@bongos/core 1.19.657 → 1.19.658

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.657",
-  "core_contract": "1.19.657",
-  "source_commit": "df6745d989dbb792638e137056792cbccc9a8b79",
+  "core_version": "1.19.658",
+  "core_contract": "1.19.658",
+  "source_commit": "116ba7cf659c5768b1e7ce2196e38becb98d2654",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T00:32:43.937Z",
+  "built_at": "2026-09-11T00:39:52.368Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 472,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2608,
-  "tree_sha256": "b43a96d39ddf0e48c70fd3e7c379d14babb9b9ce1aea288334cff68ccea020ae",
+  "tree_sha256": "c480f8fa183ff4de3cbfefdfe804fe219ab875a0c873e4d9dc8ed1322652e3ae",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -1407,7 +1407,7 @@
     {
       "path": "docs/adr/0182-project-visibility-two-axes.md",
       "mode": "0000644",
-      "sha256": "273133f1ce79a6e67b3beaa6d993c7aa3dda23daba0beeb2e9aedf9250152e6f"
+      "sha256": "5c81ca2fe6d92058039999c0d5e38b67cfdaa795ba227e341b2339bbf20815d5"
     },
     {
       "path": "docs/adr/0183-criteria-close-themselves.md",
@@ -2782,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "30e50ad812fbd62e09e32fb977c1d7aa42c0194093d450c9c661fc19204f4886"
+      "sha256": "08320e0ddfd04ab34b258eb3c6e2c4700c5cc209d76efb8becf7c9f65149678b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7747,12 +7747,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "05fcd3220a2ad25694768e35623a7473f325c255adfe9ef104921ddf00335cd8"
+      "sha256": "b64a9a59bb6257652b417c5a8c52b901d02915ae5d565b728e29b01f73ee5b01"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "35c2b2c47af84616bb58e2578e523d71377d4e89f70611ecd038f2f983973b1f"
+      "sha256": "0c28879af088fa3615bb534b1d545e909d712b2c5676e5f4a6140410c43b21e2"
     },
     {
       "path": "public-docs/index.html",
@@ -8192,7 +8192,7 @@
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
       "mode": "0000644",
-      "sha256": "f64905f88718e5617ee97584dada757367497eed350bfb41814d257c9d2ec680"
+      "sha256": "ff21b52ecfe355ce19d7bf576880dfe1b561ffe33664a9a6ec06ccc704425f1d"
     },
     {
       "path": "scripts/gds/fitness-checks-write-validation.js",
@@ -8212,7 +8212,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "b30c5c2b3bf6465a63a7124327ad40f94987088d1d87fcc110fec9281539a0a1"
+      "sha256": "d6120a5427f9053529639cf15a59bad0afae9602d5a1e8301017f3321493038b"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9342,13 +9342,18 @@
     {
       "path": "src/bongos/platform-visibility-gate.js",
       "mode": "0000644",
-      "sha256": "46a0c76cb57b8d1b65efbcd53b46302e8d4e7ad070f67bc3f4d43c71c8d8d56b"
+      "sha256": "eea15ebe44e9450f2d62040c239828008e8953ea5ee465085d5f0e8e63fe6233"
     },
     {
       "path": "src/bongos/pool.js",
       "mode": "0000644",
       "sha256": "c9edcf9cb1f027ca122388beabae488d2b771b9e7aee2cd12fbdb48ea6f0ded8"
     },
+    {
+      "path": "src/bongos/prelaunch-gate.js",
+      "mode": "0000644",
+      "sha256": "16da458f537d9eaf55675fab8aab71f537882c1630baa02d2795f32f6a52454e"
+    },
     {
       "path": "src/bongos/project-door.js",
       "mode": "0000644",
@@ -9472,12 +9477,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "969494ec8a6730aa5d40c5c1bf046e8dbbdcae15f81b835658f710cdf8dc87af"
-    },
-    {
-      "path": "src/bongos/stealth-gate.js",
-      "mode": "0000644",
-      "sha256": "3f105bd9c578d320a5b88cf4cebb69c63c16f7b7f81dbeb554a78d00461ca97c"
+      "sha256": "b388de4de8993892d26a1a456eda30deb87a95cf4f64e262cb6541e04495c43d"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9507,7 +9507,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2e2947487ed6bf9aafb2fde05a00bc134e89142ad2f1ad1c448ac180473dc01b"
+      "sha256": "25384d0eebd630303512971574f4bbdfa1aebc9680705bff64a34c6dc6e1b4d5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11874,6 +11874,11 @@
       "mode": "0000644",
       "sha256": "9f16091a8feeaef9e4350104dbc9671fab6f2b53f99fd82f798c77800e780b61"
     },
+    {
+      "path": "tests/prelaunch_gate.mjs",
+      "mode": "0000644",
+      "sha256": "53bdf7b9e0f09b4abab2c83ed77d48bd4ecd29f2b82afecc78dd694d5b36bc9f"
+    },
     {
       "path": "tests/preview_server.mjs",
       "mode": "0000644",
@@ -12734,11 +12739,6 @@
       "mode": "0000644",
       "sha256": "aa1d79bb3f900097a911c8c6b3055debe4bb20bfe2c3d6c8c64cfd8d7688824e"
     },
-    {
-      "path": "tests/stealth_gate.mjs",
-      "mode": "0000644",
-      "sha256": "bb264253e2a9c233734cf9273928db203f8f441c4e7a53f5f9ae5ea0477e20e3"
-    },
     {
       "path": "tests/stop_refcheck.mjs",
       "mode": "0000644",

package/docs/adr/0182-project-visibility-two-axes.md

@@ -150,7 +150,15 @@ Stealth's distinction from private is **at the door, not in the queue**: a refus
 
 **Decision:** the *product* meaning (the owner-facing state, whose orb metaphor is locked by the criterion) keeps the word. The infra gate is the one that should be renamed — to `prelaunch` — but that touches a protected path, an env var, and a live instance's configuration, so it is **not** decided here by an ADR about visibility. It is filed as its own task with the owner's call attached.
 
-Until then: `stealth` unqualified in product code and copy means the project state. The infra gate is referred to as the **pre-launch gate** in prose even while its identifier still says stealth.
+**RESOLVED — the rename was taken** (owner, 2026-09-09 backlog review of goal [#1000111](https://cloudbongos.com/builders#/goal/1000111); executed by task [#1003152](https://cloudbongos.com/builders#/task/1003152)). This paragraph is kept rather than rewritten, because the open question is part of the record: what follows is what the rename actually did, not what it promised.
+
+- `src/bongos/stealth-gate.js` → **`src/bongos/prelaunch-gate.js`**; `stealthGate()` → `prelaunchGate()`. The ~16 files carrying the PRODUCT sense are untouched, exactly as this decision says they must be.
+- **`PRELAUNCH_PASSWORD` is primary; `STEALTH_PASSWORD` is honoured as a deprecated alias**, with a one-time startup warning when only the old name is set. The env is read in exactly one place, so honouring both is a single expression — and it had to be: `STEALTH_PASSWORD` is set on live today, and a rename that did not read it would be an instant, total outage of the instance. Dropping the alias is a separate, later task, and must not run until the live instance has `PRELAUNCH_PASSWORD` set.
+- The submit path is **`/__prelaunch`**, with `/__stealth` still accepted and still exempt, so a form already open when the rename deployed still works.
+- **Three identifiers deliberately did NOT move** — the cookie `cb_stealth`, the HMAC label `stealth-v1`, and the legacy path above. The first two are keyed into live cookies: <redacted> either forces every holder to re-enter the password and buys nothing, because neither string is ever read by a human. One is wire format, the other an HMAC message; neither is vocabulary.
+- A fitness check in the ADR 0174 family (**check 19d**, `checkPrelaunchVocabulary`) now keeps the word from drifting back into the infra surface, scoped so the product surface's legitimate `stealth` never trips it. Per ADR 0174's own lesson it carries mutation tests: plant a violation, prove the build reds.
+
+The last sentence of this decision is therefore now spent — `stealth` unqualified means the project state, and the infra gate says `prelaunch` in its identifiers as well as in prose.
 
 ## Consequences
 

package/docs/module-api-changelog.md

@@ -1763,5 +1763,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.655 with no explicit bump. run 34546461767. (task 1002620)
   1.19.657 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.656 with no explicit bump. run 34546894776. (task 1002620)
+  1.19.658 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.657 with no explicit bump. run 34547406494. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.657",
+  "version": "1.19.658",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.657",
+      "version": "1.19.658",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.657",
+  "version": "1.19.658",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-vocabulary.js

@@ -298,11 +298,85 @@ function checkGovernmentRenameIdentity() {
 }
 
 
+// ── Check 19d — "stealth" is the PRODUCT's word, not the gate's (task 1003152) ─
+//
+// The third vocabulary wall, and the same defect as ADR 0174's "role": one word,
+// two live meanings, close to OPPOSITE. `platform_identity_projects.visibility =
+// 'stealth'` is a project that IS on the public orbs map — anonymous, rendered as
+// a black hole, refusing applications, but published and visible; only its
+// identity is withheld. The pre-launch gate is the reverse: the whole instance is
+// UNREADABLE without a password. ADR 0182 locks the product sense to the orb
+// metaphor via goal 1000046's own criterion, so the PRODUCT keeps the word and
+// the INFRA half renamed (owner decision, 2026-09-09).
+//
+// SCOPED TO THE INFRA SURFACE, for the same reason check 19 is scoped to the
+// government surface: ~16 files carry the product sense legitimately, and a
+// repo-wide ban would have to allowlist every one of them — an allowlist longer
+// than the rule. The honest unit is a SURFACE.
+//
+// NO ALLOWLIST. Two exemptions, both properties of a line rather than a file:
+// a line naming one of the four documented COMPATIBILITY identifiers (the live
+// cookie, the HMAC label, the legacy submit path, the deprecated env var — see
+// prelaunch-gate.js's header for why each stayed), and a line CITING the rename
+// or the other meaning. Everything else is drift.
+// tests/prelaunch_gate.mjs is deliberately NOT here, the same way check 19's
+// mutation test sits outside the government surface: that file's job includes
+// PLANTING the banned word to prove the rule can fail, and a wall that forbids
+// its own negative test can only be satisfied by deleting the evidence.
+const PRELAUNCH_SURFACE = [
+  'src/bongos/prelaunch-gate.js',
+  'src/bongos/platform-visibility-gate.js',
+];
+// serve-internal.js is 1,500+ lines and mounts every surface on the instance;
+// scanning it whole would drag in prose about the product's visibility. The
+// lines that name the GATE are the only ones that can regress here.
+const PRELAUNCH_LINE_SCOPED = [
+  { file: 'src/bongos/serve-internal.js', mustMention: /prelaunch|PRE-LAUNCH/i },
+];
+const PRELAUNCH_COMPAT = /cb_stealth|stealth-v1|__stealth|STEALTH_PASSWORD/;
+const PRELAUNCH_CITATION = /task 1003152|ADR 0182|stealth-gate\.js|platform_identity_projects/;
+
+function checkPrelaunchVocabulary() {
+  const violations = [];
+  let scanned = 0;
+  const scanFile = (rel, lineFilter = null) => {
+    const abs = path.join(CORE_ROOT, rel);
+    let src;
+    try { src = fs.readFileSync(abs, 'utf8'); } catch { return; }
+    scanned += 1;
+    src.split('\n').forEach((line, i) => {
+      if (lineFilter && !lineFilter.test(line)) return;
+      if (!/stealth/i.test(line)) return;
+      if (PRELAUNCH_COMPAT.test(line)) return;
+      if (PRELAUNCH_CITATION.test(line)) return;
+      violations.push(`${rel}:${i + 1}: "stealth" — on the pre-launch surface the word is PRELAUNCH. `
+        + '"stealth" belongs to the PRODUCT\'s visibility axis (ADR 0182), which means almost the opposite.'
+        + `  →  ${line.trim().slice(0, 90)}`);
+    });
+  };
+  for (const rel of PRELAUNCH_SURFACE) scanFile(rel);
+  for (const { file, mustMention } of PRELAUNCH_LINE_SCOPED) scanFile(file, mustMention);
+  return {
+    name: 'the pre-launch gate is PRELAUNCH; "stealth" is the product\'s word (task 1003152)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} pre-launch-surface file(s) scanned (${PRELAUNCH_SURFACE.length} whole plus `
+        + `${PRELAUNCH_LINE_SCOPED.length} line-scoped to the lines naming the gate); no allowlist — `
+        + 'a documented compatibility identifier or a line CITING the rename are the only exemptions.',
+  };
+}
+
 module.exports = {
   GOAL_VOCAB_CITATION,
   GOAL_VOCAB_LINE_SCOPED,
   GOAL_VOCAB_SURFACE,
   LIFECYCLE_DB_FILES,
+  PRELAUNCH_CITATION,
+  PRELAUNCH_COMPAT,
+  PRELAUNCH_LINE_SCOPED,
+  PRELAUNCH_SURFACE,
   RENAME_IDENTITY_RE,
   VOCAB_ALLOW,
   VOCAB_BANNED,
@@ -312,6 +386,7 @@ module.exports = {
   VOCAB_SURFACE,
   checkGoalMembershipVocabulary,
   checkGovernmentRenameIdentity,
+  checkPrelaunchVocabulary,
   checkVocabularyWall,
   vocabFilesToScan,
 };

package/scripts/gds/fitness.js

@@ -36,7 +36,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
-const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
+const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, PRELAUNCH_SURFACE, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkPrelaunchVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
 // ============================================================================
 // Check 1 — core ↔ host/game import boundary (ADR 0062 §1 cut-line)
 // ============================================================================
@@ -1374,7 +1374,7 @@ const CHECKS = [
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
   checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
   checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
-  checkGovernmentRenameIdentity, // Check 19c — task 1003120: `X` → `X`, the rename arrow a sweep ate both sides of (the shape checks 19/19b are blind to)
+  checkGovernmentRenameIdentity, checkPrelaunchVocabulary, // 19c task 1003120 (`X`→`X` rename arrow) + 19d task 1003152 ("stealth" is the product's word) — sharing a line: this file is AT the 1,500 budget (Check 23/24 precedent below; task 1003825 buys it back)
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
   require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
@@ -1436,7 +1436,7 @@ if (require.main === module) main();
 
 module.exports = {
   checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
-  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, // 19c — task 1003120
+  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, checkPrelaunchVocabulary, PRELAUNCH_SURFACE, // 19c task 1003120, 19d task 1003152
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/src/bongos/platform-visibility-gate.js

@@ -24,8 +24,8 @@
 //   - What a member is shown must not be cached for a stranger: a passed
 //     response leaves marked private, whatever the route behind it said.
 //
-// It is NOT the pre-launch gate (stealth-gate.js): that one is a shared
-// password for an unannounced instance, inert unless STEALTH_PASSWORD is set,
+// It is NOT the pre-launch gate (prelaunch-gate.js): that one is a shared
+// password for an unannounced instance, inert unless PRELAUNCH_PASSWORD is set,
 // and it mounts first. This one is a per-project policy with accounts behind it.
 // Both can be on at once; each refuses on its own terms.
 
@@ -67,7 +67,9 @@ const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
 //   /downloads/*         the installer script and the Dev Box updater — a
 //                        cookie-less `curl … | sh`, and release redirects carry
 //                        no project data.
-//   /__stealth           the pre-launch gate's own submit, when both gates are on.
+//   /__prelaunch         the pre-launch gate's own submit, when both gates are on.
+//                        /__stealth is its pre-rename alias (task 1003152) and is
+//                        exempt for as long as the gate still accepts it.
 const EXEMPT = [
   new RegExp(`^${API}/auth(/|$)`),
   new RegExp(`^${API}/instance$`),
@@ -76,6 +78,7 @@ const EXEMPT = [
   /^\/healthz$/,
   /^\/version$/,
   /^\/metrics$/,
+  /^\/__prelaunch$/,
   /^\/__stealth$/,
   /^\/downloads\//,
 ];
@@ -127,7 +130,7 @@ function signInHref(req) {
 }
 
 // One leading slash, no '//' (protocol-relative), no backslash, no control
-// bytes — the stealth gate's rule; anything else returns to '/'.
+// bytes — the pre-launch gate's rule; anything else returns to '/'.
 function relativeReturn(raw) {
   if (typeof raw !== 'string' || !raw.length || raw.length > 512) return null;
   if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return null;

package/src/bongos/{stealth-gate.js → prelaunch-gate.js}

@@ -1,4 +1,31 @@
-// src/bongos/stealth-gate.js — the pre-launch stealth gate (task 1002775).
+// src/bongos/prelaunch-gate.js — the instance PRE-LAUNCH gate (task 1002775).
+//
+// ── THE NAME (task 1003152, owner decision 2026-09-09; ADR 0182 Decision 7) ──
+//
+// This was `stealth-gate.js` and it collided head-on with the OTHER live meaning
+// of the word. `platform_identity_projects.visibility = 'stealth'` is a project
+// that IS on the public orbs map — rendered as a black hole, anonymous, refusing
+// applications, but published and visible; only its identity is withheld. This
+// gate is close to the opposite: the whole instance is UNREADABLE without the
+// password. Same class of defect as ADR 0174's "role", which is why the rename
+// lives in the government goal.
+//
+// The PRODUCT meaning keeps the word — ADR 0182 locks it to the orb metaphor via
+// goal 1000046's own criterion, and the ~16 files carrying that sense are
+// deliberately untouched. Renaming those would have been the actual mistake.
+//
+// THREE IDENTIFIERS DID NOT MOVE, and each one is a deliberate choice, not a
+// missed occurrence (the vocabulary check below knows them by name):
+//
+//   • the cookie `cb_stealth` and the HMAC label `stealth-v1` — both are keyed
+//     INTO live cookies. Renaming either invalidates every outstanding cookie on
+//     a running instance and forces every holder to re-enter the password, to
+//     buy nothing: neither string is ever read by a human. The cookie name is
+//     wire format and the label is an HMAC message, not vocabulary.
+//   • `/__stealth` — the submit path. `/__prelaunch` is what the form posts to
+//     now; the old path is still accepted and still exempt, so a form already
+//     open in somebody's tab when this deploys still works instead of 401ing
+//     them back to the start.
 //
 // An instance that is built but not announced needs a door that is shut without
 // being broken. The proxy can do that with basic_auth, and task 1002774 did
@@ -11,8 +38,11 @@
 // So the gate lives in the app, where it can set a cookie the browser will send
 // to every subdomain:
 //
-//   - It is INERT unless STEALTH_PASSWORD is set. That is the portable default:
-//     a vanilla instance has no gate and needs no config to not have one.
+//   - It is INERT unless PRELAUNCH_PASSWORD is set. That is the portable
+//     default: a vanilla instance has no gate and needs no config to not have
+//     one. STEALTH_PASSWORD is honoured as a deprecated alias — it is SET ON
+//     LIVE today, and a rename that did not read the old name would be an
+//     instant outage.
 //   - The cookie is a SESSION cookie — no Max-Age, no Expires — because the
 //     owner explicitly did not want it to outlive the browser. That is also the
 //     safer default: nothing is written to disk to be found later.
@@ -35,8 +65,15 @@
 const crypto = require('node:crypto');
 const { branding } = require('../branding');
 
+// Wire format, deliberately unrenamed — see the header. Both are keyed into
+// cookies that are live right now.
 const COOKIE = 'cb_stealth';
-const SUBMIT_PATH = '/__stealth';
+const HMAC_LABEL = 'stealth-v1';
+
+const SUBMIT_PATH = '/__prelaunch';
+// Accepted for as long as a form served before the rename might still be open.
+const LEGACY_SUBMIT_PATH = '/__stealth';
+const SUBMIT_PATHS = [SUBMIT_PATH, LEGACY_SUBMIT_PATH];
 
 // Paths that must answer even to a stranger, each for its own reason:
 //   /api/*    the GitHub OAuth round trip has to complete, and a gated callback
@@ -45,19 +82,37 @@ const SUBMIT_PATH = '/__stealth';
 //   /metrics  Prometheus, already access-gated on its own terms (loopback or
 //             bearer token) — double-gating it would break the scrape
 //   /version  the deploy pin check, a public commit sha
-const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__stealth$/];
+const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__prelaunch$/, /^\/__stealth$/];
 
+// PRELAUNCH_PASSWORD is primary; STEALTH_PASSWORD is the deprecated alias. This
+// is the ONE read site for either, which is what makes honouring both a single
+// expression rather than a migration — and why the rename could be taken at all
+// without an outage window on a live instance already running the old name.
 function password() {
-  const p = process.env.STEALTH_PASSWORD;
+  const p = process.env.PRELAUNCH_PASSWORD || process.env.STEALTH_PASSWORD;
   return typeof p === 'string' && p.length ? p : null;
 }
 
+// Named once at mount, never per request: a warning on every gated request would
+// be a log flood on exactly the instance that is hardest to look at. Dropping the
+// alias is a separate, later task — this only makes the deprecation audible.
+function warnIfLegacyEnv(log = console.warn) {
+  const hasNew = typeof process.env.PRELAUNCH_PASSWORD === 'string' && process.env.PRELAUNCH_PASSWORD.length;
+  const hasOld = typeof process.env.STEALTH_PASSWORD === 'string' && process.env.STEALTH_PASSWORD.length;
+  if (hasNew || !hasOld) return false;
+  log('[prelaunch-gate] STEALTH_PASSWORD is DEPRECATED and still the only password set. '
+    + 'Set PRELAUNCH_PASSWORD to the same value (task 1003152); the old name is read for now '
+    + 'and will be dropped in a later task.');
+  return true;
+}
+
 function enabled() { return password() !== null; }
 
 // The token a valid cookie must carry. Keyed by the password, so the password
 // itself never leaves the server and a rotation invalidates every cookie.
+// HMAC_LABEL is deliberately still 'stealth-v1' — see the header.
 function expectedToken() {
-  return crypto.createHmac('sha256', password()).update('stealth-v1').digest('hex');
+  return crypto.createHmac('sha256', password()).update(HMAC_LABEL).digest('hex');
 }
 
 function tokenMatches(raw) {
@@ -118,7 +173,7 @@ function relativeReturn(raw) {
   if (typeof raw !== 'string' || !raw.length || raw.length > 512) return null;
   if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return null;
   if (/[\x00-\x1f\x7f]/.test(raw)) return null;
-  if (raw === '/' || raw.startsWith(SUBMIT_PATH)) return null;
+  if (raw === '/' || SUBMIT_PATHS.some((p) => raw.startsWith(p))) return null;
   return raw;
 }
 
@@ -178,11 +233,12 @@ function productName() {
 
 // Mounted FIRST, ahead of every other surface — a route registered earlier would
 // answer before the gate ever ran.
-function stealthGate() {
-  return function stealth(req, res, next) {
+function prelaunchGate() {
+  warnIfLegacyEnv();
+  return function prelaunch(req, res, next) {
     if (!enabled()) return next();
 
-    if (req.method === 'POST' && req.path === SUBMIT_PATH) {
+    if (req.method === 'POST' && SUBMIT_PATHS.includes(req.path)) {
       // The form is urlencoded; body parsers mount later (and only on some
       // routers), so read it here rather than depending on middleware order.
       let body = '';
@@ -226,4 +282,7 @@ function stealthGate() {
   };
 }
 
-module.exports = { stealthGate, enabled, isExempt, tokenMatches, expectedToken, COOKIE, SUBMIT_PATH };
+module.exports = {
+  prelaunchGate, enabled, isExempt, tokenMatches, expectedToken, warnIfLegacyEnv,
+  COOKIE, HMAC_LABEL, SUBMIT_PATH, LEGACY_SUBMIT_PATH, SUBMIT_PATHS,
+};

package/src/bongos/serve-internal.js

@@ -47,7 +47,7 @@ const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding } = require('../branding');
-const { stealthGate } = require('./stealth-gate');
+const { prelaunchGate } = require('./prelaunch-gate');
 const { platformVisibilityGate } = require('./platform-visibility-gate');
 const { clientModules, isModuleEnabled } = require('../modules');
 const { hallWidgetScripts, moduleWebSurfaces } = require('../module-loader/loader');
@@ -494,15 +494,15 @@ function mountInternalSurfaces(app) {
   // game routes too) — it records on res 'finish' regardless of which handler
   // answers. The /metrics scrape endpoint is access-gated (loopback Prometheus
   // or Bearer METRICS_TOKEN; see metrics.authorizeScrape).
-  // THE STEALTH GATE (task 1002775) mounts before anything it is meant to
+  // THE PRE-LAUNCH GATE (task 1002775) mounts before anything it is meant to
   // cover — a surface registered earlier would answer first and the gate would
-  // never run. Inert unless STEALTH_PASSWORD is set, so a vanilla instance is
+  // never run. Inert unless PRELAUNCH_PASSWORD is set, so a vanilla instance is
   // unaffected and pays only a closure call per request.
   //
   // It sits ABOVE the metrics middleware deliberately: a refused knock is still
   // a request this instance served, and hiding gate 401s would make the traffic
   // graph lie about how much attention an unannounced instance is getting.
-  app.use(stealthGate());
+  app.use(prelaunchGate());
 
   app.use(metrics.httpMiddleware());
   app.get('/metrics', metrics.metricsHandler());

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.657'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.658'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/{stealth_gate.mjs → prelaunch_gate.mjs}

@@ -1,4 +1,4 @@
-// tests/stealth_gate.mjs — the pre-launch stealth gate (task 1002775).
+// tests/prelaunch_gate.mjs — the instance pre-launch gate (task 1002775).
 //
 // A gate that is wrong in either direction is worse than no gate: too open and
 // the unannounced instance is readable; too closed and it locks out sign-in,
@@ -6,7 +6,7 @@
 // gate's whole job is to sit in front of surfaces registered elsewhere — a unit
 // test of the middleware alone could not prove it was mounted early enough.
 //
-// Run:  node --test tests/stealth_gate.mjs
+// Run:  node --test tests/prelaunch_gate.mjs
 
 import assert from 'node:assert/strict';
 import { test, before, after } from 'node:test';
@@ -16,9 +16,9 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
 const PASSWORD = 'a-test-password';
-process.env.STEALTH_PASSWORD = PASSWORD;   // set BEFORE the app is built
+process.env.PRELAUNCH_PASSWORD = PASSWORD;   // set BEFORE the app is built
 
-const gate = require('../src/bongos/stealth-gate.js');
+const gate = require('../src/bongos/prelaunch-gate.js');
 const platformMod = require('../src/platform-server.js');
 
 let server, port;
@@ -74,7 +74,7 @@ test('the form leaks nothing about the product it is hiding', async () => {
 
 test('every human surface is gated, not just the front page', async () => {
   // the old proxy lock covered '/' but not '/projects', so the hub leaked for
-  // the whole stealth period — that regression must be impossible here
+  // the whole pre-launch period — that regression must be impossible here
   for (const p of ['/', '/projects', '/create', '/builders', '/docs']) {
     const res = await request(p);
     assert.equal(res.status, 401, `${p} must be gated`);
@@ -209,9 +209,9 @@ test('a forged or stale cookie does not open it', async () => {
 
 test('rotating the password invalidates outstanding cookies', async () => {
   const old = validCookie();
-  process.env.STEALTH_PASSWORD = 'a-different-password';
+  process.env.PRELAUNCH_PASSWORD = 'a-different-password';
   const res = await request('/', { cookie: old });
-  process.env.STEALTH_PASSWORD = PASSWORD;
+  process.env.PRELAUNCH_PASSWORD = PASSWORD;
   assert.equal(res.status, 401, 'the token is keyed by the password, so a rotation revokes');
 });
 
@@ -219,16 +219,145 @@ test('an oversized POST body is dropped rather than buffered', async () => {
   // a password is not a payload — the handler reads the body itself, so it must
   // bound it or it is a trivial memory sink on an unauthenticated endpoint
   const src = require('node:fs').readFileSync(
-    new URL('../src/bongos/stealth-gate.js', import.meta.url), 'utf8');
+    new URL('../src/bongos/prelaunch-gate.js', import.meta.url), 'utf8');
   assert.match(src, /body\.length > \d+/, 'the body read must be bounded');
   assert.match(src, /req\.destroy\(\)/);
 });
 
 test('the gate is inert when no password is configured', () => {
   // the portable default: a vanilla instance has no gate and needs no config
-  // to not have one
+  // to not have one. BOTH names must be clear — an alias that kept the gate up
+  // after the primary was unset would be the same bug in reverse.
+  delete process.env.PRELAUNCH_PASSWORD;
   delete process.env.STEALTH_PASSWORD;
   assert.equal(gate.enabled(), false);
-  process.env.STEALTH_PASSWORD = PASSWORD;
+  process.env.PRELAUNCH_PASSWORD = PASSWORD;
   assert.equal(gate.enabled(), true);
 });
+
+// ── the rename's compatibility surface (task 1003152) ───────────────────────
+//
+// STEALTH_PASSWORD is SET ON LIVE cloudbongos.com right now. A rename that did
+// not read the old name would be an instant, total outage of the instance — so
+// these are the tests that make the rename safe to deploy, not nice-to-haves.
+
+test('the DEPRECATED STEALTH_PASSWORD alone still opens the gate', async () => {
+  delete process.env.PRELAUNCH_PASSWORD;
+  process.env.STEALTH_PASSWORD = PASSWORD;
+  try {
+    assert.equal(gate.enabled(), true, 'an instance running only the old name must not go dark');
+    // and the cookie it mints is the same one, because the HMAC label did not move
+    const res = await request('/', { cookie: `${gate.COOKIE}=${gate.expectedToken()}` });
+    assert.equal(res.status, 200, 'a cookie held across the rename must still be honoured');
+  } finally {
+    delete process.env.STEALTH_PASSWORD;
+    process.env.PRELAUNCH_PASSWORD = PASSWORD;
+  }
+});
+
+test('PRELAUNCH_PASSWORD wins when both are set', () => {
+  const fromNewNameAlone = gate.expectedToken();   // PRELAUNCH_PASSWORD only
+  process.env.STEALTH_PASSWORD = 'the-old-one';
+  try {
+    assert.equal(gate.expectedToken(), fromNewNameAlone,
+      'the primary name is primary — an operator who sets the new one and forgets '
+      + 'to clear the old must get the value they just wrote, not the stale one');
+  } finally {
+    delete process.env.STEALTH_PASSWORD;
+  }
+});
+
+test('running on the old name alone warns once, at mount', () => {
+  const lines = [];
+  const log = (m) => lines.push(String(m));
+  delete process.env.PRELAUNCH_PASSWORD;
+  process.env.STEALTH_PASSWORD = PASSWORD;
+  try {
+    assert.equal(gate.warnIfLegacyEnv(log), true, 'the deprecation must be audible');
+    assert.match(lines.join('\n'), /PRELAUNCH_PASSWORD/, 'the warning must name the replacement');
+  } finally {
+    delete process.env.STEALTH_PASSWORD;
+    process.env.PRELAUNCH_PASSWORD = PASSWORD;
+  }
+  // silent once the new name is set — nobody needs a warning they have acted on
+  assert.equal(gate.warnIfLegacyEnv(log), false);
+});
+
+test('both submit paths are accepted, and both are exempt', async () => {
+  // A form served before the rename may still be open in somebody's tab. The old
+  // path keeps working so their password lands them in, not on a 401.
+  assert.equal(gate.SUBMIT_PATH, '/__prelaunch');
+  assert.equal(gate.LEGACY_SUBMIT_PATH, '/__stealth');
+  for (const p of gate.SUBMIT_PATHS) {
+    assert.equal(gate.isExempt(p), true, `${p} must be exempt or the submit is gated behind itself`);
+    const res = await request(p, { method: 'POST', body: `password=${encodeURIComponent(PASSWORD)}` });
+    assert.equal(res.status, 303, `POST ${p} must accept the password`);
+    assert.match(String(res.headers['set-cookie'] || ''), new RegExp(gate.COOKIE),
+      `POST ${p} must mint the cookie`);
+  }
+});
+
+test('the wire format did NOT move — renaming it would log everyone out', () => {
+  // Deliberate, and the reason it is pinned: the cookie name and the HMAC label
+  // are baked into cookies that are live right now. A later "finish the rename"
+  // pass that changes either forces every holder to re-enter the password, to
+  // buy nothing — neither string is ever read by a human.
+  assert.equal(gate.COOKIE, 'cb_stealth');
+  assert.equal(gate.HMAC_LABEL, 'stealth-v1');
+});
+
+// ── the vocabulary wall around the rename (check 19d, task 1003152) ─────────
+//
+// ADR 0174's lesson, applied: a naming rule is the easiest kind of check to ship
+// broken — allowlist enough and it passes forever while proving nothing. So the
+// load-bearing tests are the MUTATION tests. A rule that cannot be made to fail
+// is not a rule.
+
+const fitness = require('../scripts/gds/fitness.js');
+
+test('the pre-launch surface is clean today', () => {
+  const r = fitness.checkPrelaunchVocabulary();
+  assert.equal(r.ok, true, `check 19d is failing on the real tree:\n${r.violations.join('\n')}`);
+  assert.ok(r.note.includes('file(s) scanned'), 'the check must report what it scanned');
+});
+
+test('a planted "stealth" on the pre-launch surface REDS the build', () => {
+  assert.ok(plantInGate('// the stealth gate mounts here').some((v) => /"stealth"/.test(v)),
+    'the retired word must be caught, or the rename un-does itself one comment at a time');
+});
+
+test('a documented COMPATIBILITY identifier is not a violation', () => {
+  // The four that deliberately stayed. Catching these would force an allowlist,
+  // which is what the citation/compat split exists to avoid.
+  for (const line of ["const c = 'cb_stealth';", "hmac('stealth-v1');",
+    "path === '/__stealth'", 'process.env.STEALTH_PASSWORD']) {
+    assert.equal(plantInGate(line).length, 0, `the compat identifier tripped the wall: ${line}`);
+  }
+});
+
+test('a line CITING the rename or the other meaning may say the word', () => {
+  for (const line of ['// renamed from stealth-gate.js (task 1003152)',
+    "// platform_identity_projects.visibility = 'stealth' is the OTHER meaning"]) {
+    assert.equal(plantInGate(line).length, 0, `a citation tripped the wall: ${line}`);
+  }
+});
+
+test('the citation does NOT excuse the rest of the file', () => {
+  // The header cites task 1003152 on its own line. If the exemption were
+  // file-scoped rather than line-scoped, every later line would ride it.
+  assert.ok(plantInGate('// bring back the stealth wording').length > 0,
+    'an uncited line must still red — a file-wide exemption is an allowlist wearing a regex');
+});
+
+// Plant a line into the real gate file, run the real check, restore.
+function plantInGate(line) {
+  const fs = require('node:fs');
+  const target = new URL('../src/bongos/prelaunch-gate.js', import.meta.url);
+  const original = fs.readFileSync(target, 'utf8');
+  try {
+    fs.writeFileSync(target, `${original}\n${line}\n`);
+    return fitness.checkPrelaunchVocabulary().violations;
+  } finally {
+    fs.writeFileSync(target, original);
+  }
+}