@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0067-session-start-fast-forward-pull.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-19
 - **Track:** internal
-- **Builds on:** the warn-only freshness step ([#1258]) it replaces; the dev-box source-materialization cron (`infra/box-source-fetch.sh`, [ADR 0031](<redacted>.md)); the existing memory pull-on-session-start (`.claude/hooks/pull-memory.js`, [#275]) whose best-effort/fail-open discipline this mirrors for the code checkout.
+- **Builds on:** the warn-only freshness step ([#1258]) it replaces; the dev-box source-materialization cron (`infra/box-source-fetch.sh`, [ADR 0031](0031-cloud-dev-environments-for-builders.md)); the existing memory pull-on-session-start (`.claude/hooks/pull-memory.js`, [#275]) whose best-effort/fail-open discipline this mirrors for the code checkout.
 - **Task:** [#1277](https://example.com/builders#/task/1277) — owner request ("make sure we pull on every session start").
 
 ## Context

package/docs/adr/0068-shared-art-key-for-newcomers.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-20
 - **Track:** internal
-- **Builds on:** [ADR 0016](<redacted>.md) (rank enforced server-side, no caching — the gate here is `builders.rank`), [ADR 0054](<redacted>.md) (cost-plus economics — this is the org choosing to absorb newcomer art spend), and the existing per-builder BYOK key path in `art/pipeline/gen_api.py` (V3.R11 [#91](https://example.com/builders#/task/91))
+- **Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (rank enforced server-side, no caching — the gate here is `builders.rank`), [ADR 0054](0054-session-token-reward-cost-plus.md) (cost-plus economics — this is the org choosing to absorb newcomer art spend), and the existing per-builder BYOK key path in `art/pipeline/gen_api.py` (V3.R11 [#91](https://example.com/builders#/task/91))
 - **Task:** [#1281](https://example.com/builders#/task/1281)
 
 ## Context

package/docs/adr/0069-hall-live-channel-sse-decouple.md

@@ -2,13 +2,13 @@
 
 - **Status:** Accepted
 - **Date:** 2026-06-20
-- **Deciders:** task [#1194](https://example.com/builders#/task/1194) (V4.R55) — part of the Cloud Bongos standalone-instance work (C8, [ADR 0062](<redacted>.md))
+- **Deciders:** task [#1194](https://example.com/builders#/task/1194) (V4.R55) — part of the Cloud Bongos standalone-instance work (C8, [ADR 0062](0062-medusa-instance-model-decoupling.md))
 - **Track:** `internal` (the builders hall)
-- **Supersedes:** the *transport* decision of [ADR 0030](<redacted>.md) §2 (WebSocket/Colyseus). The change-signal layer of ADR 0030 (Postgres `NOTIFY` + `src/bongos/live-channel.js`) is **unchanged** and still authoritative.
+- **Supersedes:** the *transport* decision of [ADR 0030](0030-builders-hall-live-updates.md) §2 (WebSocket/Colyseus). The change-signal layer of ADR 0030 (Postgres `NOTIFY` + `src/bongos/live-channel.js`) is **unchanged** and still authoritative.
 
 ## Context
 
-[ADR 0030](<redacted>.md) gave the hall live updates in two layers: a transport-agnostic change-signal (a statement-level `NOTIFY` trigger relayed by one persistent `LISTEN` connection in `live-channel.js`) and a **delivery transport** — a broadcast-only Colyseus room (`builders_hall`) riding the game's existing WebSocket server. ADR 0030 explicitly considered SSE, called it "arguably the textbook fit for a receive-only dashboard," and rejected it for one reason only: to **reuse the game's already-proxy-proven Colyseus stack** rather than stand up a second long-lived-connection mechanism.
+[ADR 0030](0030-builders-hall-live-updates.md) gave the hall live updates in two layers: a transport-agnostic change-signal (a statement-level `NOTIFY` trigger relayed by one persistent `LISTEN` connection in `live-channel.js`) and a **delivery transport** — a broadcast-only Colyseus room (`builders_hall`) riding the game's existing WebSocket server. ADR 0030 explicitly considered SSE, called it "arguably the textbook fit for a receive-only dashboard," and rejected it for one reason only: to **reuse the game's already-proxy-proven Colyseus stack** rather than stand up a second long-lived-connection mechanism.
 
 That reason is exactly what the Cloud Bongos decoupling (C8) removes. The GDS-only entrypoint (`src/platform-server.js`, [R51](<redacted>.md)) boots the build platform with **no Colyseus in the process**. A `builders_hall` room cannot exist there, so on a game-less instance the hall's only live feature was dead — it would freeze at load exactly as it did before ADR 0030. The transport was load-bearing on the game runtime, which a standalone Cloud Bongos instance does not have.
 

package/docs/adr/0070-deterministic-session-card-delivery.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-20
 - **Track:** internal
-- **Builds on:** the deterministic-card lineage — task 1273 (script owns the card markup, same shape every session), task 1279 (per-builder "render widgets" knob; OFF ⇒ no HTML), task 1282 (in-band `[otb-card]` relay directive so the contract doesn't live only in the skill). Hook discipline mirrors [`.claude/hooks/conductor.js`](../../.claude/hooks/conductor.js) (the `UserPromptSubmit` MAS Conductor, [ADR 0024](<redacted>.md)).
+- **Builds on:** the deterministic-card lineage — task 1273 (script owns the card markup, same shape every session), task 1279 (per-builder "render widgets" knob; OFF ⇒ no HTML), task 1282 (in-band `[otb-card]` relay directive so the contract doesn't live only in the skill). Hook discipline mirrors [`.claude/hooks/conductor.js`](../../.claude/hooks/conductor.js) (the `UserPromptSubmit` MAS Conductor, [ADR 0024](0024-multi-agent-system-architecture.md)).
 - **Task:** [#1288](https://example.com/builders#/task/1288)
 
 ## Context

package/docs/adr/0071-box-confirm-before-destroyed-and-drift-reconcile.md

@@ -1,7 +1,7 @@
 # ADR 0071 — Dev-box teardown confirms the droplet is gone before marking 'destroyed'; a bidirectional drift reconcile is the backstop
 
 **Date:** 2026-06-20
-**Context:** GDS / dev boxes, task [#1289](https://example.com/builders#/task/1289). Builds on [ADR 0031](<redacted>.md) (cloud dev environments) and [ADR 0053](0053-scoped-dev-box-session.md) (scoped dev-box session). Touches `scripts/gds/box.js`, `src/bongos/boxes.js`, `src/bongos/do-api.js`, `infra/box-drift-reconcile.{service,timer}`.
+**Context:** GDS / dev boxes, task [#1289](https://example.com/builders#/task/1289). Builds on [ADR 0031](0031-cloud-dev-environments-for-builders.md) (cloud dev environments) and [ADR 0053](0053-scoped-dev-box-session.md) (scoped dev-box session). Touches `scripts/gds/box.js`, `src/bongos/boxes.js`, `src/bongos/do-api.js`, `infra/box-drift-reconcile.{service,timer}`.
 **Status:** Accepted.
 **Track:** `internal` (development system / builder dev boxes).
 
@@ -49,7 +49,7 @@ Dry-run is the default; `--apply` executes. A new hourly timer (`infra/box-drift
 ## Alternatives considered
 
 - **Poll `getDroplet` until 404 after the DELETE.** Stronger confirmation, but adds latency + API calls; the DELETE returning 204/404 is sufficient acceptance, and `reconcile-drift` is the backstop for anything that still slips through. Rejected as over-engineering.
-- **Box-side self-termination on `NO_ACTIVE_BOX`.** A box *cannot* delete its own droplet (no DO token; the builder firewall doesn't allow-list the DO API), and `poweroff` does **not** stop DigitalOcean billing. So self-termination can't actually reclaim the droplet — only the control-plane reconcile can. The box-side loop is harmless churn; we left `box-source-fetch.sh` unchanged rather than touch a fleet-auto-installed, permission-path-sensitive script ([ADR 0043](<redacted>.md)) for no real gain.
+- **Box-side self-termination on `NO_ACTIVE_BOX`.** A box *cannot* delete its own droplet (no DO token; the builder firewall doesn't allow-list the DO API), and `poweroff` does **not** stop DigitalOcean billing. So self-termination can't actually reclaim the droplet — only the control-plane reconcile can. The box-side loop is harmless churn; we left `box-source-fetch.sh` unchanged rather than touch a fleet-auto-installed, permission-path-sensitive script ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)) for no real gain.
 - **Reconcile snapshots too.** Out of scope: a leaked snapshot is ~$0.30/mo, not SSH-reachable, and not the reported bug. The reconcile is droplet-focused, matching the task.
 
 ## Consequences

package/docs/adr/0072-bongos-app-mac-signed-first-windows-deferred.md

@@ -1,7 +1,7 @@
 # ADR 0072 — Bongos app ships Mac-signed + notarized first; Windows code signing deferred (reuse the Dev Box app's signing posture)
 
 **Date:** 2026-06-20
-**Context:** Bongos App `BONGOS-V1` / criterion C1 (signed-installable), task [#1296](https://example.com/builders#/task/1296) (`BV1.R01`). Builds on [ADR 0045](<redacted>.md) (the Dev Box desktop app) and [ADR 0004](0004-example-name-and-trademark-acceptance.md) (brand discipline). The bongos app forks the Dev Box app's Electron shell ([#1298](https://example.com/builders#/task/1298) `BV1.R03`), so it inherits that app's signing machinery; this ADR pins which parts it inherits now and which it defers.
+**Context:** Bongos App `BONGOS-V1` / criterion C1 (signed-installable), task [#1296](https://example.com/builders#/task/1296) (`BV1.R01`). Builds on [ADR 0045](0045-devbox-desktop-app.md) (the Dev Box desktop app) and [ADR 0004](0004-example-name-and-trademark-acceptance.md) (brand discipline). The bongos app forks the Dev Box app's Electron shell ([#1298](https://example.com/builders#/task/1298) `BV1.R03`), so it inherits that app's signing machinery; this ADR pins which parts it inherits now and which it defers.
 **Status:** Accepted.
 **Track:** `internal` (development system → the Cloud Bongos desktop app line; bongos succeeds the GDS after GDS-V4).
 
@@ -9,7 +9,7 @@
 
 Bongos is a floating OS toolbar that asks for **Screen Recording + Microphone** on first run. An unsigned app making those requests is treated as hostile by the OS: on macOS the permission grants may not persist across launches (and arm64 won't launch at all without at least an ad-hoc signature), and on Windows SmartScreen blocks the first launch outright. So a code-signing path is a launch gate, and `R01` exists to **decide** that path up front so packaging (`R15`/`R16`) is unblocked — not to leave it open until packaging time.
 
-The Dev Box app already walked this road ([ADR 0045](<redacted>.md)):
+The Dev Box app already walked this road ([ADR 0045](0045-devbox-desktop-app.md)):
 
 - **macOS — solved and wired.** `.github/workflows/build-devbox-app.yml` carries an *inert-until-armed* Mac signing block: with no secrets it builds unsigned (ad-hoc); arming is purely adding repo secrets (`MAC_CSC_LINK` + `MAC_CSC_KEY_PASSWORD`, plus optional `MAC_NOTARIZE_*` for notarization) — no workflow edit. The secrets are bound to the cert env vars **only on the trusted `main` ref** (the SR-13/SR-14 hardening, [#993](https://example.com/builders#/task/993)) so a `claude/**` feature branch can never exfiltrate the Developer ID cert. A post-build `dmgbuild` re-package (task [#1235](https://example.com/builders#/task/1235)) preserves notarization while fixing the install-window backdrop.
 - **Windows — never resolved.** Windows signing stays unwired pending a cert-vendor decision: blocker [#20](https://example.com/builders#/blocker/20) (Azure Trusted Signing vs. a traditional EV cert). Today Dev Box Windows users get the SmartScreen "More info → Run anyway" first-run friction, documented in the hall onboarding copy.

package/docs/adr/0072-dev-box-code-staleness-visibility.md

@@ -3,12 +3,12 @@
 - **Status:** Accepted
 - **Date:** 2026-06-20
 - **Track:** internal
-- **Builds on:** [ADR 0031](<redacted>.md) (per-builder dev boxes), the `box-source-fetch.sh` self-update machinery ([#600](https://example.com/builders#/task/600), [#985](https://example.com/builders#/task/985)), and task [#1187](https://example.com/builders#/task/1187) (the box host-key reporter — the report-up cron pattern this mirrors)
+- **Builds on:** [ADR 0031](0031-cloud-dev-environments-for-builders.md) (per-builder dev boxes), the `box-source-fetch.sh` self-update machinery ([#600](https://example.com/builders#/task/600), [#985](https://example.com/builders#/task/985)), and task [#1187](https://example.com/builders#/task/1187) (the box host-key reporter — the report-up cron pattern this mirrors)
 - **Task:** [#1316](https://example.com/builders#/task/1316) (from idea [#332](https://example.com/builders#/idea/332))
 
 ## Context
 
-A builder (LarsCode) repeatedly hit cryptic dev-box failures: the shared Gemini art key never reached the box, and Claude Desktop connect failed with "host verification failed." Both traced to **one cause — the box was running stale code.** Its box was provisioned 2026-06-07, before two features existed: the shared-art-key delivery rail ([ADR 0068](<redacted>.md), `fetch-art-key.js` + the `gen_api.py` shared tier) and the host-key reporter ([#1187](https://example.com/builders#/task/1187)).
+A builder (LarsCode) repeatedly hit cryptic dev-box failures: the shared Gemini art key never reached the box, and Claude Desktop connect failed with "host verification failed." Both traced to **one cause — the box was running stale code.** Its box was provisioned 2026-06-07, before two features existed: the shared-art-key delivery rail ([ADR 0068](0068-shared-art-key-for-newcomers.md), `fetch-art-key.js` + the `gen_api.py` shared tier) and the host-key reporter ([#1187](https://example.com/builders#/task/1187)).
 
 Investigation refined the problem. Boxes **already auto-update**: `infra/box-source-fetch.sh` runs every ~10 min and `git pull --ff-only`s `/workspace`, *and* self-updates its own baked scripts/crons ([#985](https://example.com/builders#/task/985)). So any box provisioned *after* that machinery landed self-heals. The residual gaps:
 

package/docs/adr/0073-builder-needs-signal-and-byok-gemini-key.md

@@ -3,12 +3,12 @@
 - **Status:** Accepted
 - **Date:** 2026-06-20
 - **Track:** internal
-- **Builds on:** [ADR 0068](<redacted>.md) (the shared newcomer key — this is the Phase 2 it explicitly deferred), [ADR 0016](<redacted>.md) (rank enforced server-side, no caching — the entitlement axis here), [ADR 0054](<redacted>.md) (cost-plus economics — *we pay up front* for newcomers, builders pay their own bill after)
+- **Builds on:** [ADR 0068](0068-shared-art-key-for-newcomers.md) (the shared newcomer key — this is the Phase 2 it explicitly deferred), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (rank enforced server-side, no caching — the entitlement axis here), [ADR 0054](0054-session-token-reward-cost-plus.md) (cost-plus economics — *we pay up front* for newcomers, builders pay their own bill after)
 - **Task:** [#1013](https://example.com/builders#/task/1013)
 
 ## Context
 
-[ADR 0068](<redacted>.md) shipped the *infrastructure* that hands a shared Gemini key to newcomers (rank `xenos`) so their first art task works — **we pay up front.** It closed by naming the deferred half:
+[ADR 0068](0068-shared-art-key-for-newcomers.md) shipped the *infrastructure* that hands a shared Gemini key to newcomers (rank `xenos`) so their first art task works — **we pay up front.** It closed by naming the deferred half:
 
 > the newcomer-facing *experience* (copy explaining we pay, the on-promotion walkthrough to add a personal key, a rank-aware setup prompt) is a deliberate Phase 2.
 
@@ -43,7 +43,7 @@ The owner picked "visible **and** block-at-use" (the builder can't miss it or hi
 
 ### 2. Pragmatic BYOK — the own Gemini key, server-stored and synced
 
-The own key moves from local-file-only to **encrypted server storage that becomes the source of truth**, managed in the hall Settings page, synced down to the builder's own machine at session start — the same rail [ADR 0068](<redacted>.md) built for the shared key.
+The own key moves from local-file-only to **encrypted server storage that becomes the source of truth**, managed in the hall Settings page, synced down to the builder's own machine at session start — the same rail [ADR 0068](0068-shared-art-key-for-newcomers.md) built for the shared key.
 
 - **Encrypted at rest** ([`src/bongos/secret-box.js`](../../src/bongos/secret-box.js)): AES-256-GCM, master key (`BUILDER_SECRET_KEY`) in **server env only** — never the DB, never the repo — so a DB dump alone can't decrypt. Migration 122 adds `gemini_key_enc` / `gemini_key_last4` / `gemini_key_set_at` to `builders`. Fails **closed**: no/invalid master key → set-key 503s, the feature stays dark (exactly the [ADR 0068] rollout shape).
 - **Write-only Settings UI** (`GET/PUT/DELETE /api/gds/me/art-key/own`): set / replace / remove; masked (last-4) after save, like GitHub/Stripe; a get-one link; "needed only if you generate art." Own-scoped — a builder reads/writes only their own key.

package/docs/adr/0073-secrets-scan-exclude-uri-detector.md

@@ -1,7 +1,7 @@
 # ADR 0073 — The secrets scan excludes TruffleHog's generic URI detector
 
 **Date:** 2026-06-20
-**Context:** Secrets-scanning gate (`.github/workflows/secrets-scan.yml` + the `.husky/pre-commit` early-catch). Tasks [#1318](https://example.com/builders#/task/1318) and [#1320](https://example.com/builders#/task/1320). Relates to [ADR 0022](0022-secrets-policy.md) (secrets policy) and [ADR 0071](<redacted>.md) (dev-box teardown — the trigger).
+**Context:** Secrets-scanning gate (`.github/workflows/secrets-scan.yml` + the `.husky/pre-commit` early-catch). Tasks [#1318](https://example.com/builders#/task/1318) and [#1320](https://example.com/builders#/task/1320). Relates to [ADR 0022](0022-secrets-policy.md) (secrets policy) and [ADR 0071](0071-box-confirm-before-destroyed-and-drift-reconcile.md) (dev-box teardown — the trigger).
 **Status:** Accepted.
 **Track:** `internal` (development system / CI gates).
 
@@ -12,7 +12,7 @@ The CI gate runs `trufflehog git` over the branch's **full history** with `--res
 1. **A rejection-test fixture** — `tests/box_terminal_ssrf.mjs` asserts the SSRF guard *rejects* terminal URLs that carry userinfo credentials, so the fixtures contain exactly that shape on purpose.
 2. **Per-builder tunnel hostnames** that no longer resolve. The detector "verifies" a URI by DNS/connection; an unresolvable host yields an `unknown` (unverifiable) result, which `--results=verified,unknown` reports.
 
-This was latent until 2026-06-20: when a builder's dev box was torn down ([ADR 0071](<redacted>.md)) its tunnel host stopped resolving, flipping the fixture's result to a gating failure — reddening **every** PR built off `main` (caught while landing Bongos `R01`, task [#1296](https://example.com/builders#/task/1296)).
+This was latent until 2026-06-20: when a builder's dev box was torn down ([ADR 0071](0071-box-confirm-before-destroyed-and-drift-reconcile.md)) its tunnel host stopped resolving, flipping the fixture's result to a gating failure — reddening **every** PR built off `main` (caught while landing Bongos `R01`, task [#1296](https://example.com/builders#/task/1296)).
 
 The first attempt (task [#1318](https://example.com/builders#/task/1318)) added the fixture file to `--exclude-paths`. That failed for two compounding reasons, and is the load-bearing lesson here:
 

package/docs/adr/0076-in-session-deterministic-compaction.md

@@ -1,10 +1,10 @@
 # ADR 0076 — In-session deterministic compaction (retrieval-first context)
 
-**Status:** Accepted (2026-06-20) · tasks [#1347](https://example.com/builders#/task/1347) [#1348](https://example.com/builders#/task/1348) [#1349](https://example.com/builders#/task/1349) [#1350](https://example.com/builders#/task/1350) · hardened [#1364](https://example.com/builders#/task/1364) · System 2 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · builds on [ADR 0075](<redacted>.md) (the ledger that measures it) and [ADR 0060](0060-gds-retrieval-layer.md) (the recall layer it recovers through)
+**Status:** Accepted (2026-06-20) · tasks [#1347](https://example.com/builders#/task/1347) [#1348](https://example.com/builders#/task/1348) [#1349](https://example.com/builders#/task/1349) [#1350](https://example.com/builders#/task/1350) · hardened [#1364](https://example.com/builders#/task/1364) · System 2 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · builds on [ADR 0075](0075-per-system-cost-attribution.md) (the ledger that measures it) and [ADR 0060](0060-gds-retrieval-layer.md) (the recall layer it recovers through)
 
 ## Context
 
-The efficiency audit's central finding ([ADR 0075](<redacted>.md)): **~82% of token spend is a few dozen Opus "marathon" sessions**, and their cost is overwhelmingly `cache_read` — a context prefix that grows monotonically and is **re-billed on every assistant turn for hours**. Marathon cost is therefore the *integral of a growing prefix over hundreds of turns*, and the prefix is dominated by stale tool output: file reads later edited, the same file read repeatedly, large `Grep`/`Glob`/`ls`/`Bash` dumps acted on once and never referenced again. **This is the only pool large enough to matter — no cache, model-router, or cron-gate can touch it. Only bounding the live context can.**
+The efficiency audit's central finding ([ADR 0075](0075-per-system-cost-attribution.md)): **~82% of token spend is a few dozen Opus "marathon" sessions**, and their cost is overwhelmingly `cache_read` — a context prefix that grows monotonically and is **re-billed on every assistant turn for hours**. Marathon cost is therefore the *integral of a growing prefix over hundreds of turns*, and the prefix is dominated by stale tool output: file reads later edited, the same file read repeatedly, large `Grep`/`Glob`/`ls`/`Bash` dumps acted on once and never referenced again. **This is the only pool large enough to matter — no cache, model-router, or cron-gate can touch it. Only bounding the live context can.**
 
 Spike [#1347](https://example.com/builders#/task/1347) measured the realized headroom on 7 real OTB Opus transcripts: **~24% of tool-output tokens are provably stale** by three conservative deterministic rules (superseded reads 7.3%, stale dumps 7.9%, duplicate reads 0.2%; per-session range 4–73%). That is the *floor* — the classifier deliberately counts only what it can prove — so System 2's 20–40% estimate is validated as plausible-to-conservative.
 

package/docs/adr/0077-content-addressed-llm-cache.md

@@ -1,6 +1,6 @@
 # ADR 0077 — Content-addressed LLM cache
 
-**Status:** Accepted (2026-06-20) · tasks [#1358](https://example.com/builders#/task/1358) [#1359](https://example.com/builders#/task/1359) [#1360](https://example.com/builders#/task/1360) · System 5 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · reports savings into [ADR 0075](<redacted>.md); reuses the content-hash convention of [ADR 0060](0060-gds-retrieval-layer.md)
+**Status:** Accepted (2026-06-20) · tasks [#1358](https://example.com/builders#/task/1358) [#1359](https://example.com/builders#/task/1359) [#1360](https://example.com/builders#/task/1360) · System 5 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · reports savings into [ADR 0075](0075-per-system-cost-attribution.md); reuses the content-hash convention of [ADR 0060](0060-gds-retrieval-layer.md)
 
 ## Context
 
@@ -15,7 +15,7 @@ Memoize idempotent model runs at `runSubagent`, keyed on the **content** of the
 - **Cache key** = `sha256(normalized-prompt | model | task_type | scope_sha)` (`src/bongos/llm-cache.js`, table `llm_cache`, migration 125). `scope_sha` is the git tree/blob SHA of the embedded inputs (`git rev-parse HEAD:<path>`), so **a stale answer is only ever returned when the inputs are provably unchanged** — the moment the tree changes, the key changes and the cache misses. This is the correctness backbone.
 - **The normalizer registry is the other correctness surface.** A per-`task_type` normalizer strips only **provably-volatile** lines (timestamps, run-ids, the architect's `version=` echo) so two logically-identical prompts hash the same — *without* ever collapsing two genuinely-different requests. Adding a task type means adding a normalizer; that is where a reviewer looks to verify a cache can't return a wrong answer.
 - **Store only on a clean run.** A result is cached only when `exit_code === 0` and stdout is present — **never a timeout or a non-zero exit**. A cache must never pin a failure.
-- **The wrap is opt-in and behavior-preserving.** `grader.runSubagentCached({prompt, opts, cache})` checks the cache then falls through to the **untouched** `runSubagent`; with no `cache` spec it is exactly today's call. A hit returns `{stdout, cost_usd: 0, cached: true}`, so the $0 flows automatically through the existing `extractCostUsd → session-cost` ledger, and the saving is recorded into `cost_baseline` (`system5:llm-cache`, [ADR 0075](<redacted>.md)) — `baseline_usd` = what the run *would* have cost, `amount_usd` = 0 — so the system proves its savings in dollars.
+- **The wrap is opt-in and behavior-preserving.** `grader.runSubagentCached({prompt, opts, cache})` checks the cache then falls through to the **untouched** `runSubagent`; with no `cache` spec it is exactly today's call. A hit returns `{stdout, cost_usd: 0, cached: true}`, so the $0 flows automatically through the existing `extractCostUsd → session-cost` ledger, and the saving is recorded into `cost_baseline` (`system5:llm-cache`, [ADR 0075](0075-per-system-cost-attribution.md)) — `baseline_usd` = what the run *would* have cost, `amount_usd` = 0 — so the system proves its savings in dollars.
 - **First plug-ins (highest rerun value):** `architect-audit` (key scoped to the git tree-hash of `--paths`) and `onboarding-analyze` (key on the immutable session id). Both are best-effort: any `llm_cache` error degrades to an ordinary uncached run — the cache can never take down the thing it accelerates.
 - **v1 is exact-match.** Semantic / near-match caching is deferred; a v1 key either matches exactly (after normalization) or misses. That keeps correctness obvious.
 

package/docs/adr/0078-deterministic-first-cron.md

@@ -1,6 +1,6 @@
 # ADR 0078 — Deterministic-first cron harness
 
-**Status:** Accepted (2026-06-20) · tasks [#1355](https://example.com/builders#/task/1355) [#1356](https://example.com/builders#/task/1356) [#1357](https://example.com/builders#/task/1357) · System 4 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · cost visibility via [ADR 0075](<redacted>.md)
+**Status:** Accepted (2026-06-20) · tasks [#1355](https://example.com/builders#/task/1355) [#1356](https://example.com/builders#/task/1356) [#1357](https://example.com/builders#/task/1357) · System 4 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · cost visibility via [ADR 0075](0075-per-system-cost-attribution.md)
 
 ## Context
 
@@ -14,8 +14,8 @@ A routine **declares its run mode** in SKILL.md frontmatter, and a dispatcher ru
   - **`deterministic`** — `execFileSync` each step as plain node; route stdout by sink; non-zero exit → best-effort `#ops` alert + non-zero exit. **This is the whole execution — no `claude -p`.**
   - **`hybrid`** — run the deterministic prefix as code; spawn `claude -p` *only* when a step emits a non-empty `{"needs_judgment": …}` payload, feeding the model only that payload.
   - **`judgment`** — the status quo: a wrapped session over the SKILL body.
-  - Steps run with `OTB_COST_CRON_ROUTINE=<name>` so System 1 ([ADR 0075](<redacted>.md)) tags any (hybrid) spend `cron:<routine>:*` — making "did demoting this to deterministic actually cost ~$0?" a queryable fact.
-- **Convert only the provably-deterministic wrappers (task 1356).** `peer-vote-tally` and `diagram-drift` already do their whole job in one self-contained, self-filing script — converted to `mode: deterministic`. **`main-audit` and `dep-audit-nightly` were NOT converted:** `main-audit.js` is trust-boundary core (SEC [#863](https://example.com/builders#/task/863) / [ADR 0043](<redacted>.md)) and neither script self-files its findings (the model currently does the per-finding `idea_inbox` / `vulnerability_report` filing), so demoting them blindly would silently drop alerting. They need a self-filing flag added to their (security) scripts first — a separate, security-reviewed task.
+  - Steps run with `OTB_COST_CRON_ROUTINE=<name>` so System 1 ([ADR 0075](0075-per-system-cost-attribution.md)) tags any (hybrid) spend `cron:<routine>:*` — making "did demoting this to deterministic actually cost ~$0?" a queryable fact.
+- **Convert only the provably-deterministic wrappers (task 1356).** `peer-vote-tally` and `diagram-drift` already do their whole job in one self-contained, self-filing script — converted to `mode: deterministic`. **`main-audit` and `dep-audit-nightly` were NOT converted:** `main-audit.js` is trust-boundary core (SEC [#863](https://example.com/builders#/task/863) / [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)) and neither script self-files its findings (the model currently does the per-finding `idea_inbox` / `vulnerability_report` filing), so demoting them blindly would silently drop alerting. They need a self-filing flag added to their (security) scripts first — a separate, security-reviewed task.
 - **A fitness check stops the boundary from rotting (task 1357).** `fitness.checkDeterministicRoutines` fails CI if a `mode: deterministic` SKILL body contains a judgment/mutation instruction (`git push`/`commit`, `deploy.sh`, an `Edit`/`Write` tool instruction, free-text synthesis) — *negated* mentions ("never pushes", "does NOT edit") are allowed as descriptive boundaries — or if a fenced `node …` command diverges from the declared `steps:`. The pure core (`scanDeterministicBody`) is unit-tested both ways (clean passes, each violation class is caught). This is the structural cure for the markdown-graveyard pattern: a deterministic routine can never quietly become a wrapped session again.
 
 ## Consequences

package/docs/adr/0079-value-gated-autonomous-engagement.md

@@ -1,6 +1,6 @@
 # ADR 0079 — Value-gated autonomous engagement (BUILT DISABLED)
 
-**Status:** Accepted, **shipped inert** (2026-06-20) · tasks [#1351](https://example.com/builders#/task/1351) [#1352](https://example.com/builders#/task/1352) [#1353](https://example.com/builders#/task/1353) [#1354](https://example.com/builders#/task/1354) · System 3 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · cost visibility via [ADR 0075](<redacted>.md); reuses [ADR 0043](<redacted>.md) protected-path matcher
+**Status:** Accepted, **shipped inert** (2026-06-20) · tasks [#1351](https://example.com/builders#/task/1351) [#1352](https://example.com/builders#/task/1352) [#1353](https://example.com/builders#/task/1353) [#1354](https://example.com/builders#/task/1354) · System 3 of the Cloud Bongos LLM-reduction redesign (spike [#1326](https://example.com/builders#/task/1326)) · cost visibility via [ADR 0075](0075-per-system-cost-attribution.md); reuses [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) protected-path matcher
 
 ## Context
 
@@ -30,7 +30,7 @@ The pure decision cores (`decide`, `autofixAllowed`, `cascade-dispatch.dispatch`
 
 - The system is fully built and reviewable, but changes nothing in production until the owner arms it — no autonomous behavior shifts on deploy.
 - When armed, the spend-brake protects against a runaway autonomous fleet; **security routines (dep-audit) should be exempted from the brake at arming time** — a skipped vuln scan is a security hole, not a saved dollar (noted in the routine).
-- This system does **NOT** address marathon (interactive `cache_read`) spend — that is System 2 ([ADR 0076](<redacted>.md)), the only lever on the 82% pool. System 3 attacks the autonomous remainder.
+- This system does **NOT** address marathon (interactive `cache_read`) spend — that is System 2 ([ADR 0076](0076-in-session-deterministic-compaction.md)), the only lever on the 82% pool. System 3 attacks the autonomous remainder.
 - Arming guidance: enable `OTB_AUTONOMY_ENABLED` first with the grader live, watch `autonomy_runs` (skips) + System 1's `by_source` `cron:%` spend, then let the safe_autofix lane follow once the cascade + gate behavior is trusted.
 
 ## Reproduce / verify

package/docs/adr/0080-llm-cache-api-transport-and-trust-model.md

@@ -1,10 +1,10 @@
 # ADR 0080 — LLM-cache API transport + trust model
 
-**Status:** Accepted (2026-06-21) · task [#1381](https://example.com/builders#/task/1381) · transport for the content-addressed cache of [ADR 0077](<redacted>.md); savings ledger contract per [ADR 0075](<redacted>.md) / `migrations/124_cost_baseline.sql`; reuses the rank trust boundary of [ADR 0016](<redacted>.md)
+**Status:** Accepted (2026-06-21) · task [#1381](https://example.com/builders#/task/1381) · transport for the content-addressed cache of [ADR 0077](0077-content-addressed-llm-cache.md); savings ledger contract per [ADR 0075](0075-per-system-cost-attribution.md) / `migrations/124_cost_baseline.sql`; reuses the rank trust boundary of [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)
 
 ## Context
 
-System 5 ([ADR 0077](<redacted>.md)) memoizes idempotent model runs in the `llm_cache` Postgres table via `src/bongos/llm-cache.js` (`lookup`/`store`/`recordSaving`), all of which use a **direct `pg` pool**. But its two consumers — `architect-audit.js` and `onboarding-analyze.js` — run as CLI/cron on **builder machines**, where the pool is unreachable (peer-socket only; TCP is scram-only). So every cache op silently degraded to miss/no-store and the cache **could never hit organically** (verified empirically in the System-5 effectiveness eval, task [#1372](https://example.com/builders#/task/1372): 0 rows, 0 hits, despite correct logic — proven only when the DB was reached via a forwarded socket).
+System 5 ([ADR 0077](0077-content-addressed-llm-cache.md)) memoizes idempotent model runs in the `llm_cache` Postgres table via `src/bongos/llm-cache.js` (`lookup`/`store`/`recordSaving`), all of which use a **direct `pg` pool**. But its two consumers — `architect-audit.js` and `onboarding-analyze.js` — run as CLI/cron on **builder machines**, where the pool is unreachable (peer-socket only; TCP is scram-only). So every cache op silently degraded to miss/no-store and the cache **could never hit organically** (verified empirically in the System-5 effectiveness eval, task [#1372](https://example.com/builders#/task/1372): 0 rows, 0 hits, despite correct logic — proven only when the DB was reached via a forwarded socket).
 
 The fix is a transport: reach the cache DB from any consumer machine. The hard part is **trust** — a cache *store* writes a `result_stdout` that a later run **replays at $0 and trusts** (for `architect-audit` it becomes `audit_md` written to `docs/audits/` and `seed_ideas` filed to `idea_inbox`). An open store endpoint is a content-injection vector into the planning pipeline and a metrics-integrity vector into the public savings number.
 
@@ -19,7 +19,7 @@ The fix is a transport: reach the cache DB from any consumer machine. The hard p
 
 | Control | What it stops |
 |---|---|
-| **Metic+ gate** on both routes (`requireRank('metic','archon')`, read live per-request — [ADR 0016](<redacted>.md)) | Xenos/Thetes seeding a result a high-value audit later replays. There is no legitimate sub-Metic consumer. |
+| **Metic+ gate** on both routes (`requireRank('metic','archon')`, read live per-request — [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) | Xenos/Thetes seeding a result a high-value audit later replays. There is no legitimate sub-Metic consumer. |
 | **`cache_key` must be `/^[0-9a-f]{64}$/`** | malformed / SQL-shaped keys; a key is a sha256 by construction. |
 | **`task_type` ∈ the registered `NORMALIZERS`** | caching arbitrary (non-idempotent) producers; bounds stores to the known idempotent ones. |
 | **`owner_builder_id` pinned to `req.builder.id`** (client value ignored) | a caller falsifying write-attribution. (The cache is **shared-on-read by content address** — `lookup` keys on `cache_key` only, not on owner. Isolation comes from the key itself: an entry is only readable by someone who can reconstruct its exact `prompt+model+task_type+scope_sha`, and only at Metic+ — not from an owner filter.) |

package/docs/adr/0081-tool-agnostic-design-layer.md

@@ -1,6 +1,6 @@
 # ADR 0081 — Tool-agnostic design layer: repo-canonical, Claude Design + Figma as adapters
 
-**Status:** Accepted (2026-06-21) · this ADR [#1375](https://example.com/builders#/task/1375) · implementation cluster [#1376](https://example.com/builders#/task/1376) [#1377](https://example.com/builders#/task/1377) [#1378](https://example.com/builders#/task/1378) [#1379](https://example.com/builders#/task/1379) [#1380](https://example.com/builders#/task/1380) · applies the core↔host pattern of [ADR 0062](<redacted>.md) to design; grader/ship changes ride the gate-review hard floor of [ADR 0043](<redacted>.md)
+**Status:** Accepted (2026-06-21) · this ADR [#1375](https://example.com/builders#/task/1375) · implementation cluster [#1376](https://example.com/builders#/task/1376) [#1377](https://example.com/builders#/task/1377) [#1378](https://example.com/builders#/task/1378) [#1379](https://example.com/builders#/task/1379) [#1380](https://example.com/builders#/task/1380) · applies the core↔host pattern of [ADR 0062](0062-medusa-instance-model-decoupling.md) to design; grader/ship changes ride the gate-review hard floor of [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)
 
 ## Context
 
@@ -20,7 +20,7 @@ Owner (Lars) requirements, reached in the 2026-06-21 design conversation:
 
 ## Decision
 
-**The repo is the single source of truth; every design tool is a swappable adapter against a neutral contract.** This is the [ADR 0062](<redacted>.md) core↔host decoupling applied to design: the system depends on the *contract*, not on any tool.
+**The repo is the single source of truth; every design tool is a swappable adapter against a neutral contract.** This is the [ADR 0062](0062-medusa-instance-model-decoupling.md) core↔host decoupling applied to design: the system depends on the *contract*, not on any tool.
 
 1. **Neutral design contract = the repo.** The canonical representation is design tokens (extending [`config/branding.json`](../../config/branding.json)) + component code + exported assets, plus a per-surface "design source pointer" (which tool authored it, where its editable source lives). Tools read from and write to this contract; nothing else is canonical. ([#1377](https://example.com/builders#/task/1377))
 
@@ -40,7 +40,7 @@ Owner (Lars) requirements, reached in the 2026-06-21 design conversation:
 - **Designers keep Figma.** Manual Figma edits are first-class for structured/design-system changes and round-trip into the repo via a normal GDS task + the same grader. The honest limit: the Figma→code round-trip is lossy for arbitrary canvas art — that work becomes a committed asset, not round-tripped code.
 - **One grader to maintain, not two.** The standalone Gemini review path is retired into the unified engine. Code doesn't auto-regen today (a failed grade = human fixes + re-ships); unifying gives every type the same generate→grade→regenerate loop.
 - **Graphics is unchanged.** World pixel art stays on the Claude Code + Gemini pipeline; Figma stays its viewer ([`otb-figma-sync`](../../.claude/skills/otb-figma-sync/SKILL.md)). This ADR adds the `ui` lane beside it, it does not disturb the art pipeline.
-- **Gate-review floor applies.** [#1380](https://example.com/builders#/task/1380) touches [`grader.js`](../../src/bongos/grader.js) + [`ship.js`](../../scripts/gds/ship.js) — the gate-review **hard floor** ([ADR 0043](<redacted>.md)). It needs owner Gate approval even for Archon, and the multimodal call path wants a security review.
+- **Gate-review floor applies.** [#1380](https://example.com/builders#/task/1380) touches [`grader.js`](../../src/bongos/grader.js) + [`ship.js`](../../scripts/gds/ship.js) — the gate-review **hard floor** ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)). It needs owner Gate approval even for Archon, and the multimodal call path wants a security review.
 
 ## Rejected alternatives
 

package/docs/adr/0082-server-side-merge-conflict-auto-resolution.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-21
 - **Track:** internal
-- **Builds on:** [ADR 0055](<redacted>.md) (server-mediated publish — the box holds no push credential; the server pushes), [ADR 0063](<redacted>.md) / [ADR 0066](<redacted>.md) / [ADR 0062](<redacted>.md) §8 (the generated artifacts + the `otb-regen` merge driver, task 1243), [ADR 0016](<redacted>.md) (trust boundary — this does NOT touch it)
+- **Builds on:** [ADR 0055](0055-server-mediated-branch-publish.md) (server-mediated publish — the box holds no push credential; the server pushes), [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) / [ADR 0066](0066-generated-file-map-sections.md) / [ADR 0062](0062-medusa-instance-model-decoupling.md) §8 (the generated artifacts + the `otb-regen` merge driver, task 1243), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (trust boundary — this does NOT touch it)
 - **Task:** [#1385](https://example.com/builders#/task/1385) (idea [#349](https://example.com/builders#/idea/349))
 
 ## Context
@@ -15,7 +15,7 @@ The active merge driver (task 1162, `github-push.mergeIfGreen`) lands a green PR
 
 The gap: task 1243's machinery only runs in a **local** `git merge` (a builder's box, `/merge-mode`, ship's pre-stage). But the default ship path is **server-mediated** (ADR 0055) and lands via GitHub's own merge — and **GitHub's merge cannot run a custom merge driver** (`otb-regen`). So a confirmed PR that later conflicts only on these files sits open forever until a human with a credentialed checkout runs a local merge. This is the exact stall behind PR #300 and PR #167 (both on `docs/adr/README.md`).
 
-The owner framed the goal as "kill the merge bottleneck" — and **explicitly rejected** the tempting alternative of lowering deploy/merge access down to the `thetes` rank. That would reopen the Builder 25 hole ([ADR 0043](<redacted>.md)): a lightly-trusted agent landing changes on a live prod payment system. The right fix changes *who does the mechanical work*, not *who is trusted to land code*.
+The owner framed the goal as "kill the merge bottleneck" — and **explicitly rejected** the tempting alternative of lowering deploy/merge access down to the `thetes` rank. That would reopen the Builder 25 hole ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)): a lightly-trusted agent landing changes on a live prod payment system. The right fix changes *who does the mechanical work*, not *who is trusted to land code*.
 
 ## Decision
 

package/docs/adr/0083-modular-architecture-strangler-build-plan.md

@@ -2,11 +2,11 @@
 
 **Status:** Accepted (2026-06-21) · task [#1405](https://example.com/builders#/task/1405) (BV1.R36) · epic [#1388](https://example.com/builders#/task/1388) (BV1.R34) · spike that produced the design: [#1383](https://example.com/builders#/task/1383) → design research in [`docs/design/modular-architecture/`](../design/modular-architecture/) (5 docs, task [#1401](https://example.com/builders#/task/1401))
 
-**Amended by:** [ADR 0091](<redacted>.md) (2026-06-26, BONGOS-V1 C7) — extends this strangler from the four *feature* modules into the **core itself**: bounds the kernel as an enumerated file roster (the "~3.5k-LOC kernel" this ADR kept referencing), defines the per-domain `db.js` carve mechanism, and classifies what the `src/module-api.js` doorway may expose. Nothing here is reversed; 0091 makes "the kernel" and "carve `db.js` per-domain" concrete.
+**Amended by:** [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) (2026-06-26, BONGOS-V1 C7) — extends this strangler from the four *feature* modules into the **core itself**: bounds the kernel as an enumerated file roster (the "~3.5k-LOC kernel" this ADR kept referencing), defines the per-domain `db.js` carve mechanism, and classifies what the `src/module-api.js` doorway may expose. Nothing here is reversed; 0091 makes "the kernel" and "carve `db.js` per-domain" concrete.
 
-**Builds on:** [ADR 0062](<redacted>.md) (instance/model decoupling — the core↔host split, §4 module registry, §5 module-owned migrations, §9 fitness functions), [ADR 0061](<redacted>.md) (context layers / nested CLAUDE.md), [ADR 0016](<redacted>.md) (server-enforced rank boundary), [ADR 0043](<redacted>.md) (protected paths), [ADR 0049](<redacted>.md) (`touches[]` advisory).
+**Builds on:** [ADR 0062](0062-medusa-instance-model-decoupling.md) (instance/model decoupling — the core↔host split, §4 module registry, §5 module-owned migrations, §9 fitness functions), [ADR 0061](0061-context-layer-decomposition.md) (context layers / nested CLAUDE.md), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced rank boundary), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (protected paths), [ADR 0049](0049-split-parallel-safety-contract.md) (`touches[]` advisory).
 
-> **Numbering reconciliation (read this first).** The design docs, the epic [#1388](https://example.com/builders#/task/1388), and task [#1389](https://example.com/builders#/task/1389) all refer to the project-extensible module system as **"ADR 0080"**. That number was taken by the LLM-cache transport ADR ([ADR 0080](<redacted>.md)) before the module-system ADR was written — the same `0079→0081` collision class recorded in project memory. **The module-system decision record is THIS file, ADR 0083.** Where the design docs or those tasks say "ADR 0080 (module system / plugin API)", read "ADR 0083". ADR 0080 is unrelated (it is the LLM cache).
+> **Numbering reconciliation (read this first).** The design docs, the epic [#1388](https://example.com/builders#/task/1388), and task [#1389](https://example.com/builders#/task/1389) all refer to the project-extensible module system as **"ADR 0080"**. That number was taken by the LLM-cache transport ADR ([ADR 0080](0080-llm-cache-api-transport-and-trust-model.md)) before the module-system ADR was written — the same `0079→0081` collision class recorded in project memory. **The module-system decision record is THIS file, ADR 0083.** Where the design docs or those tasks say "ADR 0080 (module system / plugin API)", read "ADR 0083". ADR 0080 is unrelated (it is the LLM cache).
 
 ---
 

package/docs/adr/0085-remove-default-per-builder-spend-cap.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-06-23
 - **Track:** internal
-- **Builds on:** [ADR 0016](<redacted>.md) (the Archon override stays server-enforced), [ADR 0054](<redacted>.md) (session token cost — the spend this cap measured)
+- **Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the Archon override stays server-enforced), [ADR 0054](0054-session-token-reward-cost-plus.md) (session token cost — the spend this cap measured)
 - **Reverses:** the default-cap half of GDS-V3 criterion **C3** (V3.R84, task [#302](https://example.com/builders#/task/302) — "per-builder monthly budget, Archon-configurable")
 - **Task:** [#1499](https://example.com/builders#/task/1499)
 
@@ -11,7 +11,7 @@
 
 GDS-V3 criterion C3 (task 302) gave every builder a **month-to-date spend cap**: `cost_log` API/compute spend attributed to the builder since `date_trunc('month', now())`, compared against `builders.monthly_budget_usd`. When that column is `NULL` (the normal case), `classifyCostStatus()` fell back to a project-wide default of **$50/month**. At 100% the builder's `/me` `cost.level` flips to `'over'`, which **hard-blocks `/builder-ship` (before the grader runs) and the art pipeline**. An Archon could raise a specific builder's ceiling via `PATCH /builders/:id/budget`.
 
-The default was framed in-code as "catch a runaway, not ration normal work." In practice it did the opposite. The dominant entry in a builder's `cost_log` is `session:<redacted> — **the API cost of running the assistant to do the work itself** (auto-captured per [ADR 0028](<redacted>.md)). On Opus, a handful of real sessions costs more than $50:
+The default was framed in-code as "catch a runaway, not ration normal work." In practice it did the opposite. The dominant entry in a builder's `cost_log` is `session:<redacted> — **the API cost of running the assistant to do the work itself** (auto-captured per [ADR 0028](0028-honest-llm-spend-accounting.md)). On Opus, a handful of real sessions costs more than $50:
 
 - Builder 95 (Jackson Rini), created 2026-06-22, hit `over` on day two: **$69.32 MTD across 5 interactive sessions** (largest single session $24.86) vs the $50 default. He was blocked from shipping anything — and every further session he ran to *try* to work pushed him deeper over, since the cost of working is itself the metered quantity.
 

package/docs/adr/0086-goal-scoped-work-hierarchy.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-06-23
 - **Deciders:** Lars (Archon), Claude
 
-**Builds on:** [ADR 0016](<redacted>.md) (server-enforced rank boundary), [ADR 0025](<redacted>.md) (structured criterion↔task link), [ADR 0043](<redacted>.md) (protected paths + rank floor), [ADR 0049](<redacted>.md) (`touches[]` advisory), [ADR 0062](<redacted>.md) (instance/host decoupling — the config-preset pattern), [ADR 0083](<redacted>.md) (modular architecture — "a task is scoped to a module"), [ADR 0084](<redacted>.md) (auto-derived per-task rank floor), [ADR 0015](<redacted>.md) (task dependencies + auto-promotion), [ADR 0054](<redacted>.md) (cost-plus reward).
+**Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced rank boundary), [ADR 0025](0025-structured-criterion-task-link.md) (structured criterion↔task link), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (protected paths + rank floor), [ADR 0049](0049-split-parallel-safety-contract.md) (`touches[]` advisory), [ADR 0062](0062-medusa-instance-model-decoupling.md) (instance/host decoupling — the config-preset pattern), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (modular architecture — "a task is scoped to a module"), [ADR 0084](0084-auto-derived-per-task-rank-floor.md) (auto-derived per-task rank floor), [ADR 0015](0015-task-dependencies-and-auto-promotion.md) (task dependencies + auto-promotion), [ADR 0054](0054-session-token-reward-cost-plus.md) (cost-plus reward).
 
 **Track:** `internal` (GDS / methodology — a Cloud Bongos platform capability).
 
@@ -14,11 +14,11 @@
 
 Today only the Archon can create or edit tasks — `POST /tasks` and `PATCH /tasks/:id` are both `requireRank('archon')` ([`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js)). Lower-ranking builders (`xenos`, `thetes`) can only **file ideas** into `idea_inbox`; they have no ability to shape their own work toward an objective.
 
-> **Update (2026-06-26, [ADR 0090](<redacted>.md)):** `POST /tasks` / `PATCH /tasks/:id` are now `requireRank('metic','archon')` — a *Metic* may author tasks directly. This ADR's goal-scoped, module-fenced authoring path (`POST /goals/:id/tasks`) is now the mechanism for **sub-Metic** ranks (`xenos`/`thetes`) specifically; everything below about the scope-subset wall and protected-path block is unchanged and still governs that path. Every task must be hand-authored by the owner first — a delegation bottleneck that wastes capable builders' judgment, and the opposite of the AI-first norm where agents do the building.
+> **Update (2026-06-26, [ADR 0090](0090-metic-task-authoring.md)):** `POST /tasks` / `PATCH /tasks/:id` are now `requireRank('metic','archon')` — a *Metic* may author tasks directly. This ADR's goal-scoped, module-fenced authoring path (`POST /goals/:id/tasks`) is now the mechanism for **sub-Metic** ranks (`xenos`/`thetes`) specifically; everything below about the scope-subset wall and protected-path block is unchanged and still governs that path. Every task must be hand-authored by the owner first — a delegation bottleneck that wastes capable builders' judgment, and the opposite of the AI-first norm where agents do the building.
 
 Lars's directive (2026-06-23): **stop assigning individual *tasks*; assign *goals*.** A builder working toward a goal should be able to **author and organize their own tasks** beneath it — but only within a **module scope** they cannot exceed, and never in a way that lets someone "pick a goal and then create tasks that hack stuff."
 
-This slots directly into the modular architecture: [ADR 0083](<redacted>.md) Rule 5 already states *"a task is scoped to a module."* Goals are the mechanism that turns that rule into a **live, enforced permission** rather than a convention.
+This slots directly into the modular architecture: [ADR 0083](0083-modular-architecture-strangler-build-plan.md) Rule 5 already states *"a task is scoped to a module."* Goals are the mechanism that turns that rule into a **live, enforced permission** rather than a convention.
 
 The structure decided over a design session is a six-tier hierarchy — most of which **already exists** in the GDS. Only **Goal** is a genuinely new tier:
 
@@ -39,7 +39,7 @@ The structure decided over a design session is a six-tier hierarchy — most of
 
 ### 1. The hierarchy is a configurable preset (onboarding)
 
-The tier set is host-configured, not hardcoded — the [ADR 0062](<redacted>.md) core/host pattern applied to the work model.
+The tier set is host-configured, not hardcoded — the [ADR 0062](0062-medusa-instance-model-decoupling.md) core/host pattern applied to the work model.
 
 - A new **`config/hierarchy.json`** (joins `branding.json` / `modules.json` as host config; loaded by a `hierarchy-config.js` mirroring `src/modules.js`) declares the tiers — names, order, and which tier carries **scope**, **membership**, and **criteria**. Example ships the six-tier preset above; the project owner fills/edits it **during onboarding**.
 - **v1 scope of "editable":** the standard tier set with owner-set labels, enable/disable, and which tier owns scope/criteria/membership. Fully *arbitrary* custom tier graphs are a later extension — explicitly not built now.
@@ -48,7 +48,7 @@ The tier set is host-configured, not hardcoded — the [ADR 0062](<redacted>.md)
 
 - **New `goals` table** — sits between `versions` and `done_when_criteria`. New (not `parent_task_id`: one-level, task lifecycle; not `done_when_criteria`: that *is* the criteria tier). Carries: `version_id`, `title`/`description`, **`scope_modules text[]`** (the wall), `status` (`open|achieved|archived`), `created_by`, `succeeded_by_goal_id` (rescope carry-forward).
 - **Goals are shared, not owned** — a new **`goal_members`** table (many builders ↔ one goal; `lead`/`member` roles). **Membership**, not a single assignee, is what grants bounded task authoring.
-- **Criteria re-parent under goals** — `done_when_criteria` gains a `goal_id` (backfill existing version criteria under a per-version default goal). A version is "done" when all its goals are achieved; the `/status` rollup becomes **Version → Goals → Criteria → Tasks** (extends [ADR 0025](<redacted>.md)).
+- **Criteria re-parent under goals** — `done_when_criteria` gains a `goal_id` (backfill existing version criteria under a per-version default goal). A version is "done" when all its goals are achieved; the `/status` rollup becomes **Version → Goals → Criteria → Tasks** (extends [ADR 0025](0025-structured-criterion-task-link.md)).
 - **Tasks** gain `goal_id`; sub-tasks remain `parent_task_id`; a task fulfils a criterion via the existing `task_criteria` link.
 
 ### 3. Bounded task authoring (membership grants it; the create-time gate)
@@ -56,17 +56,17 @@ The tier set is host-configured, not hardcoded — the [ADR 0062](<redacted>.md)
 - **`POST /goals`** — `requireRank('metic','archon')`; **Archon-only when `scope_modules` includes a `protected` module.**
 - **`POST /goals/:id/join` / `leave`** — open join for normal goals; **joining a sensitive-scope goal needs Archon approval** (reuse the access-request pattern, [`access-requests.js`](../../src/bongos/routes/access-requests.js)).
 - **`POST /goals/:id/tasks`** — `requireBuilder` + an in-handler gate (the maneuverability grant), ordered + fail-closed: goal `open` and **caller is a member** (or Archon); version guards reused from `POST /tasks`; **scope subset** — every `touches[]` element covered by the goal's `scope_modules` globs (`touchesOverlap`, [`path-match.js`](../../src/bongos/path-match.js)); **protected-path block** — `checkPermissionPaths` ([`permission-path-check.js`](../../src/bongos/permission-path-check.js)) so a sub-Metic member cannot author a task touching the protected core; then `db.createTask` stamping `goal_id`. `POST /tasks` / `PATCH /tasks/:id` stay byte-identical (Archon-only) for ungoverned creation.
-- **Rank floor is auto-derived, not a bespoke cap.** Per [ADR 0084](<redacted>.md), a created task's `requires_rank` is auto-derived from its touches + sensitivity (`deriveRequiredRank` → `metic` for protected/sensitive, else `xenos`) and can only be raised. So a goal member need not (and cannot) self-set a rank that escapes their own gate — and a sensitive task auto-floors to `metic`, which a sub-Metic author could not claim. No new cap mechanism; this composes with the one that already exists.
+- **Rank floor is auto-derived, not a bespoke cap.** Per [ADR 0084](0084-auto-derived-per-task-rank-floor.md), a created task's `requires_rank` is auto-derived from its touches + sensitivity (`deriveRequiredRank` → `metic` for protected/sensitive, else `xenos`) and can only be raised. So a goal member need not (and cannot) self-set a rank that escapes their own gate — and a sensitive task auto-floors to `metic`, which a sub-Metic author could not claim. No new cap mechanism; this composes with the one that already exists.
 
 ### 4. The scope wall (set by the planner, never self-granted; "ask to widen")
 
-- **New `src/bongos/module-scope-map.js`** — each module key → its path globs + a `protected` flag, for the full ~16-module roster from the [modular-architecture design](../design/modular-architecture/02-module-map.md). `protected: true` where globs intersect `PROTECTED_GLOBS` ([ADR 0043](<redacted>.md)) — the lifecycle/ship-pipeline, migrations, security, authz core. It **auto-tightens** as [ADR 0083](<redacted>.md) moves code into `modules/<key>/`, converging on that ADR's task→module affinity (where `touches[]` retires in favour of the module label + a ship-time diff⊆module check). The carve precedes the feature (Lars: "carve more modules first").
+- **New `src/bongos/module-scope-map.js`** — each module key → its path globs + a `protected` flag, for the full ~16-module roster from the [modular-architecture design](../design/modular-architecture/02-module-map.md). `protected: true` where globs intersect `PROTECTED_GLOBS` ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)) — the lifecycle/ship-pipeline, migrations, security, authz core. It **auto-tightens** as [ADR 0083](0083-modular-architecture-strangler-build-plan.md) moves code into `modules/<key>/`, converging on that ADR's task→module affinity (where `touches[]` retires in favour of the module label + a ship-time diff⊆module check). The carve precedes the feature (Lars: "carve more modules first").
 - A goal's `scope_modules` is set by the assigner at planning time — the **one moment scope is defined**, which is precisely why it is **never self-granted**. Widening goes through a request a trusted rank approves (Archon for a protected module).
 
 ### 5. Dependencies
 
 - **One polymorphic "blocked-until-done" edge** — a new `dependencies(from_kind, from_id, to_kind, to_id)` over `{task, goal, criterion}`; the existing `tasks.dependencies[]` (task→task) migrates in. "Done" = task/sub-task `shipped`, criterion `satisfied`, goal `achieved`.
-- **One enforcement point** — it resolves down to the existing **claim gate** ([ADR 0015](<redacted>.md)): claiming a task checks its own deps plus deps inherited from its goal/criterion; achieving/shipping a node auto-promotes its dependents.
+- **One enforcement point** — it resolves down to the existing **claim gate** ([ADR 0015](0015-task-dependencies-and-auto-promotion.md)): claiming a task checks its own deps plus deps inherited from its goal/criterion; achieving/shipping a node auto-promotes its dependents.
 - **Cross-goal and cross-version is allowed** (Lars, 2026-06-23). A dependency is a **reference, not a grant** — it never widens module scope, so cross-module deps are safe; cross-goal deps become the visible coordination contract between two shared workspaces. Containment (the tree) is never a dependency; the graph is acyclic.
 
 ### 6. Achievement (auto-flag → planner review → auto-achieve) + lifecycle
@@ -78,19 +78,19 @@ The tier set is host-configured, not hardcoded — the [ADR 0062](<redacted>.md)
 
 ### 7. How the boundary holds (reuse + defense-in-depth)
 
-The create-time gate sees only *declared* touches (advisory — git merge is the real collision detector, [ADR 0049](<redacted>.md)), so it is the first filter, **not** the enforcement boundary. The existing **ship-time gates remain authoritative on the real diff**: the grader's `permissionPathPrePass`/`routeRankPrePass` + `serverSideGuards` ([`grader.js`](../../src/bongos/grader.js)), the `gate-review` ESCALATE floor, and the post-push `main-audit`. A mis-declared task still cannot *merge* if its real diff hits protected paths. Two CI fitness checks ([`fitness.js`](../../scripts/gds/fitness.js)) guard drift: goal routes are pinned in `route-rank-check.EXPECTED_RANKS`, and the scope code must *import* `PROTECTED_GLOBS`, never re-declare it.
+The create-time gate sees only *declared* touches (advisory — git merge is the real collision detector, [ADR 0049](0049-split-parallel-safety-contract.md)), so it is the first filter, **not** the enforcement boundary. The existing **ship-time gates remain authoritative on the real diff**: the grader's `permissionPathPrePass`/`routeRankPrePass` + `serverSideGuards` ([`grader.js`](../../src/bongos/grader.js)), the `gate-review` ESCALATE floor, and the post-push `main-audit`. A mis-declared task still cannot *merge* if its real diff hits protected paths. Two CI fitness checks ([`fitness.js`](../../scripts/gds/fitness.js)) guard drift: goal routes are pinned in `route-rank-check.EXPECTED_RANKS`, and the scope code must *import* `PROTECTED_GLOBS`, never re-declare it.
 
 ### Deferred (explicit non-decisions)
 
-- **Rewards** — whether *achieving a goal* earns anything beyond the per-task cost-plus already paid ([ADR 0054](<redacted>.md)), and how any reward splits among a goal's members. The leaning is karma by default (budget-safe, since example are real money) with contribution-weighted splits, but this is **not yet decided** and rides a follow-on.
-- **A sub-Metic builder joining a protected-scope goal** — letting a newcomer work *inside* the dangerous core under a tightly-scoped, Archon-granted goal amends the [ADR 0043](<redacted>.md) hard floor (and needs the ship-time gates to become goal-aware). Deliberately **last**, behind its own security-reviewed ADR. Until then, protected-scope goals require a Metic+ holder.
+- **Rewards** — whether *achieving a goal* earns anything beyond the per-task cost-plus already paid ([ADR 0054](0054-session-token-reward-cost-plus.md)), and how any reward splits among a goal's members. The leaning is karma by default (budget-safe, since example are real money) with contribution-weighted splits, but this is **not yet decided** and rides a follow-on.
+- **A sub-Metic builder joining a protected-scope goal** — letting a newcomer work *inside* the dangerous core under a tightly-scoped, Archon-granted goal amends the [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) hard floor (and needs the ship-time gates to become goal-aware). Deliberately **last**, behind its own security-reviewed ADR. Until then, protected-scope goals require a Metic+ holder.
 - **An AI relevance / anti-hack judge** at create/claim time (reusing the grader subagent harness; advisory-first, flag-for-Metic, never hard-blocking a newcomer) — a later phase; the deterministic scope + protected-path gates ship first.
 
 ---
 
 ## The build plan (phases → planning-session tasks)
 
-Each phase ships independently; implementing tasks are created via `/planning-session` under the live internal version (a criterion cluster alongside the [ADR 0083](<redacted>.md) BV1 module work).
+Each phase ships independently; implementing tasks are created via `/planning-session` under the live internal version (a criterion cluster alongside the [ADR 0083](0083-modular-architecture-strangler-build-plan.md) BV1 module work).
 
 | Phase | Delivers | Depends on |
 |---|---|---|
@@ -107,16 +107,16 @@ Each phase ships independently; implementing tasks are created via `/planning-se
 - **Reuse `parent_task_id` for goals (a goal = a parent task) — rejected.** One-level cap ([`hierarchy.js`](../../src/bongos/hierarchy.js)), wrong lifecycle (a goal is a standing grant, not shippable work that earns credit on ship), and a task has no place for scope or membership.
 - **Reuse `done_when_criteria` as goals — rejected.** That table *is* the criteria tier; overloading it with membership + a creation grant conflates "definition of done" with "who may do work." A goal *links to* criteria; it is not one.
 - **Single-owner goals — rejected** (Lars). Goals are shared workspaces; a single assignee would force mega-claims and block collaboration. Membership grants the authority; contribution (not membership alone) is what any future reward weights on.
-- **A bespoke per-task rank cap at goal-create — rejected in favour of [ADR 0084](<redacted>.md).** The auto-derived floor already prevents a member minting a task that escapes their gate; a second mechanism would be a second list that drifts (the SEC [#863](https://example.com/builders#/task/863) failure mode).
+- **A bespoke per-task rank cap at goal-create — rejected in favour of [ADR 0084](0084-auto-derived-per-task-rank-floor.md).** The auto-derived floor already prevents a member minting a task that escapes their gate; a second mechanism would be a second list that drifts (the SEC [#863](https://example.com/builders#/task/863) failure mode).
 - **Restrict dependencies to within a single goal — rejected** (Lars). Real dependencies cross goals; self-containment forces mega-goals or fakery. A dependency is only a reference, so cross-goal is safe and surfaces coordination.
-- **Hard-code the hierarchy / build a full tier-editor UI now — both rejected.** A config preset edited at onboarding (the [ADR 0062](<redacted>.md) pattern) is the right middle: configurable per instance without a heavy runtime editor.
+- **Hard-code the hierarchy / build a full tier-editor UI now — both rejected.** A config preset edited at onboarding (the [ADR 0062](0062-medusa-instance-model-decoupling.md) pattern) is the right middle: configurable per instance without a heavy runtime editor.
 - **Open task creation to all ranks generally (no goal) — rejected.** That removes the scope wall entirely; the whole safety model is that authority is *bounded by an assigned goal's modules*, not granted by rank alone.
 
 ---
 
 ## Consequences
 
-**Positive.** Lower-rank builders gain real maneuverability (author + organize their own work) without weakening the trust boundary — authority is bounded by an assigned, module-scoped goal and enforced server-side. It fills [ADR 0083](<redacted>.md) Rule 5 and reuses almost everything (versions, criteria, tasks, sub-tasks, the protected-path matcher, the auto-derived rank floor, the dependency/auto-promotion engine, the access-request pattern, the idea-triage cadence shape). The "carve more modules first" map is also an ADR-0083 deliverable. Each phase ships independently and is individually revertible.
+**Positive.** Lower-rank builders gain real maneuverability (author + organize their own work) without weakening the trust boundary — authority is bounded by an assigned, module-scoped goal and enforced server-side. It fills [ADR 0083](0083-modular-architecture-strangler-build-plan.md) Rule 5 and reuses almost everything (versions, criteria, tasks, sub-tasks, the protected-path matcher, the auto-derived rank floor, the dependency/auto-promotion engine, the access-request pattern, the idea-triage cadence shape). The "carve more modules first" map is also an ADR-0083 deliverable. Each phase ships independently and is individually revertible.
 
 **Negative / cost.** Schema changes to two core tables (`done_when_criteria` re-parenting under goals; `tasks.goal_id`) plus new `goals`/`goal_members`/`dependencies` tables and a criteria backfill — touches the lifecycle/`migrations` core, so those PRs ride the gate hard-floor and need owner sign-off (the boundary working as designed). The `/status` rollup, `/planning-session`, and the criterion-satisfy route all change. It is a deliberate **widening of the trust boundary** (sub-Metic builders can now create tasks), justified by the layered scope + protected-path + auto-rank-floor + ship-gate defenses; that widening is exactly why this is its own ADR.
 

package/docs/adr/0087-bongos-app-architecture-and-handoff-contract.md

@@ -1,7 +1,7 @@
 # ADR 0087 — Bongos app architecture + the model-agnostic feedback handoff contract
 
 **Date:** 2026-06-26
-**Context:** Bongos App `BONGOS-V1` / criterion C4 (the feedback loop closes — capture lands in a coding agent), task [#1312](https://example.com/builders#/task/1312) (`BV1.R33`). Records the architecture the R01–R14 rungs built and pins the contract the three handoff paths (R12 [#1307](https://example.com/builders#/task/1307), R13 [#1308](https://example.com/builders#/task/1308), R14 [#1309](https://example.com/builders#/task/1309)) share. Builds on [ADR 0045](<redacted>.md) (the Dev Box desktop app, now absorbed), [ADR 0072](<redacted>.md) (signing posture), [ADR 0083](<redacted>.md) (the modular core), and the [ADR 0062](<redacted>.md) core↔host split.
+**Context:** Bongos App `BONGOS-V1` / criterion C4 (the feedback loop closes — capture lands in a coding agent), task [#1312](https://example.com/builders#/task/1312) (`BV1.R33`). Records the architecture the R01–R14 rungs built and pins the contract the three handoff paths (R12 [#1307](https://example.com/builders#/task/1307), R13 [#1308](https://example.com/builders#/task/1308), R14 [#1309](https://example.com/builders#/task/1309)) share. Builds on [ADR 0045](0045-devbox-desktop-app.md) (the Dev Box desktop app, now absorbed), [ADR 0072](0072-bongos-app-mac-signed-first-windows-deferred.md) (signing posture), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the modular core), and the [ADR 0062](0062-medusa-instance-model-decoupling.md) core↔host split.
 **Status:** Accepted.
 **Track:** `internal` (development system → the Cloud Bongos desktop app line; bongos succeeds the GDS as the primary builder surface after GDS-V4).
 
@@ -13,7 +13,7 @@ This ADR records (a) the app's overall shape, and (b) the one contract all the h
 
 ## The architecture (what R01–R14 built)
 
-**One umbrella desktop app that absorbs the Dev Box app.** `bongos-app/` is the single signed Cloud Bongos desktop app ([#1298](https://example.com/builders#/task/1298)). The existing Dev Box app ([ADR 0045](<redacted>.md)) becomes a *module* of it rather than a sibling install — one Electron shell, one app-pairing auth (`~/.config/otb/gds-session.json`), one branded `/downloads` distribution, one in-app updater, one Apple Developer ID ([ADR 0072](<redacted>.md)). The result offers both the Dev Box switch and the new feedback toolbar.
+**One umbrella desktop app that absorbs the Dev Box app.** `bongos-app/` is the single signed Cloud Bongos desktop app ([#1298](https://example.com/builders#/task/1298)). The existing Dev Box app ([ADR 0045](0045-devbox-desktop-app.md)) becomes a *module* of it rather than a sibling install — one Electron shell, one app-pairing auth (`~/.config/otb/gds-session.json`), one branded `/downloads` distribution, one in-app updater, one Apple Developer ID ([ADR 0072](0072-bongos-app-mac-signed-first-windows-deferred.md)). The result offers both the Dev Box switch and the new feedback toolbar.
 
 **A three-stage pipeline: capture → synthesize → handoff.**
 
@@ -23,7 +23,7 @@ This ADR records (a) the app's overall shape, and (b) the one contract all the h
 
 **The Rung-3 capture floor; element-select deferred to V2.** V1 captures at the **visual** rung — pixels (screen region + frames + freeze-frame markup) plus voice. This is the robust floor: it works over *any* app on screen with no per-app integration, and needs only Screen-Recording + Microphone grants. Higher-fidelity **element-level reads** (resolving the actual UI element under the cursor via macOS Accessibility / a DOM bridge — the "rung-2" reads) are **deferred to V2**: the permission wizard (R05) requests Accessibility *lazily*, only when those reads land, never up front. Capturing pixels-not-elements is a deliberate V1 scope cut, not an accident — it keeps V1 universal and the permission ask minimal.
 
-**Bongos as the GDS successor.** The longer arc ([ADR 0072](<redacted>.md) track line): the Bongos app is where building moves *after* GDS-V4 — the feedback loop (see → say → ship) becomes the primary way an owner directs AI builders, with the GDS's task/claim/ship machinery underneath. This ADR is the first architectural record of that intent.
+**Bongos as the GDS successor.** The longer arc ([ADR 0072](0072-bongos-app-mac-signed-first-windows-deferred.md) track line): the Bongos app is where building moves *after* GDS-V4 — the feedback loop (see → say → ship) becomes the primary way an owner directs AI builders, with the GDS's task/claim/ship machinery underneath. This ADR is the first architectural record of that intent.
 
 ## Decision — the model-agnostic handoff contract
 
@@ -41,9 +41,9 @@ MCP's stdio transport is newline-delimited JSON-RPC 2.0. The four methods a sing
 
 ## Consequences
 
-- **Adding a fourth agent is an adapter, not a redesign.** A new target (Cursor, Codex) consumes the *same* bundle via the *same* `resolveLatest()` — the contract already says "prompt text + absolute image paths." The handoff layer is the seam ([ADR 0081](<redacted>.md)'s swappable-adapter pattern, applied to feedback).
+- **Adding a fourth agent is an adapter, not a redesign.** A new target (Cursor, Codex) consumes the *same* bundle via the *same* `resolveLatest()` — the contract already says "prompt text + absolute image paths." The handoff layer is the seam ([ADR 0081](0081-tool-agnostic-design-layer.md)'s swappable-adapter pattern, applied to feedback).
 - **The `latest` pointer is the single source of truth for "newest bundle."** A reader never scans for itself unless the pointer is missing (then `resolveLatest()` self-heals by scanning for the newest dir with a `prompt.md`). `latest.json` is authoritative cross-platform; the `latest/` symlink is a convenience that may be absent on Windows without symlink privilege — readers never depend on it.
 - **`writeBundle` now has a side effect beyond writing the bundle** (it records `latest`). This is intentional and best-effort: a pointer failure is swallowed and never loses the bundle already on disk.
 - **Frames are paths everywhere, base64 nowhere.** Enforced by the bundle format (R11) and re-asserted by the R14 tool result + the test suite. The day an agent needs bytes, it reads the path — the cap-safe choice.
 - **Element-select is the headline V2 lift.** When rung-2 element reads land, the bundle gains structured element context *alongside* the pixels; the handoff contract (paths, not payloads) does not change.
-- **Budget: $0 new recurring cost.** Zero-dependency MCP, on-device transcription, local file bundles. The app rides the already-paid Apple Developer ID ([ADR 0072](<redacted>.md)).
+- **Budget: $0 new recurring cost.** Zero-dependency MCP, on-device transcription, local file bundles. The app rides the already-paid Apple Developer ID ([ADR 0072](0072-bongos-app-mac-signed-first-windows-deferred.md)).

package/docs/adr/0087-compete-on-governance-not-tooling-cursor.md

@@ -1,6 +1,6 @@
 # ADR 0087 — Compete with Cursor on governance, not tooling
 
-**Status:** Accepted (2026-06-24) · task [#1505](https://example.com/builders#/task/1505) · **companion to** [ADR 0083](<redacted>.md) (modular-architecture strangler build plan); builds on [ADR 0016](<redacted>.md) (server-enforced trust boundary), [ADR 0043](<redacted>.md) (rank floor on permission paths), [ADR 0061](<redacted>.md) (context-layer decomposition), [ADR 0081](<redacted>.md) (tool-agnostic design layer), [ADR 0024](<redacted>.md) (MAS). **Red-teams** [`docs/design/modular-architecture/`](../design/modular-architecture/).
+**Status:** Accepted (2026-06-24) · task [#1505](https://example.com/builders#/task/1505) · **companion to** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (modular-architecture strangler build plan); builds on [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced trust boundary), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (rank floor on permission paths), [ADR 0061](0061-context-layer-decomposition.md) (context-layer decomposition), [ADR 0081](0081-tool-agnostic-design-layer.md) (tool-agnostic design layer), [ADR 0024](0024-multi-agent-system-architecture.md) (MAS). **Red-teams** [`docs/design/modular-architecture/`](../design/modular-architecture/).
 
 ## Context