@bongos/core 1.19.725 → 1.19.727

package/scripts/gds/provision-units.js

@@ -71,8 +71,8 @@ function serviceUnitPath(inst) { return `/etc/systemd/system/${inst.slug}.servic
 // ── nightly DB backup: per-instance timer + service (task 2213) ─────────────
 // PRODUCTIZES the manual task-2210 fix: a newly-provisioned instance was born with
 // NO backups (dir absent, GDS_BACKUP_DB unset → the script fell back to the
-// nonexistent `amazonprimea` default, and the repo's global gds-db-backup units
-// hardcode /home/lars/amazonprimea — wrong for the consumer node_modules/@bongos/
+// nonexistent `example` default, and the repo's global gds-db-backup units
+// hardcode /home/lars/example — wrong for the consumer node_modules/@bongos/
 // core layout). These generators emit a PER-INSTANCE unit pair that fixes all three:
 //   • name  → `<slug>-db-backup.{service,timer}` so co-tenant instances on one box
 //             never collide (each dumps its OWN db; the script's retention prune is

package/scripts/gds/publish-manifest.js

@@ -281,12 +281,27 @@ const INSTANCE_EXCLUDE = [
   'docs/design/container-exterior-tiles.md',
   'docs/design/container-interior.md',
   'docs/design/world-map-scroll.md',
+  // instance-specific UI MOCKUPS — iteration snapshots of THIS instance's own hub (hub v1/v2/v3,
+  // the wizard, the projects hub, the world chrome), branded end to end in markup a consumer of
+  // the portable core has no use for: they are our design history, not methodology. Same reason as
+  // the game-design carve-out above, and the same failure mode — redaction de-brands names in DOCS,
+  // but an .html is a FUNCTIONAL file that ships verbatim, so every brand string in the mock markup
+  // reached the published artifact. They were 117 of the 240 remaining leak-scan hits. Excluding the
+  // subtree rather than the six files is deliberate: it is the boundary that holds when someone adds
+  // mockup number seven. (task 1003869)
+  'docs/design/mocks/',
   // instance-HISTORY ADRs (task 1002219 / audit H5). These record THIS platform-family's own
   // migration + identity history (the amazonprimea→cloudbongos lift, the standalone reprovision,
   // the cloudbongos identity hub) — they are inherently full of the prior instance's name/owner and
   // genericize to nothing (unlike a portable methodology ADR). docs/adr/ is allowlisted wholesale for
   // the portable decision records; these three stay in this repo and never ship in the core, mirroring
   // the instance-recipe / game-design carve-outs above. (The portable ADRs + the README index still publish.)
+  // The instance's OWN name + trademark decision. Its prose redacts cleanly, but the FILENAME
+  // carries the brand and the publish manifest lists every path — so the literal shipped in
+  // .bongos-core.json no matter how well the body was redacted. It also genericizes to nothing:
+  // "accepting trademark risk on <our name>" is not a decision another instance inherits.
+  // (task 1003869 — the last literal in the artifact.)
+  'docs/adr/0004-amazonprimea-name-and-trademark-acceptance.md',
   'docs/adr/0139-platform-history-migration-to-cloudbongos.md',
   'docs/adr/0140-cloudbongos-standalone-reprovision.md',
   'docs/adr/0141-cross-site-identity-federated-hub-idp.md',

package/scripts/gds/repo-metrics.js

@@ -6,7 +6,7 @@
 // out to git / wc / knip and emits a JSON snapshot of repo health, then upserts
 // it into repo_health_snapshots (idempotent on calendar date — rerun same day
 // = upsert, not a new row). The latest row feeds /api/gds/public/repo-health,
-// which renders a trend tile on status.amazonprimea.com.
+// which renders a trend tile on status.example.com.
 //
 // What the snapshot contains:
 //   - total_loc + loc_by_dir   — tracked JS/MJS line counts, per watched dir

package/scripts/gds/sandbox-stage.js

@@ -6,7 +6,7 @@
 //
 // Two preview contexts (resolvePreviewContext picks one):
 //   - BOX (ADR 0031): box-game-preview.service serves the working tree at
-//     https://sandbox-<login>.amazonprimea.com; "staging" restarts the service.
+//     https://sandbox-<login>.example.com; "staging" restarts the service.
 //   - LOCAL (task 1056): a builder on a full local clone (laptop) runs the same
 //     ADR 0052 game-only entry privately at http://localhost:<port> via
 //     scripts/gds/local-preview.js; "staging" (re)starts that local process.

package/scripts/gds/seed-bongos-coreB-tranche1-tasks.js

@@ -7,7 +7,7 @@
 // Run: node scripts/gds/seed-bongos-coreB-tranche1-tasks.js
 const os = require('os');
 const TOKEN = require(os.homedir() + '/.config/otb/gds-session.json').token;
-const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://amazonprimea.com';
+const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://example.com';
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 
 // ref → task spec. depends_on_refs are local R## refs resolved after create.

package/scripts/gds/seed-bongos-coreB-tranche2-tasks.js

@@ -9,7 +9,7 @@
 // Run: node scripts/gds/seed-bongos-coreB-tranche2-tasks.js
 const os = require('os');
 const TOKEN = require(os.homedir() + '/.config/otb/gds-session.json').token;
-const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://amazonprimea.com';
+const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://example.com';
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 
 // ref → task spec. deps are local R## refs resolved after create. Clean-slicing

package/scripts/gds/seed-bongos-goal-hierarchy-tasks.js

@@ -47,7 +47,7 @@ const TASKS = [
   {
     key: 'G02',
     title: 'config/hierarchy.json + hierarchy-config.js — the six-tier preset (onboarding-edited)',
-    description: `Phase 1 of the goal hierarchy (ADR 0086 §1 — the ADR 0062 core/host pattern applied to the work model). Add \`config/hierarchy.json\` (joins branding.json/modules.json as host config) declaring the tiers — names, order, and which tier carries scope, membership, and criteria. Ship the six-tier Amazonprimea preset: Project → Version → Goal → Criteria → Task → Sub-task. Add \`src/bongos/hierarchy-config.js\` (mirrors src/modules.js) to load + validate it. v1 "editable" = owner-set labels, enable/disable, and which tier owns scope/criteria/membership; arbitrary custom tier graphs are explicitly DEFERRED. Owner fills/edits during onboarding (extend the scripts/gds/init.js interview).
+    description: `Phase 1 of the goal hierarchy (ADR 0086 §1 — the ADR 0062 core/host pattern applied to the work model). Add \`config/hierarchy.json\` (joins branding.json/modules.json as host config) declaring the tiers — names, order, and which tier carries scope, membership, and criteria. Ship the six-tier Example preset: Project → Version → Goal → Criteria → Task → Sub-task. Add \`src/bongos/hierarchy-config.js\` (mirrors src/modules.js) to load + validate it. v1 "editable" = owner-set labels, enable/disable, and which tier owns scope/criteria/membership; arbitrary custom tier graphs are explicitly DEFERRED. Owner fills/edits during onboarding (extend the scripts/gds/init.js interview).
 
 **Done when:** hierarchy.json + hierarchy-config.js exist; the loader validates + exposes the tier set; the six-tier preset is the OTB default; onboarding can set labels/enable/scope-owner; unit test covers a malformed preset rejected.`,
     kind: 'feature', discipline: 'engineer', priority: 5,

package/scripts/gds/seed-bongos-tasks.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Seed the 6 net-new "Cloud Bongos CLI" tasks added to GDS-V4 (C8) — the
 // conda/Miniconda-style terminal-first onboarding toolkit. `bongos` is the CLI
-// command (Cloud Bongos = the standalone build platform; Amazonprimea =
+// command (Cloud Bongos = the standalone build platform; Example =
 // instance 1). Design doc: artifact 02bcca71 (the bongos toolkit).
 //
 // Shape mirrors seed-medusa-tasks.js exactly:
@@ -98,7 +98,7 @@ A small public, read-only endpoint returning the instance descriptor assembled f
 
 \`bongos login <instance-url>\` fetches the P4A manifest, runs the GitHub device-flow (browser-click, no token paste — the UI-first rule), stores a per-instance scoped session, and brands the CLI for that instance. For someone NOT yet admitted, it files the public POST /api/gds/access-requests (their GitHub username) and polls — telling them "an Archon will approve you with a 👍 in Discord" — until admission flips, then completes sign-in. No GitHub collaborator invite is involved. Default admission is invite-only. Also folds the already-planned \`bongos init\` (scaffold a brand-new instance, R65) and \`bongos upgrade\` (R64) in as subcommands of the same CLI.
 
-**Done when:** \`bongos login <any-instance-url>\` works end-to-end including the not-yet-admitted path (files the request, polls, completes once approved); the CLI is instance-agnostic (no hard-coded amazonprimea); \`init\`/\`upgrade\` are reachable subcommands.`,
+**Done when:** \`bongos login <any-instance-url>\` works end-to-end including the not-yet-admitted path (files the request, polls, completes once approved); the CLI is instance-agnostic (no hard-coded example); \`init\`/\`upgrade\` are reachable subcommands.`,
     kind: 'feature', discipline: 'engineer', priority: 3,
     est_minutes: 360, manual_degree: 2, credits_reward: 60,
     touches: ['bin/', 'scripts/gds/'], criteria: ['C8'], deps: ['P1', 'P4A'],

package/scripts/gds/seed-gds-v4-tasks.js

@@ -379,7 +379,7 @@ Reconcile shipped tasks against uploaded session records (BFG 6D follow-up to ta
     title: 'Embedding provider decision + key provisioning (Archon go-ahead)',
     description: `**Criterion:** one-call-recall (gated by V4.R24's go/no-go).
 
-If the eval gate says GO: pick the provider (research recommendation: Voyage voyage-4-lite — $0.02/M tokens, 200M free tier, Matryoshka dims; fallback OpenAI text-embedding-3-small), create the account, provision EMBEDDINGS_API_KEY into /etc/amazonprimea/secrets.env per ADR 0022. New external account = Lars's explicit go-ahead per the budget rules.
+If the eval gate says GO: pick the provider (research recommendation: Voyage voyage-4-lite — $0.02/M tokens, 200M free tier, Matryoshka dims; fallback OpenAI text-embedding-3-small), create the account, provision EMBEDDINGS_API_KEY into /etc/example/secrets.env per ADR 0022. New external account = Lars's explicit go-ahead per the budget rules.
 
 **Done when:** decision recorded (ADR addendum), key live on the droplet, cost expectations logged.`,
     kind: 'decision', discipline: 'engineering', priority: 2,

package/scripts/gds/seed-medusa-tasks.js

@@ -2,9 +2,9 @@
 // Seed the 24 net-new "Medusa" tasks (R50–R73) added to GDS-V4 in the
 // 2026-06-17 Medusa Planning Session (meta task 1188 / claim 982).
 //
-// Medusa = decouple the GDS from the Amazonprimea game into a standalone,
+// Medusa = decouple the GDS from the Example game into a standalone,
 // configurable, self-hostable, AGPL open-source, non-profit, AI-first build
-// platform. Amazonprimea becomes instance 1.
+// platform. Example becomes instance 1.
 //
 // Companion migration 110_medusa_planning_seed.sql handles:
 //   - the 2 done_when_criteria rows (C8 = medusa-standalone-instance,
@@ -66,7 +66,7 @@ A Medusa-only boot (sibling to src/preview-server.js) that builds the Express ap
     title: 'GDS-owned DB pool + migration carve-out + drop the track enum',
     description: `Part of Medusa (C8). Cross-ref: R50 design.
 
-A GDS-owned pool reading DATABASE_URL/PG* (not hard-defaulting to the amazonprimea DB name); a GDS-only migration sequence (game migrations 001/002 simply not applied on a fresh non-game instance); drop the product/internal 'track' distinction. Live prod keeps its existing DB. Zero cross-FKs exist between game and GDS tables, so the split is clean.
+A GDS-owned pool reading DATABASE_URL/PG* (not hard-defaulting to the example DB name); a GDS-only migration sequence (game migrations 001/002 simply not applied on a fresh non-game instance); drop the product/internal 'track' distinction. Live prod keeps its existing DB. Zero cross-FKs exist between game and GDS tables, so the split is clean.
 
 **Done when:** a fresh-DB migration run produces only the build-system schema; a query asserts the game tables (world_events, players, seats) are absent; live prod unaffected.`,
     kind: 'infra', discipline: 'engineer', priority: 5,
@@ -80,7 +80,7 @@ A GDS-owned pool reading DATABASE_URL/PG* (not hard-defaulting to the amazonprim
 
 A per-instance config layer (config/branding.json + a documented schema + a neutral starter + a fill-it-in prompt an owner's own LLM uses) supplying product name, domain/cookie apex, sign-in (OAuth) origin, repo binding, currency label, copy, fonts, palette, icons/favicon/cursors. Core reads identity + branding from this layer; defaults preserve live OTB exactly. NOT a vanilla strip — branding becomes per-instance config; OTB's look becomes instance 1's pack (extracted in R57).
 
-**Done when:** core resolves all identity + branding from config; booting under a non-amazonprimea.com domain + a non-game name needs config only, no source edits. Gates most de-brand + self-host tasks.`,
+**Done when:** core resolves all identity + branding from config; booting under a non-example.com domain + a non-game name needs config only, no source edits. Gates most de-brand + self-host tasks.`,
     kind: 'feature', discipline: 'engineer', priority: 5,
     est_minutes: 360, manual_degree: 2, credits_reward: 60,
     touches: ['config/', 'src/bongos/', 'public-builders/'], criteria: ['C8'], deps: ['R50'],
@@ -128,7 +128,7 @@ Make the reward currency a configurable label (neutral default; OTB's instance =
     title: "Extract OTB's look into instance 1's branding pack (not a vanilla strip)",
     description: `Part of Medusa (C8). Cross-ref: R53, R56.
 
-Move the ~272 archaic strings, the Greek fonts, the parchment palette, favicon/cursors/SVG sigils, and the page copy out of the hall + status code and into instance 1's branding pack; core renders from the R53 branding layer with a neutral starter as the fallback. status.amazonprimea.com + builders.amazonprimea.com look IDENTICAL afterward — their look just comes from config now. Add a rank display-label map so the Greek rank LABELS are presentation (the enum stays Greek by decision).
+Move the ~272 archaic strings, the Greek fonts, the parchment palette, favicon/cursors/SVG sigils, and the page copy out of the hall + status code and into instance 1's branding pack; core renders from the R53 branding layer with a neutral starter as the fallback. status.example.com + builders.example.com look IDENTICAL afterward — their look just comes from config now. Add a rank display-label map so the Greek rank LABELS are presentation (the enum stays Greek by decision).
 
 **Done when:** no project branding is hard-coded in public-builders/ or public-status/; OTB's surfaces render unchanged from instance 1's pack; a fresh instance renders the neutral starter.`,
     kind: 'refactor', discipline: 'engineer', priority: 4,
@@ -142,7 +142,7 @@ Move the ~272 archaic strings, the Greek fonts, the parchment palette, favicon/c
 
 scripts/gds/gen-diagrams.js auto-generates the onboarding diagrams + assertions.json on every deploy. Make its template strings + assertions read the instance branding config so deploy-time regeneration emits neutral (instance-correct) branding. Rank names stay Greek by decision. This prevents the "we de-branded but Greek text reappeared after the next deploy" regression.
 
-**Done when:** running gen-diagrams.js under a neutral instance config produces diagrams + assertions.json with no hard-coded OTB/Amazonprimea tokens; OTB's instance still renders its own branding.`,
+**Done when:** running gen-diagrams.js under a neutral instance config produces diagrams + assertions.json with no hard-coded OTB/Example tokens; OTB's instance still renders its own branding.`,
     kind: 'refactor', discipline: 'engineer', priority: 4,
     est_minutes: 180, manual_degree: 2, credits_reward: 30,
     touches: ['scripts/gds/gen-diagrams.js'], criteria: ['C8'], deps: ['R53'],
@@ -190,7 +190,7 @@ The CLI config root (~/.config/otb/: gds-session.json, env, discord-webhooks.jso
     title: 'Config-driven owner bootstrap + per-instance repo/OAuth binding',
     description: `Part of Medusa (C8). Cross-ref: R52, R53.
 
-Replace migration 023's hard-coded founding-Archon literal (UPDATE builders SET rank='archon' WHERE github_login='lars589') with an install-time first-admin bootstrap from instance config. Make the GitHub repo binding (repo-info.js — the OTB_GITHUB_OWNER/REPO seam already exists) and the OAuth/App config per-instance. Single-project model keeps the global economy fine — only the owner literal + repo/OAuth need to generalize.
+Replace migration 023's hard-coded founding-Archon literal (UPDATE builders SET rank='archon' WHERE github_login='example-owner') with an install-time first-admin bootstrap from instance config. Make the GitHub repo binding (repo-info.js — the OTB_GITHUB_OWNER/REPO seam already exists) and the OAuth/App config per-instance. Single-project model keeps the global economy fine — only the owner literal + repo/OAuth need to generalize.
 
 **Done when:** grep over migrations/ returns zero login literals; a fresh install seats the configured first admin; repo + OAuth resolve from instance config.`,
     kind: 'feature', discipline: 'engineer', priority: 4,
@@ -202,7 +202,7 @@ Replace migration 023's hard-coded founding-Archon literal (UPDATE builders SET
     title: 'Containerized self-host instance (Dockerfile + docker-compose)',
     description: `Part of Medusa (C8). Cross-ref: R51, R52.
 
-A Dockerfile + docker-compose (app + Postgres) that brings a Medusa instance up from clean state with ZERO hard-coded droplet IP (104.236.254.243), amazonprimea systemd unit, or hand-maintained ~/deploy.sh. This is the self-host artifact; it does not touch prod's existing laptop/CI deploy path.
+A Dockerfile + docker-compose (app + Postgres) that brings a Medusa instance up from clean state with ZERO hard-coded droplet IP, instance-specific systemd unit, or hand-maintained ~/deploy.sh. This is the self-host artifact; it does not touch prod's existing laptop/CI deploy path.
 
 **Done when:** \`docker compose up\` on a machine that has never seen our droplet brings up Medusa + Postgres and the hall is reachable; no prod topology referenced anywhere in the path.`,
     kind: 'infra', discipline: 'engineer', priority: 4,
@@ -248,7 +248,7 @@ Separate the portable methodology core Medusa ships (the working rules, the sess
   {
     ref: 'R67',
     title: 'PROOF — Medusa dogfood: a second, differently-branded non-game instance ships a task',
-    description: `Part of Medusa (C8) — the proof-task that satisfies C8 ("the GDS builds itself"). Customer 0 = Medusa itself, running on the vanilla brand pack (R74); customer 1 = Amazonprimea.
+    description: `Part of Medusa (C8) — the proof-task that satisfies C8 ("the GDS builds itself"). Customer 0 = Medusa itself, running on the vanilla brand pack (R74); customer 1 = Example.
 
 Stand Medusa up as customer 0 (its own database, vanilla brand, no game code) and take one real task through the full lifecycle on it: claim -> grade -> merge -> ship with credits awarded. Medusa building Medusa, on Medusa. (A separate non-game third project is an acceptable alternative proof, but customer-0 self-build is the truest.)
 
@@ -342,7 +342,7 @@ Verify the private and public lineages stay consistent: migration numbering (the
     title: 'Medusa vanilla brand pack — the plain "customer 0" identity (Substack-like)',
     description: `Part of Medusa (C8). Cross-ref: R53 (branding-contract layer), R57 (customer 1 / OTB pack).
 
-Design + build the canonical Medusa VANILLA brand pack — the identity Medusa itself runs on as **customer 0** (Amazonprimea is customer 1). Deliberately PLAIN, clean, modern, professional — restrained palette, clean sans-serif type, minimal wordmark, plain-English product copy, simple favicon/icons. Aesthetic touchstone: Substack-plain; take INSPIRATION from planetscale.com's simplicity (do NOT copy). Delivered as a branding pack against the R53 contract; it is the default the hall + status render under when no other pack is supplied, and the brand Medusa ships on. Distinct from R57 (extracting customer 1 / OTB's Greek look) — this is customer 0's identity. No game/Greek flavor.
+Design + build the canonical Medusa VANILLA brand pack — the identity Medusa itself runs on as **customer 0** (Example is customer 1). Deliberately PLAIN, clean, modern, professional — restrained palette, clean sans-serif type, minimal wordmark, plain-English product copy, simple favicon/icons. Aesthetic touchstone: Substack-plain; take INSPIRATION from planetscale.com's simplicity (do NOT copy). Delivered as a branding pack against the R53 contract; it is the default the hall + status render under when no other pack is supplied, and the brand Medusa ships on. Distinct from R57 (extracting customer 1 / OTB's Greek look) — this is customer 0's identity. No game/Greek flavor.
 
 **Done when:** a complete Medusa vanilla brand pack (name/wordmark, restrained palette, clean type, plain copy, favicon/icons) renders the hall + status as a plain, professional dev toolkit; it is the pack customer 0 (Medusa) runs on; verified on the standalone boot.`,
     kind: 'feature', discipline: 'artist', priority: 4,

package/scripts/gds/seed-module-upstreaming.js

@@ -19,7 +19,7 @@ const DRY = process.argv.includes('--dry-run');
 const VERSION = 'BONGOS-V1';
 const GOAL_TITLE = 'Module upstreaming & catalog — instances contribute modules into core';
 const GOAL_DESC =
-  'ADR 0107. The reverse of the ADR 0100/0103 distribution arrow: instances (Amazonprimea, ' +
+  'ADR 0107. The reverse of the ADR 0100/0103 distribution arrow: instances (Example, ' +
   'Mercury) build feature modules and submit them for approval to be merged INTO the shared ' +
   'Cloud Bongos core catalog, credited to author + origin project. Accepted modules land in ' +
   'core modules/<key>/ default-off, added to the isPublishable() allowlist; every instance may ' +

package/scripts/gds/seed-productization-tasks.js

@@ -52,7 +52,7 @@ const TASKS = [
     title: 'ADR: instance docs-discovery contract (how an agent finds its hall/docs)',
     description: `From the 2026-07-04 review (bullet 6). Today the only pointer to an instance's doc surface is \`domains.buildersOrigin\` in branding.json. A fresh self-hosted instance needs a DEFINED contract for how an agent reliably locates its builders' hall + rendered docs from config alone (standard docs location? discovery endpoint? manifest field?). Write an ADR that pins the contract, then CLAUDE.md's preamble references it instead of hand-waving.
 
-**Done when:** an ADR records the docs-discovery contract; branding/config carries the needed field(s); CLAUDE.md §0 points at the contract; a second instance can resolve its docs surface with no hard-coded amazonprimea.`,
+**Done when:** an ADR records the docs-discovery contract; branding/config carries the needed field(s); CLAUDE.md §0 points at the contract; a second instance can resolve its docs surface with no hard-coded example.`,
     kind: 'decision', discipline: 'engineer', priority: 3,
     est_minutes: 90, manual_degree: 3, credits_reward: 20,
     touches: ['docs/adr/', 'config/', 'CLAUDE.md'], criteria: ['C16'], deps: [],
@@ -80,12 +80,12 @@ const TASKS = [
   {
     key: 'NAV-HYGIENE',
     title: 'Nav hygiene — reference the module, split instance-specifics',
-    description: `From the 2026-07-04 review (bullets 42, 57, 64, 66, 68, 94). Several nav rows (and §2 prose) INLINE content that belongs to a module or to instance-specifics. Convert them to module references, and split anything naming the amazonprimea servers/assets into project-specific detail. By module:
-- **discord** (57, 64, 94): inbound #ideas, build-broadcast, channel layout → reference the discord module; the general mechanism lives there, anything naming the amazonprimea Discord server specifically → project-specific detail.
+    description: `From the 2026-07-04 review (bullets 42, 57, 64, 66, 68, 94). Several nav rows (and §2 prose) INLINE content that belongs to a module or to instance-specifics. Convert them to module references, and split anything naming the example servers/assets into project-specific detail. By module:
+- **discord** (57, 64, 94): inbound #ideas, build-broadcast, channel layout → reference the discord module; the general mechanism lives there, anything naming the example Discord server specifically → project-specific detail.
 - **art-pipeline** (66): the pixel-art design-system row → reference the art module; the pixel/greek style choice itself is instance detail.
 - **game** (68): world-cell model + paths-as-overlays rows → the game module / instance context (out of the portable core).
 
-**Done when:** those nav/§2 items are thin references to their modules; no module-owned or amazonprimea-server-specific detail is inlined in the core; the game-specific rows are out of core.`,
+**Done when:** those nav/§2 items are thin references to their modules; no module-owned or example-server-specific detail is inlined in the core; the game-specific rows are out of core.`,
     kind: 'cleanup', discipline: 'engineer', priority: 3,
     est_minutes: 120, manual_degree: 3, credits_reward: 25,
     touches: ['CLAUDE.md'], criteria: ['C32'], deps: [],
@@ -123,7 +123,7 @@ const TASKS = [
   {
     key: 'IDENTITY-ORG',
     title: 'Rationalize the identity apparatus + structure project-context.md',
-    description: `From the 2026-07-04 review (bullets 109-111, 134/140, 187). Almost every identity section (§§1,3,5,6,7,9) is now a thin pointer to project-context.md, the §3 stub verbosely re-explains the core↔host split that §1 + the charter already cover, and the §6/§7 stubs still NAME the instance ("the Amazonprimea world", "the \`otb-*\` art skills"). Meanwhile project-context.md is getting overloaded (bullet 187). Fix: collapse §§3/5/6/7 to a single minimal pointer (or one-liners), genericize instance names out of any surviving stub, and give project-context.md a real section structure.
+    description: `From the 2026-07-04 review (bullets 109-111, 134/140, 187). Almost every identity section (§§1,3,5,6,7,9) is now a thin pointer to project-context.md, the §3 stub verbosely re-explains the core↔host split that §1 + the charter already cover, and the §6/§7 stubs still NAME the instance ("the Example world", "the \`otb-*\` art skills"). Meanwhile project-context.md is getting overloaded (bullet 187). Fix: collapse §§3/5/6/7 to a single minimal pointer (or one-liners), genericize instance names out of any surviving stub, and give project-context.md a real section structure.
 
 **Done when:** the stub scaffolding is minimal + instance-name-free in the core; project-context.md has a clear, non-overloaded structure; anchors/cross-refs still resolve.`,
     kind: 'cleanup', discipline: 'engineer', priority: 3,
@@ -148,7 +148,7 @@ const TASKS = [
     title: 'Scheduled-routines portability to self-host + multi-builder',
     description: `From the 2026-07-04 review (bullet 241). The ~17 autonomous cron routines under \`.claude/scheduled-tasks/\` (overnight-code-review, idea-triage-nightly, overnight-builder, bfg, security-review-weekly, …) are written for this instance. Define how they port to a self-hosted, multi-builder world: which run instance-wide vs per-builder, how a fresh instance inherits/configures them, and what a builder gets by default. Spike → a contract (and likely a config surface).
 
-**Done when:** there's a documented model for which routines are instance-wide vs per-builder, how a fresh instance inherits them, and how a builder configures their own; no routine hard-assumes the amazonprimea instance.`,
+**Done when:** there's a documented model for which routines are instance-wide vs per-builder, how a fresh instance inherits them, and how a builder configures their own; no routine hard-assumes the example instance.`,
     kind: 'spike', discipline: 'engineer', priority: 2,
     est_minutes: 120, manual_degree: 3, credits_reward: 25,
     touches: ['.claude/scheduled-tasks/', 'docs/'], criteria: ['C16'], deps: [],

package/scripts/gds/seed-provisioning-tasks.js

@@ -7,7 +7,7 @@
 // Run: node scripts/gds/seed-provisioning-tasks.js
 const os = require('os');
 const TOKEN = require(os.homedir() + '/.config/otb/gds-session.json').token;
-const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://amazonprimea.com';
+const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://example.com';
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 const GOAL = 26; // Cloud Bongos productization and self-host
 
@@ -27,7 +27,7 @@ const TASKS = [
     deps: ['P1', 'P2'], extDeps: [] },
   { ref: 'P4', kind: 'infra', discipline: 'engineer', priority: 2, est: 300,
     title: 'BV1 — Automated DNS record + Caddy on-demand ACME TLS for a provisioned host',
-    description: 'ADR 0111 §4. Cloudflare A-record UPSERT via the shared client (P2), plus Caddy on-demand ACME (Let\'s Encrypt) so a NEWLY provisioned host is TLS-ready with no manual Cloudflare Origin-Cert console step (the least-automated leg today). On-demand TLS MUST be allow-listed to hostnames the module actually provisioned (no cert-minting for arbitrary names). Existing amazonprimea/cloudbongos apexes keep their Origin Certs unchanged. deps: P2, P3. (buildable now)',
+    description: 'ADR 0111 §4. Cloudflare A-record UPSERT via the shared client (P2), plus Caddy on-demand ACME (Let\'s Encrypt) so a NEWLY provisioned host is TLS-ready with no manual Cloudflare Origin-Cert console step (the least-automated leg today). On-demand TLS MUST be allow-listed to hostnames the module actually provisioned (no cert-minting for arbitrary names). Existing example/cloudbongos apexes keep their Origin Certs unchanged. deps: P2, P3. (buildable now)',
     deps: ['P2', 'P3'], extDeps: [] },
   { ref: 'P5', kind: 'feature', discipline: 'engineer', priority: 2, est: 240,
     title: 'BV1 — Wire provisioning into `bongos init` (idea #345 — "configured via the API")',

package/scripts/gds/seed-staging.sh

@@ -16,19 +16,32 @@
 #      column that referenced a session, then deletes all sessions so NO real
 #      bearer token persists on staging.
 #
-# SAFETY: hard-refuses to target anything but `amazonprimea_staging`, so a
+# SAFETY: hard-refuses to target any database not named `*_staging`, so a
 # fat-fingered env can never point the wipe at production. Everything runs at
-# table-owner privilege (no superuser) since `lars` owns the staging objects.
+# table-owner privilege (no superuser) — the invoking role owns the staging objects.
 #
 # "What's real, what's faked on staging": see docs/recipes/staging-data.md.
 
 set -euo pipefail
 
-PROD_DB="${PROD_DB:-amazonprimea}"
-STAGING_DB="${STAGING_DB:-amazonprimea_staging}"
+# No baked-in database names. A portable core cannot know an instance's DB, and the
+# founder's two were hardcoded here until task 1003869 — including inside the safety
+# check, which meant de-branding the names alone would have quietly disarmed it. So the
+# guard is STRUCTURAL now instead of a name comparison: the target must be named
+# <something>_staging. That keeps the original property ("a fat-fingered env can never
+# point the wipe at production", since no production DB is called *_staging) and extends
+# it to every instance rather than one. Both names must be set explicitly — this script
+# WIPES its target, so there is no default worth guessing.
+PROD_DB="${PROD_DB:-}"
+STAGING_DB="${STAGING_DB:-}"
 
-if [ "$STAGING_DB" != "amazonprimea_staging" ]; then
-  echo "REFUSING: STAGING_DB must be 'amazonprimea_staging' (got '$STAGING_DB'). This script wipes its target." >&2
+if [ -z "$STAGING_DB" ] || [ -z "$PROD_DB" ]; then
+  echo "REFUSING: set PROD_DB (the dump source) and STAGING_DB (the wipe target) explicitly." >&2
+  echo "  e.g. PROD_DB=myapp STAGING_DB=myapp_staging $0" >&2
+  exit 2
+fi
+if ! printf '%s' "$STAGING_DB" | grep -qE '^[A-Za-z0-9_]+_staging$'; then
+  echo "REFUSING: STAGING_DB '$STAGING_DB' must be a bare identifier ending in '_staging'. This script wipes its target." >&2
   exit 2
 fi
 if [ "$PROD_DB" = "$STAGING_DB" ]; then

package/scripts/gds/ship-deploy-target.js

@@ -171,7 +171,7 @@ function readSessionApiBase() {
 // PR-body deploy note, and the manual-confirm curl guidance. Precedence mirrors the
 // CLI's own base resolution: <PREFIX>_API_BASE env → the signed-in session's
 // api_base → branding publicOrigin → null (unknowable). There is NO hardcoded
-// founder host — 5 sites here baked in `https://amazonprimea.com`, so a ci-land /
+// founder host — 5 sites here baked in `https://example.com`, so a ci-land /
 // manual-confirm on a migrated instance pointed the builder at the WRONG box; the
 // ci-land/guidance sibling of resolveDeployTarget()'s laptop-mode fix (task 1002232
 // ⊃ task 1002202). Pure over its injected inputs (env / sessionApiBase / branding)

package/scripts/gds/ship-flow.js

@@ -306,7 +306,7 @@ async function shipMain() {
 
   // ---- Sandbox-first review gate (#927, ADR 0046) ----
   // On a dev box, a diff that touches game surfaces must be STAGED on the
-  // builder's own live preview (sandbox-<login>.amazonprimea.com, ADR 0044)
+  // builder's own live preview (sandbox-<login>.example.com, ADR 0044)
   // and reviewed in a browser before the claim resolves — see it running,
   // get the chance to iterate, THEN decide to ship to the main game. Laptop
   // sessions, non-game diffs, quick-tunnel boxes, and --skip-stage all pass

package/scripts/gds/smoke-gds.js

@@ -54,7 +54,7 @@ function matchedApiBaseVar(env) {
 // null.
 //
 // There is deliberately NO hardcoded host. This file baked in
-// `https://amazonprimea.com` as its fallback, so a builder signed into any OTHER
+// `https://example.com` as its fallback, so a builder signed into any OTHER
 // instance who shipped without an env override ran the ship's verification smoke
 // against the founder's box — which PASSED, because that box is healthy. The ship
 // then reported "smoke=clean" on the strength of testing a system it never

package/scripts/status-probe.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// External uptime prober for amazonprimea.com (incident 2026-06-03, task #565).
+// External uptime prober for example.com (incident 2026-06-03, task #565).
 //
 // WHY THIS EXISTS, AND WHY IT IS NOT src/bongos/uptime-poller.js:
 //   The in-process poller (src/bongos/uptime-poller.js) runs INSIDE the Node
@@ -27,7 +27,7 @@
 //   the step output). Non-zero only on its own internal error.
 //
 // USAGE:
-//   node scripts/status-probe.mjs [--dir .] [--target https://amazonprimea.com/healthz]
+//   node scripts/status-probe.mjs [--dir .] [--target https://example.com/healthz]
 //                                 [--attempts 3] [--timeout-ms 15000] [--gap-ms 10000]
 
 import { readFile, writeFile, mkdir } from 'node:fs/promises';

package/src/bongos/auth-discord.js

@@ -167,9 +167,9 @@ async function addDiscordGuildMember({ guildId, discordUserId, accessToken, role
 
 // Collect EVERY candidate auth token on the request, in priority order, with
 // duplicates removed. A browser can legitimately carry MORE THAN ONE
-// gds_session cookie: a host-only one (set on amazonprimea.com before the
+// gds_session cookie: a host-only one (set on example.com before the
 // #726/#734 apex-scoping rollout) AND the current apex-scoped one
-// (.amazonprimea.com). The browser sends both in the Cookie header. We must try
+// (.example.com). The browser sends both in the Cookie header. We must try
 // them ALL — picking only the first (as the old single-value extractToken did)
 // meant a stale/expired duplicate could shadow the live session and 401 the
 // builder (hit on the Discord link callback for builder 25). Order: Bearer

package/src/bongos/live-channel.js

@@ -35,7 +35,7 @@ let reconnectDelayMs = 2000;  // backoff before re-LISTEN; test-tunable via _set
 // exact same socket + database (PGHOST/PGDATABASE env overrides honored for
 // non-droplet environments). The DB-name default resolves through pool.js's
 // instanceDbName() — the SINGLE source for the instance's configured db.database
-// (from the branding pack) — instead of a second hardcoded "amazonprimea" literal
+// (from the branding pack) — instead of a second hardcoded "example" literal
 // (ADR 0062 §5). A non-OTB instance LISTENs on its OWN DB, and there is one place
 // to change the default.
 function pgConfig() {

package/src/bongos/permission-path-check.js

@@ -140,13 +140,80 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
-const COMPILED = PROTECTED_SURFACES.map((s) => ({ ...s, re: globToRegExp(s.glob) }));
+// task 1002874: the glob is normalised ONCE here, at build, not per candidate —
+// there are 51 surfaces and `matchProtected` runs over every changed file on the
+// push/claim/grade path. `s.glob` itself is kept VERBATIM on the entry, because it
+// is what gets reported back to a refused builder and in the registry's own docs;
+// only the compiled matcher is folded.
+const COMPILED = PROTECTED_SURFACES.map((s) => ({ ...s, re: globToRegExp(foldForMatch(s.glob)) }));
 
 // Normalize a path the way git reports it (forward slashes, no leading ./).
+// normalize — put a path in the ONE spelling matching happens in.
+//
+// task 1002874 (ADR 0151 §4, the last piece of R101's scope): this used to do
+// only backslash→slash and strip a leading './', so matching was exact-BYTES. On
+// a case-insensitive filesystem — macOS by default, and Windows, i.e. the two
+// platforms most builders use — `Src/Bongos/Auth.js` and `src/bongos/auth.js` name
+// the SAME file, and only one of them matched the protected-surface glob. Unicode
+// composition does the same thing invisibly: NFD (`e` + U+0301) and NFC (`é`) are
+// different byte strings for one filename, and a checkout can hand you either.
+// A protected-path wall you can step over by spelling is not a wall.
+//
+// BOTH SIDES go through this — the candidate here, and every registry glob ONCE at
+// COMPILED build — so the transform is applied symmetrically and matching cannot
+// become narrower. It is a strict widening: any pair that matched byte-for-byte
+// still matches after both are folded the same way. The only regression shape is
+// OVER-protection, surfacing as an unexpected claim/push refusal, never a silent
+// un-protection.
+//
+// CASE FOLD: `toLowerCase()`, and that IS the invariant fold here. The Turkish-I
+// hazard the ADR warns about belongs to `toLocaleLowerCase('tr')`, which maps
+// 'I' → 'ı' (dotless) — measured. Plain `toLowerCase()` is Unicode Default Case
+// Conversion and is locale-independent by specification, so it is the correct
+// primitive and `toLocaleLowerCase` is the one that must never appear on this
+// path. A test asserts it does not.
+//
+// ORDER: NFC first, then fold. Measured equivalent to folding first for the
+// composed-accent cases, and NFC-first keeps the input in one canonical form
+// before any other transform reasons about it.
 function normalize(p) {
   return String(p || '').replace(/\\/g, '/').replace(/^\.\//, '').trim();
 }
 
+// foldForMatch — the spelling MATCHING happens in. Separate from normalize() on
+// purpose: normalize() still produces the path we REPORT, and that must keep its
+// original case. A finding, a refusal message and a grader issue all carry
+// `file`, and on a case-sensitive filesystem (Linux, i.e. CI) a lowercased path
+// names nothing — a consumer that tried to read it would get ENOENT for a file
+// that exists.
+function foldForMatch(p) {
+  return normalize(p).normalize('NFC').toLowerCase();
+}
+
+// compileGlobMatcher(globs) → (file) => boolean, with the fold applied to BOTH
+// sides: each glob once here, the candidate on every call.
+//
+// task 1002874: this exists because `globToRegExp` + the raw `PROTECTED_GLOBS`
+// are BOTH exported, and a consumer that compiles them itself gets a byte-exact
+// matcher — which is precisely the wall this task removed, rebuilt by accident.
+// gate-review.js had done exactly that (its ESCALATE / HARD_FLOOR classifier),
+// so an uppercased spelling still slipped past CI's auto-merge gate after the
+// matcher here was fixed. Anything matching a PROTECTED-surface list should
+// compile through this, not through globToRegExp directly.
+//
+// NOT a blanket replacement for globToRegExp, deliberately. Folding widens what
+// matches, and that is only safe when matching more means protecting more. On an
+// ALLOW-list — publish-manifest's PUBLISH_ALLOWLIST, which decides what reaches
+// the public OSS mirror — widening would publish MORE files. Those lists keep
+// the exact matcher on purpose.
+function compileGlobMatcher(globs) {
+  const compiled = (globs || []).map((g) => globToRegExp(foldForMatch(g)));
+  return (file) => {
+    const folded = foldForMatch(file);
+    return folded ? compiled.some((re) => re.test(folded)) : false;
+  };
+}
+
 // Which of `files` are permission-sensitive? Returns
 // [{ file, glob, floor, permission }] — floor + permission come straight from the
 // registry entry that matched, so a governance re-map flows through every caller.
@@ -155,7 +222,11 @@ function matchProtected(files) {
   for (const raw of files || []) {
     const f = normalize(raw);
     if (!f) continue;
-    const hit = COMPILED.find((c) => c.re.test(f));
+    // Match on the FOLDED spelling, report the original one — see foldForMatch.
+    // Hoisted OUT of the predicate on purpose: inside it, the fold re-runs once
+    // per registry surface (51 today) for every candidate file.
+    const folded = foldForMatch(raw);
+    const hit = COMPILED.find((c) => c.re.test(folded));
     if (hit) out.push({ file: f, glob: hit.glob, floor: hit.floor, permission: hit.permission });
   }
   return out;
@@ -164,7 +235,8 @@ function matchProtected(files) {
 // The registry entry governing `file`, or null when the path is unprotected.
 function surfaceFor(file) {
   const f = normalize(file);
-  const hit = f ? COMPILED.find((c) => c.re.test(f)) : null;
+  const folded = f ? foldForMatch(file) : '';
+  const hit = f ? COMPILED.find((c) => c.re.test(folded)) : null;
   return hit ? { glob: hit.glob, floor: hit.floor, permission: hit.permission, group: hit.group, why: hit.why } : null;
 }
 
@@ -271,6 +343,11 @@ module.exports = {
   REGISTRY_PATH,
   SPECIALTY,
   globToRegExp,
+  compileGlobMatcher,
+  // foldForMatch is deliberately NOT exported: it is the internal spelling rule,
+  // and every caller should go through compileGlobMatcher so the fold is applied
+  // to BOTH sides. Handing it out invites a consumer to fold one side only, which
+  // is the asymmetry that breaks matching outright.
   matchProtected,
   surfaceFor,
   floorFor,

package/src/bongos/pool.js

@@ -10,7 +10,7 @@
 // DB resolution (highest wins), NOT hard-defaulting to a host's DB name:
 //   DATABASE_URL  ->  PGHOST/PGDATABASE env  ->  the instance's configured db.database
 //   (config/branding.json, else config/branding.neutral.json)
-// OTB's branding pack carries db.database='amazonprimea', so prod (no DB env set) resolves to the
+// OTB's branding pack carries db.database='example', so prod (no DB env set) resolves to the
 // exact same socket+database it used before this carve-out — live prod is unaffected. A fresh
 // instance points this at its own DB via env or its own branding pack; the neutral starter has
 // db.database=null so a misconfigured instance fails loudly rather than silently targeting OTB.