@bongos/core 1.19.803 → 1.19.805

package/tests/government_page_gates.mjs

@@ -98,7 +98,7 @@ const GATE_FLOOR = {
   // ADR 0157: `page.view.government` floor archon→metic.
   requireGovernmentPage: 'metic',
 };
-const SIGN_IN = '/api/gds/auth/web/start';
+const SIGN_IN = '/api/bongos/auth/web/start';
 
 // --- doubles ----------------------------------------------------------------
 function fakeRes() {

package/tests/hall_reference_world.mjs

@@ -241,7 +241,7 @@ const costSummaryFixture = JSON.parse(
 test('the treasury reads the endpoint that already carried the series — no new route', () => {
   // The whole point of the task: the payload had both series all along, and the
   // route's own comment calls daily[] "the treasury chart's cumulative line".
-  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/gds\/public\/cost-summary'/);
+  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/bongos\/public\/cost-summary'/);
   assert.ok(costSummaryFixture.daily.length, 'the payload really carries daily[]');
   assert.ok(costSummaryFixture.daily_credits.length, 'and daily_credits[]');
   assert.ok(Number(costSummaryFixture.total_usd) > 0, 'and the totals the prose states');

package/tests/idea_ideate_full.mjs

@@ -93,7 +93,7 @@ test('it describes NO second write path', () => {
   // ends up sending a different payload than the form does, and the two records
   // drift while both claim to be Full Ideas.
   assert.ok(!/curl/i.test(SKILL), 'no hand-rolled HTTP');
-  assert.ok(!/api\.js POST \/api\/gds\/inbox/.test(SKILL), 'no raw POST for filing an idea');
+  assert.ok(!/api\.js POST \/api\/bongos\/inbox/.test(SKILL), 'no raw POST for filing an idea');
   const grade = [...SKILL.matchAll(/grade\s*=\s*'([a-z]+)'/g)].map((m) => m[1]);
   assert.ok(grade.every((g) => g === 'full'), `only the full grade is named: ${JSON.stringify(grade)}`);
 });

package/tests/idp_federation.mjs

@@ -29,7 +29,7 @@ t('builds the hub /sso/authorize URL with client_id, redirect_uri, state', () =>
   const url = auth.idpAuthorizeUrl('https://cloudbongos.com', 'client-abc', 'st8', 'https://proj.example.com/api/gds/auth/web/callback');
   const u = new URL(url);
   assert.equal(u.origin, 'https://cloudbongos.com');
-  assert.equal(u.pathname, '/api/gds/sso/authorize');
+  assert.equal(u.pathname, '/api/bongos/sso/authorize');
   assert.equal(u.searchParams.get('client_id'), 'client-abc');
   assert.equal(u.searchParams.get('redirect_uri'), 'https://proj.example.com/api/gds/auth/web/callback');
   assert.equal(u.searchParams.get('state'), 'st8');
@@ -37,7 +37,7 @@ t('builds the hub /sso/authorize URL with client_id, redirect_uri, state', () =>
 
 t('trims a trailing slash on the hub origin', () => {
   const url = auth.idpAuthorizeUrl('https://cloudbongos.com/', 'c', 's', 'https://p/cb');
-  assert.equal(new URL(url).pathname, '/api/gds/sso/authorize');
+  assert.equal(new URL(url).pathname, '/api/bongos/sso/authorize');
   assert.ok(!url.includes('com//api'), 'no double slash between origin and path');
 });
 

package/tests/llm-cache.mjs

@@ -88,7 +88,7 @@ await arun('lookup: routes to apiCall on a HIT (right method/path/args)', async
   const r = await c.lookup(KEY, { tokensSavedEst: 12 });
   assert.equal(r.result_stdout, 'X');
   assert.equal(calls[0][0], 'POST');
-  assert.equal(calls[0][1], '/api/gds/llm-cache/lookup');
+  assert.equal(calls[0][1], '/api/bongos/llm-cache/lookup');
   assert.deepEqual(calls[0][2], { cache_key: KEY, tokens_saved_est: 12 });
   assert.deepEqual(calls[0][3], { allowUnauthenticated: true });
 });

package/tests/manage_manifest_shared_read.mjs

@@ -2,7 +2,7 @@
 // manifest per manage entry, EXECUTED (task 1003554).
 //
 // The defect this pins shut: entering /projects?view=manage fetched
-// https://<project>/api/gds/instance twice, identically and cross-origin,
+// https://<project>/api/bongos/instance twice, identically and cross-origin,
 // because the two cards that render a "what it runs right now" line — how the
 // project is reached (brand.project.platformVisibility) and how people join
 // (brand.project.joinability) — each asked the project for themselves. Two
@@ -99,7 +99,7 @@ test('the two cards of one manage entry cost ONE round trip, not two', async ()
 
   // Assert
   assert.equal(ui.requests.length, 1, 'one cross-origin GET served both lines');
-  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/gds/instance');
+  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/bongos/instance');
   assert.equal(ui.requests[0].mode, 'cors', 'the project is somebody else’s origin');
   for (const a of answers) {
     assert.equal(a.ok, true);
@@ -151,7 +151,7 @@ test('switching projects is never served the previous project’s manifest', asy
 
   // Assert
   assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
-  assert.equal(ui.requests[1].url, 'https://two.example.com/api/gds/instance');
+  assert.equal(ui.requests[1].url, 'https://two.example.com/api/bongos/instance');
 });
 
 test('a project that answered-and-refused RESOLVES carrying its status — both lines can say so', async () => {

package/tests/people_directory_clip.mjs

@@ -0,0 +1,219 @@
+// tests/people_directory_clip.mjs — the People directory says so when it is
+// clipped (task 1003110, goal 1000095).
+//
+// WHY THIS FILE EXISTS. `people.js` asks `GET /scouting` for 500 rows, which is
+// that route's HARD CEILING (parsePagination maxLimit: 500). The rollup returns
+// no count of the whole set and the route takes no offset, so a response that
+// comes back FULL is the only truncation signal the page will ever get — and
+// until this task the page simply printed "500 builders listed" and said nothing
+// else. A directory that lies by omission is worse than one that admits it is
+// incomplete.
+//
+// It runs the REAL people.js in a vm against a stub DOM and a fake fetch, so
+// what is asserted is the sentence a reader actually sees, not a regex agreeing
+// with a regex. A source-text assertion would have passed just as happily with
+// the comparison written the wrong way round.
+//
+// The four behaviours:
+//   1. the page asks for exactly the number its copy then names (no drift)
+//   2. a SHORT response is not hedged — the exact count is the honest one
+//   3. a FULL response hedges every sentence that states a total: the pill, the
+//      subtitle, and a footnote about the lenses
+//   4. one row short of the ceiling is NOT clipped (the boundary, in the
+//      direction that would otherwise cry wolf on every load)
+//
+// Run:  node tests/people_directory_clip.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const KIT_JS = read('modules/hall-ui/public/hall-kit.js');
+const PEOPLE_JS = read('modules/hall-ui/public/people.js');
+const PEOPLE_HTML = read('modules/hall-ui/public/people.html');
+
+// The route's ceiling, spelled here as the CONTRACT rather than read out of the
+// page — a test that imports the page's own constant cannot notice it changing.
+const CEILING = 500;
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+function makeEl(id) {
+  return {
+    id,
+    innerHTML: '', textContent: '', value: '',
+    hidden: false, disabled: false, className: '',
+    options: [], style: {}, dataset: {},
+    classList: { add() {}, remove() {}, toggle() {}, contains: () => false },
+    appendChild() {}, setAttribute() {}, removeAttribute() {},
+    addEventListener() {},
+    querySelector() { return makeEl(); },
+    querySelectorAll() { return []; },
+  };
+}
+
+// `count` builders, each distinct enough that a filter lens has something to bite.
+function buildersFor(count) {
+  return Array.from({ length: count }, (_, i) => ({
+    github_id: 1000 + i,
+    github_login: `builder${i}`,
+    display_name: `Builder ${i}`,
+    avatar_url: null,
+    project_count: 1,
+    total_credits: count - i,
+    total_tasks_shipped: 1,
+    total_karma: 1,
+    last_active: '2026-09-01T00:00:00Z',
+    disciplines: ['engineer'],
+  }));
+}
+
+function harness({ count }) {
+  const els = new Map();
+  const getEl = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    getElementById: getEl,
+    querySelector(sel) { return getEl(String(sel).replace(/^#/, '')); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {},
+  };
+
+  const requests = [];
+  const store = new Map();
+  const windowObj = {
+    location: { assign() {}, href: '/people' },
+    localStorage: {
+      getItem: (k) => (store.has(k) ? store.get(k) : null),
+      setItem: (k, v) => store.set(k, String(v)),
+      removeItem: (k) => store.delete(k),
+    },
+    scrollTo() {},
+    addEventListener() {},
+    matchMedia: () => ({ matches: false, addEventListener() {}, addListener() {} }),
+    OTBBranding: { currencyLabel: () => 'Credits' },
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s),
+      $: (sel) => documentObj.querySelector(sel),
+      num: (n) => Number(n) || 0,
+      fmtInt: (n) => String(Number(n) || 0),
+      fmtCompact: (n) => String(Number(n) || 0),
+      fmtDate: (iso) => String(iso ?? '').slice(0, 10),
+      rankLabel: (r) => String(r ?? ''),
+      toast() {},
+    },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    setTimeout, clearTimeout, URLSearchParams, encodeURIComponent, Date, Math, JSON,
+    fetch: (url) => {
+      requests.push(String(url));
+      return Promise.resolve({
+        ok: true,
+        status: 200,
+        json: () => Promise.resolve({ builders: buildersFor(count) }),
+      });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  // The real kit, for the same reason sessions_kit_pager.mjs runs it: the page is
+  // held to the shipped contract, not to a stub that agrees with it.
+  vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
+  vm.runInContext(PEOPLE_JS, sandbox, { filename: 'people.js' });
+
+  return { getEl, requests };
+}
+
+// ---------------------------------------------------------------------------
+
+await test('the page markup carries the footnote slot, hidden until the page writes it', () => {
+  assert.match(PEOPLE_HTML, /id="people-foot"/, 'the clipped-directory footnote has a mount');
+  const tag = PEOPLE_HTML.match(/<p[^>]*id="people-foot"[^>]*>/);
+  assert.ok(tag, 'the footnote is a <p>');
+  assert.match(tag[0], /\bhidden\b/, 'it starts hidden — an empty note is still a visible gap');
+  assert.match(tag[0], /class="ledger__note"/, "the shell's ledger footnote class, not a bespoke one");
+});
+
+await test('the page asks for exactly the ceiling, and asks for it ONCE', async () => {
+  const h = harness({ count: 3 });
+  await tick(); await tick();
+  assert.equal(h.requests.length, 1, 'one directory read');
+  assert.match(h.requests[0], /\/api\/bongos\/scouting\?limit=/);
+  const limit = Number(new URLSearchParams(h.requests[0].split('?')[1]).get('limit'));
+  assert.equal(limit, CEILING, `the page must ask for the route ceiling (${CEILING})`);
+});
+
+await test('a SHORT directory is not hedged — the exact count is the honest one', async () => {
+  const h = harness({ count: 3 });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-count').textContent, '3', 'the pill states the real count');
+  assert.equal(h.getEl('people-count').hidden, false);
+  assert.match(h.getEl('people-sub').textContent, /^3 builders listed/, 'the subtitle states the real count');
+  assert.doesNotMatch(h.getEl('people-sub').textContent, /first|more than/i,
+    'nothing is clipped, so nothing may suggest it is');
+  assert.equal(h.getEl('people-foot').hidden, true, 'no footnote on a complete directory');
+  assert.equal(h.getEl('people-foot').textContent, '', 'and no stale text left behind it');
+});
+
+await test('a FULL response hedges the pill, the subtitle AND the lenses', async () => {
+  const h = harness({ count: CEILING });
+  await tick(); await tick();
+
+  const pill = h.getEl('people-count').textContent;
+  assert.equal(pill, `${CEILING}+`, 'the pill may not state a total the page cannot know');
+
+  const sub = h.getEl('people-sub').textContent;
+  assert.match(sub, new RegExp(`first ${CEILING}\\b`), 'the subtitle says which slice this is');
+  assert.match(sub, /more than this page can load/, 'and says the directory is larger');
+  assert.doesNotMatch(sub, new RegExp(`^${CEILING} builders listed`),
+    'the old sentence claimed the slice was the whole set');
+
+  const foot = h.getEl('people-foot');
+  assert.equal(foot.hidden, false, 'the footnote is shown');
+  // THE LENSES ARE THE SHARPER LIE. Search/sort/craft re-order only the loaded
+  // set, so on a clipped directory a builder outside the top 500 cannot be found
+  // by any of them — a reader told only "the list is long" would still trust the
+  // search box.
+  assert.match(foot.textContent, /search/i, 'the footnote names the search');
+  assert.match(foot.textContent, /sort/i, 'and the sort lenses');
+  assert.match(foot.textContent, new RegExp(`will not appear`),
+    'and says plainly that a builder outside the slice is unreachable through them');
+});
+
+await test('one row short of the ceiling is NOT clipped', async () => {
+  const h = harness({ count: CEILING - 1 });
+  await tick(); await tick();
+  assert.equal(h.getEl('people-count').textContent, String(CEILING - 1),
+    'a nearly-full page is still a complete one');
+  assert.equal(h.getEl('people-foot').hidden, true, 'crying wolf here would train the notice away');
+});
+
+await test('every number in the clipped copy is the number that was requested', async () => {
+  const h = harness({ count: CEILING });
+  await tick(); await tick();
+  const limit = new URLSearchParams(h.requests[0].split('?')[1]).get('limit');
+  // The drift this guards: someone raises the request to 1000 and leaves "500"
+  // written in three sentences. Every integer the clipped copy prints must be
+  // the one the request carried.
+  const copy = [h.getEl('people-count').textContent, h.getEl('people-sub').textContent,
+    h.getEl('people-foot').textContent].join(' ');
+  const printed = copy.match(/\d+/g) || [];
+  assert.ok(printed.length >= 3, 'the clipped copy states the number more than once');
+  for (const n of printed) {
+    assert.equal(n, limit, `copy prints ${n} but the page requested ${limit}`);
+  }
+});
+
+summary();

package/tests/planning_session_skill.mjs

@@ -31,7 +31,7 @@ function test(name, fn) {
 test('the seeding contract documents the self-check convention', () => {
   assert.ok(NORM.includes('verifySeedCriteriaLinks'), 'names the helper function');
   assert.ok(NORM.includes('seed-verify-criteria.js'), 'names the shared helper file');
-  assert.ok(NORM.includes('GET /api/gds/goals/<id>'), 'names the endpoint the self-check fetches');
+  assert.ok(NORM.includes('GET /api/bongos/goals/<id>'), 'names the endpoint the self-check fetches');
 });
 
 test('the self-check is described as failing loudly on any mismatch, zero included', () => {

package/tests/platform_visibility_gate.mjs

@@ -85,7 +85,7 @@ test('gated mode: a stranger meets the door on a page, with the way in on it', a
   assert.equal(nexted, false);
   assert.equal(res.statusCode, 401, 'a refused knock is a 401, not a 200 or a redirect');
   assert.match(res.body, /Sign in/, 'the door carries the way in');
-  assert.match(res.body, /href="\/api\/gds\/auth\/web\/start\?return=%2Fprojects%3Fview%3Dmap"/,
+  assert.match(res.body, /href="\/api\/bongos\/auth\/web\/start\?return=%2Fprojects%3Fview%3Dmap"/,
     'the sign-in start returns the member to the page they knocked on — RELATIVE, which safeReturnTo honours everywhere');
   assert.match(res.body, /Spike Harbor/, 'it names the project');
   assert.match(res.body, /noindex/, 'a members-only project is not indexed');
@@ -172,7 +172,7 @@ test('the exempt list: the door, the manifest, the probes, the downloads — on
     '/api/bongos/v1/public/progress', '/api/gds/instance/anything', '/instance', '/healthzz', '/downloads',
     '/api/other/instance', '/api/bongos/provisioning/instances',
     // the apply door is METHOD-scoped, so the bare path — no verb — is not exempt
-    '/api/gds/access-requests', '/api/gds/access-requests/status',
+    '/api/bongos/access-requests', '/api/bongos/access-requests/status',
   ]) assert.equal(isExempt(p), false, `${p} must be gated`);
 });
 
@@ -184,7 +184,7 @@ test('the apply door: POST <api>/access-requests answers a stranger — and only
   for (const p of [
     '/api/gds/access-requests', '/api/bongos/access-requests', '/api/bongos/v1/access-requests',
     // the router's own tolerances, the same ones the rest of the list is held to
-    '/API/BONGOS/ACCESS-REQUESTS', '/api/gds/access-requests/',
+    '/API/BONGOS/ACCESS-REQUESTS', '/api/bongos/access-requests/',
   ]) assert.equal(isExempt(p, 'POST'), true, `POST ${p} must reach the apply route`);
 
   // The bare GET on that path is the OWNER'S QUEUE (requireBuilder +
@@ -192,15 +192,15 @@ test('the apply door: POST <api>/access-requests answers a stranger — and only
   // in front of it regardless — an exemption that ignored the verb would have
   // silently removed a layer from the queue that lists would-be builders by name.
   for (const m of ['GET', 'HEAD', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', '']) {
-    assert.equal(isExempt('/api/gds/access-requests', m), false, `${m || '(no verb)'} on the queue must stay gated`);
+    assert.equal(isExempt('/api/bongos/access-requests', m), false, `${m || '(no verb)'} on the queue must stay gated`);
   }
   // and the exemption does not spread down the path
-  for (const p of ['/api/gds/access-requests/status', '/api/gds/access-requests/invite', '/api/gds/access-requests/1']) {
+  for (const p of ['/api/bongos/access-requests/status', '/api/bongos/access-requests/invite', '/api/bongos/access-requests/1']) {
     assert.equal(isExempt(p, 'POST'), false, `POST ${p} must stay gated`);
   }
   // a method-BLIND entry is unchanged by the new shape: it still exempts any verb
   assert.equal(isExempt('/healthz', 'POST'), true, 'a bare-RegExp entry ignores the verb');
-  assert.equal(isExempt('/api/gds/instance', 'GET'), true);
+  assert.equal(isExempt('/api/bongos/instance', 'GET'), true);
 });
 
 // task 1003525 — the other half of the apply door. `bongos login` cannot re-poll the
@@ -210,15 +210,15 @@ test('the status poll: GET <api>/access-requests/status answers a stranger — t
   for (const p of [
     '/api/gds/access-requests/status', '/api/bongos/access-requests/status',
     '/api/bongos/v1/access-requests/status',
-    '/API/BONGOS/ACCESS-REQUESTS/STATUS', '/api/gds/access-requests/status/',
+    '/API/BONGOS/ACCESS-REQUESTS/STATUS', '/api/bongos/access-requests/status/',
   ]) assert.equal(isExempt(p, 'GET'), true, `GET ${p} must reach the status route`);
 
   // the two halves do not lend each other their verbs
-  assert.equal(isExempt('/api/gds/access-requests/status', 'POST'), false, 'the status route takes no write');
-  assert.equal(isExempt('/api/gds/access-requests', 'GET'), false, 'the owner queue is still not a status poll');
+  assert.equal(isExempt('/api/bongos/access-requests/status', 'POST'), false, 'the status route takes no write');
+  assert.equal(isExempt('/api/bongos/access-requests', 'GET'), false, 'the owner queue is still not a status poll');
 
   // and neither opens the review surfaces that share the prefix
-  for (const p of ['/api/gds/access-requests/invite', '/api/gds/access-requests/1/approve', '/api/gds/access-requests/1']) {
+  for (const p of ['/api/bongos/access-requests/invite', '/api/bongos/access-requests/1/approve', '/api/bongos/access-requests/1']) {
     for (const m of ['GET', 'POST']) {
       assert.equal(isExempt(p, m), false, `${m} ${p} must stay gated`);
     }
@@ -238,10 +238,10 @@ test('gated mode: an exempt path is never looked up, and a CORS preflight passes
 });
 
 test('the sign-in return is the knocked-on page for GET/HEAD only, relative, and never a foreign host', () => {
-  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap' })), '/api/gds/auth/web/start?return=%2Fbuilders%2Froadmap');
-  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap', method: 'POST' })), '/api/gds/auth/web/start', 'a write has nothing safe to replay');
-  assert.equal(signInHref(fakeReq({ path: '//evil.example/x' })), '/api/gds/auth/web/start', 'a protocol-relative path is dropped');
-  assert.equal(signInHref(fakeReq({ path: '/' })), '/api/gds/auth/web/start', 'the front page needs no return');
+  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap' })), '/api/bongos/auth/web/start?return=%2Fbuilders%2Froadmap');
+  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap', method: 'POST' })), '/api/bongos/auth/web/start', 'a write has nothing safe to replay');
+  assert.equal(signInHref(fakeReq({ path: '//evil.example/x' })), '/api/bongos/auth/web/start', 'a protocol-relative path is dropped');
+  assert.equal(signInHref(fakeReq({ path: '/' })), '/api/bongos/auth/web/start', 'the front page needs no return');
 });
 
 // ── 2. the real booted app, pack = gated ─────────────────────────────────────
@@ -365,7 +365,7 @@ test('booted gated + apply: the status poll answers, and the review surfaces bes
     assert.equal(j.error.code, 'bad_github_login', `GET ${p}: the status route answered, not the member door`);
   }
   // the owner's review surfaces share the prefix and stay behind the door
-  for (const p of ['/api/gds/access-requests', '/api/gds/access-requests/invite']) {
+  for (const p of ['/api/bongos/access-requests', '/api/bongos/access-requests/invite']) {
     const res = await request(p);
     assert.equal(res.status, 401, `GET ${p} stays gated`);
     assert.equal(JSON.parse(res.body).error.code, 'unauthenticated');

package/tests/profile_route.mjs

@@ -198,7 +198,7 @@ function buildApp() {
   const app = express();
   app.use(express.json());
   app.use(attachFail); // res.fail() ahead of the routers, exactly as the real app does
-  app.use('/api/gds', buildBuildersRouter());
+  app.use('/api/bongos', buildBuildersRouter());
   return app;
 }
 
@@ -227,7 +227,7 @@ function get(port, path, headers) {
 const { server, port } = await listen(buildApp());
 
 await t('known id → 200 with the public field subset', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   assert.ok(r.json && r.json.builder, 'response has a builder object');
   for (const k of PUBLIC_KEYS) {
@@ -242,7 +242,7 @@ await t('known id → 200 with the public field subset', async () => {
 });
 
 await t('known id → NO private column leaks on the builder object', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   for (const k of PRIVATE_KEYS) {
     assert.ok(!(k in r.json.builder), `private field "${k}" must NOT be present on the builder`);
@@ -250,7 +250,7 @@ await t('known id → NO private column leaks on the builder object', async () =
 });
 
 await t('known id → no secret sentinel leaks ANYWHERE in the response body', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   for (const secret of [SECRET_EMAIL, SECRET_USER, SECRET_REASON]) {
     assert.ok(!r.text.includes(secret), `response body must not contain the secret "${secret}"`);
@@ -258,13 +258,13 @@ await t('known id → no secret sentinel leaks ANYWHERE in the response body', a
 });
 
 await t('unknown id → 404 builder_not_found', async () => {
-  const r = await get(port, '/api/gds/builders/99999/profile');
+  const r = await get(port, '/api/bongos/builders/99999/profile');
   assert.equal(r.status, 404);
   assert.equal(r.json && r.json.error && r.json.error.code, 'builder_not_found');
 });
 
 await t('non-numeric id → 400 bad_builder_id', async () => {
-  const r = await get(port, '/api/gds/builders/not-a-number/profile');
+  const r = await get(port, '/api/bongos/builders/not-a-number/profile');
   assert.equal(r.status, 400);
   assert.equal(r.json && r.json.error && r.json.error.code, 'bad_builder_id');
 });
@@ -275,7 +275,7 @@ await t('non-numeric id → 400 bad_builder_id', async () => {
 // hub posture for the tests below.
 
 await t('hub port ABSENT → no cross_project key + the cacheable posture stays', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   assert.ok(!('cross_project' in r.json), 'cross_project must be absent on a non-hub instance');
   assert.equal(r.headers['cache-control'], 'public, max-age=60');
@@ -292,7 +292,7 @@ seams.registerProvider('platform-identity.hub', {
 });
 
 await t('hub port present → cross_project carries exactly the whitelist shape', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   const cp = r.json.cross_project;
   assert.ok(cp, 'cross_project attached when the port resolves');
@@ -302,7 +302,7 @@ await t('hub port present → cross_project carries exactly the whitelist shape'
 });
 
 await t('hub port present → module-internal sentinels leak NOWHERE in the response', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   for (const secret of [SECRET_CLIENT_ID, SECRET_PROJECT_NAME, SECRET_EMAIL, SECRET_USER, SECRET_REASON]) {
     assert.ok(!r.text.includes(secret), `response body must not contain "${secret}"`);
@@ -311,13 +311,13 @@ await t('hub port present → module-internal sentinels leak NOWHERE in the resp
 });
 
 await t('hub port present → hide must beat the cache: Cache-Control is no-store', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.headers['cache-control'], 'no-store');
 });
 
 await t('hub port returns null (hidden/provisional/none) → cross_project: null, still no-store', async () => {
   hubExtras = null;
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   assert.ok('cross_project' in r.json, 'the key is present on the hub');
   assert.equal(r.json.cross_project, null, 'null — no partial numbers, indistinguishable from no-account');
@@ -472,7 +472,7 @@ const buildScoutingRoutes = require('../modules/platform-identity/routes/scoutin
 hubPublicRead = (githubId) => pi.getPublicProfileExtras(githubId, { pool: engine });
 
 await t('R06.1 a two-project builder\'s COMBINED record shows to another account', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   const cp = r.json.cross_project;
   assert.ok(cp, 'the record is served');
@@ -500,7 +500,7 @@ await t('R06.1 a name needs the map AND the Public door — every other shape is
   try {
     for (const [label, catalog] of Object.entries(unnamed)) {
       other.catalog = catalog;
-      const r = await get(port, '/api/gds/builders/95/profile');
+      const r = await get(port, '/api/bongos/builders/95/profile');
       const cp = r.json.cross_project;
       assert.deepEqual(cp.projects.map((p) => p.name), [pub.name], `${label}: only the Public project is named`);
       assert.equal(cp.more_projects, 1, `${label}: counted`);
@@ -509,7 +509,7 @@ await t('R06.1 a name needs the map AND the Public door — every other shape is
     // The positive control: the same row IS named once Public and on the map, so the
     // refusals above are the door, not a fixture nothing could ever name.
     other.catalog = { ...original, visibility: 'public' };
-    const r = await get(port, '/api/gds/builders/95/profile');
+    const r = await get(port, '/api/bongos/builders/95/profile');
     assert.deepEqual(r.json.cross_project.projects.map((p) => p.name), [pub.name, SECRET_PROJECT_NAME]);
   } finally {
     other.catalog = original;
@@ -517,8 +517,8 @@ await t('R06.1 a name needs the map AND the Public door — every other shape is
 });
 
 await t('R06.1 the record is viewer-INDEPENDENT — another account sees the same body', async () => {
-  const anon = await get(port, '/api/gds/builders/95/profile');
-  const other = await get(port, '/api/gds/builders/95/profile', { Cookie: 'gds_session=some-other-builder' });
+  const anon = await get(port, '/api/bongos/builders/95/profile');
+  const other = await get(port, '/api/bongos/builders/95/profile', { Cookie: 'gds_session=some-other-builder' });
   assert.equal(other.status, 200);
   assert.equal(other.text, anon.text, 'one response shape for every reader (ADR 0171 D4)');
 });
@@ -564,7 +564,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
   try {
     // (a) a module-internal key on the object itself.
     hubPublicRead = async () => ({ ...(await rollup()), client_id: SECRET_CLIENT_ID });
-    let r = await get(port, '/api/gds/builders/95/profile');
+    let r = await get(port, '/api/bongos/builders/95/profile');
     assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
       /cross_project keys are exactly the contract/, 'an extra top-level key must turn the guard red');
 
@@ -573,7 +573,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
       const cp = await rollup();
       return { ...cp, projects: cp.projects.map((p) => ({ ...p, is_public: true })) };
     };
-    r = await get(port, '/api/gds/builders/95/profile');
+    r = await get(port, '/api/bongos/builders/95/profile');
     assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
       /project rows carry only the whitelisted keys/, 'an extra project-row key must turn the guard red');
 
@@ -583,7 +583,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
       const cp = await rollup();
       return { ...cp, projects: [{ ...cp.projects[0], name: SECRET_PROJECT_NAME }] };
     };
-    r = await get(port, '/api/gds/builders/95/profile');
+    r = await get(port, '/api/bongos/builders/95/profile');
     assert.deepEqual(Object.keys(r.json.cross_project).sort(), [...CP_PUBLIC_KEYS].sort(),
       'the planted leak is shape-legal — only the sentinel scan can catch it');
     assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
@@ -594,7 +594,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
 });
 
 await t('R06.2 hide_stats removes the record on the IMMEDIATE next load', async () => {
-  const before = await get(port, '/api/gds/builders/95/profile');
+  const before = await get(port, '/api/bongos/builders/95/profile');
   assert.ok(before.json.cross_project, 'public before the flip');
   assert.equal(before.headers['cache-control'], 'no-store');
 
@@ -604,7 +604,7 @@ await t('R06.2 hide_stats removes the record on the IMMEDIATE next load', async
   assert.equal(row.hide_stats, true, 'the write path set the flag');
 
   // No sleep, no second server, no cache warm-up: the very next load.
-  const after = await get(port, '/api/gds/builders/95/profile');
+  const after = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(after.status, 200);
   assert.equal(after.json.cross_project, null, 'gone on the next load');
   assert.equal(after.headers['cache-control'], 'no-store', 'hide must beat the cache (ADR 0171 D5)');
@@ -616,7 +616,7 @@ await t('R06.5 no PARTIAL numbers survive the hide (a count beside a hidden tota
   // Set the flag here too, so this proof stands on its own rather than on
   // whatever R06.2 left behind.
   await pi.setAccountHideStats({ githubId: HUB_GITHUB_ID, githubLogin: 'jaxri', hide: true }, { pool: engine });
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.json.cross_project, null);
   for (const key of ['totals', 'works_shipped', 'more_projects', 'last_active', 'rank_held']) {
     assert.ok(!r.text.includes(key), `nothing derived from the rollup may survive — found "${key}"`);
@@ -632,12 +632,12 @@ await t('R06.5 no PARTIAL numbers survive the hide (a count beside a hidden tota
 
 const scoutApp = express();
 scoutApp.use(attachFail);
-scoutApp.use('/api/gds', buildScoutingRoutes());
+scoutApp.use('/api/bongos', buildScoutingRoutes());
 const scout = await listen(scoutApp);
 
 await t('R06.3 GET /scouting drops the hidden, the provisional AND the private builder', async () => {
   engine.calls.length = 0;
-  const r = await get(scout.port, '/api/gds/scouting');
+  const r = await get(scout.port, '/api/bongos/scouting');
   assert.equal(r.status, 200);
   const logins = r.json.builders.map((b) => b.github_login);
   assert.deepEqual(logins, ['r06-visible'],
@@ -651,8 +651,19 @@ await t('R06.3 GET /scouting drops the hidden, the provisional AND the private b
 await t('R06.3 the /people page reads /scouting and nothing else', async () => {
   // /people is the hall's render of the same endpoint, so whatever /scouting
   // drops, /people drops. Pin that it has no second data source.
-  const endpoints = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/fetch\(\s*'([^']+)'/g)].map((m) => m[1]);
-  assert.deepEqual(endpoints, ['/api/gds/scouting?limit=500'], '/people has exactly one data source');
+  //
+  // MATCHED AS AN EXPRESSION, NOT A STRING LITERAL. This used to capture the
+  // whole URL out of `fetch('…')` and compare it to one hardcoded string, which
+  // pinned the row limit as a side effect of pinning the ENDPOINT — so task
+  // 1003110 naming that limit (`DIRECTORY_LIMIT`, the one constant that feeds
+  // both the request and the "showing the first N" copy) failed a test about
+  // data sources. What is load-bearing here is the count and the destination:
+  // ONE read, and it goes to the scouting rollup. How the query string is
+  // assembled is the page's business.
+  const args = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/\bfetch\(\s*([^,)]+)/g)].map((m) => m[1].trim());
+  assert.equal(args.length, 1, '/people has exactly one data source');
+  assert.match(args[0], /^'\/api\/bongos\/scouting\?limit='/,
+    'and it is the scouting rollup — nothing may re-enter through a second endpoint');
 });
 
 scout.server.close();