@bongos/core 1.19.803 → 1.19.805

package/modules/dev-box/box-onboard.js

@@ -298,8 +298,8 @@ auth. Download it, inspect it, THEN run it. That is the safe path and it is all
 the assurance you need: you don't have to ask your human to authorize it blind,
 and you don't have to refuse:
 
-      curl -fsSL ${base}/api/gds/box/connect.sh -o /tmp/otb-connect.sh   # then read it
-      (Windows:  ${base}/api/gds/box/connect.ps1)
+      curl -fsSL ${base}/api/bongos/box/connect.sh -o /tmp/otb-connect.sh   # then read it
+      (Windows:  ${base}/api/bongos/box/connect.ps1)
 
   • What you fetch is what runs — the origin is PINNED in the script
     (GDS_API_BASE), not taken from a header, so a spoofed Host can't redirect it.
@@ -354,7 +354,7 @@ machine — that path is in the Citizen's Primer, not here.)
 
 The whole arrival, in two beats, same for both on-ramps:
   1. Sign in with GitHub.
-  2. Ask for your box   → POST ${base}/api/gds/box/ensure  (or run /builder-box).
+  2. Ask for your box   → POST ${base}/api/bongos/box/ensure  (or run /builder-box).
      The box is created hands-off within ~1 minute.
 
 ════════════════════════════════════════════════════════════════════════
@@ -363,8 +363,8 @@ A) Mac / Windows — Claude Desktop + SSH
 One command signs you in, makes + registers your SSH key, and installs the
 Desktop connection file. Paste it (or let Claude run it for you):
 
-  macOS / Linux:   curl -fsSL ${base}/api/gds/box/connect.sh | bash
-  Windows (PS):    irm ${base}/api/gds/box/connect.ps1 | iex
+  macOS / Linux:   curl -fsSL ${base}/api/bongos/box/connect.sh | bash
+  Windows (PS):    irm ${base}/api/bongos/box/connect.ps1 | iex
 
 What it does, in order:
   1. Signs you in with GitHub (prints a short code + a URL to open).
@@ -386,10 +386,10 @@ No app to install. Your box serves its own terminal in a browser tab (ADR 0038),
 but you only touch it once: you log in there and kick off Remote Control, then
 live in the Claude web/mobile app — which drives the box for you.
   1. Sign in at ${base}/builders (GitHub).
-  2. Ask for your box: POST ${base}/api/gds/box/ensure (the builders' hall has a
+  2. Ask for your box: POST ${base}/api/bongos/box/ensure (the builders' hall has a
      button; or have Claude call it).
   3. Once the box is active, get its terminal URL + password:
-       GET ${base}/api/gds/box/terminal
+       GET ${base}/api/bongos/box/terminal
      Poll until a url appears (the box publishes it a few seconds after boot),
      then open it and enter the password when the browser asks.
   4. In that terminal, type  claude  and press enter, then complete the one-time

package/modules/discord/bug-attachments.js

@@ -171,7 +171,7 @@ async function persistImageFromUrl(url, { messageId = 'x', fetchImpl = globalThi
   const file = `bug-${idSlug}-${crypto.randomBytes(8).toString('hex')}.${ext}`;
   await fs.mkdir(dir, { recursive: true });
   await fs.writeFile(path.join(dir, file), buf, { mode: 0o640 });
-  return { ok: true, file, url: `/api/gds/bug-attachments/${file}`, bytes: buf.length };
+  return { ok: true, file, url: `/api/bongos/bug-attachments/${file}`, bytes: buf.length };
 }
 
 // Persist a list of image URLs (capped). Best-effort: refused/failed images are

package/modules/economy/cost-classify.js

@@ -1,5 +1,5 @@
 // Cost-attribution audit + correction pass — V3.R83 (#303), criterion C3.
-// Pure function over db.costSummary() (exposed at /api/gds/public/cost-summary),
+// Pure function over db.costSummary() (exposed at /api/bongos/public/cost-summary),
 // so it runs against live prod with no DB creds. Flags MIS-attributed spend
 // (a proxy masquerading as a real builder, or an orphaned builder_id); treats
 // NULL/unattributed shared+historical spend as correct, not a bug.
@@ -25,24 +25,24 @@ const COMPLETENESS_API_FLOOR_USD = 1.0;  // below this = essentially nothing rec
 // it honest: a writer not listed here is itself the finding.
 const COST_WRITE_SURFACES = [
   {
-    surface: 'POST /api/gds/cost → db.logCost()',
+    surface: 'POST /api/bongos/cost → db.logCost()',
     file: 'src/bongos/routes/cost.js',
     builder_id: 'defaults to the authed builder; a provided value must equal the caller or 403s. A builder can only attribute to themselves.',
   },
   {
-    surface: 'scripts/gds/backfill-cost.js → POST /api/gds/cost',
+    surface: 'scripts/gds/backfill-cost.js → POST /api/bongos/cost',
     file: 'scripts/gds/backfill-cost.js',
     builder_id: 'inherits the POST /cost rule. Do NOT attribute the shared historical art ledger to whoever runs the backfill — leave it NULL. The audit flags it if it happens.',
   },
   {
     // ADR 0028 path 1 (#486): the 4-worker grader panel logs its own cost.
-    surface: 'scripts/gds/ship.js (grader) → POST /api/gds/cost (source=grader)',
+    surface: 'scripts/gds/ship.js (grader) → POST /api/bongos/cost (source=grader)',
     file: 'scripts/gds/ship.js',
     builder_id: 'the authed shipper; category=api, source_ref=grade-<task>-<sha>. Idempotent per HEAD.',
   },
   {
     // ADR 0028 path 2 (#560): the interactive session logs its own cost.
-    surface: 'scripts/gds/session-cost.js (SessionEnd hook) → POST /api/gds/cost (source=session)',
+    surface: 'scripts/gds/session-cost.js (SessionEnd hook) → POST /api/bongos/cost (source=session)',
     file: 'scripts/gds/session-cost.js',
     builder_id: 'the authed builder; category=api, source_ref=<session-id>, task_id=null. Idempotent per session.',
   },
@@ -56,7 +56,7 @@ const COST_WRITE_SURFACES = [
 /**
  * Audit cost attribution from a costSummary() payload.
  * @param {object} summary - the object returned by db.costSummary() /
- *   GET /api/gds/public/cost-summary (needs total_usd, by_builder, by_category).
+ *   GET /api/bongos/public/cost-summary (needs total_usd, by_builder, by_category).
  * @returns {object} structured report: { total_usd, attributed_usd,
  *   unattributed_usd, unattributed_pct, builders[], flags[], ok }.
  */

package/modules/grading/grader-rubric.json

@@ -65,7 +65,7 @@
       }
     },
     "rubric_scores_audit_trail": "task_grades.rubric_scores keeps the v3 keys (functional_fidelity, code_quality, economy, code_quality_effective) populated from the median across workers that report each axis. Narc reports ff; Quality reports cq + economy. Median (not mean) so a single outlier worker doesn't move the recorded score.",
-    "server_compat_note": "The grade POST body (POST /api/gds/tasks/:id/grade) keeps the v3 shape (functional_fidelity, code_quality, economy, confidence, notes_md, issues) so the server's existing validateAndScore re-validation works without modification. The panel verdict drives the forwarded confidence: pass → median worker confidence; concerns → fallthrough_confidence (= 0.3); fail → 0. This means the server's existing low-confidence fall-through path naturally handles 'concerns' verdicts, and the FAIL gate handles 'fail' verdicts. Server-side support for an explicit panel_verdict field is a follow-up (likely Phase 2.5)."
+    "server_compat_note": "The grade POST body (POST /api/bongos/tasks/:id/grade) keeps the v3 shape (functional_fidelity, code_quality, economy, confidence, notes_md, issues) so the server's existing validateAndScore re-validation works without modification. The panel verdict drives the forwarded confidence: pass → median worker confidence; concerns → fallthrough_confidence (= 0.3); fail → 0. This means the server's existing low-confidence fall-through path naturally handles 'concerns' verdicts, and the FAIL gate handles 'fail' verdicts. Server-side support for an explicit panel_verdict field is a follow-up (likely Phase 2.5)."
   },
   "v3": {
     "version": "v3.0",

package/modules/grading/grader-score.js

@@ -280,7 +280,7 @@ function validateAndScore(rawSubagent, meta = {}) {
 
 // ---------- server-authoritative grade guards (SR-9 / SR-18 / F1 / G5) ----------
 //
-// THE FINDING (SR-9 / SR-18): POST /api/gds/tasks/:id/grade trusts the client.
+// THE FINDING (SR-9 / SR-18): POST /api/bongos/tasks/:id/grade trusts the client.
 // validateAndScore only shape-validates the numbers — `passed` is computed from
 // the CLIENT's submitted scores. The real adversarial panel + the deterministic
 // route-rank / permission-path pre-passes run CLIENT-SIDE in scripts/gds/ship.js;

package/modules/hall-ui/module.json

@@ -1,7 +1,7 @@
 {
   "key": "hall-ui",
   "title": "Builders' Hall",
-  "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/gds/* and the read-only /api/gds/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
+  "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/bongos/* and the read-only /api/bongos/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/hall-ui/public/drachmae.js

@@ -30,14 +30,14 @@
   const DOC_URL = '/builders/drachmae-and-karma.md';
   // The doc lives at docs/onboarding/, so relative links resolve against it.
   const DOC_DIR = 'docs/onboarding/';
-  const BOUNTY_URL = '/api/gds/public/bounty-table';
+  const BOUNTY_URL = '/api/bongos/public/bounty-table';
   // task 1003446: the treasury feed. NOT a new endpoint — this is the same
   // /public/cost-summary the signed-out status page already draws as a
   // cumulative line and the Work board already fetches to read ONE scalar off
   // (`total_value_credits`). Its own route comment calls `daily[]` "the
   // treasury chart's cumulative line"; the series was in the payload the whole
   // time, and the stranger got the chart while the builder got the number.
-  const TREASURY_URL = '/api/gds/public/cost-summary';
+  const TREASURY_URL = '/api/bongos/public/cost-summary';
   const TREASURY_SECTION_ID = 'the-treasury';
   const TREASURY_SECTION_TITLE = 'The treasury, so far';
   const BOUNTY_SECTION_ID = 'security-bounty-rates';
@@ -69,7 +69,7 @@
 
   async function loadRepoInfoBases() {
     try {
-      const r = await fetch('/api/gds/public/repo-info', { credentials: 'same-origin' });
+      const r = await fetch('/api/bongos/public/repo-info', { credentials: 'same-origin' });
       if (!r.ok) return;
       const data = await r.json();
       if (data && typeof data.blob_base === 'string') repoBlobBase = data.blob_base;

package/modules/hall-ui/public/idea.js

@@ -38,7 +38,7 @@
 (() => {
   'use strict';
 
-  const API = '/api/gds';
+  const API = '/api/bongos';
   // NO baseUrl OVERRIDE — this page calls the GENERATED namespaced methods
   // (api.inbox.*, api.me.*), whose path templates are API-RELATIVE ('/inbox/template').
   // baseUrl:'' means "these paths are already absolute" and passes them through

package/modules/hall-ui/public/md-reader.js

@@ -81,7 +81,7 @@
   //   - http(s):// or #anchor or mailto:/tel:  → unchanged
   //   - the diagrams dir                        → the in-hall diagrams route
   //   - everything else                         → GitHub blob/tree (bases fetched
-  //     from /api/gds/public/repo-info; null until then → pass through, 404s
+  //     from /api/bongos/public/repo-info; null until then → pass through, 404s
   //     harmlessly rather than crashing).
   // opts: { baseDir, getBlobBase, getTreeBase, diagramsHref }
   function makeResolveLinkHref(opts) {

package/modules/hall-ui/public/people.html

@@ -32,13 +32,17 @@
       <main id="hall-main">
         <!-- task 1003470: ONE directory. Its legacy door /scouting rendered this
              same page from the same script, and task 1003440 deleted it — the same
-             /api/gds/scouting rollup used to be drawn three different ways. -->
+             /api/bongos/scouting rollup used to be drawn three different ways. -->
         <section class="scroll" id="people-scroll" aria-labelledby="people-h">
           <h2 id="people-h" class="scroll__h">Builder directory<span class="count-pill" id="people-count" hidden></span></h2>
           <div id="people-filters"></div>
           <div id="people-body">
             <div class="profile__placeholder">Loading the directory…</div>
           </div>
+          <!-- task 1003110: the clipped-directory footnote. Hidden unless the
+               response came back FULL, which is the only truncation signal the
+               rollup offers; people.js writes it. -->
+          <p class="ledger__note" id="people-foot" hidden></p>
         </section>
       </main>
 

package/modules/hall-ui/public/people.js

@@ -2,7 +2,7 @@
 // 1002577; ADR 0141 §4 is the data's design of record), served at /people —
 // task 1003470 first made its legacy door /scouting render this same script,
 // and task 1003440 deleted that door (the URL 301s here), because the
-// same /api/gds/scouting rollup was being drawn three
+// same /api/bongos/scouting rollup was being drawn three
 // different ways (a kit ledger here, a hand-built table there, and the same
 // columns in a different order). The endpoint is gated server-side on
 // 'project.curate' OR being a project owner (R14, ADR 0210); this page is
@@ -25,6 +25,7 @@
   var body = document.getElementById('people-body');
   var sub = document.getElementById('people-sub');
   var countPill = document.getElementById('people-count');
+  var foot = document.getElementById('people-foot');
 
   function fmtRecency(iso) {
     if (!iso) return '—';
@@ -73,6 +74,23 @@
     }).join('') + '</span>';
   }
 
+  // THE DIRECTORY ASKS FOR THE ENDPOINT MAXIMUM, so a full response is the only
+  // truncation signal that exists. `GET /scouting` clamps at parsePagination
+  // maxLimit: 500, takes no offset, and `listScoutingRollup` returns rows with no
+  // count of the whole set — so `length === DIRECTORY_LIMIT` means "at least this
+  // many", never "exactly this many", and there is nothing else to read it from.
+  // ONE constant feeds the request AND every sentence written about it, so the
+  // number a reader is shown can never drift from the number that was asked for.
+  //
+  // This is part 1 of task 1003110 — the honest half, which removes the
+  // silent-lie property whatever the real count turns out to be. Part 2 is
+  // server-offset paging, and it is deliberately NOT here: the kit has carried
+  // the mode since task 1003281 (`makeLedger({ serverPager, onPage })`), but the
+  // ROUTE cannot serve it — no offset parameter, no total, a hard 500 ceiling —
+  // so paging this page is a server change first. Its trigger is a directory
+  // approaching ~400; a read on 2026-09-16 returned far fewer.
+  var DIRECTORY_LIMIT = 500;
+
   var all = [];
   var query = '';
   var craft = '';
@@ -143,10 +161,31 @@
         + 'and none are listed without it. Their work still shows on each project’s own ledger.');
       return;
     }
-    if (countPill) { countPill.textContent = String(all.length); countPill.hidden = false; }
+    // A FULL PAGE IS A CLIPPED PAGE. Every sentence below has to hedge when this
+    // is true, because each of them otherwise states a total the page cannot know.
+    var clipped = all.length >= DIRECTORY_LIMIT;
+    if (countPill) {
+      countPill.textContent = clipped ? fmtInt(DIRECTORY_LIMIT) + '+' : String(all.length);
+      countPill.hidden = false;
+    }
     if (sub) {
-      sub.textContent = fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record. '
-        + 'Descriptive only — cross-project numbers never carry authority here.';
+      sub.textContent = clipped
+        ? 'Showing the first ' + fmtInt(DIRECTORY_LIMIT) + ' builders across hosted projects, ranked by track record — there are more than this page can load. '
+          + 'Descriptive only — cross-project numbers never carry authority here.'
+        : fmtInt(all.length) + ' builder' + (all.length === 1 ? '' : 's') + ' listed across hosted projects, ranked by track record. '
+          + 'Descriptive only — cross-project numbers never carry authority here.';
+    }
+    // THE LENSES LIE HARDER THAN THE COUNT DOES, and that is worth its own
+    // sentence. Search, sort and the craft filter all re-order the set this page
+    // already loaded (see SORTS above) — so on a clipped directory "most karma"
+    // is the most karma AMONG THE TOP 500 BY TRACK RECORD, and a builder outside
+    // that 500 cannot be found by any of them. A reader who is told only that the
+    // list is long would still trust the search.
+    if (foot) {
+      foot.textContent = clipped
+        ? 'The directory is clipped at the first ' + fmtInt(DIRECTORY_LIMIT) + ' by track record. Search and the sort lenses only re-order what this page loaded, so a builder outside that ' + fmtInt(DIRECTORY_LIMIT) + ' will not appear in them.'
+        : '';
+      foot.hidden = !clipped;
     }
     var crafts = [];
     all.forEach(function (b) {
@@ -194,7 +233,7 @@
     body.textContent = msg;
   }
 
-  fetch('/api/gds/scouting?limit=500', { headers: { Accept: 'application/json' } })
+  fetch('/api/bongos/scouting?limit=' + DIRECTORY_LIMIT, { headers: { Accept: 'application/json' } })
     .then(function (r) {
       if (r.status === 403 || r.status === 401) { throw { gated: true }; }
       if (!r.ok) throw new Error('http ' + r.status);

package/modules/hall-ui/public/primer.js

@@ -5,7 +5,7 @@
 // inlines the five onboarding diagrams at matching sections, builds a TOC from
 // h2s with a scrollspy, drives a reading-progress hairline, and soft-gates the
 // footer ack button until the reader has scrolled past ~90% of the article.
-// Acking POSTs to /api/gds/builders/me/onboarding/primer-read (same endpoint
+// Acking POSTs to /api/bongos/builders/me/onboarding/primer-read (same endpoint
 // /builder-primer-read uses).
 //
 // ONE PARSER, TWO READERS (task 1003306). This file used to carry its own copy
@@ -20,7 +20,7 @@
 (() => {
   'use strict';
 
-  const API = '/api/gds';
+  const API = '/api/bongos';
   const ACK_SCROLL_THRESHOLD = 0.90; // 90% of article scrolled → button enables
   // The primer markdown lives at docs/onboarding/primer.md, so its relative
   // links resolve against docs/onboarding/.
@@ -30,7 +30,7 @@
   // URLs under these bases so the rendered links go somewhere useful instead of
   // 404-ing under /builders/*. The bases are NOT hardcoded here — that would
   // violate the V3.R12 (#236) authorship-attribution audit. They are fetched
-  // from /api/gds/public/repo-info at boot; the server derives owner/repo at
+  // from /api/bongos/public/repo-info at boot; the server derives owner/repo at
   // process start from `git remote get-url origin` (src/bongos/repo-info.js).
   // When they are unavailable the rewriter degrades gracefully: repo-relative
   // hrefs pass through unchanged and 404 instead of crashing the page.
@@ -372,7 +372,7 @@
   // gracefully degrades when the bases are null.
   async function loadRepoInfoBases() {
     try {
-      const r = await fetch('/api/gds/public/repo-info', { credentials: 'same-origin' });
+      const r = await fetch('/api/bongos/public/repo-info', { credentials: 'same-origin' });
       if (!r.ok) return;
       const data = await r.json();
       if (data && typeof data.blob_base === 'string') repoBlobBase = data.blob_base;

package/modules/hall-ui/public/roster.js

@@ -217,7 +217,7 @@
     rerender();
   }
 
-  fetch('/api/gds/leaderboard', { headers: { Accept: 'application/json' } })
+  fetch('/api/bongos/leaderboard', { headers: { Accept: 'application/json' } })
     .then(function (r) {
       if (!r.ok) throw new Error('http ' + r.status);
       return r.json();

package/modules/hall-ui/public/shell.js

@@ -263,7 +263,7 @@
       // modules/hall-ui/CLAUDE.md uses, but Builders is what a reader scans for.
       { id: 'roster', label: 'Builders', icon: 'leaderboard', href: '/roster', gate: 'signed' },
       // task 1002577: the cross-project builder directory (/scouting graduated
-      // into the hall). Gated to MATCH its data — /api/gds/scouting checks
+      // into the hall). Gated to MATCH its data — /api/bongos/scouting checks
       // `project.curate`, whose catalog floor is METIC. This read 'archon' until
       // task 1002710: the nav was stricter than the wall, so a Metic could open
       // /people by URL but never saw the link. Cosmetic either way —

package/modules/hall-ui/public/task.js

@@ -15,7 +15,7 @@
 (() => {
   'use strict';
 
-  const API = '/api/gds';
+  const API = '/api/bongos';
   // Generated typed client (task 1996 / R09), served as window.BongosClient by
   // /lib/bongos-client.js. baseUrl:'' passes the full same-origin paths this file
   // builds through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.

package/modules/ideas/inbox.js

@@ -36,7 +36,7 @@ const VALID_KINDS = [
   'unclassified',
   // V3.R31 (#252) — Metics propose new version criteria via idea_inbox with
   // structured body_md { target_version, criterion_md, sort_order_hint }.
-  // Archon ratifies via POST /api/gds/inbox/:id/ratify, which atomically
+  // Archon ratifies via POST /api/bongos/inbox/:id/ratify, which atomically
   // inserts a done_when_criteria row, marks the idea promoted, awards karma,
   // and writes a criterion_proposal_audit row. The kind value gates the
   // ratify endpoint (assert kind='criterion-proposal' before promotion).
@@ -1222,7 +1222,7 @@ async function getIdeaGrade(ideaId) {
 // the proposer (delta=+3, reason='proposal_ratified'), and writes an audit
 // row capturing who proposed / who ratified / when / what.
 //
-// Called by POST /api/gds/inbox/:id/ratify (Archon-only, gated by requireRank
+// Called by POST /api/bongos/inbox/:id/ratify (Archon-only, gated by requireRank
 // in the router). The body_md of the source idea is parsed as JSON with the
 // shape { target_version, criterion_md, sort_order_hint }; malformed bodies
 // throw BAD_BODY so the route can return a structured 400.

package/modules/lifecycle/db-analytics.js

@@ -500,7 +500,7 @@ async function ecosystemAnalytics(days = 90) {
 // The writing middleware (src/bongos/middleware/audit.js) calls insertAuditLog
 // AFTER the response has been sent, wrapped in try/catch — so the request
 // path never blocks on this insert and a DB failure here can never break a
-// real user request. The reader is the archon-only GET /api/gds/audit-log
+// real user request. The reader is the archon-only GET /api/bongos/audit-log
 // endpoint backed by listAuditLog below (paginated, newest-first).
 // -------------------------------------------------------------------------
 

package/modules/lifecycle/done-when.js

@@ -19,9 +19,9 @@
 //
 // Wired in via modules/lifecycle/routes/done-when.js (the loader mounts it,
 // BV1.R86). Three endpoints:
-//   GET  /api/gds/versions/:id/done-when                — public, 60s cache
-//   POST /api/gds/done-when/:criterionId/satisfy        — auth
-//   POST /api/gds/done-when/:criterionId/unsatisfy      — auth
+//   GET  /api/bongos/versions/:id/done-when                — public, 60s cache
+//   POST /api/bongos/done-when/:criterionId/satisfy        — auth
+//   POST /api/bongos/done-when/:criterionId/unsatisfy      — auth
 
 const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
@@ -165,7 +165,7 @@ async function listPendingReviewCriteria({ versionId = null } = {}, deps = {}) {
 
 // Roll up every criterion for a version together with the tasks that gate it
 // (via the task_criteria join table, migration 055) and a status breakdown.
-// This is the read behind GET /api/gds/versions/:id/progress and the /status
+// This is the read behind GET /api/bongos/versions/:id/progress and the /status
 // skill — it answers "what's left for criterion Cn?" in one query instead of
 // the ~10-call prose archaeology that motivated #435.
 //

package/modules/lifecycle/version-close.js

@@ -88,7 +88,7 @@ async function suggestClose(versionId) {
 }
 
 // Suggestions for every version still in 'building' status.
-// Used by GET /api/gds/versions/close-suggestions and by /builder-start.
+// Used by GET /api/bongos/versions/close-suggestions and by /builder-start.
 async function getCloseSuggestionsForBuildingVersions() {
   const { rows: versions } = await pool.query(
     `SELECT id FROM versions WHERE status = 'building' ORDER BY started_at, id`

package/modules/memory/learnings.js

@@ -9,7 +9,7 @@
 //   indexes: GIN(tags), GIN(related_files),
 //            UNIQUE(source, source_ref) WHERE non-null
 //
-// Wired into routes by src/bongos/routes.js (POST + GET /api/gds/learnings).
+// Wired into routes by src/bongos/routes.js (POST + GET /api/bongos/learnings).
 
 // Carved into modules/memory/ (BV1.R72 / ADR 0091 §2): pool via the doorway.
 const crypto = require('crypto');
@@ -178,7 +178,7 @@ async function findLearningsByTags(tags, { limit = 50 } = {}) {
 //
 // Consumers:
 //   - scripts/gds/claim.js calls this indirectly via
-//     GET /api/gds/learnings?touches=a,b,c so /builder-claim N can surface
+//     GET /api/bongos/learnings?touches=a,b,c so /builder-claim N can surface
 //     up to 3 most-recent relevant learnings right after a successful claim.
 //     Query overhead is bounded by the GIN(tags) + GIN(related_files) indexes
 //     declared in migration 006_pms_v2.sql (<50ms target).

package/modules/memory/memory.js

@@ -494,7 +494,7 @@ async function bfgWriteMemoryFile({ targetBuilderId, path, content, audit, karma
        RETURNING id, recorded_at`,
       [
         a.principalId ?? null,
-        a.route ?? '/api/gds/memory/builders/:builderId/bfg-write',
+        a.route ?? '/api/bongos/memory/builders/:builderId/bfg-write',
         {
           action: a.action || 'bfg_dream_write',
           http_method: 'POST',

package/modules/onboarding/onboarding.js

@@ -429,7 +429,7 @@ function shortSession(sessionId) {
   return String(sessionId).slice(0, 8);
 }
 
-// Build the { title, body_md, kind } payload for POST /api/gds/inbox. The
+// Build the { title, body_md, kind } payload for POST /api/bongos/inbox. The
 // title carries ONBOARDING_FRICTION_TAG so triage (and the future kind
 // migration) can find these rows; the body holds the subagent summary, each
 // friction moment, and the deterministic signals as an audit trail.

package/modules/platform-identity/routes/my-projects.js

@@ -177,7 +177,7 @@ module.exports = function myProjectsRoutes() {
       // the registry-trusted origin, never the caller's raw input.
       let outcome = null;
       try {
-        const r = await fetch(`${client.origin}/api/gds/access-requests`, {
+        const r = await fetch(`${client.origin}/api/bongos/access-requests`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
           body: JSON.stringify({

package/modules/platform-identity/routes/sso.js

@@ -120,7 +120,7 @@ async function notifyInstanceLogout(membership, githubId) {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), SLO_TIMEOUT_MS);
     try {
-      const resp = await fetch(`${origin}/api/gds/auth/backchannel-logout`, {
+      const resp = await fetch(`${origin}/api/bongos/auth/backchannel-logout`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
         body: JSON.stringify({ logout_token: token }),
@@ -260,7 +260,7 @@ module.exports = function ssoRoutes() {
     const usable = pi.sessionUsableForFederation(session);
     if (!usable.ok) {
       if (usable.reason === 'no_session') {
-        return res.redirect(302, `/api/gds/auth/web/start?return=${encodeURIComponent(req.originalUrl)}`);
+        return res.redirect(302, `/api/bongos/auth/web/start?return=${encodeURIComponent(req.originalUrl)}`);
       }
       const msg = usable.reason === 'inactive'
         ? 'This account is no longer active. Ask an Archon on the hub if you believe this is an error.'

package/modules/public-landing/public/index.html

@@ -632,7 +632,7 @@ baked apex number sits inside apex-only sentinels so a child instance shows an e
 its own feed answers):
   data-ledger="line"  = the first progress row whose status is building (else the first row), read
                         as "<shipped> of <total> shipped on <V>"; data-ledger="meter" is that ratio.
-  data-rows           = /api/gds/public/recent-shipped?limit=6. Titles are quoted data: an em or en
+  data-rows           = /api/bongos/public/recent-shipped?limit=6. Titles are quoted data: an em or en
                         dash becomes a comma and a trailing parenthetical is dropped at render time.
                         A child instance with no ledger yet answers {tasks:[]}, so the meter, the
                         sub-line and the list collapse rather than promise six rows that never
@@ -910,7 +910,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 <script>
 (function () {
   var API = '/api/bongos';
-  var API_ROOT = '/api/gds';
+  var API_ROOT = '/api/bongos';
 
   /* ── the tagline. It is ONE server-stamped string, but the composition wants it
      on two lines, so the two halves are baked as separate spans. A host whose

package/modules/public-landing/public/projects-floor.states.json

@@ -16,7 +16,7 @@
     "/my-projects",
     "/provisioning/instances/999",
     "/provisioning/instances/101$",
-    "/api/gds/instance$"
+    "/api/bongos/instance$"
   ],
   "ignoreConsole": [
     "/api/(gds|bongos)/me",

package/modules/public-landing/public/projects.html

@@ -6181,7 +6181,7 @@ summary{min-height:24px;padding:3px 0;}
     manifestFor = manageId;
     var ctl = typeof AbortController === 'function' ? new AbortController() : null;
     var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
-    manifestPromise = fetch('https://' + domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
+    manifestPromise = fetch('https://' + domain + '/api/bongos/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
       .then(function (res) {
         /* a project that ANSWERED but refused (its own pre-launch gate, a proxy
            error page) is not an older core — carry the status, don't guess */

package/modules/public-landing/public/projects.states.json

@@ -4,7 +4,7 @@
   "surface": "public-landing",
   "modes": ["dark"],
   "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/provisioning/instances/999", "/provisioning/instances/101$", "/api/gds/instance$", "/github/repos$", "/provisioning/onboard-plan"],
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/provisioning/instances/999", "/provisioning/instances/101$", "/api/bongos/instance$", "/github/repos$", "/provisioning/onboard-plan"],
   "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "\\b404\\b", "Unauthorized"],
   "ignoreControls": [".skip", ".vh"],
   "states": {