@bongos/core 1.19.803 → 1.19.805

package/modules/sessions/db.js

@@ -24,6 +24,10 @@
 
 const api = require('../../src/module-api');
 const { pool } = api;
+// The PURE verdict + every clamp and threshold (task 1003865). The module's own
+// file, not the doorway: it touches no kernel surface, and keeping the numbers
+// in one place is what stops the route and the poller disagreeing.
+const uploadHealth = require('./upload-health');
 // `seams` is the doorway's kernel-mediated seam surface (resolveOptional/resolve).
 // upsertSessionRecordWithReward resolves the economy `reward` port through it —
 // the module↔module seam, never a sibling-module require (BV1.R77 / ADR 0093 §2).
@@ -656,6 +660,118 @@ async function filterTaskIdsClaimedBy(builderId, taskIds) {
   return rows.map((r) => Number(r.task_id));
 }
 
+
+
+// -------------------------------------------------------------------------
+// Session-upload health (task 1003865) — is the corpus still being written?
+// -------------------------------------------------------------------------
+//
+// THE SIGNAL. The server already knows both halves independently: a task reached
+// status='shipped', and whether that task's builder uploaded any session around
+// then. A ship with no session record for its builder inside a window is the unit
+// of evidence. Before this, the ONLY trace of a skipped upload was a jsonl file on
+// the builder's own laptop, so a weeks-long outage that stopped every cost-plus
+// reward from booking was invisible from the server.
+//
+// GROUPED BY BUILDER, which is the entire design and is measured, not assumed —
+// see ../upload-health for the numbers. The corpus-wide share cannot see the
+// outage (3.4% in its worst month, against 1.7-2.0% in healthy ones); per builder
+// the same data fires on 13 days, all inside the outage window, all one builder.
+//
+// KEYED ON builder_id + TIME, NEVER ON task_ids. session_records.task_ids is
+// EMPTY on 54% of rows (1,771 of 3,873 when task 1002448 measured it), so the
+// obvious predicate — "no session record NAMES this task" — reports the linkage
+// gap as an outage. Neither query below mentions task_ids, and a test asserts
+// that about the SQL these functions actually emit.
+//
+// Every threshold and clamp lives in ../upload-health (PURE, unit-tested), so the
+// route and the poller cannot answer this question two different ways.
+
+// sessionUploadCoverage — per-BUILDER ship counts over the lookback, and how many
+// of those ships had NO session record for that builder inside the window. One
+// query, server-side, deliberately: /sessions/search is rate-limited per builder
+// and clamps limit to 100, so paging the corpus from a client to compute this is
+// neither cheap nor reliable (measured while scoping this task — 45 pages, with
+// 429s).
+async function sessionUploadCoverage({ days, windowHours } = {}) {
+  const d = uploadHealth.clampLookbackDays(days);
+  const w = uploadHealth.clampWindowHours(windowHours);
+  const { rows } = await pool.query(
+    `SELECT t.shipped_by AS builder_id,
+            b.github_login,
+            COUNT(*)::int AS ships,
+            COUNT(*) FILTER (
+              WHERE NOT EXISTS (
+                SELECT 1
+                  FROM session_records sr
+                 WHERE sr.builder_id = t.shipped_by
+                   AND sr.uploaded_at >= t.shipped_at - ($2 * interval '1 hour')
+                   AND sr.uploaded_at <= t.shipped_at + ($2 * interval '1 hour')
+              )
+            )::int AS uncovered
+       FROM tasks t
+       JOIN builders b ON b.id = t.shipped_by
+      WHERE t.status = 'shipped'
+        AND t.shipped_by IS NOT NULL
+        AND t.shipped_at IS NOT NULL
+        AND t.shipped_at >= now() - ($1 * interval '1 day')
+      GROUP BY t.shipped_by, b.github_login
+      ORDER BY 4 DESC`,
+    [d, w]
+  );
+  return { days: d, windowHours: w, rows };
+}
+
+// shipsMissingSessionRecord — the offending ships themselves, newest first. The
+// verdict says how bad and whose; this says WHICH, because recovering the unpaid
+// work needs the task ids and a percentage does not carry them. Bounded by
+// clampSampleLimit: evidence, not a report.
+async function shipsMissingSessionRecord({ days, windowHours, limit, builderId } = {}) {
+  const d = uploadHealth.clampLookbackDays(days);
+  const w = uploadHealth.clampWindowHours(windowHours);
+  const n = uploadHealth.clampSampleLimit(limit);
+  const b = Number.isFinite(Number(builderId)) ? Number(builderId) : null;
+  const { rows } = await pool.query(
+    `SELECT t.id, t.title, t.shipped_by, b.github_login, t.shipped_at
+       FROM tasks t
+       JOIN builders b ON b.id = t.shipped_by
+      WHERE t.status = 'shipped'
+        AND t.shipped_by IS NOT NULL
+        AND t.shipped_at IS NOT NULL
+        AND t.shipped_at >= now() - ($1 * interval '1 day')
+        AND ($3::bigint IS NULL OR t.shipped_by = $3)
+        AND NOT EXISTS (
+          SELECT 1
+            FROM session_records sr
+           WHERE sr.builder_id = t.shipped_by
+             AND sr.uploaded_at >= t.shipped_at - ($2 * interval '1 hour')
+             AND sr.uploaded_at <= t.shipped_at + ($2 * interval '1 hour')
+        )
+      ORDER BY t.shipped_at DESC
+      LIMIT ${n}`,
+    [d, w, b]
+  );
+  return rows;
+}
+
+// sessionUploadHealth — the whole answer in one call: the verdict, the per-builder
+// counts behind it, and a sample of the ships it is counting. The route serves
+// this and the poller logs from it, so neither owns the arithmetic. The sample is
+// skipped entirely when nothing is uncovered — the healthy path costs one query.
+async function sessionUploadHealth({ days, windowHours, sampleLimit } = {}) {
+  const coverage = await sessionUploadCoverage({ days, windowHours });
+  const verdict = uploadHealth.uploadHealthVerdict(coverage.rows);
+  const sample = verdict.uncovered > 0
+    ? await shipsMissingSessionRecord({ days, windowHours, limit: sampleLimit })
+    : [];
+  return {
+    days: coverage.days,
+    window_hours: coverage.windowHours,
+    verdict,
+    sample,
+  };
+}
+
 module.exports = {
   // write side (6D.1)
   upsertSessionRecord,
@@ -667,6 +783,10 @@ module.exports = {
   // search + fetch (6D.2)
   searchSessions,
   summarizeSessions,
+  // upload health (task 1003865) — is the corpus still being written at all?
+  sessionUploadCoverage,
+  shipsMissingSessionRecord,
+  sessionUploadHealth,
   getSessionById,
   listSessionsByBuilder,
   filterTaskIdsClaimedBy,

package/modules/sessions/module.json

@@ -1,11 +1,11 @@
 {
   "key": "sessions",
   "title": "Sessions & BFG (session corpus · efficiency eval)",
-  "description": "The session-records corpus + its data plane (POST /sessions upload, the Archon-gated cross-builder /sessions/search + /sessions/:id deep-dive), the BFG 'read-the-room' cross-builder scorer (ADR 0026 §6B), and the session-pulse / stale-claim heartbeat helpers. A core-domain module carved out of the GDS core in BV1.R82 (ADR 0093 §1); default-on because every instance records its builders' sessions for the BFG. Like the memory module, sessions registers no port — core never calls back into it: the ship-time digest write is an HTTP POST to the module's own /sessions route, and the only outward dependency is the economy `reward` kernel PORT it resolves (session token reward + sumCreditsForTasks) at upload time.",
+  "description": "The session-records corpus + its data plane (POST /sessions upload, the Archon-gated cross-builder /sessions/search + /sessions/:id deep-dive + /sessions/upload-health, the server-side signal that a builder's session uploads have silently stopped), the BFG 'read-the-room' cross-builder scorer (ADR 0026 §6B), and the session-pulse / stale-claim heartbeat helpers. A core-domain module carved out of the GDS core in BV1.R82 (ADR 0093 §1); default-on because every instance records its builders' sessions for the BFG. Like the memory module, sessions registers no port — core never calls back into it: the ship-time digest write is an HTTP POST to the module's own /sessions route, and the only outward dependency is the economy `reward` kernel PORT it resolves (session token reward + sumCreditsForTasks) at upload time.",
   "coreVersion": "^1.10.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["sessions"], "pollers": ["session-reward-reconcile"] },
+  "contributes": { "routes": ["sessions"], "pollers": ["session-reward-reconcile", "session-upload-health"] },
   "provides": [],
   "consumes": []
 }

package/modules/sessions/pollers/session-upload-health.js

@@ -0,0 +1,111 @@
+'use strict';
+
+// modules/sessions/pollers/session-upload-health.js — the half of task 1003865
+// that makes the signal NOTICE rather than merely be answerable.
+//
+// GET /sessions/upload-health makes the outage visible to anyone who asks. Nobody
+// asked for weeks, which is the whole incident: the failure mode is silence, and a
+// number you have to go and look at is silent too. So this sweep asks on a
+// schedule and writes the answer where the server's own operator surface already
+// is — the process log, beside the reward reconciler's lines, which is what a
+// journalctl over this unit is read for.
+//
+// SEPARATE FROM session-reward-reconcile ON PURPOSE. That poller MOVES MONEY; this
+// one only reports. Folding telemetry into the payout sweep would let a bad read
+// here delay or crash a booking there, and the two want different cadences —
+// reward recovery wants minutes, a 14-day coverage ratio does not change in ten.
+//
+// It writes nothing and books nothing. A check that could itself change state
+// would need its own safety argument; this one needs none.
+
+const db = require('../db');
+const uploadHealth = require('../upload-health');
+// The doorway's namespaced structured logger (task 1003130), not console: this
+// module reaches the kernel only through module-api, and console.* in a server
+// path is the count the fitness ratchet exists to shrink, not to grow.
+const api = require('../../../src/module-api');
+const log = api.logger('sessions');
+
+// Hourly. The measurement behind the thresholds used a 14-day lookback stepped
+// daily, so anything under a day is already far finer than the signal; hourly is
+// chosen so a fresh outage surfaces within the same working session rather than
+// the next morning.
+const INTERVAL_MS = Number(process.env.SESSION_UPLOAD_HEALTH_MS) || 60 * 60_000;
+const FIRST_SWEEP_DELAY_MS = Number(process.env.SESSION_UPLOAD_HEALTH_FIRST_MS) || 120_000;
+
+let intervalTimer = null;
+let firstTimer = null;
+
+// logLinesFor — PURE, so the wording is pinned by a DB-free test. A log line that
+// says "unhealthy" and no more is the same silence with a timestamp on it: the
+// firing line has to name the builder, the arithmetic, and where to look next,
+// because the person reading it at 2am did not scope this task.
+function logLinesFor(health) {
+  const v = (health && health.verdict) || {};
+  const where = `GET /api/gds/sessions/upload-health?days=${health && health.days}`;
+  if (!v.firing) {
+    return [`[session-upload-health] ${v.status || 'unknown'} — ${v.reason || 'no reason given'}`];
+  }
+  const lines = [
+    `[session-upload-health] ALERT — ${v.reason}`,
+    `[session-upload-health]   a missing session record means no session.token_reward booked (ADR 0146: cost-plus is the only reward stream), so this is unpaid shipped work, not just missing telemetry.`,
+    `[session-upload-health]   look: ${where}  ·  likely cause: the upload skipping client-side (session-upload-skips.jsonl on that builder's machine).`,
+  ];
+  const sample = Array.isArray(health.sample) ? health.sample.slice(0, 5) : [];
+  if (sample.length > 0) {
+    lines.push(`[session-upload-health]   uncovered ships, newest first: ${sample.map((s) => `#${s.id}`).join(' ')}`);
+  }
+  return lines;
+}
+
+async function runSweep() {
+  const health = await db.sessionUploadHealth({
+    days: uploadHealth.DEFAULT_LOOKBACK_DAYS,
+    windowHours: uploadHealth.DEFAULT_WINDOW_HOURS,
+  });
+  const lines = logLinesFor(health);
+  // A firing sweep goes out at ERROR so it survives a level filter set to hide
+  // the hourly all-clear — the whole failure mode here is a signal nobody saw.
+  const write = health.verdict && health.verdict.firing ? log.error : log.info;
+  for (const line of lines) write(line);
+  return health;
+}
+
+// Start the periodic sweep. Idempotent (a second call is a no-op). Kill-switched
+// by SESSION_UPLOAD_HEALTH_DISABLED=1. Timers are unref'd so they never hold the
+// process open on a systemd restart (the session-reward-reconcile precedent).
+function start() {
+  if (process.env.SESSION_UPLOAD_HEALTH_DISABLED === '1') {
+    log.info('[session-upload-health] disabled (SESSION_UPLOAD_HEALTH_DISABLED=1)');
+    return;
+  }
+  if (intervalTimer) return; // already started
+
+  const tick = () => {
+    runSweep().catch((e) =>
+      log.error(e, '[session-upload-health] sweep crashed')
+    );
+  };
+
+  firstTimer = setTimeout(tick, FIRST_SWEEP_DELAY_MS);
+  if (firstTimer.unref) firstTimer.unref();
+  intervalTimer = setInterval(tick, INTERVAL_MS);
+  if (intervalTimer.unref) intervalTimer.unref();
+
+  log.info(
+    `[session-upload-health] started — checking session-upload coverage every ${Math.round(INTERVAL_MS / 60_000)}m`
+  );
+}
+
+function stop() {
+  if (firstTimer) {
+    clearTimeout(firstTimer);
+    firstTimer = null;
+  }
+  if (intervalTimer) {
+    clearInterval(intervalTimer);
+    intervalTimer = null;
+  }
+}
+
+module.exports = { start, stop, runSweep, logLinesFor, INTERVAL_MS };

package/modules/sessions/pulse.js

@@ -21,7 +21,7 @@
 //    rows as data; a follow-up task is expected to add the marker
 //    column + UPDATE write + builder surface in /builder-start.
 //
-// 2. POST /api/gds/pulse route is NOT wired here — routes.js is out
+// 2. POST /api/bongos/pulse route is NOT wired here — routes.js is out
 //    of touches[]. recordPulse() is exported for whichever future
 //    request handler is created. The CLI shell at scripts/gds/pulse.js
 //    posts to the intended endpoint and will start working once the
@@ -29,7 +29,7 @@
 //
 // Follow-up work (file new tasks when picked up):
 //   a) New migration adding claims.pulse_lost_at timestamptz.
-//   b) Route: POST /api/gds/pulse → recordPulse() (auth + claim
+//   b) Route: POST /api/bongos/pulse → recordPulse() (auth + claim
 //      ownership check).
 //   c) sweepStaleClaims() side-effect: UPDATE claims
 //      SET pulse_lost_at = now() WHERE id = ANY(...).

package/modules/sessions/routes/sessions.js

@@ -6,6 +6,11 @@
 //   POST /sessions          — upload your OWN session digest (6D.1). Owner is
 //                             forced to the caller; body builder_id is ignored.
 //   GET  /sessions/mine     — your own sessions (self-serve summary list).
+//   GET  /sessions/upload-health
+//                           — is the corpus still being written? Ships whose
+//                             builder uploaded no session around them, per
+//                             builder (task 1003865). Same cross-builder gate +
+//                             audit as /search, because it reads the same corpus.
 //   GET  /sessions/search   — cross-builder search over session + builder facets
 //                             (rank/karma/drachmae/tenure). Archon-gated +
 //                             audited (the BFG principal posture until 6C.1).
@@ -36,6 +41,11 @@ const db = require('../db');
 // the interaction profile as data precisely so it does not have to require
 // builder-settings, which ADR 0083 forbids.
 const { scoreAccessibility } = require('../accessibility');
+// The PURE clamps behind /sessions/upload-health. The route audits the values it
+// will actually query with, not the raw query string — an audit row naming
+// `days=99999` for a read that ran at 365 is a record of something that did not
+// happen (task 1003865).
+const uploadHealth = require('../upload-health');
 const seams = api; // resolveOptional('reward' | 'builder-settings') — kernel-mediated ports
 const { validateOrRespond, parseId } = api;
 
@@ -358,6 +368,42 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // GET /sessions/upload-health — the answer to "has anyone's session upload
+  // silently stopped?", which before task 1003865 existed ONLY as a jsonl file on
+  // the builder's own laptop. A skipped upload means no session_records row, which
+  // means the ADR 0146 cost-plus reward never books — a builder earning nothing for
+  // work that shipped, invisible from here.
+  //
+  // Read-only and side-effect-free, so it is DELIBERATELY not a new permission:
+  // it reads the same corpus /sessions/search reads, for the same cross-builder
+  // audience, so it rides the same `session.search` gate and writes the same
+  // fail-closed audit row. A new permission would be a new thing to grant before
+  // anyone could look at a number that already exists.
+  router.get('/sessions/upload-health', auth.requireBuilder, auth.requirePermission('session.search'), readRateLimit, async (req, res) => {
+    const q = req.query || {};
+    try {
+      // Audit BEFORE the query, like /search: no cross-builder read without a
+      // durable record of who asked.
+      await recordSessionRead(req, {
+        route: '/api/bongos/sessions/upload-health',
+        targetBuilderId: null,
+        target: `upload-health days=${uploadHealth.clampLookbackDays(q.days)} window_hours=${uploadHealth.clampWindowHours(q.window_hours)}`,
+      });
+      const health = await db.sessionUploadHealth({
+        days: q.days,
+        windowHours: q.window_hours,
+        sampleLimit: q.sample_limit,
+      });
+      res.json(health);
+    } catch (err) {
+      // The namespaced structured logger, not console — see the poller's note.
+      // Its siblings above still use console because they predate task 1003130;
+      // new call sites do not add to the count the ratchet exists to shrink.
+      api.logger('sessions').error(err, 'GET /sessions/upload-health failed');
+      res.fail('upload_health_failed', 500);
+    }
+  });
+
   // rank: any-builder — your OWN sessions (self-serve; no audit needed).
   router.get('/sessions/mine', auth.requireBuilder, readRateLimit, async (req, res) => {
     try {

package/modules/sessions/upload-health.js

@@ -0,0 +1,197 @@
+'use strict';
+
+// modules/sessions/upload-health.js — the PURE verdict over session-upload
+// coverage (task 1003865, goal 1000118).
+//
+// THE OUTAGE THIS EXISTS FOR. A Windows path-encoding bug made every transcript
+// lookup miss, so each ship skipped its session upload with `transcript_not_found`.
+// No session_records row was written, so no `session.token_reward` credit booked —
+// and since ADR 0146 made cost-plus the SOLE reward stream, the affected builder
+// earned nothing for real shipped work. It ran for weeks before a human noticed.
+//
+// WHY NOTHING NOTICED. The only trace was `session-upload-skips.jsonl`, written by
+// recordUploadSkip on the BUILDER'S OWN MACHINE. It never reaches the server, so
+// from the server's side a skipped upload and a builder who simply did not work
+// look identical: the absence of a row, in both cases.
+//
+// So the signal is built from two things the server already knows INDEPENDENTLY:
+// a task reached `shipped`, and whether that task's builder uploaded any session
+// around then. A ship with no session record for its builder inside a window is
+// the unit of evidence.
+//
+// ---------------------------------------------------------------------------
+// PER BUILDER, AND THAT IS THE WHOLE DESIGN — measured, not assumed.
+//
+// The obvious version of this check — the uncovered share across the CORPUS —
+// cannot see the outage at all. Measured against the real corpora on 2026-09-16
+// (4,495 session records and 2,640 ships carrying shipped_at + shipped_by, paged
+// out of /sessions/search and /tasks):
+//
+//   corpus-wide uncovered share, ±24h:  2026-06 1.7% · 2026-07 3.4% ·
+//                                       2026-08 2.0% · 2026-09 0.2%
+//
+// July and August — the outage months — are indistinguishable from the rest. Of
+// course they are: the failure was one builder on one machine, about 19 ships out
+// of the ~1,164 that landed across those two months. A corpus-wide ratio puts the
+// signal two orders of magnitude beneath its own noise floor.
+//
+// Keyed on the BUILDER, the same data separates cleanly. Re-running the check as
+// it would have run — a rolling 14-day lookback stepped one day at a time over
+// the ~92 evaluable days — at ±24h, min 8 ships, firing above 25%:
+//
+//   fires on 13 days, ALL of them 2026-07-24 … 2026-08-05, ALL one builder
+//   peak 2026-07-25: 19 of 19 ships with no session record — a total outage
+//   silent on the other ~79 days and on every other builder
+//
+// That is the stated outage window (2026-07 into 2026-08) and about the stated
+// ship count ("at least 16 ships"), found without being told where to look.
+//
+// The window width is measured too, not chosen: at ±12h the same sweep fires on
+// 27 days across THREE builders — long sessions that upload once at the end drift
+// past a narrow window and read as outages. ±24h keeps them in.
+// ---------------------------------------------------------------------------
+//
+// KEYED ON BUILDER + TIME, NEVER ON task_ids. `session_records.task_ids` is EMPTY
+// on 54% of rows (1,771 of 3,873 when task 1002448 measured it in 2026-09), so
+// "no session record NAMES this task" is not a usable predicate — it reports the
+// linkage gap as an outage. This file never sees task_ids at all, and the SQL in
+// db.js does not mention it; a test asserts that about the SQL actually emitted.
+//
+// PURE so the firing condition is provable without a database, and so the route
+// (on demand) and the poller (periodically) cannot answer the question two
+// different ways.
+
+// ---- the knobs, every one of them measured above ---------------------------
+
+// The window around a ship in which its builder must have uploaded SOMETHING.
+// The digest uploads at ship time (uploadSessionOnShip, inside finishShip), so a
+// healthy ship's nearest upload is minutes away — p50 is 0.21h across the whole
+// corpus. The width is for what is awkward but not an outage: a long session that
+// uploads once after several ships, a land that polled for hours, a clock that
+// disagrees. ±12h costs three false builders; ±24h costs nothing measurable.
+const DEFAULT_WINDOW_HOURS = 24;
+
+// How far back the check looks. Long enough that one quiet week cannot empty it,
+// short enough that a resolved outage stops firing instead of haunting the number
+// for a quarter. 14 days is what the sweep above was tuned on.
+const DEFAULT_LOOKBACK_DAYS = 14;
+
+// Below this many ships IN THE LOOKBACK, a builder is not judged at all. Three
+// uncovered out of four is 75% and means nothing; the same share over twenty
+// ships is the outage. A check that fires on someone's quiet fortnight teaches
+// people to mute it, which is the state this task exists to fix.
+const DEFAULT_MIN_SHIPS = 8;
+
+// The uncovered share that counts as broken, per builder. The real outage ran at
+// 86-100%; every healthy builder-fortnight in the same sweep stayed under this.
+// Set here rather than at 50% so a PARTIAL outage — some ships uploading, some
+// not — still fires, which is the shape a flaky path bug actually has.
+const DEFAULT_MAX_UNCOVERED_SHARE = 0.25;
+
+// ---- the clamps ------------------------------------------------------------
+//
+// Both reach an SQL interval, and both are reachable from a URL. They are clamped
+// HERE rather than at the route because the route is not the only caller — the
+// poller is the other — and a bound that lives at one of two call sites is not a
+// bound.
+function clampLookbackDays(n) {
+  const x = Number(n);
+  if (!Number.isFinite(x)) return DEFAULT_LOOKBACK_DAYS;
+  return Math.max(1, Math.min(365, Math.trunc(x)));
+}
+function clampWindowHours(n) {
+  const x = Number(n);
+  if (!Number.isFinite(x)) return DEFAULT_WINDOW_HOURS;
+  return Math.max(1, Math.min(720, Math.trunc(x)));
+}
+// The offender sample is evidence, not a report: enough rows to recognise the
+// shape (one machine? one week? everyone?), never the whole corpus.
+function clampSampleLimit(n) {
+  if (n == null) return 20;
+  const x = Number(n);
+  if (!Number.isFinite(x)) return 20;
+  return Math.max(1, Math.min(100, Math.trunc(x)));
+}
+
+// ---- the verdict -----------------------------------------------------------
+
+function toCount(v) {
+  const n = Number(v);
+  return Number.isFinite(n) && n > 0 ? Math.trunc(n) : 0;
+}
+
+// normalizeBuilderRows — take what the SQL returns (per-builder counts, with
+// Postgres' bigint-as-string) and hand back clean numbers. A row without a
+// builder is dropped rather than trusted, and an uncovered count above the ship
+// count is a query bug, not an outage several times over: clamp, don't propagate.
+function normalizeBuilderRows(rows) {
+  const list = Array.isArray(rows) ? rows : [];
+  return list
+    .filter((r) => r && r.builder_id != null)
+    .map((r) => {
+      const ships = toCount(r.ships);
+      const uncovered = Math.min(ships, toCount(r.uncovered));
+      return {
+        builder_id: String(r.builder_id),
+        github_login: r.github_login == null ? null : String(r.github_login),
+        ships,
+        uncovered,
+        uncovered_share: ships > 0 ? Number((uncovered / ships).toFixed(4)) : 0,
+      };
+    });
+}
+
+// uploadHealthVerdict — is any builder's session upload silently failing?
+//
+// The verdict always carries its own arithmetic and names the builder, because
+// the first question a firing check has to answer is "on what evidence", and the
+// answer to "whose machine" is what makes it actionable. An alert that cannot
+// answer either is one more thing to mute.
+function uploadHealthVerdict(rows, opts = {}) {
+  const minShips = Number.isFinite(opts.minShips) ? opts.minShips : DEFAULT_MIN_SHIPS;
+  const maxShare = Number.isFinite(opts.maxUncoveredShare) ? opts.maxUncoveredShare : DEFAULT_MAX_UNCOVERED_SHARE;
+  const builders = normalizeBuilderRows(rows).sort((a, b) => b.uncovered_share - a.uncovered_share);
+  const judged = builders.filter((b) => b.ships >= minShips);
+  const offenders = judged.filter((b) => b.uncovered_share > maxShare);
+  const ships = builders.reduce((a, b) => a + b.ships, 0);
+  const uncovered = builders.reduce((a, b) => a + b.uncovered, 0);
+  const base = { ships, uncovered, builders, judged: judged.length, offenders, minShips, maxUncoveredShare: maxShare };
+
+  if (judged.length === 0) {
+    return {
+      ...base,
+      firing: false,
+      status: 'insufficient-data',
+      reason: `no builder shipped ${minShips}+ tasks in the window (${builders.length} builder(s), ${ships} ship(s) total) — not enough to judge`,
+    };
+  }
+  if (offenders.length > 0) {
+    const worst = offenders[0];
+    const who = worst.github_login || `builder #${worst.builder_id}`;
+    const rest = offenders.length > 1 ? ` (and ${offenders.length - 1} other builder(s) over the line)` : '';
+    return {
+      ...base,
+      firing: true,
+      status: 'uploads-missing',
+      reason: `${who} has ${worst.uncovered} of ${worst.ships} ships (${(worst.uncovered_share * 100).toFixed(1)}%) with no session record in the window${rest}. Their session uploads are probably failing, which means the cost-plus reward is not booking for work that shipped.`,
+    };
+  }
+  return {
+    ...base,
+    firing: false,
+    status: 'healthy',
+    reason: `${judged.length} builder(s) judged, worst ${(judged[0].uncovered_share * 100).toFixed(1)}% uncovered — under the ${(maxShare * 100).toFixed(0)}% threshold`,
+  };
+}
+
+module.exports = {
+  DEFAULT_WINDOW_HOURS,
+  DEFAULT_LOOKBACK_DAYS,
+  DEFAULT_MIN_SHIPS,
+  DEFAULT_MAX_UNCOVERED_SHARE,
+  clampLookbackDays,
+  clampWindowHours,
+  clampSampleLimit,
+  normalizeBuilderRows,
+  uploadHealthVerdict,
+};

package/modules/status-ui/module.json

@@ -1,7 +1,7 @@
 {
   "key": "status-ui",
   "title": "Status dashboard (\"The Watch\")",
-  "description": "The public build-status dashboard served at status.<apex> (status.example.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/gds/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
+  "description": "The public build-status dashboard served at status.<apex> (status.example.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/bongos/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/status-ui/public/explore.js

@@ -113,7 +113,7 @@
     return el;
   }
 
-  fetch('/api/gds/projects/featured', { headers: { Accept: 'application/json' } })
+  fetch('/api/bongos/projects/featured', { headers: { Accept: 'application/json' } })
     .then(function (r) { if (!r.ok) throw new Error('http ' + r.status); return r.json(); })
     .then(function (data) {
       var projects = (data && Array.isArray(data.projects)) ? data.projects : [];

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.803",
+  "version": "1.19.805",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.803",
+      "version": "1.19.805",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.803",
+  "version": "1.19.805",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/agent-invoke.js

@@ -610,7 +610,7 @@ module.exports = {
 
 function usage() {
   console.error('Usage: node scripts/gds/agent-invoke.js <agent> "<question>" [--out <path>] [--json]');
-  console.error('  <agent>      the agent name as it appears in the registry (GET /api/gds/agents)');
+  console.error('  <agent>      the agent name as it appears in the registry (GET /api/bongos/agents)');
   console.error('  --out <path> write the answer to a file and record it as the run\'s output_ref');
   console.error('  --json       print the whole result as JSON instead of prose');
 }
@@ -624,7 +624,7 @@ async function main() {
   // Rule 5. requireSession exits with its own guidance when there is no session.
   const cli = require('./cli-lib');
   await cli.requireSession();
-  const me = await cli.apiCall('GET', '/api/gds/me');
+  const me = await cli.apiCall('GET', '/api/bongos/me');
   const builder = (me && me.data && me.data.builder) || null;
   if (!builder || !builder.id) {
     console.error('agent-invoke: could not resolve who you are from /me — a fire has to be attributable.');
@@ -659,7 +659,7 @@ async function main() {
     console.error(`\n  ${name}: ${result.code}`);
     if (result.reason) console.error(`  ${result.reason}`);
     if (result.code === 'agent_not_found') {
-      console.error('  Nothing by that name is in the registry. `node scripts/gds/api.js GET /api/gds/agents` lists it.');
+      console.error('  Nothing by that name is in the registry. `node scripts/gds/api.js GET /api/bongos/agents` lists it.');
     }
     if (result.code === 'agent_refused' && /not enabled/.test(result.reason || '')) {
       console.error('  Definitions land in the registry DISABLED by design: agents-sync reconciles');

package/scripts/gds/api.js

@@ -8,10 +8,10 @@
 // session token + API base, so there is no manual token extraction here.
 //
 // Usage:
-//   node scripts/gds/api.js GET  /api/gds/inbox
-//   node scripts/gds/api.js POST /api/gds/blockers/5/resolve --body '{"resolution_note":"fixed in #690"}'
-//   node scripts/gds/api.js POST /api/gds/security/reports   --body-file report.json
-//   echo '{"verdict":"promote"}' | node scripts/gds/api.js PATCH /api/gds/inbox/12 --body-file -
+//   node scripts/gds/api.js GET  /api/bongos/inbox
+//   node scripts/gds/api.js POST /api/bongos/blockers/5/resolve --body '{"resolution_note":"fixed in #690"}'
+//   node scripts/gds/api.js POST /api/bongos/security/reports   --body-file report.json
+//   echo '{"verdict":"promote"}' | node scripts/gds/api.js PATCH /api/bongos/inbox/12 --body-file -
 //
 // The HTTP status goes to STDERR ("POST /path → 201"); the pretty-printed JSON
 // body goes to STDOUT, so `... | node -e ...` style piping stays clean. Exit 0

package/scripts/gds/api.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # scripts/gds/api.sh — Git Bash/Linux passthrough wrapper around api.js.
-# MSYS_NO_PATHCONV avoids Git Bash mangling API paths (e.g. /api/gds/inbox) into
+# MSYS_NO_PATHCONV avoids Git Bash mangling API paths (e.g. /api/bongos/inbox) into
 # Windows paths before node ever sees them.
 export MSYS_NO_PATHCONV=1
 exec node "$(dirname "$0")/api.js" "$@"