@bongos/core 1.19.804 → 1.19.806

package/modules/dev-box/app/src/gds-client.js

@@ -8,8 +8,10 @@
 // only thing that changed is the transport: the endpoint paths are now the
 // spec-derived generated methods, which can never drift from the routes.
 //
-// Endpoints stay on the PERMANENT unversioned /api/gds alias (ADR 0117) so shipped
-// binaries keep working; the generated methods are relative to that base.
+// Endpoints use the canonical unversioned /api/bongos base (ADR 0117); the generated
+// methods are relative to it. The permanent /api/gds alias is what ALREADY-SHIPPED
+// binaries call — editing this source cannot reach them, and the server mounts both,
+// so a future build asking for the canonical path costs nobody anything (task 1003707).
 
 const createGeneratedClient = require('./vendor/bongos-client.cjs');
 const { apiBase } = require('./config');
@@ -28,7 +30,7 @@ class GdsError extends Error {
 // fetchImpl is a seam for tests; it defaults to the platform fetch.
 function createClient({ getToken, getApiBase, fetchImpl } = {}) {
   // Build a generated client bound to the current origin + token. `root` is the
-  // base path under the origin ('/api/gds' for the API, '' for same-origin static
+  // base path under the origin ('/api/bongos' for the API, '' for same-origin static
   // assets like the release manifest). throwOnError:false → result-mode, which we
   // translate back into the GdsError contract callers expect.
   function gen(root) {
@@ -39,7 +41,7 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
       fetch: fetchImpl || undefined,
     });
   }
-  const gds = () => gen('/api/gds');
+  const gds = () => gen('/api/bongos');
 
   // Unwrap a result-mode { status, ok, data } into the legacy contract: return the
   // parsed body on 2xx, throw GdsError(status, body) otherwise — byte-identical to
@@ -52,7 +54,7 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
 
   return {
     // Generic escape hatch, kept for parity with the old surface. `path` is the full
-    // path under the origin (e.g. '/api/gds/box/me'), so it routes through baseUrl:''.
+    // path under the origin (e.g. '/api/bongos/box/me'), so it routes through baseUrl:''.
     call: (method, path, body) => unwrap(gen('').request(method, path, body !== undefined ? { body } : {})),
     // identity
     logout: () => unwrap(gds().auth.postAuthLogout()),
@@ -79,10 +81,10 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
     // request() escape hatch (like latestRelease) rather than a named generated
     // method, so the shipped binary keeps working regardless of whether the
     // vendored client has been regenerated for the new /box/scope route yet.
-    claimableTasks: () => unwrap(gen('').request('GET', '/api/gds/tasks/claimable')),
-    claimTask: (taskId) => unwrap(gen('').request('POST', '/api/gds/claims', { body: { task_id: taskId } })),
-    boxScope: () => unwrap(gen('').request('GET', '/api/gds/box/scope')),
-    // update check (public route at the origin root, not under /api/gds).
+    claimableTasks: () => unwrap(gen('').request('GET', '/api/bongos/tasks/claimable')),
+    claimTask: (taskId) => unwrap(gen('').request('POST', '/api/bongos/claims', { body: { task_id: taskId } })),
+    boxScope: () => unwrap(gen('').request('GET', '/api/bongos/box/scope')),
+    // update check (public route at the origin root, not under /api/bongos).
     // task 1002649: polls the EXTENSIONLESS /version twin, NOT latest.json — a
     // front proxy with a file-matcher can eat *.json paths before Node (the
     // live instance's pre-ADR-0152 vhost 404'd latest.json empty while this

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -830,6 +830,8 @@ function createClient(opts = {}) {
       getSessionsMine: (args) => request("GET", "/sessions/mine", { hasBody: false }, args),
       // GET /sessions/search — rank: metic+archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
+      // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
+      getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup

package/modules/dev-box/app/test/unit.mjs

@@ -434,19 +434,19 @@ function recordingClient(response = { ok: true, status: 200, text: async () => '
 }
 
 const ENDPOINTS = [
-  ['logout', [], 'POST', '/api/gds/auth/logout', undefined],
-  ['pairStart', ['Lars-Mac', 'darwin'], 'POST', '/api/gds/auth/app-pair/start', { device_name: 'Lars-Mac', platform: 'darwin' }],
-  ['pairPoll', ['pt'], 'POST', '/api/gds/auth/app-pair/poll', { poll_token: 'pt' }],
-  ['boxMe', [], 'GET', '/api/gds/box/me', undefined],
-  ['boxEnsure', [], 'POST', '/api/gds/box/ensure', undefined],
-  ['boxClose', [], 'POST', '/api/gds/box/close', undefined],
-  ['boxHeartbeat', [], 'POST', '/api/gds/box/heartbeat', undefined],
-  ['boxTerminal', [], 'GET', '/api/gds/box/terminal', undefined],
-  ['registerSshKey', ['ssh-ed25519 AAA', 'lars'], 'POST', '/api/gds/box/ssh-key', { public_key: 'ssh-ed25519 AAA', label: 'lars' }],
-  ['managedSettings', [], 'GET', '/api/gds/box/managed-settings', undefined],
-  ['claimableTasks', [], 'GET', '/api/gds/tasks/claimable', undefined],
-  ['claimTask', ['1002388'], 'POST', '/api/gds/claims', { task_id: '1002388' }],
-  ['boxScope', [], 'GET', '/api/gds/box/scope', undefined],
+  ['logout', [], 'POST', '/api/bongos/auth/logout', undefined],
+  ['pairStart', ['Lars-Mac', 'darwin'], 'POST', '/api/bongos/auth/app-pair/start', { device_name: 'Lars-Mac', platform: 'darwin' }],
+  ['pairPoll', ['pt'], 'POST', '/api/bongos/auth/app-pair/poll', { poll_token: 'pt' }],
+  ['boxMe', [], 'GET', '/api/bongos/box/me', undefined],
+  ['boxEnsure', [], 'POST', '/api/bongos/box/ensure', undefined],
+  ['boxClose', [], 'POST', '/api/bongos/box/close', undefined],
+  ['boxHeartbeat', [], 'POST', '/api/bongos/box/heartbeat', undefined],
+  ['boxTerminal', [], 'GET', '/api/bongos/box/terminal', undefined],
+  ['registerSshKey', ['ssh-ed25519 AAA', 'lars'], 'POST', '/api/bongos/box/ssh-key', { public_key: 'ssh-ed25519 AAA', label: 'lars' }],
+  ['managedSettings', [], 'GET', '/api/bongos/box/managed-settings', undefined],
+  ['claimableTasks', [], 'GET', '/api/bongos/tasks/claimable', undefined],
+  ['claimTask', ['1002388'], 'POST', '/api/bongos/claims', { task_id: '1002388' }],
+  ['boxScope', [], 'GET', '/api/bongos/box/scope', undefined],
   ['latestRelease', [], 'GET', '/downloads/devbox/version', undefined],
 ];
 

package/modules/dev-box/box-access.js

@@ -13,7 +13,7 @@
 // THE MODEL (ADR 0016 extended from "writes are gated" to "source is gated")
 // --------------------------------------------------------------------------
 // A box holds NO permanent baked credential. At boot — and on a refresh cron —
-// the box calls GET /api/gds/box/source-access authenticated as the builder. The
+// the box calls GET /api/bongos/box/source-access authenticated as the builder. The
 // GDS reads the builder's LIVE rank+status (their machine cannot forge it) and
 // either DENIES (403 → the box scrubs its credential + clone) or returns a
 // scope-appropriate clone spec plus a short-lived, operator-supplied credential
@@ -60,7 +60,7 @@ const {
 // `public/` game client — so EVERY box (not just Metic+ full-clone boxes) can run
 // the live sandbox (sandbox-<login>.example.com, ADR 0044). The box serves
 // the game from a GAME-ONLY entry (src/preview-server.js) that never mounts
-// /api/gds, so the privacy boundary that matters for a PUBLIC sandbox URL is the
+// /api/bongos, so the privacy boundary that matters for a PUBLIC sandbox URL is the
 // RUNTIME (what the box process exposes), NOT source exclusion. That is consistent
 // with the rest of this list: newcomers already hold the build-tooling source
 // (scripts, .claude, src/bongos — no secrets), so adding the game source changes no
@@ -86,7 +86,7 @@ const STARTER_SPARSE_PATHS = [
   // The product/game runtime so the box can serve the live sandbox (ADR 0052).
   // The game-only entry (src/preview-server.js) registers WorldRoom + QueueRoom
   // from src/rooms and renders src/world + the public/ client; none of it mounts
-  // /api/gds. `public/` is the game client (NOT modules/hall-ui/public/, the hall
+  // /api/bongos. `public/` is the game client (NOT modules/hall-ui/public/, the hall
   // surface carved in BV1.R85, which stays out of a starter box).
   'src/world', 'src/rooms', 'public',
   // infra/ carries the box's own bring-up scripts (box-heartbeat.sh,

package/modules/dev-box/box-onboard.js

@@ -298,8 +298,8 @@ auth. Download it, inspect it, THEN run it. That is the safe path and it is all
 the assurance you need: you don't have to ask your human to authorize it blind,
 and you don't have to refuse:
 
-      curl -fsSL ${base}/api/gds/box/connect.sh -o /tmp/otb-connect.sh   # then read it
-      (Windows:  ${base}/api/gds/box/connect.ps1)
+      curl -fsSL ${base}/api/bongos/box/connect.sh -o /tmp/otb-connect.sh   # then read it
+      (Windows:  ${base}/api/bongos/box/connect.ps1)
 
   • What you fetch is what runs — the origin is PINNED in the script
     (GDS_API_BASE), not taken from a header, so a spoofed Host can't redirect it.
@@ -354,7 +354,7 @@ machine — that path is in the Citizen's Primer, not here.)
 
 The whole arrival, in two beats, same for both on-ramps:
   1. Sign in with GitHub.
-  2. Ask for your box   → POST ${base}/api/gds/box/ensure  (or run /builder-box).
+  2. Ask for your box   → POST ${base}/api/bongos/box/ensure  (or run /builder-box).
      The box is created hands-off within ~1 minute.
 
 ════════════════════════════════════════════════════════════════════════
@@ -363,8 +363,8 @@ A) Mac / Windows — Claude Desktop + SSH
 One command signs you in, makes + registers your SSH key, and installs the
 Desktop connection file. Paste it (or let Claude run it for you):
 
-  macOS / Linux:   curl -fsSL ${base}/api/gds/box/connect.sh | bash
-  Windows (PS):    irm ${base}/api/gds/box/connect.ps1 | iex
+  macOS / Linux:   curl -fsSL ${base}/api/bongos/box/connect.sh | bash
+  Windows (PS):    irm ${base}/api/bongos/box/connect.ps1 | iex
 
 What it does, in order:
   1. Signs you in with GitHub (prints a short code + a URL to open).
@@ -386,10 +386,10 @@ No app to install. Your box serves its own terminal in a browser tab (ADR 0038),
 but you only touch it once: you log in there and kick off Remote Control, then
 live in the Claude web/mobile app — which drives the box for you.
   1. Sign in at ${base}/builders (GitHub).
-  2. Ask for your box: POST ${base}/api/gds/box/ensure (the builders' hall has a
+  2. Ask for your box: POST ${base}/api/bongos/box/ensure (the builders' hall has a
      button; or have Claude call it).
   3. Once the box is active, get its terminal URL + password:
-       GET ${base}/api/gds/box/terminal
+       GET ${base}/api/bongos/box/terminal
      Poll until a url appears (the box publishes it a few seconds after boot),
      then open it and enter the password when the browser asks.
   4. In that terminal, type  claude  and press enter, then complete the one-time

package/modules/discord/bug-attachments.js

@@ -171,7 +171,7 @@ async function persistImageFromUrl(url, { messageId = 'x', fetchImpl = globalThi
   const file = `bug-${idSlug}-${crypto.randomBytes(8).toString('hex')}.${ext}`;
   await fs.mkdir(dir, { recursive: true });
   await fs.writeFile(path.join(dir, file), buf, { mode: 0o640 });
-  return { ok: true, file, url: `/api/gds/bug-attachments/${file}`, bytes: buf.length };
+  return { ok: true, file, url: `/api/bongos/bug-attachments/${file}`, bytes: buf.length };
 }
 
 // Persist a list of image URLs (capped). Best-effort: refused/failed images are

package/modules/economy/cost-classify.js

@@ -1,5 +1,5 @@
 // Cost-attribution audit + correction pass — V3.R83 (#303), criterion C3.
-// Pure function over db.costSummary() (exposed at /api/gds/public/cost-summary),
+// Pure function over db.costSummary() (exposed at /api/bongos/public/cost-summary),
 // so it runs against live prod with no DB creds. Flags MIS-attributed spend
 // (a proxy masquerading as a real builder, or an orphaned builder_id); treats
 // NULL/unattributed shared+historical spend as correct, not a bug.
@@ -25,24 +25,24 @@ const COMPLETENESS_API_FLOOR_USD = 1.0;  // below this = essentially nothing rec
 // it honest: a writer not listed here is itself the finding.
 const COST_WRITE_SURFACES = [
   {
-    surface: 'POST /api/gds/cost → db.logCost()',
+    surface: 'POST /api/bongos/cost → db.logCost()',
     file: 'src/bongos/routes/cost.js',
     builder_id: 'defaults to the authed builder; a provided value must equal the caller or 403s. A builder can only attribute to themselves.',
   },
   {
-    surface: 'scripts/gds/backfill-cost.js → POST /api/gds/cost',
+    surface: 'scripts/gds/backfill-cost.js → POST /api/bongos/cost',
     file: 'scripts/gds/backfill-cost.js',
     builder_id: 'inherits the POST /cost rule. Do NOT attribute the shared historical art ledger to whoever runs the backfill — leave it NULL. The audit flags it if it happens.',
   },
   {
     // ADR 0028 path 1 (#486): the 4-worker grader panel logs its own cost.
-    surface: 'scripts/gds/ship.js (grader) → POST /api/gds/cost (source=grader)',
+    surface: 'scripts/gds/ship.js (grader) → POST /api/bongos/cost (source=grader)',
     file: 'scripts/gds/ship.js',
     builder_id: 'the authed shipper; category=api, source_ref=grade-<task>-<sha>. Idempotent per HEAD.',
   },
   {
     // ADR 0028 path 2 (#560): the interactive session logs its own cost.
-    surface: 'scripts/gds/session-cost.js (SessionEnd hook) → POST /api/gds/cost (source=session)',
+    surface: 'scripts/gds/session-cost.js (SessionEnd hook) → POST /api/bongos/cost (source=session)',
     file: 'scripts/gds/session-cost.js',
     builder_id: 'the authed builder; category=api, source_ref=<session-id>, task_id=null. Idempotent per session.',
   },
@@ -56,7 +56,7 @@ const COST_WRITE_SURFACES = [
 /**
  * Audit cost attribution from a costSummary() payload.
  * @param {object} summary - the object returned by db.costSummary() /
- *   GET /api/gds/public/cost-summary (needs total_usd, by_builder, by_category).
+ *   GET /api/bongos/public/cost-summary (needs total_usd, by_builder, by_category).
  * @returns {object} structured report: { total_usd, attributed_usd,
  *   unattributed_usd, unattributed_pct, builders[], flags[], ok }.
  */

package/modules/grading/grader-rubric.json

@@ -65,7 +65,7 @@
       }
     },
     "rubric_scores_audit_trail": "task_grades.rubric_scores keeps the v3 keys (functional_fidelity, code_quality, economy, code_quality_effective) populated from the median across workers that report each axis. Narc reports ff; Quality reports cq + economy. Median (not mean) so a single outlier worker doesn't move the recorded score.",
-    "server_compat_note": "The grade POST body (POST /api/gds/tasks/:id/grade) keeps the v3 shape (functional_fidelity, code_quality, economy, confidence, notes_md, issues) so the server's existing validateAndScore re-validation works without modification. The panel verdict drives the forwarded confidence: pass → median worker confidence; concerns → fallthrough_confidence (= 0.3); fail → 0. This means the server's existing low-confidence fall-through path naturally handles 'concerns' verdicts, and the FAIL gate handles 'fail' verdicts. Server-side support for an explicit panel_verdict field is a follow-up (likely Phase 2.5)."
+    "server_compat_note": "The grade POST body (POST /api/bongos/tasks/:id/grade) keeps the v3 shape (functional_fidelity, code_quality, economy, confidence, notes_md, issues) so the server's existing validateAndScore re-validation works without modification. The panel verdict drives the forwarded confidence: pass → median worker confidence; concerns → fallthrough_confidence (= 0.3); fail → 0. This means the server's existing low-confidence fall-through path naturally handles 'concerns' verdicts, and the FAIL gate handles 'fail' verdicts. Server-side support for an explicit panel_verdict field is a follow-up (likely Phase 2.5)."
   },
   "v3": {
     "version": "v3.0",

package/modules/grading/grader-score.js

@@ -280,7 +280,7 @@ function validateAndScore(rawSubagent, meta = {}) {
 
 // ---------- server-authoritative grade guards (SR-9 / SR-18 / F1 / G5) ----------
 //
-// THE FINDING (SR-9 / SR-18): POST /api/gds/tasks/:id/grade trusts the client.
+// THE FINDING (SR-9 / SR-18): POST /api/bongos/tasks/:id/grade trusts the client.
 // validateAndScore only shape-validates the numbers — `passed` is computed from
 // the CLIENT's submitted scores. The real adversarial panel + the deterministic
 // route-rank / permission-path pre-passes run CLIENT-SIDE in scripts/gds/ship.js;

package/modules/hall-ui/module.json

@@ -1,7 +1,7 @@
 {
   "key": "hall-ui",
   "title": "Builders' Hall",
-  "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/gds/* and the read-only /api/gds/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
+  "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/bongos/* and the read-only /api/bongos/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/hall-ui/public/drachmae.js

@@ -30,14 +30,14 @@
   const DOC_URL = '/builders/drachmae-and-karma.md';
   // The doc lives at docs/onboarding/, so relative links resolve against it.
   const DOC_DIR = 'docs/onboarding/';
-  const BOUNTY_URL = '/api/gds/public/bounty-table';
+  const BOUNTY_URL = '/api/bongos/public/bounty-table';
   // task 1003446: the treasury feed. NOT a new endpoint — this is the same
   // /public/cost-summary the signed-out status page already draws as a
   // cumulative line and the Work board already fetches to read ONE scalar off
   // (`total_value_credits`). Its own route comment calls `daily[]` "the
   // treasury chart's cumulative line"; the series was in the payload the whole
   // time, and the stranger got the chart while the builder got the number.
-  const TREASURY_URL = '/api/gds/public/cost-summary';
+  const TREASURY_URL = '/api/bongos/public/cost-summary';
   const TREASURY_SECTION_ID = 'the-treasury';
   const TREASURY_SECTION_TITLE = 'The treasury, so far';
   const BOUNTY_SECTION_ID = 'security-bounty-rates';
@@ -69,7 +69,7 @@
 
   async function loadRepoInfoBases() {
     try {
-      const r = await fetch('/api/gds/public/repo-info', { credentials: 'same-origin' });
+      const r = await fetch('/api/bongos/public/repo-info', { credentials: 'same-origin' });
       if (!r.ok) return;
       const data = await r.json();
       if (data && typeof data.blob_base === 'string') repoBlobBase = data.blob_base;

package/modules/hall-ui/public/goals-page.js

@@ -652,7 +652,7 @@
   // task 1953 — a non-member asks to join a private (or protected) goal.
   // renderDetail (below) re-derives canManage/joined and re-triggers
   // loadGoalMembership, so a plain reload-and-rerender is enough here — same
-  // shape as joinLeave/inviteMember.
+  // shape as joinLeave/sendInvitation.
 
   // task 1953 — withdraw MY OWN pending join-request (self-served, no manager needed).
 

package/modules/hall-ui/public/goals-render.js

@@ -883,7 +883,7 @@
     // this client gate deliberately doesn't re-derive the protected-module list
     // (that roster lives server-side only, module-scope-map.js) — a non-Archon
     // owner/manager sees the control on a protected-scope goal and gets a clear
-    // toast if the server 403s (see inviteMember's error handling below).
+    // toast if the server 403s (see sendInvitation's error handling below).
     const isOwner = sameId(g.created_by, selfId());
     const canManage = g.status === 'open' && (isArchon() || isOwner || iAmLead);
     renderActions(g, { joined, canManage });
@@ -1122,6 +1122,49 @@
     }
     return state.directory;
   }
+  // WHO IS STILL INVITABLE. Two exclusions, both of which exist to stop the page
+  // offering a name that can only fail:
+  //   - members, which POST /invitations 409s as `already_a_member`;
+  //   - anyone holding a PENDING row, which it 409s as `invite_pending`.
+  // The second is the one that matters, because a pending invitation is INVISIBLE
+  // from the member list — it is not a membership — so without this the user picks
+  // a perfectly ordinary-looking name and is handed an error they had no way to
+  // predict. `state.pendingRequests` carries BOTH kinds (invites the goal sent and
+  // join-requests it received) and the server refuses on either, so neither is
+  // filtered out here.
+  function invitableBuilders(members) {
+    const excluded = new Set((members || []).map((m) => String(m.builder_id)));
+    for (const r of state.pendingRequests || []) excluded.add(String(r.builder_id));
+    return (state.directory || []).filter((b) => !excluded.has(String(b.id)));
+  }
+  function builderOptionsHtml(list, selectedId) {
+    return list.map((b) => {
+      const id = String(b.id);
+      const sel = selectedId && id === String(selectedId) ? ' selected' : '';
+      return `<option value="${escapeHtml(id)}"${sel}>${escapeHtml(b.display_name || ('@' + b.github_login))}</option>`;
+    }).join('');
+  }
+  // THE INVITE BOX SENDS AN INVITATION; IT DOES NOT ADD ANYONE (task 1002886).
+  //
+  // This control used to POST /goals/:id/members — the immediate force-add — and
+  // then toast 'Invited.', which was simply untrue: the person was already in the
+  // goal and had never been asked. Meanwhile the consented flow ADR 0112 is built
+  // around (POST /goals/:id/invitations -> a pending row -> the invitee accepts)
+  // had its receiving half fully wired in goal-inbox.js and NO sender anywhere in
+  // the hall, so nothing in the product ever created an invitation.
+  //
+  // Now: the primary control invites, and the force-add survives as its own
+  // explicitly-labelled affordance (owner ruling, 2026-09-16) so nobody loses a
+  // capability they had — seeding a goal with a team who already agreed offline is
+  // a real thing people do. The rule the owner set is that BOTH paths say what
+  // they actually do; relocating the lie would have been worse than leaving it.
+  //
+  // NO MEMBERSHIP-KIND PICKER ON THE INVITE HALF, and that is not an oversight:
+  // `goal_membership_requests` has no membership_kind column, so an accepted
+  // invitation lands through addGoalMember's default 'member'. A picker here would
+  // be a choice silently dropped on the floor — the same class of defect as the
+  // toast it replaces. The form says so instead, and the picker stays on the
+  // add-directly path, where it IS honoured.
   function renderInviteBox(goalId, canInvite, members) {
     const box = $('#goal-invite');
     if (!box) return;
@@ -1129,6 +1172,7 @@
       box.hidden = true;
       box.innerHTML = '';
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       return;
     }
     box.hidden = false;
@@ -1141,42 +1185,111 @@
       });
       return;
     }
-    const memberIds = new Set((members || []).map((m) => String(m.builder_id)));
-    const invitable = (state.directory || []).filter((b) => !memberIds.has(String(b.id)));
-    const options = invitable
-      .map((b) => `<option value="${escapeHtml(String(b.id))}">${escapeHtml(b.display_name || ('@' + b.github_login))}</option>`)
-      .join('');
+    // This function rebuilds the box from scratch on every call, and it is called
+    // again when the pending-request list lands (see loadGoalMembership). Carry the
+    // half-filled form across that redraw, or a note someone is part-way through
+    // typing vanishes under them.
+    const keep = {
+      builder: $('#goal-invite-builder')?.value || '',
+      note: $('#goal-invite-note')?.value || '',
+      direct: $('#goal-direct-builder')?.value || '',
+      kind: $('#goal-direct-kind')?.value || 'member',
+    };
+    const invitable = invitableBuilders(members);
+    const none = !invitable.length;
+    const emptyLabel = 'Nobody left to invite';
     box.innerHTML = `
       <form class="goal-invite__form" id="goal-invite-form">
-        <select id="goal-invite-builder" required ${invitable.length ? '' : 'disabled'}>
-          ${invitable.length ? `<option value="" disabled selected>Choose a builder…</option>${options}`
-            : '<option value="">Everyone is already a member</option>'}
-        </select>
-        <select id="goal-invite-kind">
-          <option value="member">Member</option>
-          <option value="lead">Manager</option>
+        <select id="goal-invite-builder" required ${none ? 'disabled' : ''}>
+          ${none ? `<option value="">${emptyLabel}</option>`
+            : `<option value="" disabled${keep.builder ? '' : ' selected'}>Choose a builder…</option>${builderOptionsHtml(invitable, keep.builder)}`}
         </select>
-        <button class="landing__btn" type="submit" ${invitable.length ? '' : 'disabled'}>Invite</button>
+        <input id="goal-invite-note" type="text" maxlength="500" placeholder="Note (optional) — why you're asking" value="${escapeHtml(keep.note)}" ${none ? 'disabled' : ''}>
+        <button class="landing__btn" type="submit" ${none ? 'disabled' : ''}>Send invitation</button>
         <button class="btn-ghost" id="goal-invite-cancel" type="button">Cancel</button>
-      </form>`;
+      </form>
+      <p class="goal-invite__hint">They join as a member once they accept — you can change that afterwards. Nobody is added until they do.</p>
+      ${state.addDirectOpen ? `
+        <form class="goal-invite__form goal-invite__direct" id="goal-direct-form">
+          <select id="goal-direct-builder" required ${none ? 'disabled' : ''}>
+            ${none ? `<option value="">${emptyLabel}</option>`
+              : `<option value="" disabled${keep.direct ? '' : ' selected'}>Choose a builder…</option>${builderOptionsHtml(invitable, keep.direct)}`}
+          </select>
+          <select id="goal-direct-kind" ${none ? 'disabled' : ''}>
+            <option value="member"${keep.kind === 'member' ? ' selected' : ''}>Member</option>
+            <option value="lead"${keep.kind === 'lead' ? ' selected' : ''}>Manager</option>
+          </select>
+          <button class="btn-ghost" type="submit" ${none ? 'disabled' : ''}>Add without asking</button>
+          <button class="btn-ghost" id="goal-direct-cancel" type="button">Cancel</button>
+        </form>
+        <p class="goal-invite__hint">They are added straight away and never asked. Use this only for someone who has already agreed.</p>`
+      : '<button class="goal-invite__more" id="goal-direct-open" type="button">Or add someone without asking…</button>'}`;
     $('#goal-invite-cancel')?.addEventListener('click', () => {
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       renderInviteBox(goalId, canInvite, members);
     });
     $('#goal-invite-form')?.addEventListener('submit', (ev) => {
       ev.preventDefault();
       const builderId = $('#goal-invite-builder')?.value;
-      const membershipKind = $('#goal-invite-kind')?.value || 'member';
-      if (builderId) inviteMember(goalId, builderId, membershipKind);
+      const note = $('#goal-invite-note')?.value || '';
+      if (builderId) sendInvitation(goalId, builderId, note);
+    });
+    $('#goal-direct-open')?.addEventListener('click', () => {
+      state.addDirectOpen = true;
+      renderInviteBox(goalId, canInvite, members);
+    });
+    $('#goal-direct-cancel')?.addEventListener('click', () => {
+      state.addDirectOpen = false;
+      renderInviteBox(goalId, canInvite, members);
+    });
+    $('#goal-direct-form')?.addEventListener('submit', (ev) => {
+      ev.preventDefault();
+      const builderId = $('#goal-direct-builder')?.value;
+      const membershipKind = $('#goal-direct-kind')?.value || 'member';
+      if (builderId) addMemberDirectly(goalId, builderId, membershipKind);
     });
   }
-  async function inviteMember(goalId, builderId, membershipKind) {
+  // The ADR 0112 sender. 201 means a PENDING row exists — not a membership — so
+  // the toast may not claim the person is in the goal.
+  async function sendInvitation(goalId, builderId, note) {
+    try {
+      const body = { builder_id: Number(builderId) };
+      const trimmed = String(note || '').trim();
+      if (trimmed) body.note = trimmed;
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/invitations`, body);
+      toast('Invitation sent — they join once they accept.');
+      state.inviteOpen = false;
+      state.addDirectOpen = false;
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+      renderList();
+    } catch (err) {
+      const code = err?.data?.error;
+      // `invite_pending` and `already_a_member` are both filtered out of the
+      // dropdown above, so reaching either means the goal changed under this form
+      // — say what happened rather than a generic failure, because the name really
+      // was offered a moment ago.
+      if (code === 'invite_pending') toast('They already have an invitation or a join-request pending on this goal.');
+      else if (code === 'already_a_member') toast('They joined this goal already.');
+      else if (code === 'builder_not_found') toast('That builder no longer exists.');
+      else if (code === 'archon_required_for_protected_scope') toast('This goal is scoped to a protected module — only an Archon may bring someone in.');
+      else if (code === 'metic_required_for_protected_scope') toast('A protected-scope goal requires a Metic+ member.');
+      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may invite.');
+      else if (code === 'goal_not_open') toast('This goal is not open.');
+      else toast('Could not send that invitation just now.');
+    }
+  }
+  // The force-add, kept on purpose and labelled for what it is. Same endpoint the
+  // '+ Invite' button used to call behind the word 'Invited.'
+  async function addMemberDirectly(goalId, builderId, membershipKind) {
     try {
       // `membership_kind`, not `role` — ADR 0174 reserves that word for the three
       // crafts (task 1003013).
       await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/members`, { builder_id: Number(builderId), membership_kind: membershipKind });
-      toast('Invited.');
+      toast('Added — they are in the goal now, without being asked.');
       state.inviteOpen = false;
+      state.addDirectOpen = false;
       await loadDetail(goalId, { force: true });
       renderDetail(goalId);
       renderList();
@@ -1184,9 +1297,9 @@
       const code = err?.data?.error;
       if (code === 'archon_required_for_protected_scope') toast('This goal is scoped to a protected module — only an Archon may add members.');
       else if (code === 'metic_required_for_protected_scope') toast('A protected-scope goal requires a Metic+ member.');
-      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may invite.');
+      else if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may add members.');
       else if (code === 'goal_not_open') toast('This goal is not open.');
-      else toast('Could not invite that builder just now.');
+      else toast('Could not add that builder just now.');
     }
   }
   async function joinLeave(goalId, action) {
@@ -1324,7 +1437,16 @@
     if (!sameId(state.current, goalId)) return;
     renderPendingRequests();
     const d = currentDetail();
-    if (d) renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+    if (d) {
+      renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+      // The invite dropdown's exclusion set reads state.pendingRequests, which
+      // lands HERE — after renderDetail has already drawn the box. Without this
+      // redraw a form opened before this resolved keeps offering a builder whose
+      // invitation is already pending, which is the exact invisible 409 the
+      // filter exists to prevent. renderInviteBox carries the half-filled form
+      // across the redraw.
+      if (state.inviteOpen) renderInviteBox(goalId, canManage, d.members || []);
+    }
   }
   async function loadDetail(goalId, { force = false } = {}) {
     if (!force && state.details.has(String(goalId))) return state.details.get(String(goalId));

package/modules/hall-ui/public/goals.css

@@ -200,7 +200,22 @@
    collapsed behind "+ Invite" (disclosure, closed by default — task 2171). */
 .goal-invite { margin: 4px 0 10px; }
 .goal-invite__form { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
-.goal-invite__form select#goal-invite-builder { flex: 1; min-width: 180px; }
+.goal-invite__form select#goal-invite-builder,
+.goal-invite__form select#goal-direct-builder { flex: 1; min-width: 180px; }
+.goal-invite__form input#goal-invite-note { flex: 1; min-width: 180px; }
+
+/* task 1002886 — BOTH admission paths now say what they do, so both carry a
+   line of their own: the invite half promises nobody is added until they
+   accept, the force-add half admits nobody is asked. Muted, because this is
+   the consequence of the button beside it, not a warning. */
+.goal-invite__hint { margin: 4px 0 8px; font-size: 12.5px; color: var(--ink-faint); max-width: var(--measure); }
+/* The force-add is deliberately QUIETER than the invite it sits under — same
+   authority, but it is the path that skips consent, so it does not get equal
+   visual weight. It stays one click away, never hidden. */
+.goal-invite__more { background: none; border: 0; padding: 0; margin: 0 0 8px; cursor: pointer;
+  font: inherit; font-size: 12.5px; color: var(--ink-soft); text-decoration: underline; }
+.goal-invite__more:hover { color: var(--ink); }
+.goal-invite__direct { padding-top: 8px; border-top: var(--line) solid var(--rule-soft); }
 
 /* task 1953 — private goals: the lock badge (meta line) + the goal's own
    pending invite/join-request queue (manager view, next to the invite box). */

package/modules/hall-ui/public/idea.js

@@ -38,7 +38,7 @@
 (() => {
   'use strict';
 
-  const API = '/api/gds';
+  const API = '/api/bongos';
   // NO baseUrl OVERRIDE — this page calls the GENERATED namespaced methods
   // (api.inbox.*, api.me.*), whose path templates are API-RELATIVE ('/inbox/template').
   // baseUrl:'' means "these paths are already absolute" and passes them through

package/modules/hall-ui/public/md-reader.js

@@ -81,7 +81,7 @@
   //   - http(s):// or #anchor or mailto:/tel:  → unchanged
   //   - the diagrams dir                        → the in-hall diagrams route
   //   - everything else                         → GitHub blob/tree (bases fetched
-  //     from /api/gds/public/repo-info; null until then → pass through, 404s
+  //     from /api/bongos/public/repo-info; null until then → pass through, 404s
   //     harmlessly rather than crashing).
   // opts: { baseDir, getBlobBase, getTreeBase, diagramsHref }
   function makeResolveLinkHref(opts) {

package/modules/hall-ui/public/people.html

@@ -32,7 +32,7 @@
       <main id="hall-main">
         <!-- task 1003470: ONE directory. Its legacy door /scouting rendered this
              same page from the same script, and task 1003440 deleted it — the same
-             /api/gds/scouting rollup used to be drawn three different ways. -->
+             /api/bongos/scouting rollup used to be drawn three different ways. -->
         <section class="scroll" id="people-scroll" aria-labelledby="people-h">
           <h2 id="people-h" class="scroll__h">Builder directory<span class="count-pill" id="people-count" hidden></span></h2>
           <div id="people-filters"></div>

package/modules/hall-ui/public/people.js

@@ -2,7 +2,7 @@
 // 1002577; ADR 0141 §4 is the data's design of record), served at /people —
 // task 1003470 first made its legacy door /scouting render this same script,
 // and task 1003440 deleted that door (the URL 301s here), because the
-// same /api/gds/scouting rollup was being drawn three
+// same /api/bongos/scouting rollup was being drawn three
 // different ways (a kit ledger here, a hand-built table there, and the same
 // columns in a different order). The endpoint is gated server-side on
 // 'project.curate' OR being a project owner (R14, ADR 0210); this page is
@@ -233,7 +233,7 @@
     body.textContent = msg;
   }
 
-  fetch('/api/gds/scouting?limit=' + DIRECTORY_LIMIT, { headers: { Accept: 'application/json' } })
+  fetch('/api/bongos/scouting?limit=' + DIRECTORY_LIMIT, { headers: { Accept: 'application/json' } })
     .then(function (r) {
       if (r.status === 403 || r.status === 401) { throw { gated: true }; }
       if (!r.ok) throw new Error('http ' + r.status);