@bongos/core 1.19.804 → 1.19.806

package/modules/hall-ui/public/primer.js

@@ -5,7 +5,7 @@
 // inlines the five onboarding diagrams at matching sections, builds a TOC from
 // h2s with a scrollspy, drives a reading-progress hairline, and soft-gates the
 // footer ack button until the reader has scrolled past ~90% of the article.
-// Acking POSTs to /api/gds/builders/me/onboarding/primer-read (same endpoint
+// Acking POSTs to /api/bongos/builders/me/onboarding/primer-read (same endpoint
 // /builder-primer-read uses).
 //
 // ONE PARSER, TWO READERS (task 1003306). This file used to carry its own copy
@@ -20,7 +20,7 @@
 (() => {
   'use strict';
 
-  const API = '/api/gds';
+  const API = '/api/bongos';
   const ACK_SCROLL_THRESHOLD = 0.90; // 90% of article scrolled → button enables
   // The primer markdown lives at docs/onboarding/primer.md, so its relative
   // links resolve against docs/onboarding/.
@@ -30,7 +30,7 @@
   // URLs under these bases so the rendered links go somewhere useful instead of
   // 404-ing under /builders/*. The bases are NOT hardcoded here — that would
   // violate the V3.R12 (#236) authorship-attribution audit. They are fetched
-  // from /api/gds/public/repo-info at boot; the server derives owner/repo at
+  // from /api/bongos/public/repo-info at boot; the server derives owner/repo at
   // process start from `git remote get-url origin` (src/bongos/repo-info.js).
   // When they are unavailable the rewriter degrades gracefully: repo-relative
   // hrefs pass through unchanged and 404 instead of crashing the page.
@@ -372,7 +372,7 @@
   // gracefully degrades when the bases are null.
   async function loadRepoInfoBases() {
     try {
-      const r = await fetch('/api/gds/public/repo-info', { credentials: 'same-origin' });
+      const r = await fetch('/api/bongos/public/repo-info', { credentials: 'same-origin' });
       if (!r.ok) return;
       const data = await r.json();
       if (data && typeof data.blob_base === 'string') repoBlobBase = data.blob_base;

package/modules/hall-ui/public/roster.js

@@ -217,7 +217,7 @@
     rerender();
   }
 
-  fetch('/api/gds/leaderboard', { headers: { Accept: 'application/json' } })
+  fetch('/api/bongos/leaderboard', { headers: { Accept: 'application/json' } })
     .then(function (r) {
       if (!r.ok) throw new Error('http ' + r.status);
       return r.json();

package/modules/hall-ui/public/shell.js

@@ -263,7 +263,7 @@
       // modules/hall-ui/CLAUDE.md uses, but Builders is what a reader scans for.
       { id: 'roster', label: 'Builders', icon: 'leaderboard', href: '/roster', gate: 'signed' },
       // task 1002577: the cross-project builder directory (/scouting graduated
-      // into the hall). Gated to MATCH its data — /api/gds/scouting checks
+      // into the hall). Gated to MATCH its data — /api/bongos/scouting checks
       // `project.curate`, whose catalog floor is METIC. This read 'archon' until
       // task 1002710: the nav was stricter than the wall, so a Metic could open
       // /people by URL but never saw the link. Cosmetic either way —

package/modules/hall-ui/public/task.js

@@ -15,7 +15,7 @@
 (() => {
   'use strict';
 
-  const API = '/api/gds';
+  const API = '/api/bongos';
   // Generated typed client (task 1996 / R09), served as window.BongosClient by
   // /lib/bongos-client.js. baseUrl:'' passes the full same-origin paths this file
   // builds through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.

package/modules/ideas/inbox.js

@@ -36,7 +36,7 @@ const VALID_KINDS = [
   'unclassified',
   // V3.R31 (#252) — Metics propose new version criteria via idea_inbox with
   // structured body_md { target_version, criterion_md, sort_order_hint }.
-  // Archon ratifies via POST /api/gds/inbox/:id/ratify, which atomically
+  // Archon ratifies via POST /api/bongos/inbox/:id/ratify, which atomically
   // inserts a done_when_criteria row, marks the idea promoted, awards karma,
   // and writes a criterion_proposal_audit row. The kind value gates the
   // ratify endpoint (assert kind='criterion-proposal' before promotion).
@@ -1222,7 +1222,7 @@ async function getIdeaGrade(ideaId) {
 // the proposer (delta=+3, reason='proposal_ratified'), and writes an audit
 // row capturing who proposed / who ratified / when / what.
 //
-// Called by POST /api/gds/inbox/:id/ratify (Archon-only, gated by requireRank
+// Called by POST /api/bongos/inbox/:id/ratify (Archon-only, gated by requireRank
 // in the router). The body_md of the source idea is parsed as JSON with the
 // shape { target_version, criterion_md, sort_order_hint }; malformed bodies
 // throw BAD_BODY so the route can return a structured 400.

package/modules/lifecycle/db-analytics.js

@@ -500,7 +500,7 @@ async function ecosystemAnalytics(days = 90) {
 // The writing middleware (src/bongos/middleware/audit.js) calls insertAuditLog
 // AFTER the response has been sent, wrapped in try/catch — so the request
 // path never blocks on this insert and a DB failure here can never break a
-// real user request. The reader is the archon-only GET /api/gds/audit-log
+// real user request. The reader is the archon-only GET /api/bongos/audit-log
 // endpoint backed by listAuditLog below (paginated, newest-first).
 // -------------------------------------------------------------------------
 

package/modules/lifecycle/done-when.js

@@ -19,9 +19,9 @@
 //
 // Wired in via modules/lifecycle/routes/done-when.js (the loader mounts it,
 // BV1.R86). Three endpoints:
-//   GET  /api/gds/versions/:id/done-when                — public, 60s cache
-//   POST /api/gds/done-when/:criterionId/satisfy        — auth
-//   POST /api/gds/done-when/:criterionId/unsatisfy      — auth
+//   GET  /api/bongos/versions/:id/done-when                — public, 60s cache
+//   POST /api/bongos/done-when/:criterionId/satisfy        — auth
+//   POST /api/bongos/done-when/:criterionId/unsatisfy      — auth
 
 const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
@@ -165,7 +165,7 @@ async function listPendingReviewCriteria({ versionId = null } = {}, deps = {}) {
 
 // Roll up every criterion for a version together with the tasks that gate it
 // (via the task_criteria join table, migration 055) and a status breakdown.
-// This is the read behind GET /api/gds/versions/:id/progress and the /status
+// This is the read behind GET /api/bongos/versions/:id/progress and the /status
 // skill — it answers "what's left for criterion Cn?" in one query instead of
 // the ~10-call prose archaeology that motivated #435.
 //

package/modules/lifecycle/version-close.js

@@ -88,7 +88,7 @@ async function suggestClose(versionId) {
 }
 
 // Suggestions for every version still in 'building' status.
-// Used by GET /api/gds/versions/close-suggestions and by /builder-start.
+// Used by GET /api/bongos/versions/close-suggestions and by /builder-start.
 async function getCloseSuggestionsForBuildingVersions() {
   const { rows: versions } = await pool.query(
     `SELECT id FROM versions WHERE status = 'building' ORDER BY started_at, id`

package/modules/memory/learnings.js

@@ -9,7 +9,7 @@
 //   indexes: GIN(tags), GIN(related_files),
 //            UNIQUE(source, source_ref) WHERE non-null
 //
-// Wired into routes by src/bongos/routes.js (POST + GET /api/gds/learnings).
+// Wired into routes by src/bongos/routes.js (POST + GET /api/bongos/learnings).
 
 // Carved into modules/memory/ (BV1.R72 / ADR 0091 §2): pool via the doorway.
 const crypto = require('crypto');
@@ -178,7 +178,7 @@ async function findLearningsByTags(tags, { limit = 50 } = {}) {
 //
 // Consumers:
 //   - scripts/gds/claim.js calls this indirectly via
-//     GET /api/gds/learnings?touches=a,b,c so /builder-claim N can surface
+//     GET /api/bongos/learnings?touches=a,b,c so /builder-claim N can surface
 //     up to 3 most-recent relevant learnings right after a successful claim.
 //     Query overhead is bounded by the GIN(tags) + GIN(related_files) indexes
 //     declared in migration 006_pms_v2.sql (<50ms target).

package/modules/memory/memory.js

@@ -494,7 +494,7 @@ async function bfgWriteMemoryFile({ targetBuilderId, path, content, audit, karma
        RETURNING id, recorded_at`,
       [
         a.principalId ?? null,
-        a.route ?? '/api/gds/memory/builders/:builderId/bfg-write',
+        a.route ?? '/api/bongos/memory/builders/:builderId/bfg-write',
         {
           action: a.action || 'bfg_dream_write',
           http_method: 'POST',

package/modules/onboarding/onboarding.js

@@ -429,7 +429,7 @@ function shortSession(sessionId) {
   return String(sessionId).slice(0, 8);
 }
 
-// Build the { title, body_md, kind } payload for POST /api/gds/inbox. The
+// Build the { title, body_md, kind } payload for POST /api/bongos/inbox. The
 // title carries ONBOARDING_FRICTION_TAG so triage (and the future kind
 // migration) can find these rows; the body holds the subagent summary, each
 // friction moment, and the deterministic signals as an audit trail.

package/modules/platform-identity/routes/my-projects.js

@@ -177,7 +177,7 @@ module.exports = function myProjectsRoutes() {
       // the registry-trusted origin, never the caller's raw input.
       let outcome = null;
       try {
-        const r = await fetch(`${client.origin}/api/gds/access-requests`, {
+        const r = await fetch(`${client.origin}/api/bongos/access-requests`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
           body: JSON.stringify({

package/modules/platform-identity/routes/sso.js

@@ -120,7 +120,7 @@ async function notifyInstanceLogout(membership, githubId) {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), SLO_TIMEOUT_MS);
     try {
-      const resp = await fetch(`${origin}/api/gds/auth/backchannel-logout`, {
+      const resp = await fetch(`${origin}/api/bongos/auth/backchannel-logout`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
         body: JSON.stringify({ logout_token: token }),
@@ -260,7 +260,7 @@ module.exports = function ssoRoutes() {
     const usable = pi.sessionUsableForFederation(session);
     if (!usable.ok) {
       if (usable.reason === 'no_session') {
-        return res.redirect(302, `/api/gds/auth/web/start?return=${encodeURIComponent(req.originalUrl)}`);
+        return res.redirect(302, `/api/bongos/auth/web/start?return=${encodeURIComponent(req.originalUrl)}`);
       }
       const msg = usable.reason === 'inactive'
         ? 'This account is no longer active. Ask an Archon on the hub if you believe this is an error.'

package/modules/public-landing/public/index.html

@@ -632,7 +632,7 @@ baked apex number sits inside apex-only sentinels so a child instance shows an e
 its own feed answers):
   data-ledger="line"  = the first progress row whose status is building (else the first row), read
                         as "<shipped> of <total> shipped on <V>"; data-ledger="meter" is that ratio.
-  data-rows           = /api/gds/public/recent-shipped?limit=6. Titles are quoted data: an em or en
+  data-rows           = /api/bongos/public/recent-shipped?limit=6. Titles are quoted data: an em or en
                         dash becomes a comma and a trailing parenthetical is dropped at render time.
                         A child instance with no ledger yet answers {tasks:[]}, so the meter, the
                         sub-line and the list collapse rather than promise six rows that never
@@ -910,7 +910,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 <script>
 (function () {
   var API = '/api/bongos';
-  var API_ROOT = '/api/gds';
+  var API_ROOT = '/api/bongos';
 
   /* ── the tagline. It is ONE server-stamped string, but the composition wants it
      on two lines, so the two halves are baked as separate spans. A host whose

package/modules/public-landing/public/projects-floor.states.json

@@ -16,7 +16,7 @@
     "/my-projects",
     "/provisioning/instances/999",
     "/provisioning/instances/101$",
-    "/api/gds/instance$"
+    "/api/bongos/instance$"
   ],
   "ignoreConsole": [
     "/api/(gds|bongos)/me",

package/modules/public-landing/public/projects.html

@@ -6181,7 +6181,7 @@ summary{min-height:24px;padding:3px 0;}
     manifestFor = manageId;
     var ctl = typeof AbortController === 'function' ? new AbortController() : null;
     var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
-    manifestPromise = fetch('https://' + domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
+    manifestPromise = fetch('https://' + domain + '/api/bongos/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
       .then(function (res) {
         /* a project that ANSWERED but refused (its own pre-launch gate, a proxy
            error page) is not an older core — carry the status, don't guess */

package/modules/public-landing/public/projects.states.json

@@ -4,7 +4,7 @@
   "surface": "public-landing",
   "modes": ["dark"],
   "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/provisioning/instances/999", "/provisioning/instances/101$", "/api/gds/instance$", "/github/repos$", "/provisioning/onboard-plan"],
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/provisioning/instances/999", "/provisioning/instances/101$", "/api/bongos/instance$", "/github/repos$", "/provisioning/onboard-plan"],
   "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "\\b404\\b", "Unauthorized"],
   "ignoreControls": [".skip", ".vh"],
   "states": {

package/modules/sessions/db.js

@@ -24,6 +24,10 @@
 
 const api = require('../../src/module-api');
 const { pool } = api;
+// The PURE verdict + every clamp and threshold (task 1003865). The module's own
+// file, not the doorway: it touches no kernel surface, and keeping the numbers
+// in one place is what stops the route and the poller disagreeing.
+const uploadHealth = require('./upload-health');
 // `seams` is the doorway's kernel-mediated seam surface (resolveOptional/resolve).
 // upsertSessionRecordWithReward resolves the economy `reward` port through it —
 // the module↔module seam, never a sibling-module require (BV1.R77 / ADR 0093 §2).
@@ -656,6 +660,118 @@ async function filterTaskIdsClaimedBy(builderId, taskIds) {
   return rows.map((r) => Number(r.task_id));
 }
 
+
+
+// -------------------------------------------------------------------------
+// Session-upload health (task 1003865) — is the corpus still being written?
+// -------------------------------------------------------------------------
+//
+// THE SIGNAL. The server already knows both halves independently: a task reached
+// status='shipped', and whether that task's builder uploaded any session around
+// then. A ship with no session record for its builder inside a window is the unit
+// of evidence. Before this, the ONLY trace of a skipped upload was a jsonl file on
+// the builder's own laptop, so a weeks-long outage that stopped every cost-plus
+// reward from booking was invisible from the server.
+//
+// GROUPED BY BUILDER, which is the entire design and is measured, not assumed —
+// see ../upload-health for the numbers. The corpus-wide share cannot see the
+// outage (3.4% in its worst month, against 1.7-2.0% in healthy ones); per builder
+// the same data fires on 13 days, all inside the outage window, all one builder.
+//
+// KEYED ON builder_id + TIME, NEVER ON task_ids. session_records.task_ids is
+// EMPTY on 54% of rows (1,771 of 3,873 when task 1002448 measured it), so the
+// obvious predicate — "no session record NAMES this task" — reports the linkage
+// gap as an outage. Neither query below mentions task_ids, and a test asserts
+// that about the SQL these functions actually emit.
+//
+// Every threshold and clamp lives in ../upload-health (PURE, unit-tested), so the
+// route and the poller cannot answer this question two different ways.
+
+// sessionUploadCoverage — per-BUILDER ship counts over the lookback, and how many
+// of those ships had NO session record for that builder inside the window. One
+// query, server-side, deliberately: /sessions/search is rate-limited per builder
+// and clamps limit to 100, so paging the corpus from a client to compute this is
+// neither cheap nor reliable (measured while scoping this task — 45 pages, with
+// 429s).
+async function sessionUploadCoverage({ days, windowHours } = {}) {
+  const d = uploadHealth.clampLookbackDays(days);
+  const w = uploadHealth.clampWindowHours(windowHours);
+  const { rows } = await pool.query(
+    `SELECT t.shipped_by AS builder_id,
+            b.github_login,
+            COUNT(*)::int AS ships,
+            COUNT(*) FILTER (
+              WHERE NOT EXISTS (
+                SELECT 1
+                  FROM session_records sr
+                 WHERE sr.builder_id = t.shipped_by
+                   AND sr.uploaded_at >= t.shipped_at - ($2 * interval '1 hour')
+                   AND sr.uploaded_at <= t.shipped_at + ($2 * interval '1 hour')
+              )
+            )::int AS uncovered
+       FROM tasks t
+       JOIN builders b ON b.id = t.shipped_by
+      WHERE t.status = 'shipped'
+        AND t.shipped_by IS NOT NULL
+        AND t.shipped_at IS NOT NULL
+        AND t.shipped_at >= now() - ($1 * interval '1 day')
+      GROUP BY t.shipped_by, b.github_login
+      ORDER BY 4 DESC`,
+    [d, w]
+  );
+  return { days: d, windowHours: w, rows };
+}
+
+// shipsMissingSessionRecord — the offending ships themselves, newest first. The
+// verdict says how bad and whose; this says WHICH, because recovering the unpaid
+// work needs the task ids and a percentage does not carry them. Bounded by
+// clampSampleLimit: evidence, not a report.
+async function shipsMissingSessionRecord({ days, windowHours, limit, builderId } = {}) {
+  const d = uploadHealth.clampLookbackDays(days);
+  const w = uploadHealth.clampWindowHours(windowHours);
+  const n = uploadHealth.clampSampleLimit(limit);
+  const b = Number.isFinite(Number(builderId)) ? Number(builderId) : null;
+  const { rows } = await pool.query(
+    `SELECT t.id, t.title, t.shipped_by, b.github_login, t.shipped_at
+       FROM tasks t
+       JOIN builders b ON b.id = t.shipped_by
+      WHERE t.status = 'shipped'
+        AND t.shipped_by IS NOT NULL
+        AND t.shipped_at IS NOT NULL
+        AND t.shipped_at >= now() - ($1 * interval '1 day')
+        AND ($3::bigint IS NULL OR t.shipped_by = $3)
+        AND NOT EXISTS (
+          SELECT 1
+            FROM session_records sr
+           WHERE sr.builder_id = t.shipped_by
+             AND sr.uploaded_at >= t.shipped_at - ($2 * interval '1 hour')
+             AND sr.uploaded_at <= t.shipped_at + ($2 * interval '1 hour')
+        )
+      ORDER BY t.shipped_at DESC
+      LIMIT ${n}`,
+    [d, w, b]
+  );
+  return rows;
+}
+
+// sessionUploadHealth — the whole answer in one call: the verdict, the per-builder
+// counts behind it, and a sample of the ships it is counting. The route serves
+// this and the poller logs from it, so neither owns the arithmetic. The sample is
+// skipped entirely when nothing is uncovered — the healthy path costs one query.
+async function sessionUploadHealth({ days, windowHours, sampleLimit } = {}) {
+  const coverage = await sessionUploadCoverage({ days, windowHours });
+  const verdict = uploadHealth.uploadHealthVerdict(coverage.rows);
+  const sample = verdict.uncovered > 0
+    ? await shipsMissingSessionRecord({ days, windowHours, limit: sampleLimit })
+    : [];
+  return {
+    days: coverage.days,
+    window_hours: coverage.windowHours,
+    verdict,
+    sample,
+  };
+}
+
 module.exports = {
   // write side (6D.1)
   upsertSessionRecord,
@@ -667,6 +783,10 @@ module.exports = {
   // search + fetch (6D.2)
   searchSessions,
   summarizeSessions,
+  // upload health (task 1003865) — is the corpus still being written at all?
+  sessionUploadCoverage,
+  shipsMissingSessionRecord,
+  sessionUploadHealth,
   getSessionById,
   listSessionsByBuilder,
   filterTaskIdsClaimedBy,

package/modules/sessions/module.json

@@ -1,11 +1,11 @@
 {
   "key": "sessions",
   "title": "Sessions & BFG (session corpus · efficiency eval)",
-  "description": "The session-records corpus + its data plane (POST /sessions upload, the Archon-gated cross-builder /sessions/search + /sessions/:id deep-dive), the BFG 'read-the-room' cross-builder scorer (ADR 0026 §6B), and the session-pulse / stale-claim heartbeat helpers. A core-domain module carved out of the GDS core in BV1.R82 (ADR 0093 §1); default-on because every instance records its builders' sessions for the BFG. Like the memory module, sessions registers no port — core never calls back into it: the ship-time digest write is an HTTP POST to the module's own /sessions route, and the only outward dependency is the economy `reward` kernel PORT it resolves (session token reward + sumCreditsForTasks) at upload time.",
+  "description": "The session-records corpus + its data plane (POST /sessions upload, the Archon-gated cross-builder /sessions/search + /sessions/:id deep-dive + /sessions/upload-health, the server-side signal that a builder's session uploads have silently stopped), the BFG 'read-the-room' cross-builder scorer (ADR 0026 §6B), and the session-pulse / stale-claim heartbeat helpers. A core-domain module carved out of the GDS core in BV1.R82 (ADR 0093 §1); default-on because every instance records its builders' sessions for the BFG. Like the memory module, sessions registers no port — core never calls back into it: the ship-time digest write is an HTTP POST to the module's own /sessions route, and the only outward dependency is the economy `reward` kernel PORT it resolves (session token reward + sumCreditsForTasks) at upload time.",
   "coreVersion": "^1.10.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["sessions"], "pollers": ["session-reward-reconcile"] },
+  "contributes": { "routes": ["sessions"], "pollers": ["session-reward-reconcile", "session-upload-health"] },
   "provides": [],
   "consumes": []
 }

package/modules/sessions/pollers/session-upload-health.js

@@ -0,0 +1,111 @@
+'use strict';
+
+// modules/sessions/pollers/session-upload-health.js — the half of task 1003865
+// that makes the signal NOTICE rather than merely be answerable.
+//
+// GET /sessions/upload-health makes the outage visible to anyone who asks. Nobody
+// asked for weeks, which is the whole incident: the failure mode is silence, and a
+// number you have to go and look at is silent too. So this sweep asks on a
+// schedule and writes the answer where the server's own operator surface already
+// is — the process log, beside the reward reconciler's lines, which is what a
+// journalctl over this unit is read for.
+//
+// SEPARATE FROM session-reward-reconcile ON PURPOSE. That poller MOVES MONEY; this
+// one only reports. Folding telemetry into the payout sweep would let a bad read
+// here delay or crash a booking there, and the two want different cadences —
+// reward recovery wants minutes, a 14-day coverage ratio does not change in ten.
+//
+// It writes nothing and books nothing. A check that could itself change state
+// would need its own safety argument; this one needs none.
+
+const db = require('../db');
+const uploadHealth = require('../upload-health');
+// The doorway's namespaced structured logger (task 1003130), not console: this
+// module reaches the kernel only through module-api, and console.* in a server
+// path is the count the fitness ratchet exists to shrink, not to grow.
+const api = require('../../../src/module-api');
+const log = api.logger('sessions');
+
+// Hourly. The measurement behind the thresholds used a 14-day lookback stepped
+// daily, so anything under a day is already far finer than the signal; hourly is
+// chosen so a fresh outage surfaces within the same working session rather than
+// the next morning.
+const INTERVAL_MS = Number(process.env.SESSION_UPLOAD_HEALTH_MS) || 60 * 60_000;
+const FIRST_SWEEP_DELAY_MS = Number(process.env.SESSION_UPLOAD_HEALTH_FIRST_MS) || 120_000;
+
+let intervalTimer = null;
+let firstTimer = null;
+
+// logLinesFor — PURE, so the wording is pinned by a DB-free test. A log line that
+// says "unhealthy" and no more is the same silence with a timestamp on it: the
+// firing line has to name the builder, the arithmetic, and where to look next,
+// because the person reading it at 2am did not scope this task.
+function logLinesFor(health) {
+  const v = (health && health.verdict) || {};
+  const where = `GET /api/gds/sessions/upload-health?days=${health && health.days}`;
+  if (!v.firing) {
+    return [`[session-upload-health] ${v.status || 'unknown'} — ${v.reason || 'no reason given'}`];
+  }
+  const lines = [
+    `[session-upload-health] ALERT — ${v.reason}`,
+    `[session-upload-health]   a missing session record means no session.token_reward booked (ADR 0146: cost-plus is the only reward stream), so this is unpaid shipped work, not just missing telemetry.`,
+    `[session-upload-health]   look: ${where}  ·  likely cause: the upload skipping client-side (session-upload-skips.jsonl on that builder's machine).`,
+  ];
+  const sample = Array.isArray(health.sample) ? health.sample.slice(0, 5) : [];
+  if (sample.length > 0) {
+    lines.push(`[session-upload-health]   uncovered ships, newest first: ${sample.map((s) => `#${s.id}`).join(' ')}`);
+  }
+  return lines;
+}
+
+async function runSweep() {
+  const health = await db.sessionUploadHealth({
+    days: uploadHealth.DEFAULT_LOOKBACK_DAYS,
+    windowHours: uploadHealth.DEFAULT_WINDOW_HOURS,
+  });
+  const lines = logLinesFor(health);
+  // A firing sweep goes out at ERROR so it survives a level filter set to hide
+  // the hourly all-clear — the whole failure mode here is a signal nobody saw.
+  const write = health.verdict && health.verdict.firing ? log.error : log.info;
+  for (const line of lines) write(line);
+  return health;
+}
+
+// Start the periodic sweep. Idempotent (a second call is a no-op). Kill-switched
+// by SESSION_UPLOAD_HEALTH_DISABLED=1. Timers are unref'd so they never hold the
+// process open on a systemd restart (the session-reward-reconcile precedent).
+function start() {
+  if (process.env.SESSION_UPLOAD_HEALTH_DISABLED === '1') {
+    log.info('[session-upload-health] disabled (SESSION_UPLOAD_HEALTH_DISABLED=1)');
+    return;
+  }
+  if (intervalTimer) return; // already started
+
+  const tick = () => {
+    runSweep().catch((e) =>
+      log.error(e, '[session-upload-health] sweep crashed')
+    );
+  };
+
+  firstTimer = setTimeout(tick, FIRST_SWEEP_DELAY_MS);
+  if (firstTimer.unref) firstTimer.unref();
+  intervalTimer = setInterval(tick, INTERVAL_MS);
+  if (intervalTimer.unref) intervalTimer.unref();
+
+  log.info(
+    `[session-upload-health] started — checking session-upload coverage every ${Math.round(INTERVAL_MS / 60_000)}m`
+  );
+}
+
+function stop() {
+  if (firstTimer) {
+    clearTimeout(firstTimer);
+    firstTimer = null;
+  }
+  if (intervalTimer) {
+    clearInterval(intervalTimer);
+    intervalTimer = null;
+  }
+}
+
+module.exports = { start, stop, runSweep, logLinesFor, INTERVAL_MS };

package/modules/sessions/pulse.js

@@ -21,7 +21,7 @@
 //    rows as data; a follow-up task is expected to add the marker
 //    column + UPDATE write + builder surface in /builder-start.
 //
-// 2. POST /api/gds/pulse route is NOT wired here — routes.js is out
+// 2. POST /api/bongos/pulse route is NOT wired here — routes.js is out
 //    of touches[]. recordPulse() is exported for whichever future
 //    request handler is created. The CLI shell at scripts/gds/pulse.js
 //    posts to the intended endpoint and will start working once the
@@ -29,7 +29,7 @@
 //
 // Follow-up work (file new tasks when picked up):
 //   a) New migration adding claims.pulse_lost_at timestamptz.
-//   b) Route: POST /api/gds/pulse → recordPulse() (auth + claim
+//   b) Route: POST /api/bongos/pulse → recordPulse() (auth + claim
 //      ownership check).
 //   c) sweepStaleClaims() side-effect: UPDATE claims
 //      SET pulse_lost_at = now() WHERE id = ANY(...).

package/modules/sessions/routes/sessions.js

@@ -6,6 +6,11 @@
 //   POST /sessions          — upload your OWN session digest (6D.1). Owner is
 //                             forced to the caller; body builder_id is ignored.
 //   GET  /sessions/mine     — your own sessions (self-serve summary list).
+//   GET  /sessions/upload-health
+//                           — is the corpus still being written? Ships whose
+//                             builder uploaded no session around them, per
+//                             builder (task 1003865). Same cross-builder gate +
+//                             audit as /search, because it reads the same corpus.
 //   GET  /sessions/search   — cross-builder search over session + builder facets
 //                             (rank/karma/drachmae/tenure). Archon-gated +
 //                             audited (the BFG principal posture until 6C.1).
@@ -36,6 +41,11 @@ const db = require('../db');
 // the interaction profile as data precisely so it does not have to require
 // builder-settings, which ADR 0083 forbids.
 const { scoreAccessibility } = require('../accessibility');
+// The PURE clamps behind /sessions/upload-health. The route audits the values it
+// will actually query with, not the raw query string — an audit row naming
+// `days=99999` for a read that ran at 365 is a record of something that did not
+// happen (task 1003865).
+const uploadHealth = require('../upload-health');
 const seams = api; // resolveOptional('reward' | 'builder-settings') — kernel-mediated ports
 const { validateOrRespond, parseId } = api;
 
@@ -358,6 +368,42 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // GET /sessions/upload-health — the answer to "has anyone's session upload
+  // silently stopped?", which before task 1003865 existed ONLY as a jsonl file on
+  // the builder's own laptop. A skipped upload means no session_records row, which
+  // means the ADR 0146 cost-plus reward never books — a builder earning nothing for
+  // work that shipped, invisible from here.
+  //
+  // Read-only and side-effect-free, so it is DELIBERATELY not a new permission:
+  // it reads the same corpus /sessions/search reads, for the same cross-builder
+  // audience, so it rides the same `session.search` gate and writes the same
+  // fail-closed audit row. A new permission would be a new thing to grant before
+  // anyone could look at a number that already exists.
+  router.get('/sessions/upload-health', auth.requireBuilder, auth.requirePermission('session.search'), readRateLimit, async (req, res) => {
+    const q = req.query || {};
+    try {
+      // Audit BEFORE the query, like /search: no cross-builder read without a
+      // durable record of who asked.
+      await recordSessionRead(req, {
+        route: '/api/bongos/sessions/upload-health',
+        targetBuilderId: null,
+        target: `upload-health days=${uploadHealth.clampLookbackDays(q.days)} window_hours=${uploadHealth.clampWindowHours(q.window_hours)}`,
+      });
+      const health = await db.sessionUploadHealth({
+        days: q.days,
+        windowHours: q.window_hours,
+        sampleLimit: q.sample_limit,
+      });
+      res.json(health);
+    } catch (err) {
+      // The namespaced structured logger, not console — see the poller's note.
+      // Its siblings above still use console because they predate task 1003130;
+      // new call sites do not add to the count the ratchet exists to shrink.
+      api.logger('sessions').error(err, 'GET /sessions/upload-health failed');
+      res.fail('upload_health_failed', 500);
+    }
+  });
+
   // rank: any-builder — your OWN sessions (self-serve; no audit needed).
   router.get('/sessions/mine', auth.requireBuilder, readRateLimit, async (req, res) => {
     try {