@bongos/core 1.19.818 → 1.19.820

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1863,
-    "unique_ids": 1617,
-    "certain": 1863,
+    "strings": 1868,
+    "unique_ids": 1622,
+    "certain": 1868,
     "heuristic": 0,
     "duplicate_ids": 170
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 86,
-      "strings": 1373
+      "strings": 1378
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -730,8 +730,8 @@
       "text": "Could not load sessions.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/sessions.js:275",
-        "modules/hall-ui/public/sessions.js:313"
+        "modules/hall-ui/public/sessions.js:399",
+        "modules/hall-ui/public/sessions.js:437"
       ]
     },
     {
@@ -1480,8 +1480,8 @@
       "text": "The session log could not be loaded. Try again.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/sessions.js:274",
-        "modules/hall-ui/public/sessions.js:326"
+        "modules/hall-ui/public/sessions.js:398",
+        "modules/hall-ui/public/sessions.js:450"
       ]
     },
     {
@@ -2491,6 +2491,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "e08d410571e9",
+      "surface": "builders-hall",
+      "text": "All kinds",
+      "file": "modules/hall-ui/public/sessions.js",
+      "line": 286,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "9c34bccb06ef",
       "surface": "builders-hall",
@@ -3954,7 +3963,7 @@
       "surface": "builders-hall",
       "text": "Could not load sessions.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 275,
+      "line": 399,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -3963,7 +3972,7 @@
       "surface": "builders-hall",
       "text": "Could not load sessions.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 313,
+      "line": 437,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4395,7 +4404,7 @@
       "surface": "builders-hall",
       "text": "Could not verify your access. Try again.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 312,
+      "line": 436,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5119,6 +5128,15 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
+    {
+      "id": "e8dd9a8f3a7e",
+      "surface": "builders-hall",
+      "text": "Filter sessions by kind",
+      "file": "modules/hall-ui/public/sessions.html",
+      "line": 67,
+      "origin": "html-attr:aria-label",
+      "confidence": "certain"
+    },
     {
       "id": "1def0e7c716e",
       "surface": "builders-hall",
@@ -5700,7 +5718,7 @@
       "surface": "builders-hall",
       "text": "How the session read to this builder, scored against their own interaction profile. Advisory — it gates nothing.",
       "file": "modules/hall-ui/public/sessions.html",
-      "line": 63,
+      "line": 78,
       "origin": "html-attr:title",
       "confidence": "certain"
     },
@@ -6735,7 +6753,7 @@
       "surface": "builders-hall",
       "text": "Most recent first. Each load of this page is itself recorded in the audit log.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 228,
+      "line": 340,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7104,7 +7122,7 @@
       "surface": "builders-hall",
       "text": "No sessions recorded yet. They land here as builders ship and end sessions.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 109,
+      "line": 146,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7162,6 +7180,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "086665af6208",
+      "surface": "builders-hall",
+      "text": "No {…} sessions recorded. Choose another kind to widen the ledger.",
+      "file": "modules/hall-ui/public/sessions.js",
+      "line": 145,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "1967d2176f2e",
       "surface": "builders-hall",
@@ -7230,7 +7257,7 @@
       "surface": "builders-hall",
       "text": "Not scored — this builder’s own profile waived every signal, or the session predates this measure.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 67,
+      "line": 100,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7261,6 +7288,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "20bb29015a84",
+      "surface": "builders-hall",
+      "text": "Not yet classified.",
+      "file": "modules/hall-ui/public/sessions.js",
+      "line": 72,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "571b9b22dbda",
       "surface": "builders-hall",
@@ -7869,7 +7905,7 @@
       "surface": "builders-hall",
       "text": "Plain speech",
       "file": "modules/hall-ui/public/sessions.html",
-      "line": 63,
+      "line": 78,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -10209,7 +10245,7 @@
       "surface": "builders-hall",
       "text": "The session log could not be loaded. Try again.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 274,
+      "line": 398,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10218,7 +10254,7 @@
       "surface": "builders-hall",
       "text": "The session log could not be loaded. Try again.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 326,
+      "line": 450,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10731,7 +10767,7 @@
       "surface": "builders-hall",
       "text": "Tool errors",
       "file": "modules/hall-ui/public/sessions.html",
-      "line": 61,
+      "line": 76,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -11068,6 +11104,15 @@
       "origin": "html-attr:placeholder",
       "confidence": "certain"
     },
+    {
+      "id": "e179870922a3",
+      "surface": "builders-hall",
+      "text": "What the session did, derived from its own transcript: whether it wrote files, used tools, and how many prompts a person actually sent.",
+      "file": "modules/hall-ui/public/sessions.html",
+      "line": 74,
+      "origin": "html-attr:title",
+      "confidence": "certain"
+    },
     {
       "id": "5f2b989bbf6a",
       "surface": "builders-hall",
@@ -13395,7 +13440,7 @@
       "surface": "builders-hall",
       "text": "{…} and up",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 149,
+      "line": 187,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -13404,7 +13449,7 @@
       "surface": "builders-hall",
       "text": "{…} and up.",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 147,
+      "line": 185,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -13579,15 +13624,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "3d76dce19c4a",
-      "surface": "builders-hall",
-      "text": "{…} session{…} across {…} builder{…}.",
-      "file": "modules/hall-ui/public/sessions.js",
-      "line": 226,
-      "origin": "js-text-assign",
-      "confidence": "certain"
-    },
     {
       "id": "e08fa22622f0",
       "surface": "builders-hall",
@@ -13629,7 +13665,7 @@
       "surface": "builders-hall",
       "text": "{…} tokens",
       "file": "modules/hall-ui/public/sessions.js",
-      "line": 132,
+      "line": 170,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13840,6 +13876,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "97e27ab169ae",
+      "surface": "builders-hall",
+      "text": "{…}{…} session{…} across {…} builder{…}.",
+      "file": "modules/hall-ui/public/sessions.js",
+      "line": 338,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "3d74668f69e5",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -2110,5 +2110,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.816 with no explicit bump. run 35200401779. (task 1002620)
   1.19.818 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.817 with no explicit bump. run 35201213516. (task 1002620)
+  1.19.819 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.818 with no explicit bump. run 35206448426. (task 1002620)
+  1.19.820 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.819 with no explicit bump. run 35209838815. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/gds-db-backup.md

@@ -242,6 +242,52 @@ curl -s https://example.com/api/gds/healthz
 curl -s https://example.com/api/gds/public/progress | jq '.progress[0]'
 ```
 
+## Bug attachments — the state that is not in the database (task 1003918)
+
+The nightly dump is not the whole of this instance. Re-hosted `#bugs` screenshots
+live on disk under `var/bug-attachments`, outside Postgres and outside git, and they
+are the one artefact here that **cannot be regenerated**: the Discord CDN URL each was
+copied from is signed and expires in about a day, so our copy *is* the image.
+
+Nothing backed them up until this task. All five this instance had ever stored were
+lost in the 2026-07-05 droplet move (ADR 0126) — `pg_dump` carried the database and
+nothing carried `var/` — and the loss surfaced two months later, when somebody opened
+an old bug task and saw a broken image.
+
+Two things changed, and one thing is still on you:
+
+1. **The nightly job archives them.** `db-backup-nightly.sh` now writes
+   `<db>-attachments-<TS>.tar.gz` beside the dump, same timestamp and same retention,
+   so a restore drill that picks a date gets the database and the images that go with
+   it. Best-effort: a missing or empty attachments dir is the ordinary case on a fresh
+   instance and never fails a night of database backup.
+
+2. **The default store follows the instance, not the package.** It resolves against the
+   instance root, so an instance running a vendored core no longer keeps these files
+   inside `node_modules/@bongos/core/var`, where every core reinstall would wipe them.
+
+3. **On a box where the instance root is itself impermanent, set `BUG_ATTACHMENTS_DIR`**
+   to a persistent path (e.g. `/srv/<instance>/bug-attachments`) in the service
+   environment, and make sure that path is on the volume your backups actually cover.
+   The override wins over everything above.
+
+### Checking
+
+```bash
+node scripts/gds/bug-attachment-audit.js
+```
+
+Reads every bug task's description, extracts the attachment links it promises a reader,
+and asks the disk whether it can keep them. Exits 1 when any are missing and names the
+task each broken image sits in. `--json` for a machine, `--line` for a one-line probe
+that never blocks a session.
+
+A missing file cannot be re-fetched. Restore it from an attachments archive:
+
+```bash
+tar -xzf /var/backups/gds/<db>-attachments-<TS>.tar.gz -C "$BUG_ATTACHMENTS_DIR"
+```
+
 ## Limits — what this recipe does NOT cover
 
 1. **Whole-droplet loss window is ~1 week, not zero.** The weekly offsite copy ([#415](https://example.com/builders#/task/415), above) closes the catastrophic-loss gap, but it runs weekly — so in the worst case (droplet dies right before the weekly run) you lose up to ~7 days of writes that made it into the local daily dumps but not yet offsite. Acceptable for the Bongos DB's shape; tighten the offsite cadence to daily if that ever stops being true.

package/migrations/core_246_session_type.sql

@@ -0,0 +1,49 @@
+-- core_246_session_type.sql — WHAT EACH SESSION WAS (task 1003975, idea 1001033).
+--
+-- The session ledger could say whether a session shipped a task and nothing else,
+-- so the 54% of the corpus with an empty task_ids read as an undifferentiated
+-- column of dashes. This column holds the verdict of modules/sessions/session-type.js
+-- — a pure, deterministic read of the digest the session already uploaded (its
+-- prompt count and which tools it called), computed once at upload rather than on
+-- every query, because the write-tool signal lives in the `detail` jsonb and
+-- scanning it per request would put a jsonb walk on the ledger's hot path.
+--
+-- WHY IT IS HERE AND NOT IN modules/sessions/migrations/. The sessions module's
+-- own CLAUDE.md says a new session migration belongs in the module — but that
+-- holds only for a table the module OWNS. `session_records` predates the module
+-- system and lives in core, and ADR 0083 §Decision #5 (enforced by fitness.js,
+-- "module migrations additive + namespaced") lets a module migration touch only
+-- its own `sessions_`-prefixed tables. A module migration adding this column was
+-- written first and the gate refused it, correctly. The rule wins; the module doc
+-- has been narrowed to say so.
+--
+-- NULLABLE ON PURPOSE, and there is no DEFAULT. Three reasons:
+--   * Every row that predates this migration is legitimately unclassified until
+--     the backfill (scripts/gds/backfill-session-types.js) runs. A DEFAULT would
+--     assert a type for 4,595 rows nobody measured.
+--   * The upload path fills it, but an older CLI posting the current body shape
+--     must keep working — the column is derived server-side from what the body
+--     already carries, never sent by the client, so no pinned core is broken.
+--   * NULL is distinguishable from 'unknown'. NULL means "not yet classified";
+--     'unknown' means "classified, and the digest did not decide". Collapsing the
+--     two would make the backfill's own progress unreadable.
+--
+-- NO CHECK CONSTRAINT against the type list. The closed set lives in
+-- session-type.js, which the route filter and the ledger both validate against;
+-- duplicating it here would give the vocabulary a second home that a deploy can
+-- leave behind. The values are written by one function, never by a client.
+
+ALTER TABLE session_records
+  ADD COLUMN IF NOT EXISTS session_type text;
+
+COMMENT ON COLUMN session_records.session_type IS
+  'Derived shape of the session (build / automated / exploration / conversation / unknown) '
+  'from modules/sessions/session-type.js. NULL = not yet classified, which is not the same '
+  'as ''unknown''. Never client-supplied.';
+
+-- Partial index: the ledger filters BY a type, never FOR the unclassified, so the
+-- NULL rows are dead weight in the index. Drops with the backlog as the backfill
+-- runs, which is the opposite of what a full index would do.
+CREATE INDEX IF NOT EXISTS idx_session_records_type
+  ON session_records (session_type, uploaded_at DESC)
+  WHERE session_type IS NOT NULL;

package/modules/discord/bug-attachments.js

@@ -50,8 +50,43 @@ const NAME_RE = /^bug-[a-z0-9]{1,40}-[0-9a-f]{16}\.(png|jpg|gif|webp)$/;
 // Where re-hosted images live. Outside the git tree (a `var/` dir) so a deploy's
 // `git reset --hard` / pull never wipes them; gitignored. Env override for tests
 // / non-default layouts.
+//
+// RESOLVED AGAINST THE INSTANCE ROOT, not this file (task 1003918). The default
+// used to be __dirname/../../var, which is the repo root in a single checkout and
+// `node_modules/@bongos/core/var` on an instance running a vendored core — where
+// every core reinstall wipes it. That is the task 1002237 shape, and these files
+// are the one thing here that cannot be regenerated: a Discord CDN URL expires in
+// about a day, so our copy IS the image. All five attachments this instance ever
+// stored are already gone (the 2026-07-05 droplet move carried the database and
+// not var/), which is what this default is meant to stop happening again.
+//
+// BUG_ATTACHMENTS_DIR still wins, and on a box where the instance root is itself
+// impermanent that override is the answer — the standup recipe says so.
+// The instance root is resolved ONCE. resolveInstanceRoot() reads an optional
+// bongos.config.json on every call, and this runs per served attachment — a sync
+// file read per image request, where the old code did a path.join. The root cannot
+// move under a running process, so caching it costs nothing and keeps the serve
+// path as cheap as it was. The env override is still read every call, so a test
+// (or an operator) can still change it without restarting.
+let instanceRootCache;
+function attachmentsRoot() {
+  if (instanceRootCache === undefined) {
+    try {
+      // Through the published doorway (ADR 0083), like every other core read here.
+      instanceRootCache = require('../../src/module-api').resolveInstanceRoot();
+    } catch (e) {
+      // Never let a storage-path lookup take down the bot: fall back to the historical
+      // location, which is correct in a single checkout and is where any existing
+      // files already are.
+      instanceRootCache = path.join(__dirname, '..', '..');
+    }
+  }
+  return instanceRootCache;
+}
+
 function attachmentsDir() {
-  return process.env.BUG_ATTACHMENTS_DIR || path.join(__dirname, '..', '..', 'var', 'bug-attachments');
+  if (process.env.BUG_ATTACHMENTS_DIR) return process.env.BUG_ATTACHMENTS_DIR;
+  return path.join(attachmentsRoot(), 'var', 'bug-attachments');
 }
 
 // PURE — is this a well-formed, bot-generated attachment name?

package/modules/hall-ui/public/sessions.css

@@ -17,3 +17,22 @@
 /* The task ids: chips that are doors (the family's a.fact-chip hover). */
 .ledger-tasks { display: inline-flex; flex-wrap: wrap; gap: 6px; }
 .ledger-tasks .fact-chip { text-decoration: none; }
+/* task 1003975 — the kind filter row. Right-aligned above the ledger so it sits
+   over the column it acts on without stealing the lede's line; it reuses the
+   pager's .pager__perpage label+select so the page has ONE control grammar. */
+.ledger-filters { display: flex; justify-content: flex-end; margin: 0 0 var(--sp-sm); }
+/* The control itself: the same label+select proportions as the pager's per-page
+   picker, so the page reads as one grammar — but its OWN class, because the
+   hall_audit guard treats any .pager* markup outside the kit as a second pager,
+   and borrowing that family is exactly how one starts. */
+.ledger-filter {
+  display: inline-flex; align-items: center; gap: 6px;
+  font-size: 12px; color: var(--ink-faint);
+}
+.ledger-filter select { height: 30px; padding: 2px 8px; font-size: 13px; }
+/* The kind cell: a quiet fact, not a chip. The ledger already spends its colour
+   on the two warnings (tool errors, plain speech), and a third coloured token
+   per row would make the warnings stop reading as warnings. Deliberately NO
+   white-space: nowrap — task 1003470 removed the blanket nowrap that broke this
+   table on a phone, and "Automated run" is short enough to wrap harmlessly. */
+.ledger-kind { color: var(--ink-soft); }

package/modules/hall-ui/public/sessions.html

@@ -54,10 +54,25 @@
         <section class="scroll" id="sessions-scroll" aria-labelledby="sessions-h" hidden>
           <h2 id="sessions-h" class="scroll__h">Recorded sessions</h2>
           <p class="scroll__lede">Most recent first. Each row is one recorded work session; every id on it opens its record.</p>
+          <!-- task 1003975: the ledger's first filter. It LOOKS like the pager's
+               per-page control on purpose (one control grammar per page) but wears
+               its own class — the hall_audit guard reads `class="pager…"` as a
+               hand-rolled pager, and it is right to: borrowing that family is how a
+               second pager implementation starts. Its options are filled from the
+               server's vocabulary in sessions.js, never hardcoded here, where they
+               would drift from what the route accepts. -->
+          <div class="ledger-filters">
+            <label class="ledger-filter">
+              <span>Kind</span>
+              <select id="session-type-filter" aria-label="Filter sessions by kind"></select>
+            </label>
+          </div>
           <table class="ledger" id="sessions-table">
             <thead>
               <tr>
-                <th>Session</th><th>Builder</th><th>Tasks</th>
+                <th>Session</th><th>Builder</th>
+                <th title="What the session did, derived from its own transcript: whether it wrote files, used tools, and how many prompts a person actually sent.">Kind</th>
+                <th>Tasks</th>
                 <th class="ledger__num">Earned</th><th class="ledger__num">Turns</th><th class="ledger__num">Tokens</th><th class="ledger__num">Tool errors</th>
                 <th class="ledger__num">Duration</th>
                 <th class="ledger__num" title="How the session read to this builder, scored against their own interaction profile. Advisory — it gates nothing.">Plain speech</th>