@bongos/core 1.19.820 → 1.19.821

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.820",
-  "core_contract": "1.19.820",
-  "source_commit": "c4a01fc04756f55d2459a179bd38a808b5950c1c",
+  "core_version": "1.19.821",
+  "core_contract": "1.19.821",
+  "source_commit": "8010be7b18c8402b4992ca02d3ea6486e3864b8d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T10:19:46.189Z",
+  "built_at": "2026-09-17T10:54:28.375Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 490,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2743,
-  "tree_sha256": "8f93538017b17fbc142d0e8bf95cc5f666a32ea5295ba9be2dbca5eb19acd100",
+  "tree_sha256": "b45cfd41d39a01485663e30b259328725d4eb07530cb520214df9811d2842e0b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -62,7 +62,7 @@
     {
       "path": ".claude/skills/builder-end/SKILL.md",
       "mode": "0000644",
-      "sha256": "60573c4e129df5bb386e7588989fbb407dfd1b88b4b9d567b2415d3e597f54da"
+      "sha256": "6f410236fa6fed591838b52a1d962210ed3c376e1feb439755c39930edd96ede"
     },
     {
       "path": ".claude/skills/builder-exit/SKILL.md",
@@ -517,7 +517,7 @@
     {
       "path": "docs/adr/0021-per-builder-skill-model-preferences.md",
       "mode": "0000644",
-      "sha256": "bcd0b55d7fd83e3e8877c55dbddbc9c101a2627f1a7be29207ab3e3bf8732e71"
+      "sha256": "12ee736d317c0076261f469c7fa010f71625329d81ee15bf2f069af80850826a"
     },
     {
       "path": "docs/adr/0022-secrets-policy.md",
@@ -537,7 +537,7 @@
     {
       "path": "docs/adr/0024-multi-agent-system-architecture.md",
       "mode": "0000644",
-      "sha256": "0aa00a713d3c15f456d535c15968547141df4f76f6b351a86c4c50132bad937c"
+      "sha256": "f446e8a7b535cd9b35a7255c2e78179ca287c16985f4b3e294c4282c5b1cfab4"
     },
     {
       "path": "docs/adr/0025-offsite-backup-vendor-digitalocean-spaces.md",
@@ -552,7 +552,7 @@
     {
       "path": "docs/adr/0026-bfg-memory-hygiene-and-cross-builder-learning.md",
       "mode": "0000644",
-      "sha256": "4e337e424c15df34f411877ecc371ad2e8f111c9922f9898eedc648d5d9bb1fe"
+      "sha256": "50d275eeea0cac619c5806583db070a3b95ab4e350a89e2b99e9d6fd4022332d"
     },
     {
       "path": "docs/adr/0027-bfg-session-inefficiency-evaluator.md",
@@ -562,7 +562,7 @@
     {
       "path": "docs/adr/0028-honest-llm-spend-accounting.md",
       "mode": "0000644",
-      "sha256": "31a0378984e53c9cb08370f70f3dca296cf532c1bf7e55a39c898683b1cb0c22"
+      "sha256": "7d8e8a3de946d3ddd2b9ee2d717b067fdcf7ecaa66bad814fd4567846b4c749e"
     },
     {
       "path": "docs/adr/0029-status-page-outage-resilience.md",
@@ -597,7 +597,7 @@
     {
       "path": "docs/adr/0035-builder-onboarding-three-paths.md",
       "mode": "0000644",
-      "sha256": "e411de75d8fa21b6870d5ca85052e3608b7fc59505990fd19bd23ac4c474b0e9"
+      "sha256": "eefc4f6a5d9090c853bcb45d03e1b5fb410910a003b08331dbf16a3d50836e80"
     },
     {
       "path": "docs/adr/0036-builders-subdomain-and-ui-reorg.md",
@@ -702,7 +702,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "4b2b10b4ae53c2b5c33d1220563b3021822c3ddc5e1a5034afc04a0d286f7bec"
+      "sha256": "09b32b0cf2f01db37797c6f99262b37dd5be51a47a57cb5005c49e9058c06c81"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -722,17 +722,17 @@
     {
       "path": "docs/adr/0058-automatic-gate-surface-gatekeeper.md",
       "mode": "0000644",
-      "sha256": "308a1342c514ef4028da846a8b3963df4a3908e72e1ed3a688fe1c1e51c67ec9"
+      "sha256": "35b2bfccd503b150c3e6587564c1e1779400bdbf1899ee2346c31eb19d8b2681"
     },
     {
       "path": "docs/adr/0059-single-approval-remove-devbox-approval-gate.md",
       "mode": "0000644",
-      "sha256": "adb7a32e2afc71212a680fd59443e4435a884758053f78509ec6bc7b8f738e23"
+      "sha256": "6b425c8416bf8695c5a85b93d0f24e3db9d1a43ee9fa3032aa38a9178fbb740a"
     },
     {
       "path": "docs/adr/0060-gds-retrieval-layer.md",
       "mode": "0000644",
-      "sha256": "9d0546a4d24f38f1632aa94789c3d599777ff9dbf9664929993934f6b2ffcd1f"
+      "sha256": "9f965ad0eb78ea5e5dd83f46426129a593335bb35e312209d1cfe3a240d53be3"
     },
     {
       "path": "docs/adr/0061-context-layer-decomposition.md",
@@ -782,7 +782,7 @@
     {
       "path": "docs/adr/0070-deterministic-session-card-delivery.md",
       "mode": "0000644",
-      "sha256": "b8ecbe554ac874f415bca4e31198e77f574fdba7fc0d2a6f9491701094203062"
+      "sha256": "f215a47f3432a8efce4b9fd7a9eb90dd3221ca314b8fa8ca35486464f3027769"
     },
     {
       "path": "docs/adr/0071-box-confirm-before-destroyed-and-drift-reconcile.md",
@@ -802,7 +802,7 @@
     {
       "path": "docs/adr/0073-builder-needs-signal-and-byok-gemini-key.md",
       "mode": "0000644",
-      "sha256": "b7e794e23d06b44d7e4cbdc4985275aa4c26b5b88aa5a5c019881ac0b88bfaa7"
+      "sha256": "cf5981d3c27dfed8e2f02b07a77c9de08a8df6bda0a746ecd3bc0943d30d64da"
     },
     {
       "path": "docs/adr/0073-secrets-scan-exclude-uri-detector.md",
@@ -847,7 +847,7 @@
     {
       "path": "docs/adr/0081-tool-agnostic-design-layer.md",
       "mode": "0000644",
-      "sha256": "6fbbd598f08196d32253f15a797dd20bdc28cb7c38930e10f9dcf5467e6dbf97"
+      "sha256": "d2f5de4793bf1e9cd184a4bfc2cddb9dd44c560e42e3ef8d0f0e6668fd84d69a"
     },
     {
       "path": "docs/adr/0082-productized-key-storage-provisioning.md",
@@ -877,7 +877,7 @@
     {
       "path": "docs/adr/0086-goal-scoped-work-hierarchy.md",
       "mode": "0000644",
-      "sha256": "db082db26afc1fefd429c826ba934e99ff1e127cd0b099810de1b9e83ef8514f"
+      "sha256": "15c590ed8bb381435564f4ba797f8933b2332620da6178e2f2b47c22feedc15b"
     },
     {
       "path": "docs/adr/0087-bongos-app-architecture-and-handoff-contract.md",
@@ -1052,7 +1052,7 @@
     {
       "path": "docs/adr/0117-api-versioning-and-deprecation-policy.md",
       "mode": "0000644",
-      "sha256": "738b956bbf896aabdfd28b7f885b47e4b44cce6406d9ac9a5b67a23f3b0cac5d"
+      "sha256": "6a9f4f42867cfd07f7ad85b2d7fc8dab58f6e6ce0c7e0145cb7d58aa16955619"
     },
     {
       "path": "docs/adr/0118-api-contract-source-of-truth-code-first.md",
@@ -2547,7 +2547,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "54570238fac2a9b36678a3fa293f7ea17cc53d3c8aeb29070132a5eb35f31334"
+      "sha256": "9d562958c91d14116733518e2934b1a78b980adc6a19c652cfe47eb85c3693bf"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2732,7 +2732,7 @@
     {
       "path": "docs/recipes/multi-builder-merge.md",
       "mode": "0000644",
-      "sha256": "048875fdcbd2e6637f19b96e3b6660434e4ceb68b5ee171580a6d6a13b39242b"
+      "sha256": "368b0acc045087c8aff34b3a551ced958e6e87987afcf6c3210eff093c8a9eea"
     },
     {
       "path": "docs/recipes/ops-gotchas.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/recipes/search-index-ingestion.md",
       "mode": "0000644",
-      "sha256": "70989ad134f5aaffc08007a180bfa5f9cccceef780346a965fcade293490dc71"
+      "sha256": "dd333b764d0ed25162b6bee7f02cb5231d7384918abb30a05ad3a18aa099f4dd"
     },
     {
       "path": "docs/recipes/self-host.md",
@@ -7812,12 +7812,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e520824e675ebbb739a1f6ea7e2bc6ff857e1b6a396a61e22f20fd31b8b9a502"
+      "sha256": "bd6442d6f7a4122841efdb7ed6d796e43f9df2bb4a65677d19d586af19cb0650"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "39eb085e8df8abd30ffe2826215c5c7eb6969b2a3990f3f7d0f12cd303cd0aaf"
+      "sha256": "8185455c292222a25c1928dc9ef4959bc09783fb71fc231e89dca09793239e44"
     },
     {
       "path": "public-docs/index.html",
@@ -9722,7 +9722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8285f22119e40dc42cf2826696104fea2321fb9da9ad5c6cbd8eb5106382807f"
+      "sha256": "363876fc33b090bf88ca7b767b82778feb63ee9bb607c00e4a37a2aae0b5416f"
     },
     {
       "path": "src/module-loader/catalog.js",

package/.claude/skills/builder-end/SKILL.md

@@ -13,7 +13,7 @@ This is **not** `/builder-exit` — that deactivates an entire builder (releases
 Composes operations that already exist, in a safe order, with the destructive ones gated last:
 
 1. **Resolve the claim** — `/builder-ship` when there's committed, shippable work; `/builder-release` when there isn't. (It calls the sibling skills; it does not re-implement shipping.)
-2. **Clean-git verify** — refuse to go further if any *tracked* file is uncommitted. This is the same guard `scripts/gds/ship.js` enforces (`trackedDirty` in [`src/bongos/ship-preflight.js`](../../../src/bongos/ship-preflight.js)): untracked scratch is ignored, but a modified/staged/deleted tracked file means real work isn't committed — stop before anything is lost.
+2. **Clean-git verify** — refuse to go further if any *tracked* file is uncommitted. This is the same guard `scripts/gds/ship.js` enforces (`trackedDirty` in [`modules/lifecycle/ship-preflight.js`](../../../modules/lifecycle/ship-preflight.js)): untracked scratch is ignored, but a modified/staged/deleted tracked file means real work isn't committed — stop before anything is lost.
 3. **Worktree teardown** — from the main checkout, remove this session's linked worktree via `node scripts/gds/worktree.js remove` (junction-aware), `prune`, and delete the now-merged `claude/<name>` branch.
 
 It never pushes to `main`, never `ssh`-es, never runs a deploy — landing is `/builder-ship`'s job (server-mediated). It only ever touches the caller's **own** claim and **own** worktree.

package/docs/adr/0021-per-builder-skill-model-preferences.md

@@ -93,7 +93,7 @@ If V4 retires per-skill defaults in favor of per-skill-*kind* defaults (the broa
 ## Cross-references
 
 - [Migration 037](../../migrations/037_builder_skill_model_prefs.sql) — the schema change.
-- [`src/bongos/skill-prefs.js`](../../src/bongos/skill-prefs.js) — the helper module and source of truth for defaults.
+- [`modules/builder-settings/skill-prefs.js`](../../modules/builder-settings/skill-prefs.js) — the helper module and source of truth for defaults.
 - [`tests/skill_prefs.mjs`](../../tests/skill_prefs.mjs) — unit coverage for the pure helpers.
 - [ADR 0017](0017-code-simplification-and-repo-cleanliness.md) — same spirit: keep judgment work intentional, mechanism work cheap.
 - CLAUDE.md §2 — the project-wide subagent routing policy this ADR sits beside (not replaces — the policy is the default the matrix opens with).

package/docs/adr/0024-multi-agent-system-architecture.md

@@ -10,7 +10,7 @@
 
 As the GDS opens to multiple builders, three structural risks scale faster than headcount:
 
-1. **The ship-time grader is lenient by construction.** [`src/bongos/grader.js`](../../src/bongos/grader.js) v2 (V3.R18 / [#209](https://example.com/builders#/task/209)) runs a *single* Opus subagent against the diff. Opus wrote the code; Opus grades it. Academic LLM-as-judge work (Zheng et al. 2023, Chiang & Lee 2023) consistently documents ~10–15% same-family inflation. The prompt asks "what score?" rather than "find what's wrong, then decide if it passes" — the default-to-pass framing is the bias. The recorded 14-day passing rate (65/75 = 87%) is suspiciously high for un-calibrated work.
+1. **The ship-time grader is lenient by construction.** [`modules/grading/grader.js`](../../modules/grading/grader.js) v2 (V3.R18 / [#209](https://example.com/builders#/task/209)) runs a *single* Opus subagent against the diff. Opus wrote the code; Opus grades it. Academic LLM-as-judge work (Zheng et al. 2023, Chiang & Lee 2023) consistently documents ~10–15% same-family inflation. The prompt asks "what score?" rather than "find what's wrong, then decide if it passes" — the default-to-pass framing is the bias. The recorded 14-day passing rate (65/75 = 87%) is suspiciously high for un-calibrated work.
 
 2. **Methodology hygiene is reactive.** Documentation drift, dead code, and architectural sprawl are caught (if at all) by `overnight-code-review` and `repo-simplify-sweep` — both downstream of merge, both advisory, both already overfilling. No upstream gate looks at the *system* the way the grader looks at the diff.
 

package/docs/adr/0026-bfg-memory-hygiene-and-cross-builder-learning.md

@@ -22,7 +22,7 @@ This ADR records the architecture and, critically, the **boundaries** that turn
 
 ### What the substrate already gives us
 
-- **Builder memory is server-canonical and per-builder isolated** — [`builder_memory`](../../src/bongos/routes/memory.js), `PRIMARY KEY (builder_id, path)`. The *only* cross-builder access that exists today is an **Archon-only, audit-logged, read-only** forensic path. **There is no cross-builder *write* path at all** — that was a conscious decision ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md), [ADR 0024-memory](0024-cloneable-repo-local-first-memory.md) §4).
+- **Builder memory is server-canonical and per-builder isolated** — [`builder_memory`](../../modules/memory/routes/memory.js), `PRIMARY KEY (builder_id, path)`. The *only* cross-builder access that exists today is an **Archon-only, audit-logged, read-only** forensic path. **There is no cross-builder *write* path at all** — that was a conscious decision ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md), [ADR 0024-memory](0024-cloneable-repo-local-first-memory.md) §4).
 - **Karma** ([`karma_log`](../../migrations/040_builder_karma.sql)) is the existing good-citizenship reputation ledger (append-only, `granted_by` records who drove a delta, `NULL` = system).
 - **Cron roles** live as `SKILL.md` files under [`.claude/scheduled-tasks/`](../../.claude/scheduled-tasks/); the read-only `overnight-code-review` routine is the closest existing pattern.
 

package/docs/adr/0028-honest-llm-spend-accounting.md

@@ -22,7 +22,7 @@ Capture the two sources at **two different seams**, because their cost data live
 
 ### 1. Grader cost — read it from the subprocess envelope (client-side, exact)
 
-`grader.runSubagent` spawns each worker as `claude -p --print --output-format json` ([src/bongos/grader.js](../../src/bongos/grader.js)). With `--output-format json`, the CLI returns a result envelope that includes **`total_cost_usd`** (and a `usage` block) — *verified* on a real call: `{type, …, total_cost_usd: 0.198, usage, modelUsage}`. The old `extractAssistantResult` parsed only `env.result` and **discarded the cost**.
+`grader.runSubagent` spawns each worker as `claude -p --print --output-format json` ([modules/grading/grader.js](../../modules/grading/grader.js)). With `--output-format json`, the CLI returns a result envelope that includes **`total_cost_usd`** (and a `usage` block) — *verified* on a real call: `{type, …, total_cost_usd: 0.198, usage, modelUsage}`. The old `extractAssistantResult` parsed only `env.result` and **discarded the cost**.
 
 > **Correction (made during [#486](https://example.com/builders#/task/486) implementation):** the panel does **not** run server-side. `gradeSubagent` is invoked **client-side in `scripts/gds/ship.js`** (and `conductor-dispatch.js`); the server's `/tasks/:id/grade` route only *validates/scores* the result ship.js POSTs. So there is no in-process DB handle at grade time — the cost is logged over HTTP, exactly like the session path. The substance below (exact envelope cost, no pricing table) is unchanged; only the seam moved from `db.logCost` to `POST /api/gds/cost`.
 

package/docs/adr/0035-builder-onboarding-three-paths.md

@@ -13,7 +13,7 @@ A new builder can reach Example three different ways, but the project has never
 
 1. **The live onboarding contradicts the intended model.** Today the *only* fully-working setup path is the one documented in [`docs/onboarding/primer.md`](../onboarding/primer.md) "Get set up": **accept a GitHub collaborator invite and clone the private repo onto your own disk** — open to *every* rank, including a brand-new Xenos. ADR 0031 §6 says source access should be a *rank-gated, revocable, box-held* boundary. So the live behavior is the exact opposite of the locked design: an unproven newcomer currently gets a permanent local copy of the whole repo. This must be reconciled.
 2. **The box lane is built but has no front door.** ADR 0031 + [#701](https://example.com/builders#/task/701) shipped the whole provisioning spine — `POST /box/ensure`, the intent queue, the control-plane runner, the pairing-link path. But there is no *guided arrival*: nothing tells a non-technical or Chromebook builder, in plain language, "here is your first session, here is what to type, here is how you wait for your box." The capability exists; the on-ramp doesn't.
-3. **Cost exposure is unbounded at the front door.** Anyone with a GitHub account can complete Device-Flow auth and become a Xenos, and a Xenos is above the box provisioning floor (`DEFAULT_PROVISION_FLOOR = 'xenos'`, [`src/bongos/boxes.js`](../../src/bongos/boxes.js)). With [#701](https://example.com/builders#/task/701)'s auto-draining intent queue, a signup could cause a paid droplet (~$24/mo, ~$5/active after auto-park) to be created with **zero human in the loop**. On a $5,000/yr budget that's a real hole.
+3. **Cost exposure is unbounded at the front door.** Anyone with a GitHub account can complete Device-Flow auth and become a Xenos, and a Xenos is above the box provisioning floor (`DEFAULT_PROVISION_FLOOR = 'xenos'`, [`modules/dev-box/boxes.js`](../../modules/dev-box/boxes.js)). With [#701](https://example.com/builders#/task/701)'s auto-draining intent queue, a signup could cause a paid droplet (~$24/mo, ~$5/active after auto-park) to be created with **zero human in the loop**. On a $5,000/yr budget that's a real hole.
 
 ## The three paths (what each *is*, who it's for, how it's gated)
 

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -26,7 +26,7 @@ A box-scoped token still cannot ship. The builder runs **`/builder-reauth`** (th
 
 - `POST /api/gds/tasks/:id/publish-branch` — `auth.requireBuilder` + `gateTaskOwnership` (the same [#871](https://example.com/builders#/task/871) gate as `/grade`/`/confirm`/`/ship`), **deliberately without `auth.allowBoxScope`**, so a box-scoped session is `403 box_scope`. Accepts the branch as a **thin git bundle** (base64, `origin/main..HEAD`), `head_sha`, and `value_summary`. The server: writes the bundle to a per-request temp dir, fast `git clone --bare --local` of its own checkout for `main`'s objects (no network, no worktree touch → never races the `deploy-prod.yml` reset), unbundles, **verifies the bundle tip == the claimed `head_sha`** (binds the pushed code to the already-graded sha), then `git push` to GitHub via a **one-shot `x-access-token:<redacted> URL** (never persisted, never logged — the `box-source-fetch.sh` pattern), opens the PR, and enables auto-merge.
 - `GET /api/gds/tasks/:id/publish-status?branch=…` — ownership-gated; the server derives PR + deploy state live from GitHub so `ship.js` confirms the land WITHOUT `gh` on the box. No DB column added.
-- Implementation: [`src/bongos/github-push.js`](../../src/bongos/github-push.js) (push/PR/status via `execFile` arg-arrays + raw `fetch`, all behind test seams), routes in [`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js), the bundle body bypasses the global 64 KB JSON cap via the skip-list in [`src/bongos/routes.js`](../../src/bongos/routes.js) (route-scoped 32 MB parser + a 20 MB decoded-byte cap).
+- Implementation: [`modules/lifecycle/github-push.js`](../../modules/lifecycle/github-push.js) (push/PR/status via `execFile` arg-arrays + raw `fetch`, all behind test seams), routes in [`modules/lifecycle/routes/tasks.js`](../../modules/lifecycle/routes/tasks.js), the bundle body bypasses the global 64 KB JSON cap via the skip-list in [`src/bongos/routes.js`](../../src/bongos/routes.js) (route-scoped 32 MB parser + a 20 MB decoded-byte cap).
 
 ### 3. `ship.js` chooses the path automatically
 

package/docs/adr/0058-automatic-gate-surface-gatekeeper.md

@@ -46,7 +46,7 @@ The hard floor is the irreducible root of trust: a compromised or prompt-injecte
 
 ## Update — enforcing, and the two server-attestation vectors (task 1142, task 1169)
 
-The gatekeeper went **ENFORCING** (task 1142): `gate-review.yml` no longer sets `GATE_REPORT_ONLY`, and `gate-review` is a required check. The `GATE_AUTHOR_TRUSTED` signal is the `gate-author-trust` **commit status** — set only by the server (which alone holds the authenticated builder's server-resolved rank + the App/PAT credential), so CI reads it but cannot forge it. The server posts it via `githubPush.setCommitStatus` from **two** ship paths, sharing one helper (`postGateAuthorTrust` in [`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js)):
+The gatekeeper went **ENFORCING** (task 1142): `gate-review.yml` no longer sets `GATE_REPORT_ONLY`, and `gate-review` is a required check. The `GATE_AUTHOR_TRUSTED` signal is the `gate-author-trust` **commit status** — set only by the server (which alone holds the authenticated builder's server-resolved rank + the App/PAT credential), so CI reads it but cannot forge it. The server posts it via `githubPush.setCommitStatus` from **two** ship paths, sharing one helper (`postGateAuthorTrust` in [`modules/lifecycle/routes/tasks.js`](../../modules/lifecycle/routes/tasks.js)):
 
 1. **Server-mediated publish** ([ADR 0055](0055-server-mediated-branch-publish.md), dev box / `pushVia 'server'`): `POST /tasks/:id/publish-branch` attests the pushed tip after opening the PR.
 2. **Laptop `ci`-land** (`pushVia 'local'` — task 1169): `ship.js` pushes the branch + opens the PR with the laptop's own `gh` credential, which **cannot** forge the attestation. So `ciLandLocal` calls `POST /tasks/:id/attest-gate` (`requireBuilder` + ownership, deliberately **no** `allowBoxScope`) right **after the push and before opening the PR** — race-free for a fresh PR, since the PR-open is what fires `gate-review` and it runs only after the status is already present. Before task 1169 the laptop path posted *nothing*, so a Metic+ author's gate-surface PR from a laptop was BLOCKED and they could not self-approve their own PR (hit live on task 1162 / PR #131).

package/docs/adr/0059-single-approval-remove-devbox-approval-gate.md

@@ -25,7 +25,7 @@ This **supersedes** [ADR 0035](0035-builder-onboarding-three-paths.md) §2 (Deci
 ## Consequences
 
 - **The member invite becomes the SOLE human gate before a paid (~$24/mo) box is created.** An admitted Xenos can provision their first box hands-off — the spend is bounded by the fact that a human already chose to admit them, not by a second per-box click.
-- **The box provisioning RANK FLOOR still bounds eligibility.** `BOX_PROVISION_MIN_RANK` ([`src/bongos/boxes.js`](../../src/bongos/boxes.js)) is unchanged: the floor is still the rank-side control on who may have a box at all, and the per-builder "one box at a time" invariant (`box_intents` partial unique index, one `builder_boxes` row) is untouched. Removing the *first-box* gate does not widen *who* qualifies; it only removes the second human click for someone already admitted and already above the floor.
+- **The box provisioning RANK FLOOR still bounds eligibility.** `BOX_PROVISION_MIN_RANK` ([`modules/dev-box/boxes.js`](../../modules/dev-box/boxes.js)) is unchanged: the floor is still the rank-side control on who may have a box at all, and the per-builder "one box at a time" invariant (`box_intents` partial unique index, one `builder_boxes` row) is untouched. Removing the *first-box* gate does not widen *who* qualifies; it only removes the second human click for someone already admitted and already above the floor.
 - **Migration 102 reverts the schema** introduced by migration 071 — the `pending_approval` box-intent state (and any approval-tracking column) is removed; in-flight first-box intents are migrated to `pending` so the runner drains them.
 - **The box-panel "awaiting approval" UI state is removed** — `/builder-box` and the hall box panel no longer surface "your box is awaiting approval," because no box waits.
 - **The `#box-approvals` Discord channel + its box-intent approve/deny wiring are removed** (the box half of [ADR 0057](0057-discord-archon-approval-channels.md)). `#member-approvals` and the admission approve/dismiss wiring stay — admission is still the gate.

package/docs/adr/0060-gds-retrieval-layer.md

@@ -67,7 +67,7 @@ Results are fused with **Reciprocal Rank Fusion** (RRF: `score = Σ 1/(k + rank_
 
 ### 6. Scoping — per-chunk `min_rank` + owner, server-enforced (V4.R12 / [#950](https://example.com/builders#/task/950))
 
-This is the load-bearing security property, mirroring [`src/bongos/routes/memory.js`](../../src/bongos/routes/memory.js)'s posture:
+This is the load-bearing security property, mirroring [`modules/memory/routes/memory.js`](../../modules/memory/routes/memory.js)'s posture:
 
 - Every query is filtered **in the SQL WHERE clause** (not post-hoc in JS) by the caller's **live, server-resolved rank** (`req.builder.rank`, read fresh per request — never from input): `min_rank` must be ≤ the caller's rank in the ladder.
 - A chunk with a non-null `owner_builder_id` (a per-builder private chunk, e.g. memory) is returned **only** to that owner — `owner_builder_id IS NULL OR owner_builder_id = req.builder.id`. There is no parameter to name another builder; the owner is always the authenticated session.

package/docs/adr/0070-deterministic-session-card-delivery.md

@@ -25,7 +25,7 @@ Make card **delivery** deterministic via hooks, and split the vehicle by whether
 
 1. **Read-only cards** (`/builder-start`, `/status`; future: `/recall`) → **[`session-cards.js`](../../.claude/hooks/session-cards.js)**, a `UserPromptSubmit` hook. On a matching intent it runs the script's `--hook` mode, which emits a one-fetch JSON envelope `{widgets_enabled, html, markdown, warnings}`, and injects the finished card + a one-step "render this once" directive. Registry-driven: adding a read-only card is one `CARDS` entry (a matcher, a script, an arg-extractor). Safe to pre-run because these scripts only fetch + render.
 
-2. **Mutating / lifecycle cards** (`/builder-claim`, `/builder-ship`; `release` matched, emits none today) → **[`lifecycle-card.js`](../../.claude/hooks/lifecycle-card.js)**, a `PostToolUse`/Bash hook. These **must never be pre-run** — claiming or shipping as a side effect of merely typing would be catastrophic. Instead the model runs the script itself; the hook fires immediately after, reads the `[otb-card-html] <path>` marker the shared emitter ([`src/bongos/ship-card.js`](../../src/bongos/ship-card.js)) wrote, reads that file, and injects the card + directive next to the tool result.
+2. **Mutating / lifecycle cards** (`/builder-claim`, `/builder-ship`; `release` matched, emits none today) → **[`lifecycle-card.js`](../../.claude/hooks/lifecycle-card.js)**, a `PostToolUse`/Bash hook. These **must never be pre-run** — claiming or shipping as a side effect of merely typing would be catastrophic. Instead the model runs the script itself; the hook fires immediately after, reads the `[otb-card-html] <path>` marker the shared emitter ([`modules/lifecycle/ship-card.js`](../../modules/lifecycle/ship-card.js)) wrote, reads that file, and injects the card + directive next to the tool result.
 
 Both hooks honor the task-1279 widgets knob (OFF ⇒ no HTML injected, the plain-text card stands), carry **exactly two** fence markers around each payload (no extraction ambiguity), and follow the standard hook discipline: silent-fail (any miss/parse/IO error → exit 0, no output), zero model calls, a kill-switch (`OTB_SESSION_CARDS_OFF`) and the `OTB_SUBAGENT` guard. The skills (`builder-start`, `status`, `builder-claim`, `builder-ship`) are slimmed to **defer to the injected directive**, keeping their old run-the-script logic as the fallback when no directive appears (hook disabled, an older checkout, or a silent failure).
 

package/docs/adr/0073-builder-needs-signal-and-byok-gemini-key.md

@@ -23,7 +23,7 @@ Two coupled pieces: a **reusable signal** (the general mechanism the owner asked
 
 ### 1. The `needs` signal — one consistent way to flag a required input
 
-A new pure module, [`src/bongos/builder-needs.js`](../../src/bongos/builder-needs.js), is a small **registry**. Each thing the system needs from a builder to run a capability — today the Gemini image key; tomorrow a Stripe key, a first-party Anthropic link, … — is one `(ctx) => need|null` entry. The server computes the live list on `GET /api/gds/me` (`needs: { items, action_needed_count, has_action_needed }`); every surface renders the **same** shape. Adding a future input is one registry entry — the renderers don't change.
+A new pure module, [`modules/builder-settings/builder-needs.js`](../../modules/builder-settings/builder-needs.js), is a small **registry**. Each thing the system needs from a builder to run a capability — today the Gemini image key; tomorrow a Stripe key, a first-party Anthropic link, … — is one `(ctx) => need|null` entry. The server computes the live list on `GET /api/gds/me` (`needs: { items, action_needed_count, has_action_needed }`); every surface renders the **same** shape. Adding a future input is one registry entry — the renderers don't change.
 
 A need is always in exactly one of three states:
 

package/docs/adr/0081-tool-agnostic-design-layer.md

@@ -9,7 +9,7 @@ Developers collaborate through Git because code is text: it diffs line-by-line a
 Three forces made this worth deciding now:
 
 1. **UI is becoming real work.** Today the GDS has three disciplines — `engineer | artist | ideator` — and "design/figma/UI" tasks fall into `artist`, the pixel-art lane. UI (HUD, menus, the builders' hall, status dashboard, landing pages) is a different problem from world tiles and deserves its own lane.
-2. **The grader is secretly two systems.** The GDS ship pipeline (`confirm → grade → merge → deploy → credits`) does **not** branch by discipline — every task rides the same rails. But the *grade* step is the code panel [`grader.js`](../../src/bongos/grader.js) (reads a git diff; scores code quality), while pixel art is really gated by a *separate* Gemini vision pipeline ([`art/pipeline/review.py`](../../art/pipeline/review.py)) that runs **upstream** in `/paint`, not at ship. Art passes the ship-time grader as a near-rubber-stamp because a text-only panel can't see pixels. Two grader codebases is a maintenance trap.
+2. **The grader is secretly two systems.** The GDS ship pipeline (`confirm → grade → merge → deploy → credits`) does **not** branch by discipline — every task rides the same rails. But the *grade* step is the code panel [`grader.js`](../../modules/grading/grader.js) (reads a git diff; scores code quality), while pixel art is really gated by a *separate* Gemini vision pipeline ([`art/pipeline/review.py`](../../art/pipeline/review.py)) that runs **upstream** in `/paint`, not at ship. Art passes the ship-time grader as a near-rubber-stamp because a text-only panel can't see pixels. Two grader codebases is a maintenance trap.
 3. **Claude Design changed the calculus.** [Claude Design](https://www.anthropic.com/news/claude-design-anthropic-labs) (Anthropic Labs, beta, 2026) **writes code and renders it** — it has no vector canvas. Its output is HTML/CSS/JS, and its June 2026 update added tight Claude Code sync (`/design-sync` imports a repo's design system in; a finished design hands off to Claude Code "where the designer left off"). So for Claude Design, *design is code* — it merges like any other code.
 
 Owner (Lars) requirements, reached in the 2026-06-21 design conversation:
@@ -40,7 +40,7 @@ Owner (Lars) requirements, reached in the 2026-06-21 design conversation:
 - **Designers keep Figma.** Manual Figma edits are first-class for structured/design-system changes and round-trip into the repo via a normal GDS task + the same grader. The honest limit: the Figma→code round-trip is lossy for arbitrary canvas art — that work becomes a committed asset, not round-tripped code.
 - **One grader to maintain, not two.** The standalone Gemini review path is retired into the unified engine. Code doesn't auto-regen today (a failed grade = human fixes + re-ships); unifying gives every type the same generate→grade→regenerate loop.
 - **Graphics is unchanged.** World pixel art stays on the Claude Code + Gemini pipeline; Figma stays its viewer ([`otb-figma-sync`](../../.claude/skills/otb-figma-sync/SKILL.md)). This ADR adds the `ui` lane beside it, it does not disturb the art pipeline.
-- **Gate-review floor applies.** [#1380](https://example.com/builders#/task/1380) touches [`grader.js`](../../src/bongos/grader.js) + [`ship.js`](../../scripts/gds/ship.js) — the gate-review **hard floor** ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)). It needs owner Gate approval even for Archon, and the multimodal call path wants a security review.
+- **Gate-review floor applies.** [#1380](https://example.com/builders#/task/1380) touches [`grader.js`](../../modules/grading/grader.js) + [`ship.js`](../../scripts/gds/ship.js) — the gate-review **hard floor** ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)). It needs owner Gate approval even for Archon, and the multimodal call path wants a security review.
 
 ## Rejected alternatives
 

package/docs/adr/0086-goal-scoped-work-hierarchy.md

@@ -12,7 +12,7 @@
 
 ## Context
 
-Today only the Archon can create or edit tasks — `POST /tasks` and `PATCH /tasks/:id` are both `requireRank('archon')` ([`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js)). Lower-ranking builders (`xenos`, `thetes`) can only **file ideas** into `idea_inbox`; they have no ability to shape their own work toward an objective.
+Today only the Archon can create or edit tasks — `POST /tasks` and `PATCH /tasks/:id` are both `requireRank('archon')` ([`modules/lifecycle/routes/tasks.js`](../../modules/lifecycle/routes/tasks.js)). Lower-ranking builders (`xenos`, `thetes`) can only **file ideas** into `idea_inbox`; they have no ability to shape their own work toward an objective.
 
 > **Update (2026-06-26, [ADR 0090](0090-metic-task-authoring.md)):** `POST /tasks` / `PATCH /tasks/:id` are now `requireRank('metic','archon')` — a *Metic* may author tasks directly. This ADR's goal-scoped, module-fenced authoring path (`POST /goals/:id/tasks`) is now the mechanism for **sub-Metic** ranks (`xenos`/`thetes`) specifically; everything below about the scope-subset wall and protected-path block is unchanged and still governs that path. Every task must be hand-authored by the owner first — a delegation bottleneck that wastes capable builders' judgment, and the opposite of the AI-first norm where agents do the building.
 
@@ -54,7 +54,7 @@ The tier set is host-configured, not hardcoded — the [ADR 0062](0062-medusa-in
 ### 3. Bounded task authoring (membership grants it; the create-time gate)
 
 - **`POST /goals`** — `requireRank('metic','archon')`; **Archon-only when `scope_modules` includes a `protected` module.**
-- **`POST /goals/:id/join` / `leave`** — open join for normal goals; **joining a sensitive-scope goal needs Archon approval** (reuse the access-request pattern, [`access-requests.js`](../../src/bongos/routes/access-requests.js)).
+- **`POST /goals/:id/join` / `leave`** — open join for normal goals; **joining a sensitive-scope goal needs Archon approval** (reuse the access-request pattern, [`access-requests.js`](../../modules/onboarding/routes/access-requests.js)).
 - **`POST /goals/:id/tasks`** — `requireBuilder` + an in-handler gate (the maneuverability grant), ordered + fail-closed: goal `open` and **caller is a member** (or Archon); version guards reused from `POST /tasks`; **scope subset** — every `touches[]` element covered by the goal's `scope_modules` globs (`touchesOverlap`, [`path-match.js`](../../src/bongos/path-match.js)); **protected-path block** — `checkPermissionPaths` ([`permission-path-check.js`](../../src/bongos/permission-path-check.js)) so a sub-Metic member cannot author a task touching the protected core; then `db.createTask` stamping `goal_id`. `POST /tasks` / `PATCH /tasks/:id` stay byte-identical (Archon-only) for ungoverned creation.
 - **Rank floor is auto-derived, not a bespoke cap.** Per [ADR 0084](0084-auto-derived-per-task-rank-floor.md), a created task's `requires_rank` is auto-derived from its touches + sensitivity (`deriveRequiredRank` → `metic` for protected/sensitive, else `xenos`) and can only be raised. So a goal member need not (and cannot) self-set a rank that escapes their own gate — and a sensitive task auto-floors to `metic`, which a sub-Metic author could not claim. No new cap mechanism; this composes with the one that already exists.
 
@@ -78,7 +78,7 @@ The tier set is host-configured, not hardcoded — the [ADR 0062](0062-medusa-in
 
 ### 7. How the boundary holds (reuse + defense-in-depth)
 
-The create-time gate sees only *declared* touches (advisory — git merge is the real collision detector, [ADR 0049](0049-split-parallel-safety-contract.md)), so it is the first filter, **not** the enforcement boundary. The existing **ship-time gates remain authoritative on the real diff**: the grader's `permissionPathPrePass`/`routeRankPrePass` + `serverSideGuards` ([`grader.js`](../../src/bongos/grader.js)), the `gate-review` ESCALATE floor, and the post-push `main-audit`. A mis-declared task still cannot *merge* if its real diff hits protected paths. Two CI fitness checks ([`fitness.js`](../../scripts/gds/fitness.js)) guard drift: goal routes are pinned in `route-rank-check.EXPECTED_RANKS`, and the scope code must *import* `PROTECTED_GLOBS`, never re-declare it.
+The create-time gate sees only *declared* touches (advisory — git merge is the real collision detector, [ADR 0049](0049-split-parallel-safety-contract.md)), so it is the first filter, **not** the enforcement boundary. The existing **ship-time gates remain authoritative on the real diff**: the grader's `permissionPathPrePass`/`routeRankPrePass` + `serverSideGuards` ([`grader.js`](../../modules/grading/grader.js)), the `gate-review` ESCALATE floor, and the post-push `main-audit`. A mis-declared task still cannot *merge* if its real diff hits protected paths. Two CI fitness checks ([`fitness.js`](../../scripts/gds/fitness.js)) guard drift: goal routes are pinned in `route-rank-check.EXPECTED_RANKS`, and the scope code must *import* `PROTECTED_GLOBS`, never re-declare it.
 
 ### Deferred (explicit non-decisions)
 
@@ -104,7 +104,7 @@ Each phase ships independently; implementing tasks are created via `/planning-se
 
 ## Alternatives considered
 
-- **Reuse `parent_task_id` for goals (a goal = a parent task) — rejected.** One-level cap ([`hierarchy.js`](../../src/bongos/hierarchy.js)), wrong lifecycle (a goal is a standing grant, not shippable work that earns credit on ship), and a task has no place for scope or membership.
+- **Reuse `parent_task_id` for goals (a goal = a parent task) — rejected.** One-level cap ([`hierarchy.js`](../../modules/lifecycle/hierarchy.js)), wrong lifecycle (a goal is a standing grant, not shippable work that earns credit on ship), and a task has no place for scope or membership.
 - **Reuse `done_when_criteria` as goals — rejected.** That table *is* the criteria tier; overloading it with membership + a creation grant conflates "definition of done" with "who may do work." A goal *links to* criteria; it is not one.
 - **Single-owner goals — rejected** (Lars). Goals are shared workspaces; a single assignee would force mega-claims and block collaboration. Membership grants the authority; contribution (not membership alone) is what any future reward weights on.
 - **A bespoke per-task rank cap at goal-create — rejected in favour of [ADR 0084](0084-auto-derived-per-task-rank-floor.md).** The auto-derived floor already prevents a member minting a task that escapes their gate; a second mechanism would be a second list that drifts (the SEC [#863](https://example.com/builders#/task/863) failure mode).

package/docs/adr/0117-api-versioning-and-deprecation-policy.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-07-04
 **Status:** Accepted (policy; R05 of goal 36).
-**Context:** [task 1992](https://builders.example.com#/task/1992) (BONGOS-V1, goal 36 "Robust, versioned, easy-to-call public API", criterion `api-versioning`). This is the **policy**; the mount + aliasing that implements it is R06 ([task 1993](https://builders.example.com#/task/1993)). Builds on the API-prefix chokepoint ([`src/gds/api-prefix.js`](../../src/gds/api-prefix.js), task 1918/1919), the self-describing OpenAPI + hosted `/docs` ([ADR 0109](0109-self-describing-openapi-and-hosted-docs.md)), and the docs-discovery contract ([ADR 0114](0114-instance-docs-discovery-contract.md)).
+**Context:** [task 1992](https://builders.example.com#/task/1992) (BONGOS-V1, goal 36 "Robust, versioned, easy-to-call public API", criterion `api-versioning`). This is the **policy**; the mount + aliasing that implements it is R06 ([task 1993](https://builders.example.com#/task/1993)). Builds on the API-prefix chokepoint ([`src/bongos/api-prefix.js`](../../src/bongos/api-prefix.js), task 1918/1919), the self-describing OpenAPI + hosted `/docs` ([ADR 0109](0109-self-describing-openapi-and-hosted-docs.md)), and the docs-discovery contract ([ADR 0114](0114-instance-docs-discovery-contract.md)).
 
 ## Problem
 

package/docs/module-api-changelog.md

@@ -2114,5 +2114,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.818 with no explicit bump. run 35206448426. (task 1002620)
   1.19.820 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.819 with no explicit bump. run 35209838815. (task 1002620)
+  1.19.821 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.820 with no explicit bump. run 35212866365. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/multi-builder-merge.md

@@ -14,7 +14,7 @@ This recipe is the audit deliverable for [#269](https://example.com/builders#/ta
 - **Claim side is already deterministic.** `claimTask()` runs in a single transaction with `SELECT … FOR UPDATE` on the task row, a touches-overlap check, and the `uniq_active_claim_per_task` partial unique index. A lost race surfaces as `ALREADY_CLAIMED` (Postgres `23505`), never as corruption. No change needed.
 - **Merge side is the risk, and it has ONE shared resource:** the single `main` worktree (`REPO_ROOT`) on the build machine. Every ship's auto-merge and every `/merge-mode` run checks out `main`, fetches, merges, pushes, and deploys *there*.
 - **[#462](https://example.com/builders#/task/462) (criterion C4)** added a lockfile so two concurrent **ships** couldn't collide — but the lock lived *inside* `ship.js`, so `/merge-mode` (which mutates the same tree by hand) never took it. That left two races open: **ship-vs-merge-mode** and **merge-mode-vs-merge-mode**.
-- **[#269](https://example.com/builders#/task/269) (this task)** extracts the lock into [`src/bongos/merge-lock.js`](../../src/bongos/merge-lock.js) and has **both** surfaces acquire the **same** mutex. `/merge-mode` takes it via the [`scripts/gds/merge-lock.js`](../../scripts/gds/merge-lock.js) CLI before it touches `main`, and releases it after deploy.
+- **[#269](https://example.com/builders#/task/269) (this task)** extracts the lock into [`modules/lifecycle/merge-lock.js`](../../modules/lifecycle/merge-lock.js) and has **both** surfaces acquire the **same** mutex. `/merge-mode` takes it via the [`scripts/gds/merge-lock.js`](../../scripts/gds/merge-lock.js) CLI before it touches `main`, and releases it after deploy.
 
 ---
 
@@ -48,7 +48,7 @@ This recipe is the audit deliverable for [#269](https://example.com/builders#/ta
 
 ## The mutex, precisely
 
-[`src/bongos/merge-lock.js`](../../src/bongos/merge-lock.js) is a portable, advisory file lock at `<REPO_ROOT>/.git/otb-automerge.lock`. **Not `flock(2)`** — ships run on macOS over an iCloud-synced filesystem where `flock` is unreliable, and the manual `/merge-mode` holder is a short-lived CLI process with no long-lived owner.
+[`modules/lifecycle/merge-lock.js`](../../modules/lifecycle/merge-lock.js) is a portable, advisory file lock at `<REPO_ROOT>/.git/otb-automerge.lock`. **Not `flock(2)`** — ships run on macOS over an iCloud-synced filesystem where `flock` is unreliable, and the manual `/merge-mode` holder is a short-lived CLI process with no long-lived owner.
 
 Lockfile format (3 lines): `pid` · `epoch-ms timestamp` · `mode` (`auto` | `manual`).
 

package/docs/recipes/search-index-ingestion.md

@@ -2,11 +2,11 @@
 
 How the `search_chunks` index (the recall layer, [ADR 0060](../adr/0060-gds-retrieval-layer.md)) gets populated from repo markdown, and how to operate it. Read before touching `scripts/gds/search-ingest-md.js` or the deploy hook.
 
-> The query side is [`src/bongos/search.js`](../../src/bongos/search.js) + [`POST /api/gds/search`](../../src/bongos/routes/search.js) ([#949](https://example.com/builders#/task/949)); rank/owner scoping + its isolation suite are [#950](https://example.com/builders#/task/950). Ingestion has two halves: **repo markdown** (this recipe's first sections — [#947](https://example.com/builders#/task/947), the deploy hook) and **DB prose** (the [DB-prose nightly](#db-prose-nightly-timer) section below — [#948](https://example.com/builders#/task/948), a systemd timer).
+> The query side is [`modules/memory/search.js`](../../modules/memory/search.js) + [`POST /api/gds/search`](../../modules/memory/routes/search.js) ([#949](https://example.com/builders#/task/949)); rank/owner scoping + its isolation suite are [#950](https://example.com/builders#/task/950). Ingestion has two halves: **repo markdown** (this recipe's first sections — [#947](https://example.com/builders#/task/947), the deploy hook) and **DB prose** (the [DB-prose nightly](#db-prose-nightly-timer) section below — [#948](https://example.com/builders#/task/948), a systemd timer).
 
 ## What it does
 
-`node scripts/gds/search-ingest-md.js` walks the repo's markdown (~226 files), chunks each file via the heading-aware chunker ([`src/bongos/search-chunker.js`](../../src/bongos/search-chunker.js)), and upserts the chunks into `search_chunks`:
+`node scripts/gds/search-ingest-md.js` walks the repo's markdown (~226 files), chunks each file via the heading-aware chunker ([`modules/memory/search-chunker.js`](../../modules/memory/search-chunker.js)), and upserts the chunks into `search_chunks`:
 
 - **Delta-driven.** Each chunk's `content_hash` (sha256 of its body) is the change key. The upsert's `ON CONFLICT … DO UPDATE … WHERE content_hash IS DISTINCT FROM EXCLUDED.content_hash` makes an unchanged chunk a **no-op** (no row rewrite). A re-run over an unchanged tree writes nothing.
 - **Prunes shrinkage.** If a file loses sections, chunks beyond the new count are deleted; if a file is removed from the tree entirely, all its chunks are deleted (`source_kind='doc' AND source_ref NOT IN (present)`).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.820",
+  "version": "1.19.821",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.820",
+      "version": "1.19.821",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.820",
+  "version": "1.19.821",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.820'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.821'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');