@bongos/core 1.19.972 → 1.19.974

package/docs/adr/README.md

@@ -418,3 +418,4 @@ This keeps the decision history honest and traceable.
 | 0324 | [**The public npm CLI channel is retired** ([task 1004144](https://cloudbongos.com/builders#/task/1004144), goal 1000091 — BONGOS-V2). The owner deleted `@cloudbongos/cli` from the registry on 2026-09-22 (`npm view` → E404; the `@cloudbongos` scope is empty). This supersedes [ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) and [ADR 0292](0292-both-install-paths-stay-and-vendoring-is-the-production-one.md) §2 — the latter titled "`@cloudbongos/cli` STAYS, on a new justification" and written *because* task 1003872 proposed removing it once the public core flip dissolved its original reason. 0292's measured argument (~0.5 MB front door vs a 46 MB core pull to print a task list) is still true and is NOT what changed; the owner's decision about carrying a public channel at all is. `scripts/gds/build-cli-package.js` + `tests/cli_package.mjs` are deleted, no doc offers `npx @cloudbongos/cli`, and the way in is the hall at `<origin>/builders` or a checkout. The COMPILED binary channel (`build-bongos.js` → `/downloads/bongos/*` via `config/bongos-cli.json`) is a different artifact and is untouched — the same near-twin task 1003889 warned about. Three tests used the package's FILES manifest as a stand-in for "what a terminal user can run" and now read `bin/bongos.js`'s verb table, which is what that set always meant.](0324-the-public-npm-cli-channel-is-retired.md) | distribution / CLI |
 | 0325 | [**The managed fleet control plane is the hub we already run** ([task 1001948](https://cloudbongos.com/builders#/task/1001948), goal 1000106 — BONGOS-V2). The spike was written against [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7, which deferred the managed offering as **"genuinely greenfield (no fleet registry exists)"** behind two gates — Mercury and a real `bongos upgrade`. Both gates are shipped and **the premise is not**: measuring the call sites first changed the answer, as it did for [task 1004141](https://cloudbongos.com/builders#/task/1004141). The registry is `provisioning_instances` (owner, shape, domain, database, port, lifecycle, cost estimate, module selection, the liveness overlay and the served/available core-version snapshot), with `provisioning_intents` as the queue and `provisioning_events` as the audit trail; the operator is `scripts/gds/provision.js`, the single token-holder draining that queue behind ADR 0111 §2's trust boundary; oversight is `GET /provisioning/fleet` and `/fleet/cost-ledger`; and the update channel is not one mechanism but two shipped ones — the owner's per-instance deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md), health-gated with auto-rollback) and the opt-in patch-only sweep ([ADR 0136](0136-update-channel-subscription-policy.md)). **Decision: there is no greenfield fleet control plane to design, and none will be built — the hub IS it.** It never needed to sit *above* the per-repo databases [ADR 0100](0100-two-repo-instance-model.md) §3 locks: the roster is a hub table and the operator has never read one. The genuinely missing leg is a **platform leg** — `grep -rl RENDER_API scripts modules src` returns nothing, and after [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) a `cloud-host` is a Render service — and this ADR **deliberately specifies none of it**, because that is [task 1004142](https://cloudbongos.com/builders#/task/1004142)'s with those files open and a second spec for one implementation is how two drift. The fleet **driven** and the fleet **observed** are different populations: `byo-host` is in the registry and operated by nobody, its liveness the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull, so every operator surface must state which it counts — a roster that mixes them reports a fleet-wide upgrade as complete while an unknown number were never asked. The operator holds **exactly one** credential and it is **its own** (the platform account token, root-only on the control plane, never the web tier, never per-customer); ADR 0323 D6's "names, never values" rule is about the CUSTOMER's secrets and is unchanged. Two gaps are filed rather than fixed here: the subscription roster living in `config/update-subscriptions.json` is the one fleet fact the roster route cannot report and a restored backup can lose independently of the rows it describes ([task 1004150](https://cloudbongos.com/builders#/task/1004150), a recommendation and not a ruling), and **`costEstimateUsd` returns 0 for every shape but `dedicated`** — measured live, all 24 fleet rows report `$0`, confidently and with no error, for projects about to cost ~\$14/month each ([task 1004148](https://cloudbongos.com/builders#/task/1004148)). **No fleet-wide "upgrade everything" button**: both channels are per-instance by construction, and one action that moves the whole fleet is the shape most likely to take every customer down at once. AGPL posture unchanged — ADR 0111 §5's one-sentence rule survives its own table. Rejected: building the separate control plane §5 described (a second registry and a second operator holding the same rows with nothing keeping them equal); specifying Render here; reading per-instance databases for fleet reporting; and continuing to defer the whole layer, which is now the reason the ledger reads \$0 for a fleet about to cost real money.](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) | hosting / fleet / provisioning |
 | 0326 | [**An upgrade may ADD a deny rule to a file the instance owns** ([task 1004156](https://cloudbongos.com/builders#/task/1004156), goal 1000090 — BONGOS-V2). Task 1003966 gave the instance starter its deny rules — no reading `.env` files, keys or session tokens, no shelving with the repo-global stash — and they reached **nobody who was already here**. The starter is written only when `.claude/settings.json` is ABSENT, and `bongos upgrade` materializes from the published package, which excludes that file on purpose; so an upgrade always takes the starter branch, always finds a settings.json already there, and left it alone. Every instance on the allow-only starter from task 1003962 — the live one included — kept it forever. That was deliberate ("rewriting a file the instance owns is the line task 1003962 drew"), and the recorded remedy was manual: re-run `bongos init`, or delete the file. **A manual remedy for a security gap protects the instances whose owners read release notes, which is not the set that needs protecting.** The owner's call: ADD the missing deny rules and NAME each one in the run output. The argument is that a deny rule is **monotonic in the safe direction** — an allow rule widens what the local agent may do, a deny rule can only narrow, so appending one cannot make any instance less safe than it was a moment earlier. That is what makes this the one merge worth doing without asking per-instance, and it extends [ADR 0121](0121-greenfield-vs-brownfield-onboarding-adopt-existing-repo.md) §2's already-licensed "merge OR leave-and-report" from `--adopt` to every materialize. "Never clobber" survives in the sense that was load-bearing: **nothing the instance wrote is removed, reordered or rewritten** — their allow rules, own denies, `ask` list, hooks, env and every key outside `permissions` come back exactly as they were, with new rules appended after. Deliberately NOT done: **no provenance**, so an owner who deletes a rule we add gets it back next upgrade and (deny beating allow in Claude Code's order) cannot override it with an allow — rejected as speculative machinery for a case nobody has hit, revisit on a real complaint; a file that will not parse, or whose `permissions`/`permissions.deny` is not the expected shape, is left BYTE-FOR-BYTE alone and reported, the posture task 1004023 took for the core's own file, because a half-understood rewrite of a permissions file is worse than the gap; and **the allow half is never topped up** — the safety argument is directionality and does not survive being applied to a rule that grants. `materializeClaude` gains `summary.settingsDenyAdded` + `settingsDenyUncheckable`, both printed through `log()` since `upgrade.js` does not iterate `summary.notes`. The test asserting an instance's settings.json comes back byte-identical is superseded by a strictly stronger one — every rule still there, unmoved, deny-only growth — the weaker spelling being what froze the gap in place. **AMENDED 2026-09-22 by [task 1004158](https://cloudbongos.com/builders#/task/1004158): the two shelf rules are now starter-only and the top-up asks for the CREDENTIAL half alone.** 0326 itself named this exclusion as the remedy if the rule ever bit; the owner took it ahead of that, because the monotonicity argument licenses a rule about reading a secret and does not reach one that guards a workflow — with no provenance and deny beating allow, an instance that loses the shelf cannot give it back. A fresh instance still gets both. The top-up only ever appends, so this is **forward-looking only**: an instance that already took them keeps them, live included.](0326-an-upgrade-may-add-a-deny-rule-to-a-file-the-instance-owns.md) | security / instance onboarding |
+| 0327 | [**A `cloud-host` runs on the owner's own account, and the key is borrowed, not stored** ([task 1004175](https://cloudbongos.com/builders#/task/1004175), goal 1000106 — BONGOS-V2). [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) moved a `cloud-host` to Render to stop being a landlord but left **whose account** unexamined; [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §4 then ruled the platform token is ours and "never per-customer". Standing it up disproved the premise: a Render API key is issued against a **user** and carries their rights in **every workspace they belong to** — the owner's reached three, one of them another builder's, holding their live production. The same check found `mercury` **already on Render**, run by its own owner, which 0323 would have migrated OFF a correct setup onto our bill. The remaining landlord relationship was never the servers; it was the **account**. **Decisions:** (1) each project brings its own platform key — we hold no billing relationship for anyone's compute, and a leaked key's blast radius is exactly its own owner's account, a property that comes from the decision and not from cryptography; (2) the key is **borrowed for standup and cleared**, never stored, because nothing afterwards needs it — Render auto-deploys from Git, the deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md)) is a push, liveness is the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull — so it rides the queue as a short-lived value encrypted with the existing `secret-box.js`, the [ADR 0133](0133-github-app-manifest-onboarding-signin.md) handshake's shape; (3) we **never destroy a customer's infrastructure** — teardown disconnects, the owner deletes their own services, a safety property first and the reason (2) works; (4) **two shapes, not three** (`dedicated-cloud-host` removed — on someone's own account a bigger plan is a setting, finishing 0323 §1's own "plan size, not a second code path"), and the **free tier is free**, 0323 §7's cap retired with its premise. **Deliberately NOT built, because nothing is stored:** an asymmetric sealing module, per-row credential binding, rotation/revocation, and the separate-unix-user precondition — each designed in full, then deleted when the retention question was asked instead of assumed. **Stated honestly:** encrypting the in-transit value protects it from a database dump, NOT from a compromised web tier, because the owner's key arrives there in plaintext first; that defence was never available at any retention length. **§5 records a measurement, fixed elsewhere:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §2's boundary is enforced by the CODE, not the kernel — `cloudbongos.service` runs `User=lars` with no sandboxing and `/etc/cloudbongos/box.env` is mode 600 owned by `lars`, so the web tier CAN read the DigitalOcean, Cloudflare and platform tokens; 0325 §4's "root-only" is not what is on the box. (A second finding in the same section — a "mode 777" key file — was **void and is corrected in place**: the path is a symlink, whose mode display is meaningless, to a 600 target. It was inferred from an `ls` rather than an attempted read.) **Resolved 2026-09-23 by [task 1004176](https://cloudbongos.com/builders#/task/1004176)**, and more narrowly than §5 proposed — not the unix split (which would mean relocating the checkout, config dir, `web.env` and the secret-box master key the web tier legitimately needs), but a systemd drop-in with `InaccessiblePaths`, verified as the service user; proving it as **root** reports "no effect" against a working config, because `CAP_DAC_OVERRIDE` bypasses the mode-000 over-mount. It is emphatically NOT a precondition here — that is the point of storing nothing, and had we sealed per-project keys with a private key in that same file the two would have had to land together. **Consequences:** the migration shrinks to an **adoption**; the cost ledger's question inverts (our spend on a `cloud-host` is ~\$0 and correct — what an owner is worth telling is THEIR Render cost, a different column, [task 1004148](https://cloudbongos.com/builders#/task/1004148)); and metering loses its forcing function, cost *visibility* surviving as a feature while billing for hosting does not ([task 1001949](https://cloudbongos.com/builders#/task/1001949)). Rejected: storing each key sealed with a key pair (three days plus a live-site infra change, to keep a value needed once); one platform account holding every project (0325 §4 as written — keeps us the billing landlord and makes one credential reach every customer); generating a Blueprint and having the owner click once in Render (simplest, but the click is the exact friction `cloud-host` exists to remove); and keeping the key in the browser to call Render directly (standup is a runner job with retries and an audit trail, not a page that stays open).](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) | hosting / provisioning / credentials |

package/docs/architecture.md

@@ -2,7 +2,7 @@
 
 > Split out of `CLAUDE.md` §10 in V3.R86 ([#305](https://example.com/builders#/task/305)) to keep the agent index lean. `CLAUDE.md` §10 now
 > carries a one-paragraph orientation and points here. This file is **descriptive** — for live Bongos
-> state (tasks, versions, claims, ranks) the source of truth is the database via `/api/gds/*`, and
+> state (tasks, versions, claims, ranks) the source of truth is the database via `/api/bongos/*`, and
 > for permissions specifically see [`docs/canonical-permissions.md`](canonical-permissions.md).
 
 > **For decision rationale (why we chose what), read [`docs/adr/`](adr/). The most relevant: 0001 (stack), 0002 (DigitalOcean), 0003 (Cloudflare cert), 0006 (singleton WorldRoom + queue), 0007 (persistent identity), 0008 (Google Chat OAuth), 0010 (Bongos architecture), 0016 (trust boundary).**
@@ -217,10 +217,10 @@ audit_log(id, builder_id, route, method CHECK IN (POST|PATCH|PUT|DELETE),
 
 Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again in 014 so the new `discipline` column flows through), `version_progress` (rebuilt in 006 to count only leaf tasks for forward-compat with task hierarchy), `tasks_session_fit` (new in 006: derives `fits_session_modes[]` and `credits_per_minute`; rebuilt in 014 for the same SELECT t.* refresh), `task_grades_with_context` (new in 016: joins task_grades × tasks × builders × cost_log so the V4 optimizer has quality-per-dollar in one read).
 
-**Bongos API (`/api/gds/*`, mounted in the same Node process):**
+**Bongos API (`/api/bongos/*`, mounted in the same Node process):**
 
 - **Canonical path is `/api/bongos` (task 1919); `/api/gds` is a PERMANENT alias.** The router + the discovery index are dual-mounted at both by `serve-internal.js`, driven by the single `src/bongos/api-prefix.js` constant (`API_PREFIX` + `LEGACY_API_PREFIXES`). The legacy `/api/gds` alias never goes away — shipped Dev Box binaries, the cached status mirror, and live boxes call it. **Exception:** the GitHub OAuth callback stays pinned to `/api/gds/auth/web/callback` (registered on the OAuth app; `src/bongos/routes/auth.js`). Not yet flipped (still ride the permanent alias): `src/**` internal callers + the deeper internal names (folders, `GDS_*` env, `gds_session` cookie) — the deferred internal-rename pass.
-- **Self-describing (task 1918, [ADR 0109](adr/0109-self-describing-openapi-and-hosted-docs.md)).** The whole surface is documented in the standard **OpenAPI 3.1** format at [`docs/api/openapi.json`](api/openapi.json), **generated from the live route files** by `scripts/gds/gen-api-docs.js` (reusing the same `route-rank-check.js` introspection the ship-time rank gate uses — so it can't drift; a fitness `--check` + ship-time regen enforce freshness). A rendered docs site (vendored Redoc) is served at **`/docs`** on the apex of every instance (`cloudbongos.com/docs` canonical); `GET /api/gds` returns a machine-discovery index pointing at it. The generated [`docs/api-reference.md`](api-reference.md) supersedes the old hand-maintained `routes-permissions.md`. The mount prefix is the single `src/bongos/api-prefix.js` constant.
+- **Self-describing (task 1918, [ADR 0109](adr/0109-self-describing-openapi-and-hosted-docs.md)).** The whole surface is documented in the standard **OpenAPI 3.1** format at [`docs/api/openapi.json`](api/openapi.json), **generated from the live route files** by `scripts/gds/gen-api-docs.js` (reusing the same `route-rank-check.js` introspection the ship-time rank gate uses — so it can't drift; a fitness `--check` + ship-time regen enforce freshness). A rendered docs site (vendored Redoc) is served at **`/docs`** on the apex of every instance (`cloudbongos.com/docs` canonical); `GET /api/bongos` returns a machine-discovery index pointing at it. The generated [`docs/api-reference.md`](api-reference.md) supersedes the old hand-maintained `routes-permissions.md`. The mount prefix is the single `src/bongos/api-prefix.js` constant.
 
 - Auth: `POST /auth/device/start`, `/poll` (CLI Device Flow); `GET /auth/web/start`, `/web/callback` (browser); `POST /auth/logout`; app pairing for the Dev Box desktop app ([#904](https://example.com/builders#/task/904), [ADR 0045](adr/0045-devbox-desktop-app.md), store [`src/bongos/app-pair.js`](../src/bongos/app-pair.js) — in-memory, 10-min TTL): `POST /auth/app-pair/start` + `/poll` (public; the secret poll_token is the bearer and the minted token is delivered to it exactly once), `GET /auth/app-pair/info` + `POST /auth/app-pair/approve` (any-builder; approve is **cookie-gated** like `/auth/cli-token/issue` so a leaked bearer can't mint siblings; approving from `/builders/pair?code=…` signs the app in as the approver, `source='cli'`).
 - Own-scoped session self-service ([ADR 0206](adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md), task 1003341), in [`src/bongos/routes/my-sessions.js`](../src/bongos/routes/my-sessions.js): `GET /me/sessions` (every live session on the caller's own account — source, user agent, created/last-used/expires, a `current` flag; the token value is never selected), `POST /me/sessions/revoke` (`{session_id}` — one of your own; a miss answers `revoked: 0` so a stranger's id cannot be probed) and `POST /me/sessions/revoke-all` (sign out everywhere, the requesting session included). All three gate on `requireBuilder` alone and key every statement on `req.builder.id` — an account is never named in the query, body or path. They exist because a bearer refreshes to `now()+24h` on every call, so a leaked one never expires, and the cross-builder pair (`POST /auth/revoke`, `/auth/revoke-all`, both still gated on the admin `auth.session.revoke` atom) needed an Archon the victim might not have. Surfaced in the hall at Settings → Active sessions.
@@ -232,7 +232,7 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 - Builder memory (ADR 0024 cloneable memory + ADR 0026 BFG). Self-scoped (owner is always `req.builder.id`, never input): `POST /memory/sync` (push own memory; own 64 MB parser, vs the global 64 KB), `GET /memory/files`, `GET /memory/file`, `DELETE /memory/file` (the BFG delete affordance, 6C.2). Cross-builder (input-owner) endpoints — all privileged + audit-logged fail-closed: `GET /memory/builders/:id/files`+`/file` (**archon forensic** read), `GET /memory/bfg/builders/:id/files`+`/file` (**BFG-principal only**, 6B.1 read), and the one cross-builder WRITE `POST /memory/builders/:id/bfg-write` (**BFG-principal only**, kill-switched `BFG_WRITE_ENABLED` default-OFF, namespaced `bfg/`, attributed `author: BFG`, write+audit in one tx — dreams + transparent corrections, 6C.1/6C.2).
 - Session corpus (BFG evaluator — 6D, ADR 0027): `POST /sessions` (upload own session digest; own **4 MB** json parser — capped, vs the global 64 KB — and the digest is per-turn metadata + short scrubbed snippets, never raw transcript content), `GET /sessions/mine` (self-serve), `GET /sessions/search` (cross-builder, **archon-gated** — the BFG-principal stand-in; the principal now exists (6C.1) and the *memory* cross-reads moved to it (6B.1), but these *session* reads still use the archon stand-in pending a retrofit, + audit_log row per read), `GET /sessions/:id` (own self-serve; cross-builder needs archon + audit; non-owner → 404).
 - Public (no auth, `Cache-Control: max-age=60`): `/public/versions`, `/public/progress`, `/public/cost-summary`, `/public/recent-shipped`, `/public/leaderboard`, `/public/grades[?days=N]`, `/public/tasks/:id` ([#604](https://example.com/builders#/task/604) — single-task resolver for `#NNN` doc deep-links; `title`/`value_summary`/`visual_url` returned **only** for `shipped`|`confirmed` work and withheld for in-flight tasks so unshipped/security task names can't leak; the status dashboard renders it at `#/task/:id`), `/public/ref-ids` ([#653](https://example.com/builders#/task/653) — `{tasks:[ids]}`, ids only, token-free; the doc-ref linkifier + its CI gate consult it to decide which bare `#NNN` are real task refs). These power `status.example.com`.
-- Live updates (Server-Sent Events — [#569](https://example.com/builders#/task/569), [ADR 0030](adr/0030-builders-hall-live-updates.md) signal layer, [ADR 0069](adr/0069-hall-live-channel-sse-decouple.md) transport): an SSE stream at `GET /api/gds/live` ([`src/bongos/routes/live.js`](../src/bongos/routes/live.js)), mounted in both entrypoints (`server.js` + `src/platform-server.js`) so the hall stays live on a game-less boot. This **superseded** the original broadcast-only Colyseus `builders_hall` room (R55 / task 1194 — the room and `src/rooms/BuildersHallRoom.js` were deleted because a Bongos-only instance has no Colyseus in the process). The change-signal layer is **unchanged**: a statement-level Postgres `NOTIFY` trigger (migration 066) on `tasks`/`claims`/`builders`/`builder_onboarding_state`/`credit_log`/`karma_log` fires a `gds_live` notification on every write (incl. direct `psql`); one persistent `LISTEN` connection ([`src/bongos/live-channel.js`](../src/bongos/live-channel.js)) relays each notification, and the SSE endpoint emits an **opaque empty nudge** to open hall tabs (the `{table, op}` is kept server-side so internal table names can't leak); the hall re-runs its `loadAll()` (debounced) on any nudge. No row data crosses the channel — access control stays on the per-panel re-fetches.
+- Live updates (Server-Sent Events — [#569](https://example.com/builders#/task/569), [ADR 0030](adr/0030-builders-hall-live-updates.md) signal layer, [ADR 0069](adr/0069-hall-live-channel-sse-decouple.md) transport): an SSE stream at `GET /api/bongos/live` ([`src/bongos/routes/live.js`](../src/bongos/routes/live.js)), mounted in both entrypoints (`server.js` + `src/platform-server.js`) so the hall stays live on a game-less boot. This **superseded** the original broadcast-only Colyseus `builders_hall` room (R55 / task 1194 — the room and `src/rooms/BuildersHallRoom.js` were deleted because a Bongos-only instance has no Colyseus in the process). The change-signal layer is **unchanged**: a statement-level Postgres `NOTIFY` trigger (migration 066) on `tasks`/`claims`/`builders`/`builder_onboarding_state`/`credit_log`/`karma_log` fires a `gds_live` notification on every write (incl. direct `psql`); one persistent `LISTEN` connection ([`src/bongos/live-channel.js`](../src/bongos/live-channel.js)) relays each notification, and the SSE endpoint emits an **opaque empty nudge** to open hall tabs (the `{table, op}` is kept server-side so internal table names can't leak); the hall re-runs its `loadAll()` (debounced) on any nudge. No row data crosses the channel — access control stays on the per-panel re-fetches.
 
 **Builder ranks & the trust boundary:** moved to its own canonical reference —
 [`docs/canonical-permissions.md`](canonical-permissions.md) (rank ladder, live ranks, what's gated,
@@ -246,9 +246,9 @@ markdown describes, the DB enforces.**
 
 - **the apex root itself** — the public front door (`/`, `/projects`, `/create`, `/privacy`, `/terms`, `/contact`). **Carved to the `public-landing` module in task 1003322** ([ADR 0218](adr/0218-the-apex-root-web-surface.md)): the surface moved from repo-root `public-landing/` to `modules/public-landing/public/` and is a loader-discovered web-surface module — the THIRD, and the first that is not a subdomain. Where `hall-ui`/`status-ui` declare a Host PREFIX, this one declares `{ apexRoot: true, dir }`, because the apex is whatever host is left once the subdomains are taken (`isApexHost` = `!isStatusHost && !isBuildersHost`); `host: ""` is rejected, since `host.startsWith("")` is true for every host and would swallow the other two surfaces. Like the hall it keeps its **dedicated** serving block — in `src/platform-server.js`, now resolving its root through `moduleWebSurfaces()` by the `apexRoot` predicate rather than a hardcoded path — so the apex-only sentinel strip, the brand-token stamp and the `?v=` content stamp are unchanged. Disable the module and the front door vanishes: every route falls through to the game-less 404 tail. Served bytes are identical across the carve apart from the module's own `window.__MODULES__` entry.
 - **`example.com`** — game (Phaser + Colyseus). Static files from `public/`. `/builders` + `/builders/*` now **301-redirect to `builders.example.com/<rest>`** ([#739](https://example.com/builders#/task/739) then promoted to permanent 301 in [#741](https://example.com/builders#/task/741), ADR 0036 cutover); the apex no longer serves the builder surface directly.
-- **`status.example.com`** — public build dashboard. **Carved to the `status-ui` module in BV1.R84** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1): the surface moved from `public-status/` to `modules/status-ui/public/`, now served by the loader's web-surface seam (`moduleWebSurfaces` → `serve-internal.js`, routed on the `status.` Host prefix the manifest declares) instead of a hardcoded block — no behavior change. Layout reorganized in [#726](https://example.com/builders#/task/726) (ADR 0036): Pulse / Watch(uptime) / Architects / Works / Treasury / Lately Inscribed / The World — the grade-aggregate, estimation-drift, and repo-health tablets moved to the Archon `/watch` page. **⚠ Served OFF the droplet** (ADR 0029, outage resilience): the live page is **GitHub Pages from the separate repo `example-owner/example-status`** (CNAME → Fastly), reading data cross-origin from the droplet's `/api/gds/public/*` (CORS open) and an availability banner from the prober's `status-data` branch. The droplet still serves `modules/status-ui/public/` (on the `status.` host) as a same-origin fallback, but **DNS points at Pages, not the droplet** — so a droplet deploy does NOT update the live page. Changes to the surface publish to the mirror via `scripts/status-mirror-sync.js` (re-pointed at `modules/status-ui/public/`; status.js/style.css/cursors are byte-identical copies; index.html gets the off-box bits injected), run automatically by `.github/workflows/sync-status-mirror.yml` (needs the `STATUS_MIRROR_TOKEN` secret) ([#737](https://example.com/builders#/task/737)). **⚠ FOLLOW-UP (R84):** that workflow's path trigger still watches `public-status/**` and must be re-pointed at `modules/status-ui/public/**` by an owner/Archon — the GitHub App can't push `.github/workflows/*` (learning 107), so until then the mirror sync won't auto-fire on future status edits.
+- **`status.example.com`** — public build dashboard. **Carved to the `status-ui` module in BV1.R84** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1): the surface moved from `public-status/` to `modules/status-ui/public/`, now served by the loader's web-surface seam (`moduleWebSurfaces` → `serve-internal.js`, routed on the `status.` Host prefix the manifest declares) instead of a hardcoded block — no behavior change. Layout reorganized in [#726](https://example.com/builders#/task/726) (ADR 0036): Pulse / Watch(uptime) / Architects / Works / Treasury / Lately Inscribed / The World — the grade-aggregate, estimation-drift, and repo-health tablets moved to the Archon `/watch` page. **⚠ Served OFF the droplet** (ADR 0029, outage resilience): the live page is **GitHub Pages from the separate repo `example-owner/example-status`** (CNAME → Fastly), reading data cross-origin from the droplet's `/api/bongos/public/*` (CORS open) and an availability banner from the prober's `status-data` branch. The droplet still serves `modules/status-ui/public/` (on the `status.` host) as a same-origin fallback, but **DNS points at Pages, not the droplet** — so a droplet deploy does NOT update the live page. Changes to the surface publish to the mirror via `scripts/status-mirror-sync.js` (re-pointed at `modules/status-ui/public/`; status.js/style.css/cursors are byte-identical copies; index.html gets the off-box bits injected), run automatically by `.github/workflows/sync-status-mirror.yml` (needs the `STATUS_MIRROR_TOKEN` secret) ([#737](https://example.com/builders#/task/737)). **⚠ FOLLOW-UP (R84):** that workflow's path trigger still watches `public-status/**` and must be re-pointed at `modules/status-ui/public/**` by an owner/Archon — the GitHub App can't push `.github/workflows/*` (learning 107), so until then the mirror sync won't auto-fire on future status edits.
 - **`builders.example.com`** — dedicated builder surface (`isBuildersHost`, ADR 0036). **Carved to the `hall-ui` module in BV1.R85** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1): the surface moved from `public-builders/` to `modules/hall-ui/public/` (~13k LOC, the largest module) and is a loader-discovered web-surface module (`contributes.webSurfaces` host `builders.`). UNLIKE the generic status surface it keeps its **dedicated** serving block in `serve-internal.js` (`BUILDERS_DIR = modules/hall-ui/public/`), partitioned out of the generic web-surface loop on the `isBuildersHost` predicate. A thin rewrite shim maps every non-API path onto the existing `/builders/*` tree (so all serving + gating + asset-stamping is reused), serving the hall (`/`), the Metic+ **`/watch`** monitoring page (gated by `requireGovernmentPage`), **`/settings`** (Voices + Craft prefs), plus ranks/sessions/primer/diagrams. No behavior change — byte-identical (only `window.__MODULES__.enabled` gains `hall-ui:true`). **Additive** — until its DNS A record + cert are live, the whole surface stays reachable at `example.com/builders/*`. No `.github/workflows/*` follow-up: unlike R84, no workflow path-trigger watches `public-builders/**`.
-- The `/api/gds/*` surface is reachable from every host. **Cross-subdomain sign-in:** the `gds_session` cookie is scoped to `.example.com` on the production hosts (apex/www/builders/status) and host-only on localhost/staging (no cross-env token bleed); the OAuth handshake runs on the canonical origin with a validated `?return=` (open-redirect-guarded) so the subdomain can land a builder back on itself.
+- The `/api/bongos/*` surface is reachable from every host. **Cross-subdomain sign-in:** the `gds_session` cookie is scoped to `.example.com` on the production hosts (apex/www/builders/status) and host-only on localhost/staging (no cross-env token bleed); the OAuth handshake runs on the canonical origin with a validated `?return=` (open-redirect-guarded) so the subdomain can land a builder back on itself.
 - Caddy gets a site block per host (`infra/Caddyfile` (instance-side)), all reverse-proxying to `127.0.0.1:3000`.
 
 **Asset cache-busting (content-hash `?v=`, task [#521](https://example.com/builders#/task/521)).** The hall + status HTML pages (`modules/hall-ui/public/*.html`, `modules/status-ui/public/index.html`) are served from an **in-memory stamped copy**, not straight off disk: at boot [`src/asset-version.js`](../src/asset-version.js) rewrites each local css/js ref's `?v=` query to a 12-hex hash of the referenced file's content (`buildStampedHtml`). The on-disk HTML keeps a hand-typed `?v=` only as a fallback. This is the durable fix for stale-asset serving — Cloudflare overrides the origin's `max-age=60` with a **4h browser TTL** for js/css, so before this, editing `builders.js` without manually bumping its `?v=` left every returning browser (and CF's edge) serving pre-deploy bytes for hours. Now any content change → new hash → new URL → fetched fresh automatically. HTML pages stay short-cached (CF serves them DYNAMIC), so the new `?v=` reaches clients within ~60s. Assets and non-HTML paths still fall through to `express.static`; the sign-in gate on primer/diagrams runs before the stamped serving.

package/docs/branding-contract.md

@@ -61,7 +61,7 @@ Tests drive the pure resolver with injected objects (no I/O): `resolveBranding({
 The browser never sees the full pack — only the **client-safe projection** `clientBranding()` (a small allow-list — `{ identity, currency, theme, copy, rankLabels }`; origins, repo, db name, `llmProjectName`, and env prefix stay server-side). It reaches the front-end two ways:
 
 - **On-box (hall + status served from the droplet):** injected synchronously by `mountInternalSurfaces` (`src/bongos/serve-internal.js` → `injectBrandingGlobal`) into the page `<head>` as **`window.__BRANDING__`** (the strings) **plus theme markup** (`themeMarkup` → a `:root` palette/font-var override `<style>`, the web-font `<link>`s, and the favicon `<link>`). The `<style>` lands after the page's own stylesheet so the pack wins. No fetch, no flash-of-default.
-- **Off-box (the GitHub-Pages status page):** read cross-origin from **`GET /api/gds/public/branding`**.
+- **Off-box (the GitHub-Pages status page):** read cross-origin from **`GET /api/bongos/public/branding`**.
 
 R56 seeded the projection with the configurable **currency label** (`public-builders/brand-apply.js` fills `[data-currency-label]` / `[data-currency-tmpl]` markup + `window.OTBBranding.currencyLabel()`). R57 widens it to the **LOOK** — `theme.ui` (palette + fonts + favicon; note this is the WEB theme, distinct from the server-only `theme.palette` game pixel-art path) — and the **rank display-label map** (`window.OTB.rankLabel()` reads `rankLabels`; the rank ENUM stays Greek by decision, only the label is presentation). The remaining themed **page copy + identity strings** (titles, ledes, world-flavor copy) are tracked as the R57 copy-pack follow-up.
 

package/docs/canonical-permissions.md

@@ -23,7 +23,7 @@ de-facto permission *state*. `CLAUDE.md` now points here.
 |---|---|---|
 | `builders.rank` (prod DB, migration 023) | **the** source of authority | ✅ yes — the boundary itself |
 | `requireRank()` middleware on each route (`src/bongos/auth.js`) | enforcement point | ✅ yes |
-| `PATCH /api/gds/builders/:id/rank` (Archon-only, task [#232](https://example.com/builders#/task/232) / V3.R07) | the *only* writer of rank | ✅ yes |
+| `PATCH /api/bongos/builders/:id/rank` (Archon-only, task [#232](https://example.com/builders#/task/232) / V3.R07) | the *only* writer of rank | ✅ yes |
 | `CLAUDE.md`, this file, ADRs | **describe** the model for humans/agents | ❌ no — documentation only |
 | `.claude/skills/*`, `.claude/settings.json`, hooks | call server endpoints; cannot grant authority | ❌ no |
 | session token / cookie | identity, not authority (carries no rank) | ❌ no |
@@ -137,11 +137,11 @@ or missing ranks fail closed.
 - **Archon-only** — **rank, identity, and the four escalation keys ([ADR 0157](adr/0157-archon-is-rank-and-identity-only.md), owner decision 2026-08-05).**
   That ADR narrowed Archon from ~50 route gates to 9 live ones, on the rule *"the Archon rank is
   responsible for rank and identity only"*:
-  - **rank** — `PATCH /api/gds/builders/:id/rank` (the single writer).
-  - **identity** — `PATCH /api/gds/builders/:id/status` (offboard/(de)activate), `GET|PATCH /api/gds/access-requests[/:id]`
+  - **rank** — `PATCH /api/bongos/builders/:id/rank` (the single writer).
+  - **identity** — `PATCH /api/bongos/builders/:id/status` (offboard/(de)activate), `GET|PATCH /api/bongos/access-requests[/:id]`
     (who is admitted), `POST /api/gds/auth/revoke[-all]` (whose sessions are valid).
-  - **the four escalation keys**, which look operational but are not: `POST /api/gds/tasks/:id/confirm`
-    (grader-bypass), `POST /api/gds/gate-approvals/:pr/approve` (CI deploy-gate override), protected-module
+  - **the four escalation keys**, which look operational but are not: `POST /api/bongos/tasks/:id/confirm`
+    (grader-bypass), `POST /api/bongos/gate-approvals/:pr/approve` (CI deploy-gate override), protected-module
     **goal scope** ([ADR 0086](adr/0086-goal-scoped-work-hierarchy.md)), and `government.manage` (the
     ranks/permissions tab). Delegating any one of them lets a Metic reach Archon in four steps — create a
     protected-scope goal in the permission core, claim a task there (protected paths already floor at
@@ -149,7 +149,7 @@ or missing ranks fail closed.
     past the failed grade, approve their own red gate — so keeping rank Archon-only depends on keeping
     these Archon-only too. **Any future delegation must re-check that chain.**
   - plus `version.close` (paired with rank as the powers that never delegate), the cross-tier
-    `POST|DELETE /api/gds/dependencies` (`system: true`), and the substrate floors
+    `POST|DELETE /api/bongos/dependencies` (`system: true`), and the substrate floors
     (`deploy.push_main` / `path.protected.modify` / `infra.ssh`, ADR 0043).
 
   > **Amended by [ADR 0172](adr/0172-editable-rank-roles-substrate-axis.md) (owner decision, 2026-08-16).**
@@ -166,14 +166,14 @@ or missing ranks fail closed.
   > so no amount of in-app escalation produces a push to `main`, a protected-path edit, or an ssh session.
   > `builders.rank` remains the only writer of who holds a rank (R95b).
 
-  Earlier one-power delegations that ADR 0157 generalises: **task authoring** — `POST /api/gds/tasks`,
-  `PATCH /api/gds/tasks/:id` (incl. the `newcomer_friendly` flag), `POST /api/gds/tasks/:id/promote`, and the
+  Earlier one-power delegations that ADR 0157 generalises: **task authoring** — `POST /api/bongos/tasks`,
+  `PATCH /api/bongos/tasks/:id` (incl. the `newcomer_friendly` flag), `POST /api/bongos/tasks/:id/promote`, and the
   `tasks/:id/{dependencies,criteria}` CRUD — moved to Metic+ in [ADR 0090](adr/0090-metic-task-authoring.md),
-  and **task retirement** — `POST /api/gds/tasks/:id/abandon`, plus the `abandoned → backlog` restore on
+  and **task retirement** — `POST /api/bongos/tasks/:id/abandon`, plus the `abandoned → backlog` restore on
   `/promote` — in [ADR 0152](adr/0152-metic-task-abandonment.md) (see the Metic+Archon bullet).
 
   > **The ownership axis: a rule about WHOSE row, which no rank can express** ([ADR 0297](adr/0297-a-tasks-creator-may-retire-it.md),
-  > owner request 2026-07-25). `POST /api/gds/tasks/:id/abandon` is the first route decided on the
+  > owner request 2026-07-25). `POST /api/bongos/tasks/:id/abandon` is the first route decided on the
   > [ADR 0151](adr/0151-governance-permissions-as-atom-ranks-as-roles.md) §3 ownership axis, and so the first whose
   > middleware list is deliberately **not** the whole gate. Two authorities reach it:
   >
@@ -198,20 +198,20 @@ or missing ranks fail closed.
   > are untouched for both paths — never a shipped task, never one with an active claim. And a task with
   > `created_by IS NULL` (everything filed before `core_227`, plus the seed/restock/Discord vectors)
   > belongs to **nobody**: the control never appears on it, and no ownership grant can reach it.
-  `POST /api/gds/done-when/:id/unsatisfy` **was** Archon-only and moved to Metic in ADR 0157, superseding
+  `POST /api/bongos/done-when/:id/unsatisfy` **was** Archon-only and moved to Metic in ADR 0157, superseding
   [ADR 0154](adr/0154-goal-owner-criterion-authoring.md)'s "the backward ratchet stays Archon" carve-out;
   satisfy and unsatisfy remain separate permissions, so confirming a criterion still never confers
   un-confirming one. **A manual promotion advances exactly
   ONE live rung at a time** (`xenos→thetes→metic→archon`; [#707](https://example.com/builders#/task/707)) — a multi-rung jump (e.g. `xenos→metic`) returns
   `400 multi_rung_promotion` naming the next allowed rung. Demotions are unconstrained (offboarding
   drops straight to `xenos`); the automatic `xenos→thetes` graduation is +1 and unaffected.
-- **Metic + Archon** — the working rank's review/triage powers ([#360](https://example.com/builders#/task/360) / ADR 0018): `PATCH /api/gds/inbox/:id`
-  (idea triage), `POST /api/gds/blockers/:id/{resolve,link}` (blocker review) — **plus, since
-  [ADR 0090](adr/0090-metic-task-authoring.md), full task authoring**: `POST /api/gds/tasks`,
-  `PATCH /api/gds/tasks/:id`, `POST /api/gds/tasks/:id/promote`, the `tasks/:id/dependencies` +
-  `tasks/:id/criteria` CRUD, and `POST /api/gds/done-when/:id/satisfy` (criterion confirm,
+- **Metic + Archon** — the working rank's review/triage powers ([#360](https://example.com/builders#/task/360) / ADR 0018): `PATCH /api/bongos/inbox/:id`
+  (idea triage), `POST /api/bongos/blockers/:id/{resolve,link}` (blocker review) — **plus, since
+  [ADR 0090](adr/0090-metic-task-authoring.md), full task authoring**: `POST /api/bongos/tasks`,
+  `PATCH /api/bongos/tasks/:id`, `POST /api/bongos/tasks/:id/promote`, the `tasks/:id/dependencies` +
+  `tasks/:id/criteria` CRUD, and `POST /api/bongos/done-when/:id/satisfy` (criterion confirm,
   [ADR 0086](adr/0086-goal-scoped-work-hierarchy.md)). Since
-  [ADR 0154](adr/0154-goal-owner-criterion-authoring.md), also `POST /api/gds/versions/:id/done-when`
+  [ADR 0154](adr/0154-goal-owner-criterion-authoring.md), also `POST /api/bongos/versions/:id/done-when`
   (criterion **create**) — but walled by goal ownership, not by rank alone: a non-Archon must name a
   `goal_id`, on an open (`planning`/`building`) version, in an `open` goal they **own or manage** (the same
   `authorizeGoalManagement` wall as goal visibility/invites/memberships — the membership column is
@@ -224,13 +224,13 @@ or missing ranks fail closed.
   **[ADR 0157](adr/0157-archon-is-rank-and-identity-only.md) added the whole operational block here** —
   20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
   the government/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.government`) and
-  `GET /api/gds/sessions/search` (whose own `/sessions` page had no server gate at all until
+  `GET /api/bongos/sessions/search` (whose own `/sessions` page had no server gate at all until
   task 1002710 put it behind `page.view.government` alongside its three group-mates); the
   **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
   `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
   `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,
   `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD);
-  `GET /api/gds/audit-log`; the **roster reads** (`GET /builders/roster`, `/grades/by-builder`,
+  `GET /api/bongos/audit-log`; the **roster reads** (`GET /builders/roster`, `/grades/by-builder`,
   `/builders/:id/active-claims`); **cross-builder memory reads** (`GET /memory/builders/:id/file[s]`);
   **project curation + scouting**; `PATCH /builders/:id/budget`; `POST /inbox/:id/ratify`;
   `GET /override-requests` + `POST .../:id/decide`; `POST /claims/:id/release-on-behalf`;
@@ -251,7 +251,7 @@ or missing ranks fail closed.
   the builder's tier is below it).
 - **Every-privileged-route audit:** task [#231](https://example.com/builders#/task/231) (V3.R06) applies `requireRank()` to *every* privileged
   route so none is left ungated; the periodic auditor ([#266](https://example.com/builders#/task/266)/[#267](https://example.com/builders#/task/267)) asserts the boundary stays intact.
-- **Rank writer:** `PATCH /api/gds/builders/:id/rank` (task [#232](https://example.com/builders#/task/232) / V3.R07) — Archon-only, the single
+- **Rank writer:** `PATCH /api/bongos/builders/:id/rank` (task [#232](https://example.com/builders#/task/232) / V3.R07) — Archon-only, the single
   writer of rank.
 
 **Default posture for any new write/privileged route: `requireRank('archon')`** until a lower rank is
@@ -269,8 +269,8 @@ nothing set it, so every task sat at the `'xenos'` default and the claim gate ab
   floor and the [ADR 0043](adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) git-push floor can never disagree). Everything else stays `'xenos'` (the open
   general queue). The rule **never auto-assigns `archon`** — owner-only is a deliberate manual call.
 - **Override is upward-only (`db.highestRank`):** the stored value is `max(derived floor, requested)`.
-  An Archon may RAISE a task's floor (incl. to `archon`) on `POST /api/gds/tasks` or
-  `PATCH /api/gds/tasks/:id` (`requires_rank`, Archon-only); a request **below** the derived floor is
+  An Archon may RAISE a task's floor (incl. to `archon`) on `POST /api/bongos/tasks` or
+  `PATCH /api/bongos/tasks/:id` (`requires_rank`, Archon-only); a request **below** the derived floor is
   clamped up (fail-closed). Flipping `security_sensitive` on ratchets the floor up; it never lowers one.
 - **Backfill:** migration `<redacted>` raised every non-terminal task that was
   still at the `'xenos'` default to `metic` where sensitive (raise-only, idempotent).
@@ -284,7 +284,7 @@ Authority over *the code itself* rides the same ladder, enforced server-side fro
 - **Local clone onto your own disk = Metic and up.** Below Metic (`xenos`, `thetes`), there is **no
   permanent local copy** — the collaborator-invite path is a Metic+ affordance. New builders work
   inside the org-controlled cloud box, where access is revocable and audited.
-- **Box source is scoped by rank** (`boxScopeForRank`, decided live inside `GET /api/gds/box/source-access`):
+- **Box source is scoped by rank** (`boxScopeForRank`, decided live inside `GET /api/bongos/box/source-access`):
   `xenos`/`thetes` get a sparse `starter` surface; `metic`/`archon` get `full`. A demotion cuts a box
   off on its very next fetch (instant credential-layer revocation; the droplet teardown is the slower
   control-plane half via `box.js reconcile`).
@@ -295,7 +295,7 @@ Authority over *the code itself* rides the same ladder, enforced server-side fro
 
 ### Git and SSH are OUTSIDE the HTTP boundary — covered by a separate rank floor (ADR 0043, SEC [#863](https://example.com/builders#/task/863))
 
-ADR 0016's per-request rank check covers `/api/gds/*` only. Two surfaces it does **not** cover —
+ADR 0016's per-request rank check covers `/api/bongos/*` only. Two surfaces it does **not** cover —
 `git push` to `main` and `ssh` to the droplet — were used in the Builder 25 incident to land an
 un-graded tiering change straight on prod `main`. **Since 2026-08-08 (task 1002619), `main` HAS
 live branch protection: the required `unit` status check blocks every direct push, so all work

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1929 strings** across 3 surfaces · 1669 distinct pieces of copy · 1929 certain, 0 heuristic · 178 shown in more than one place.
+**1936 strings** across 3 surfaces · 1676 distinct pieces of copy · 1936 certain, 0 heuristic · 178 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 96 | 1434 |
+| `builders-hall` | `modules/hall-ui/public` | 96 | 1441 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 395 |
 
@@ -44,7 +44,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5df2baabf82e` | 6x | ← Back | modules/public-landing/public/projects.html:1083, modules/public-landing/public/projects.html:1114, modules/public-landing/public/projects.html:1153 |
 | `afe83bbbd0d4` | 5x | A non-profit, capture-resistant commons. | modules/public-landing/public/contact.html:71, modules/public-landing/public/index.html:900, modules/public-landing/public/privacy.html:80 |
 | `c661548d5140` | 5x | Next → | modules/public-landing/public/projects.html:1084, modules/public-landing/public/projects.html:1117, modules/public-landing/public/projects.html:1156 |
-| `cbfdd6ac4ec8` | 5x | Open source (AGPL-3.0) | modules/public-landing/public/contact.html:71, modules/public-landing/public/index.html:900, modules/public-landing/public/privacy.html:80 |
+| `d6314ddcc1d0` | 5x | Open source | modules/public-landing/public/contact.html:71, modules/public-landing/public/index.html:900, modules/public-landing/public/privacy.html:80 |
 | `e57ec24e13ef` | 5x | Sign in with GitHub | modules/hall-ui/public/hall-render.js:275, modules/hall-ui/public/hall-render.js:367, modules/hall-ui/public/hall-render.js:391 |
 | `9a685b01e2c6` | 5x | This page opens at a higher rank. | modules/hall-ui/public/deploy.html:31, modules/hall-ui/public/gate.html:37, modules/hall-ui/public/government.html:37 |
 | `90a128c97eae` | 4x | Builders' hall | modules/public-landing/public/index.html:906, modules/public-landing/public/projects.html:550, modules/public-landing/public/projects.html:550 |
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `07f422cbdb7e` | 2x | ) and capture-resistant by design. | modules/public-landing/public/projects.html:1030, modules/public-landing/public/projects.html:1057 |
 | … | | _138 more in the JSON registry_ | |
 
-## `builders-hall` — 1434 strings
+## `builders-hall` — 1441 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -89,7 +89,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `66cea7cefa4e` | certain | '; for (const row of bodyRows) { html += ' | `modules/hall-ui/public/md-reader.js:220` |
 | `53e4ac514458` | certain | '; out.push(html); continue; } // Lists (unordered '- ' or ordered '1. '); consecutive items collapse. if (/^( | `modules/hall-ui/public/md-reader.js:224` |
 | `87fa099f5068` | certain | '; } html += ' | `modules/hall-ui/public/md-reader.js:224` |
-| `af615fa9f404` | certain | (checked {…}) | `modules/hall-ui/public/deploy.js:203` |
+| `af615fa9f404` | certain | (checked {…}) | `modules/hall-ui/public/deploy.js:256` |
 | `544794f1ec8f` | certain | (later in | `modules/hall-ui/public/index.html:9` |
 | `3ac2eb36ba97` | certain | (no sections) | `modules/hall-ui/public/drachmae.js:260` |
 | `a4614c0b8eb5` | certain | (or use the Claude Code CLI) and open the project. | `modules/hall-ui/public/hall-render.js:864` |
@@ -122,6 +122,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b8f70e36c7f9` | certain | A goal may only be added to a version that is still in planning. These were added after this version started b | `modules/hall-ui/public/roadmap.js:95` |
 | `df5eb70b5a05` | certain | A higher rank. Its details are hidden until you reach the rank directly below it. | `modules/hall-ui/public/ranks.js:125` |
 | `2e17d7e236d9` | certain | A module built here can be submitted upstream for review, so it can join the shared catalog with your name and | `modules/hall-ui/public/modules.html:71` |
+| `0c611f5a76af` | certain | A move to core {…} failed{…} — this project has moved on since, and is serving {…} now. Whatever stopped that  | `modules/hall-ui/public/deploy.js:193` |
 | `a07c7b335a66` | certain | A protected-scope goal requires a Metic+ member. | `modules/hall-ui/public/goals-render.js:1307` |
 | `a07c7b335a66` | certain | A protected-scope goal requires a Metic+ member. | `modules/hall-ui/public/goals-render.js:1329` |
 | `5723baf26b2d` | certain | A quick idea is a thought filed fast. It is not an unfinished Full Idea — only its author can offer it up for  | `modules/hall-ui/public/idea.js:447` |
@@ -164,6 +165,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e99cc5d37404` | certain | Already a member? | `modules/hall-ui/public/hall-render.js:367` |
 | `da5368d10f85` | certain | Amendment {…} passed{…}, and the constitution below is not the one it decided: | `modules/hall-ui/public/government.js:633` |
 | `20365fc74500` | certain | An arrow runs from the goal that has to ship first to the goal that waits on it, and a thicker line means more | `modules/hall-ui/public/goal-map.js:98` |
+| `2ca420e19dbb` | certain | An earlier attempt did not land. | `modules/hall-ui/public/deploy.js:193` |
 | `69f0ca4a4d84` | certain | Analytics scope | `modules/hall-ui/public/hall-render.js:1236` |
 | `14bdceaac078` | certain | Answer the five questions and this spark becomes a Full Idea. | `modules/hall-ui/public/ideas.js:901` |
 | `0293418d5e8e` | certain | Answerable for: | `modules/hall-ui/public/profile.js:72` |
@@ -238,10 +240,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `cab7a9526ca1` | certain | Changes save the moment you pick. “Default” clears your override and falls back to the system's choice. | `modules/hall-ui/public/settings.html:365` |
 | `4b714191b423` | certain | Changes touching protected build surfaces, held for your approval. | `modules/hall-ui/public/gate.js:403` |
 | `e6982a9ff948` | certain | Charter library | `modules/hall-ui/public/government.js:799` |
-| `f66f5cdaa732` | certain | Checked against {…} — nothing blocks this move.{…} | `modules/hall-ui/public/deploy.js:206` |
+| `f66f5cdaa732` | certain | Checked against {…} — nothing blocks this move.{…} | `modules/hall-ui/public/deploy.js:259` |
 | `f8725cf3ba62` | certain | Checking dependency order… | `modules/hall-ui/public/work.js:857` |
 | `7a41b18c0de8` | certain | Checking for conflicts… | `modules/hall-ui/public/work.js:836` |
-| `69da40d030b0` | certain | Checking what this would do… | `modules/hall-ui/public/deploy.js:196` |
+| `ac7cf27bd7de` | certain | Checking what this would do, and what it would bring in. The answer comes from the machine itself, so it can t | `modules/hall-ui/public/deploy.js:248` |
 | `aa3ba7d28a76` | certain | Checking your key… | `modules/hall-ui/public/settings.js:1053` |
 | `834f8c6f3b72` | certain | Choose a builder… | `modules/hall-ui/public/goals-render.js:1246` |
 | `b3d0e2af5176` | certain | Choose a goal first. | `modules/hall-ui/public/task.js:938` |
@@ -327,7 +329,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
 | `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:297` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:640` |
-| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:322` |
+| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:414` |
+| `21a782f1af26` | certain | Could not read what this would bring in: {…}. The check below still applies. | `modules/hall-ui/public/deploy.js:333` |
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:1133` |
 | `4cf6bc8b377b` | certain | Could not remove. Try again. | `modules/hall-ui/public/settings.js:1132` |
 | `7a778d188e87` | certain | Could not remove: {…} | `modules/hall-ui/public/government.js:369` |
@@ -377,7 +380,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/profile.html:94` |
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/settings.html:95` |
 | `24013a074724` | certain | Custom rank | `modules/hall-ui/public/government.html:113` |
-| `cf7d7d5d5e83` | certain | Database behind. | `modules/hall-ui/public/deploy.js:286` |
+| `cf7d7d5d5e83` | certain | Database behind. | `modules/hall-ui/public/deploy.js:378` |
 | `6744aed3d15e` | certain | Dated exploit-detail engagement reports — kept out of the repo (threat-model §6.3) and served only to Archons. | `modules/hall-ui/public/watch.html:131` |
 | `7c6891813679` | certain | Default ({…}) | `modules/hall-ui/public/settings.js:63` |
 | `7ec7dc1adaa6` | certain | Deploy — {{worldName}} | `modules/hall-ui/public/deploy.html:6` |
@@ -626,7 +629,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/hall-render.js:563` |
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/profile.js:94` |
 | `c7a670e9552d` | certain | Merged into | `modules/hall-ui/public/profile.js:489` |
-| `dce0546c9e34` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this platform — or any p | `modules/hall-ui/public/deploy.html:39` |
+| `f3ba5b1b7849` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this project onto a newe | `modules/hall-ui/public/deploy.html:42` |
 | `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:781` |
 | `91328a97fe68` | certain | Mingle pairs you with someone from another role. Saying no costs nothing. | `modules/hall-ui/public/collab.html:90` |
 | `d7ce4a3bb745` | certain | Minimize the welcome panel | `modules/hall-ui/public/hall-widgets.js:52` |
@@ -640,9 +643,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1ae18e58fead` | certain | Most recent first. Each load of this page is itself recorded in the audit log. | `modules/hall-ui/public/sessions.js:340` |
 | `f14a91b3f625` | certain | Most recent first. Each row is one recorded work session; every id on it opens its record. | `modules/hall-ui/public/sessions.html:56` |
 | `e52ae74f0052` | certain | Move to goal | `modules/hall-ui/public/task.js:581` |
-| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:269` |
-| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:383` |
-| `393139f648b8` | certain | Moving to core | `modules/hall-ui/public/deploy.js:140` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:360` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:472` |
+| `393139f648b8` | certain | Moving to core | `modules/hall-ui/public/deploy.js:157` |
 | `ae84ebe1d735` | certain | Name cannot be blank. | `modules/hall-ui/public/settings.js:761` |
 | `31e91ee6ce03` | certain | Name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:766` |
 | `5e8199266a8a` | certain | Name unvouched | `modules/hall-ui/public/watch.js:374` |
@@ -679,9 +682,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2a6d7552e21f` | certain | No other sessions. | `modules/hall-ui/public/settings-sessions.js:64` |
 | `9f73b3f3dad0` | certain | No rank floor — any builder can claim this task | `modules/hall-ui/public/task-lib.js:62` |
 | `3fd0c6fcb92e` | certain | No request and no invite needed. Sign in with GitHub, and a step-by-step guide takes you the rest of the way. | `modules/hall-ui/public/hall-render.js:277` |
-| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:360` |
+| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:450` |
 | `9fb9f766450d` | certain | No sections yet | `modules/hall-ui/public/primer.js:130` |
 | `bef9fe43ba84` | certain | No sessions recorded yet. They land here as builders ship and end sessions. | `modules/hall-ui/public/sessions.js:146` |
+| `084748fd85b4` | certain | No shipped work is recorded between core {…} and {…}. | `modules/hall-ui/public/deploy.js:340` |
 | `4485497d87bb` | certain | No specialities yet. Create one below — it takes a name and a craft, and you can train it afterwards. | `modules/hall-ui/public/settings-specialities.js:169` |
 | `545dc44ad427` | certain | No task in this goal depends on another task in this goal. | `modules/hall-ui/public/goal-forest-render.js:100` |
 | `712b64d8273f` | certain | No tasks match these filters. Try widening them. | `modules/hall-ui/public/work.js:417` |
@@ -692,7 +696,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1967d2176f2e` | certain | Nobody has an open ask right now. | `modules/hall-ui/public/collab.html:78` |
 | `c65c9f5c02e3` | certain | Nobody is waiting on you. Requests reach you by role — | `modules/hall-ui/public/collab.html:54` |
 | `91c409a4aea5` | certain | Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit | `modules/hall-ui/public/watch.js:374` |
-| `428a62539050` | certain | Not checked yet — the runner takes this reading on its own tick. | `modules/hall-ui/public/deploy.js:201` |
+| `428a62539050` | certain | Not checked yet — the runner takes this reading on its own tick. | `modules/hall-ui/public/deploy.js:254` |
 | `c72e0bdb834a` | certain | Not declared in module.json — this is who ships the module. | `modules/hall-ui/public/modules.js:62` |
 | `361b353ded5e` | certain | Not enough shipped work yet to chart. | `modules/hall-ui/public/hall-widgets.js:184` |
 | `90230572d017` | certain | Not found | `modules/hall-ui/public/task.js:970` |
@@ -711,11 +715,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:1079` |
 | `905e99f158c2` | certain | Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps  | `modules/hall-ui/public/goals-render.js:1036` |
 | `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:843` |
-| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:303` |
+| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:395` |
 | `073d7fb013ae` | certain | Nothing of yours is {…} right now. | `modules/hall-ui/public/thinking.js:311` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:242` |
 | `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:258` |
-| `26a07b64f49d` | certain | Now running core {…} | `modules/hall-ui/public/deploy.js:162` |
+| `26a07b64f49d` | certain | Now running core {…} | `modules/hall-ui/public/deploy.js:211` |
 | `9d25ba1d2f17` | certain | Off voice — says it in the wrong register | `modules/hall-ui/public/copy-desk.html:89` |
 | `b89ad49770e7` | certain | On Windows, run | `modules/hall-ui/public/hall-render.js:890` |
 | `11a1905c76b2` | certain | On the board | `modules/hall-ui/public/hall-render.js:626` |
@@ -893,7 +897,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `324af64c8b6e` | certain | See all {…} goals {…} | `modules/hall-ui/public/roadmap.js:207` |
 | `a9c398651862` | certain | See the cross-project record | `modules/hall-ui/public/profile-canonical.js:114` |
 | `17d5b5739f46` | certain | See the work board → | `modules/hall-ui/public/hall-render.js:1003` |
-| `55cde0774831` | certain | See what would change | `modules/hall-ui/public/deploy.js:172` |
+| `55cde0774831` | certain | See what would change | `modules/hall-ui/public/deploy.js:221` |
 | `292761c89fae` | certain | See which goals wait on each other → | `modules/hall-ui/public/goals.html:47` |
 | `75dc5463facc` | certain | Select at least 2 waiting tasks to copy a parallel-session prompt. | `modules/hall-ui/public/work.js:821` |
 | `a98882faa482` | certain | Select at least 2 waiting tasks to copy a sequential prompt. | `modules/hall-ui/public/work.js:846` |
@@ -902,7 +906,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7e1d54119e08` | certain | Select task {…} for bulk release | `modules/hall-ui/public/work.js:242` |
 | `ae43a132699b` | certain | Selectable today | `modules/hall-ui/public/government.js:799` |
 | `53cc6d8dd23c` | certain | Send invitation | `modules/hall-ui/public/goals-render.js:1235` |
-| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:306` |
+| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:398` |
 | `64a1f055129e` | certain | Session card richness | `modules/hall-ui/public/settings-render.js:83` |
 | `d14e8e9acaff` | certain | Session ended. | `modules/hall-ui/public/settings-sessions.js:81` |
 | `55e0a34bafed` | certain | Session log{…} | `modules/hall-ui/public/task.js:487` |
@@ -957,7 +961,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ec1c2dae4a90` | certain | Standing there | `modules/hall-ui/public/profile.js:314` |
 | `eaad12cacb9d` | certain | Start over | `modules/hall-ui/public/studio.js:235` |
 | `efe530c0e3a7` | certain | Still open | `modules/hall-ui/public/profile.js:494` |
-| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:419` |
+| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:506` |
 | `9a4ced1afb6c` | certain | Stop waiting on task {…} | `modules/hall-ui/public/task.js:278` |
 | `b0861c874a2f` | certain | Stopped using it. | `modules/hall-ui/public/settings-specialities.js:200` |
 | `6c6544f5c011` | certain | Stored encrypted; never shown again after saving — only its last four digits. | `modules/hall-ui/public/settings.html:193` |
@@ -1018,7 +1022,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7f03838faf0c` | certain | The markdown behind this page could not be fetched. Reload to try again, or read it in the repo. | `modules/hall-ui/public/drachmae.html:86` |
 | `7f03838faf0c` | certain | The markdown behind this page could not be fetched. Reload to try again, or read it in the repo. | `modules/hall-ui/public/primer.html:89` |
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:140` |
-| `3f0e54242e8e` | certain | The move to core {…} did not land | `modules/hall-ui/public/deploy.js:154` |
+| `3f0e54242e8e` | certain | The move to core {…} did not land | `modules/hall-ui/public/deploy.js:203` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:75` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
 | `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1473` |
@@ -1052,7 +1056,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `34555793f33e` | certain | The task list could not be loaded right now. | `modules/hall-ui/public/work.js:1279` |
 | `59ed56e621a2` | certain | The thought | `modules/hall-ui/public/thinking.js:314` |
 | `aed969dd1e18` | certain | The unattended runner works only the goals listed here, and only while it is on. This is the switch — it lives | `modules/hall-ui/public/gate.html:54` |
-| `8c991355687d` | certain | The upgrade checked {…} and refused:{…} | `modules/hall-ui/public/deploy.js:211` |
+| `8c991355687d` | certain | The upgrade checked {…} and refused:{…} | `modules/hall-ui/public/deploy.js:264` |
 | `a42a37c43bfb` | certain | The words this project shows people — what has been flagged, and what nobody has looked at. | `modules/hall-ui/public/copy-desk.js:328` |
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1483` |
 | `25794c439321` | certain | Then copy the project onto your machine and run the one-shot bootstrap (it checks your setup, installs depende | `modules/hall-ui/public/hall-render.js:890` |
@@ -1087,14 +1091,13 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/government.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/project-settings.html:36` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:40` |
-| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:352` |
-| `3c8aaec39c40` | certain | This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies | `modules/hall-ui/public/deploy.js:286` |
-| `6e9dfe1fb903` | certain | This restarts {…} onto core | `modules/hall-ui/public/deploy.js:269` |
+| `3c8aaec39c40` | certain | This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies | `modules/hall-ui/public/deploy.js:378` |
+| `6e9dfe1fb903` | certain | This restarts {…} onto core | `modules/hall-ui/public/deploy.js:360` |
 | `69e8beced2ff` | certain | This sends the idea back to its author. Say why, and which section. | `modules/hall-ui/public/board-room.js:363` |
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:422` |
 | `c9e50a67988a` | certain | This task has shipped and its credits have landed. Neither Ship it nor Confirm is available. | `modules/hall-ui/public/task.js:719` |
 | `62b0940efd7d` | certain | This task is already retired. Promote restores it to the backlog. | `modules/hall-ui/public/task.js:755` |
-| `4301ecd67891` | certain | This would fail. | `modules/hall-ui/public/deploy.js:211` |
+| `4301ecd67891` | certain | This would fail. | `modules/hall-ui/public/deploy.js:264` |
 | `2ad5823d2cd7` | certain | Three dials, all settings rather than code: | `modules/hall-ui/public/government.html:55` |
 | `82367d2122af` | certain | To paste the sign-in code: | `modules/hall-ui/public/hall-render.js:825` |
 | `f158ed1c24a2` | certain | Toggle fullscreen | `modules/hall-ui/public/diagram-viewer.js:101` |
@@ -1138,6 +1141,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a85f2c19b48` | certain | What should it say? | `modules/hall-ui/public/copy-desk.html:156` |
 | `2dd116d2d817` | certain | What the current wording gets wrong, and what yours does about it. | `modules/hall-ui/public/copy-desk.html:166` |
 | `e179870922a3` | certain | What the session did, derived from its own transcript: whether it wrote files, used tools, and how many prompt | `modules/hall-ui/public/sessions.html:74` |
+| `515f3c6023a9` | certain | What the upgrade said | `modules/hall-ui/public/deploy.js:189` |
+| `5a58392783fd` | certain | What this brings in | `modules/hall-ui/public/deploy.js:349` |
 | `a444ad812e4f` | certain | What this builder has done, seen one role at a time. | `modules/hall-ui/public/profile.html:134` |
 | `32d675a2b022` | certain | What this rank is for (optional) | `modules/hall-ui/public/government.html:90` |
 | `04b3ff4c4f4c` | certain | What users can see | `modules/hall-ui/public/deploy.html:35` |
@@ -1175,7 +1180,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b6b0fcb2bcee` | certain | You already have a pending request or invitation for this goal. | `modules/hall-ui/public/goals-render.js:1389` |
 | `52e93bbc07a6` | certain | You are already a member of this goal. | `modules/hall-ui/public/goals-render.js:1390` |
 | `46b1265ef172` | certain | You are not a member of this goal. | `modules/hall-ui/public/goals-render.js:1346` |
-| `921cb15a8188` | certain | You can still press Move — the runner will refuse it the same way, and the box is left where it is. | `modules/hall-ui/public/deploy.js:211` |
+| `921cb15a8188` | certain | You can still press Move — the runner will refuse it the same way, and the box is left where it is. | `modules/hall-ui/public/deploy.js:264` |
 | `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/goals-page.js:424` |
 | `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/goals-page.js:523` |
 | `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/work.js:908` |
@@ -1304,7 +1309,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `77ad318bb546` | certain | invited — awaiting their response | `modules/hall-ui/public/goals-render.js:1424` |
 | `af0777cd098b` | certain | is hardcoded back inside this | `modules/hall-ui/public/index.html:56` |
 | `c767b3e07826` | certain | is only the screen; the | `modules/hall-ui/public/diagrams.html:74` |
-| `d0e722302840` | certain | is published and this box is not on it yet. | `modules/hall-ui/public/deploy.js:172` |
+| `d0e722302840` | certain | is published and this box is not on it yet. | `modules/hall-ui/public/deploy.js:221` |
 | `aa530bd15088` | certain | itself). The registry stays the single source of truth for what the hall shows; a fitness check (scripts/gds/f | `modules/hall-ui/public/index.html:53` |
 | `966b32c8af7e` | certain | last check-in {…} ago | `modules/hall-ui/public/gate.js:360` |
 | `9018bf6e99eb` | certain | last used {…} · signed in {…} | `modules/hall-ui/public/settings-sessions.js:46` |
@@ -1320,7 +1325,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e3317d58ec83` | certain | no cost logged | `modules/hall-ui/public/hall-render.js:352` |
 | `e02979266baf` | certain | no data | `modules/hall-ui/public/hall-kit.js:735` |
 | `4eb559027d7f` | certain | no goal has claimed {…} | `modules/hall-ui/public/sky.js:316` |
-| `9e194a57d054` | certain | no reading | `modules/hall-ui/public/deploy.js:113` |
+| `9e194a57d054` | certain | no reading | `modules/hall-ui/public/deploy.js:130` |
 | `33ca71bef112` | certain | no tasks yet | `modules/hall-ui/public/goals-render.js:171` |
 | `739a4bd6bd83` | certain | node scripts/setup-builder.js | `modules/hall-ui/public/hall-render.js:890` |
 | `b55eda6feb4c` | certain | none yet | `modules/hall-ui/public/sky.js:371` |
@@ -1355,7 +1360,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fb1dad96280` | certain | pending, on the People tab | `modules/hall-ui/public/watch.html:46` |
 | `3b22c5af029b` | certain | rank or above, or that it is your own. | `modules/hall-ui/public/copy-desk.html:47` |
 | `80ddf28baee7` | certain | rank-key (kebab-case) | `modules/hall-ui/public/government.html:82` |
-| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:364` |
+| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:454` |
 | `f83f0a9d6b6a` | certain | recorded, on the Operations tab | `modules/hall-ui/public/watch.html:49` |
 | `26da1df6fd4a` | certain | reflects it. | `modules/hall-ui/public/settings.html:136` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:84` |
@@ -1481,20 +1486,22 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4a5ff4f662df` | certain | — ${…} of ${…} this month ({…}%). {…} | `modules/hall-ui/public/hall-render.js:517` |
 | `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:713` |
 | `729d4ce22b99` | certain | — any — | `modules/hall-ui/public/hall-widgets.js:132` |
+| `13c0414d2a10` | certain | — attempted{…}. This project is still running core {…}. | `modules/hall-ui/public/deploy.js:203` |
 | `d2c30a1ee74e` | certain | — decide — | `modules/hall-ui/public/goals-render.js:1000` |
 | `03d2d984684f` | certain | — it takes one line. | `modules/hall-ui/public/sky.js:457` |
 | `03d2d984684f` | certain | — it takes one line. | `modules/hall-ui/public/thinking.js:310` |
-| `e31a588bb9e1` | certain | — moved {…}, and the box confirmed it. | `modules/hall-ui/public/deploy.js:162` |
+| `e31a588bb9e1` | certain | — moved {…}, and the box confirmed it. | `modules/hall-ui/public/deploy.js:211` |
 | `417adabd1a00` | certain | — no goal suggested — open the goal board and pick one — | `modules/hall-ui/public/task-detail.js:412` |
 | `da9962dc1729` | certain | — or open any diagram fullscreen. | `modules/hall-ui/public/diagrams.html:33` |
 | `e5c5e94152b3` | certain | — that's all the tooling you need up front. | `modules/hall-ui/public/hall-render.js:890` |
-| `38c40179ec06` | certain | — this project was put back on {…} and is running. | `modules/hall-ui/public/deploy.js:154` |
 | `392afc533191` | certain | — type | `modules/hall-ui/public/hall-render.js:825` |
 | `ff7514f48a7b` | certain | — untouched {…}+ days | `modules/hall-ui/public/goal-inbox.js:457` |
 | `d3afa6d6dd9e` | certain | — your words, in your voice. Needed for a note or a follow-up. | `modules/hall-ui/public/studio.js:162` |
 | `68b547166d48` | certain | — {…} confirmed {…} can't land yet, so {…} reward is pending (it lands on ship). Rebase + re-ship or release { | `modules/hall-ui/public/hall-render.js:558` |
-| `28fef677706c` | certain | — {…}. The project restarts as part of this, and puts itself back on {…} if the new core does not answer. This | `modules/hall-ui/public/deploy.js:140` |
+| `8f2eba6e0da8` | certain | — {…} {…} of work landed between core {…} and {…}{…}: | `modules/hall-ui/public/deploy.js:349` |
+| `28fef677706c` | certain | — {…}. The project restarts as part of this, and puts itself back on {…} if the new core does not answer. This | `modules/hall-ui/public/deploy.js:157` |
 | `5b9fa7cb4fb0` | certain | …and {…} more waiting — | `modules/hall-ui/public/goal-inbox.js:121` |
+| `b797996b2e4f` | certain | …and {…} more, not listed. | `modules/hall-ui/public/deploy.js:347` |
 | `b2a04abfead0` | certain | …{…} more awaiting a nod. | `modules/hall-ui/public/goal-inbox.js:278` |
 | `f16717b3e122` | certain | …{…} more awaiting an answer. | `modules/hall-ui/public/goal-inbox.js:358` |
 | `616fb9adf3cf` | certain | …{…} more going quiet. | `modules/hall-ui/public/goal-inbox.js:447` |
@@ -1774,11 +1781,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8329bb1a3693` | certain | One tap files the request and the platform starts standing your project up — server, database, address. Here's | `modules/public-landing/public/projects.html:1281` |
 | `86cde1930d84` | certain | Only mine | `modules/public-landing/public/projects.html:419` |
 | `f82fe1982ab3` | certain | Open an issue on the repository | `modules/public-landing/public/contact.html:52` |
-| `cbfdd6ac4ec8` | certain | Open source (AGPL-3.0) | `modules/public-landing/public/contact.html:71` |
-| `cbfdd6ac4ec8` | certain | Open source (AGPL-3.0) | `modules/public-landing/public/index.html:900` |
-| `cbfdd6ac4ec8` | certain | Open source (AGPL-3.0) | `modules/public-landing/public/privacy.html:80` |
-| `cbfdd6ac4ec8` | certain | Open source (AGPL-3.0) | `modules/public-landing/public/projects.html:1410` |
-| `cbfdd6ac4ec8` | certain | Open source (AGPL-3.0) | `modules/public-landing/public/terms.html:84` |
+| `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/contact.html:71` |
+| `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/index.html:900` |
+| `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/privacy.html:80` |
+| `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/projects.html:1410` |
+| `d6314ddcc1d0` | certain | Open source | `modules/public-landing/public/terms.html:84` |
 | `275ca0d5ce65` | certain | Open source. | `modules/public-landing/public/index.html:862` |
 | `74cdcd87d1fa` | certain | Open the map | `modules/public-landing/public/index.html:755` |
 | `a226469fc575` | certain | Optional — invite people by GitHub username. Each one gets an invitation to accept from their own projects pag | `modules/public-landing/public/projects.html:1310` |