@bongos/core 1.20.18 → 1.20.19

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.18",
-  "core_contract": "1.20.18",
-  "source_commit": "e1841ec9f7044de186bb75988136b6dfb0835ef7",
+  "core_version": "1.20.19",
+  "core_contract": "1.20.19",
+  "source_commit": "634240626e5878bfa71f84a126f2a5066315c631",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T13:46:50.940Z",
+  "built_at": "2026-09-30T14:16:31.957Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 556,
+    "docs_redacted": 557,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2628,
+    "functional_verbatim": 2631,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3210,
-  "tree_sha256": "34fda46e51438cef84700eb352c0f4dc3a8552cd8e8fc962864f4f500e09047d",
+  "file_count": 3214,
+  "tree_sha256": "1941a2dc44fb870a71c3227166d032c854f48237c2fef4cc958e355f9658f585",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2229,10 +2229,15 @@
       "mode": "0000644",
       "sha256": "4ca4eae961c994cae0dd9d306ea0a5a6f9ce660de161a62c5ccd125d910f70ec"
     },
+    {
+      "path": "docs/adr/0352-a-rollup-report-carries-its-as-of-in-a-header.md",
+      "mode": "0000644",
+      "sha256": "d74b4f6262d4f23fd67f73771bbe8187e9cb92fa321b83ffb33ef03cf96d1236"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "bcfa8004aeaebbfb6c32c53042665d7da49098e80dd858a3f353420f8ef2c523"
+      "sha256": "943ac0f8c9c0b2dc5ef2a05241b0bac329c5fa986b09425841e12e62f4f9b936"
     },
     {
       "path": "docs/api-reference.md",
@@ -2242,7 +2247,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "829ba538e06cca081f0540bf819f280ba36e738a553e5fa3634af5f5af5bc5b0"
+      "sha256": "796e47e332b7788981b5118aabfbacdc9b728e22796da301cedce44ac1ab8dc6"
     },
     {
       "path": "docs/architecture.md",
@@ -2772,7 +2777,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "99307d7bab261c46f7e80d768b014352d9f3c47ec2c72088acfac7bc700dd06f"
+      "sha256": "f7fe6c9e2a06b6dfb71087791b38b22ff4ce57f897320ade88e65a131fdb4160"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7009,6 +7014,11 @@
       "mode": "0000644",
       "sha256": "72be4f7e3aa3afa47dd78de7a57dcdf57b877675b44fbdf02f6607a8632e1787"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_026_activity_reported_as_of.sql",
+      "mode": "0000644",
+      "sha256": "9f8d582d626dec82b55b96272f9d6d7f6c1488ac28bd9a98ab673404afde0c8e"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -7022,7 +7032,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "badb8e19541a08a35f85037bc9f5130c553403ae75017423354d255f972cbe46"
+      "sha256": "a823bd5e79795f93aa011470088b5840bf2ada6fb696fbf6b9b1c6c2ea85e5ef"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -7117,7 +7127,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "aa1bceddd27140e33d12f1c22ca362ba35352d837b556422b54633fd4fcedfc0"
+      "sha256": "2906d873fa46a2745fbbecefdeb81194f6f433e97deed65ee5fbee3e9a7fa140"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -7142,7 +7152,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "788915622457990f61b7b95cc6266d1e285097100100be06419145702191c9ce"
+      "sha256": "93d74c10d601eab840da83b5d33d7bbf51907830626401cc27fadb138441fcc3"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -8862,12 +8872,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "35d3b7a5f69caee9c6a98b7c34c02daec4289cd0548637d05ff41fd23d1926c4"
+      "sha256": "01b48ab609eb6e0b51a3420a79cd5e13158e3bf3f996a5bd30dbd1c2927c5b91"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9807202c95ba59b5f8104eb0c6701241d989800e67fdddf8252bc569b9a74c96"
+      "sha256": "15c8438b1ea0a683e536e21ca2ed353042533ddf893b727c3835d5422595797a"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8897,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "19b0f5588a02e7517cc25668a59df836f8ee1a183e1f1ec4a2b63d79214b3808"
+      "sha256": "426ac20e29712617fe5881fdc428ff184ab09e2e0cfc093a99b1f10c192291a3"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10047,7 +10057,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "55ffec8533dc352849c2a9bb40663a1a0c95d72d466360bf47091e9491683b0b"
+      "sha256": "456b185fcbab4fb486fb15aecf0de260183c9eda9942c12c0123000a8baeaa57"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -10667,7 +10677,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "2d11e7b745a0476fa0643fd997c2e17a49709bae1ef93a7c4636f7efd18c7ab0"
+      "sha256": "9fd9311df751a418985073db3aed97825e52d2a45ca7501b93f93cf5019c1fe6"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -11002,7 +11012,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3f49c56de113748d04529b5028e1ac2fca037cf00c1d6be6e531346dcfbea552"
+      "sha256": "f80e044dd532aabc41f3731129d98f63c98c2d60a9a4fc3eecbf713e3a86650e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11104,10 +11114,20 @@
       "mode": "0000644",
       "sha256": "f7434d510d656e5081f735d1f9356ecb11e8c3630a86a86137c3290134541c8d"
     },
+    {
+      "path": "tests/activity_rollup_as_of.mjs",
+      "mode": "0000644",
+      "sha256": "d5903404f0fed48e599b68f259e0d79a44d11c249bb69bc4b59643e7dac62cbb"
+    },
+    {
+      "path": "tests/activity_rollup_order_db.mjs",
+      "mode": "0000644",
+      "sha256": "497b453aa441ba06276d5146fc71f54da111a12c7c0c2e192da199cc1f2812ec"
+    },
     {
       "path": "tests/activity_snapshots_db.mjs",
       "mode": "0000644",
-      "sha256": "219569f3160eb22a89e92a217b854a194afba6ebc7032dc07eff2534efc4390a"
+      "sha256": "73cb5a43e3f3ce61dd7f57720e523a310390ed60ed491d39fdaf8b8e9c78053a"
     },
     {
       "path": "tests/admission_ceiling_gate.mjs",
@@ -14347,7 +14367,7 @@
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",
-      "sha256": "986cd6a9aa83743f5d2bc6083803e6ed576f6b7b35a8c6dc05e9096fa022f898"
+      "sha256": "093f078f965454e535d6026c1852a0e0668695809f270f84e5d26dba4025abbd"
     },
     {
       "path": "tests/profile_route.mjs",

package/docs/adr/0352-a-rollup-report-carries-its-as-of-in-a-header.md

@@ -0,0 +1,38 @@
+# ADR 0352 — A rollup report carries its "as of" in a header, and the hub keeps the newest
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1004268](https://cloudbongos.com/builders#/task/1004268) (goal 1000110), found in [task 1004244](https://cloudbongos.com/builders#/task/1004244)'s code review
+- **Interacts with:** [ADR 0141](<redacted>.md) §4 (the activity rollup), [ADR 0171](0171-profile-rollup-join-and-consent.md) D7 (a report is third-party self-report), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) §5 (module-namespaced migrations)
+
+## Context
+
+`POST /sso/activity/rollup` upserted the live activity row last-writer-wins, and a report carried no timestamp. An instance pushes one on every federated sign-in and one on every ship, so a sign-in report read earlier and a ship report read later can reach the hub together, and the older one can commit last. The live row and, since task 1004244, the newest snapshot then show the older totals. The leaderboard reads a regression that never happened until the builder's next report. It is low-urgency, since the next report corrects it, but it is wrong in exactly the place people compare numbers.
+
+The fix the task names is for the instance to send when it read the totals, and for the hub to refuse an older report. What is not obvious is where that stamp travels.
+
+## Decision
+
+**D1 — The stamp is a request header, `Bongos-Report-As-Of`, not a body field.** The hub validates the rollup body strictly (`validateOrRespond`), so an unknown field is a 400. The hub and its instances upgrade independently, and an instance can run a newer core than the hub (today the hub's pin trails main). A body field sent by an upgraded instance would be refused by a hub that predates it. The sender never reads the response, so every report from that instance would be lost silently until the hub caught up. An unknown header is ignored, so the header is safe in both directions: an old hub ignores it, and a new hub treats its absence as "unstamped".
+
+**D2 — Unstamped means the old behaviour, never a refusal.** A missing or unparseable header binds NULL. A NULL on either side of the comparison (an older instance's report, or a row written before migration 026) applies last-writer-wins, as before. An unstamped report also clears the stored stamp, so a stamp never outlives the numbers it described. A malformed header is not a 400, for D1's reason: a refusal drops the report, when the only thing lost should be its ordering.
+
+**D3 — The guard is a WHERE on the upsert's conflict branch.** `ON CONFLICT (client_id, github_id) DO UPDATE … WHERE EXCLUDED.reported_as_of IS NULL OR <row>.reported_as_of IS NULL OR EXCLUDED.reported_as_of >= <row>.reported_as_of`. A skipped update still takes the row lock, so racing reports stay queued exactly as task 1004244 arranged, and the snapshot beside it copies an unchanged live row, which records nothing. Ties apply (the later arrival wins, as before).
+
+**D4 — The stamp is the instance's clock, compared only with itself, and clamped to the hub's.** A row's stored stamp only ever comes from the same client for the same builder, so skew between an instance and the hub does not matter. A stamp later than the hub's `now()` is stored as `now()`, so an instance whose clock runs ahead cannot freeze the row until its clock is reached. The sender stamps before its first read, so a report is never ordered ahead of totals read after it.
+
+## Consequences
+
+- Migration `platform_identity_026_activity_reported_as_of.sql` adds one nullable column, with no backfill and no default. An invented stamp on an existing row could refuse an honest report from an instance whose clock reads earlier than the hub's.
+- A mixed fleet behaves as before until each instance upgrades. An upgraded instance talking to an old hub is also unaffected.
+- **Honest limit:** an instance clock that steps backwards (an NTP correction after running fast) has its reports refused until it passes the last stamp it sent. The skew bounds this, the clamp bounds the skew by the hub's own time, and the next report after that applies. A report refused this way still answers `{ ok: true }`, because the instance ignores the body.
+- **The pattern generalises:** a field added to a hub↔instance wire that the older side validates strictly must be able to ride where the older side ignores it, or the change must land on the hub first and be released before any instance sends it.
+
+Proof: `tests/activity_rollup_order_db.mjs` (real Postgres: the out-of-order race, ties, NULLs on each side, the future clamp, and ten rounds of five racing writers ending on the latest stamp with the snapshot agreeing) and `tests/activity_rollup_as_of.mjs` (DB-free: the sender stamps a header before its reads and never the body; the route binds it and degrades a bad one to unstamped).
+
+## Alternatives considered
+
+- **A body field `as_of`.** This is what the task sketched. It is lost against any older hub (D1).
+- **`GREATEST` on each total.** Credits and karma can legitimately fall, so this would pin a clawback forever.
+- **The standard `Date` header.** It has one-second granularity, and a sign-in push and a ship push inside the same second are exactly the case being fixed.
+- **A 400 on a malformed stamp.** It turns a sender bug into silent data loss (D2).

package/docs/adr/README.md

@@ -470,3 +470,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0349 | [**A version preview is a sandboxed child the web tier launches, reached by a cookie** ([task 1004300](https://cloudbongos.com/builders#/task/1004300), goal 1000090 — BONGOS-V2, owner Lars, approved 2026-09-29). Amends ADR 0293 D1 for this feature only. **D1 (owner):** route by a `bongos_preview` cookie through an optional `request.divert` seam, not a path; forward only with the cookie, off the sign-in and preview paths, with no Bearer, and with `core.pin.move` re-checked on every request. **D2 (owner):** the npm-release module launches the preview itself, with a deny-by-default environment, a dump-and-restore copy of the database (never a template copy), one at a time, 20-minute idle stop, published versions within 30 of the running one. **D3:** the same database role and no egress firewall are accepted for now.](0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md) | modules / npm-release / deploy |
 | 0350 | [**The hub holds a per-project WRITE deploy key, so a hosted project's upgraded pin always reaches its GitHub repo** ([task 1004291](https://cloudbongos.com/builders#/task/1004291), follow-up to task 1004065). Amends ADR 0176. The owner's token lasts one hour and the checkout's own key is read-only, so most hosted upgrades ended "GitHub was not updated". **D1:** a second deploy key per repo, registered `read_only: false` as `cloudbongos-pin-<slug>`, the pull key untouched. **D2:** kept outside every checkout in the runner's own directory (0700 dir, 0600 key, modes verified), unreadable by the project's account. **D3:** minted at standup and whenever a fresh owner token finds none, so reconnecting GitHub once is enough. **D4:** `pushUpgradePin` tries write key, then owner token, then origin, never forced. **D5:** revoked on teardown and disconnect. **D6:** a project on the shared app user is refused a key: "needs its own account first". **D7:** /deploy says reconnecting sets up lasting access.](0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md) | provisioning / security |
 | 0351 | [**A criterion closes on a UAT, not on its linked tasks shipping** ([task 1004392](https://cloudbongos.com/builders#/task/1004392), goal 1000089 — working area 3). Supersedes ADR 0183's close rule. `wa7-government` had closed on six Board Room navigation tasks while nothing it describes was on the live site. **D1:** three checks — Code (linked tasks done, ≥1 shipped; automatic), Live, UAT — and the sweep closes a criterion only with a CURRENT sign-off (no older than the newest linked ship). **D2 (owner):** "Awaiting UAT" is a visible state. **D3 (owner):** one step; the signer is refused if they shipped linked work, the project owner excepted. **D4 (owner):** an mp4/webm up to 100 MB on the project's own server. **D5 (owner):** backend-only is set while a criterion is open and takes a recording-free sign-off. **D6 (owner):** Live is read via the `deploy.taskWhere` port where the site can tell, attested otherwise. **D7 (owner):** already-closed criteria stay closed ("Closed before UAT"). **D8:** `/satisfy` is a recorded override that needs a reason. **D9:** `/goal-uat` + `scripts/gds/uat.js`; the hall is task 1004402.](0351-a-criterion-closes-on-a-uat.md) | lifecycle / criteria / review |
+| 0352 | [**A rollup report carries its "as of" in a header, and the hub keeps the newest** ([task 1004268](https://cloudbongos.com/builders#/task/1004268), goal 1000110). `POST /sso/activity/rollup` was last-writer-wins with no report timestamp, so a sign-in push read earlier and a ship push read later could land the older totals last. **D1:** the instance's read time rides a `Bongos-Report-As-Of` HEADER, not a body field, because the hub validates the body strictly and hub and instances upgrade independently: a body field from a newer instance would 400 on an older hub and lose the report, while an unknown header is ignored. **D2:** missing or unparseable = unstamped = last-writer-wins, never a 400. **D3:** the guard is a WHERE on the upsert's conflict branch (migration 026, `reported_as_of`, no backfill); a skipped update keeps the row lock, so the task 1004244 snapshot stays in step. **D4:** the stamp is compared only with the same client's, and clamped to the hub's `now()`.](0352-a-rollup-report-carries-its-as-of-in-a-header.md) | platform identity / federation |

package/docs/api/openapi.json

@@ -18502,7 +18502,7 @@
           "sso"
         ],
         "summary": "POST /sso/activity/rollup",
-        "description": "POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). Server-to-server, client_id+client_secret auth. Keyed to the AUTHENTICATED client_id. Descriptive analytics for the Archon-only scouting view — never authority. rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). Server-to-server, client_id+client_secret auth. Keyed to the AUTHENTICATED client_id. Descriptive analytics for the Archon-only scouting view — never authority. Optional `Bongos-Report-As-Of` header (task 1004268): when the instance read these totals, so an older report landing last cannot overwrite a newer one. A HEADER, not a body field, because the body is validated strictly and the hub and its instances upgrade independently: a new instance's body field would 400 on an older hub and the report would be lost, while an unknown header is ignored. Absent or unparseable reads as unstamped (last-writer-wins, as before) rather than a 400 — the sender never reads the response, so a refusal would silently drop the report instead of only its ordering. rank: public — authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/platform-identity/routes/sso.js",
         "requestBody": {

package/docs/module-api-changelog.md

@@ -2693,5 +2693,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.16 with no explicit bump. run 36722139698. (task 1002620)
   1.20.18 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.17 with no explicit bump. run 36724081934. (task 1002620)
+  1.20.19 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.18 with no explicit bump. run 36727774141. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/migrations/platform_identity_026_activity_reported_as_of.sql

@@ -0,0 +1,27 @@
+-- platform_identity_026_activity_reported_as_of.sql — WHEN the reporting instance
+-- read the totals a rollup carries (task 1004268).
+--
+-- WHY. POST /sso/activity/rollup upserted the live activity row last-writer-wins,
+-- and a report carried no timestamp. A sign-in report and a ship report racing to
+-- the hub could commit in the wrong order, leaving the older totals live (and, since
+-- task 1004244, as the newest snapshot) — a leaderboard regression that never
+-- happened, until the builder's next report.
+--
+-- WHAT. One nullable column: the instance's own "as of" for the stored totals, sent
+-- as the Bongos-Report-As-Of header and clamped to the hub's clock on write.
+-- upsertActivity's conflict branch applies a report only when its stamp is at least
+-- this one. NULL means "unstamped" — every row written before this column, and every
+-- report from an instance too old to send the header — and an unstamped side always
+-- applies, which is exactly the old behaviour.
+--
+-- No backfill, no default: inventing a stamp for an existing row would make it
+-- refuse an honest report from an instance whose clock reads earlier than the hub's.
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). Idempotent.
+
+BEGIN;
+
+ALTER TABLE platform_identity_builder_project_activity
+  ADD COLUMN IF NOT EXISTS reported_as_of timestamptz;
+
+COMMIT;

package/modules/platform-identity/platform-identity.js

@@ -664,8 +664,10 @@ function sanitizeRecentShips(raw, clientOrigin) {
 // Descriptive analytics — never authority. Refreshes last_active on each report.
 // `clientOrigin` is the AUTHENTICATED client's registered origin (never a
 // caller-named one) and exists only to bound the ship links — see
-// origin-containment.js:urlWithinOrigin.
-async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], clientOrigin = null }, { pool = defaultPool } = {}) {
+// origin-containment.js:urlWithinOrigin. `asOf` is when the instance read these
+// totals (task 1004268, migration 026): an older report never overwrites a newer
+// one; unstamped (an older instance) keeps last-writer-wins; a future stamp is clamped.
+async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped = 0, karma = 0, rank = null, disciplines = [], recentShips = [], clientOrigin = null, asOf = null }, { pool = defaultPool } = {}) {
   // api.LIVE_RANK_LADDER is a published doorway export (src/module-api.js, a
   // lazy getter over db-kernel's canonical four-rank ladder).
   const safeRank = api.LIVE_RANK_LADDER.includes(rank) ? rank : null;
@@ -677,17 +679,20 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
   return api.withTx(async (client) => {
     const { rows } = await client.query(
       `INSERT INTO platform_identity_builder_project_activity
-         (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, now(), now())
+         (client_id, github_id, credits, tasks_shipped, karma, rank_held, disciplines, recent_ships, last_active, updated_at, reported_as_of)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, now(), now(),
+               CASE WHEN $9::timestamptz IS NULL THEN NULL ELSE LEAST($9::timestamptz, now()) END)
        ON CONFLICT (client_id, github_id) DO UPDATE SET
          credits = EXCLUDED.credits, tasks_shipped = EXCLUDED.tasks_shipped, karma = EXCLUDED.karma,
          rank_held = EXCLUDED.rank_held, disciplines = EXCLUDED.disciplines,
-         recent_ships = EXCLUDED.recent_ships,
+         recent_ships = EXCLUDED.recent_ships, reported_as_of = EXCLUDED.reported_as_of,
          last_active = now(), updated_at = now()
+       WHERE EXCLUDED.reported_as_of IS NULL OR platform_identity_builder_project_activity.reported_as_of IS NULL
+          OR EXCLUDED.reported_as_of >= platform_identity_builder_project_activity.reported_as_of
        RETURNING id, client_id, github_id`,
       // jsonb is bound as a JSON STRING: node-postgres serializes a JS array as a
       // Postgres ARRAY literal, which the jsonb column would reject.
-      [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships)],
+      [clientId, githubId, credits | 0, tasksShipped | 0, karma | 0, safeRank, disc, JSON.stringify(ships), asOf],
     );
     // Windowed data plane (task 1002977) — best-effort, see activity-snapshots.js.
     await recordActivitySnapshot({ clientId, githubId }, { client });

package/modules/platform-identity/routes/sso.js

@@ -83,6 +83,14 @@ const log = api.logger('platform-identity');
 
 const { pool, validateOrRespond, resolveSession } = api;
 
+// The Bongos-Report-As-Of header of a rollup as an ISO timestamp, or null when it
+// is absent or unparseable (task 1004268; see POST /sso/activity/rollup).
+function reportAsOf(req) {
+  const raw = req.get ? req.get('Bongos-Report-As-Of') : null;
+  const ms = typeof raw === 'string' && raw.length <= 64 ? Date.parse(raw) : NaN;
+  return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+}
+
 // Minimal standalone error page for the browser leg (no template engine / deps).
 // The /sso/authorize failures are pre-redirect (bad client / bad redirect_uri), so
 // we must render our OWN page rather than bounce to an unvalidated URI.
@@ -538,6 +546,15 @@ module.exports = function ssoRoutes() {
   // the AUTHENTICATED client_id. Descriptive analytics for the Archon-only scouting
   // view — never authority.
   //
+  // Optional `Bongos-Report-As-Of` header (task 1004268): when the instance read
+  // these totals, so an older report landing last cannot overwrite a newer one.
+  // A HEADER, not a body field, because the body is validated strictly and the hub
+  // and its instances upgrade independently: a new instance's body field would 400
+  // on an older hub and the report would be lost, while an unknown header is
+  // ignored. Absent or unparseable reads as unstamped (last-writer-wins, as before)
+  // rather than a 400 — the sender never reads the response, so a refusal would
+  // silently drop the report instead of only its ordering.
+  //
   // rank: public — authenticated by client_id + client_secret, not a builder rank.
   router.post('/sso/activity/rollup', async (req, res) => {
     if (validateOrRespond(req, res, {
@@ -595,6 +612,7 @@ module.exports = function ssoRoutes() {
         // ship link must fall inside (task 1002803). Taken from the client row,
         // never from the body, for the same reason client_id is.
         clientOrigin: client.origin,
+        asOf: reportAsOf(req),
       }, { pool });
       res.json({ ok: true });
     } catch (err) {

package/modules/platform-identity/tests/platform-identity.mjs

@@ -595,8 +595,9 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   assert.match(c.text, /ON CONFLICT \(client_id, github_id\) DO UPDATE/);
   // recent_ships (task 1002803) rides the same row as a jsonb STRING param —
   // an empty list when the sender reported none, never NULL. Its own cap,
-  // shape and link bound are covered by tests/hub_recent_ships.mjs.
-  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]']);
+  // shape and link bound are covered by tests/hub_recent_ships.mjs. The last param
+  // is the report's as-of stamp (task 1004268): null when the sender gave none.
+  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]', null]);
 });
 
 await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.18",
+  "version": "1.20.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.18",
+      "version": "1.20.19",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.18",
+  "version": "1.20.19",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8164,5 +8164,11 @@
       "id": "1004265",
       "text": "The terms page now says your agreement is recorded when you sign in to a project in your browser, and explains why a command-line-only sign-in doesn't publish your profile."
     }
+  ],
+  "1.20.19": [
+    {
+      "id": "1004268",
+      "text": "Builders' activity numbers on the platform can no longer briefly go backwards when two updates arrive at the same time."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -87,6 +87,10 @@ const INTEGRATION = new Set([
   // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
   // a fake pool can prove the query shape but not which reports it inserts.
   'activity_snapshots_db',
+  // task 1004268: an older rollup report never overwrites a newer one — a WHERE on
+  // the upsert's conflict branch, whose NULL handling and racing-writer outcome only
+  // a real Postgres settles (the DB-free sibling is activity_rollup_as_of).
+  'activity_rollup_order_db',
   // task 1002978: the windowed leaderboard against real SQL. Which snapshot
   // becomes a window baseline (a LATERAL at-or-before probe), a missing baseline
   // counting as zero, and the privacy matrix filtering are all planner facts the

package/src/bongos/auth-admission.js

@@ -148,6 +148,10 @@ async function reportActivityRollup({ builderId, githubId = null }) {
   const idp = loadIdpConfig();
   if (!idp) return;
   try {
+    // Stamped BEFORE the reads: the hub keeps whichever report was read latest, so a
+    // sign-in push and a ship push racing to it cannot land the older totals last
+    // (task 1004268). A header, not a body field — see the hub's rollup route.
+    const asOf = new Date().toISOString();
     // Snapshot the builder's talent signals directly from the DB (auth.js is a
     // kernel file — it uses pool, never a non-kernel domain module like metrics.js).
     const b = await pool.query(
@@ -162,7 +166,10 @@ async function reportActivityRollup({ builderId, githubId = null }) {
     const recentShips = await recentShipsForRollup(builderId);
     await fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+      headers: {
+        'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent(),
+        'Bongos-Report-As-Of': asOf,
+      },
       body: JSON.stringify({
         client_id: idp.clientId,
         client_secret: idp.clientSecret,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.18'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.19'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/activity_rollup_as_of.mjs

@@ -0,0 +1,172 @@
+// tests/activity_rollup_as_of.mjs — task 1004268, the two ends of the wire.
+//
+// A rollup report now says WHEN the instance read its totals, so the hub can keep
+// the newest one when a sign-in push and a ship push race (the ordering itself is
+// proven against real SQL in tests/activity_rollup_order_db.mjs). This file holds
+// the two halves a fake can settle:
+//
+//   1. THE SENDER stamps every report with a `Bongos-Report-As-Of` header, taken
+//      BEFORE it reads the totals, and never puts the stamp in the body — the hub
+//      validates the body strictly, so a body field from a newer instance would
+//      400 on an older hub and lose the report.
+//   2. THE HUB ROUTE binds that header as the upsert's stamp, and reads a missing
+//      or unparseable one as "unstamped" (last-writer-wins, the old behaviour)
+//      rather than refusing — the sender never reads the response, so a 400 would
+//      silently drop the report, not just its ordering.
+//
+// DB-free: the core half pins require.cache and stubs fetch (the
+// tests/hub_recent_ships.mjs idiom); the hub half drives the real route handler
+// over a recording fake pool.
+//
+// Run:  node tests/activity_rollup_as_of.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+function mockPool(answer = () => ({ rows: [] })) {
+  const calls = [];
+  const query = async (text, params = []) => {
+    calls.push({ text: String(text), params, at: Date.now() });
+    return answer(String(text), params) || { rows: [] };
+  };
+  return {
+    calls,
+    query,
+    connect: async () => ({ query, release: () => {} }),
+    find: (re) => calls.find((c) => re.test(c.text)),
+  };
+}
+
+// ---- 1. the sender ----------------------------------------------------------
+
+console.log('\n1. the instance stamps each report, in a header:');
+
+const pin = (rel, exports) => {
+  const p = require.resolve(rel);
+  require.cache[p] = { id: p, filename: p, loaded: true, exports };
+};
+
+await t('reportActivityRollup sends Bongos-Report-As-Of, stamped before the totals were read', async () => {
+  const senderPool = mockPool((sql) => {
+    if (/FROM builders WHERE id/.test(sql)) {
+      return { rows: [{ github_id: 42, total_credits: 7, karma: 1, rank: 'metic', preferred_disciplines: ['engineer'] }] };
+    }
+    if (/count\(\*\)/.test(sql)) return { rows: [{ n: 3 }] };
+    return { rows: [] };
+  });
+  pin('../src/bongos/pool.js', { pool: senderPool });
+  pin('../src/bongos/auth-config.js', {
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'c1', clientSecret: 's' }),
+  });
+  delete require.cache[require.resolve('../src/bongos/auth-admission.js')];
+  const { reportActivityRollup } = require('../src/bongos/auth-admission.js');
+
+  const sent = [];
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async (url, opts) => { sent.push({ url, opts }); return { ok: true, json: async () => ({ ok: true }) }; };
+  const before = Date.now();
+  try {
+    await reportActivityRollup({ builderId: 7 });
+  } finally {
+    globalThis.fetch = realFetch;
+  }
+  assert.equal(sent.length, 1, 'exactly one rollup was sent');
+  assert.match(sent[0].url, /\/sso\/activity\/rollup$/);
+  const stamp = sent[0].opts.headers['Bongos-Report-As-Of'];
+  assert.equal(typeof stamp, 'string', 'the report carries its as-of header');
+  const ms = Date.parse(stamp);
+  assert.ok(Number.isFinite(ms) && new Date(ms).toISOString() === stamp, `an ISO timestamp, got ${stamp}`);
+  assert.ok(ms >= before && ms <= senderPool.calls[0].at,
+    'stamped BEFORE the first read — a stamp taken after could order a report ahead of totals read later');
+  const body = JSON.parse(sent[0].opts.body);
+  assert.equal(body.credits, 7, 'CONTROL: the body still carries the totals');
+  assert.ok(!Object.keys(body).some((k) => /as_?of/i.test(k)),
+    'the stamp must never ride the body: an older hub validates it strictly and would 400 the whole report');
+});
+
+// ---- 2. the hub route --------------------------------------------------------
+
+console.log('\n2. the hub binds the stamp, and an unusable one degrades to unstamped:');
+
+const SECRET = 'as-of-secret';
+function hubRoute() {
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  const rollupPool = mockPool((sql) => {
+    if (/FROM platform_identity_sso_clients/.test(sql)) {
+      return { rows: [{ client_id: 'c1', secret_hash: pi.sha256hex(SECRET), status: 'active', origin: 'https://p.example' }] };
+    }
+    if (/FROM platform_identity_project_memberships/.test(sql)) {
+      return { rows: [{ id: 1, client_id: 'c1', github_id: 42, membership_kind: 'member', signin_verified_at: '2026-08-29T00:00:00.000Z' }] };
+    }
+    return { rows: [{ id: 1 }] };
+  });
+  const helpers = require('../src/bongos/routes/_helpers.js');
+  const realApi = require('../src/module-api.js');
+  const moduleApiPath = require.resolve('../src/module-api.js');
+  require.cache[moduleApiPath] = {
+    id: moduleApiPath, filename: moduleApiPath, loaded: true,
+    exports: {
+      pool: rollupPool,
+      validateOrRespond: helpers.validateOrRespond,
+      resolveSession: async () => null,
+      logger: () => ({ info() {}, warn() {}, error() {} }),
+      LIVE_RANK_LADDER: realApi.LIVE_RANK_LADDER,
+      withTx: realApi.withTx,
+      corsPublicGet: () => (_q, _s, next) => next(),
+      on: () => () => {},
+      hasProvider: () => false,
+      registerProvider: () => {},
+    },
+  };
+  delete require.cache[require.resolve('../modules/platform-identity/routes/sso.js')];
+  const router = require('../modules/platform-identity/routes/sso.js')();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/sso/activity/rollup');
+  return { handle: layer.route.stack[0].handle, rollupPool };
+}
+
+async function postRollup(headers) {
+  const { handle, rollupPool } = hubRoute();
+  const res = { body: null, failure: null };
+  res.json = (b) => { res.body = b; return res; };
+  res.fail = (code, ...rest) => { res.failure = { code, rest }; return res; };
+  const lower = Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v]));
+  const req = {
+    get: (name) => lower[name.toLowerCase()],
+    body: { client_id: 'c1', client_secret: SECRET, github_id: 42, credits: 10, tasks_shipped: 2, karma: 1 },
+  };
+  await handle(req, res, () => {});
+  const insert = rollupPool.find(/INSERT INTO platform_identity_builder_project_activity/);
+  return { res, stamp: insert ? insert.params[8] : undefined };
+}
+
+await t('a stamped report binds its as-of as the upsert stamp', async () => {
+  const { res, stamp } = await postRollup({ 'Bongos-Report-As-Of': '2026-09-30T12:00:10.123Z' });
+  assert.equal(res.failure, null, JSON.stringify(res.failure));
+  assert.deepEqual(res.body, { ok: true });
+  assert.equal(stamp, '2026-09-30T12:00:10.123Z');
+});
+
+await t('no header (an older instance) is unstamped — the report still applies', async () => {
+  const { res, stamp } = await postRollup({});
+  assert.deepEqual(res.body, { ok: true });
+  assert.equal(stamp, null);
+});
+
+await t('an unparseable or oversized header is unstamped, never a 400 that would drop the report', async () => {
+  for (const bad of ['yesterday-ish', '', 'x'.repeat(200)]) {
+    const { res, stamp } = await postRollup({ 'Bongos-Report-As-Of': bad });
+    assert.equal(res.failure, null, `a bad stamp (${bad.slice(0, 20)}) refused the whole report`);
+    assert.equal(stamp, null, `a bad stamp (${bad.slice(0, 20)}) was bound`);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/activity_rollup_order_db.mjs

@@ -0,0 +1,131 @@
+// tests/activity_rollup_order_db.mjs — task 1004268 (real DB).
+//
+// A rollup report computed EARLIER never overwrites one computed LATER. The
+// instance stamps each report with the moment it read the totals (the
+// Bongos-Report-As-Of header, carried here as upsertActivity's `asOf`), and the
+// live row's ON CONFLICT DO UPDATE only fires when the incoming stamp is at least
+// the stored one. Before this, a sign-in report and a ship report racing to the
+// hub were last-writer-wins, so the older totals could commit last and the
+// leaderboard would read a regression that never happened.
+//
+// Only a real Postgres can settle this: the guard is a WHERE on the conflict
+// branch, and what it does with NULLs (a report from an instance too old to stamp,
+// a row written before the column existed) and with a skipped update (does the
+// snapshot beside it still agree with the live row?) is planner behaviour, not
+// statement shape.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/activity_rollup_order_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const pi = require('../modules/platform-identity/platform-identity.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`activity_rollup_order_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// High-numbered fixture ids so a shared DB can never collide with real data.
+const ORDER = 90042681, LEGACY = 90042682, FUTURE = 90042683, RACE = 90042684;
+const IDS = [ORDER, LEGACY, FUTURE, RACE];
+const CLIENT = 't1004268-client';
+const q = (sql, params) => pool.query(sql, params);
+const report = (githubId, credits, asOf) =>
+  pi.upsertActivity({ clientId: CLIENT, githubId, credits, tasksShipped: 1, karma: 0, asOf }, { pool });
+const at = (sec) => new Date(Date.UTC(2026, 8, 30, 12, 0, sec)).toISOString();
+
+async function cleanup() {
+  await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+  await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = ANY($1::bigint[])', [IDS]).catch(() => {});
+}
+async function live(githubId) {
+  const { rows } = await q(
+    `SELECT credits, reported_as_of FROM platform_identity_builder_project_activity
+      WHERE client_id = $1 AND github_id = $2`, [CLIENT, githubId]);
+  return rows[0];
+}
+async function newestSnapshot(githubId) {
+  const { rows } = await q(
+    `SELECT credits FROM platform_identity_activity_snapshots
+      WHERE client_id = $1 AND github_id = $2 ORDER BY reported_at DESC, id DESC LIMIT 1`, [CLIENT, githubId]);
+  return rows[0] ? rows[0].credits : null;
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  for (const f of ['platform_identity_005_builder_activity.sql', 'platform_identity_012_recent_ships.sql',
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_026_activity_reported_as_of.sql']) {
+    await q(migrationSql(f));
+  }
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql')); // idempotent: replays cleanly
+  await cleanup();
+
+  // 1 — the race the task describes, landed in the bad order.
+  await report(ORDER, 200, at(20)); // the ship report, computed later, lands first
+  await report(ORDER, 100, at(10)); // the sign-in report, computed earlier, lands last
+  same((await live(ORDER)).credits, 200, 'an older report landing last does not overwrite the newer totals');
+  same(await newestSnapshot(ORDER), 200, 'and the snapshot history does not record the regression either');
+  await report(ORDER, 300, at(30));
+  same((await live(ORDER)).credits, 300, 'a genuinely newer report still applies');
+  await report(ORDER, 250, at(30));
+  same((await live(ORDER)).credits, 250, 'an equal stamp applies (ties go to the later arrival, as before)');
+
+  // 2 — mixed versions. An instance too old to stamp sends no as_of: last-writer-wins,
+  // exactly as before, and it clears the guard rather than leaving a stamp its numbers
+  // no longer match.
+  await report(LEGACY, 10, null);
+  same((await live(LEGACY)).reported_as_of, null, 'an unstamped report stores no stamp');
+  await report(LEGACY, 20, at(10));
+  same((await live(LEGACY)).credits, 20, 'a stamped report over an unstamped row applies');
+  await report(LEGACY, 5, null);
+  same([(await live(LEGACY)).credits, (await live(LEGACY)).reported_as_of], [5, null],
+    'an unstamped report always applies and clears the stamp (the old behaviour, for old instances)');
+  await report(LEGACY, 30, at(1));
+  same((await live(LEGACY)).credits, 30, 'after it, the next stamped report applies whatever its stamp');
+
+  // 3 — a sender whose clock runs ahead cannot freeze the row: a stamp past the hub's
+  // own now() is stored as now(), so the next honest report is not refused until then.
+  await report(FUTURE, 1, new Date(Date.now() + 365 * 86400e3).toISOString());
+  const stored = new Date((await live(FUTURE)).reported_as_of).getTime();
+  ok(stored <= Date.now() + 1000, 'a future stamp is clamped to the hub clock');
+  await report(FUTURE, 2, new Date(Date.now() + 2000).toISOString());
+  same((await live(FUTURE)).credits, 2, 'so the next report from a correct clock still applies');
+
+  // 4 — racing writers: the row lock queues them, and whatever the commit order the
+  // row ends on the report with the LATEST stamp, and the newest snapshot agrees.
+  for (let round = 0; round < 10; round++) {
+    await q('DELETE FROM platform_identity_activity_snapshots WHERE github_id = $1', [RACE]);
+    await q('DELETE FROM platform_identity_builder_project_activity WHERE github_id = $1', [RACE]);
+    const stamps = [1, 2, 3, 4, 5].sort(() => Math.random() - 0.5);
+    await Promise.all(stamps.map((s) => report(RACE, s * 100, at(s))));
+    const row = await live(RACE);
+    assert.equal(row.credits, 500, `round ${round}: the row ended on ${row.credits}, not the latest-stamped 500`);
+    assert.equal(await newestSnapshot(RACE), 500, `round ${round}: the newest snapshot disagrees with the live row`);
+  }
+  pass++; console.log('  ok - 10 rounds of five racing reports in random order: the latest stamp always wins');
+
+  console.log(`\nactivity_rollup_order_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+}

package/tests/activity_snapshots_db.mjs

@@ -97,6 +97,8 @@ try {
   // column); without it here, the upsertActivity steps fail 42703 on a fresh database.
   await q(migrationSql('platform_identity_012_recent_ships.sql'));
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  // upsertActivity also writes reported_as_of (task 1004268) — same reason as 012 above.
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
   await cleanup();
 
   // 1 — the writer snapshots the LIVE row, and only when it changed.

package/tests/profile_rollup_consent.mjs

@@ -100,6 +100,8 @@ try {
   // before the fixtures, so its one-shot grandfather never sees LEGACY below.
   await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
+  // upsertActivity also writes reported_as_of (026, task 1004268): 42703 without it.
+  await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
   await cleanup();
 
   // CONSENT IS TWO COLUMNS (ADR 0213, task 1002913): profile_state='active' AND