@bongos/core 1.20.83 → 1.21.1

package/modules/ui-design/kit/fixtures/founding-genesis-demo.json

@@ -0,0 +1,176 @@
+{
+  "_": "A demo born into genesis (task 1004506): 3 people, 4 hours each. The plan was settled at birth from the demo (Monarchy / BDFL, one pass, no advisors), so decide is behind and scope is in progress, each stage minutes long. Built from the real server shaper (genesis-home.js demoPlan + shapeGenesis).",
+  "genesis": {
+    "stage": "scope",
+    "stage_number": 1,
+    "stage_count": 5,
+    "day": 1,
+    "deciding": false,
+    "plan": {
+      "days": {
+        "scope": 1,
+        "strategize": 1,
+        "charter": 1,
+        "legalize": 1,
+        "legislation": 1
+      },
+      "passes": 1,
+      "advisors": "none",
+      "government": "monarchy",
+      "expected_builders": 3,
+      "existing": false,
+      "demo": {
+        "people": 3,
+        "hours_each": 4
+      },
+      "minutes": {
+        "scope": 14,
+        "strategize": 10,
+        "charter": 10,
+        "legalize": 5,
+        "legislation": 10
+      }
+    },
+    "demo": {
+      "people": 3,
+      "hours_each": 4
+    },
+    "stages": [
+      {
+        "key": "scope",
+        "number": 1,
+        "label": "Scope",
+        "life": "primordial sea",
+        "plate": "r5-life-1-primordial-sea",
+        "done_when": "The scope is written: what you are making, for whom, and what is left out.",
+        "wakes": [
+          "roadmap",
+          "goals",
+          "goal-map"
+        ],
+        "days": 1,
+        "minutes": 14,
+        "due": "2026-10-01T09:14:00.000Z",
+        "state": "now",
+        "tasks": [
+          {
+            "id": "101",
+            "title": "Write the project scope: what we are making, for whom, and what is out of scope",
+            "status": "active",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "strategize",
+        "number": 2,
+        "label": "Strategize",
+        "life": "first cells",
+        "plate": "r5-life-2-first-cells",
+        "done_when": "The strategy is written out, or the one you have is linked.",
+        "wakes": [
+          "work"
+        ],
+        "days": 1,
+        "minutes": 10,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "102",
+            "title": "Write out the strategy, or link the one you already have",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "charter",
+        "number": 3,
+        "label": "Charter",
+        "life": "the genome",
+        "plate": "r5-life-3-genome",
+        "done_when": "The starting government is chosen and the bylaws are written.",
+        "wakes": [
+          "board-room"
+        ],
+        "days": 1,
+        "minutes": 10,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "103",
+            "title": "Choose the starting government and write the bylaws",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "legalize",
+        "number": 4,
+        "label": "Legalize",
+        "life": "the membrane",
+        "plate": "r5-life-4-membrane",
+        "done_when": "Rewards are decided, and who can be paid.",
+        "wakes": [
+          "economy"
+        ],
+        "days": 1,
+        "minutes": 5,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "104",
+            "title": "Decide how contributors are rewarded and who can be paid",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      },
+      {
+        "key": "legislation",
+        "number": 5,
+        "label": "Legislation",
+        "life": "the nervous system",
+        "plate": "r5-life-5-nervous-system",
+        "done_when": "The voting rules are set: who votes, and how many must agree.",
+        "wakes": [
+          "ranks"
+        ],
+        "days": 1,
+        "minutes": 10,
+        "due": null,
+        "state": "later",
+        "tasks": [
+          {
+            "id": "105",
+            "title": "Set the voting rules: who votes and how many must agree",
+            "status": "ready",
+            "finished": false
+          }
+        ],
+        "finished": 0,
+        "total": 1,
+        "board": null
+      }
+    ],
+    "can_close": false,
+    "can_come_alive": false
+  },
+  "viewer_id": "1"
+}

package/modules/ui-design/kit/fixtures/me-founding-demo.json

@@ -0,0 +1,27 @@
+{
+  "builder": {
+    "id": "1",
+    "github_login": "builder",
+    "display_name": "A Builder",
+    "avatar_url": "/__kit/avatar.svg",
+    "rank": "archon"
+  },
+  "founding_mode": {
+    "active": true,
+    "stage": "scope",
+    "stage_number": 1,
+    "stage_count": 5,
+    "day": 1,
+    "asleep": {
+      "roadmap": "scope",
+      "goals": "scope",
+      "goal-map": "scope",
+      "work": "strategize",
+      "board-room": "charter",
+      "economy": "legalize",
+      "ranks": "legislation",
+      "collab": "alive",
+      "roster": "alive"
+    }
+  }
+}

package/modules/ui-design/kit/fixtures/provisioning-instances-demo.json

@@ -16,6 +16,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null,
       "demo": {
@@ -89,6 +90,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": "2026-08-15T12:00:00.000Z",
       "open_intent": null
     },
@@ -107,6 +109,7 @@
       "last_verified_up": false,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null
     }

package/modules/ui-design/kit/fixtures/provisioning-instances-dns-pending.json

@@ -0,0 +1,49 @@
+{
+  "_": "Two projects whose address the platform's own lookup has not seen answer yet (task 1004505): beacon is active a minute after its standup, lumen is still standing up. The hub must link neither and name neither until dns_resolves is true. Only projects-dns-pending.states.json points at this.",
+  "instances": [
+    {
+      "id": 106,
+      "slug": "beacon",
+      "status": "active",
+      "domain": "beacon.cloudbongos.com",
+      "target_ref": "builder/beacon",
+      "hosting_shape": "cloud-host",
+      "owner_monthly_usd": null,
+      "onboard_mode": "scaffold",
+      "created_at": "$now-5m",
+      "provisioned_at": "$now-1m",
+      "updated_at": "$now-1m",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": null,
+      "dns_note": null,
+      "dns_resolves": false,
+      "torn_down_at": null,
+      "open_intent": null
+    },
+    {
+      "id": 107,
+      "slug": "lumen",
+      "status": "provisioning",
+      "domain": "lumen.cloudbongos.com",
+      "target_ref": "builder/lumen",
+      "hosting_shape": "cloud-host",
+      "owner_monthly_usd": null,
+      "onboard_mode": "scaffold",
+      "created_at": "$now-3m",
+      "provisioned_at": null,
+      "updated_at": "$now-2m",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": null,
+      "dns_note": null,
+      "dns_resolves": false,
+      "torn_down_at": null,
+      "open_intent": {
+        "action": "provision",
+        "state": "running",
+        "created_at": "$now-3m"
+      }
+    }
+  ]
+}

package/modules/ui-design/kit/fixtures/provisioning-instances.json

@@ -16,6 +16,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null
     },
@@ -75,6 +76,7 @@
       "last_verified_up": true,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": "2026-08-15T12:00:00.000Z",
       "open_intent": null
     },
@@ -93,6 +95,7 @@
       "last_verified_up": false,
       "error_note": null,
       "dns_note": null,
+      "dns_resolves": true,
       "torn_down_at": null,
       "open_intent": null
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.83",
+  "version": "1.21.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.83",
+      "version": "1.21.1",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.83",
+  "version": "1.21.1",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8659,5 +8659,40 @@
       "id": "1004513",
       "text": "A goal now finishes by itself when its last task ships. Before, if someone ticked off all of a goal's done-when criteria while one task was still being worked on, the goal stayed open forever once that task landed — it took ti"
     }
+  ],
+  "1.21.0": [],
+  "1.21.1": [
+    {
+      "id": "1004522",
+      "text": "The Governor City design now lives in the project itself, not only in a private design canvas. This is the design where a governor's home is a small animated city and each part of the government is a building. All six design f"
+    },
+    {
+      "id": "1004518",
+      "text": "If GitHub refuses a Release for lack of permission, the deploy page now names the exact thing to fix: the server's access token or its GitHub App, whichever it uses."
+    },
+    {
+      "id": "1004506",
+      "text": "New projects now open their hall already in genesis. When a project is created through the startup flow, the platform marks it, and on the founder's first visit the hall switches into founding mode, once and safely. Projects m"
+    },
+    {
+      "id": "1004521",
+      "text": "Releases Bongos 1.21.0, the first bigger-step update, so we can watch cloudbongos.com take it on its own."
+    },
+    {
+      "id": "1004515",
+      "text": "The new way to start a project is now agreed. It is one short flow of six screens with no progress bar, plain words, and a calm night-time look. Before anything is created, you confirm every setting we filled in for you."
+    },
+    {
+      "id": "1001004",
+      "text": "Every session's complete conversation, with secrets removed, is now saved on the server so the review team can read what was actually asked and answered. Only the owner or an administrator can read it, and each administrator r"
+    },
+    {
+      "id": "1004514",
+      "text": "When a project is updated from the deploy page, the update now always saves its new version, even on projects whose history has no author name set. Before, those projects quietly kept the update unsaved, so the next update tri"
+    },
+    {
+      "id": "1004505",
+      "text": "A new project's address now works the first time you open it. The platform creates the address before anything else, and the hub only links it once the platform has seen it answer. Before, an early click could leave your home"
+    }
   ]
 }

package/scripts/gds/provision.js

@@ -13,7 +13,8 @@
 // composes the docs/recipes/cloudbongos-standup.md runbook into ONE idempotent,
 // dry-run-default, drift-reconciling flow (ADR 0016 / ADR 0031 §9.4 trust boundary):
 //
-//   server (a process on an allocated port — co-tenant or cloud-host)
+//   DNS A record FIRST (task 1004505 — the name must exist before anyone is shown it)
+//     → server (a process on an allocated port — co-tenant or cloud-host)
 //     → createdb + GDS-only migrate (MEDUSA_GDS_ONLY=1)
 //     → write config + per-instance /etc/<inst>/web.env
 //     → install + enable a per-instance systemd unit (+ allocate a port)
@@ -251,8 +252,8 @@ async function provisionInstance(inst, deps) {
 
   if (isByoHost(inst.hosting_shape)) return recordByoHost(inst, deps); // stand up NOTHING, ABOVE every preflight — reasoning in provision-byo-host.js's header (ADR 0323)
   // ── preflight: DNS token scope (task 1980) ─────────────────────────────────
-  // BEFORE committing to the address (allocating a port / the
-  // step-5 DNS UPSERT), verify the control-plane Cloudflare token can actually reach
+  // BEFORE committing to the address (the step-0 DNS UPSERT /
+  // allocating a port), verify the control-plane Cloudflare token can actually reach
   // the domain's zone. Turns the Emersonian standup's confusing mid-flow step-5 DNS
   // failure into an up-front, actionable stop with no half-done provision. Read-only.
   if (inst.domain && CONFIG.dnsHook) {
@@ -292,6 +293,64 @@ async function provisionInstance(inst, deps) {
     const gap = caddyCheck(boxExec, { domain: inst.domain });
     if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
   }
+  // ── step 0: DNS FIRST — Cloudflare A-record UPSERT for the instance's domain (P4) ──
+  // The first mutation of a standup, ahead of the status flip and every step after it
+  // (task 1004505, BV2.PS17). The hub can show a project's address from the moment it
+  // is created, and a lookup made before the record exists is cached as "not found" by
+  // the visitor's resolver for the zone's negative TTL (30 min on cloudbongos.com) — a
+  // founder's first click used to lock their own home network out of the project for
+  // half an hour. Created here, the name answers before any surface can offer it; the
+  // hub also holds every link until a platform lookup has seen it answer (dns_resolves).
+  // The A-record target (recordIp):
+  //   • co-tenant  → PROVISION_PUBLIC_IP (the box it runs on — under remote-exec that
+  //                  is the co-hosting box, ADR 0130).
+  //   • standalone → the CONTROL PLANE's own IP (task 2074): it runs control-plane-
+  //                  local, so its domain must point HERE, not at the co-hosting box.
+  //                  PROVISION_CONTROL_PLANE_IP when remote-exec splits the two boxes;
+  //                  else PROVISION_PUBLIC_IP (all-local: one and the same machine).
+  //                  Remote-exec set but no control-plane IP configured → null, which
+  //                  makes this step fail loud rather than point the domain at the wrong box.
+  const recordIp = standalone ? CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp) : CONFIG.publicIp;
+  // Formalized in P4 (#1945): the shared box-dns-cloudflare.sh hook UPSERTs an A
+  // record pointing the domain at recordIp, in the domain's own zone. It runs on the
+  // CONTROL PLANE for every shape: the hook needs the Cloudflare token, which never
+  // leaves the control plane. A DNS FAILURE SURFACES (the task-1180 lesson: never
+  // report provision success while the A record silently didn't land) — and, being
+  // first, it now fails before anything else was touched.
+  let dnsUpserted = false;
+  if (inst.domain && CONFIG.dnsHook) {
+    if (!recordIp) {
+      const ipEnvHint = standalone ? 'PROVISION_CONTROL_PLANE_IP (standalone)' : 'PROVISION_PUBLIC_IP (co-tenant)';
+      if (apply) throw new Error(`cannot UPSERT DNS for ${inst.domain}: no target IP — set ${ipEnvHint} in the control-plane box.env`);
+      log(`  [dns] would upsert A ${inst.domain} once the target IP is known (set ${ipEnvHint})`);
+    } else {
+      // Standalone runs control-plane-local under the *.cloudbongos.com wildcard origin
+      // cert (task 2074/2077) → proxied=true (CF edge fronts it, IP hidden); co-tenant
+      // stays proxied=false so their on-demand ACME challenge (step 6) reaches the origin.
+      const dnsEnv = dnsUpsertEnv(inst, { publicIp: recordIp, proxied: standalone });
+      log(`  [dns] upsert A ${inst.domain} -> ${recordIp} (zone ${dnsEnv.CLOUDFLARE_ZONE}, proxied=${dnsEnv.BOX_PROXIED === '1'}) via ${CONFIG.dnsHook}`);
+      // controlExec, NOT exec: the DNS hook needs the Cloudflare token, which lives
+      // only on the control plane — it must never run on the (token-free) co-hosting
+      // box even when the box-mutating steps below go there over SSH (task 2065).
+      controlExec(CONFIG.dnsHook, { env: dnsEnv });
+      dnsUpserted = true;
+      // The clear half of the birth-path note (F16): a revive after the operator
+      // configured the hook must retire the stale "point your A record" sentence.
+      if (apply && provisioning.recordDnsNote) {
+        await provisioning.recordDnsNote(db, inst.id, null).catch(() => {});
+      }
+    }
+  } else {
+    log('  [dns] skipped (no domain, or BOX_DNS_HOOK unset)');
+    // Birth-path twin of the domain-attach note (F16): a domain with no hook is
+    // the same silent skip here, so the owner card gets the same sentence.
+    if (apply && inst.domain) {
+      if (provisioning.recordDnsNote) await provisioning.recordDnsNote(db, inst.id,
+        `Automatic DNS isn't set up on this platform — point ${inst.domain}'s A record at ${recordIp || 'your server'}, and this card will show when it answers.`
+      ).catch(() => {});
+    }
+  }
+
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
   const patch = {};
 
@@ -318,16 +377,6 @@ async function provisionInstance(inst, deps) {
   }
 
   // ── step 1: server ───────────────────────────────────────────────────────
-  // The A-record target for step 5's DNS UPSERT:
-  //   • co-tenant  → PROVISION_PUBLIC_IP (the box it runs on — under remote-exec that
-  //                  is the co-hosting box, ADR 0130).
-  //   • standalone → the CONTROL PLANE's own IP (task 2074): it runs control-plane-
-  //                  local, so its domain must point HERE, not at the co-hosting box.
-  //                  PROVISION_CONTROL_PLANE_IP when remote-exec splits the two boxes;
-  //                  else PROVISION_PUBLIC_IP (all-local: one and the same machine).
-  //                  Remote-exec set but no control-plane IP configured → null, which
-  //                  makes step 5 fail loud rather than point the domain at the wrong box.
-  const recordIp = standalone ? CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp) : CONFIG.publicIp;
   // Co-tenant OR standalone: a process bound to an allocated port on the box it runs
   // on. Co-tenant shares that box's checkout ($0, cloudbongos.com model — under
   // remote-exec, the co-hosting box); standalone (ADR 0108) runs from its OWN repo
@@ -433,46 +482,7 @@ async function provisionInstance(inst, deps) {
   log('  [backup] create backup dir + install + enable nightly DB backup timer');
   pm.installBackup(inst, { exec: boxExec, writeFile: boxWriteFile, sudoP, log });
 
-  // ── step 5: DNS — Cloudflare A-record UPSERT for the instance's domain (P4) ──
-  // Formalized in P4 (#1945): the shared box-dns-cloudflare.sh hook UPSERTs an A
-  // record pointing the domain at its target IP (recordIp), in the domain's own
-  // zone, proxied=false so Caddy's on-demand ACME challenge (step 6) reaches the
-  // origin (dnsUpsertEnv). It runs on the CONTROL PLANE for every shape: the hook
-  // needs the Cloudflare token, which never leaves the control plane.
-  // Unlike P3's best-effort allowFail, a DNS FAILURE now SURFACES (the task-1180
-  // lesson: never report provision success while the A record silently didn't land).
-  if (inst.domain && CONFIG.dnsHook) {
-    if (!recordIp) {
-      const ipEnvHint = standalone ? 'PROVISION_CONTROL_PLANE_IP (standalone)' : 'PROVISION_PUBLIC_IP (co-tenant)';
-      if (apply) throw new Error(`cannot UPSERT DNS for ${inst.domain}: no target IP — set ${ipEnvHint} in the control-plane box.env`);
-      log(`  [dns] would upsert A ${inst.domain} once the target IP is known (set ${ipEnvHint})`);
-    } else {
-      // Standalone runs control-plane-local under the *.cloudbongos.com wildcard origin
-      // cert (task 2074/2077) → proxied=true (CF edge fronts it, IP hidden); co-tenant
-      // stays proxied=false so their on-demand ACME challenge reaches the origin.
-      const dnsEnv = dnsUpsertEnv(inst, { publicIp: recordIp, proxied: standalone });
-      log(`  [dns] upsert A ${inst.domain} -> ${recordIp} (zone ${dnsEnv.CLOUDFLARE_ZONE}, proxied=${dnsEnv.BOX_PROXIED === '1'}) via ${CONFIG.dnsHook}`);
-      // controlExec, NOT exec: the DNS hook needs the Cloudflare token, which lives
-      // only on the control plane — it must never run on the (token-free) co-hosting
-      // box even when the box-mutating steps above went there over SSH (task 2065).
-      controlExec(CONFIG.dnsHook, { env: dnsEnv });
-      // The clear half of the birth-path note (F16): a revive after the operator
-      // configured the hook must retire the stale "point your A record" sentence.
-      if (apply && provisioning.recordDnsNote) {
-        await provisioning.recordDnsNote(db, inst.id, null).catch(() => {});
-      }
-    }
-  } else {
-    log('  [dns] skipped (no domain, or BOX_DNS_HOOK unset)');
-    // Birth-path twin of the domain-attach note (F16): a domain with no hook is
-    // the same silent skip here, so the owner card gets the same sentence.
-    if (apply && inst.domain) {
-      if (provisioning.recordDnsNote) await provisioning.recordDnsNote(db, inst.id,
-        `Automatic DNS isn't set up on this platform — point ${inst.domain}'s A record at ${recordIp || 'your server'}, and this card will show when it answers.`
-      ).catch(() => {});
-    }
-  }
-
+  // (step 5, the DNS UPSERT, moved to step 0 at the top — task 1004505.)
   // A re-point on a PRE-ACTIVE instance records its release here and never
   // reaches the attach leg (that one no-ops for anything but 'active'), so this
   // run owns the drain — and an `error` row is frequently a partial standup that
@@ -542,6 +552,20 @@ async function provisionInstance(inst, deps) {
   // standalone paths never cleared it). The runner hands its own observation
   // to the liveness overlay so the card gets an honest verdict immediately
   // instead of waiting ~5 min for the first sweep.
+  // ── step 7c: the platform's own lookup (task 1004505) ─────────────────────
+  // The record went in at step 0, minutes ago, so this lookup cannot race it into a
+  // cached miss. An answer lets the hub link the address the moment the row reads
+  // active, instead of waiting for the first liveness sweep. Only for a record this
+  // run created: a manual-DNS domain is the owner's to point, and the sweep finds it.
+  if (apply && dnsUpserted && provisioning.lookupAnswers && provisioning.recordDnsResolved) {
+    if (await provisioning.lookupAnswers(inst.domain, { lookup: deps.lookup })) {
+      await provisioning.recordDnsResolved(db, inst.id).catch(() => {});
+      log(`  [dns] ${inst.domain} answers — the hub may link it now`);
+    } else {
+      log(`  [dns] ${inst.domain} does not answer the control plane yet — the hub holds its link until the sweep sees it`);
+    }
+  }
+
   if (apply) {
     await provisioning.setInstanceStatus(db, inst.id, 'active', { ...patch, error_note: null, provisioned_at: new Date().toISOString() });
     // The overlay column is DOMAIN-scoped when a domain exists (the sweep

package/scripts/gds/session-digest.js

@@ -34,6 +34,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { cliClient, loadSession, arg } = require('./cli-lib');
+const { uploadSessionTranscript } = require('./session-transcript-upload');
 const { buildSessionDigest, collectEnvSecrets, foldSubagentUsage } = require('./ship');
 
 
@@ -115,8 +116,11 @@ function parseTranscript(transcriptPath) {
 
 async function main() {
   // Watchdog: a SessionEnd hook must never stall session exit. If the read or
-  // POST hangs (slow/offline network — fetch has no default timeout), bail.
-  const watchdog = setTimeout(() => process.exit(0), 6000);
+  // POST hangs (slow/offline network — fetch has no default timeout), bail. 25s,
+  // not the old 6s, because the full transcript (ADR 0051, up to ~12 MB) now
+  // uploads after the digest; the .claude/settings.json hook timeout (30s) is the
+  // outer bound, and a hang still just drops the upload, never blocks exit.
+  const watchdog = setTimeout(() => process.exit(0), 25000);
   watchdog.unref();
   try {
     const stdinRaw = await readStdin();
@@ -143,7 +147,8 @@ async function main() {
     const extraSecrets = collectEnvSecrets();
     if (session.token) extraSecrets.push(session.token);
 
-    const digest = buildSessionDigest(parseTranscript(transcriptPath), { extraSecrets });
+    const entries = parseTranscript(transcriptPath);
+    const digest = buildSessionDigest(entries, { extraSecrets });
     // task 1003435: fold this session's subagents subtree into model_usage, the
     // same way the on-ship upload does — the whole session's tokens, not just the
     // interactive thread's.
@@ -174,6 +179,9 @@ async function main() {
       console.error(
         `session-digest: stored full session (${digest.metrics.assistant_turns} turns, ${digest.totalTokens} tokens, ${digest.metrics.tool_error_count} tool errors).`
       );
+      // ADR 0051: every session's FULL scrubbed transcript, after the digest (the
+      // server builds the transcript row from the digest's). Non-fatal.
+      console.error(`session-digest: ${await uploadSessionTranscript(api, sessionId, entries, extraSecrets)}`);
     } else {
       console.error(`session-digest: skipped (POST ${r && r.status}${r && r.data && r.data.error ? ' ' + r.data.error : ''}).`);
     }