@bongos/core 1.20.83 → 1.21.2

package/modules/public-landing/public/projects.html

@@ -3193,8 +3193,8 @@ summary{min-height:24px;padding:3px 0;}
         '<div class="runs"><span class="rLbl">runs</span>' + tagsHtml(p.tags) + '</div>' +
         /* at most two doors (task 1003356): the site, and the hall where the
            viewer builds there and the hall answers at a different address */
-        '<div class="rowDoors">' + (safeHttpUrl(p.origin)
-          ? '<a class="rowGo" href="' + esc(safeHttpUrl(p.origin)) + '" target="_blank" rel="noopener">view</a>'
+        '<div class="rowDoors">' + (siteHref(p)
+          ? '<a class="rowGo" href="' + esc(siteHref(p)) + '" target="_blank" rel="noopener">view</a>'
           : '') + hallGlyphHtml(p, rel) + '</div>' +
         '</li>';
     }).join(''));
@@ -3413,8 +3413,12 @@ summary{min-height:24px;padding:3px 0;}
   var HALL_GLYPH = '<svg viewBox="0 0 20 20" aria-hidden="true"><path d="M2.8 7.4 10 3.5l7.2 3.9"/><path d="M5.2 8.8v5.6M10 8.8v5.6M14.8 8.8v5.6"/><path d="M3.4 16.3h13.2"/></svg>';
   function isMember(rel) { return rel === 'owner' || rel === 'builder'; }
   /* the row's hall glyph: a member's door, only where the hall is elsewhere */
+  /* the site door for a map entry: one of the viewer's own projects gets none until
+     its address answers (task 1004505, addressReady) */
+  function siteHref(p) { return p._inst && !addressReady(p._inst) ? '' : safeHttpUrl(p.origin); }
   function hallGlyphHtml(p, rel) {
     var hall = isMember(rel) ? hallUrlOf(p) : '';
+    if (p._inst && !addressReady(p._inst)) hall = '';   /* your own project's hall waits for its name too (task 1004505) */
     return hall
       ? '<a class="rowHall" href="' + esc(hall) + '" target="_blank" rel="noopener" aria-label="Builders\' hall" title="Builders\' hall">' + HALL_GLYPH + '</a>'
       : '';
@@ -3472,7 +3476,7 @@ summary{min-height:24px;padding:3px 0;}
   }
 
   function openCard(p, rel, returnTo) {
-    var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
+    var href = p.isSelf ? '/' : siteHref(p);
     /* the art: catalog text an Archon typed, scheme-checked server-side and
        again here before it becomes a src */
     cardArt(p.isSelf ? '' : (backdropPlate(p.card_backdrop) || safeHttpUrl(p.art_url)));
@@ -6937,7 +6941,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -7083,7 +7087,7 @@ summary{min-height:24px;padding:3px 0;}
       /* the door opens only when the project ANSWERS and sign-in is wired: a
          link to an address that does not resolve yet is the worst first
          impression a founder can get of their own project (task 1003232) */
-      if (live.instStatus !== 'active' || live.manifest !== 'done') {
+      if (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done') {
         return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks once your project is answering and sign-in above is wired. Then you’ll open <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>, sign in with GitHub once, and be seated as the owner — the founding Archon.</p></li>';
       }
       return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
@@ -7091,7 +7095,7 @@ summary{min-height:24px;padding:3px 0;}
 
     function renderStepEnterHall() {
       var domain = resolvedDomain();
-      if (domain && (live.instStatus !== 'active' || live.manifest !== 'done')) {
+      if (domain && (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done')) {
         return '<li class="slocked" data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Unlocks with the first sign-in — your project’s home will be <code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code>.</p></li>';
       }
       return domain
@@ -7383,6 +7387,14 @@ summary{min-height:24px;padding:3px 0;}
             projectPageLink('its own page') + '; the steps below that need one unlock then.', '', flow));
           return true;
         }
+        /* task 1004505: no link until the platform's own lookup has seen the name
+           answer. A founder's first click on a name that does not resolve yet is
+           cached as "not found" by their resolver for up to half an hour. */
+        if (!addressReady(inst)) {
+          setProgress(progressMarkup(2, 2,
+            'The build finished — your address is being set up. This panel links it the moment it answers.', '', flow));
+          return false;
+        }
         if (inst.last_verified_up === false) {
           setProgress(progressMarkup(2, 2,
             'The build finished, but ' + link + ' isn’t answering right now — this panel keeps checking.', '', flow));
@@ -7471,8 +7483,8 @@ summary{min-height:24px;padding:3px 0;}
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
-            if (inst && inst.status !== live.instStatus) {
-              live.instStatus = inst.status; renderSteps();
+            if (inst && (inst.status !== live.instStatus || addressReady(inst) !== live.addrReady)) {
+              live.instStatus = inst.status; live.addrReady = addressReady(inst); renderSteps();
               if (state.step === 13) paintRail(13);   /* the rail finishes only when the project answers */
             }
             var terminal = renderProgress(inst);
@@ -7505,7 +7517,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       try { sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
@@ -7797,6 +7809,11 @@ summary{min-height:24px;padding:3px 0;}
      so the page can never say "Answering at …" beside a chip that says "live?". */
   function verifiedAt(inst) { return inst.last_verified_at ? new Date(inst.last_verified_at).getTime() : 0; }
   function freshUp(inst) { var at = verifiedAt(inst); return !!(inst.last_verified_up && at && (Date.now() - at) <= FRESH_MS); }
+  /* an address is LINKED only once the platform's own lookup has seen it answer (task
+     1004505): a click made before the name exists is cached as "not found" by the
+     visitor's resolver for up to half an hour, so the provision status alone is never
+     enough. dns_resolves is the server's sighting; an up probe is the same proof. */
+  function addressReady(inst) { return !!(inst && inst.domain && (inst.dns_resolves || inst.last_verified_up)); }
   /* the landing moment (task 1003243): a standup or revive that VERIFIABLY came
      up, still recent enough to be news. Two gates, both already on the card —
      freshUp() so "live" stays ONE rule (a lit third stage beside a "live?" chip
@@ -7933,7 +7950,7 @@ summary{min-height:24px;padding:3px 0;}
     else if (inst.status === 'error' || (inst.status === 'active' && inst.last_verified_up === false)) cls += ' ashen';
     else if (inst.status === 'active' && !freshUp(inst)) cls += ' dim';
     var attrs = planetAttrs(pl) + ' style="--acc:' + pl.acc + ';--d:64px"';
-    if (inst.status === 'active' && inst.domain) {
+    if (inst.status === 'active' && addressReady(inst)) {
       return '<a class="' + cls + '"' + attrs + ' href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener" title="Open ' + esc(inst.slug) + '" aria-label="Open ' + esc(inst.slug) + '"><span class="disc"></span></a>';
     }
     return '<span class="' + cls + '"' + attrs + ' aria-hidden="true"><span class="disc"></span></span>';
@@ -8085,6 +8102,7 @@ summary{min-height:24px;padding:3px 0;}
      has. Since task 1003355 the list row acts on nothing, so a row's sentence
      sends the owner to the project's own page and the manage page's says
      "below" — the ADR 0199 §8 rule that a refusal must name a reachable door. */
+  var ADDRESS_SETTING_UP = 'Your address is being set up — it shows here, with a link, as soon as it answers.';
   function addressRow(inst, onManage) {
     /* state FIRST, then domain: a torn-down or snagged project still holds its
        domain (ADR 0181 keeps port + address), and the standup promise below
@@ -8099,6 +8117,13 @@ summary{min-height:24px;padding:3px 0;}
         /* "answering" is a VERIFIED claim (direction §3 / F16): only a FRESH up
            probe earns it — never the runner finishing its script, and never a
            probe the chip has already aged into "live?" */
+        /* task 1004505: no link — and no name to type — until the platform's own
+           lookup has seen it answer; the manual-DNS note still names the address,
+           because pointing it is the owner's own step */
+        if (!addressReady(inst)) {
+          return inst.dns_note ? 'Its address is <code>' + esc(inst.domain) + '</code>. ' + esc(inst.dns_note)
+            : ADDRESS_SETTING_UP;
+        }
         var link = '<a href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>';
         if (freshUp(inst)) return 'Answering at ' + link;
         /* the runner had no DNS hook (F16): the CAUSE beats the bare symptom —
@@ -8119,7 +8144,7 @@ summary{min-height:24px;padding:3px 0;}
         return 'Its address is ' + link + ' — confirming it answers.';
       }
       if (inst.status === 'error') return 'Address <code>' + esc(inst.domain) + '</code> — held for this project, but nothing is answering there yet.';
-      return 'Address: <code>' + esc(inst.domain) + '</code> — it answers there once the instance is live.';
+      return inst.dns_note ? 'Its address is <code>' + esc(inst.domain) + '</code>. ' + esc(inst.dns_note) : ADDRESS_SETTING_UP;
     }
     /* the HONEST no-address state: sign-in on the instance needs a real domain */
     return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one. ' +
@@ -8191,7 +8216,7 @@ summary{min-height:24px;padding:3px 0;}
        links, so middle/ctrl-click works; the delegated handler upgrades a plain
        click on Manage (task 1003041). */
     var acts = [];
-    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">View</a>');
+    if (inst.status === 'active' && addressReady(inst)) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">View</a>');
     acts.push('<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>');
     body += '<div class="actions">' + acts.join('') + '</div>';
     /* sig() buckets recency per minute, so a live row re-renders on the
@@ -8514,7 +8539,7 @@ summary{min-height:24px;padding:3px 0;}
     $('mErr').innerHTML = snag ? errMarkup(inst) : '';
     $('mErr').hidden = !snag;
     var acts = [];
-    if (inst.status === 'active' && inst.domain) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
+    if (inst.status === 'active' && addressReady(inst)) acts.push('<a class="btn small ghost" href="https://' + esc(inst.domain) + '" target="_blank" rel="noopener">Open site →</a>');
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-m-retry>Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-m-revive>Bring it back</button>');
     if (canRestart(inst)) acts.push('<button type="button" class="btn small" data-m-restart>Restart it</button>');
@@ -9319,7 +9344,7 @@ summary{min-height:24px;padding:3px 0;}
   /* what the project RUNS: its own public manifest, read cross-origin (the
      same GET /instance the platform's runner reads after a restart) */
   function loadVisRuns(inst) {
-    if (!inst || inst.status !== 'active' || !inst.domain) { visRuns(''); return; }
+    if (!inst || inst.status !== 'active' || !addressReady(inst)) { visRuns(''); return; }   /* the browser's own lookup waits for the name too (task 1004505) */
     var asked = manageId;
     visRuns('Checking what the project is running…');
     ensureManifest(inst.domain).then(function (ans) {
@@ -9772,7 +9797,7 @@ summary{min-height:24px;padding:3px 0;}
   /* what the project RUNS: the SAME shared manifest read the reach card uses
      (task 1003554) — a different key out of one answer, not a second GET */
   function loadJoinRuns(inst) {
-    if (!inst || inst.status !== 'active' || !inst.domain) { joinRuns(''); return; }
+    if (!inst || inst.status !== 'active' || !addressReady(inst)) { joinRuns(''); return; }   /* the browser's own lookup waits for the name too (task 1004505) */
     var asked = manageId;
     joinRuns('Checking what the project is running…');
     ensureManifest(inst.domain).then(function (ans) {

package/modules/sessions/db.js

@@ -658,6 +658,62 @@ async function getSessionById(id) {
   return rows[0] || null;
 }
 
+const TRANSCRIPT_PAGE_DEFAULT = 500; // turns per read; the reader pages with offset=
+const TRANSCRIPT_PAGE_MAX = 2000;
+
+// upsertSessionTranscript — store/refresh one session's FULL scrubbed transcript
+// (ADR 0051, task 1001004). Keyed on session_id like session_records, and the same
+// ownership guard applies: a row can only be rewritten by the builder who owns it,
+// so guessing another builder's session_id cannot overwrite their transcript. The
+// content arrives already scrubbed (the uploader's box is the scrub point); this
+// layer stores it and never inspects it. `turnsJson` is the ALREADY-serialized
+// array (the route serializes once to measure it; re-stringifying 12 MB here would
+// block the event loop a second time). The row is only ever created FROM the
+// caller's own session_records row, so a transcript cannot exist for a session the
+// builder did not upload a digest for (and a stranger cannot squat a session_id
+// ahead of its owner). Returns { session_id, turn_count, byte_size, truncated } or
+// null when there is no such owned session.
+async function upsertSessionTranscript({ sessionId, builderId, turnsJson, turnCount = 0, truncated = false, byteSize = 0 }) {
+  const { rows } = await pool.query(
+    `INSERT INTO session_transcripts (session_id, builder_id, turn_count, byte_size, truncated, turns)
+     SELECT sr.session_id, sr.builder_id, $3, $4, $5, $6::jsonb
+       FROM session_records sr
+      WHERE sr.session_id = $1 AND sr.builder_id = $2
+     ON CONFLICT (session_id) DO UPDATE SET
+       turn_count  = EXCLUDED.turn_count,
+       byte_size   = EXCLUDED.byte_size,
+       truncated   = EXCLUDED.truncated,
+       turns       = EXCLUDED.turns,
+       uploaded_at = now()
+     WHERE session_transcripts.builder_id = EXCLUDED.builder_id
+     RETURNING session_id, turn_count, byte_size, truncated`,
+    [sessionId, builderId, Math.max(0, Math.trunc(Number(turnCount) || 0)), Math.max(0, Math.trunc(Number(byteSize) || 0)), !!truncated, turnsJson]
+  );
+  return rows[0] || null;
+}
+
+// getSessionTranscript — one PAGE of the full transcript for one session_records row (by its
+// numeric id, the same id /sessions/:id uses), with the owner so the route can
+// apply the own-vs-Archon rule. null when the session or its transcript is absent.
+async function getSessionTranscript(id, { offset = 0, limit = TRANSCRIPT_PAGE_DEFAULT } = {}) {
+  const off = Math.max(0, Math.trunc(Number(offset) || 0));
+  const lim = Math.min(TRANSCRIPT_PAGE_MAX, Math.max(1, Math.trunc(Number(limit) || TRANSCRIPT_PAGE_DEFAULT)));
+  // The slice happens in Postgres so a page read never ships the whole MB-scale
+  // jsonb to Node just to throw most of it away.
+  const { rows } = await pool.query(
+    `SELECT sr.id, sr.session_id, sr.builder_id, st.turn_count, st.byte_size,
+            st.truncated, st.uploaded_at,
+            COALESCE((SELECT jsonb_agg(e.v ORDER BY e.n)
+                        FROM jsonb_array_elements(st.turns) WITH ORDINALITY AS e(v, n)
+                       WHERE e.n > $2 AND e.n <= $2 + $3), '[]'::jsonb) AS turns
+       FROM session_records sr
+       JOIN session_transcripts st ON st.session_id = sr.session_id
+      WHERE sr.id = $1`,
+    [Number(id), off, lim]
+  );
+  return rows[0] ? { ...rows[0], offset: off, limit: lim } : null;
+}
+
 // listSessionsByBuilder — a builder's OWN sessions (self-serve summary list).
 async function listSessionsByBuilder(builderId, limit = 25) {
   const { rows } = await pool.query(
@@ -865,6 +921,8 @@ async function sessionTypeCounts() {
 module.exports = {
   // write side (6D.1)
   upsertSessionRecord,
+  upsertSessionTranscript, // ADR 0051 — full scrubbed transcript (separate table)
+  getSessionTranscript,
   upsertSessionRecordWithReward, // route entry point — upsert + token reward (task 1005)
   awardDeferredSessionRewardForTask, // ADR 0120 land-side trigger — task.shipped listener calls it
   reconcileUnbookedSessionRewards, // ADR 0120 state-based safety net — books rewards for out-of-band ships

package/modules/sessions/routes/sessions.js

@@ -16,6 +16,11 @@
 //                             audited (the BFG principal posture until 6C.1).
 //   GET  /sessions/:id       — one session's full detail for deep-dive. Owner
 //                             self-serve; cross-builder requires Archon + audit.
+//   PUT  /sessions/:sid/transcript
+//                           — upload the FULL scrubbed transcript of your OWN
+//                             session (ADR 0051). Own 16 MB parser.
+//   GET  /sessions/:id/transcript
+//                           — read it. Owner, or Archon + audit written first.
 //
 // Cross-builder reads are GETs, which the global audit middleware does NOT
 // instrument — so each writes its own audit_log row (fail-closed: logged BEFORE
@@ -54,6 +59,16 @@ const seams = api; // resolveOptional('reward' | 'builder-settings') — kernel-
 const { validateOrRespond, parseId } = api;
 
 const UPLOAD_BODY_LIMIT = '4mb';
+// ADR 0051 — the full transcript is MB-scale. The client's own ceiling is 12 MB of
+// content (scripts/gds/session-transcript-build.js); 16 MB leaves JSON overhead.
+const TRANSCRIPT_BODY_LIMIT = '16mb';
+const MAX_TRANSCRIPT_TURNS = 20000;
+// SR-17 for the transcript (the sibling POST bounds detail[] to 2 MB; this row is
+// deliberately ~6x that because a full transcript IS the product, but it is still
+// bounded IN the handler, not just by the parser): a per-turn ceiling stops one
+// absurd turn, and the serialized total matches the client's own ceiling.
+const MAX_TRANSCRIPT_TURN_BYTES = 256 * 1024;
+const MAX_TRANSCRIPT_TOTAL_BYTES = 12 * 1024 * 1024;
 const MAX_DETAIL_TURNS = 5000; // a hard ceiling; ship.js bounds well under this
 
 // Disk-fill defense (SR-17 / task 997). The 4 MB body limit + maxItems=5000 cap
@@ -189,6 +204,7 @@ module.exports = function buildSessionsRouter() {
   registerSeams();
   const router = express.Router();
   const uploadJson = express.json({ limit: UPLOAD_BODY_LIMIT });
+  const transcriptJson = express.json({ limit: TRANSCRIPT_BODY_LIMIT });
 
   // rank: any-builder — upload your OWN session digest. Owner is forced to the
   // authenticated caller; the body cannot attribute a record to another builder.
@@ -315,6 +331,59 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // rank: any-builder — upload the FULL scrubbed transcript of your OWN session
+  // (ADR 0051, task 1001004). Separate from POST /sessions on purpose: the digest
+  // is KB and carries the reward/evaluator path under a 4 MB parser; the transcript
+  // is MB and gets its own larger parser, so a transcript failure can never block a
+  // digest. The row is created only FROM the caller's own session_records row (no
+  // digest → 404, someone else's session_id → 404, never a confirmation it exists).
+  // The content is scrubbed on the uploader's box; the server bounds SHAPE, not
+  // secrets — every turn must be a plain object and the whole body is capped.
+  router.put('/sessions/:sid/transcript', auth.requireBuilder, transcriptJson, async (req, res) => {
+    const sid = String(req.params.sid || '');
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(sid)) return res.fail('bad_session_id', 400);
+    if (validateOrRespond(req, res, {
+      turns: { required: true, type: 'array', maxItems: MAX_TRANSCRIPT_TURNS },
+      truncated: { type: 'boolean' },
+    })) return;
+    const body = req.body || {};
+    const turns = body.turns;
+    // Serialize each turn ONCE: the same strings are measured, then joined into the
+    // jsonb text the db stores, so a 12 MB transcript is not stringified twice.
+    const parts = new Array(turns.length);
+    let totalBytes = 2;
+    for (let idx = 0; idx < turns.length; idx++) {
+      const t = turns[idx];
+      if (!t || typeof t !== 'object' || Array.isArray(t)) {
+        return res.fail('bad_transcript_turn', { status: 400, message: `turns[${idx}] must be an object` });
+      }
+      parts[idx] = JSON.stringify(t);
+      const turnBytes = Buffer.byteLength(parts[idx], 'utf8');
+      if (turnBytes > MAX_TRANSCRIPT_TURN_BYTES) {
+        return res.fail('transcript_turn_too_large', { status: 413, message: `turns[${idx}] is ${turnBytes} bytes; the per-turn cap is ${MAX_TRANSCRIPT_TURN_BYTES} bytes` });
+      }
+      totalBytes += turnBytes + 1;
+      if (totalBytes > MAX_TRANSCRIPT_TOTAL_BYTES) {
+        return res.fail('transcript_too_large', { status: 413, message: `transcript exceeds the ${MAX_TRANSCRIPT_TOTAL_BYTES}-byte total cap` });
+      }
+    }
+    try {
+      const stored = await db.upsertSessionTranscript({
+        sessionId: sid,
+        builderId: req.builder.id, // owner = caller, never the body
+        turnsJson: `[${parts.join(',')}]`,
+        turnCount: turns.length,
+        truncated: body.truncated === true,
+        byteSize: totalBytes,
+      });
+      if (!stored) return res.fail('not_found', 404);
+      res.status(201).json({ transcript: stored });
+    } catch (err) {
+      api.logger('sessions').error(err, 'PUT /sessions/:sid/transcript failed');
+      res.fail('upload_failed', 500);
+    }
+  });
+
   // GET /sessions/search + /sessions/mine are declared BEFORE /sessions/:id so
   // Express matches the literal paths first (the numeric :id never swallows them).
 
@@ -458,5 +527,33 @@ module.exports = function buildSessionsRouter() {
     }
   });
 
+  // rank: any-builder — the FULL transcript of one session (ADR 0051). Same rule as
+  // GET /sessions/:id: the owner reads their own; a cross-builder read is
+  // Archon-only, 404 (never 403) for everyone else, and the fail-closed audit row
+  // is written BEFORE any transcript content is served — transcripts are the most
+  // sensitive thing this module holds. Paged (?offset=&limit=, default 500 turns,
+  // max 2000): a transcript is MB-scale and the response carries turn_count so the
+  // reader knows how far to go.
+  router.get('/sessions/:id/transcript', auth.requireBuilder, readRateLimit, async (req, res) => {
+    const id = parseId(req, res, { code: 'bad_session_id', positiveInt: true });
+    if (id === null) return;
+    try {
+      const t = await db.getSessionTranscript(id, { offset: req.query.offset, limit: req.query.limit });
+      if (!t) return res.fail('not_found', 404);
+      if (String(t.builder_id) !== String(req.builder.id)) {
+        if (req.builder.rank !== 'archon') return res.fail('not_found', 404);
+        await recordSessionRead(req, {
+          route: '/api/bongos/sessions/:id/transcript',
+          targetBuilderId: t.builder_id,
+          target: `transcript:${id}`,
+        });
+      }
+      res.json({ transcript: t });
+    } catch (err) {
+      api.logger('sessions').error(err, 'GET /sessions/:id/transcript failed');
+      res.fail('fetch_failed', 500);
+    }
+  });
+
   return router;
 };

package/modules/status-ui/public/status.js

@@ -1076,17 +1076,26 @@ function updateHeadlineShippedFromItems() {
 
 // ---------- leaderboard ----------
 
-// Set is locked at 8 for V2 (per limitations/pms-v2.md), so hardcoding the
-// emoji map here is cheaper than another API round-trip per page load.
-// Mirrors public-builders/builders.js — keep both in sync if the catalog
-// ever shifts (would require an ADR + version bump per the V2 contract).
+// The catalog is small and changes only by migration (the latest: the seven
+// craft achievements of task 1004438, migrations/core_270), so hardcoding the
+// emoji map here is cheaper than another API round-trip per page load. Mirrors
+// modules/hall-ui/public/roster.js ACH_EMOJI — tests/craft_achievements.mjs
+// holds both maps to the migration's ids and icons.
 const ACH_EMOJI = {
   'first-ship': '🚢',
   'first-claim': '🪙',
   'first-parallel-claim': '⚓',
   'streak-3': '🔥',
   'streak-7': '🌋',
-  'art-pipeline-shipper': '🎨',
+  // task 1004438: renamed Art Pipeline Engineer; the palette is the artist's now
+  'art-pipeline-shipper': '🛠️',
+  'first-thought-ignited': '💡',
+  'first-full-idea': '📜',
+  'first-board-ratification': '🏛️',
+  'thought-built-ten': '🌟',
+  'first-page-approved': '🎨',
+  'ten-pages-approved': '🖼️',
+  'whole-surface-tweaked': '🗺️',
   'gds-shipper': '⚙️',
   'breaking-the-100c-bar': '💯',
 };
@@ -1101,14 +1110,35 @@ function renderAchievementRow(ids) {
     if (!emoji) continue;
     const span = document.createElement('span');
     span.className = 'leader__ach';
-    span.title = id;
-    span.setAttribute('aria-label', id);
+    // the name as words ("First page approved"), not the id slug (task 1004438)
+    const words = String(id).replace(/-/g, ' ');
+    span.title = words.charAt(0).toUpperCase() + words.slice(1);
+    span.setAttribute('aria-label', span.title);
     span.textContent = emoji;
     row.appendChild(span);
   }
   return row.children.length > 0 ? row : null;
 }
 
+// task 1004437 (WA6.RP07): each row names its roles, main first — the crafts
+// the builder has EARNED in, from the row's own `roles.shown`, not only what
+// they declared. The same words the hall's roster uses. Text only, never markup.
+const ROLE_WORD = { engineer: 'Engineer', artist: 'Artist', ideator: 'Ideator' };
+function renderRoles(roles) {
+  const shown = roles && Array.isArray(roles.shown) ? roles.shown.filter((c) => ROLE_WORD[c]) : [];
+  if (!shown.length) return null;
+  const row = document.createElement('span');
+  row.className = 'leader__roles';
+  row.setAttribute('aria-label', 'roles');
+  shown.forEach((c, i) => {
+    const chip = document.createElement('span');
+    chip.className = i === 0 ? 'leader__role leader__role--lead' : 'leader__role';
+    chip.textContent = ROLE_WORD[c];
+    row.appendChild(chip);
+  });
+  return row;
+}
+
 async function loadLeaderboard() {
   const data = await fetchJson('/api/bongos/public/leaderboard');
   const rows = data.leaderboard || [];
@@ -1138,6 +1168,8 @@ async function loadLeaderboard() {
     login.className = 'leader__login';
     login.textContent = `@${b.github_login}`;
     name.appendChild(login);
+    const roles = renderRoles(b.roles);
+    if (roles) name.appendChild(roles);
     const badges = renderAchievementRow(b.achievements);
     if (badges) name.appendChild(badges);
     const credits = document.createElement('div');

package/modules/status-ui/public/style.css

@@ -749,6 +749,30 @@ main {
   letter-spacing: 0;
 }
 
+/* The roles under each builder's name (task 1004437): one small tag per role
+   the builder has earned in, the main one a step stronger, as the hall's
+   roster and the approved mock draw them, on this page's own palette. */
+.leader__roles {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px;
+  margin-top: 4px;
+}
+.leader__role {
+  display: inline-flex;
+  align-items: center;
+  min-height: 22px;
+  padding: 0 8px;
+  border: 1px solid var(--rule-soft);
+  font-family: var(--font-body);
+  font-size: 0.78rem;
+  font-weight: 400;
+  letter-spacing: 0;
+  color: var(--ink-soft);
+  text-transform: none;
+}
+.leader__role--lead { color: var(--ink); border-color: var(--rule); }
+
 /* Inline laurels next to each architect's name. Slightly dimmed so the
    name still leads the row; emoji glyphs would otherwise punch above the
    marble palette. PMS-V2 #54 */