@bongos/core 1.20.83 → 1.21.2

package/docs/recipes/private-npm-distribution.md

@@ -57,7 +57,7 @@ npm publish ./clients/bongos-client               # real (publishConfig makes it
 
 **Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check and waits for the `integration` lane's verdict on the commit it releases (task 1004290), auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
 
-**Candidates and Release** ([ADR 0361](../adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md), task 1004298). With the repo variable `PUBLISH_AS_CANDIDATE=1`, each merge publishes under the `next` label: the platform hall runs it, and no other project is offered it. **Release** on /deploy runs `publish.yml`'s `release` job (`workflow_dispatch`, input `release_version`), which moves `latest` to that version over the same OIDC trusted publisher. It needs **Allow npm dist-tag** ticked on the `publish.yml` trusted-publisher entry, and the server's GitHub App needs **Actions: write** to start the job. From a terminal the same job runs as `gh workflow run publish.yml -f release_version=<x.y.z>`. The arming order is in the ADR.
+**Candidates and Release** ([ADR 0361](../adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md), task 1004298). With the repo variable `PUBLISH_AS_CANDIDATE=1`, each merge publishes under the `next` label: the platform hall runs it, and no other project is offered it. **Release** on /deploy runs `publish.yml`'s `release` job (`workflow_dispatch`, input `release_version`), which moves `latest` to that version over the same OIDC trusted publisher. It needs **Allow npm dist-tag** ticked on the `publish.yml` trusted-publisher entry, and the server's GitHub credential needs **Actions: write** to start the job: the `GITHUB_PUSH_TOKEN` access token (what cloudbongos.com uses), or the GitHub App where one is configured. From a terminal the same job runs as `gh workflow run publish.yml -f release_version=<x.y.z>`. The arming order is in the ADR.
 
 The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):
 

package/migrations/core_269_session_transcripts.sql

@@ -0,0 +1,35 @@
+-- core_269_session_transcripts.sql — the FULL, secret-scrubbed transcript of every
+-- session (ADR 0051, task 1001004).
+--
+-- WHY A SEPARATE TABLE and not a widened session_records.detail / a new jsonb
+-- column on it: session_records is the BFG's hot, searched, paged table
+-- (searchSessions, summarizeSessions, /mine all SELECT from it, and its rows are
+-- KB by design — ADR 0027). A transcript is MB. Putting it on the same row would
+-- make every list query drag (or have to remember to exclude) a fat jsonb, and
+-- would make a TOASTed-column slip on one query a performance incident. One row
+-- per session in each table, joined on session_id, keeps the evaluator's read
+-- path exactly as cheap as it is today. ADR 0051 §1 allowed either shape
+-- ("new transcript jsonb column, or a widened detail"); this is the third
+-- option that satisfies its intent without the cost.
+--
+-- The content is scrubbed ON THE BUILDER'S BOX before upload (modules/security/
+-- secret-scrub.js, the task-1003 scrubber); this table never holds raw text.
+--
+-- builder_id is denormalised from session_records ON PURPOSE: the read route's
+-- ownership check (own transcript vs Archon-only cross-builder) must not depend
+-- on a join succeeding, and the upload's ownership guard needs it at write time.
+--
+-- Retention: keep forever (ADR 0051 §4, Lars 2026-06-13). Storage-cost work is a
+-- deliberate future task, not designed in here.
+
+CREATE TABLE IF NOT EXISTS session_transcripts (
+  session_id    text PRIMARY KEY,                       -- Claude Code session id, == session_records.session_id
+  builder_id    bigint NOT NULL REFERENCES builders(id),
+  turn_count    integer NOT NULL DEFAULT 0,
+  byte_size     integer NOT NULL DEFAULT 0,             -- serialized size of `turns`, for corpus accounting
+  truncated     boolean NOT NULL DEFAULT false,         -- true when the uploader hit its own size ceiling
+  turns         jsonb NOT NULL DEFAULT '[]'::jsonb,     -- per-turn scrubbed content (prompts, assistant text, tool calls + results)
+  uploaded_at   timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_session_transcripts_builder ON session_transcripts (builder_id);

package/migrations/core_270_craft_achievements.sql

@@ -0,0 +1,128 @@
+-- core_270_craft_achievements.sql — achievements for artist and ideator moments
+-- (task 1004438 / WA6.RP08, goal 1000095, criterion wa6-roles-read-true-in-public).
+--
+-- WHY. Every achievement was a claim or ship event, and the one art badge
+-- ("art-pipeline-shipper") fires when CODE touches art/ — it rewards engineering,
+-- not art. An artist who rewrites pages in the studio and an ideator whose thoughts
+-- become work earned nothing on the shelf. These seven are each keyed to a LEDGER
+-- fact the economy already books (credit_log), so they are awarded once, by the
+-- same reconcile every other achievement uses (modules/economy/achievements.js
+-- STATE_EVALUATORS), and backfilled below for work that already happened.
+--
+-- credit_bonus is 0 on all seven: they recognise work the ledger has already
+-- paid for, and a backfill that minted bonus credits for past work is a money
+-- decision this migration does not make.
+--
+-- A core migration, not an economy_* one: `achievements` and
+-- `builder_achievements` are core tables (modules/economy/CLAUDE.md, Tables).
+
+INSERT INTO achievements (id, name, description, icon, credit_bonus, sort_order) VALUES
+  ('first-thought-ignited', 'First Thought Ignited',
+   'A thought of yours became shipped work.',
+   '💡', 0, 90),
+  ('first-full-idea', 'First Full Idea',
+   'A Full Idea of yours passed the completeness bar.',
+   '📜', 0, 100),
+  ('first-board-ratification', 'Ratified by the Board',
+   'The board ratified an idea of yours.',
+   '🏛️', 0, 110),
+  ('thought-built-ten', 'A Thought That Built Ten',
+   'One thought of yours led to ten or more shipped tasks.',
+   '🌟', 0, 120),
+  ('first-page-approved', 'First Page Approved',
+   'A page you rewrote in Tweak Mode was approved and shipped.',
+   '🎨', 0, 130),
+  ('ten-pages-approved', 'Ten Pages Approved',
+   'Ten pages you rewrote in Tweak Mode were approved and shipped.',
+   '🖼️', 0, 140),
+  ('whole-surface-tweaked', 'A Whole Surface',
+   'Every page of one surface was rewritten by you and approved.',
+   '🗺️', 0, 150)
+ON CONFLICT (id) DO UPDATE
+  SET name         = EXCLUDED.name,
+      description  = EXCLUDED.description,
+      icon         = EXCLUDED.icon,
+      credit_bonus = EXCLUDED.credit_bonus,
+      sort_order   = EXCLUDED.sort_order;
+
+-- The misleading one, renamed rather than retired: builders who earned it keep it,
+-- and it now says what it is — engineering work on the art pipeline. The palette
+-- icon moves to First Page Approved, the artist's own badge.
+UPDATE achievements
+   SET name = 'Art Pipeline Engineer',
+       description = 'Ship engineering work on the art/ pipeline (code, not art; an artist earns First Page Approved).',
+       icon = '🛠️'
+ WHERE id = 'art-pipeline-shipper';
+
+-- ---- Backfill: everyone who already earned one, from the ledger ---------------
+-- Each unlock is stamped with the FIRST qualifying credit's time and task, so the
+-- shelf dates the moment, not this migration. ON CONFLICT DO NOTHING: re-running
+-- converges, and an unlock the live reconcile already wrote is left alone.
+-- "A Whole Surface" needs the page inventory, which is a file, not a table, so
+-- SQL cannot award it. It is backfilled by the lifecycle's periodic sweep, which
+-- runs economy's backfillCraftAchievements ONCE at every server start (so the
+-- deploy that applies this migration awards it within the first sweep), and by
+-- the reconcile on the artist's next approved page; by hand,
+-- `node scripts/gds/diagnose-achievements.js --apply`.
+
+-- the idea-stream and artist-lane prefixes, spelled as LIKE literals with the
+-- underscore escaped (modules/economy/credits.js IDEA_STREAM_REASON_PREFIXES,
+-- ARTIST_PAGE_REASON_PREFIX; tests/craft_achievements.mjs holds them together)
+INSERT INTO builder_achievements (builder_id, achievement_id, unlocked_at, unlocked_by_task_id)
+SELECT DISTINCT ON (builder_id) builder_id, 'first-thought-ignited', recorded_at, task_id
+  FROM credit_log
+ WHERE reason LIKE 'idea.credit.task\_ship:%' AND delta > 0
+ ORDER BY builder_id, recorded_at, id
+ON CONFLICT DO NOTHING;
+
+INSERT INTO builder_achievements (builder_id, achievement_id, unlocked_at, unlocked_by_task_id)
+SELECT DISTINCT ON (builder_id) builder_id, 'first-full-idea', recorded_at, task_id
+  FROM credit_log
+ WHERE reason LIKE 'idea.credit.full\_pass:%' AND delta > 0
+ ORDER BY builder_id, recorded_at, id
+ON CONFLICT DO NOTHING;
+
+INSERT INTO builder_achievements (builder_id, achievement_id, unlocked_at, unlocked_by_task_id)
+SELECT DISTINCT ON (builder_id) builder_id, 'first-board-ratification', recorded_at, task_id
+  FROM credit_log
+ WHERE reason LIKE 'idea.credit.governance\_pass:%' AND delta > 0
+ ORDER BY builder_id, recorded_at, id
+ON CONFLICT DO NOTHING;
+
+-- ten distinct shipped tasks paid under ONE idea (reason idea.credit.task_ship:<idea>:<task>);
+-- stamped at the tenth task's payment
+INSERT INTO builder_achievements (builder_id, achievement_id, unlocked_at, unlocked_by_task_id)
+SELECT DISTINCT ON (builder_id) builder_id, 'thought-built-ten', recorded_at, task_id
+  FROM (
+    SELECT builder_id, recorded_at, task_id, id,
+           DENSE_RANK() OVER (PARTITION BY builder_id, split_part(reason, ':', 2)
+                              ORDER BY first_paid) AS nth
+      FROM (
+        SELECT builder_id, recorded_at, task_id, id, reason,
+               MIN(recorded_at) OVER (PARTITION BY builder_id, split_part(reason, ':', 2), split_part(reason, ':', 3)) AS first_paid
+          FROM credit_log
+         WHERE reason LIKE 'idea.credit.task\_ship:%' AND delta > 0
+      ) per_task
+  ) ranked
+ WHERE nth >= 10
+ ORDER BY builder_id, recorded_at, id
+ON CONFLICT DO NOTHING;
+
+INSERT INTO builder_achievements (builder_id, achievement_id, unlocked_at, unlocked_by_task_id)
+SELECT DISTINCT ON (builder_id) builder_id, 'first-page-approved', recorded_at, task_id
+  FROM credit_log
+ WHERE reason LIKE 'tweak.page\_approved:%' AND delta > 0
+ ORDER BY builder_id, recorded_at, id
+ON CONFLICT DO NOTHING;
+
+-- the tenth approved page (one row per round, keyed on its task)
+INSERT INTO builder_achievements (builder_id, achievement_id, unlocked_at, unlocked_by_task_id)
+SELECT builder_id, 'ten-pages-approved', recorded_at, task_id
+  FROM (
+    SELECT builder_id, recorded_at, task_id,
+           ROW_NUMBER() OVER (PARTITION BY builder_id ORDER BY recorded_at, id) AS nth
+      FROM credit_log
+     WHERE reason LIKE 'tweak.page\_approved:%' AND delta > 0
+  ) pages
+ WHERE nth = 10
+ON CONFLICT DO NOTHING;

package/modules/economy/achievements.js

@@ -41,7 +41,7 @@ const streak = require('./streak');
 // getLockedAchievementsProgress/renderProgressText), moved from src/bongos/db.js,
 // reads the shared pool through the published doorway — a module never requires a
 // core internal. The evaluators above take a tx `client` from the caller.
-const { pool } = require('../../src/module-api');
+const { pool, resolveOptional } = require('../../src/module-api');
 
 async function alreadyUnlocked(client, builderId, achievementId) {
   const r = await client.query(
@@ -367,6 +367,88 @@ async function eligible_streak7(client, builderId) {
   return s.longest_streak >= 7;
 }
 
+// ---- the craft achievements (task 1004438 / WA6.RP08) --------------------------
+// An artist and an ideator earn on the LEDGER, not on a claim: each predicate
+// below is a fact credit_log already holds (the reason prefixes are economy's own,
+// the same strings the writers book and migrations/core_270 backfills from). None
+// needs a ship of the builder's own; reconcileAfterCraftCredit (below) runs them
+// the moment such a credit is booked.
+const IDEA_SHIP_LIKE = 'idea.credit.task\\_ship:%';
+const IDEA_FULL_LIKE = 'idea.credit.full\\_pass:%';
+const IDEA_BOARD_LIKE = 'idea.credit.governance\\_pass:%';
+const PAGE_LIKE = 'tweak.page\\_approved:%';
+const THOUGHT_TASKS = 10;
+const PAGES_MANY = 10;
+
+//
+// ONE READ FOR ALL SEVEN. craftFacts asks the builder's craft ledger once —
+// served by idx_credit_log_builder (builder_id, recorded_at), so it is that
+// person's rows, never the whole ledger — and every craft rule is a pure test of
+// its answer. The full reconcile and the craft-only one read the SAME facts
+// through the SAME rules (CRAFT_RULES), so the two paths cannot disagree about
+// who earned what. Within one reconcile the facts are read once and shared.
+const CRAFT_FACTS_SQL = `
+  SELECT bool_or(reason LIKE $2) AS ignited,
+         bool_or(reason LIKE $3) AS full_idea,
+         bool_or(reason LIKE $4) AS ratified,
+         COUNT(*) FILTER (WHERE reason LIKE $5)::int AS pages,
+         (SELECT COALESCE(MAX(n), 0)::int FROM (
+            SELECT COUNT(DISTINCT split_part(reason, ':', 3)) AS n
+              FROM credit_log
+             WHERE builder_id = $1 AND reason LIKE $2 AND delta > 0
+             GROUP BY split_part(reason, ':', 2)) per_thought) AS best_thought_tasks
+    FROM credit_log
+   WHERE builder_id = $1 AND delta > 0`;
+
+async function craftFacts(client, builderId) {
+  const r = await client.query(CRAFT_FACTS_SQL, [builderId, IDEA_SHIP_LIKE, IDEA_FULL_LIKE, IDEA_BOARD_LIKE, PAGE_LIKE]);
+  const row = r.rows[0] || {};
+  return {
+    ignited: row.ignited === true,
+    fullIdea: row.full_idea === true,
+    ratified: row.ratified === true,
+    pages: Number(row.pages) || 0,
+    bestThoughtTasks: Number(row.best_thought_tasks) || 0,
+  };
+}
+
+// Every page of one surface rewritten by this artist and approved: the studio's
+// own "N of M tweaked" per surface (copy-desk's `copy-desk.artistStats` port, the
+// one the profile header reads), so the inventory has one reader. Asked ONLY of a
+// builder with an approved page — anyone else structurally cannot earn it, and
+// the port is not free. A port that is absent or fails is "could not tell", never
+// a badge.
+async function wholeSurfaceTweaked(builderId, facts) {
+  if (!(facts.pages > 0)) return false;
+  const port = resolveOptional('copy-desk.artistStats');
+  if (typeof port !== 'function') return false;
+  const stats = await port(builderId);
+  const surfaces = (stats && Array.isArray(stats.surfaces)) ? stats.surfaces : [];
+  return surfaces.some((s) => Number(s.total) > 0 && Number(s.tweaked) >= Number(s.total));
+}
+
+// id → (facts, builderId) → boolean | Promise<boolean>, in sort order.
+const CRAFT_RULES = [
+  ['first-thought-ignited', (f) => f.ignited],
+  ['first-full-idea', (f) => f.fullIdea],
+  ['first-board-ratification', (f) => f.ratified],
+  // one thought, ten shipped tasks: stream 1's reason is idea.credit.task_ship:<idea>:<task>
+  ['thought-built-ten', (f) => f.bestThoughtTasks >= THOUGHT_TASKS],
+  ['first-page-approved', (f) => f.pages > 0],
+  ['ten-pages-approved', (f) => f.pages >= PAGES_MANY],
+  ['whole-surface-tweaked', (f, builderId) => wholeSurfaceTweaked(builderId, f)],
+];
+const CRAFT_IDS = CRAFT_RULES.map(([id]) => id);
+
+// The STATE_EVALUATORS form of a rule: read the facts once per reconcile (the
+// shared `ctx`), then test. diagnose-achievements.js reaches the rules this way.
+function craftEvaluator(rule) {
+  return async (client, builderId, ctx = {}) => {
+    if (!ctx.craftFacts) ctx.craftFacts = craftFacts(client, builderId);
+    return rule(await ctx.craftFacts, builderId);
+  };
+}
+
 // Ordered by achievements.sort_order so banners/backfill output read naturally.
 const STATE_EVALUATORS = [
   { id: 'first-ship',            fn: eligible_firstShip },
@@ -378,6 +460,7 @@ const STATE_EVALUATORS = [
   { id: 'subtractor',            fn: eligible_subtractor },
   { id: 'gds-shipper',           fn: eligible_gdsShipper },
   { id: 'breaking-the-100c-bar', fn: eligible_breaking100c },
+  ...CRAFT_RULES.map(([id, rule]) => ({ id, fn: craftEvaluator(rule) })),
 ];
 
 // Unlock every achievement the builder currently qualifies for but hasn't yet.
@@ -387,9 +470,10 @@ const STATE_EVALUATORS = [
 async function reconcileBuilderAchievements(client, builderId, opts = {}) {
   const { taskId = null } = opts;
   const results = [];
+  const ctx = {}; // shared by the craft rules: their facts are read once per reconcile
   for (const ev of STATE_EVALUATORS) {
     if (await alreadyUnlocked(client, builderId, ev.id)) continue;
-    if (await ev.fn(client, builderId)) {
+    if (await ev.fn(client, builderId, ctx)) {
       const unlocked = await unlockAchievement(client, builderId, ev.id, taskId);
       if (unlocked) results.push(unlocked);
     }
@@ -397,6 +481,83 @@ async function reconcileBuilderAchievements(client, builderId, opts = {}) {
   return results;
 }
 
+// reconcileCraftAchievements — ONLY the seven craft rules, in two reads: what the
+// builder already holds of them, then (only if anything is left) their craft
+// facts. The payout hook below runs this, not the full sixteen-evaluator
+// reconcile: an idea credit or an approved page cannot change a streak, a claim
+// count or a shipped diff, so asking about those on every payment is waste.
+async function reconcileCraftAchievements(client, builderId, opts = {}) {
+  const { taskId = null } = opts;
+  const held = await client.query(
+    'SELECT achievement_id FROM builder_achievements WHERE builder_id = $1 AND achievement_id = ANY($2::text[])',
+    [builderId, CRAFT_IDS]
+  );
+  const have = new Set((held.rows || []).map((r) => r.achievement_id));
+  const open = CRAFT_RULES.filter(([id]) => !have.has(id));
+  if (!open.length) return [];
+  const facts = await craftFacts(client, builderId);
+  const results = [];
+  for (const [id, rule] of open) {
+    if (await rule(facts, builderId)) {
+      const unlocked = await unlockAchievement(client, builderId, id, taskId);
+      if (unlocked) results.push(unlocked);
+    }
+  }
+  return results;
+}
+
+// backfillCraftAchievements — the part of the backfill a migration cannot do.
+// migrations/core_270 backfills six badges from the ledger in SQL, but "A Whole
+// Surface" needs the page inventory, which is a file the database never sees. So
+// the lifecycle's periodic sweep (publish-reconciler.js) runs this ONCE per
+// process start: every builder the craft ledger has paid, through the craft-only
+// reconcile, in id order, bounded. Idempotent, so a restart that runs it again
+// unlocks nothing twice. Returns { checked, unlocked }.
+async function backfillCraftAchievements({ client = null, limit = 500 } = {}) {
+  const q = client || pool;
+  const { rows } = await q.query(
+    `SELECT DISTINCT builder_id FROM credit_log
+      WHERE delta > 0 AND (reason LIKE $1 OR reason LIKE $2 OR reason LIKE $3 OR reason LIKE $4)
+      ORDER BY builder_id
+      LIMIT $5`,
+    [IDEA_SHIP_LIKE, IDEA_FULL_LIKE, IDEA_BOARD_LIKE, PAGE_LIKE, limit]
+  );
+  let unlocked = 0;
+  for (const r of rows) {
+    const got = await reconcileAfterCraftCredit(q, r.builder_id);
+    unlocked += got.length;
+  }
+  return { checked: rows.length, unlocked };
+}
+
+// reconcileAfterCraftCredit — the craft writers' hook (task 1004438). An idea
+// stream or an approved page pays a builder inside SOMEONE ELSE'S ship (or an
+// idea route's own read), so the ship-time reconcile — which runs for the shipper
+// — never reaches the ideator or the artist. credits.js calls this for each payee
+// it just booked. It can never fail the payment: on a transaction client it runs
+// under a SAVEPOINT and rolls back to it on any error; on a pool (an idea route
+// pays through the pool, one idempotent statement) SAVEPOINT itself fails, nothing
+// is open to poison, and the reconcile runs plainly inside a try. Returns the
+// just-unlocked list, or [] on any failure.
+async function reconcileAfterCraftCredit(client, builderId, opts = {}) {
+  if (builderId == null || !client || typeof client.query !== 'function') return [];
+  let saved = false;
+  try {
+    await client.query('SAVEPOINT ach_craft_credit');
+    saved = true;
+  } catch (_) { /* not in a transaction: a pool */ }
+  try {
+    const out = await reconcileCraftAchievements(client, builderId, opts);
+    if (saved) await client.query('RELEASE SAVEPOINT ach_craft_credit');
+    return out;
+  } catch (_) {
+    if (saved) {
+      try { await client.query('ROLLBACK TO SAVEPOINT ach_craft_credit'); } catch (_e) { /* the caller's tx decides */ }
+    }
+    return [];
+  }
+}
+
 // -------------------------------------------------------------------------
 // Achievements — minimal getters added by migration 006_pms_v2.
 // Full evaluator + unlock writes live in src/bongos/achievements.js (task K1).
@@ -436,6 +597,10 @@ async function getLeaderboardWithAchievements(limit = 10, perBuilderCap = 5) {
             b.avatar_url,
             b.total_credits,
             b.rank,
+            -- task 1004437: karma too, as credits.leaderboard carries it, so the
+            -- hall's roster can read this one public list (with its roles) and
+            -- keep its karma column and lens. The profile already publishes it.
+            b.karma,
             COALESCE((
               SELECT array_agg(t.achievement_id ORDER BY t.sort_order)
                 FROM (
@@ -504,7 +669,14 @@ async function getLockedAchievementsProgress(builderId) {
              AND a.outcome = 'shipped' AND a.released_at IS NOT NULL
              AND b2.outcome = 'shipped' AND b2.released_at IS NOT NULL
              AND tstzrange(a.claimed_at, a.released_at)
-              && tstzrange(b2.claimed_at, b2.released_at))                     AS overlap_pairs
+              && tstzrange(b2.claimed_at, b2.released_at))                     AS overlap_pairs,
+         -- task 1004438: the craft counters, from the ledger
+         (SELECT COUNT(*) FROM credit_log
+           WHERE builder_id = $1 AND reason LIKE 'tweak.page\\_approved:%' AND delta > 0) AS pages_approved,
+         (SELECT COALESCE(MAX(n), 0) FROM (
+            SELECT COUNT(DISTINCT split_part(reason, ':', 3)) AS n FROM credit_log
+             WHERE builder_id = $1 AND reason LIKE 'idea.credit.task\\_ship:%' AND delta > 0
+             GROUP BY split_part(reason, ':', 2)) t)                           AS best_thought_tasks
      )
      SELECT a.id            AS achievement_id,
             a.name,
@@ -516,7 +688,9 @@ async function getLockedAchievementsProgress(builderId) {
             c.art_ships,
             c.pms_ships,
             c.total_credits,
-            c.overlap_pairs
+            c.overlap_pairs,
+            c.pages_approved,
+            c.best_thought_tasks
        FROM achievements a
        CROSS JOIN counters c
       WHERE NOT EXISTS (
@@ -594,6 +768,25 @@ function renderProgressText(row) {
       return artShips === 0
         ? 'needs one shipped task touching art/'
         : 'keep building';
+    // task 1004438: the craft achievements
+    case 'first-thought-ignited':
+      return 'needs one thought of yours to become shipped work';
+    case 'first-full-idea':
+      return 'needs one Full Idea to pass the completeness bar';
+    case 'first-board-ratification':
+      return 'needs the board to ratify one idea of yours';
+    case 'thought-built-ten': {
+      const best = Math.max(0, Math.min(Number(row.best_thought_tasks || 0), 10));
+      return `${best} of 10 shipped tasks from one thought`;
+    }
+    case 'first-page-approved':
+      return 'needs one page you rewrote to be approved';
+    case 'ten-pages-approved': {
+      const pages = Math.max(0, Math.min(Number(row.pages_approved || 0), 10));
+      return `${pages} of 10 pages approved`;
+    }
+    case 'whole-surface-tweaked':
+      return 'needs every page of one surface rewritten by you and approved';
     case 'gds-shipper':
       return pmsShips === 0
         ? 'needs one shipped task touching src/bongos/ or scripts/gds/'
@@ -612,6 +805,8 @@ module.exports = {
   evaluateAfterShip,
   evaluateAfterCreditAward,
   reconcileBuilderAchievements,
+  reconcileAfterCraftCredit,
+  backfillCraftAchievements,
   STATE_EVALUATORS,
   alreadyUnlocked,
   unlockAchievement,

package/modules/economy/credits.js

@@ -429,9 +429,21 @@ async function bookIdeaSplit(client, { payees, reason, taskId = null, describe }
     if (rowCount > 0) credited += p.delta;
     booked.push({ ...p, booked: rowCount > 0 });
   }
+  // task 1004438: an idea credit is an ideator's moment (First Thought Ignited,
+  // First Full Idea, Ratified by the Board, A Thought That Built Ten), and it is
+  // booked inside someone else's ship, so the shipper's reconcile never reaches
+  // the payee. Every idea stream books through here; each payee just paid is
+  // reconciled, and the hook can never fail the payment.
+  for (const p of booked) {
+    if (p.booked) await craftAchievements().reconcileAfterCraftCredit(client, p.builderId, { taskId });
+  }
   return { credited, payees: booked };
 }
 
+// Lazy: achievements.js sits beside this file and requires nothing of it, but a
+// load-time require would make the two files' load order matter for no reason.
+function craftAchievements() { return require('./achievements'); }
+
 // Stream 2 (ADR 0172 / IC2): a Full Idea with a passing completeness score pays
 // its author IDEA_FULL_PASS_CREDIT, ONCE. Transaction-participant like the rest
 // of the reward port — the caller passes its `client` (a pool works too, since
@@ -1243,6 +1255,10 @@ async function awardArtistPageCredit(client, { taskId, config = rewardConfig() }
     [t.artist_id, taskId, priced.effective, reason,
       `Approved page tweak, task #${taskId}: ${priced.description} to its artist (artist lane, ADR 0341 D10)`]
   );
+  // task 1004438: an approved page is the artist's moment (First Page Approved,
+  // Ten Pages Approved, A Whole Surface). Reconciled here as well as at ship, so
+  // a re-sweep that pays the round outside the ship still reaches the shelf.
+  if (rowCount > 0) await craftAchievements().reconcileAfterCraftCredit(client, t.artist_id, { taskId });
   return rowCount > 0
     ? { credited: priced.effective, reason: 'paid', artistId: t.artist_id, delta: priced.effective }
     : { credited: 0, reason: 'already_paid', artistId: t.artist_id, delta: priced.effective };

package/modules/economy/reward.js

@@ -55,6 +55,9 @@ module.exports = {
   // fires on EVERY ship path (incl. confirmTask / grader_bypass, which never
   // evaluated achievements before, so most builders only ever got first-claim).
   reconcileBuilderAchievements: (...a) => achievements.reconcileBuilderAchievements(...a),
+  // task 1004438: the craft badges a migration cannot backfill ("A Whole Surface"
+  // needs the page inventory, a file) — the lifecycle's sweep runs this once per start.
+  backfillCraftAchievements: (...a) => achievements.backfillCraftAchievements(...a),
   // pure helpers + constants (display / tests)
   applyKindMultiplier: (...a) => credits.applyKindMultiplier(...a),
   computeSessionTokenReward: (...a) => credits.computeSessionTokenReward(...a),

package/modules/hall-ui/public/builders.js

@@ -1174,7 +1174,7 @@
       getJSON(`${API}/achievements`),
       getJSON(`${API}/me/recent-ships?limit=all`),
       getJSON(`${API}/versions`),
-      getJSON(`${API}/leaderboard`),
+      getJSON(`${API}/public/leaderboard`), // task 1004437: the list with each builder's roles
       getJSON(`${API}/public/progress`), // task 1003464: "<version> is N percent shipped"
     ]);
 

package/modules/hall-ui/public/genesis-home.js

@@ -79,7 +79,7 @@
     var now = g.stages.find(function (s) { return s.state === 'now'; });
     var sub = g.deciding
       ? 'Deciding the plan' + (g.day ? ' · day ' + g.day : '')
-      : 'Stage ' + g.stage_number + ' of ' + g.stage_count + ' · ' + (now ? now.label.toLowerCase() : g.stage) + (g.day ? ' · day ' + g.day : '');
+      : 'Stage ' + g.stage_number + ' of ' + g.stage_count + ' · ' + (now ? now.label.toLowerCase() : g.stage) + (g.demo ? ' · demo' : g.day ? ' · day ' + g.day : '');
     return '<div class="genesis__head"><h2 id="genesis-h" class="scroll__h">Genesis</h2>'
       + '<p class="genesis__sub">' + esc(sub) + '</p></div>' + stepperHtml(g);
   }
@@ -157,7 +157,10 @@
   function stagesHtml(g) {
     return '<ol class="genesis__stages">' + g.stages.map(function (s) {
       var wakes = (s.wakes || []).map(function (id) { return ROOM[id] || id; });
-      var due = s.state === 'now' && s.due ? ' · due ' + new Date(s.due).toLocaleDateString(undefined, { month: 'short', day: 'numeric' }) : '';
+      // A demo's stage is minutes long (task 1004506): say how long, and due at a time.
+      var due = s.minutes
+        ? ' · ' + s.minutes + ' min' + (s.state === 'now' && s.due ? ', due ' + new Date(s.due).toLocaleTimeString(undefined, { hour: 'numeric', minute: '2-digit' }) : '')
+        : s.state === 'now' && s.due ? ' · due ' + new Date(s.due).toLocaleDateString(undefined, { month: 'short', day: 'numeric' }) : '';
       return '<li class="genesis__stage is-' + s.state + '">'
         + '<span class="genesis__stage-n">0' + s.number + '</span>'
         + '<span class="genesis__stage-t"><b>' + esc(s.label) + '</b>'
@@ -225,12 +228,23 @@
     return document.documentElement.getAttribute('data-founding') === 'on';
   }
 
+  // A demo's genesis is expedited (task 1004506): its plan was settled from the demo's
+  // own picks before anyone saw it, so it never shows the decide form, only this line.
+  function demoHtml(g) {
+    var d = g.demo;
+    if (!d) return '';
+    var total = g.stages.reduce(function (n, s) { return n + (s.minutes || 0); }, 0);
+    return '<p class="scroll__lede">A demo’s genesis is short: about ' + esc(String(total)) + ' minutes, then the rest of your time is for building. '
+      + 'The plan is already set from your demo: Monarchy / BDFL, ' + esc(String(d.people)) + (d.people === 1 ? ' person, ' : ' people, ')
+      + esc(String(d.hours_each)) + (d.hours_each === 1 ? ' hour' : ' hours') + ' each. Finish each stage’s task, then approve it to move on.</p>';
+  }
+
   function render(host, state) {
     var g = state.genesis;
     if (!g) { host.hidden = true; return; }
     host.innerHTML = headHtml(g) + (g.deciding
       ? decideHtml(g, state.gov)
-      : lifeHtml(g) + '<div class="genesis__grid">' + stagesHtml(g) + nowHtml(g, state.viewer) + '</div>');
+      : demoHtml(g) + lifeHtml(g) + '<div class="genesis__grid">' + stagesHtml(g) + nowHtml(g, state.viewer) + '</div>');
     host.hidden = false;
   }
 

package/modules/hall-ui/public/hall-render.js

@@ -578,6 +578,7 @@
           <span>Member since ${fmtDate(builder.created_at)}</span>
           <span title="${escapeHtml(karmaTooltip)}">${karmaTrend.replace(' in 30d', ' karma in 30d')}</span>
           ${rollPlace ? `<span title="Your place on the leaderboard (top ${rollPlace.total}), ranked by ${curLabel()}.">#${rollPlace.place} on the leaderboard</span>` : ''}
+          ${rolePlaceText(rollPlace) ? `<span title="Your place among the ${rollPlace.role.total} builders shown as ${ROLE_AS[rollPlace.role.craft]}, ranked by the ${curLabel()} that role earned.">${rolePlaceText(rollPlace)}</span>` : ''}
         </div>
         <div class="profile__disciplines">
           <span class="profile__disc-label">Preferred work:</span>
@@ -611,7 +612,7 @@
     setText('stat-karma-sub', karmaTrendText);
     const statRank = document.getElementById('stat-rank');
     if (statRank) statRank.innerHTML = builder.rank ? renderRankBadge(normalizeRank(builder.rank), { tip: false }) : '—';
-    setText('stat-rank-sub', rollPlace ? `#${rollPlace.place} on the leaderboard` : '');
+    setText('stat-rank-sub', rollPlace ? [`#${rollPlace.place} on the leaderboard`, rolePlaceText(rollPlace)].filter(Boolean).join(' · ') : '');
     const statsSection = document.getElementById('home-stats');
     if (statsSection && !ctx.newcomerGated) statsSection.hidden = false;
 
@@ -1274,7 +1275,28 @@
       (a, b) => (Number(b.total_credits) || 0) - (Number(a.total_credits) || 0),
     );
     const idx = ranked.findIndex((r) => r.github_login === login);
-    return idx === -1 ? null : { place: idx + 1, total: ranked.length };
+    if (idx === -1) return null;
+    // task 1004437: the place inside the builder's MAIN role too, the roster's
+    // role toggle read the same way (credits earned in that craft, among the
+    // builders it is shown for), so an artist's card can say where they stand
+    // as an artist and not only beside every engineer's session pay.
+    const me = ranked[idx];
+    const main = me.roles && me.roles.main;
+    let role = null;
+    if (main && me.roles.credits_by_craft) {
+      const credit = (r) => Number(r.roles && r.roles.credits_by_craft && r.roles.credits_by_craft[main]) || 0;
+      const peers = ranked.filter((r) => r.roles && Array.isArray(r.roles.shown) && r.roles.shown.includes(main));
+      const order = peers.map((r, i) => ({ r, i })).sort((a, b) => (credit(b.r) - credit(a.r)) || (a.i - b.i));
+      const at = order.findIndex((x) => x.r === me);
+      if (at !== -1) role = { craft: main, place: at + 1, total: peers.length };
+    }
+    return { place: idx + 1, total: ranked.length, role };
+  }
+  const ROLE_AS = { engineer: 'an engineer', artist: 'an artist', ideator: 'an ideator' };
+  // "#2 as an artist" — only when it says something the overall place does not.
+  function rolePlaceText(p) {
+    if (!p || !p.role || !ROLE_AS[p.role.craft] || p.role.place === p.place) return '';
+    return `#${p.role.place} as ${ROLE_AS[p.role.craft]}`;
   }
 
   // task 1003459 — the Claim button on each Home "Next up" row, through the

package/modules/hall-ui/public/index-genesis-demo.states.json

@@ -0,0 +1,13 @@
+{
+  "_": "The genesis home of a DEMO, born into genesis (task 1004506): 3 people, 4 hours each. The plan was settled at birth from the demo's picks, so there is no decide form: one line names the plan, and each stage reads in minutes (scope in progress, due at a time). /me says founding at scope (kit fixture me-founding-demo.json) and /founding/genesis answers founding-genesis-demo.json, built from the real server shaper. A real project's genesis is index-genesis.states.json and index-genesis-decide.states.json; a hall that is not founding is index.states.json.",
+  "page": "/builders/",
+  "surface": "hall-ui",
+  "stub": { "prefix": "/builders/", "fixtures": { "me": "me-founding-demo", "founding-genesis": "founding-genesis-demo" } },
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/me/", "/api/(gds|bongos)/tasks", "/api/(gds|bongos)/claims", "/api/(gds|bongos)/goals", "/api/(gds|bongos)/inbox", "/api/(gds|bongos)/live", "/api/(gds|bongos)/analytics/", "/api/(gds|bongos)/achievements", "/api/(gds|bongos)/versions", "/api/(gds|bongos)/leaderboard", "/api/(gds|bongos)/removal-proposals", "/api/(gds|bongos)/blockers"],
+  "_ignored": "removal-proposals and blockers are fixtures the kit stub does not carry; index.states.json's home render reports the same two 404s.",
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
+  "states": {
+    "demo": { "auth": true, "actions": [["wait", 800]], "expect": { "visible": ["#genesis-home", "#founding-band"] } }
+  }
+}

package/modules/hall-ui/public/roster.css

@@ -22,6 +22,27 @@
 .dir-who__t { display: flex; flex-direction: column; gap: 1px; min-width: 132px; }
 .dir-name { font-weight: 500; color: var(--ink); overflow-wrap: anywhere; }
 .dir-login { font-family: var(--font-mono); font-size: 11.5px; color: var(--ink-faint); }
+/* ---- the roles (task 1004437, the approved mock's leaderboard) -------------
+   The toggle: pill chips on the glass, the pressed one filled in ink (the mock's
+   .chip). The roles column: one pill per role shown, the main one a step
+   stronger (the mock's .role / .role--lead, the profile header's chips). */
+.roster-roles { display: flex; flex-wrap: wrap; gap: 6px; margin: 0 0 var(--sp-sm); }
+.roster-role {
+  min-height: 34px; padding: 0 14px; border: 0; border-radius: var(--radius-pill);
+  background: var(--glass); color: var(--ink-soft);
+  font: inherit; font-size: 13px; cursor: pointer;
+}
+.roster-role:hover { color: var(--ink); background: var(--glass-strong); }
+.roster-role[aria-pressed="true"] { background: var(--ink); color: var(--bg-card); }
+.lb-roles { display: inline-flex; flex-wrap: wrap; gap: 4px; }
+.lb-role {
+  display: inline-flex; align-items: center; min-height: 24px; padding: 0 9px;
+  border-radius: var(--radius-pill); background: var(--glass);
+  font-size: 12.5px; color: var(--ink-soft); white-space: nowrap;
+}
+.lb-role--lead { background: var(--glass-strong); color: var(--ink); }
+.lb-roles--none, .lb-none { color: var(--ink-faint); }
+
 /* The roster's place cell carries two facts: the place, and under it the
    builder's number in the same mono/faint voice the login uses (task
    1002837). Block display so the id never wraps up beside the place. */