@bongos/core 1.21.154 → 1.21.155

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.154",
-  "core_contract": "1.21.154",
-  "source_commit": "046cb72ed357309e34e58fb712b7efa7b56a4888",
+  "core_version": "1.21.155",
+  "core_contract": "1.21.155",
+  "source_commit": "52dca2e93875584dd158bf10e45f5ada2e514f5d",
   "source_ref": "HEAD",
-  "built_at": "2026-10-22T14:58:30.668Z",
+  "built_at": "2026-10-22T15:30:40.144Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3808,
-  "tree_sha256": "9b227a8bf5b2795c452c985814ac1f22809900835d5148efee15c24a2203b4af",
+  "tree_sha256": "20b6a1ac82282fb2440342571c00fa8e0d05ceedf5a7e5a18f18b477e8aa50d0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2412,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "36192920b84dfe1a36853f586c7de9259b6ce62adba750ef73537a050604b6d7"
+      "sha256": "7af2be903aaae34204963c5bb83ee7cefa31b85569ee46def97749519f08cc86"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "0ce492be99e91cdf249acc1f49c2acfde87e652b5a73a95c1d12ff41865273ff"
+      "sha256": "df33993ea06f5d5cee24402e3768c17ac2cec08252dcc0e25a058a4bf2eeb1eb"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "933a5d803257d84f6df3fa2fd66229f74e0463ba41f23256ab7db81c7a689ca8"
+      "sha256": "1e26586f1e872e4c3717b12d21c62b2412d41152b89259a7629e1eb62e2dc827"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7187,7 +7187,7 @@
     {
       "path": "modules/lifecycle/criterion-uat.js",
       "mode": "0000644",
-      "sha256": "dadd4f70a3bfe1679519e77b3dacd5a6078c358ff831dc567307ba18a7a8e62e"
+      "sha256": "096c77513ded2056c09d40c7743d1a0e0f4e1e01c16f9f3cb5da80b897489433"
     },
     {
       "path": "modules/lifecycle/db-analytics.js",
@@ -10557,12 +10557,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8896ac22750733e9413d6ac302b78e85999a7878eb8ca8c1ec1af5e493abea42"
+      "sha256": "33f1d7e3960bd0b4954fdece29a8c35764e99f00fbd57d701b44d5f652b3fa9c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1a220fca30df53b3e1cc4ae053b91ec424e142b0e2aaf38bf53bf22cf444b5ba"
+      "sha256": "7143a612dd45e63e65244c8d5f56f1a253f9dbb392c07f1965d4a2d02ebc315d"
     },
     {
       "path": "public-docs/index.html",
@@ -10582,7 +10582,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "3dbca36d0a1743a39859a3d3d26cf209db264cd6bd6c8588e7ebf1177be55b75"
+      "sha256": "9117c7df1bc5d28ae11e4a99b168949db3684bb4eb08d5f1c328bbe5ee461786"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10957,7 +10957,7 @@
     {
       "path": "scripts/gds/copy-inventory.js",
       "mode": "0000644",
-      "sha256": "9dd80d2c37602c59cb75db0be02cfadc737fc64891a81d03f5be5f0ea5e35a27"
+      "sha256": "18e08203b33af87b4d5e7d52e76fed2b5c6c8838c15a4f644d7b0b4b686a14d1"
     },
     {
       "path": "scripts/gds/core-origin-follow.js",
@@ -12962,7 +12962,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "39421d70df1f7628486cf17294e001fc06d49fa502847ca7786fff43fb2738c4"
+      "sha256": "d36ae4917f2bb33204869e2ea14e9dc383dde6347bd881b147b6c13fd76730b0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13962,7 +13962,7 @@
     {
       "path": "tests/copy_inventory.mjs",
       "mode": "0000644",
-      "sha256": "b3a2787a34a78bb961bb55ef9de52088881dc2f9cbe6ce7098f0803cd1548146"
+      "sha256": "d62fb2e59647d14586851bd1c14c215fb2f086cfcf06f33fa763e9d2eec86f47"
     },
     {
       "path": "tests/core_258_box_session_claims_db.mjs",
@@ -14137,7 +14137,7 @@
     {
       "path": "tests/criterion_uat.mjs",
       "mode": "0000644",
-      "sha256": "7c89e2ecb1caa66d00284447b1ff89ad4783cd109e1bc9e12a075a9223f8f462"
+      "sha256": "c1c906829e7a3b572a8f751dd658a6fa91bf34d21529c1a9ffb36d6ab459267c"
     },
     {
       "path": "tests/criterion_uat_routes.mjs",

package/docs/copy-inventory.md

@@ -4,15 +4,15 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2771 strings** across 3 surfaces · 2350 distinct pieces of copy · 2771 certain, 0 heuristic · 241 shown in more than one place.
+**2784 strings** across 3 surfaces · 2363 distinct pieces of copy · 2784 certain, 0 heuristic · 241 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 148 | 1963 |
+| `builders-hall` | `modules/hall-ui/public` | 148 | 1964 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
-| `landing` | `modules/public-landing/public` | 9 | 708 |
+| `landing` | `modules/public-landing/public` | 9 | 720 |
 
 ## Confidence, and why it is on every row
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8226c979db4d` | 3x | Not now | modules/hall-ui/public/collab.js:668, modules/hall-ui/public/paintbrush.js:119, modules/hall-ui/public/paintbrush.js:183 |
 | … | | _201 more in the JSON registry_ | |
 
-## `builders-hall` — 1963 strings
+## `builders-hall` — 1964 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -1456,6 +1456,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7a29c910cc5b` | certain | Tweak {…} — {…} | `modules/hall-ui/public/tweak-editor.js:286` |
 | `18801fb6845f` | certain | Tweak/CopyWrite Flow | `modules/hall-ui/public/studio.html:123` |
 | `18801fb6845f` | certain | Tweak/CopyWrite Flow | `modules/hall-ui/public/studio.html:153` |
+| `2850b51235fd` | certain | Two different bills, one column each. The first is what a project costs this platform. The second is an estima | `modules/hall-ui/public/fleet.html:39` |
 | `4a25dba3ef56` | certain | Type it yourself | `modules/hall-ui/public/commands-lib.js:93` |
 | `4a25dba3ef56` | certain | Type it yourself | `modules/hall-ui/public/commands.html:37` |
 | `348507a25334` | certain | Type these in a Claude Code session on this project. Most also start when you simply say what you want in plai | `modules/hall-ui/public/commands.html:34` |
@@ -2151,7 +2152,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7667eb552781` | certain | {…}: {…}% ({…}/{…} checks) | `modules/status-ui/public/status.js:468` |
 | `6d0d64f10bd9` | certain | ‹ earlier page | `modules/status-ui/public/index.html:321` |
 
-## `landing` — 708 strings
+## `landing` — 720 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -2194,6 +2195,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d7e8b03c25ce` | certain | A note (optional): how you know each other. | `modules/public-landing/public/connections.html:166` |
 | `c209b53693c0` | certain | A note for the owner (optional) — what you’d like to work on, who you are. | `modules/public-landing/public/invitations.html:175` |
 | `407982c3d4ff` | certain | A project as a codebase, regardless of function. | `modules/public-landing/public/index.html:779` |
+| `437ddce8e760` | certain | A project is a record here and a database of its own. The record holds its name, the GitHub repository it ship | `modules/public-landing/public/privacy.html:108` |
 | `c3504a900b0f` | certain | A project stood up from the hub runs on the platform's servers at your request. Any cost is shown before you c | `modules/public-landing/public/terms.html:111` |
 | `6cb796f01882` | certain | A project you create | `modules/public-landing/public/privacy.html:107` |
 | `167a256eeca5` | certain | A repo I already have | `modules/public-landing/public/projects.html:1731` |
@@ -2294,6 +2296,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d919980d2ca5` | certain | Download our core code and protocols, and build instantly with your team. | `modules/public-landing/public/index.html:879` |
 | `41c49e22002d` | certain | Download the CLI | `modules/public-landing/public/index.html:912` |
 | `18b6b56edc93` | certain | Each sign-in creates a session: a random token, whether it came from the browser or the command line, the brow | `modules/public-landing/public/privacy.html:104` |
+| `032693d19430` | certain | Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency | `modules/public-landing/public/terms.html:116` |
 | `9a4a940d2a56` | certain | Emersonian Circles | `modules/public-landing/public/index.html:768` |
 | `9150fa905ba4` | certain | Enough for a small version. Trim it to one shared list, voting and a winner reveal; accounts and notifications | `modules/public-landing/public/projects.html:1580` |
 | `05fed739a9e1` | certain | Enter Genesis | `modules/public-landing/public/projects.html:2129` |
@@ -2306,6 +2309,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `654dfc6855b5` | certain | Everything, for you | `modules/public-landing/public/projects.html:1970` |
 | `1b5a6cfc494c` | certain | Example World | `modules/public-landing/public/index.html:758` |
 | `70e3e447cf7c` | certain | Expert consulting | `modules/public-landing/public/projects.html:1987` |
+| `e14fd6120fc6` | certain | Extras are the optional parts a project can run — extra AI agents, a Discord mirror, and the rest. You picked  | `modules/public-landing/public/projects.html:1334` |
 | `7c8dcf228e70` | certain | Extras for this project | `modules/public-landing/public/projects.html:1864` |
 | `2585087f4873` | certain | Fair use | `modules/public-landing/public/terms.html:123` |
 | `b6a70459e3f7` | certain | Fill these in from my last project | `modules/public-landing/public/projects.html:1553` |
@@ -2342,6 +2346,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `97c0329fc07b` | certain | How much is run for you | `modules/public-landing/public/projects.html:1969` |
 | `485c565b5745` | certain | How people join | `modules/public-landing/public/projects.html:1269` |
 | `4b542b000afa` | certain | How this project is drawn: on the sky, in your list, at the top of this page and on its card. A planet is a | `modules/public-landing/public/projects.html:1402` |
+| `5a2650d439ce` | certain | How this project is listed — the kind shown beside its name on the map, in the table and on its card. It is a  | `modules/public-landing/public/projects.html:1314` |
 | `a86a02b0ded9` | certain | How your project’s own hall looks: its colours in light and dark mode, whether its dark mode takes a tint of y | `modules/public-landing/public/projects.html:1432` |
 | `23febbbd53e2` | certain | I can sign for this project, and I accept the | `modules/public-landing/public/projects.html:2043` |
 | `9f31eaed8252` | certain | If you grant repository access while creating a project, that permission is used to create or adopt your repos | `modules/public-landing/public/privacy.html:105` |
@@ -2606,7 +2611,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e37a1cf49d98` | certain | The builders you know, across every project. A connection is a way to find each other again; it grants no rank | `modules/public-landing/public/connections.html:113` |
 | `183c89fecb58` | certain | The code is open | `modules/public-landing/public/privacy.html:124` |
 | `a954f0dce9a3` | certain | The platform | `modules/public-landing/public/contact.html:115` |
+| `82d751a27370` | certain | The platform first gives this project its own read-only deploy key and switches its deploys over to it, and on | `modules/public-landing/public/projects.html:1242` |
 | `4fd8f5746cc5` | certain | The platform is run as a non-profit, capture-resistant commons. | `modules/public-landing/public/terms.html:100` |
+| `768a6990ebfc` | certain | The platform stores the date you accepted these terms, and which version, on your account. It is written when  | `modules/public-landing/public/terms.html:120` |
 | `20fcebaa85c4` | certain | The project hub needs JavaScript — the map, your projects, and starting a new one all live here. You can read  | `modules/public-landing/public/projects.html:873` |
 | `4a740b5afe73` | certain | The project map | `modules/public-landing/public/projects.html:883` |
 | `d4e91fc9e8ce` | certain | The projects you build on, and leaving one, are on your account page. | `modules/public-landing/public/projects.html:1075` |
@@ -2624,6 +2631,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e6c859147ba4` | certain | This cannot be undone. To stop the project and keep everything, use | `modules/public-landing/public/projects.html:1467` |
 | `b5ec30734473` | certain | This can’t be built | `modules/public-landing/public/projects.html:1693` |
 | `886326f70c38` | certain | This guild is public, and you’re a member who isn’t on its public page. Nobody is listed there until they say  | `modules/public-landing/public/guild.html:202` |
+| `a1aa7835abce` | certain | This is a list of which variables your project needs and what each one is for — not the secrets themselves. Th | `modules/public-landing/public/projects.html:1349` |
 | `d83b739afb1e` | certain | This is a project’s management page — it answers only to the person who owns it. Sign in with GitHub to open y | `modules/public-landing/public/projects.html:1111` |
 | `637ca6a1649a` | certain | This project,{{productName}}has two environments a code & user one respectively (or a Repo & Builders hall) | `modules/public-landing/public/contact.html:97` |
 | `11c244aec5c3` | certain | This statement describes the software as it ships and changes when the software does. Revised August 2026. | `modules/public-landing/public/privacy.html:126` |
@@ -2634,6 +2642,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `64e08f62d974` | certain | Try a demo. | `modules/public-landing/public/projects.html:1559` |
 | `3672d2e5f619` | certain | Try a small demo instead | `modules/public-landing/public/projects.html:1546` |
 | `b1dd149424ea` | certain | Turn the filter off to see what everyone else is building — or start your own. | `modules/public-landing/public/projects.html:909` |
+| `50f764cf1229` | certain | Two things, and only two: a name — this project already has one — and a description of what it is. Modules, ar | `modules/public-landing/public/projects.html:1214` |
 | `b0c3729108be` | certain | Type a country | `modules/public-landing/public/projects.html:1631` |
 | `a165999f36a9` | certain | Types of projects | `modules/public-landing/public/index.html:877` |
 | `2f740afee113` | certain | US and EU | `modules/public-landing/public/projects.html:1655` |
@@ -2642,6 +2651,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `11416e2b83fa` | certain | Use these | `modules/public-landing/public/projects.html:1591` |
 | `52e9981a4a49` | certain | Used once to create your app on your Render account, then thrown away — not kept, not even in this browser. A  | `modules/public-landing/public/projects.html:1916` |
 | `6e1001190059` | certain | VERRO LABS | `modules/public-landing/public/index.html:863` |
+| `f68a38de7e1b` | certain | Visitors who aren’t signed in meet a sign-in door instead of the project’s pages — its front page, its status  | `modules/public-landing/public/projects.html:1258` |
 | `3d6b0bf6c2db` | certain | Waiting on you | `modules/public-landing/public/invitations.html:145` |
 | `5370dd2d0e62` | certain | Ways to get paid | `modules/public-landing/public/index.html:893` |
 | `5361539434e0` | certain | We already have a legal entity | `modules/public-landing/public/projects.html:1667` |
@@ -2708,6 +2718,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `cfce77d01e59` | certain | Your code lives in your GitHub repository and stays yours. The platform holds a working copy on the project's  | `modules/public-landing/public/terms.html:106` |
 | `7ce5ac1d34d4` | certain | Your connections | `modules/public-landing/public/connections.html:144` |
 | `cd008ecb2887` | certain | Your connections could not be read. Reload the page to try again. | `modules/public-landing/public/connections.html:130` |
+| `1e6d91f484e4` | certain | Your cross-project record is descriptive analytics and never authority. What you may do inside any project is  | `modules/public-landing/public/terms.html:117` |
 | `63535be9eb75` | certain | Your hybrid suite | `modules/public-landing/public/projects.html:1977` |
 | `69d41637ccf0` | certain | Your idea | `modules/public-landing/public/projects.html:1577` |
 | `acebb426377e` | certain | Your legal entity | `modules/public-landing/public/projects.html:1669` |
@@ -2857,8 +2868,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2609873e46a5` | certain | — Render needs one; the usual one is filled in | `modules/public-landing/public/projects.html:1940` |
 | `5ee1b494eec3` | certain | — for signing in, and for the repositories your projects ship to. | `modules/public-landing/public/privacy.html:113` |
 | `39b7e60d327e` | certain | — it is on the map under its name, but nobody joins on their own: people ask, and you decide. | `modules/public-landing/public/projects.html:1292` |
+| `a5319c33053a` | certain | — no one can apply: the project’s hall and its sign-in say so, and you invite people by GitHub username from t | `modules/public-landing/public/projects.html:1273` |
 | `5becfcad07c3` | certain | — people ask from the project’s hall, you approve each one from the hall’s Watch page, and then they sign in. | `modules/public-landing/public/projects.html:1273` |
 | `9ac56aa4e540` | certain | — projects hosted by the platform run on servers rented from DigitalOcean, with their web address and traffic  | `modules/public-landing/public/privacy.html:115` |
+| `013f0e214b89` | certain | — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody c | `modules/public-landing/public/projects.html:1292` |
 | `b5bac008ba11` | certain | — the project is on the map under its name, and anyone who finds it can join. | `modules/public-landing/public/projects.html:1292` |
 | `728661ec4c4a` | certain | — when a shipped task is graded, the change it made (the code diff) is sent to the model the grader runs on, A | `modules/public-landing/public/privacy.html:114` |
 | `ff1318762145` | certain | — whoever signs in with GitHub becomes a member at once, at the newcomer rank. | `modules/public-landing/public/projects.html:1273` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2771,
-    "unique_ids": 2350,
-    "certain": 2771,
+    "strings": 2784,
+    "unique_ids": 2363,
+    "certain": 2784,
     "heuristic": 0,
     "duplicate_ids": 241
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 148,
-      "strings": 1963
+      "strings": 1964
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 9,
-      "strings": 708
+      "strings": 720
     }
   },
   "blind_spots": [
@@ -14996,6 +14996,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "2850b51235fd",
+      "surface": "builders-hall",
+      "text": "Two different bills, one column each. The first is what a project costs this platform. The second is an estimate of what its owner pays their own hosting provider, which bills them directly. A project with no recorded plan reads \"not priced yet\", never $0, and is left out of the total. A self-hosted project runs on its owner's own machine, so its bill is not visible to us.",
+      "file": "modules/hall-ui/public/fleet.html",
+      "line": 39,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "4a25dba3ef56",
       "surface": "builders-hall",
@@ -20648,6 +20657,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "437ddce8e760",
+      "surface": "landing",
+      "text": "A project is a record here and a database of its own. The record holds its name, the GitHub repository it ships to, its web address, how it is hosted, who owns it, when it was created, what state it is in, and its settings — who can see it and how people join. The project's own database holds the same kinds of records as above for the people who build on it: accounts, sessions, tasks, grades, {{currency}}.",
+      "file": "modules/public-landing/public/privacy.html",
+      "line": 108,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "c3504a900b0f",
       "surface": "landing",
@@ -21548,6 +21566,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "032693d19430",
+      "surface": "landing",
+      "text": "Each {{productName}} project you build in reports a summary of your work there to the platform: the {{currency}} you earned, the works you shipped, your karma, the rank that project gave you, the roles you worked in, and when you were last active. The platform adds these up across every project into one cross-project record. Projects report this themselves — the platform does not read their databases.",
+      "file": "modules/public-landing/public/terms.html",
+      "line": 116,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "9a4a940d2a56",
       "surface": "landing",
@@ -21656,6 +21683,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "e14fd6120fc6",
+      "surface": "landing",
+      "text": "Extras are the optional parts a project can run — extra AI agents, a Discord mirror, and the rest. You picked a set when you created the project, or took the suggested set by skipping that step; this is where you change your mind. Switching one on or off saves straight away and changes nothing that is already running: nothing restarts, and no work is lost either way. The parts every project runs — the platform itself, the way it tracks work, the builders’ hall — were never part of the choice, so they are not listed here and cannot be switched off.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1334,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "7c8dcf228e70",
       "surface": "landing",
@@ -21980,6 +22016,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "5a2650d439ce",
+      "surface": "landing",
+      "text": "How this project is listed — the kind shown beside its name on the map, in the table and on its card. It is a declaration about the project, not a setting the project obeys: nothing is pushed to it and nothing restarts. One thing does follow the kind: if you never picked your extras yourself, they are the set this kind suggests, so changing the kind changes them too — you will be told when that happens. Extras you picked for yourself are stored and never move. Not Sure is a real answer, and it is the way back if you would rather not say.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1314,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "a86a02b0ded9",
       "surface": "landing",
@@ -24356,6 +24401,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "82d751a27370",
+      "surface": "landing",
+      "text": "The platform first gives this project its own read-only deploy key and switches its deploys over to it, and only then makes the repository private — in that order, so no deploy ever tries to read a private repository with a key that can’t. The change is made with your connected GitHub account, so that account needs admin rights on the repository. It works for a project on a Cloud host; a project on your own host is yours to change on GitHub directly. You can make it public again from here at any time.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1242,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "4fd8f5746cc5",
       "surface": "landing",
@@ -24365,6 +24419,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "768a6990ebfc",
+      "surface": "landing",
+      "text": "The platform stores the date you accepted these terms, and which version, on your account. It is written when you sign in to a project in your browser with your platform account, and only once — signing in again does not change the date you accepted. Signing in from the command line does not record it: you approve that sign-in on GitHub’s page, where these terms are not shown, so an account that has only signed in that way stays unpublished until you sign in to a project in your browser once. This is version",
+      "file": "modules/public-landing/public/terms.html",
+      "line": 120,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "20fcebaa85c4",
       "surface": "landing",
@@ -24518,6 +24581,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "a1aa7835abce",
+      "surface": "landing",
+      "text": "This is a list of which variables your project needs and what each one is for — not the secrets themselves. The values belong wherever your project actually runs (Vercel, Netlify, Render, or your own machine): that is where the running app reads them, and it already keeps them encrypted, logs who touched them and lets you rotate them. Keeping a second copy here would make this platform the keeper of your credentials and buy you nothing.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1349,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "d83b739afb1e",
       "surface": "landing",
@@ -24608,6 +24680,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "50f764cf1229",
+      "surface": "landing",
+      "text": "Two things, and only two: a name — this project already has one — and a description of what it is. Modules, artwork, a finished setup interview: none of them are required, because the bar is there to keep empty shells off the map, not to make you finish anything. Until it is met the project is not listed publicly and nobody can ask to join it; the project itself runs exactly the same either way. Adding a description puts it on the map, and clearing one takes it back off.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1214,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "b0c3729108be",
       "surface": "landing",
@@ -24680,6 +24761,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "f68a38de7e1b",
+      "surface": "landing",
+      "text": "Visitors who aren’t signed in meet a sign-in door instead of the project’s pages — its front page, its status page, and its hall. The door itself stays open, so members can always get in, and members see everything either way. It is separate from the repository’s visibility above: the code on GitHub is its own setting. Changing it restarts the project to pick it up — the line under the choice says what the project is running right now.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1258,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "3d6b0bf6c2db",
       "surface": "landing",
@@ -25274,6 +25364,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "1e6d91f484e4",
+      "surface": "landing",
+      "text": "Your cross-project record is descriptive analytics and never authority. What you may do inside any project is decided by that project alone, from its own records, at the moment you ask. A large record grants nothing and a hidden one takes nothing away; no project is required to read it, and none may treat it as permission. A rank shown here is that project’s own standing for you, as that project reported it — the platform holds no rank of its own.",
+      "file": "modules/public-landing/public/terms.html",
+      "line": 117,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "63535be9eb75",
       "surface": "landing",
@@ -26615,6 +26714,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "a5319c33053a",
+      "surface": "landing",
+      "text": "— no one can apply: the project’s hall and its sign-in say so, and you invite people by GitHub username from the hall’s Watch page; only an invited person’s sign-in gets in — and people who asked before you switched stay in your queue, to approve or dismiss. Whichever you pick, people who are already members stay members. Changing it restarts the project to pick it up — the line under the choice says what the project is running right now.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1273,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "5becfcad07c3",
       "surface": "landing",
@@ -26633,6 +26741,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "013f0e214b89",
+      "surface": "landing",
+      "text": "— the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Switching to Stealth is itself visible: someone comparing the map before and after can tell which project went quiet. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1292,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "b5bac008ba11",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -3145,5 +3145,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.152 with no explicit bump. run 39675693737. (task 1002620)
   1.21.154 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.153 with no explicit bump. run 39800316919. (task 1002620)
+  1.21.155 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.154 with no explicit bump. run 39805364072. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/criterion-uat.js

@@ -122,6 +122,12 @@ function foldLiveReadings(readings) {
 
 // ── the sign-off refusal ladder ─────────────────────────────────────────────
 
+// PAUSED (owner, 2026-10-22): the "someone else signs it off" rule below is off,
+// so the person who shipped the work may sign off its UAT/review themselves.
+// Delete this flag to restore the rule. UAT_SELF_SIGNOFF=off turns it back on
+// (the tests do, so the paused rule stays proven while it waits).
+const SELF_SIGNOFF_ALLOWED = process.env.UAT_SELF_SIGNOFF !== 'off';
+
 // PURE — may this person sign this criterion off now? Returns null (allowed) or
 // { code, status, message, ...detail }. The ORDER is the order a person would
 // want to be told: is there anything to sign, is it the right kind of sign-off,
@@ -163,7 +169,7 @@ function signoffRefusal({ criterion, counts, remaining = [], backendOnly, kind,
   }
   const signer = String(signerId);
   const isOwner = signerIsOwner === true || (ownerId != null && String(ownerId) === signer);
-  if (!isOwner && shipperIds.map(String).includes(signer)) {
+  if (!SELF_SIGNOFF_ALLOWED && !isOwner && shipperIds.map(String).includes(signer)) {
     return { code: 'signer_shipped_this_work', status: 403, message: 'You shipped work linked to this criterion, so someone else has to sign it off. Any other reviewer, or the project owner, can.' };
   }
   if (kind === 'uat' && !recording) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.154",
+  "version": "1.21.155",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.154",
+      "version": "1.21.155",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.154",
+  "version": "1.21.155",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9946,5 +9946,15 @@
       "id": "1003800",
       "text": "In the module store, a buyer can now sort by the score that matters to them, like reliability or tests, so the module strongest at that comes first."
     }
+  ],
+  "1.21.155": [
+    {
+      "id": "1004769",
+      "text": "The person who built something can now sign off its UAT themselves, not only the project owner. The old rule is paused, not deleted, so it can come back with one change."
+    },
+    {
+      "id": "1004768",
+      "text": "A page rewrite can now include a long paragraph. Before, any paragraph over 400 characters was dropped from the site's text list, so the privacy page's changes could not be applied."
+    }
   ]
 }

package/scripts/gds/copy-inventory.js

@@ -66,7 +66,11 @@ const SURFACES = [
 // Attributes whose value is COPY a person reads (not wiring). The matchers are
 // built ONCE — the first cut re-created all seven per markup literal.
 const COPY_ATTRS = ['title', 'aria-label', 'placeholder', 'alt', 'data-page-title', 'aria-description'];
-const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${attr}\\s*=\\s*"([^"]{4,400})"`, 'gi') }));
+// The longest string the registry lists. A page tweak may rewrite a paragraph
+// past the old 400, and the applier then could not find its own words in the
+// registry it regenerates (task 1004768, the privacy page's round).
+const MAX_COPY_LEN = 2000;
+const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${attr}\\s*=\\s*"([^"]{4,${MAX_COPY_LEN}})"`, 'gi') }));
 
 // What this tool knowingly does not see. Printed in the report — an inventory that
 // implies completeness it does not have is worse than a short one.
@@ -125,7 +129,7 @@ function lineAt(starts, index) {
 // by platform (task 1004545 — a 396-char run was 403 under CRLF and vanished).
 function looksLikeCopy(raw) {
   const s = String(raw).replace(/\r\n/g, '\n').trim();
-  if (s.length < 4 || s.length > 400) return false;
+  if (s.length < 4 || s.length > MAX_COPY_LEN) return false;
   if (!/[A-Za-z]{2}/.test(s)) return false;               // needs actual letters
   if (!/\s/.test(s) && !/[.!?]$/.test(s)) return false;   // one bare word is a token
   if (/^[/.#]/.test(s)) return false;                     // paths, selectors
@@ -561,7 +565,7 @@ if (require.main === module) {
 }
 
 module.exports = {
-  SURFACES, COPY_ATTRS, BLIND_SPOTS, REGISTRY_REL, REPORT_REL,
+  SURFACES, COPY_ATTRS, BLIND_SPOTS, MAX_COPY_LEN, REGISTRY_REL, REPORT_REL,
   cmp, stableId, looksLikeCopy, lineIndex, lineAt, stripEmbedded, fromHtml, fromJs, filesFor,
   buildRegistry, renderReport, write, matchesGenerated,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.154'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.155'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/copy_inventory.mjs

@@ -103,15 +103,18 @@ test('stripEmbedded keeps line numbers truthful', () => {
 // Windows regen dropped a row CI kept and redded "the committed artifacts match".
 // The fixture rebuilds both halves: a tag inside a comment, and a run sized to
 // straddle the cap.
-// Eight 45-char lines under a 28-char head: 396 chars on LF, 404 on CRLF.
-const NEAR_CAP_LINES = Array.from({ length: 8 }, () => `   ${'word '.repeat(8)}s.`);
+// 45-char lines under a 28-char head, as many as fit under the cap on LF; each
+// CRLF adds one, which pushes it over. Sized from MAX_COPY_LEN (task 1004768).
+const NEAR_CAP_HEAD = 'A real sentence on the page,';
+const NEAR_CAP_LINE = `   ${'word '.repeat(8)}s.`;
+const NEAR_CAP_LINES = Array.from({ length: Math.floor((inv.MAX_COPY_LEN - NEAR_CAP_HEAD.length) / (NEAR_CAP_LINE.length + 1)) }, () => NEAR_CAP_LINE);
 const EOL_FIXTURE = [
   '<!doctype html>',
   '<!-- Author note: a building is a door (an <a>) to its interior.',
   '     The template is street.css, the <style> on the tokens.',
   '-->',
   '<style>.x { color: red; }</style>',
-  '<p>A real sentence on the page,',
+  `<p>${NEAR_CAP_HEAD}`,
   ...NEAR_CAP_LINES.slice(0, -1),
   `${NEAR_CAP_LINES.at(-1)}</p>`,
   '<p title="A tooltip a person reads">Second real line.</p>',
@@ -123,13 +126,26 @@ test('LF and CRLF checkouts extract identical rows (task 1004545)', () => {
   const strip = (rows) => rows.map(({ text, line, origin }) => ({ text, line, origin }));
   assert.deepEqual(strip(crlf), strip(lf), 'the registry must not depend on the checkout\'s line endings');
   const run = EOL_FIXTURE.slice(EOL_FIXTURE.indexOf('A real'), EOL_FIXTURE.indexOf('</p>'));
-  assert.ok(run.length <= 400 && run.replace(/\n/g, '\r\n').length > 400, 'the fixture must straddle the cap, or this test proves nothing');
+  assert.ok(run.length <= inv.MAX_COPY_LEN && run.replace(/\n/g, '\r\n').length > inv.MAX_COPY_LEN, 'the fixture must straddle the cap, or this test proves nothing');
   // The multi-line sentence sits under the cap only when CRLF counts as one
   // character — so this is the case that reds if the length rule regresses.
   assert.ok(lf.some((r) => r.text.startsWith('A real sentence on the page')), 'a multi-line run under the cap is copy on LF');
   assert.ok(crlf.some((r) => r.text.startsWith('A real sentence on the page')), 'and the same run is copy on CRLF');
 });
 
+// The privacy page's round rewrote one paragraph past 400 characters, and the
+// registry dropped it, so the applier could not find its own words (task 1004768).
+test('a long paragraph a page tweak writes is still listed', () => {
+  const para = `We keep only what we need to run your account. ${'Nothing else is stored or sold, and you can ask for it to be removed. '.repeat(14)}`.trim();
+  assert.ok(para.length > 1000 && para.length <= inv.MAX_COPY_LEN, 'the fixture must sit well past the old 400 cap');
+  const rows = inv.fromHtml({ source: `<p>${para}</p>\n<p title="${para}">x y</p>`, rel: 'p.html' });
+  assert.equal(rows.filter((r) => r.text === para).length, 2, 'listed as text and as an attribute');
+  const at = (n) => `${'ab '.repeat(n)}`.slice(0, n - 1) + '.';
+  assert.equal(at(inv.MAX_COPY_LEN).length, inv.MAX_COPY_LEN);
+  assert.equal(inv.looksLikeCopy(at(inv.MAX_COPY_LEN)), true, 'exactly at the cap is listed');
+  assert.equal(inv.looksLikeCopy(at(inv.MAX_COPY_LEN + 1)), false, 'one past the cap is refused');
+});
+
 test('HTML comments are never copy, and a tag named inside one swallows nothing', () => {
   const rows = inv.fromHtml({ source: EOL_FIXTURE, rel: 'p.html' });
   const texts = rows.map((r) => r.text);
@@ -140,7 +156,7 @@ test('HTML comments are never copy, and a tag named inside one swallows nothing'
   assert.ok(texts.includes('Second real line.'));
   assert.ok(texts.includes('A tooltip a person reads'));
   const real = rows.find((r) => r.text === 'Second real line.');
-  assert.equal(real.line, 15, 'a stripped comment must not shift the lines after it');
+  assert.equal(real.line, 7 + NEAR_CAP_LINES.length, 'a stripped comment must not shift the lines after it');
   // A span still addresses the file's own characters (copy-apply writes through it).
   assert.equal(EOL_FIXTURE.slice(real.start, real.end), 'Second real line.');
 });

package/tests/criterion_uat.mjs

@@ -29,6 +29,8 @@ import { makeRunner } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
+// The shipper rule is paused in production (owner, 2026-10-22); prove it still works.
+process.env.UAT_SELF_SIGNOFF = 'off';
 const uat = require('../modules/lifecycle/criterion-uat.js');
 const uatDb = require('../modules/lifecycle/criterion-uat-db.js');
 const doneWhen = require('../modules/lifecycle/done-when.js');
@@ -115,6 +117,23 @@ await test('LADDER: whoever shipped linked work is refused — ids compare as st
   assert.equal(code({ signerId: '8' }), 'signer_shipped_this_work');
 });
 
+await test('PAUSE (task 1004769): at the production default a shipper is let through, and only the shipper rung moves', () => {
+  const modPath = require.resolve('../modules/lifecycle/criterion-uat.js');
+  delete process.env.UAT_SELF_SIGNOFF;
+  delete require.cache[modPath];
+  try {
+    const paused = require(modPath);
+    const pcode = (over) => { const r = paused.signoffRefusal({ ...base, ...over }); return r && r.code; };
+    assert.equal(pcode({ signerId: 7 }), null);
+    assert.equal(pcode({ signerId: '8' }), null);
+    assert.equal(pcode({ signerId: 7, recording: null }), 'uat_recording_required');
+  } finally {
+    process.env.UAT_SELF_SIGNOFF = 'off';
+    delete require.cache[modPath];
+    require(modPath);
+  }
+});
+
 await test('LADDER: the project owner may sign off work they shipped (solo projects)', () => {
   assert.equal(code({ signerId: 3, shipperIds: ['3'] }), null);
 });