@bongos/core 1.21.174 → 1.21.176

package/modules/copy-desk/routes/copy-desk-release.js

@@ -0,0 +1,119 @@
+// modules/copy-desk/routes/copy-desk-release.js — move a page round the reads
+// cannot name (task 1004837).
+//
+// POST /copy-desk/pages/:pageId/release  { note, task_id? }
+//
+// A round in copy-desk's `unknown` state (an active round nobody holds, or a
+// ready round whose applied block says nothing more) counted as stuck the moment
+// it appeared, and the Studio had no action for it: its link opened the approval
+// card, which only holds rounds waiting for their artist. This is that action.
+//
+//   • a round that still carries its frozen batch goes back to the /tweak queue
+//     with the note (the send-back block, so the next applier reads why);
+//   • any other is abandoned with the note as its reason, freeing the page for a
+//     fresh round.
+// Either way the move runs through the lifecycle port (releaseStuckTweak), which
+// owns the status change, so this file writes no row, no file and no wording.
+//
+// Apart from routes/copy-desk.js because that file sits at the 1,500-line
+// ratchet. Gated on the task.abandon permission (Metic and up): releasing a
+// round is the applier's call, the floor `/tweak` and the stuck digest already
+// name; the artist's own decisions stay approve and send-back.
+//
+//   200 released | abandoned · 400 note_too_short / note_too_long ·
+//   404 unknown_page · 409 not_stuck · 409 round_moved · 403 (rank)
+
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pages = require('../pages');
+const pageData = require('../page-data');
+const pageStatus = require('../page-status');
+const { openRoundOf } = require('../page-decisions');
+
+const log = api.logger('copy-desk');
+
+const RELEASE_BODY_SCHEMA = Object.freeze({
+  note:    { required: true, type: 'string', maxLength: pages.MAX_NOTE_CHARS * 2, minLength: 1 },
+  task_id: { type: 'string', maxLength: 20, minLength: 1 },
+});
+
+module.exports = function buildCopyDeskReleaseRouter() {
+  const router = express.Router();
+
+  // POST /copy-desk/pages/:pageId/release — release a page round the reads cannot
+  // name: back to the /tweak queue with a note when it still holds its batch,
+  // otherwise closed so the page can start fresh. Metic and up; body { note, task_id? }.
+  router.post('/copy-desk/pages/:pageId/release', api.requireBuilder, api.requirePermission('task.abandon'), async (req, res) => {
+    try {
+      if (api.validateOrRespond(req, res, RELEASE_BODY_SCHEMA)) return;
+      const pageId = String(req.params.pageId || '');
+      const inv = pageData.loadInventory();
+      const known = pages.PAGE_ID_RE.test(pageId) && inv.ok && (inv.data.pages || []).some((p) => p && p.id === pageId);
+      if (!known) {
+        return res.fail('unknown_page', 404, { page_id: pageId, what_this_means: 'There is no page with that id. Pick the page from the Studio list.' });
+      }
+      const note = pages.normalizeSentBackNote(req.body.note);
+      if (!note.ok) {
+        return res.fail(note.code, 400, {
+          ...note.detail,
+          what_this_means: `Say in one line why this round is being released, in at least ${pages.MIN_NOTE_CHARS} characters, so whoever picks the page up next knows. Nothing was changed.`,
+        });
+      }
+      const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+      if (!lifecycle || typeof lifecycle.releaseStuckTweak !== 'function' || typeof lifecycle.listPageTweakTasks !== 'function') {
+        return res.fail('lifecycle_unavailable', 503, { what_this_means: 'This instance cannot move a page round on. Nothing was changed.' });
+      }
+      const rounds = await lifecycle.listPageTweakTasks({ pageId });
+      const round = openRoundOf(rounds, pageId);
+      const state = round ? pageStatus.roundState(round) : null;
+      if (!round || state !== 'unknown') {
+        return res.fail('not_stuck', 409, {
+          page_id: pageId,
+          round: round ? { task_id: String(round.id), status: round.status, state } : null,
+          what_this_means: 'This round is not stuck. Approve or send back a page waiting for its artist from the Approval queue.',
+        });
+      }
+      if (req.body.task_id != null && String(req.body.task_id) !== String(round.id)) {
+        return res.fail('round_moved', 409, {
+          page_id: pageId,
+          round: { task_id: String(round.id) },
+          what_this_means: 'The round on this page now is a different one from the one you looked at. Open the Studio again; nothing was changed.',
+        });
+      }
+      const at = new Date().toISOString();
+      const by = String(req.builder.id);
+      const keepsBatch = round.status === 'ready' && pages.parseBatchBlock(round.description).ok;
+      const r = await lifecycle.releaseStuckTweak({
+        taskId: round.id,
+        builderId: req.builder.id,
+        expectedStatus: round.status,
+        note: note.note,
+        compose: keepsBatch ? (task) => pages.appendSentBack(task.description, { at, by, note: note.note }) : null,
+      });
+      if (r.outcome !== 'released' && r.outcome !== 'abandoned') {
+        const gone = r.outcome === 'round_moved' || r.outcome === 'not_stuck' || r.outcome === 'not_found' || r.outcome === 'wrong_source';
+        if (r.outcome === 'builder_inactive') return res.fail('builder_inactive', 403);
+        if (r.outcome === 'refused') return res.fail((r.refusal && r.refusal.code) || 'release_refused', 400, (r.refusal && r.refusal.detail) || {});
+        return res.fail(gone ? 'round_moved' : 'release_failed', 409, {
+          page_id: pageId,
+          what_this_means: 'The round changed while you were looking at it. Open the Studio again; nothing was changed.',
+        });
+      }
+      return res.json({
+        ok: true,
+        outcome: r.outcome,
+        page_id: pageId,
+        round: { task_id: String(r.task.id), status: r.task.status },
+        released: { at, by, note: note.note },
+        pr: r.pr || null,
+      });
+    } catch (err) {
+      log.error({ err }, 'POST /copy-desk/pages/:pageId/release failed');
+      if (!res.headersSent) res.fail('copy_page_release_failed', 500);
+    }
+  });
+
+  return router;
+};

package/modules/copy-desk/routes/copy-desk.js

@@ -62,7 +62,7 @@ const pageStatus = require('../page-status');
 const pages = require('../pages');
 const guarded = require('../guarded-lines');
 const docx = require('../docx');
-const { waitingRoundOrFail, refuseDecision, nextWaiting } = require('../page-decisions');
+const { openRoundOf, waitingRoundOrFail, refuseDecision, nextWaiting } = require('../page-decisions');
 const { tallyCreditRows, readArtistStats } = require('../artist-stats');
 
 const { validateOrRespond } = api;
@@ -195,7 +195,7 @@ function readingPageOrFail(res, pageId) {
   const readings = readingsState();
   if (!readings.data) {
     res.fail('readings_missing', 503, {
-      run: readings.info.run || 'node scripts/gds/page-reader.js',
+      run: readings.info.run || 'node scripts/bongos/page-reader.js',
       what_this_means: 'A draft is resolved against the committed page readings, and this instance has none. Nothing was saved.',
     });
     return null;
@@ -211,15 +211,6 @@ function readingPageOrFail(res, pageId) {
   return readingPage;
 }
 
-// The page's OPEN round, from the same read the page routes use.
-function openRoundOf(tasks, pageId) {
-  const open = (tasks || []).filter((t) => {
-    const ref = pages.parseRoundRef(t.source_ref);
-    return ref && ref.page_id === pageId && t.status !== 'shipped' && t.status !== 'abandoned';
-  });
-  return open.length ? open[open.length - 1] : null;
-}
-
 // The answer to a repeated submit: the round is in the queue (ready, a frozen
 // batch, nobody holding it) and the caller is its artist, the builder of its
 // latest web claim. Null when that is not the case.
@@ -584,7 +575,7 @@ module.exports = function buildCopyDeskRouter() {
   // strict. What it produces is a TASK carrying a patch, in the ledger every
   // change already has to pass through, which nothing renders from. The wording
   // reaches a person only after somebody claims that task, runs
-  // `node scripts/gds/copy-apply.js --task <id>`, and ships the resulting diff
+  // `node scripts/bongos/copy-apply.js --task <id>`, and ships the resulting diff
   // through the normal pipeline with the grader reading it.
   //
   // The shape is borrowed, not invented: it is `adapter.export()` from the

package/modules/copy-desk/skills/tweak/SKILL.md

@@ -16,7 +16,7 @@ You are applying ONE page an artist rewrote in the studio (Tweak Mode, ADR 0341)
 ## 1. Take the next submitted round
 
 ```bash
-node scripts/gds/api.js GET /api/bongos/copy-desk/pages --quiet
+node scripts/bongos/api.js GET /api/bongos/copy-desk/pages --quiet
 ```
 
 A round is in the queue when its page's `open_round.state` is `submitted`. Take the one with the lowest `open_round.task_id` (the oldest). None? Say "the tweak queue is empty" and stop.
@@ -24,7 +24,7 @@ A round is in the queue when its page's `open_round.state` is `submitted`. Take
 Claim it in THIS worktree, on a fresh branch from `origin/main`:
 
 ```bash
-node scripts/gds/claim.js <task-id>
+node scripts/bongos/claim.js <task-id>
 ```
 
 Read the whole printout and confirm it says "Claimed". A refusal can be silent under grep. The round sits in the version's catch-all goal: a `GOAL_MEMBERSHIP_REQUIRED` refusal means join that goal first. Writing the applied block (step 3) needs `task.edit`, which is Metic+.
@@ -32,7 +32,7 @@ Read the whole printout and confirm it says "Claimed". A refusal can be silent u
 ## 2. Render the page BEFORE
 
 ```bash
-node scripts/gds/tweak-renders.js shoot --page <page-id> --phase before --out <scratchpad>/tweak-<task-id>
+node scripts/bongos/tweak-renders.js shoot --page <page-id> --phase before --out <scratchpad>/tweak-<task-id>
 ```
 
 The page id is in the round's title, `Tweak: <title> (<page-id>)`. Four shots: desktop 1440 and phone 390, light and dark. A page that pins one mode is shot in that mode for both, and the run says so.
@@ -40,13 +40,13 @@ The page id is in the round's title, `Tweak: <title> (<page-id>)`. Four shots: d
 ## 3. Apply every line
 
 ```bash
-node scripts/gds/copy-apply.js --batch --dry-run
-node scripts/gds/copy-apply.js --batch
+node scripts/bongos/copy-apply.js --batch --dry-run
+node scripts/bongos/copy-apply.js --batch
 ```
 
 It reads the round you hold, applies every line of its `page-tweak` block by ADR 0233's rules (the `${expr}` holes go back in), regenerates the copy registry, re-reads the changed pages (it opens a browser) and records a `page-tweak-applied` block on the task.
 
-**A refused line is named, never skipped.** Each one prints `REFUSED (<code>)`: `target_gone`, `ambiguous_target`, `no_exact_span`, `placeholder_mismatch` or `path_outside_surface`. It is recorded in the applied block, and the artist sees it at approval. Do not hand-edit a refused line into place, because that would put words on the page the artist cannot see were refused. The rest of the batch still lands. Exit 2 means no line applied: release the claim (`node scripts/gds/release.js <task-id>`) and say which lines refused.
+**A refused line is named, never skipped.** Each one prints `REFUSED (<code>)`: `target_gone`, `ambiguous_target`, `no_exact_span`, `placeholder_mismatch` or `path_outside_surface`. It is recorded in the applied block, and the artist sees it at approval. Do not hand-edit a refused line into place, because that would put words on the page the artist cannot see were refused. The rest of the batch still lands. Exit 2 means no line applied: release the claim (`node scripts/bongos/release.js <task-id>`) and say which lines refused.
 
 Review `git diff`: only the artist's words changed, plus the regenerated registry and readings. Commit.
 
@@ -55,8 +55,8 @@ If a line changed `modules/hall-ui/public/shell.js` (a shared line), bump the sh
 ## 4. Render AFTER and attach all eight
 
 ```bash
-node scripts/gds/tweak-renders.js shoot --page <page-id> --phase after --out <scratchpad>/tweak-<task-id>
-node scripts/gds/tweak-renders.js attach <task-id> --dir <scratchpad>/tweak-<task-id>
+node scripts/bongos/tweak-renders.js shoot --page <page-id> --phase after --out <scratchpad>/tweak-<task-id>
+node scripts/bongos/tweak-renders.js attach <task-id> --dir <scratchpad>/tweak-<task-id>
 ```
 
 Look at the after shots yourself. If a rewritten line overflows or breaks the layout, say so in the ship notes: the artist decides, not you.
@@ -64,13 +64,13 @@ Look at the after shots yourself. If a rewritten line overflows or breaks the la
 ## 5. Ship it to wait for the artist
 
 ```bash
-node scripts/gds/ship-check.js
-node scripts/gds/ship.js <task-id> --notes-file <notes> --summary-file <summary>
+node scripts/bongos/ship-check.js
+node scripts/bongos/ship.js <task-id> --notes-file <notes> --summary-file <summary>
 ```
 
 Heal whatever ship-check names first (`git add` new files before it). Run ship.js in the background and wait for it; never pipe it through tail. On a passed grade it prints **WAITING FOR THE ARTIST**: the branch and its PR are published, auto-merge is not armed, and the task stays at `completed`. That is the finish line. Never pass `--skip-grade`: it would confirm the round past the artist.
 
-A failed grade is an ordinary one: read it (`GET /api/bongos/tasks/<task-id>?include=grade`), fix, commit, `node scripts/gds/ship.js <task-id> --regrade`. If the branch did not publish, a plain `node scripts/gds/ship.js <task-id>` publishes it again without re-grading.
+A failed grade is an ordinary one: read it (`GET /api/bongos/tasks/<task-id>?include=grade`), fix, commit, `node scripts/bongos/ship.js <task-id> --regrade`. If the branch did not publish, a plain `node scripts/bongos/ship.js <task-id>` publishes it again without re-grading.
 
 ## Unattended mode: `/tweak --page <page-id> --unattended`
 
@@ -84,7 +84,7 @@ The Autobongos tweak lane (ADR 0371 D1, D8) runs this skill with nobody at the t
 **On any halt, release and exit.** Run the matching line and stop; do not retry, and do not try another round:
 
 ```bash
-node scripts/gds/tweak-halt.js <task-id> --code <code>
+node scripts/bongos/tweak-halt.js <task-id> --code <code>
 ```
 
 | What happened | `--code` |

package/modules/copy-desk/tests/copy_flags.mjs

@@ -28,7 +28,7 @@ async function test(name, fn) {
 // never depend on what the real tree happens to say today.
 const FAKE = {
   schema: 1,
-  generator: 'scripts/gds/copy-inventory.js',
+  generator: 'scripts/bongos/copy-inventory.js',
   counts: { strings: 3, unique_ids: 2, certain: 3, heuristic: 0, duplicate_ids: 1 },
   surfaces: {
     'builders-hall': { at: 'modules/hall-ui/public', files: 2, strings: 2 },

package/modules/copy-desk/tests/copy_no_cms.mjs

@@ -74,8 +74,8 @@ const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'pa
 
 console.log('copy-desk: NO LIVE CMS');
 
-await test('the route files are exactly the two the module declares', () => {
-  assert.deepEqual(ROUTE_FILES, ['routes/copy-desk-artist.js', 'routes/copy-desk.js'],
+await test('the route files are exactly the three the module declares', () => {
+  assert.deepEqual(ROUTE_FILES, ['routes/copy-desk-artist.js', 'routes/copy-desk-release.js', 'routes/copy-desk.js'],
     'a new route file is a new place a write could hide: add it here, and to the write-surface scan below');
 });
 
@@ -103,6 +103,10 @@ await test('the write surface is exactly the verbs the module defines', () => {
     // round's DRAFT through the autosave's own port call and resolver, never a
     // row here, a file, or the site.
     'POST /copy-desk/pages/:pageId/draft.docx',
+    // Task 1004837: release a round the reads cannot name. Through the lifecycle
+    // port (releaseStuckTweak): back to the /tweak queue or abandoned, with the
+    // applier's note. No row here, no file, no wording.
+    'POST /copy-desk/pages/:pageId/release',
     'POST /copy-desk/pages/:pageId/send-back',
     // TW08 (task 1004319, ADR 0341 D4, D11): the draft autosave and the
     // submit. Both write the page round's TASK DESCRIPTION through the
@@ -320,7 +324,7 @@ await test('the module manifest declares no seam another module could write copy
 await test('the applier is the only writer, it lives outside the request path, and it is path-guarded', () => {
   // The one thing in this feature that does write a surface file. Three
   // properties make that safe, and all three are pinned here.
-  const applier = readRepo('scripts/gds/copy-apply.js');
+  const applier = readRepo('scripts/bongos/copy-apply.js');
   const stripped = stripComments(applier);
 
   // 1. It is a COMMAND, not a route: nothing in the module's request path

package/modules/copy-desk/tests/copy_proposals.mjs

@@ -23,7 +23,7 @@ import { createRequire } from 'node:module';
 const HERE = path.dirname(url.fileURLToPath(import.meta.url));
 const require_ = createRequire(import.meta.url);
 const proposals = require_(path.join(HERE, '..', 'proposals.js'));
-const applier = require_(path.join(HERE, '..', '..', '..', 'scripts', 'gds', 'copy-apply.js'));
+const applier = require_(path.join(HERE, '..', '..', '..', 'scripts', 'bongos', 'copy-apply.js'));
 
 let passed = 0;
 let failed = 0;
@@ -128,7 +128,7 @@ await test('a composed proposal block parses back to the same patch', () => {
   // RUNNABLE AS WRITTEN. The task cannot know its own id while its description is
   // being composed, so the command takes none and acts on the claim you hold —
   // a placeholder here would be a step for the claimer to get wrong.
-  assert.match(body, /```bash\nnode scripts\/gds\/copy-apply\.js\n```/,
+  assert.match(body, /```bash\nnode scripts\/(?:gds|bongos)\/copy-apply\.js\n```/,
     'the task must tell its claimer the exact line that lands it, with nothing to substitute');
   assert.ok(!/<this task id>|--task <|\$\{/.test(body), 'and no placeholder survives into the instructions');
 });

package/modules/copy-desk/tests/copy_queue.mjs

@@ -29,7 +29,7 @@ async function test(name, fn) {
 
 const REG = {
   schema: 1,
-  generator: 'scripts/gds/copy-inventory.js',
+  generator: 'scripts/bongos/copy-inventory.js',
   goal: 1000074,
   counts: { strings: 3, unique_ids: 2, duplicate_ids: 1 },
   surfaces: { 'builders-hall': { at: 'modules/hall-ui/public', files: 2, strings: 3 } },

package/modules/design-styles/skills/README.md

@@ -1,6 +1,6 @@
 # `modules/design-styles/skills/` — the vetted UI skills: the policy, the roster, and why the roster is what it is
 
-The home for the design-style skills the `design-styles` module ships to every builder on every instance that turns the module on. They lived in `modules/ui-design/skills/` until task 1004470 split them out: `ui-design` stays default-on with `/design`, the sync skills, the kit and the style library, and this module is **off by default** — an instance opts in with `"design-styles": true` in `config/modules.json`, because thirteen descriptions are resident in every session whether a project designs pages or not. The policy below is unchanged by the move ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
+The home for the design-style skills the `design-styles` module ships to every builder on every instance that turns the module on. They lived in `modules/ui-design/skills/` until task 1004470 split them out: `ui-design` stays default-on with `/design`, the sync skills, the kit and the style library, and this module is **off by default** — an instance opts in with `"design-styles": true` in `config/modules.json`, because thirteen descriptions are resident in every session whether a project designs pages or not. The policy below is unchanged by the move ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/bongos/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
 
 ## The policy (enforced by `tests/ui_design_skills.mjs`, declared in [`policy.json`](policy.json))
 
@@ -8,9 +8,9 @@ A third-party skill lands here **only** as a copy of a pinned commit that:
 
 1. was scanned with `/scan-before-install` at the `default` tier or higher and reduced to **`clean` or `caution`** — a `dangerous` verdict never lands a copy, not for a skill already installed on a builder's machine, not for one that "ran the last round"; the arithmetic is the scanner's, not a session's;
 2. carries a licence on the allowlist — `Apache-2.0`, `MIT`, `BSD-2-Clause`, `BSD-3-Clause`, `CC-BY-4.0` — with the upstream `LICENSE` text beside the copy; anything else or unlicensed becomes a rebuild spec, not a copy;
-3. carries a `PROVENANCE.md` sidecar (YAML frontmatter with the fields [`policy.json`](policy.json) names: `name`, `origin`, `sourcePath`, `commit`, `licence`, `scanVerdict`, `scanTier`, `scanReport`, `scannedOn`, `vendoredOn`, then prose) — and the materialiser reads it **at copy time** (`vendoredSkillGate` in `scripts/gds/claude-materialize.js`): a vendored dir with no sidecar, an off-list licence or a verdict that may not land is refused and logged, whatever the CI test says;
+3. carries a `PROVENANCE.md` sidecar (YAML frontmatter with the fields [`policy.json`](policy.json) names: `name`, `origin`, `sourcePath`, `commit`, `licence`, `scanVerdict`, `scanTier`, `scanReport`, `scannedOn`, `vendoredOn`, then prose) — and the materialiser reads it **at copy time** (`vendoredSkillGate` in `scripts/bongos/claude-materialize.js`): a vendored dir with no sidecar, an off-list licence or a verdict that may not land is refused and logged, whatever the CI test says;
 4. opens its `SKILL.md` body with the **PLATFORM PREAMBLE** — [`PREAMBLE.md`](PREAMBLE.md), one fenced block, byte-identical in every copy so an upstream refresh is a three-way merge — which reads the instance's world (its branding pack, its design tokens, its `DESIGN.md`) before any taste rule, keeps the fifteen-token contract the only colour source, makes a style skill produce variants *inside* that world, confines image generation to hero plates and hero objects, applies the instance's taste bans, restates the platform floors and the kill switch, and points at the look-before-you-ship loop;
-5. is declared in `module.json` `contributes.skills` (the manifest stays the single declaration; an undeclared dir is not a skill) and lives under **`vendor/<name>/`** — the `vendor/` segment is the one `scripts/gds/fitness-ratchets.js` exempts from the first-party line and duplication budgets, so a 150-file upstream tree does not count as our debt. A skill the module *authors* lives at `<name>/` and is counted.
+5. is declared in `module.json` `contributes.skills` (the manifest stays the single declaration; an undeclared dir is not a skill) and lives under **`vendor/<name>/`** — the `vendor/` segment is the one `scripts/bongos/fitness-ratchets.js` exempts from the first-party line and duplication budgets, so a 150-file upstream tree does not count as our debt. A skill the module *authors* lives at `<name>/` and is counted.
 
 No auto-update: a refresh is a task that re-scans the new commit and re-applies the preamble. An instance may disable the module (`config/modules.json`), which withdraws every skill here; it may add its own skills under its own `.claude/skills/` — never by editing a vendored copy.
 
@@ -55,7 +55,7 @@ A skill the platform wrote from nothing declares the **other** origin. It lives
 |---|---|---|---|
 | `style` | first party (no upstream) | [task 1003475](https://cloudbongos.com/builders#/task/1003475) | the `/style` session: four bounded steps in which an owner authors their own look as a branding pack. SEARCH renders the nearest two library entries before asking two or three questions about feel; CREATE drafts the three files inside the contract, never a fork of a sheet and never a sixteenth token; PROVE retunes the thirteen against `contrast.js`, the styles suite, `check-mock.js` and the renders with a failure-to-fix table so the retune is arithmetic; ADOPT hands the owner the one-step switch, never writes `config/branding.json`, and files the catalogue rows. Its first output is [`../styles/blueprint`](../../ui-design/styles/README.md), the library's first cool look |
 
-**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/gds/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
+**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/bongos/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
 
 **The playwright plugin** (`claude-plugins-official`, an MCP plugin) is the LIVE browser-driving loop, where the kit is the headless one. It is a prerequisite, documented — `claude plugin install playwright@claude-plugins-official` — never vendored.
 

package/modules/design-styles/skills/imagegen-frontend-mobile/SKILL.md

@@ -57,7 +57,7 @@ The first view at 390 by 844 holds **one focal point** (the masthead or the fiel
 
 ## Step 4: the prompt, the key, the run
 
-A narrow plate is a text-free hero plate or hero object like any other, and the same rule holds: text-free hero plates and hero objects only. The prompt is the family's sentence plus the object, whole and centred, then the refusals every time: **no text, no letters, no logo, no watermark, no UI, no phone**. A portrait plate is generated at its portrait aspect, never cropped down from a landscape one, because the crop destroys the proportion the slot was sized for. Generation goes through the instance's art pipeline (the builder's own image key at the hall's settings, `/builders/settings#art-key`, or the instance's shared key); preflight the cost, generate at 2k, log the spend with `node scripts/gds/cost.js <usd> art --task-id <id>`; a white ground goes through the pipeline's background remover and the alpha is verified with `ffmpeg -vf alphaextract` before anything is called a cutout.
+A narrow plate is a text-free hero plate or hero object like any other, and the same rule holds: text-free hero plates and hero objects only. The prompt is the family's sentence plus the object, whole and centred, then the refusals every time: **no text, no letters, no logo, no watermark, no UI, no phone**. A portrait plate is generated at its portrait aspect, never cropped down from a landscape one, because the crop destroys the proportion the slot was sized for. Generation goes through the instance's art pipeline (the builder's own image key at the hall's settings, `/builders/settings#art-key`, or the instance's shared key); preflight the cost, generate at 2k, log the spend with `node scripts/bongos/cost.js <usd> art --task-id <id>`; a white ground goes through the pipeline's background remover and the alpha is verified with `ffmpeg -vf alphaextract` before anything is called a cutout.
 
 ## Step 5: the output contract
 

package/modules/design-styles/skills/imagegen-frontend-web/SKILL.md

@@ -77,7 +77,7 @@ One prompt per plate, written in this order: the object, whole and centred; the
 
 ## Step 6: the run, through the instance's key
 
-Generation goes through the instance's art pipeline: the builder's own image key at the hall's settings (`/builders/settings#art-key`) or the instance's shared key, never a credential this skill carries or a service it installs. Preflight the cost, generate at 2k, and log the spend with `node scripts/gds/cost.js <usd> art --task-id <id>` under the claim. The model ignores the black-ground instruction about one time in six and returns a white ground; a plate that must sit on a non-black ground goes through the pipeline's background remover for a real-alpha cutout, and the alpha is verified with `ffmpeg -vf alphaextract` (a `signalstats` YAVG strictly between 0 and 255 is real alpha; an image viewer that drops alpha makes a good cutout look opaque).
+Generation goes through the instance's art pipeline: the builder's own image key at the hall's settings (`/builders/settings#art-key`) or the instance's shared key, never a credential this skill carries or a service it installs. Preflight the cost, generate at 2k, and log the spend with `node scripts/bongos/cost.js <usd> art --task-id <id>` under the claim. The model ignores the black-ground instruction about one time in six and returns a white ground; a plate that must sit on a non-black ground goes through the pipeline's background remover for a real-alpha cutout, and the alpha is verified with `ffmpeg -vf alphaextract` (a `signalstats` YAVG strictly between 0 and 255 is real alpha; an image viewer that drops alpha makes a good cutout look opaque).
 
 ## Step 7: the output contract (the pair and the sidecar)
 

package/modules/discord/bug-attachments.js

@@ -60,7 +60,7 @@ const NAME_RE = /^bug-[a-z0-9]{1,40}-[0-9a-f]{16}\.(png|jpg|gif|webp)$/;
 // long as its message exists, and `GET /channels/{channel}/messages/{message}`
 // with the bot token returns a freshly-signed URL. The stored filename carries
 // the message id (`bug-<messageId>-<rand>.<ext>`), so a lost file is still
-// addressable — `scripts/gds/bug-attachment-recover.js` re-fetches it to its
+// addressable — `scripts/bongos/bug-attachment-recover.js` re-fetches it to its
 // original name (task 1004667). It stops working the day the message is deleted
 // or the channel history is gone, so our copy is still the copy to keep. All five
 // attachments this instance ever stored went missing from disk (the 2026-07-05

package/modules/discord/ship-broadcast.js

@@ -2,7 +2,7 @@
 //
 // chooseBroadcastTargets is the PURE channel-routing decision (task 990): given a
 // shipped task's security flag, which Discord channels + lines the broadcast goes
-// to. It lived in scripts/gds/ship.js; task 1045 extracted it here so BOTH the
+// to. It lived in scripts/bongos/ship.js; task 1045 extracted it here so BOTH the
 // laptop-local ship.js path AND the server-mediated publish path (ADR 0055) route
 // by the EXACT same rule — a security fix must never leak to a public channel from
 // either path. ship.js re-exports it so its existing regression test is unchanged.

package/modules/economy/achievements.js

@@ -153,7 +153,7 @@ async function evaluateAfterShip(client, builderId, taskId, changedFiles = null)
     }
   }
 
-  // gds-shipper: the shipped diff includes src/bongos/ or scripts/gds/ (falls back to touches[]).
+  // gds-shipper: the shipped diff includes src/bongos/ or scripts/bongos/ (falls back to touches[]).
   if (!await alreadyUnlocked(client, builderId, 'gds-shipper')) {
     const task = await client.query(
       'SELECT touches FROM tasks WHERE id=$1',
@@ -161,7 +161,9 @@ async function evaluateAfterShip(client, builderId, taskId, changedFiles = null)
     );
     if (task.rowCount > 0) {
       const files = filesForBadges(changedFiles, task.rows[0].touches || []);
-      if (files.some((t) => t.startsWith('src/bongos/') || t.startsWith('scripts/gds/'))) {
+      // The old scripts/ spelling (pre task 1004848) still counts: ships recorded before the move. rename-keep
+      if (files.some((t) => t.startsWith('src/bongos/') || t.startsWith('scripts/bongos/')
+        || t.startsWith('scripts/gds/'))) { // rename-keep: recorded touches[] carry the old path
         const unlocked = await unlockAchievement(client, builderId, 'gds-shipper', taskId);
         if (unlocked) results.push(unlocked);
       }
@@ -274,7 +276,7 @@ async function evaluateAfterCreditAward(client, builderId, totalBefore, totalAft
 //     builders.total_credits, credit_log), so it works no matter which ship
 //     path ran. Callers wrap it in a SAVEPOINT so it can never fail a ship.
 //   - the SINGLE SOURCE OF TRUTH for eligibility (STATE_EVALUATORS below).
-//     scripts/gds/diagnose-achievements.js and the backfill CLI import this same
+//     scripts/bongos/diagnose-achievements.js and the backfill CLI import this same
 //     list, so the stale-prefix drift that silently broke gds-shipper
 //     (idea 44/idea 50: the diagnose/backfill copies still said src/pms/) cannot
 //     recur — there is now one definition, not three.
@@ -313,7 +315,8 @@ async function eligible_gdsShipper(client, builderId) {
        FROM claims c JOIN tasks t ON t.id = c.task_id
       WHERE c.builder_id = $1 AND c.outcome = 'shipped'
         AND EXISTS (SELECT 1 FROM unnest(t.touches) AS p
-                     WHERE p LIKE 'src/bongos/%' OR p LIKE 'scripts/gds/%')
+                     WHERE p LIKE 'src/bongos/%' OR p LIKE 'scripts/bongos/%'
+                        OR p LIKE 'scripts/gds/%') -- rename-keep: recorded touches[] carry the old path
       LIMIT 1`,
     [builderId]
   );
@@ -589,7 +592,43 @@ async function getBuilderAchievements(builderId) {
 // top N (by total_credits), includes an `achievements` string[] of up to
 // `perBuilderCap` achievement IDs the builder has unlocked, sorted by
 // achievements.sort_order. No N+1: one round trip total.
-async function getLeaderboardWithAchievements(limit = 10, perBuilderCap = 5) {
+//
+// task 1004853: served from a short in-process cache. The query sums
+// total_tokens over every session_records row of every listed builder, and the
+// route already tells browsers max-age=60 — but nothing on the server cached,
+// so every hall refresh from every viewer re-ran it. Entries are keyed on the
+// arguments and live LEADERBOARD_CACHE_MS (60 s, matching the header). The
+// in-flight promise is what is cached, so concurrent first reads share one
+// query; a failed read is evicted so the next request retries.
+const LEADERBOARD_CACHE_MS = 60 * 1000;
+const leaderboardCache = new Map(); // `${limit}:${perBuilderCap}` → { at, promise }
+
+function getLeaderboardWithAchievements(limit = 10, perBuilderCap = 5) {
+  const key = `${limit}:${perBuilderCap}`;
+  const now = Date.now();
+  let hit = leaderboardCache.get(key);
+  if (!hit || now - hit.at >= LEADERBOARD_CACHE_MS) {
+    // The key comes from ?limit=&offset=, so sweep expired entries on every
+    // miss: the map holds only what the last minute asked for.
+    for (const [k, v] of leaderboardCache) {
+      if (now - v.at >= LEADERBOARD_CACHE_MS) leaderboardCache.delete(k);
+    }
+    const entry = { at: now, promise: queryLeaderboardWithAchievements(limit, perBuilderCap) };
+    leaderboardCache.set(key, entry);
+    entry.promise.catch(() => {
+      if (leaderboardCache.get(key) === entry) leaderboardCache.delete(key);
+    });
+    hit = entry;
+  }
+  // The route stamps roles onto each row; hand every caller its own copies so
+  // no request can edit the cached answer another request is served.
+  return hit.promise.then((rows) => rows.map((r) => ({ ...r })));
+}
+
+// Test seam: drop every cached leaderboard.
+function clearLeaderboardCache() { leaderboardCache.clear(); }
+
+async function queryLeaderboardWithAchievements(limit, perBuilderCap) {
   const { rows } = await pool.query(
     `SELECT b.id,
             b.github_login,
@@ -621,6 +660,7 @@ async function getLeaderboardWithAchievements(limit = 10, perBuilderCap = 5) {
                WHERE sr.builder_id = b.id
             ), 0)::bigint AS tokens_used
        FROM builders b
+      WHERE b.is_tester = false
        ORDER BY b.total_credits DESC, b.created_at ASC
        LIMIT $1`,
     [limit, perBuilderCap]
@@ -659,7 +699,8 @@ async function getLockedAchievementsProgress(builderId) {
          (SELECT COUNT(*) FROM tasks
            WHERE shipped_by = $1 AND status = 'shipped'
              AND EXISTS (SELECT 1 FROM unnest(COALESCE(touches, ARRAY[]::text[])) t
-                          WHERE t LIKE 'src/bongos/%' OR t LIKE 'scripts/gds/%')) AS pms_ships,
+                          WHERE t LIKE 'src/bongos/%' OR t LIKE 'scripts/bongos/%'
+                             OR t LIKE 'scripts/gds/%')) AS pms_ships, -- rename-keep: recorded touches[] carry the old path
          (SELECT COALESCE(b.total_credits, 0) FROM builders b WHERE b.id = $1) AS total_credits,
          (SELECT COUNT(*)
             FROM claims a
@@ -789,7 +830,7 @@ function renderProgressText(row) {
       return 'needs every page of one surface rewritten by you and approved';
     case 'gds-shipper':
       return pmsShips === 0
-        ? 'needs one shipped task touching src/bongos/ or scripts/gds/'
+        ? 'needs one shipped task touching src/bongos/ or scripts/bongos/'
         : 'keep building';
     case 'breaking-the-100c-bar': {
       const have = Math.max(0, Math.min(totalCredits, 100));
@@ -814,6 +855,7 @@ module.exports = {
   listAchievements,
   getBuilderAchievements,
   getLeaderboardWithAchievements,
+  clearLeaderboardCache,
   getLockedAchievementsProgress,
   renderProgressText,
 };

package/modules/economy/cost-classify.js

@@ -30,20 +30,20 @@ const COST_WRITE_SURFACES = [
     builder_id: 'defaults to the authed builder; a provided value must equal the caller or 403s. A builder can only attribute to themselves.',
   },
   {
-    surface: 'scripts/gds/backfill-cost.js → POST /api/bongos/cost',
-    file: 'scripts/gds/backfill-cost.js',
+    surface: 'scripts/bongos/backfill-cost.js → POST /api/bongos/cost',
+    file: 'scripts/bongos/backfill-cost.js',
     builder_id: 'inherits the POST /cost rule. Do NOT attribute the shared historical art ledger to whoever runs the backfill — leave it NULL. The audit flags it if it happens.',
   },
   {
     // ADR 0028 path 1 (#486): the 4-worker grader panel logs its own cost.
-    surface: 'scripts/gds/ship.js (grader) → POST /api/bongos/cost (source=grader)',
-    file: 'scripts/gds/ship.js',
+    surface: 'scripts/bongos/ship.js (grader) → POST /api/bongos/cost (source=grader)',
+    file: 'scripts/bongos/ship.js',
     builder_id: 'the authed shipper; category=api, source_ref=grade-<task>-<sha>. Idempotent per HEAD.',
   },
   {
     // ADR 0028 path 2 (#560): the interactive session logs its own cost.
-    surface: 'scripts/gds/session-cost.js (SessionEnd hook) → POST /api/bongos/cost (source=session)',
-    file: 'scripts/gds/session-cost.js',
+    surface: 'scripts/bongos/session-cost.js (SessionEnd hook) → POST /api/bongos/cost (source=session)',
+    file: 'scripts/bongos/session-cost.js',
     builder_id: 'the authed builder; category=api, source_ref=<session-id>, task_id=null. Idempotent per session.',
   },
   {

package/modules/economy/cost-report.js

@@ -1,7 +1,7 @@
 // modules/economy/cost-report.js — the spend read-out's text rendering (task
 // 1001621: "what did this cost, by month, category and source", the figures
 // hosting ROI is sized against). Pure (no DB, no I/O) so the CLI
-// (scripts/gds/cost-report.js) stays a thin fetch-and-print shell and the
+// (scripts/bongos/cost-report.js) stays a thin fetch-and-print shell and the
 // wording is unit-testable DB-free (tests/cost_report.mjs). Reads a
 // db.costSummary() payload / the GET /public/cost-summary response as-is.
 

package/modules/economy/cost.js

@@ -207,7 +207,7 @@ async function logCost({
 
 // task 1366 (System 1) — server-side session-cost reconciler.
 //
-// WHY THIS EXISTS. The client cost hook (scripts/gds/session-cost.js, a
+// WHY THIS EXISTS. The client cost hook (scripts/bongos/session-cost.js, a
 // SessionEnd hook) silently fails to write a cost_log row for the MAJORITY of
 // sessions: a cloud box / cowork VM / overnight agent runs with no GDS token,
 // so the hook quiet-skips, and some sessions post a digest but the cost POST

package/modules/economy/credits.js

@@ -48,6 +48,7 @@ async function leaderboard(limit = 20) {
                WHERE sr.builder_id = builders.id
             ), 0)::bigint AS tokens_used
        FROM builders
+      WHERE is_tester = false
        ORDER BY total_credits DESC, created_at ASC
        LIMIT $1`,
     [limit]
@@ -1094,7 +1095,7 @@ async function awardSessionTokenReward(
 //
 // The bonus is a flat +1 drachma when lines_removed > lines_added in the ship's
 // diff_stats (the same shortstat the grader already records in
-// signals.diff_stats — see scripts/gds/ship.js computeDiffShortstat). Net-zero
+// signals.diff_stats — see scripts/bongos/ship.js computeDiffShortstat). Net-zero
 // or net-positive ships get nothing. The credit_log description embeds the raw
 // removed/added values and the reason so the audit trail is self-explaining.
 //

package/modules/economy/idea-size.js

@@ -18,9 +18,9 @@
 // deliberate — so "the karma a thought caused" is not a quantity that exists to
 // be summed. Credits are already idea-attributed at the moment they are booked.
 //
-// WHY NO MIGRATION. scripts/gds/sequence.js flagged this task `needs_migration`,
+// WHY NO MIGRATION. scripts/bongos/sequence.js flagged this task `needs_migration`,
 // but that flag is a keyword scan of the title and description
-// (scripts/gds/sequence.js:169), not a fact about the schema. The reason key
+// (scripts/bongos/sequence.js:169), not a fact about the schema. The reason key
 // stream 1 books under ALREADY embeds the idea:
 //
 //     idea.credit.task_ship:<ideaId>:<taskId>

package/modules/economy/reward.js

@@ -141,4 +141,6 @@ module.exports = {
   get CRAFTS() { return creditsByCraftLib.CRAFTS; },
   computeStreak: (...a) => streak.computeStreak(...a),
   wouldExtendStreak: (...a) => streak.wouldExtendStreak(...a),
+  // task 1004853: /me's batched form — one streak + one task query per request.
+  streakPreviewsForTasks: (...a) => streak.streakPreviewsForTasks(...a),
 };

package/modules/economy/routes/cost.js

@@ -54,7 +54,7 @@ module.exports = function buildCostRouter() {
       // must match the authed builder — we don't let one builder attribute
       // spend to another. Archons could in theory be allowed to override
       // (e.g. for backfill), but the only existing backfill path is
-      // scripts/gds/backfill-cost.js, which runs as Lars (archon) and reads
+      // scripts/bongos/backfill-cost.js, which runs as Lars (archon) and reads
       // the historical ledger that had no builder_id anyway. Keep the rule
       // tight; relax later if/when a real cross-builder use case appears.
       builder_id: { type: 'integer', min: 1 },