@bongos/core 1.21.174 → 1.21.176

package/modules/hall-ui/records/reading-rooms.md

@@ -9,6 +9,6 @@
 
 Also gone, and the one rule in that list: **a page-local `:root` is forbidden both ways** (`roadmap.css` had the hall's only one) — the pack's `:root` is spliced at the end of `<head>` at (0,1,0), so a page's own `:root` neither wins reliably nor loses cleanly.
 
-**Two page-head voices, one per archetype, and that is the pick, not drift.** `.page-head--board` is quiet because a working surface's own name is the least interesting thing on it; `.page-head--room` is a lowercase display line over the ground with a one-word eyebrow, because in a reading room the document *is* the page. The roadmap deck takes the **board's** voice — it is a figure surface, not a document. The modifier carries the voice only; the room's WIDTH (`--room-max`, 1010px — past that a reading card is more empty ground than page) lives in `room.css`, so Ranks can take the voice without loading the archetype and never ends up with a 1010px head over 1120px cards.
+**Two page-head voices, one per archetype, and that is the pick, not drift.** `.page-head--board` is quiet because a working surface's own name is the least interesting thing on it; `.page-head--room` is a lowercase display line over the ground (its one-word eyebrow went in task 1004828 — no page shows its head since task 1004836), because in a reading room the document *is* the page. The roadmap deck takes the **board's** voice — it is a figure surface, not a document. The modifier carries the voice only; the room's WIDTH (`--room-max`, 1010px — past that a reading card is more empty ground than page) lives in `room.css`, so Ranks can take the voice without loading the archetype and never ends up with a 1010px head over 1120px cards.
 
 **The figures follow the theme ([task 1003639](https://cloudbongos.com/builders#/task/1003639)).** mermaid-cli renders one LIGHT figure per diagram at deploy, so on dark mode the canvas was a white plate on black. The fix is two CSS twins and one JS line, not a second render: `diagram-viewer.js` drops the `background-color: white` mermaid bakes into the SVG root, and in dark `diagram-viewer.css` turns the inline SVG with `filter: invert(1) hue-rotate(180deg)` (invert, then turn the hues back, so dark ink reads light and a purple edge stays purple). `room.css` turns the fallback PNG the same way, so a dark reader gets no white flash before the SVG arrives. A second, dark render per diagram was the alternative; it was not taken because it doubles the deploy's headless-Chrome work on a small host and needs the viewer to swap files on a theme switch, where CSS follows the switch for free. Measured on the rendered page, dark, at 137%: 16.1:1 on a node, 11.4:1 on an edge label, 18.8:1 on the note. `tests/hall_reading_world.mjs` §7b pins both twins and the JS line.

package/modules/hall-ui/records/welcome-tower.md

@@ -0,0 +1,50 @@
+# The welcome — Home's first visit of the day (tasks 1004785, 1004818)
+
+The owner's Builders' Hall idea 1001262, second half (the first is [`home-reshuffle.md`](home-reshuffle.md)).
+Files: `public/welcome-boot.js` + `public/welcome-boot.css`, and the owner's two paintings
+`public/welcome-day.webp` / `public/welcome-night.webp`, on Home only.
+
+**How the look got here (2026-10-23, one day of owner rounds).** Task 1004785 built v5 "the tower"
+([`docs/design/mocks/hall/welcome/v5.src.html`](../../../docs/design/mocks/hall/welcome/v5.src.html)),
+drawn live from the Repo Atlas. The owner then asked for day and night and a slow way out, then
+swapped the tower for a glowing module city with a lunch crew on a beam, dropped the crew, and
+finally had Gemini paint the city by day and by night and asked for those to be animated (task
+1004818). The atlas-drawn scene is gone; the painting is the scene.
+
+- **When.** A signed-in builder's first Home load of the LOCAL day, per builder id
+  (`localStorage['hall-welcome-day:<id>']`). Storage that throws is never shown it, because it could not
+  stop it replaying. Never for a signed-out visitor, never over a deep link (`#/task/N`, `#/idea/N`).
+- **It and the craft picker never stack.** `shell.js` asks `OTBWelcome.onAccess()` first and asks
+  `OTBCraftMode.onAccess()` only when the welcome did not show; the welcome also calls
+  `OTBCraftMode.markAsked()`, so a later `applyAccess` on the same load cannot open the picker either.
+  `welcome-boot.js` loads before the `shell-trail.js` / `craft-mode.js` / `shell.js` trio, which
+  `tests/craft_mode.mjs` keeps adjacent.
+- **Day and night.** `timeOfDay` makes 06:00 to 17:59 local `day`, the rest `night`; the root wears
+  `.wb--day` or `.wb--night` and shows the matching painting. It opens from a veil (`.wb__veil`),
+  white by day and black by night, that lifts once the painting has loaded (or after 1.5s).
+- **The motion is laid on the painting, in its own pixels.** `.wb__art` covers the screen at the
+  paintings' 1024x572 shape (both share one layout), so the SVG over it (`viewBox 0 0 1024 572`) keeps
+  every light on its mark however the screen crops: `TOWERS` (the circuit towers, where `pulseRuns`
+  climbs), `BEACONS` (mast lights, night), `LANES` (hover cars), the moon and stars (night), plus a
+  slow drift of the whole picture and two clouds. **A new painting must keep that layout, or the
+  coordinates in welcome-boot.js move with it** — `tests/welcome_boot.mjs` checks both files are
+  1024x572 WebP.
+- **Banner.** "Working on the core of <project>" from `__BRANDING__.identity` (never a hardcoded word),
+  with `core <version>` under it when the public `GET /version` reports one.
+- **Sequence.** Veil lifts, the city powers up (pulses brighten), the greeting comes up at ~3.4s.
+  **Skip** jumps to the greeting; **Esc**, "Your home page" and Engineer leave slowly: the picture sinks
+  past the rooftops while the welcome fades into the hall underneath (about 2.4s), and the hall can be
+  clicked and scrolled from the first moment. A role bound for another room sinks into the veil, then
+  opens that room. Under `prefers-reduced-motion` nothing moves and leaving is immediate.
+- **Roles** (the owner's mapping): Owner → `/city`, Ideator → `/thinking`, Artist → `/studio`,
+  Engineer → stays on Home. A pick also calls `OTBCraftMode.choose()` with governing / ideating /
+  artistry / building. **Owner shows only where `OTBCraftMode.offered('governing')`** — Governing is a
+  seat — and the list is built when "Start with your role" is pressed, after the seats have settled.
+- **No painting** (a 404) hides the image and leaves the sky gradient; everything else works.
+- **Colours are the paintings'**, in both hall themes: `welcome-boot.css` and `welcome-boot.js` are on
+  `tests/hall_audit.mjs`'s literal exemptions with that reason.
+- **Tests.** `tests/welcome_boot.mjs` (the day rule, the paintings' files and shape, every light inside
+  the painting and every pulse inside its tower, the banner, the role map, the load order);
+  `tests/welcome_boot_browser.mjs` runs Home's markup with the real shell, craft mode, welcome and
+  paintings in a browser: once a day, Skip, Esc, no double picker, the seat rule, no painting, reduced
+  motion, the veil by day and night, the slow exit, and that the old drawn scene is gone.

package/modules/ideas/migrations/ideas_011_idea_votes.sql

@@ -0,0 +1,31 @@
+-- ideas_011_idea_votes.sql — builder-on-builder karma votes on IDEAS (task 1004727).
+--
+-- The twin of peer_votes (migrations/058_peer_votes.sql), for ideas. The owner's
+-- decisions (2026-10-23): an idea vote earns karma for the builder who SUBMITTED
+-- the idea (idea_inbox.captured_by), weighs the same as a vote on a task, and
+-- carries the same two guards:
+--   1. no self-vote — enforced in modules/ideas/votes.js (a CHECK cannot see
+--      idea_inbox.captured_by from here);
+--   2. the same 7-day karma lag — the ONE weekly fold
+--      (modules/lifecycle/db-analytics.js tallyPeerVotes) folds a vote only once
+--      recorded_at is at least PEER_VOTE_KARMA_LAG_DAYS old, then stamps
+--      tallied_at; a tallied vote is frozen.
+--
+-- A module-owned table, so it carries the module's prefix (ideas_*), and the
+-- fold reaches it through to_regclass so a core with the ideas module off still
+-- folds task votes.
+
+CREATE TABLE IF NOT EXISTS ideas_votes (
+  id                bigserial PRIMARY KEY,
+  voter_builder_id  bigint NOT NULL REFERENCES builders(id),
+  target_idea_id    bigint NOT NULL REFERENCES idea_inbox(id) ON DELETE CASCADE,
+  vote              integer NOT NULL CHECK (vote IN (-1, 1)),  -- 0 = cleared = row deleted
+  recorded_at       timestamptz NOT NULL DEFAULT now(),
+  tallied_at        timestamptz,  -- NULL = not yet folded into karma
+  UNIQUE (voter_builder_id, target_idea_id)
+);
+
+-- Net-votes-per-idea read (the list control's batched hydrate).
+CREATE INDEX IF NOT EXISTS idx_ideas_votes_target ON ideas_votes (target_idea_id);
+-- Weekly fold hot path: matured, not-yet-folded votes.
+CREATE INDEX IF NOT EXISTS idx_ideas_votes_untallied ON ideas_votes (recorded_at) WHERE tallied_at IS NULL;

package/modules/ideas/projection.js

@@ -1,7 +1,7 @@
 // modules/ideas/projection.js — the SHAPE every idea read returns (task 1004115).
 //
 // Carved out of inbox.js, which sat at exactly the 1,500-line ratchet ceiling
-// (scripts/gds/fitness-ratchets.js OVERSIZE_LINES) and could therefore not grow
+// (scripts/bongos/fitness-ratchets.js OVERSIZE_LINES) and could therefore not grow
 // by one line. That ceiling had started deciding the design rather than the
 // domain: modules/ideas/CLAUDE.md records two files (trail-descent.js,
 // trail-size.js) that exist partly because of it, and task 1004084 shipped an

package/modules/ideas/routes/blockers.js

@@ -65,7 +65,7 @@ async function withAsks(rows) {
 // the scripts that file a TEMPLATED blocker unattended, named here by the
 // `source` each one sends: they keep filing whether or not they send a card, so
 // an unattended run, or a checkout older than this rule, is never refused. They
-// send a card too (scripts/gds/ask.js postWithAsk). An allow-list, not a
+// send a card too (scripts/bongos/ask.js postWithAsk). An allow-list, not a
 // deny-list: agents file with `task`, `manual`, or no source at all, and a
 // source nobody thought of is held to the rule rather than let through.
 // tests/government_agent_asks.mjs reads each script's source off the script.
@@ -137,8 +137,8 @@ module.exports = function buildBlockersRouter() {
       if (port && typeof port.checkAsk === 'function') {
         return res.fail('ask_required', {
           status: 400,
-          message: port.askRequiredMessage || 'An AI session files a blocker with an ask. Check the card first with: node scripts/gds/ask.js check <file>',
-          details: { field: 'ask', helper: 'node scripts/gds/ask.js check <file>' },
+          message: port.askRequiredMessage || 'An AI session files a blocker with an ask. Check the card first with: node scripts/bongos/ask.js check <file>',
+          details: { field: 'ask', helper: 'node scripts/bongos/ask.js check <file>' },
         });
       }
     }

package/modules/ideas/routes/inbox.js

@@ -35,6 +35,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const inbox = require('../inbox');
+const ideaVotes = require('../votes'); // task 1004727: karma votes on ideas
 const bornOf = require('../born-of');
 const ideatorStats = require('../ideator-stats');
 // The trail read to the FULL depth of the descent (task 1004089, BV2.R09). Its
@@ -752,7 +753,7 @@ module.exports = function buildInboxRouter() {
   // records) only fixes collisions INSIDE this file; it cannot reach a route
   // another module contributes. The digit constraint can, because it makes the
   // non-numeric path fall THROUGH to whatever is mounted later, whatever the
-  // order. `scripts/gds/route-shadow-guard.js` fails the build on any remaining
+  // order. `scripts/bongos/route-shadow-guard.js` fails the build on any remaining
   // pair of this shape, and gen-api-docs strips the constraint so it never
   // reaches the published spec.
   //
@@ -771,6 +772,33 @@ module.exports = function buildInboxRouter() {
   // would dead-end at a "no such idea" card. getIdea() reads any idea by id.
   // Authed: a logged-out resolve hits the hall's softAuth "sign in" card, so no
   // idea text is exposed publicly (the linked refs are public, the bodies aren't).
+  // GET /inbox/votes?ids=1,2,3 — net votes and the caller's own vote for every
+  // idea row on a page, in one call, for the hall's shared list vote control
+  // (vote-control.js, task 1004727): { votes: { [id]: { net, mine } } }.
+  // Declared above /inbox/:id. At most 200 ids.
+  router.get('/inbox/votes', api.requireBuilder, api.asyncHandler('GET /inbox/votes', async (req, res) => {
+    const ids = String(req.query.ids || '').split(',');
+    res.json({ votes: await ideaVotes.readIdeaVotes(api.pool, { voterId: req.builder.id, ids }) });
+  }));
+
+  // POST /inbox/:id/vote { vote: 1 | -1 | 0 } — a karma vote on an idea (task
+  // 1004727). Earns karma for the idea's SUBMITTER through the same weekly fold
+  // as task votes, after the same 7-day lag, weighing the same (owner,
+  // 2026-10-23). The same guards as POST /tasks/:id/vote: Metic+ by default, via
+  // its own idea.vote permission (task 1004834; seeded wherever task.vote is), 403 on your own idea, 409 once the
+  // vote has been folded into karma; 0 clears an untallied vote.
+  // rank: metic+archon — a trusted-builder reputation action.
+  router.post('/inbox/:id(\\d+)/vote', api.requireBuilder, api.requirePermission('idea.vote'), api.asyncHandler('POST /inbox/:id/vote', async (req, res) => {
+    if (validateOrRespond(req, res, {
+      vote: { required: true, type: 'integer', enum: [-1, 0, 1] },
+    })) return;
+    const id = parseId(req, res, { code: 'bad_id', positiveInt: true });
+    if (id === null) return;
+    const r = await ideaVotes.castIdeaVote(api.pool, { voterId: req.builder.id, ideaId: id, vote: req.body.vote });
+    if (!r.ok) return res.fail(r.code, r.status, r.detail ? { detail: r.detail } : undefined);
+    res.json(r);
+  }));
+
   router.get('/inbox/:id(\\d+)', api.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_id', positiveInt: true });
     if (id === null) return;

package/modules/ideas/routes/ratify-goal.js

@@ -3,7 +3,7 @@
 // BV2.R17, spec R23, goal 1000095, criterion `ideator-full-idea-shapes-the-space`).
 //
 // WHY IT IS ITS OWN FILE, and not one more route in inbox.js. That file sits at
-// the 1,500-line size ratchet (`scripts/gds/fitness-ratchets.js` OVERSIZE_LINES)
+// the 1,500-line size ratchet (`scripts/bongos/fitness-ratchets.js` OVERSIZE_LINES)
 // and this route pushed it 24 lines over. Trimming back under would have left it
 // at ~1,497 — a landmine for whoever adds the next line — so the route moved
 // out instead. It is the same call `trail-descent.js`, `trail-size.js` and

package/modules/ideas/routing.js

@@ -89,7 +89,7 @@ const NEVER_ROUTE_GRADE = 'full';
 //
 // Both members carry a human or a channel that means "this is broken":
 //   'api'           — POST /inbox, an authenticated builder naming the kind. This
-//                     is also how `scripts/gds/capture.js` files (it posts to the
+//                     is also how `scripts/bongos/capture.js` files (it posts to the
 //                     route rather than calling this module), so the CLI inherits
 //                     it and needs no member of its own.
 //   'discord-bugs'  — the #bugs channel, where the CHANNEL is the classification

package/modules/ideas/templates.js

@@ -140,7 +140,7 @@ const BASE_V2_TEMPLATE = Object.freeze({
 });
 
 // The template a NEW Full Idea is written against — an alias, not a sixth
-// declaration. Consumers that mean "the current questions" (scripts/gds/spark.js
+// declaration. Consumers that mean "the current questions" (scripts/bongos/spark.js
 // prints them; the tests build a full payload from them) read this, so the alias
 // is what makes flipping the default a one-line change here rather than a sweep.
 // Anything that means a SPECIFIC vintage names `BASE_V1_TEMPLATE` /

package/modules/ideas/trail-descent.js

@@ -13,7 +13,7 @@
 //
 // WHY IT IS A SEPARATE FILE rather than more of listIdeaTrailForBuilder. Two
 // reasons, and the second is the real one. inbox.js is AT the 1500-line size
-// ratchet (scripts/gds/fitness-ratchets.js), so a line added there fails the
+// ratchet (scripts/bongos/fitness-ratchets.js), so a line added there fails the
 // build — the same wall that put descent.js beside it. And the descent is a
 // different relation from the trail: the trail is idea → task (one query, one
 // page window), the descent is task → task (a walk). Composing them here keeps

package/modules/ideas/trail-size.js

@@ -8,7 +8,7 @@
 // money: the sum of every stream-1 payout the descent has produced.
 //
 // WHY IT IS A SEPARATE FILE, like trail-descent.js beside it. inbox.js is AT the
-// 1500-line size ratchet (scripts/gds/fitness-ratchets.js), so a line added
+// 1500-line size ratchet (scripts/bongos/fitness-ratchets.js), so a line added
 // there fails the build. And this is a different read again: the trail is
 // idea → task, the descent is a task → task walk, and size is a read of the
 // LEDGER keyed by idea. Three relations, three files.

package/modules/ideas/votes.js

@@ -0,0 +1,93 @@
+'use strict';
+// modules/ideas/votes.js — karma votes on ideas (task 1004727).
+//
+// The idea twin of POST /tasks/:id/vote (modules/lifecycle/routes/tasks.js), with
+// the SAME guards, as the owner decided (2026-10-23): no voting on your own idea,
+// and a vote already folded into karma is frozen. The karma itself is written by
+// the one weekly fold that also counts task votes (tallyPeerVotes in
+// modules/lifecycle/db-analytics.js), which credits the idea's SUBMITTER
+// (idea_inbox.captured_by) after the same 7-day lag. Table: ideas_votes
+// (migrations/ideas_011_idea_votes.sql).
+//
+// Pure over an injected pool, so tests/karma_vote_lists.mjs drives every guard
+// with a scripted pool; the route only maps the result onto HTTP.
+
+async function ideaVoteTally(pool, ideaId) {
+  const { rows } = await pool.query(
+    `SELECT COALESCE(SUM(vote), 0)::int AS net, COUNT(*)::int AS total
+       FROM ideas_votes WHERE target_idea_id = $1`,
+    [ideaId]
+  );
+  const r = rows[0] || {};
+  return { net: Number(r.net) || 0, total: Number(r.total) || 0 };
+}
+
+// Cast (1 / -1) or clear (0) one builder's vote on one idea.
+// -> { ok: true, idea_id, my_vote, net_votes, total_votes }
+//  | { ok: false, status, code, detail }
+async function castIdeaVote(pool, { voterId, ideaId, vote }) {
+  if (![-1, 0, 1].includes(vote)) {
+    return { ok: false, status: 400, code: 'bad_vote', detail: 'vote must be 1, -1, or 0 (clear)' };
+  }
+  const { rows } = await pool.query(`SELECT id, captured_by FROM idea_inbox WHERE id = $1`, [ideaId]);
+  if (!rows.length) return { ok: false, status: 404, code: 'idea_not_found' };
+  const idea = rows[0];
+  if (idea.captured_by == null) {
+    return { ok: false, status: 409, code: 'no_submitter', detail: 'this idea has no submitter to credit' };
+  }
+  if (Number(idea.captured_by) === Number(voterId)) {
+    return { ok: false, status: 403, code: 'self_vote_forbidden', detail: 'you cannot vote on your own idea' };
+  }
+  const frozen = { ok: false, status: 409, code: 'vote_already_counted', detail: 'this vote was folded into karma and can no longer be changed' };
+  if (vote === 0) {
+    // Same freeze semantics as the task path: only an untallied vote clears, and
+    // a 0-row delete is disambiguated so a frozen vote is never reported cleared.
+    const del = await pool.query(
+      `DELETE FROM ideas_votes WHERE voter_builder_id = $1 AND target_idea_id = $2 AND tallied_at IS NULL RETURNING id`,
+      [voterId, ideaId]
+    );
+    if (del.rowCount === 0) {
+      const ex = await pool.query(
+        `SELECT 1 FROM ideas_votes WHERE voter_builder_id = $1 AND target_idea_id = $2`,
+        [voterId, ideaId]
+      );
+      if (ex.rowCount > 0) return frozen;
+    }
+  } else {
+    // The freeze check and the write are ONE statement (no TOCTOU with the fold).
+    // recorded_at is left alone on a change, so the 7-day lag clock is not reset.
+    const up = await pool.query(
+      `INSERT INTO ideas_votes (voter_builder_id, target_idea_id, vote)
+       VALUES ($1, $2, $3)
+       ON CONFLICT (voter_builder_id, target_idea_id)
+       DO UPDATE SET vote = EXCLUDED.vote
+         WHERE ideas_votes.tallied_at IS NULL
+       RETURNING id`,
+      [voterId, ideaId, vote]
+    );
+    if (up.rowCount === 0) return frozen;
+  }
+  const { net, total } = await ideaVoteTally(pool, ideaId);
+  return { ok: true, idea_id: ideaId, my_vote: vote === 0 ? null : vote, net_votes: net, total_votes: total };
+}
+
+// Batched read for a list: { [ideaId]: { net, mine } } for every id asked.
+async function readIdeaVotes(pool, { voterId, ids }) {
+  const clean = [...new Set((ids || []).map(Number).filter((n) => Number.isInteger(n) && n > 0))].slice(0, 200);
+  if (!clean.length) return {};
+  const { rows } = await pool.query(
+    `SELECT target_idea_id AS id,
+            SUM(vote)::int AS net,
+            MAX(CASE WHEN voter_builder_id = $2 THEN vote END) AS mine
+       FROM ideas_votes
+      WHERE target_idea_id = ANY($1::bigint[])
+      GROUP BY target_idea_id`,
+    [clean, voterId]
+  );
+  const out = {};
+  for (const id of clean) out[id] = { net: 0, mine: null };
+  for (const r of rows) out[r.id] = { net: Number(r.net) || 0, mine: r.mine == null ? null : Number(r.mine) };
+  return out;
+}
+
+module.exports = { castIdeaVote, readIdeaVotes, ideaVoteTally };

package/modules/lifecycle/abandon-leftovers.js

@@ -93,7 +93,7 @@ function leftoverNotice(taskId, leftovers) {
     'off its review sits against code that does not exist on main. Decide which:',
     '',
     `  git push origin --delete ${leftovers[0].branch}    # the work is cut — drop it`,
-    `  node scripts/gds/api.js POST /api/gds/tasks/${taskId}/promote   # it is not cut — revive the task`,
+    `  node scripts/bongos/api.js POST /api/gds/tasks/${taskId}/promote   # it is not cut — revive the task`,
     '',
     'Close or draft the branch\'s PR either way — the remote is not this tool\'s to change.',
   );

package/modules/lifecycle/cascade.js

@@ -108,7 +108,7 @@
 //
 // What stays, and why:
 //   • `hasCopyOrVisualWork` stays exported. The grader's advisory reader lens
-//     (ADR 0298, scripts/gds/ship-grade.js) is scoped by it.
+//     (ADR 0298, scripts/bongos/ship-grade.js) is scoped by it.
 //   • The runner still resolves `ctx.artistGate` and `ctx.changedFiles` when a
 //     caller injects them (routes/lifecycle.js does). No production rule reads
 //     either today; the reads are shared with the removal rule's (ship-files.js

package/modules/lifecycle/conflict-resolve.js

@@ -11,7 +11,7 @@
 // reliably hit:
 //   • generated artifacts (docs/repo-map.md, docs/file-map.md, docs/session-log-
 //     index.md, the nested CLAUDE.md symbol blocks) — regenerated from the merged
-//     tree by `otb-regen` (scripts/gds/git-merge-regen.js); and
+//     tree by `otb-regen` (scripts/bongos/git-merge-regen.js); and
 //   • the docs/adr/README.md append-index — `merge=union` keeps both new rows.
 // But that machinery only runs in a LOCAL merge (a builder's box, /merge-mode,
 // ship's pre-stage). The default ship path is server-mediated (ADR 0055): the box
@@ -50,7 +50,7 @@ const { promisify } = require('node:util');
 const githubPush = require('./github-push');
 const { repoInfo, branding } = require('../../src/module-api');
 const { loadRepoInfo } = repoInfo;
-const { registerMergeDriver } = require('../../scripts/gds/install-git-hooks');
+const { registerMergeDriver } = require('../../scripts/bongos/install-git-hooks');
 const { computeExecutedClosure, branchTouchesExecutedCode } = require('./executed-closure');
 
 // The closure is a property of the SERVER's trusted tree, not of the branch being
@@ -211,7 +211,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     //    driver only writes its own %A temp file, and the artifacts it produces are
     //    provisional by design (step 7b regenerates them from the merged tree).
     try {
-      register(work, { driverScript: path.join(repoRoot, 'scripts', 'gds', 'git-merge-regen.js') });
+      register(work, { driverScript: path.join(repoRoot, 'scripts', 'bongos', 'git-merge-regen.js') });
     } catch (_) {
       /* fall through — the merge will just leave generated conflicts unresolved */
     }
@@ -235,7 +235,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     //     live server's environment — the merge driver at step 6 and the generators at
     //     7b — so a branch that rewrote any of it would be running its own code as the
     //     server. This check must sit BEFORE the merge, not after it: `git merge` invokes
-    //     `node scripts/gds/git-merge-regen.js` by RELATIVE path with cwd at the clone
+    //     `node scripts/bongos/git-merge-regen.js` by RELATIVE path with cwd at the clone
     //     root, so the driver is the clone's copy and it runs at step 6.
     //
     //     Fail CLOSED and hand the merge to a human. The alternative — scrubbing the
@@ -339,9 +339,9 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
 // heal regenerates exactly these from the merged tree. Kept as the clone's OWN
 // scripts (each resolves its repo root from its __dirname), never the server's.
 const GENERATOR_SCRIPTS = [
-  'scripts/gds/gen-repo-map.js',
-  'scripts/gds/gen-file-map.js',
-  'scripts/gds/gen-session-index.js',
+  'scripts/bongos/gen-repo-map.js',
+  'scripts/bongos/gen-file-map.js',
+  'scripts/bongos/gen-session-index.js',
   // task 1003546: copy-inventory.js writes docs/copy-registry.json +
   // docs/copy-inventory.md, and its rows carry a `line` per copy string — so ANY
   // merge that shifts lines in a scanned UI file re-stales it and `unit`
@@ -351,20 +351,12 @@ const GENERATOR_SCRIPTS = [
   // staleness" — so copy-registry staleness was MISDIAGNOSED as a genuine failure,
   // burned the attempt cap, and announceStrand flagged the task needs_rebase
   // (PR #536 / task 1003544).
-  'scripts/gds/copy-inventory.js',
-  // task 1003537: the generated API contract + client. gen-api-docs.js writes
-  // docs/api/openapi.json + docs/api-reference.md + docs/routes-permissions.md from a
-  // scan of the route files; gen-api-client.js then writes the six
-  // clients/bongos-client files FROM that spec. Both are `--check` gates on the merge
-  // ref, so the same trap copy-inventory.js fell into applies verbatim: covered by the
-  // merge driver, regenerated by nobody, and the resulting staleness reported as
-  // `no_regen_diff` — "a real check failure" — rather than as drift.
-  //
-  // ORDER IS LOAD-BEARING: gen-api-client.js reads docs/api/openapi.json off disk, so
-  // it must run AFTER gen-api-docs.js has rewritten it for the merged tree. This list
-  // is walked in order, one await at a time, which is what makes that safe.
-  'scripts/gds/gen-api-docs.js',
-  'scripts/gds/gen-api-client.js',
+  'scripts/bongos/copy-inventory.js',
+  // task 1003537: gen-api-docs.js writes the committed docs/routes-permissions.md stub
+  // (a --check gate on the merge ref). The spec, the reference and the typed client it
+  // and gen-api-client.js also produce are gitignored since task 1004866 — nothing on
+  // the merge ref can be stale — so gen-api-client.js no longer runs here at all.
+  'scripts/bongos/gen-api-docs.js',
 ];
 
 // Run the CLONE's generator scripts in WRITE mode against the merged working tree.

package/modules/lifecycle/criterion-ref.js

@@ -3,7 +3,7 @@
 //
 // WHY THIS FILE EXISTS. `parseCriterionRef` lived inside db-deps-criteria.js,
 // which requires ../../src/module-api and therefore a database pool. The read
-// side — scripts/gds/status.js, which is public and unauthenticated — could not
+// side — scripts/bongos/status.js, which is public and unauthenticated — could not
 // require it, so
 // it grew its own parser: `Number(ref.slice(1))`, positional only. The system
 // ended up PRINTING an identifier its own write path refuses as unsafe, because

package/modules/lifecycle/db-analytics.js

@@ -135,16 +135,24 @@ async function estimationDriftSummary() {
 }
 
 
+// The rows a builder's own ship list shows: shipped by them, never a smoke task.
+// Shared by the list and its count so the two can never disagree on what "a ship" is.
+const LISTED_SHIPS_WHERE = `t.shipped_by = $1
+        AND t.status = 'shipped'
+        AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'`;
+
 async function recentShippedTasksByBuilder(builderId, limit = 10) {
   const { rows } = await pool.query(
     // task 1004433: the profile's recent works show what THIS builder was paid
     // (creditsEarnedBySql), not the task's whole payout across everyone.
+    // That figure is a per-row subquery over the builder's sessions, so its cost
+    // grows with rows returned x sessions; Postgres evaluates it only for the rows
+    // that survive the LIMIT, which is why a caller wanting a number should ask
+    // countListedShipsByBuilder rather than fetching every row (task 1004854).
     `SELECT t.id, t.title, t.value_summary, t.visual_url, t.visual_alt, t.version_id, t.status, t.shipped_at, t.credits_reward,
             ${creditsEarnedBySql('$1')} AS credits_awarded
        FROM tasks t
-      WHERE t.shipped_by = $1
-        AND t.status = 'shipped'
-        AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
+      WHERE ${LISTED_SHIPS_WHERE}
       ORDER BY t.shipped_at DESC NULLS LAST
       LIMIT $2`,
     [builderId, limit]
@@ -152,6 +160,19 @@ async function recentShippedTasksByBuilder(builderId, limit = 10) {
   return rows;
 }
 
+// How many ships recentShippedTasksByBuilder would list with no limit — a plain
+// count (task 1004854). No new index: idx_tasks_shipped_by_shipped_at
+// ON tasks (shipped_by, shipped_at DESC) WHERE status = 'shipped' already matches
+// this predicate (migrations/core_228_idea_inbox_captured_by_idx.sql). Measured on
+// a freshly migrated copy with a 3,000-ship builder in 8,000 tasks: 0.8 ms.
+async function countListedShipsByBuilder(builderId) {
+  const { rows } = await pool.query(
+    `SELECT count(*)::int AS n FROM tasks t WHERE ${LISTED_SHIPS_WHERE}`,
+    [builderId]
+  );
+  return rows[0]?.n ?? 0;
+}
+
 // -------------------------------------------------------------------------
 // Achievement getters (listAchievements / getBuilderAchievements /
 // getLeaderboardWithAchievements / getLockedAchievementsProgress /
@@ -812,6 +833,30 @@ async function tallyPeerVotes() {
       voteIds.push(r.id);
       netByBuilder.set(r.builder_id, (netByBuilder.get(r.builder_id) || 0) + r.vote);
     }
+    // task 1004727: idea votes fold HERE, in the same transaction, with the same
+    // lag, into the idea's SUBMITTER, and weigh the same as a task vote (owner,
+    // 2026-10-23). ideas_votes is the ideas module's table, so it is reached only
+    // when it exists: a core with that module off still folds task votes.
+    const ideaVoteIds = [];
+    const { rows: [{ has: hasIdeaVotes }] } = await client.query(
+      `SELECT to_regclass('ideas_votes') IS NOT NULL AS has`
+    );
+    if (hasIdeaVotes) {
+      const { rows: maturedIdeas } = await client.query(
+        `SELECT iv.id, i.captured_by AS builder_id, iv.vote
+           FROM ideas_votes iv
+           JOIN idea_inbox i ON i.id = iv.target_idea_id
+          WHERE iv.tallied_at IS NULL
+            AND iv.recorded_at <= now() - ($1::int * interval '1 day')
+            AND i.captured_by IS NOT NULL
+          FOR UPDATE OF iv`,
+        [PEER_VOTE_KARMA_LAG_DAYS]
+      );
+      for (const r of maturedIdeas) {
+        ideaVoteIds.push(r.id);
+        netByBuilder.set(r.builder_id, (netByBuilder.get(r.builder_id) || 0) + r.vote);
+      }
+    }
     const karmaRows = [];
     for (const [builderId, net] of netByBuilder) {
       if (net === 0) continue; // no net signal → no karma row, but still mark tallied
@@ -828,9 +873,16 @@ async function tallyPeerVotes() {
         [voteIds]
       );
     }
+    if (ideaVoteIds.length) {
+      await client.query(
+        `UPDATE ideas_votes SET tallied_at = now() WHERE id = ANY($1::bigint[])`,
+        [ideaVoteIds]
+      );
+    }
     return {
       ok: true,
-      votes_tallied: voteIds.length,
+      votes_tallied: voteIds.length + ideaVoteIds.length,
+      idea_votes_tallied: ideaVoteIds.length,
       builders_credited: karmaRows.length,
       karma: karmaRows,
       lag_days: PEER_VOTE_KARMA_LAG_DAYS,
@@ -857,6 +909,7 @@ module.exports = {
   recentGradesForBuilder,
   recentShippedTasks,
   recentShippedTasksByBuilder,
+  countListedShipsByBuilder,
   releaseMergeLease,
   rollingAvgGrade,
   tallyPeerVotes,

package/modules/lifecycle/db-deps-criteria.js

@@ -335,7 +335,7 @@ async function removeDependency(fromKind, fromId, toKind, toId) {
 //
 // The DEFINITION lives in ./criterion-ref.js, which requires nothing at all —
 // because the READ side needs the same vocabulary and cannot pay for a pool.
-// scripts/gds/status.js is public and unauthenticated, so while this classifier sat behind
+// scripts/bongos/status.js is public and unauthenticated, so while this classifier sat behind
 // ../../src/module-api it was unreachable from there and the CLI grew its own
 // positional-only parser (`Number(ref.slice(1))`). The system ended up PRINTING
 // and REQUIRING the very ref shape resolveCriterionIds below refuses as unsafe

package/modules/lifecycle/db-ship.js

@@ -871,7 +871,7 @@ async function getBuildersRoster({ staleHours } = {}) {
        b.display_name,
        b.avatar_url,
        b.rank,
-       b.status,
+       b.status, b.is_tester,
        b.total_credits,
        b.karma,
        b.created_at,
@@ -1445,7 +1445,7 @@ async function mergeTask({ taskId, intoTaskId, reason }, deps = {}) {
 
     // Abandoned blocks its dependents forever (owner ruling 2026-08-21, see this
     // module's CLAUDE.md), so the merge must say who it just stranded — the same
-    // report scripts/gds/abandon.js prints. Live dependents only; read inside the
+    // report scripts/bongos/abandon.js prints. Live dependents only; read inside the
     // txn so it agrees with the row we just flipped.
     const { rows: stranded } = await client.query(
       `SELECT t.id, t.title, t.status

package/modules/lifecycle/db-tasks.js

@@ -849,7 +849,7 @@ async function listTasks({ versionId, status, kind, discipline, goalId, createdB
 
 // task 1002827 — the candidate pool for the dependency advisory (POST /tasks'
 // `dependency_advisory` + the periodic sweep): OPEN tasks in this version that
-// carry touches[], the same OPEN set scripts/gds/audit-deps.js already treats
+// carry touches[], the same OPEN set scripts/bongos/audit-deps.js already treats
 // as "auditable" (ready, backlog, active, blocked). Bounded and cheap —
 // measured 2026-09-22, BONGOS-V2 carries ~51 such rows, since most tasks
 // declare no touches[] at all (ADR 0049 demoted the field to advisory, so
@@ -1203,7 +1203,7 @@ function taskTouchesProtectedPath(task) {
 //   3. est_minutes ASC         — shorter wins the tiebreak (easier to try)
 //   4. id ASC                  — stable final tiebreak
 //
-// scripts/gds/start.js keeps a hand-copied mirror of this function (it is a
+// scripts/bongos/start.js keeps a hand-copied mirror of this function (it is a
 // pure HTTP client and cannot import this module). The two are a documented
 // mirror pair: tests/cross_discipline_priority_direction.mjs executes BOTH and
 // fails if either drifts. Change one, change the other.

package/modules/lifecycle/db-versions.js

@@ -230,7 +230,7 @@ async function createVersion({ id, name, status = 'planning', scopeDocPath = nul
 // THE TIEBREAK IS NOT NEW. More than one version may sit at 'building' — ADR 0250
 // D5 closes the PLANNING slot only, and refusing a second building version is
 // still unshipped work (task 1003606, BV1.R19) — so a rule was needed, and the
-// project already has one: scripts/gds/version-select.js pickDefaultVersion,
+// project already has one: scripts/bongos/version-select.js pickDefaultVersion,
 // extracted to end nine hardcoded version literals and pinned by
 // tests/version_literals.mjs. This is that rule in SQL: building only, most
 // recently started first, a null started_at sorting LAST so a half-filled row

package/modules/lifecycle/db.js

@@ -179,6 +179,7 @@ const {
   recentGradesForBuilder,
   recentShippedTasks,
   recentShippedTasksByBuilder,
+  countListedShipsByBuilder,
   releaseMergeLease,
   rollingAvgGrade,
   tallyPeerVotes,
@@ -353,6 +354,7 @@ module.exports = {
   releaseClaimOnBehalf,
   recentShippedTasks,
   recentShippedTasksByBuilder,
+  countListedShipsByBuilder,
   getEstVsActualRatio,
   estimationDriftSummary,
   recentGradesForBuilder,

package/modules/lifecycle/dead-deps.js

@@ -19,8 +19,8 @@
 // actual bug: the CLI used to answer a dead edge with "Ship those first (or
 // release them) and try again", advice that can never be followed.
 //
-// Pure + DB-free so the CLI (scripts/gds/claim.js), the route
-// (modules/lifecycle/routes/claims.js) and the detector (scripts/gds/audit-deps.js)
+// Pure + DB-free so the CLI (scripts/bongos/claim.js), the route
+// (modules/lifecycle/routes/claims.js) and the detector (scripts/bongos/audit-deps.js)
 // all speak from ONE definition — the goal-authz.js precedent.
 
 // The one terminal task status that can gate a dependency edge. 'shipped' is the
@@ -155,7 +155,7 @@ function deadDepHint(deps, taskId = null) {
     + tail;
 }
 
-// Detector core (scripts/gds/audit-deps.js --stranded): which LIVE tasks are
+// Detector core (scripts/bongos/audit-deps.js --stranded): which LIVE tasks are
 // gated by an abandoned dependency? `tasks` are rows carrying { id, status,
 // title, blocked_by: [{ id, status, title }] } — the GET /tasks?include=deps
 // shape. A dependent that is itself terminal is NOT stranded (nothing is