@bongos/core 1.21.175 → 1.21.176

package/docs/file-map.md

@@ -14,7 +14,7 @@
 ├── .impeccable/                 ← impeccable skill artifacts: config.json (buildPath: code), surfaces/<route>.md (per-route briefs), mocks/world-assets/ (Higgsfield renders + prompt sidecars; the SOURCE of modules/public-landing/public/assets/world/), mocks/decision/ (A1 comps), design.json (DESIGN.md sidecar), review/ (finish captures)
 ├── .gitignore
 ├── package.json / package-lock.json
-├── CODEOWNERS                   ← owner review on the merge-gate surfaces (real since task 1002611, ADR 0159); inert until branch protection is on (scripts/gds/gating.js) — keep aligned with gate-review.js HARD_FLOOR_GLOBS
+├── CODEOWNERS                   ← owner review on the merge-gate surfaces (real since task 1002611, ADR 0159); inert until branch protection is on (scripts/bongos/gating.js) — keep aligned with gate-review.js HARD_FLOOR_GLOBS
 ├── server.js                    ← game boot: Express + Colyseus + the shared internal surface (mountInternalSurfaces), binds 127.0.0.1:3000
 │
 ├── limitations/                 ← versioning-methodology artifacts
@@ -40,21 +40,21 @@
 │   │   └── 0001…0120-*.md       ← 133 ADR files (a handful of numbers collide — see README.md's disambiguation note; README.md has the live list)
 │   ├── architecture.md          ← §10 detail: live infra, app stack, DB schema, Bongos API (split out V3.R86)
 │   ├── canonical-permissions.md ← rank ladder + trust boundary reference (read-only mirror; DB enforces)
-│   ├── code-conventions.md      ← ADR 0095 (task 1001654): the doc-comment convention — every module a header, every public symbol a line, saying WHAT it does and WHY it exists. The findability layer agents grep. Advisory only; the nudge is scripts/gds/doc-comment-coverage.js
+│   ├── code-conventions.md      ← ADR 0095 (task 1001654): the doc-comment convention — every module a header, every public symbol a line, saying WHAT it does and WHY it exists. The findability layer agents grep. Advisory only; the nudge is scripts/bongos/doc-comment-coverage.js
 │   ├── design/                  ← game design docs (V2 visual redesign cluster)
 │   │   ├── container-exterior.md ← (#641) container building exterior: two-storey stacked-container structure, glass facade, deck, rooftop
 │   │   └── container-interior.md ← (#645) container building interior: layered industrial shell + aqua wave floor + boutique display; palette reconciled to ADR 0044
 │   ├── file-map.md              ← this file (§11 detail, split out V3.R86); the `.claude/skills/` + `.claude/scheduled-tasks/` trees are GENERATED (gen-file-map.js, ADR 0066) — do not hand-edit those blocks
 │   ├── file-map.notes.json      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): the sidecar of one-line notes for each skill/routine that gen-file-map.js renders into file-map.md; the ONE place to edit those notes — a new skill with no note here fails CI
-│   ├── copy-registry.json      ← GENERATED (scripts/gds/copy-inventory.js): the machine-readable copy registry — 1,096 user-facing strings with stable ids, render paths, and duplicates. R02's flag queue attaches to these ids; regenerate + commit, never hand-edit
+│   ├── copy-registry.json      ← GENERATED (scripts/bongos/copy-inventory.js): the machine-readable copy registry — 1,096 user-facing strings with stable ids, render paths, and duplicates. R02's flag queue attaches to these ids; regenerate + commit, never hand-edit
 │   ├── copy-inventory.md       ← GENERATED twin of copy-registry.json: the human-readable copy report, including the "what this cannot see" section (server-side messages, skill prose, Discord copy, runtime-composed strings, and the src/ui-vs-reality surface mismatch)
-│   ├── page-inventory.json     ← GENERATED (scripts/gds/page-inventory.js, BV2.TW02 task 1004314): every page of every enabled web surface (builders hall, landing, status) with its stable id <surface>:<page>, title, portable url, the files that render it and its .states.json states. Tweak Mode keys page status, claims and pay on these ids; regenerate + commit, never hand-edit
+│   ├── page-inventory.json     ← GENERATED (scripts/bongos/page-inventory.js, BV2.TW02 task 1004314): every page of every enabled web surface (builders hall, landing, status) with its stable id <surface>:<page>, title, portable url, the files that render it and its .states.json states. Tweak Mode keys page status, claims and pay on these ids; regenerate + commit, never hand-edit
 │   ├── page-inventory.md       ← GENERATED twin of page-inventory.json: the id rule, then one table per surface
-│   ├── page-readings.json      ← GENERATED (scripts/gds/page-reader.js, BV2.TW04 task 1004315, ADR 0341 D3): every inventory page rendered in each state, its visible strings in page order by section, each placed (registry row), shared (shell text) or unplaced; reading_hash + files_hash per page. Re-read with page-reader.js --stale, never hand-edit
+│   ├── page-readings.json      ← GENERATED (scripts/bongos/page-reader.js, BV2.TW04 task 1004315, ADR 0341 D3): every inventory page rendered in each state, its visible strings in page order by section, each placed (registry row), shared (shell text) or unplaced; reading_hash + files_hash per page. Re-read with page-reader.js --stale, never hand-edit
 │   ├── handoff-template.md      ← session-end template + Definition of Done
-│   ├── module-api-changelog.md  ← the `CORE_VERSION` release ledger for the published doorway (ADR 0203, task 1003335). MOVED here out of src/module-api.js: the ADR 0161 CI carrier appends an entry on every release and pushes straight to main, which grew that .js file past the 1500-line oversized-file ratchet and turned `unit` red for main and every open PR. Markdown is exempt from the .js line budget. Written by scripts/gds/bump-version.js (entries oldest-first, each inserted above the closing divider); the CORE_VERSION literal itself stays in src/module-api.js
+│   ├── module-api-changelog.md  ← the `CORE_VERSION` release ledger for the published doorway (ADR 0203, task 1003335). MOVED here out of src/module-api.js: the ADR 0161 CI carrier appends an entry on every release and pushes straight to main, which grew that .js file past the 1500-line oversized-file ratchet and turned `unit` red for main and every open PR. Markdown is exempt from the .js line budget. Written by scripts/bongos/bump-version.js (entries oldest-first, each inserted above the closing divider); the CORE_VERSION literal itself stays in src/module-api.js
 │   ├── google-chat-broadcast.md ← team-chat integration plan
-│   ├── packs/                   ← the ROLE PACKS (task 1002990, criterion wa6-kernel-and-packs): the root CLAUDE.md is now a role-neutral KERNEL and each craft's operating playbook lives here. Bound to a discipline by scripts/gds/discipline-modes.json (the role registry), printed by claim.js, and budgeted by scripts/gds/role-pack-guard.js — which HARD-FAILS CI if a registry entry names a pack that isn't in the tree, because claim.js's own read fails open and would hide it. Replaces the deleted /dev, /ideate and /paint skills. Governor is deferred: three packs, not four
+│   ├── packs/                   ← the ROLE PACKS (task 1002990, criterion wa6-kernel-and-packs): the root CLAUDE.md is now a role-neutral KERNEL and each craft's operating playbook lives here. Bound to a discipline by scripts/bongos/discipline-modes.json (the role registry), printed by claim.js, and budgeted by scripts/bongos/role-pack-guard.js — which HARD-FAILS CI if a registry entry names a pack that isn't in the tree, because claim.js's own read fails open and would hide it. Replaces the deleted /dev, /ideate and /paint skills. Governor is deferred: three packs, not four
 │   │   ├── engineer.md          ← code, infra, Bongos itself: the understand → scoped-change → verify → ship loop, the working rules, the session protocol, the daily cadence
 │   │   ├── artist.md            ← how the project looks and reads: show-first, as little interpretation as possible, arrive precalculated — a place an artist wants to be, not a form
 │   │   └── ideator.md           ← Claude as sounding board, not author: quick ideas stay one line, then the offer to develop one into a Full Idea (five questions drawn out of the conversation, scored on completeness). Contract pinned by tests/idea_ideate_full.mjs
@@ -67,7 +67,7 @@
 │   │   └── overnight-builder.md ← (#358) operator runbook for the autonomous overnight session-runner
 │   ├── research/                ← investigations that answer a question rather than record a decision (an ADR) or a procedure (a recipe)
 │   │   ├── task-network-map-readability.md ← (task 1003282, goal 1000072) the spike verdict: a node-link map of ~1,357 tasks is unreadable at every dependency density — 59–97% isolated dots, and the dense fix overplots 84% of them into the 40-node goal graph. Build the goal graph + a per-goal dependency forest; measure the real density with `--from` first
-│   │   └── task-network-map/    ← the figures that verdict argues from, rendered by scripts/gds/spike-task-map.js — regenerate, never hand-edit
+│   │   └── task-network-map/    ← the figures that verdict argues from, rendered by the spike harness (deleted in task 1004857; in history at b8c20cba2) — never hand-edit
 │   ├── reviews/                 ← temporary audit/review docs (e.g. claude-md-audit-V3.R86.md)
 │   ├── session-logs/            ← one file per session, named YYYY-MM-DD-<slug>.md (CLAUDE.md §13 indexes them)
 │   ├── session-log-archive.md   ← compressed older session-log prose
@@ -113,11 +113,12 @@
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `roster.css` the Builders roster's identity cell (was `people.css`, shared with the cross-project `/people` directory until task 1003444 deleted that page — `/people` and its legacy door `/scouting` now 302 to `/roster`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
-│   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. BV2.TW05 (task 1004316, ADR 0341 D8) added Tweak Mode's three derived READS — GET /copy-desk/pages, /copy-desk/pages/:pageId, /copy-desk/tally: page status and count, changelog, drift, "N of M tweaked" per surface, and the artist's tally — over the page-tweak tasks (lifecycle port), docs/page-inventory.json and docs/page-readings.json (both now in the publish manifest), with no status table. BV2.TW06 (task 1004317, ADR 0341 D2, D5, D6) added its first two page WRITES: POST /copy-desk/pages/:pageId/claim (an artist-craft builder opens or takes the page's tweak round as a web-claimed task, through the lifecycle port's webClaimPageTweak, under an advisory lock on the page) and POST /copy-desk/pages/:pageId/asks (anyone files a page ask, a copy_desk_flags row with scope 'page', added by copy_desk_002_page_asks.sql). CLAUDE.md, module.json, registry.js, flags.js, proposals.js, pages.js (the page-tweak block format), page-status.js (the pure derivation), page-data.js (the page artifacts' read side), routes/copy-desk.js, migrations/copy_desk_001_flags.sql, migrations/copy_desk_002_page_asks.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals,copy_page_status}.mjs + tests/fixtures/page-tweak.cjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent. skills/tweak/SKILL.md is the /tweak skill (contributes.skills; moved out of .claude/skills/ in task 1004471, hidden from the model listing, typed as /tweak).
+│   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/bongos/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/bongos/copy-apply.js lands it as a real diff under a claim. BV2.TW05 (task 1004316, ADR 0341 D8) added Tweak Mode's three derived READS — GET /copy-desk/pages, /copy-desk/pages/:pageId, /copy-desk/tally: page status and count, changelog, drift, "N of M tweaked" per surface, and the artist's tally — over the page-tweak tasks (lifecycle port), docs/page-inventory.json and docs/page-readings.json (both now in the publish manifest), with no status table. BV2.TW06 (task 1004317, ADR 0341 D2, D5, D6) added its first two page WRITES: POST /copy-desk/pages/:pageId/claim (an artist-craft builder opens or takes the page's tweak round as a web-claimed task, through the lifecycle port's webClaimPageTweak, under an advisory lock on the page) and POST /copy-desk/pages/:pageId/asks (anyone files a page ask, a copy_desk_flags row with scope 'page', added by copy_desk_002_page_asks.sql). CLAUDE.md, module.json, registry.js, flags.js, proposals.js, pages.js (the page-tweak block format), page-status.js (the pure derivation), page-data.js (the page artifacts' read side), routes/copy-desk.js, migrations/copy_desk_001_flags.sql, migrations/copy_desk_002_page_asks.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals,copy_page_status}.mjs + tests/fixtures/page-tweak.cjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent. skills/tweak/SKILL.md is the /tweak skill (contributes.skills; moved out of .claude/skills/ in task 1004471, hidden from the model listing, typed as /tweak).
 │   ├── page-notes/              ← the artist's page feedback docs (task 1004496, default-on): the Artistry palette button's store. A doc about one hall page, with up to eight reference images (stored in the DB, images only), turned into ideas by an AI split on submit and kept as the page's reference (?note=N). Apart from copy-desk, which may hold no wording. module.json, CLAUDE.md, notes.js (pure), split.js, db.js, routes/, migrations/.
-│   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
-│   ├── render-deploy/           ← the deploy page for a project whose app deploys through Render (task 1004270, default-OFF). The service's Render deploys, each tied to its commit and the Bongos tasks in it, what is live now, and deploy + roll back behind a two-step confirm the server also holds. The owner's Render key is never stored: it rides each request in a header. Uses the one Render client, scripts/gds/render-api.js, and its ownerId guard. `deploys.js` (shaping + ledger), `render.js` (key + client), `routes/` (app, history, act), `public/deploy.js` (the page, mounted in /deploy), `migrations/` (one two-id table)
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470 (below); design-taste-frontend-v1 was deleted. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── raise/                   ← the /raise investor page (task 1004847, ADR 0384, default-off; hub only): password-gated for investors (signing in accepts the NDA, non-binding interest), edited in place by any active builder with every change logged. The copy in content/ is the owner's words — never reword it in code. module.json, CLAUDE.md, raise.js (pure), page.js, web.js (the GET-only raise.web port core mounts at /raise), db.js, routes/ (every write), migrations/, content/, views/, public/.
+│   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/bongos/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
+│   ├── render-deploy/           ← the deploy page for a project whose app deploys through Render (task 1004270, default-OFF). The service's Render deploys, each tied to its commit and the Bongos tasks in it, what is live now, and deploy + roll back behind a two-step confirm the server also holds. The owner's Render key is never stored: it rides each request in a header. Uses the one Render client, scripts/bongos/render-api.js, and its ownerId guard. `deploys.js` (shaping + ledger), `render.js` (key + client), `routes/` (app, history, act), `public/deploy.js` (the page, mounted in /deploy), `migrations/` (one two-id table)
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/bongos/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470 (below); design-taste-frontend-v1 was deleted. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── design-styles/           ← the opt-in design-style skills (task 1004470, default-OFF): split out of ui-design so the thirteen descriptions are not resident on an instance that never designs a page; an instance turns it on with "design-styles": true in config/modules.json, and /design says plainly when it is off. Declaration-only: module.json, CLAUDE.md, skills/. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in modules/ui-design/styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's modules/ui-design/styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json.
 │   ├── pixel-art/               ← the opt-in pixel-art skills (task 1004470, default-OFF): otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture, otb-figma-sync under skills/<name>/SKILL.md — moved out of .claude/skills/, where they were orphans no manifest owned. Skill TEXT only: the pipeline, palette, rubric and the copyrighted reference maps stay in the instance's never-published art-pipeline (ADR 0098). module.json, CLAUDE.md, skills/.
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest (its otb-character-review skill is the pixel-art module's since task 1004470). CLAUDE.md, module.json.
@@ -141,72 +142,72 @@
 │   │   ├── README.md
 │   │   ├── lib.js               ← webhook poster (reads ~/.config/otb/discord-webhooks.json, mode 600)
 │   │   └── post.js              ← post a ship summary to a channel (default ship_news)
-│   └── gds/                     ← Bongos CLI + bootstrap (renamed from `pms/` in V3.R01)
-│       ├── cli-lib.js           ← shared: session token, apiCall(), formatters
-│       ├── discord-channels.js  ← Archon CLI: plan/apply the Discord channel layout via the API (ADR 0036, #727)
-│       ├── setup.js             ← one-time GitHub Device Flow → ~/.config/otb/gds-session.json
-│       ├── start.js             ← list claimable tasks + active claims (`/builder-start`)
-│       ├── claim.js             ← atomic POST /api/bongos/claims (`/builder-claim`); runs the worktree-per-claim guard (worktree-claim-guard.js) BEFORE the session check and the POST; prints the claim-time context pack incl. next-free ADR/migration numbers (V4.R26); printRoleLine() prints the claimed craft's one role line from discipline-modes.json and lands a ui claim's module-owned skills (the full pack pointer is injected by the Conductor from GET /me, task 1002992)
-│       ├── discipline-modes.json ← the ROLE REGISTRY read by claim.js: engineer/artist/ideator → their role pack under docs/packs/, module-contributed ui → the /design skill; absence of an entry = the default build-and-ship loop, fail-open at claim time — but scripts/gds/role-pack-guard.js hard-fails CI if an entry names a pack that is not in the tree ([#1267](https://example.com/builders#/task/1267))
-│       ├── next-number.js       ← deterministic next-free ADR + migration number from origin/main ∪ local working tree; supersedes the drift-prone claim-time DB counter (V4.R26, [#964](https://example.com/builders#/task/964)). `node scripts/gds/next-number.js [--json]`
-│       ├── gen-repo-map.js      ← Path B (ADR 0063, [#1224](https://example.com/builders#/task/1224)): zero-dep, deterministic symbol-skeleton generator → docs/repo-map.md + the generated factual block in each nested CLAUDE.md; ranks exported symbols by reference frequency. `--check` = CI gate; regenerated on deploy by ship.js regenerateRepoMap()
-│       ├── gen-file-map.js      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): generates the `.claude/skills/` + `.claude/scheduled-tasks/` sections of docs/file-map.md from disk; per-entry notes come from docs/file-map.notes.json; `--check` fails on drift OR a skill/routine with no note (CI gate via fitness.js); regenerated on deploy by ship.js regenerateFileMap()
-│       ├── spike-task-map.js    ← (task 1003282, goal 1000072) the task-network-map spike harness: builds a ~1,357-task graph across a swept dependency density, lays it out for real (<redacted> + Barnes-Hut), counts what decides readability (isolated nodes, components, distinguishable marks / overplot, crossings, ink budget, payload) and renders PNGs with a hand-rolled encoder. Zero deps, no DB. `--from <tasks.json>` measures the REAL corpus instead of the model. Verdict: docs/research/task-network-map-readability.md
-│       ├── fitness.js           ← Path C (ADR 0062 §9, [#1225](https://example.com/builders#/task/1225)): architecture fitness functions — core↔host import boundary (zero grandfathered exceptions as of R52/#1191), CLAUDE.md budget + nested-doc presence (ADR 0061), no route bypasses rank checks (reuses route-rank-check), repo-map freshness. Enforced in CI via tests/fitness.mjs (the `unit` gate). `node scripts/gds/fitness.js`
-│       ├── ship.js              ← resolve claim as shipped, award credits (`/builder-ship`); also uploads a secret-scrubbed session digest to the corpus (6D.1, ADR 0027); runs the sandbox-first review gate before resolving when the checkout has a local game preview (#927, ADR 0046)
-│       ├── ship-visual.js       ← the OPTIONAL `--visual <image> [--visual-alt "…"]` leg of a ship (task 1003109): screens the file BEFORE the claim resolves (bad input costs no claim), uploads it AFTER (a failed picture never fails a ship)
-│       ├── package-core.js      ← package the core as a versioned, installable artifact + pin manifest (`bongos package-core`; R84, ADR 0100 §1, [#1688](https://example.com/builders#/task/1688)): isPublishable() selection + mirror redaction + fail-closed no-leak gate → dist/bongos-core-<version>.{tgz,manifest.json}; version = src/module-api CORE_VERSION. Recipe: docs/recipes/packaging-the-core.md
-│       ├── release-notes.js     ← what each core release brought in (task 1004218): generated at pack time from the ref's HISTORY into the package's release-notes.json (exact per-release ranges, 1 MiB bound; package-core redacts its prose like a doc), read back by the upgrade runner for a from→to range; home of the one merge-summary parser
-│       ├── surface.js         ← who the CLI output is FOR: agent (default) or terminal (task 1003680). The `bongos` dispatcher sets BONGOS_SURFACE=terminal when a person types a verb; the skills and the card hook run `node scripts/gds/<verb>.js` directly and keep the agent card byte-identical. Never inferred from isTTY — a session's stdout is not a TTY either, so sniffing would invert it. Helpers: action() (/builder-ship N vs bongos ship N), taskRef(), strong()/em()/code(), table() (markdown vs aligned columns). Guarded by tests/cli_surface.mjs
-│       ├── sandbox-stage.js     ← stage the working tree on the builder's local game preview for browser review before ship (`/builder-stage`; #927, ADR 0046; task 1056)
-│       ├── local-preview.js     ← builder CLI for the LOCAL sandbox: start/stop/status/restart/logs/url of the game-only preview at http://localhost:3100 (`npm run preview`; task 1056)
-│       ├── local-preview-lib.js ← core of the local sandbox launcher (detached `node src/preview-server.js`, pid/health/port mgmt); shared by local-preview.js + sandbox-stage.js (task 1056)
-│       ├── dev.js               ← `bongos dev`: one-command LOCAL launcher for a standalone instance (Postgres → createdb → migrate → server on the branding port → sign-in); up/stop/status (ADR 0149)
-│       ├── dev-lib.js           ← pure + injectable core of `bongos dev` (branding→port/db/env resolution, managed detached server pid/health); unit-tested by tests/dev_lib.mjs (ADR 0149)
-│       ├── session-transcript-build.js  ← PURE full-transcript builder (ADR 0051): prompts, replies, tool calls + results, every string scrubbed, size-capped
-│       ├── session-transcript-upload.js ← sends it (PUT /sessions/:sid/transcript) from the SessionEnd hook and the on-ship upload
-│       ├── session-eval.js      ← BFG session-inefficiency analysis engine (6D.3): classify turns, compute ceremony-vs-work, detect footguns, file systemic findings (ADR 0027)
-│       ├── linkify-refs.js      ← rewrite bare `#NNN` task refs across ALL docs → status-dashboard permalinks (stops GitHub's PR/issue autolinker mis-linking them); conservative classifier, token-free id list via /public/ref-ids; --apply / --check (CI gate: tests/linkify_check.mjs, in the required `unit` check) / --dry-run default ([#604](https://example.com/builders#/task/604), [#653](https://example.com/builders#/task/653)).
-│       ├── release.js           ← resolve claim as abandoned (`/builder-release`)
-│       ├── cost.js              ← log a cost entry (`/builder-cost`)
-│       ├── howto.js             ← the how-to guide for AI tools without hooks: `bongos howto moment <id>` prints + marks read the person's unread steps for a moment (task 1004635); `show` / `next` / `skip` / `reset` reopen the guide, continue it, turn it off or start it over (task 1004636)
-│       ├── me.js                ← current builder profile + leaderboard
-│       ├── goal.js              ← goal board CLI: `list` (rollup per goal) + `show <id>` (criteria, tasks, waits-on, next claimable)
-│       ├── seed-v3-tasks.js     ← V3 Planning Session #1: 80 net-new GDS-V3 tasks (V3.R01–V3.R89) + 10 idea_inbox promotions; idempotent on source_ref
-│       ├── backfill-cost.js     ← read art ledger → POST /api/bongos/cost (idempotent)
-│       ├── smoke-write.sh       ← write-path smoke (create→claim→ship round-trip)
-│       ├── backup-dropin-sweep.sh ← (task 1003930) control-plane sweep: retires the temporary task-1003925 backup drop-in from each project whose pinned core carries the fix (1.19.750+), proving one backup succeeds without it first; survey by default, `--apply` to act; re-run after each pin moves
-│       ├── stray-unit-sweep.sh  ← (task 1003939) control-plane sweep: the ledger's torn-down slugs that still have a service/backup unit loaded or on disk (a torn-down project holding memory outside the ADR 0285 count); survey by default, `--apply` disables, removes, reloads, reset-failed's; DB/dumps/checkout/Caddy left alone
-│       ├── address-park-sweep.sh ← (task 1003947) control-plane sweep: the ledger's torn-down rows that still have a `<slug>.caddy` block or a hostname not yet parked (rows torn down before task 1002897 taught teardown to do both); survey by default, `--apply` removes the snippets, reloads Caddy and parks each non-reserved hostname at 192.0.2.1 via the DNS hook; the reserved rule, zone and apex come from the installed core
-│       ├── smoke-gds.js         ← public-surface + 401-check smoke test (asserts /api/pms/* now 404s — removed in V3.R01-followup #308)
-│       ├── recall.js            ← `/recall` CLI: two-call progressive-disclosure search (summary → `--expand <id>`) over Bongos retrieval layer (ADR 0060); `node scripts/gds/recall.js <query>`
-│       ├── capture.js           ← file an idea_inbox row from the CLI (the ideas.capture kernel port); backs the "capture a tangent" flow across skills. Task 1002927 / R151 taught it the GRADES: `--full --fields-file f.json` files a Full Idea, `--spark` is capture-then-mark (two requests — the route refuses a pre-marked capture), and after a plain quick capture it OFFERS to develop further. That offer is TTY-gated (`--no-prompt` too): capture.js is run by agents with no terminal and reads its body from stdin, so an unguarded prompt would hang every non-interactive caller. Task 1003070 / R09 (goal 1000071) taught it capture-time ROUTING: `--goal N` sends goal_id, `--goal none` opts out explicitly, and with neither it defaults to the caller's active claim's goal, else prints a one-line R07 suggester hint
-│       ├── spark.js            ← (tasks 1002920 / R144 + 1002921 / R145 + 1002922 / R146) the whole spark handoff from the terminal: mark one of your OWN quick ideas as a Big Idea Spark (`--undo` withdraws it), `--list` is the SPARK QUEUE, `--template` prints the five Full Idea fields, `--develop <id> --fields-file <json>` is the PICKUP (any builder; author + developer both recorded). Author-only server-side for the mark (it is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
-│       ├── stale-worktrees.js   ← (task 1003365) the per-claim worktrees whose branch already landed on origin/main or is gone — pure git facts, no API; `--line` is the SessionStart probe, `/worktree-clean` walks the list through worktree.js remove
-│       ├── worktree-claim-guard.js ← (task 1002579) the PURE decision behind worktree-per-claim, enforced at claim time: claiming in the MAIN CHECKOUT is refused (escape hatch `--here` → loud warning), a linked worktree passes, an unclassifiable tree fails open. Stops the ship-time "the main checkout is on <branch>, not main" strand at its cause
-│       ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
-│       ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
-│       ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`
-│       ├── doc-comment-coverage.js ← ADR 0095 / task 1001654: the ADVISORY doc-comment nudge (fitness Check 28) — reports source files under src/·scripts/·modules/ that open with no module header. Never hard-fails: a doc-comment gate that blocks a ship buys filler prose, and making it blocking needs owner sign-off + its own ADR. CRLF-safe (unlike docs-entropy.js); an empty enumeration throws as a scan defect
-│       ├── copy-inventory.js  ← R01 of goal 1000074 (the artist's loop): the COPY REGISTRY — every user-facing string across the hall / status / landing surfaces, each row naming the render path that shows it (html-text · html-attr · js-markup · js-notice · js-text-assign) + a stable id that survives a move. Writes docs/copy-registry.json + docs/copy-inventory.md; `--check` fails on drift. Precision over recall: a JS literal with no render path is not listed
-│       ├── page-inventory.js  ← BV2.TW02 (task 1004314): the PAGE INVENTORY — surfaces from the loader's moduleWebSurfaces() over the ENABLED modules (no hardcoded list), pages from each surface's *.html, ids <surface>:<page> (page = body[data-page] else the file name). Writes docs/page-inventory.json + .md; `--check` (run by fitness.js + ship-check.js) fails on drift, a duplicate id or an empty surface
-│       ├── page-reader.js     ← BV2.TW04 (task 1004315, ADR 0341 D3): the PAGE READER — renders every page of docs/page-inventory.json in each state (hall-preview harness + ui-design kit stub, one browser, about two minutes for all 37) and writes docs/page-readings.json; `--check` (ship-check only, no browser) compares files_hash; `--stale` re-reads the stale pages
-│       ├── copy-apply.js     ← R03 of goal 1000074 (ADR 0233): lands a copy proposal as a REAL DIFF under a claim — the design half’s adapter.export() applied to text. Reads the fenced copy-proposal patch off a task (--task N; --dry-run, --patch-file), RE-DERIVES the string’s position by re-running copy-inventory’s own extractor over the working tree (the registry commits no offsets — they go stale, the id does not), re-injects the source’s own ${expr} into the proposal’s {…} holes, writes, regenerates the registry and verifies its own edit. Refuses BY NAME on target_gone / ambiguous_target / no_exact_span / placeholder_mismatch / path_outside_surface. The ONLY writer in the copy feature, and deliberately a command rather than a route
-│       ├── gen-role-responsibilities.js ← writes each role pack's written-responsibility block from src/role-responsibilities.js (task 1003732, ADR 0275). Targets come from the role registry, not a hardcoded list, so a renamed pack or a fourth craft needs no edit here; the block takes the pack's own line ending (the packs are CRLF on Windows, LF in CI). `--check` is the CI gate, run by role-pack-guard.js — never hand-edit a block
-│       ├── role-pack-guard.js   ← the fitness check over the role packs (task 1002990, ADR 0274): every registry entry resolves to a real pack, every pack fits its char budget, three crafts carry one, and each pack's responsibility block is current. HARD-fails because claim.js reads the registry fail-open, so a broken pack path is silent at runtime
-│       ├── gen-diagrams.js      ← generates the 5 onboarding diagrams (`.mmd`/`.svg`/`.png` + `assertions.json`) from templates in this file — never hand-edit a `.mmd`/assertions.json; runs on deploy
-│       ├── gen-api-docs.js      ← ADR 0109: generates `docs/api/openapi.json` + `docs/api-reference.md` from the live route files via `route-rank-check.js` introspection, so the API reference cannot drift from what the server actually mounts
-│       ├── architect-audit.js   ← MAS Phase 5 (ADR 0024): the Architect's bounded first-principles `--scope`/`--paths` audit CLI → `docs/audits/`
-│       ├── module.js            ← `bongos module new <key>` scaffolder + module CLI utilities (ADR 0083)
-│       ├── upgrade.js           ← `bongos upgrade` — bump the installed `@bongos/core` package version with doorway/coreVersion pre-checks (ADR 0108)
-│       └── newcomer-floor.js    ← deterministic on-claim replenisher for the evergreen newcomer chores (engineer/artist/ideator floor); no cron, restocks when one is claimed (task 1168)
+│   ├── bongos/                  ← Bongos CLI + bootstrap (moved from the old `gds/` folder in task 1004848 by `codemod-rename-scripts-gds.js`; renamed from `pms/` in V3.R01). Own nested map: scripts/bongos/CLAUDE.md.
+│   │   ├── cli-lib.js           ← shared: session token, apiCall(), formatters
+│   │   ├── discord-channels.js  ← Archon CLI: plan/apply the Discord channel layout via the API (ADR 0036, #727)
+│   │   ├── setup.js             ← one-time GitHub Device Flow → ~/.config/otb/gds-session.json
+│   │   ├── start.js             ← list claimable tasks + active claims (`/builder-start`)
+│   │   ├── claim.js             ← atomic POST /api/bongos/claims (`/builder-claim`); runs the worktree-per-claim guard (worktree-claim-guard.js) BEFORE the session check and the POST; prints the claim-time context pack incl. next-free ADR/migration numbers (V4.R26); printRoleLine() prints the claimed craft's one role line from discipline-modes.json and lands a ui claim's module-owned skills (the full pack pointer is injected by the Conductor from GET /me, task 1002992)
+│   │   ├── discipline-modes.json ← the ROLE REGISTRY read by claim.js: engineer/artist/ideator → their role pack under docs/packs/, module-contributed ui → the /design skill; absence of an entry = the default build-and-ship loop, fail-open at claim time — but scripts/bongos/role-pack-guard.js hard-fails CI if an entry names a pack that is not in the tree ([#1267](https://example.com/builders#/task/1267))
+│   │   ├── next-number.js       ← deterministic next-free ADR + migration number from origin/main ∪ local working tree; supersedes the drift-prone claim-time DB counter (V4.R26, [#964](https://example.com/builders#/task/964)). `node scripts/bongos/next-number.js [--json]`
+│   │   ├── gen-repo-map.js      ← Path B (ADR 0063, [#1224](https://example.com/builders#/task/1224)): zero-dep, deterministic symbol-skeleton generator → docs/repo-map.md + the generated factual block in each nested CLAUDE.md; ranks exported symbols by reference frequency. `--check` = CI gate; regenerated on deploy by ship.js regenerateRepoMap()
+│   │   ├── gen-file-map.js      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): generates the `.claude/skills/` + `.claude/scheduled-tasks/` sections of docs/file-map.md from disk; per-entry notes come from docs/file-map.notes.json; `--check` fails on drift OR a skill/routine with no note (CI gate via fitness.js); regenerated on deploy by ship.js regenerateFileMap()
+│   │   ├── fitness.js           ← Path C (ADR 0062 §9, [#1225](https://example.com/builders#/task/1225)): architecture fitness functions — core↔host import boundary (zero grandfathered exceptions as of R52/#1191), CLAUDE.md budget + nested-doc presence (ADR 0061), no route bypasses rank checks (reuses route-rank-check), repo-map freshness. Enforced in CI via tests/fitness.mjs (the `unit` gate). `node scripts/bongos/fitness.js`
+│   │   ├── ship.js              ← resolve claim as shipped, award credits (`/builder-ship`); also uploads a secret-scrubbed session digest to the corpus (6D.1, ADR 0027); runs the sandbox-first review gate before resolving when the checkout has a local game preview (#927, ADR 0046)
+│   │   ├── ship-visual.js       ← the OPTIONAL `--visual <image> [--visual-alt "…"]` leg of a ship (task 1003109): screens the file BEFORE the claim resolves (bad input costs no claim), uploads it AFTER (a failed picture never fails a ship)
+│   │   ├── package-core.js      ← package the core as a versioned, installable artifact + pin manifest (`bongos package-core`; R84, ADR 0100 §1, [#1688](https://example.com/builders#/task/1688)): isPublishable() selection + mirror redaction + fail-closed no-leak gate → dist/bongos-core-<version>.{tgz,manifest.json}; version = src/module-api CORE_VERSION. Recipe: docs/recipes/packaging-the-core.md
+│   │   ├── release-notes.js     ← what each core release brought in (task 1004218): generated at pack time from the ref's HISTORY into the package's release-notes.json (exact per-release ranges, 1 MiB bound; package-core redacts its prose like a doc), read back by the upgrade runner for a from→to range; home of the one merge-summary parser
+│   │   ├── surface.js         ← who the CLI output is FOR: agent (default) or terminal (task 1003680). The `bongos` dispatcher sets BONGOS_SURFACE=terminal when a person types a verb; the skills and the card hook run `node scripts/bongos/<verb>.js` directly and keep the agent card byte-identical. Never inferred from isTTY — a session's stdout is not a TTY either, so sniffing would invert it. Helpers: action() (/builder-ship N vs bongos ship N), taskRef(), strong()/em()/code(), table() (markdown vs aligned columns). Guarded by tests/cli_surface.mjs
+│   │   ├── sandbox-stage.js     ← stage the working tree on the builder's local game preview for browser review before ship (`/builder-stage`; #927, ADR 0046; task 1056)
+│   │   ├── local-preview.js     ← builder CLI for the LOCAL sandbox: start/stop/status/restart/logs/url of the game-only preview at http://localhost:3100 (`npm run preview`; task 1056)
+│   │   ├── local-preview-lib.js ← core of the local sandbox launcher (detached `node src/preview-server.js`, pid/health/port mgmt); shared by local-preview.js + sandbox-stage.js (task 1056)
+│   │   ├── dev.js               ← `bongos dev`: one-command LOCAL launcher for a standalone instance (Postgres → createdb → migrate → server on the branding port → sign-in); up/stop/status (ADR 0149)
+│   │   ├── dev-lib.js           ← pure + injectable core of `bongos dev` (branding→port/db/env resolution, managed detached server pid/health); unit-tested by tests/dev_lib.mjs (ADR 0149)
+│   │   ├── session-transcript-build.js  ← PURE full-transcript builder (ADR 0051): prompts, replies, tool calls + results, every string scrubbed, size-capped
+│   │   ├── session-transcript-upload.js ← sends it (PUT /sessions/:sid/transcript) from the SessionEnd hook and the on-ship upload
+│   │   ├── session-eval.js      ← BFG session-inefficiency analysis engine (6D.3): classify turns, compute ceremony-vs-work, detect footguns, file systemic findings (ADR 0027)
+│   │   ├── linkify-refs.js      ← rewrite bare `#NNN` task refs across ALL docs → status-dashboard permalinks (stops GitHub's PR/issue autolinker mis-linking them); conservative classifier, token-free id list via /public/ref-ids; --apply / --check (CI gate: tests/linkify_check.mjs, in the required `unit` check) / --dry-run default ([#604](https://example.com/builders#/task/604), [#653](https://example.com/builders#/task/653)).
+│   │   ├── release.js           ← resolve claim as abandoned (`/builder-release`)
+│   │   ├── cost.js              ← log a cost entry (`/builder-cost`)
+│   │   ├── howto.js             ← the how-to guide for AI tools without hooks: `bongos howto moment <id>` prints + marks read the person's unread steps for a moment (task 1004635); `show` / `next` / `skip` / `reset` reopen the guide, continue it, turn it off or start it over (task 1004636)
+│   │   ├── me.js                ← current builder profile + leaderboard
+│   │   ├── goal.js              ← goal board CLI: `list` (rollup per goal) + `show <id>` (criteria, tasks, waits-on, next claimable)
+│   │   ├── seed-v3-tasks.js     ← V3 Planning Session #1: 80 net-new GDS-V3 tasks (V3.R01–V3.R89) + 10 idea_inbox promotions; idempotent on source_ref
+│   │   ├── backfill-cost.js     ← read art ledger → POST /api/bongos/cost (idempotent)
+│   │   ├── smoke-write.sh       ← write-path smoke (create→claim→ship round-trip)
+│   │   ├── backup-dropin-sweep.sh ← (task 1003930) control-plane sweep: retires the temporary task-1003925 backup drop-in from each project whose pinned core carries the fix (1.19.750+), proving one backup succeeds without it first; survey by default, `--apply` to act; re-run after each pin moves
+│   │   ├── stray-unit-sweep.sh  ← (task 1003939) control-plane sweep: the ledger's torn-down slugs that still have a service/backup unit loaded or on disk (a torn-down project holding memory outside the ADR 0285 count); survey by default, `--apply` disables, removes, reloads, reset-failed's; DB/dumps/checkout/Caddy left alone
+│   │   ├── address-park-sweep.sh ← (task 1003947) control-plane sweep: the ledger's torn-down rows that still have a `<slug>.caddy` block or a hostname not yet parked (rows torn down before task 1002897 taught teardown to do both); survey by default, `--apply` removes the snippets, reloads Caddy and parks each non-reserved hostname at 192.0.2.1 via the DNS hook; the reserved rule, zone and apex come from the installed core
+│   │   ├── smoke-gds.js         ← public-surface + 401-check smoke test (asserts /api/pms/* now 404s — removed in V3.R01-followup #308)
+│   │   ├── recall.js            ← `/recall` CLI: two-call progressive-disclosure search (summary → `--expand <id>`) over Bongos retrieval layer (ADR 0060); `node scripts/bongos/recall.js <query>`
+│   │   ├── capture.js           ← file an idea_inbox row from the CLI (the ideas.capture kernel port); backs the "capture a tangent" flow across skills. Task 1002927 / R151 taught it the GRADES: `--full --fields-file f.json` files a Full Idea, `--spark` is capture-then-mark (two requests — the route refuses a pre-marked capture), and after a plain quick capture it OFFERS to develop further. That offer is TTY-gated (`--no-prompt` too): capture.js is run by agents with no terminal and reads its body from stdin, so an unguarded prompt would hang every non-interactive caller. Task 1003070 / R09 (goal 1000071) taught it capture-time ROUTING: `--goal N` sends goal_id, `--goal none` opts out explicitly, and with neither it defaults to the caller's active claim's goal, else prints a one-line R07 suggester hint
+│   │   ├── spark.js            ← (tasks 1002920 / R144 + 1002921 / R145 + 1002922 / R146) the whole spark handoff from the terminal: mark one of your OWN quick ideas as a Big Idea Spark (`--undo` withdraws it), `--list` is the SPARK QUEUE, `--template` prints the five Full Idea fields, `--develop <id> --fields-file <json>` is the PICKUP (any builder; author + developer both recorded). Author-only server-side for the mark (it is the consent); its own command because sparking acts on an EXISTING idea, which is why capture.js refuses grade='spark'
+│   │   ├── stale-worktrees.js   ← (task 1003365) the per-claim worktrees whose branch already landed on origin/main or is gone — pure git facts, no API; `--line` is the SessionStart probe, `/worktree-clean` walks the list through worktree.js remove
+│   │   ├── worktree-claim-guard.js ← (task 1002579) the PURE decision behind worktree-per-claim, enforced at claim time: claiming in the MAIN CHECKOUT is refused (escape hatch `--here` → loud warning), a linked worktree passes, an unclassifiable tree fails open. Stops the ship-time "the main checkout is on <branch>, not main" strand at its cause
+│   │   ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
+│   │   ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
+│   │   ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`
+│   │   ├── doc-comment-coverage.js ← ADR 0095 / task 1001654: the ADVISORY doc-comment nudge (fitness Check 28) — reports source files under src/·scripts/·modules/ that open with no module header. Never hard-fails: a doc-comment gate that blocks a ship buys filler prose, and making it blocking needs owner sign-off + its own ADR. CRLF-safe (unlike docs-entropy.js); an empty enumeration throws as a scan defect
+│   │   ├── copy-inventory.js  ← R01 of goal 1000074 (the artist's loop): the COPY REGISTRY — every user-facing string across the hall / status / landing surfaces, each row naming the render path that shows it (html-text · html-attr · js-markup · js-notice · js-text-assign) + a stable id that survives a move. Writes docs/copy-registry.json + docs/copy-inventory.md; `--check` fails on drift. Precision over recall: a JS literal with no render path is not listed
+│   │   ├── page-inventory.js  ← BV2.TW02 (task 1004314): the PAGE INVENTORY — surfaces from the loader's moduleWebSurfaces() over the ENABLED modules (no hardcoded list), pages from each surface's *.html, ids <surface>:<page> (page = body[data-page] else the file name). Writes docs/page-inventory.json + .md; `--check` (run by fitness.js + ship-check.js) fails on drift, a duplicate id or an empty surface
+│   │   ├── page-reader.js     ← BV2.TW04 (task 1004315, ADR 0341 D3): the PAGE READER — renders every page of docs/page-inventory.json in each state (hall-preview harness + ui-design kit stub, one browser, about two minutes for all 37) and writes docs/page-readings.json; `--check` (ship-check only, no browser) compares files_hash; `--stale` re-reads the stale pages
+│   │   ├── copy-apply.js     ← R03 of goal 1000074 (ADR 0233): lands a copy proposal as a REAL DIFF under a claim — the design half’s adapter.export() applied to text. Reads the fenced copy-proposal patch off a task (--task N; --dry-run, --patch-file), RE-DERIVES the string’s position by re-running copy-inventory’s own extractor over the working tree (the registry commits no offsets — they go stale, the id does not), re-injects the source’s own ${expr} into the proposal’s {…} holes, writes, regenerates the registry and verifies its own edit. Refuses BY NAME on target_gone / ambiguous_target / no_exact_span / placeholder_mismatch / path_outside_surface. The ONLY writer in the copy feature, and deliberately a command rather than a route
+│   │   ├── gen-role-responsibilities.js ← writes each role pack's written-responsibility block from src/role-responsibilities.js (task 1003732, ADR 0275). Targets come from the role registry, not a hardcoded list, so a renamed pack or a fourth craft needs no edit here; the block takes the pack's own line ending (the packs are CRLF on Windows, LF in CI). `--check` is the CI gate, run by role-pack-guard.js — never hand-edit a block
+│   │   ├── role-pack-guard.js   ← the fitness check over the role packs (task 1002990, ADR 0274): every registry entry resolves to a real pack, every pack fits its char budget, three crafts carry one, and each pack's responsibility block is current. HARD-fails because claim.js reads the registry fail-open, so a broken pack path is silent at runtime
+│   │   ├── gen-diagrams.js      ← generates the 5 onboarding diagrams (`.mmd`/`.svg`/`.png` + `assertions.json`) from templates in this file — never hand-edit a `.mmd`/assertions.json; runs on deploy
+│   │   ├── gen-api-docs.js      ← ADR 0109: generates `docs/api/openapi.json` + `docs/api-reference.md` (both gitignored since task 1004866; `api-artifacts.js` builds the set) from the live route files via `route-rank-check.js` introspection, so the API reference cannot drift from what the server actually mounts
+│   │   ├── architect-audit.js   ← MAS Phase 5 (ADR 0024): the Architect's bounded first-principles `--scope`/`--paths` audit CLI → `docs/audits/`
+│   │   ├── module.js            ← `bongos module new <key>` scaffolder + module CLI utilities (ADR 0083)
+│   │   ├── upgrade.js           ← `bongos upgrade` — bump the installed `@bongos/core` package version with doorway/coreVersion pre-checks (ADR 0108)
+│   │   └── newcomer-floor.js    ← deterministic on-claim replenisher for the evergreen newcomer chores (engineer/artist/ideator floor); no cron, restocks when one is claimed (task 1168)
+│   └── gds/                     ← @bongos-forwarder files only: one generated forwarder per executable at its old path, so installed units, cron and older hooks keep working (warns once; removed by task 1003706)
 │
 ├── src/
 │   ├── db.js                    ← GAME db helper: logEvent + player identity; sources its pool from src/bongos/pool.js (R52 carve-out, task 1191 — one pool, host→core)
 │   ├── branding.js              ← the branding contract resolver (env → config/branding.json → branding.neutral.json); single source for instance-identity strings + the configurable track set + db.database (ADR 0062 §3)
 │   ├── modules.js              ← back-compat facade over src/module-loader/loader.js; stable exports: isModuleEnabled/enabledModules/enabledDisciplines/clientModules/resolveModules; vanilla=all off (ADR 0062 §4; ADR 0083; docs/modules-contract.md)
 │   ├── module-api.js           ← THE PUBLISHED, SEMVER'D DOORWAY (ADR 0083): the ONLY core file a module may `require`. Re-exports kernel capabilities (auth gates, pool, db helpers, branding, seams, logger, CORE_VERSION). MINOR bump = additive export; MAJOR = breaking change; `bongos upgrade` pre-checks. The release ledger is NOT here — it moved to docs/module-api-changelog.md (ADR 0203); only the `const CORE_VERSION` literal lives in this file.
-│   ├── role-responsibilities.js ← the ONE source of each craft's written responsibility — the owner's verbatim sentences (fixed 2026-09-08, criterion `wa6-written-responsibilities`; task 1003732, ADR 0275). Three consumers and no second copy: the hall profile via clientModules() → window.__MODULES__, the grader via the module-api doorway, and the role packs via a GENERATED block (scripts/gds/gen-role-responsibilities.js, freshness gated by role-pack-guard.js). A KERNEL_FILES entry (modules.js reads it) and exempt from the no-module-keys scan, because the ideator's statement contains the English word "ideas". Do not paraphrase the statements
+│   ├── role-responsibilities.js ← the ONE source of each craft's written responsibility — the owner's verbatim sentences (fixed 2026-09-08, criterion `wa6-written-responsibilities`; task 1003732, ADR 0275). Three consumers and no second copy: the hall profile via clientModules() → window.__MODULES__, the grader via the module-api doorway, and the role packs via a GENERATED block (scripts/bongos/gen-role-responsibilities.js, freshness gated by role-pack-guard.js). A KERNEL_FILES entry (modules.js reads it) and exempt from the no-module-keys scan, because the ideator's statement contains the English word "ideas". Do not paraphrase the statements
 │   ├── module-seams.js         ← kernel seam registry (ADR 0083 / design 04§1): PORTS (registerProvider/resolve/resolveOptional — single-provider required capabilities) + EVENTS (emit/on — optional reactions, isolated errors). Modules cooperate through here, never by importing each other. Re-exported through module-api.js.
 │   ├── module-loader/          ← the loader that makes `modules/<key>/` discoverable (BV1.R38–R41)
 │   │   ├── loader.js           ← discover modules/*/module.json → validate manifest → coreVersion-check → enabled-filter → mount routes behind kernel auth → start pollers. <redacted> on empty modules/. Used by modules.js + routes.js.
@@ -247,7 +248,7 @@
 │   │   ├── goal-scope-check.js / hierarchy-config.js / module-scope-map.js ← goal-scope protected-path checks, the configurable work-hierarchy tiers, and the module→file-glob map
 │   │   ├── project-door.js      ← the project's COMPOSED join/apply door — visibility × join_grant × joinability → open | apply | invite_only | locked (BV1.R12 / task 1002331, ADR 0182 D6 + ADR 0247). PURE + kernel; published as api.projectJoinDoor() so the public POST /access-requests, the hall landing form, the CLI and the hub's join relay cannot answer one stranger differently — and since task 1003579 (ADR 0256) the SIGN-IN gate reads it too (openEnrollmentEnabled), which is why joinabilityMode() lives here rather than in auth-admission.js
 │   │   ├── artist-gate.js       ← the project's ARTIST GATE — off | advisory | strict (task 1003575, ADR 0241). PURE + kernel; published as api.artistGate so the lifecycle cascade ("file this review?") and the pin move ("does an open one hold?") resolve the same knob through one reader. It reads a STATE (is a cascade-filed artist review still open?), never a verdict, and what it can hold is the DEPLOY, never a builder's ship — that boundary is the whole reconciliation with ADR 0162
-│   │   ├── path-match.js / repo-info.js / metrics.js / uptime-poller.js ← touches[] overlap matcher, git-remote parser, Prometheus metrics endpoint, uptime poller
+│   │   ├── path-match.js / repo-info.js / metrics.js ← touches[] overlap matcher, git-remote parser, Prometheus metrics endpoint
 │   └── world/
 │       ├── terrain.js           ← (Phase D + ADR 0012, CJS): TERRAIN + OBJECT enums + BLOCKING_TERRAINS + BLOCKING_OBJECTS (server twin of public/game/world/terrain.js)
 │       └── map.js               ← (Phase D + ADR 0012): two-grid INITIAL_MAP {ground, objects}; isBlocked checks both layers (mirrors public/game/world/{terrain,map}.js)
@@ -371,14 +372,14 @@ tests/
 
 **Project skills** at `.claude/skills/` (drive Claude Code from inside a session):
 
-<!-- BEGIN GENERATED FILE-MAP .claude/skills/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
+<!-- BEGIN GENERATED FILE-MAP .claude/skills/ (scripts/bongos/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/skills/
 ├── ask-for-help/SKILL.md         ← /ask-for-help — turn 'ask <builder> to help with task N' into a filed collab help request (POST /help-requests): resolve the name to a builder id, one addressee (person XOR craft) and one context (task XOR goal), a what_is_stuck answerable without this session, then settle it; routes the near-neighbours (recommendation vs blocker) and states that the addressed read is a pull, not a push (task 1003826)
-├── backlog-review/SKILL.md       ← /backlog-review — HIDDEN (typed-only), step of /owner-review (task 1004471); daily walk of status=backlog, the pre-workable state a human must say go on: splits rows waiting on a PERSON (promote / kill / water) from rows waiting on a live dep TRIGGER (counted, never walked, migration 163) and surfaces rows stranded behind an abandoned dep; runs scripts/gds/backlog-review.js (task 1003746); Metic+
+├── backlog-review/SKILL.md       ← /backlog-review — HIDDEN (typed-only), step of /owner-review (task 1004471); daily walk of status=backlog, the pre-workable state a human must say go on: splits rows waiting on a PERSON (promote / kill / water) from rows waiting on a live dep TRIGGER (counted, never walked, migration 163) and surfaces rows stranded behind an abandoned dep; runs scripts/bongos/backlog-review.js (task 1003746); Metic+
 ├── blocker-review/SKILL.md       ← /blocker-review — daily review of open Bongos blockers (resolve / escalate / note); Metic+
 ├── blocker-solve/SKILL.md        ← /blocker-solve N — drive ONE blocker to done: do the doable parts, hand back owner-only steps, verify, auto-resolve (auto-promotes waiters); Metic+
-├── bongos-feedback/SKILL.md      ← /bongos-feedback — send feedback about Bongos itself upstream to the Cloud Bongos maintainers via `bongos feedback` (a bug lands as a backlog task in the maintenance goal, an idea in the hub inbox); backed by scripts/gds/feedback-send.js (task 1004462)
+├── bongos-feedback/SKILL.md      ← /bongos-feedback — send feedback about Bongos itself upstream to the Cloud Bongos maintainers via `bongos feedback` (a bug lands as a backlog task in the maintenance goal, an idea in the hub inbox); backed by scripts/bongos/feedback-send.js (task 1004462)
 ├── bug-triage/SKILL.md           ← /bug-triage — HIDDEN (typed-only), step of /owner-review (task 1004471); daily walk through open kind=bug tasks (batch-cluster near-dups, merge / won't-fix); the idea-triage counterpart built on the new tasks.merge primitive (task 1001478); Metic+
 ├── builder-backup/SKILL.md       ← /builder-backup — check DB backup status or trigger a fresh local dump before risky changes (migrations, destructive SQL); no SSH required
 ├── builder-claim/SKILL.md        ← /builder-claim N — atomic claim; prints the claim-time context pack + discipline playbook routing
@@ -389,7 +390,7 @@ tests/
 ├── builder-reauth/SKILL.md       ← /builder-reauth — refresh an expired Bongos CLI session the UI-first way (no terminal Device Flow)
 ├── builder-redteam/SKILL.md      ← /builder-redteam — file a red-team / vulnerability report (severity, target, repro) to /api/bongos/security
 ├── builder-release/SKILL.md      ← /builder-release — abandon a claim (task returns to ready, no credits)
-├── builder-sequence/SKILL.md     ← /builder-sequence N — walk a whole dependency chain from one kickoff (claim → build → ship → next), one claim at a time; halts and reports on migration/security/protected-path/thin-spec/judgement tasks (scripts/gds/sequence.js, task 1002484)
+├── builder-sequence/SKILL.md     ← /builder-sequence N — walk a whole dependency chain from one kickoff (claim → build → ship → next), one claim at a time; halts and reports on migration/security/protected-path/thin-spec/judgement tasks (scripts/bongos/sequence.js, task 1002484)
 ├── builder-setup/SKILL.md        ← /builder-setup — one-time GitHub Device Flow auth (Bongos); multi-builder-on-one-device gate
 ├── builder-ship/SKILL.md         ← /builder-ship — record + award credits (runs touches[] scanner; warns on drift; sandbox-first review gate for game-surface changes, ADR 0046)
 ├── builder-stage/SKILL.md        ← /builder-stage — stage work on the builder's own local sandbox preview (http://localhost:<port>) for browser review before shipping (#927, ADR 0046)
@@ -413,23 +414,23 @@ tests/
 ├── owner-review/SKILL.md         ← /owner-review — the LISTED front door to the four queues waiting on a person's decision: backlog → bugs → ideas → priorities, or one step by name or plain words; reads each step's hidden playbook by path (task 1004471); Metic+
 ├── planning-session/SKILL.md     ← /planning-session — run a structured planning session for an upcoming version (set criteria, brainstorm, rank, seed Bongos); Metic+
 ├── priority-session/SKILL.md     ← /priority-session — HIDDEN (typed-only), step of /owner-review (task 1004471); a trusted builder answers plain-speech questions; the answers reweight the idea_inbox + suggest what to build next
-├── read-session-export/SKILL.md  ← /read-session-export — read a Claude Code /export zip fast (prompts + thinking + tool calls → stdout); reads the existing export, doesn't make one. Backed by scripts/gds/read-session-export.js
+├── read-session-export/SKILL.md  ← /read-session-export — read a Claude Code /export zip fast (prompts + thinking + tool calls → stdout); reads the existing export, doesn't make one. Backed by scripts/bongos/read-session-export.js
 ├── recall/SKILL.md               ← /recall — one-call project-knowledge search across repo docs + DB prose (tasks, learnings, session logs)
 ├── scan-before-install/SKILL.md  ← /scan-before-install — quarantine-fetch a third-party repo/plugin, deterministic floor + tiered subagent panel over the scrubbed mirror, arithmetic verdict + honest-limits report to the builder's own config dir; prints install commands (pinned SHA only), never installs (goal 1000055)
 ├── session-handoff/SKILL.md      ← /session-handoff — compose a clean, paste-ready next-steps prompt to START a fresh session with (keeps context light by curating what carries forward); read-only, distinct from /builder-ship's ledger notes and /builder-end's close-out
-├── ship-check/SKILL.md           ← /ship-check — run every freshness + fitness check ship.js will run (repo-map/session-index/file-map/api-docs/copy-registry --check, linkify, skill-lint, fitness; --tests adds the DB-free lane; an ADVISORY render-fit row renders the changed pages via scripts/gds/render-check.js, ADR 0329) in ONE command before shipping, with the healing command per stale artifact (task 1003548; script scripts/gds/ship-check.js)
+├── ship-check/SKILL.md           ← /ship-check — run every freshness + fitness check ship.js will run (repo-map/session-index/file-map/api-docs/copy-registry --check, linkify, skill-lint, fitness; --tests adds the DB-free lane; an ADVISORY render-fit row renders the changed pages via scripts/bongos/render-check.js, ADR 0329) in ONE command before shipping, with the healing command per stale artifact (task 1003548; script scripts/bongos/ship-check.js)
 ├── status/SKILL.md               ← /status — what's the status of X / what's left for criterion Cn (read-only rollup)
 ├── strand-fix/SKILL.md           ← /strand-fix N — walk ONE stranded confirmed task (strand:no_branch_no_tip / land_not_proven — the shape the reconciler gave up on) to shipped: find the work (main commit / unpushed branch / conflicting PR / nowhere), do the one sanctioned move, verify the flip; also clears a 409 REBASE_REQUIRED claim gate (task 1003365)
-└── worktree-clean/SKILL.md       ← /worktree-clean — list the per-claim worktrees whose branch already landed on main (scripts/gds/stale-worktrees.js) and remove each through the junction-safe worktree.js remove; never raw git worktree remove (task 1003365)
+└── worktree-clean/SKILL.md       ← /worktree-clean — list the per-claim worktrees whose branch already landed on main (scripts/bongos/stale-worktrees.js) and remove each through the junction-safe worktree.js remove; never raw git worktree remove (task 1003365)
 ```
 <!-- END GENERATED FILE-MAP .claude/skills/ -->
 
 **Scheduled tasks** at `.claude/scheduled-tasks/` (autonomous routines that fire on a cron — user-level dir `~/.claude/scheduled-tasks/` is symlinked to this repo path so each routine is version-controlled and reviewable):
 
-<!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
+<!-- BEGIN GENERATED FILE-MAP .claude/scheduled-tasks/ (scripts/bongos/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/scheduled-tasks/
-├── artifact-audit/SKILL.md            ← weekly artifact audit (task 1003200): every task at shipped/confirmed/completed that DECLARES a code artifact is checked against main's commit messages AND the content of its tracked files — both, because a fix can land under another branch and be cited only in a comment (task 1003212). Anything unproven is filed as a blocker, deduped on the finding set. Scoped to ships on/after the ship-assurance gate (2026-08-19, ADR 0184), before which a DB-only ship recorded no declaration and silence proves nothing. FIRED BY .github/workflows/artifact-audit.yml, Mondays 06:23 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
+├── artifact-audit/SKILL.md            ← weekly artifact audit (task 1003200): every task at shipped/confirmed/completed that DECLARES a code artifact is checked against main's commit messages AND the content of its tracked files — both, because a fix can land under another branch and be cited only in a comment (task 1003212). Anything unproven is filed as a blocker, deduped on the finding set. Scoped to ships on/after the ship-assurance gate (2026-08-19, ADR 0184), before which a DB-only ship recorded no declaration and silence proves nothing. FIRED BY .github/workflows/artifact-audit.yml, Mondays 06:23 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/bongos/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
 ├── artifact-staleness/SKILL.md        ← freshness backstop for the gitignored deploy-generated navigation docs (task 1001930, ADR 0110 pt.5): docs/repo-map.md and docs/session-log-index.md are untracked, so no PR gate can see them and a broken deploy regen step leaves a stale or missing map with only a journald line as the alarm. Asks each artifact's own generator (--check-whole) whether it still matches the served commit, reports absent and stale separately, and posts findings to Discord #ship-news itself. INSTANCE-SIDE ONLY — a fresh CI clone legitimately lacks these files, so it declares no cadence and no workflow fires it; config/scheduled-routines.json records the intended daily cadence.
 ├── bfg/SKILL.md                       ← nightly BFG pass (MAS Phase 6, ADR 0026) — doc/memory hygiene + DB counter-vs-ledger drift (Part A), per-builder interaction scoring into transferable-practice suggestions (Part B), and the audited cross-builder memory write (Part C, OFF unless BFG_WRITE_ENABLED) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── bfg-session-eval/SKILL.md          ← nightly session-inefficiency evaluator (MAS Phase 6D, ADR 0027) — mines the session corpus for wasteful sessions and files the fixes as idea_inbox rows plus a docs/audits report (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
@@ -445,7 +446,7 @@ tests/
 ├── peer-vote-tally/SKILL.md           ← deterministic tally (`tally.js`) folding builder-on-builder peer votes at least 7 days old into karma_log rows (criterion C2) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── publish-watch/SKILL.md             ← daily publish-lane check (task 1003916): compares every version the release lane ANNOUNCED in its own release commits against what the registry actually holds, and posts anything announced-but-never-delivered to Discord #ship-news. Exists because the 2026-09-13 outage (8 failed runs, 3 hours) was found by a person reading the npm version list — a failed run is one red row nobody watches, and the next merge erases the evidence. Silent on a healthy day by design; exit 2 (could not read) is distinct from exit 1 (found one).
 ├── rank-roles-audit/SKILL.md          ← nightly deterministic check that every builder holds one of the four live ranks, so none silently resolves to zero permissions under the governance_002 backfill's INNER JOIN; detect-only, files one idea_inbox row and never repairs, and never fatal at boot (task 1002873; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── redteam-weekly/SKILL.md            ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0158 §2). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/gds/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
+├── redteam-weekly/SKILL.md            ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0158 §2). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/bongos/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
 ├── repo-simplify-sweep/SKILL.md       ← weekly repo-cleanliness janitor — runs repo-metrics, files dead-code findings to idea_inbox, and auto-fixes only the narrow safe class (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── security-review-weekly/SKILL.md    ← weekly security-state review — stale vulnerability_reports, ageing security-tagged tasks, recent high/critical dependency alerts; one Archon broadcast when anything is stale, silent otherwise (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── skill-usage-review/SKILL.md        ← nightly skill-usage feedback loop — aggregates 24h of skill invocations into friction findings filed as `[skill-friction]` idea_inbox rows (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
@@ -462,12 +463,12 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 .claude/hooks/
 ├── secret-gate.js            ← PreToolUse (Edit|Write|MultiEdit|NotebookEdit|Bash|PowerShell): cooperative, fail-OPEN block of secret-shaped content before it reaches the tree or a shell (task 1003125, ADR 0022)
 ├── run-node.sh               ← the node resolver every hook command runs through (task 1003548): $OTB_NODE_BIN → PATH → known install dirs → nvm; one actionable line + exit 1 when none is found. 1,055 hook runs had died silently with `node: command not found`
-├── edit-hints.js             ← PostToolUse (Edit|Write|MultiEdit): lints a saved SKILL.md's frontmatter (scripts/gds/skill-lint.js) and names the generator an edited path makes stale (copy-registry, repo-map blocks, file-map, openapi, §13 snippet) with its command (task 1003548)
+├── edit-hints.js             ← PostToolUse (Edit|Write|MultiEdit): lints a saved SKILL.md's frontmatter (scripts/bongos/skill-lint.js) and names the generator an edited path makes stale (copy-registry, repo-map blocks, file-map, openapi, §13 snippet) with its command (task 1003548)
 ├── git-guard.js              ← PreToolUse (Bash|PowerShell): same contract as secret-gate — blocks `git stash` (repo-global stack, learning 1000215), raw `git worktree remove` (follows the node_modules junction, task 1002809), `git push origin main` (PR-only) and `git branch -D`, each with its remedy; kill-switch BONGOS_GIT_GUARD_OFF=1 (task 1003365)
 ├── allow-rule-guard.js       ← PreToolUse (PowerShell): a command that names something the project's allow-list pre-approves ASKS unless it is PLAIN — command names, bare-word arguments, `$name` reads, literal strings, `; | && ||`, `2>&1` / `> $null`, and nothing else. An allowlist of shape, not a denylist of tricks (the denylist cut was evaded eleven ways in review). Never blocks, fails open, silent for commands nobody pre-allowed. Exists because the client ordering that already does this for PowerShell is undocumented (ADR 0304 amendment, task 1004014); kill-switch BONGOS_ALLOW_RULE_GUARD_OFF=1
 ├── _core-resolve.js          ← shared helper, not a hook: locates a core module/script across the monolith vs `node_modules/@cloudbongos/core` layouts; required by most hooks here and by four routine scripts under `.claude/scheduled-tasks/`
 ├── cascade-route.js          ← PreToolUse (Task|Agent): cheapest-sufficient start-model advisory for a subagent spawn (ADR 0024); inert unless OTB_AUTONOMY_ENABLED=1
-├── land-watch-card.js        ← UserPromptSubmit: delivers the SHIPPED banner once an async CI land completes (reads `scripts/gds/land-watch.js`)
+├── land-watch-card.js        ← UserPromptSubmit: delivers the SHIPPED banner once an async CI land completes (reads `scripts/bongos/land-watch.js`)
 ├── worktree-guard.js         ← PreToolUse (Edit|Write|MultiEdit|NotebookEdit): DENY a write that lands in the wrong git checkout (main/sibling worktree) when the session is in a worktree — hands back the corrected worktree path. Fail-open; opt-out OTB_ALLOW_CROSS_TREE=1 (V4.R13, [#951](https://example.com/builders#/task/951))
 ├── session-start.js          ← SessionStart: <redacted> .env.local into a fresh worktree, then chains onboarding-ship + rank-change greeting + memory pull
 ├── rank-change-greeting.js   ← promotion/demotion greeting (V3.R28 #249); spawned by session-start.js, also runnable standalone
@@ -484,7 +485,7 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 └── stop-refcheck.js          ← Stop: deterministic backstop that catches a bare `#NNN` Bongos ref in live session text (autolinks to a 404 GitHub issue) and asks for the clickable form (follow-on to task 929)
 ```
 
-> Restored in task 1003365 from the box's pre-re-seed checkout: the tree was lost when core was re-seeded to 1.18.0 (task 1003272 found the sound half; this brought back the rest). `stop-sound.js` was NOT restored — `scripts/gds/turn-end-sound.js` superseded it. Every hook above is wired in `.claude/settings.json`, which is the authority on what actually runs.
+> Restored in task 1003365 from the box's pre-re-seed checkout: the tree was lost when core was re-seeded to 1.18.0 (task 1003272 found the sound half; this brought back the rest). `stop-sound.js` was NOT restored — `scripts/bongos/turn-end-sound.js` superseded it. Every hook above is wired in `.claude/settings.json`, which is the authority on what actually runs.
 
 (Before [#671](https://example.com/builders#/task/671) these ran via `bash` shims — `sync-env-local.sh`, `conductor.sh`, `onboarding-ship-logs.sh`, `rank-change-greeting.sh`, `pull-memory.sh` — which failed on Windows without Git Bash. The Node entries above replaced them.)
 
@@ -492,11 +493,11 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 
 ```
 .claude/sounds/
-└── play.js                   ← the local player. playSound(<wavName>) — fire-and-forget, never throws, spawns the platform player detached (afplay / paplay / aplay / ffplay / PowerShell SoundPlayer); scales the WAV itself for the master volume because aplay and SoundPlayer have no volume flag. Reads the prefs mirror at instance-config.configPath('sound-prefs.json') with the pre-rename ~/.config/otb/ as fallback. Required (guarded) by scripts/gds/ship-state.js; runnable directly: `node .claude/sounds/play.js ship`
+└── play.js                   ← the local player. playSound(<wavName>) — fire-and-forget, never throws, spawns the platform player detached (afplay / paplay / aplay / ffplay / PowerShell SoundPlayer); scales the WAV itself for the master volume because aplay and SoundPlayer have no volume flag. Reads the prefs mirror at instance-config.configPath('sound-prefs.json') with the pre-rename ~/.config/otb/ as fallback. Required (guarded) by scripts/bongos/ship-state.js; runnable directly: `node .claude/sounds/play.js ship`
 ```
 
 The five base assets live ONCE, in `modules/hall-ui/public/` — served at `/builders/<name>.wav` for the Settings previews and read from the same directory by the player:
-`chime.wav` (pre-existing) plus `alert.wav`, `ship.wav`, `triumph.wav`, `fanfare.wav`, all generated by [`scripts/gds/gen-sounds.js`](../scripts/gds/gen-sounds.js) (`--check` verifies freshness; it never touches `chime.wav`).
+`chime.wav` (pre-existing) plus `alert.wav`, `ship.wav`, `triumph.wav`, `fanfare.wav`, all generated by [`scripts/bongos/gen-sounds.js`](../scripts/bongos/gen-sounds.js) (`--check` verifies freshness; it never touches `chime.wav`).
 
 **On the droplet (`REDACTED_IP`):**
 

package/docs/handoff-template.md

@@ -1,6 +1,6 @@
 # Session-end handoff — template
 
-> **Use this at the end of every working session.** Write your entry as its own dated file `docs/session-logs/YYYY-MM-DD-<slug>.md`. Soft cap: ~400 words per entry. The next Claude session — or the next human — should be able to pick up cold from this. **You never touch an index by hand:** the CLAUDE.md §13 recent-sessions snippet and the full `docs/session-log-index.md` are generated from the files and regenerate at ship (`scripts/gds/gen-session-index.js`).
+> **Use this at the end of every working session.** Write your entry as its own dated file `docs/session-logs/YYYY-MM-DD-<slug>.md`. Soft cap: ~400 words per entry. The next Claude session — or the next human — should be able to pick up cold from this. **You never touch an index by hand:** the CLAUDE.md §13 recent-sessions snippet and the full `docs/session-log-index.md` are generated from the files and regenerate at ship (`scripts/bongos/gen-session-index.js`).
 
 ---
 
@@ -26,12 +26,12 @@
 
 **New limitations / risks / blockers introduced this session:**
 - {new V1 architecture limitation → added to limitations/current-version.md}
-- {new ops gotcha → long-form recipe under docs/recipes/, OR short rule via `node scripts/gds/learning-capture.js`}
+- {new ops gotcha → long-form recipe under docs/recipes/, OR short rule via `node scripts/bongos/learning-capture.js`}
 - {new blocker for Lars → POST /api/bongos/blockers (the markdown file is frozen archive only)}
 - {(or "none")}
 
 **Generative ideas captured this session:**
-- {captured via `node scripts/gds/capture.js` (B2 idea_inbox), or "none". The markdown file is frozen archive only.}
+- {captured via `node scripts/bongos/capture.js` (B2 idea_inbox), or "none". The markdown file is frozen archive only.}
 
 **Decisions made (linked to ADRs):**
 - {NNNN — title} (or "none — no architectural decisions this session")
@@ -67,7 +67,7 @@ If even one of these is false, the claim is `[verified-smoke]` or `[implemented-
 
 If your change touched anything the onboarding diagrams describe — the **rank enum or which ranks are wired** (`requireRank`, `builders.rank` default, exit/assign paths), the **task-status set**, the **versions** (id/track/status), or the **complete-architecture** (the ADR 0024 memory chain + the machine → production ship flow) **/ example-karma** models (which now flip per the **shipped** status of their backing tasks) — then before shipping:
 
-- **All five diagrams are auto-generated** by `scripts/gds/gen-diagrams.js` — run it (`node scripts/gds/gen-diagrams.js`) and confirm the result looks right; **do not hand-edit any `.mmd`**. The mechanical three (`01-task-lifecycle`, `02-rank-ladder`, `05-versioning`) regenerate from migrations + the public version API. The conceptual two (`03-example-karma`, `04-architecture`) regenerate from the **authenticated** `/tasks/:id` status of their backing tasks (and 03's seeded-achievement count); if no session is present the generator skips them cleanly. Rendering produces both `.svg` (the pannable viewer asset) and `.png` (fallback).
+- **All five diagrams are auto-generated** by `scripts/bongos/gen-diagrams.js` — run it (`node scripts/bongos/gen-diagrams.js`) and confirm the result looks right; **do not hand-edit any `.mmd`**. The mechanical three (`01-task-lifecycle`, `02-rank-ladder`, `05-versioning`) regenerate from migrations + the public version API. The conceptual two (`03-example-karma`, `04-architecture`) regenerate from the **authenticated** `/tasks/:id` status of their backing tasks (and 03's seeded-achievement count); if no session is present the generator skips them cleanly. Rendering produces both `.svg` (the pannable viewer asset) and `.png` (fallback).
 - To change a diagram's **layout or wording**, edit the matching template function in `gen-diagrams.js` — not the `.mmd`. `assertions.json` is rebuilt by the generator in lockstep, so you don't hand-maintain it.
 
 The `diagram-drift` routine is a belt-and-braces backstop (it should find nothing once the generator has run), but the point is not to rely on it — running `gen-diagrams.js` is part of the change.