@bongos/core 1.21.175 → 1.21.176

package/docs/recipes/windows-builders.md

@@ -13,7 +13,7 @@ PowerShell-specific gotchas (stderr false-failures, BOM) live in
 
 ## api.js: MSYS path mangling is auto-repaired (no more `MSYS_NO_PATHCONV=1`)
 
-- **Was:** Git Bash rewrites a leading-slash argument before node sees it — `node scripts/gds/api.js GET /tasks/123`
+- **Was:** Git Bash rewrites a leading-slash argument before node sees it — `node scripts/bongos/api.js GET /tasks/123`
   arrived as `GET C:/Program Files/Git/tasks/123` and hit the usage error, unless every call was
   prefixed `MSYS_NO_PATHCONV=1`.
 - **Now (task 1002809):** `api.js` detects the mangled prefix via `EXEPATH` and strips it itself
@@ -21,7 +21,7 @@ PowerShell-specific gotchas (stderr false-failures, BOM) live in
   still type it out of habit.
 - **Still true:** judge success by the JSON + status line, not folklore about exit codes — and if
   you ever see the libuv `UV_HANDLE_CLOSING` assertion after the JSON printed, that teardown class
-  of bug is tracked in [scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md) (task 1002734's
+  of bug is tracked in [scripts/bongos/CLAUDE.md](../../scripts/bongos/CLAUDE.md) (task 1002734's
   `cliExit` rule).
 
 ## api.js: inline `--body` loses its quotes — use `--body-file`
@@ -30,9 +30,9 @@ Shells on Windows strip/re-split inline JSON quoting. The durable pattern for an
 
 ```bash
 # write the JSON with a real editor/tool, then:
-node scripts/gds/api.js POST /tasks --body-file C:/tmp/body.json
+node scripts/bongos/api.js POST /tasks --body-file C:/tmp/body.json
 # or pipe it (no temp file):
-node scripts/gds/api.js POST /claims --body-file - <<'EOF'
+node scripts/bongos/api.js POST /claims --body-file - <<'EOF'
 {"task_id": 123, "worktree_name": "task-123"}
 EOF
 ```
@@ -52,9 +52,9 @@ placements work on Windows:
   is where the destructive trap lives. Use the helper, never hand-rolled `mklink`:
 
   ```bash
-  node scripts/gds/worktree.js add <task-id> --outside     # worktree + junction, no shell quoting
-  node scripts/gds/worktree.js remove task-<id>            # unlinks the junction FIRST
-  node scripts/gds/worktree.js list                        # shows which worktrees carry junctions
+  node scripts/bongos/worktree.js add <task-id> --outside     # worktree + junction, no shell quoting
+  node scripts/bongos/worktree.js remove task-<id>            # unlinks the junction FIRST
+  node scripts/bongos/worktree.js list                        # shows which worktrees carry junctions
   ```
 
 ### ⚠ The trap (why the helper exists — task 1002809)
@@ -88,7 +88,7 @@ for 13 registered worktrees when it was finally measured). Worse, a husk is invi
 directory has left. Sweep them when the lock has cleared:
 
 ```bash
-node scripts/gds/worktree.js prune-husks
+node scripts/bongos/worktree.js prune-husks
 ```
 
 It deletes only an **empty** husk that the current process is not standing in and that has not
@@ -101,7 +101,7 @@ residue. `--force` waives the 24-hour rule and nothing else.
 
 A raw `node --test tests/*.mjs` has a **large stable failure baseline on Windows boxes** (mostly
 DB-backed tests with no local Postgres — the count drifts and is not worth recording). Run
-**`node scripts/gds/run-unit-tests.js`** instead: it is the DB-free gate CI actually runs, so its
+**`node scripts/bongos/run-unit-tests.js`** instead: it is the DB-free gate CI actually runs, so its
 result means something locally.
 
 **That gate's Windows baseline, re-measured for task 1003860 on 2026-09-12 in a deps-installed
@@ -123,7 +123,7 @@ below).
 hard-exits after serving HTTP can print a clean verdict and then die natively —
 `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)`, exit `127` or `3221226505`
 (`0xC0000409`). This is the `cliExit` class documented in
-[scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md). Timing decides it:
+[scripts/bongos/CLAUDE.md](../../scripts/bongos/CLAUDE.md). Timing decides it:
 `provisioning_github_app_routes` aborted 5 runs of 6, and in task 1003860 one unchanged tree
 answered 9 failures in one sweep and 8 in the next. A new failure could take a vanished one's
 place and the count would not move. `run-unit-tests.js` now recognises the abort by that stderr
@@ -158,7 +158,7 @@ branch, so a green branch can red the PR when a regenerated file goes stale agai
 
 When the pager closes the pipe mid-run, node dies on EPIPE and the land chain aborts silently —
 the task strands at `confirmed` (hit on task 1001860). Run it unpiped or `> file`; a stranded
-confirmed task re-lands by re-running `node scripts/gds/ship.js <id>` (resume is idempotent).
+confirmed task re-lands by re-running `node scripts/bongos/ship.js <id>` (resume is idempotent).
 
 ## ship.js: a failed post-land ship call may be a success — now auto-verified
 
@@ -179,17 +179,17 @@ you see a ship-call failure from older tooling, check `GET /tasks/<id>` before r
 
 - **Symptom:** `This session is isolated in the worktree … but this command is too complex to verify that it stays inside` (25×), `… changes directory to the shared checkout` (7×), `… runs export PATH= with a value every later program …` (6×), `… runs a command whose name is computed at runtime` (3×). 1,931 of 2,370 Bash calls in the scan were compound.
 - **Root cause:** a session that entered a worktree (EnterWorktree) has Claude Code checking that each Bash command stays inside it. A chain of `export … ; cd … && …` defeats the checker, so it refuses the whole command.
-- **Fix:** one purpose per command; use paths relative to the worktree (the Bash tool's cwd is the worktree); no `export PATH=` prefix once node is on PATH; never `cd` into the main checkout from a worktree session (learning 2026-08-29: `../../../` checks and dirties the MAIN checkout — run the worktree's own `scripts/gds/` copy).
+- **Fix:** one purpose per command; use paths relative to the worktree (the Bash tool's cwd is the worktree); no `export PATH=` prefix once node is on PATH; never `cd` into the main checkout from a worktree session (learning 2026-08-29: `../../../` checks and dirties the MAIN checkout — run the worktree's own `scripts/bongos/` copy).
 
 ## `git fetch` / `git push` / `ls-remote` fail here BY DESIGN
 
-- This machine holds no GitHub push credential (ADR 0031 §6 / ADR 0055). The scan found 22 `git fetch` attempts in three days, all wasted. Landing is server-mediated: `/builder-ship` uploads a bundle and the server pushes, opens the PR and lands it. To see whether work reached GitHub use `GET /api/bongos/tasks/:id/publish-status`, never a raw git probe. To base a new worktree on fresh main, `node scripts/gds/worktree.js add <task-id> --base origin/main` (worktree.js fetches through the sanctioned path).
+- This machine holds no GitHub push credential (ADR 0031 §6 / ADR 0055). The scan found 22 `git fetch` attempts in three days, all wasted. Landing is server-mediated: `/builder-ship` uploads a bundle and the server pushes, opens the PR and lands it. To see whether work reached GitHub use `GET /api/bongos/tasks/:id/publish-status`, never a raw git probe. To base a new worktree on fresh main, `node scripts/bongos/worktree.js add <task-id> --base origin/main` (worktree.js fetches through the sanctioned path).
 
 ## A worktree without `node_modules` fails 300+ tests — and the count is not the signal
 
 - **Symptom:** `Cannot find module 'pg'` / `'express'`; `npm test` reports ~300 FAILED; 9 `npm install`s and 2 dead junctions in three days of transcripts.
-- **What the tooling does now:** SessionStart prints one `[otb] node_modules is missing …` line (from `scripts/gds/preflight.js`'s check) when neither the worktree nor the main checkout has it. Install ONCE in the main checkout (`npm ci`); inside-repo worktrees resolve from it.
-- **Rule:** when comparing a local run against CI, compare failing test NAMES against an untouched checkout of `origin/main`, never counts — a ~25-failure Windows baseline has masked real regressions (session logs 2026-08-14, 2026-08-19). `node scripts/gds/ship-check.js --tests` prints the names.
+- **What the tooling does now:** SessionStart prints one `[otb] node_modules is missing …` line (from `scripts/bongos/preflight.js`'s check) when neither the worktree nor the main checkout has it. Install ONCE in the main checkout (`npm ci`); inside-repo worktrees resolve from it.
+- **Rule:** when comparing a local run against CI, compare failing test NAMES against an untouched checkout of `origin/main`, never counts — a ~25-failure Windows baseline has masked real regressions (session logs 2026-08-14, 2026-08-19). `node scripts/bongos/ship-check.js --tests` prints the names.
 - **The "a test can't find its dep inside a worktree" family is CLOSED — do not go looking for a worktree bootstrap to repair.** It had exactly one member, `tests/logger.mjs`, which required pino by an absolute `<root>/node_modules/pino`; task 1003616 changed it to a bare specifier with a `require.resolve` skip guard on 2026-09-07. Re-verified in task 1003529 from a fresh `.claude/worktrees/` worktree carrying no `node_modules` of its own: `logger` passes, and the whole gate resolves `pino`/`express` by walk-up to the main checkout. **The bug was never the missing `node_modules`** — an inside-repo worktree is not supposed to have one — it was the absolute path that stopped node walking up. A dep failure here means you are outside the repo (use `worktree.js add --outside`, which makes the junction) or the main checkout was never installed. Task 1003519 was a duplicate row for this same bug and is merged into 1003616.
 
 ## `tests/git_merge_regen.mjs` — when it reds, suspect `.gitattributes` first, not Windows
@@ -198,7 +198,7 @@ This test is the consistency gate between **two** sources that must agree, and i
 caught a real bug during task 1003548, so read its assertion before blaming the platform:
 
 - **Every path declared `merge=otb-regen` in `.gitattributes` must be in `REGENERABLE`**
-  (`scripts/gds/git-merge-regen.js`, derived from `gen-repo-map.NESTED_DIRS` + the whole-file set).
+  (`scripts/bongos/git-merge-regen.js`, derived from `gen-repo-map.NESTED_DIRS` + the whole-file set).
   Drop a doc from the generators and its `.gitattributes` line has to come out in the same commit —
   otherwise a merge on that path routes through a driver that cannot regenerate it. The failure reads
   `.gitattributes declares merge=otb-regen for <path> but REGENERABLE … does not know it`.
@@ -212,10 +212,10 @@ caught a real bug during task 1003548, so read its assertion before blaming the
 
 ## CRLF: a multi-line find silently misses, and a whole-file diff is usually line endings
 
-- Several hall files (`roster.css`, `roster.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/gds/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
+- Several hall files (`roster.css`, `roster.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/bongos/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
 - A `git diff --stat` that touches every line of a file you barely edited is an EOL flip — check with `git diff --stat --ignore-cr-at-eol`, and restore the original EOL before committing.
 - **`copy-inventory.js --check` no longer reds on line endings alone** (task 1003619). It used to: the generator emits LF and the check byte-compared that against a CRLF worktree file, so `/ship-check` showed one permanent red line on every Windows checkout while the committed content was already correct — and a builder who "fixed" it committed a whole-file CRLF diff. `docs/copy-inventory.md` is now pinned `text eol=lf` in `.gitattributes` (its `.json` sibling always was, via `*.json`), and the check compares EOL-blind so an already-CRLF worktree passes without a re-clone. If it reports STALE now, the content really is stale — regenerate, don't reach for `--ignore-cr-at-eol`. Since task 1003981 `*.md` IS pinned repo-wide (`*.md text eol=lf`), so a fresh clone gets LF markdown everywhere and a markdown reader no longer has to be CRLF-aware to be correct. An EXISTING Windows checkout keeps its CRLF copies until git rewrites them — the clean filter still normalises to LF on add, so `git status` stays quiet and nothing is broken; to convert in place, `git rm --cached -r . && git reset --hard`.
-- **A freshness check compares CONTENT, so route it through `sameContent()`** (`scripts/gds/gen-freshness.js`) rather than `===` on file bytes. A pin is the wrong lever on its own: regenerating never clears a byte-wise red, because the write lands LF and git converts it back on the next checkout. `tests/gen_freshness.mjs` enforces this for the four gated generators; `tests/api_client.mjs` was outside that guard and reported the client STALE forever on Windows until task 1003529 (`index.d.ts` and `README.md` are the two generated client files with no `eol=lf` pin).
+- **A freshness check compares CONTENT, so route it through `sameContent()`** (`scripts/bongos/gen-freshness.js`) rather than `===` on file bytes. A pin is the wrong lever on its own: regenerating never clears a byte-wise red, because the write lands LF and git converts it back on the next checkout. `tests/gen_freshness.mjs` enforces this for the four gated generators; `tests/api_client.mjs` was outside that guard and reported the client STALE forever on Windows until task 1003529 (`index.d.ts` and `README.md` are the two generated client files with no `eol=lf` pin).
 
 ## Four Windows traps that make a test lie — all four found in one pass (task 1003529)
 

package/docs/research/llm-model-agnostic-and-cheaper-grader.md

@@ -66,11 +66,11 @@ Model identity is a **substring-on-the-id** convention repeated in four places.
 
 Not everything goes through `runSubagent`. A `grep` for direct `claude` spawns / `CLAUDE_BIN` turned up these additional sites — each is a *second* spawn shape to bring under the port (or to leave as-is if it stays Claude-only): ✅
 
-- **`scripts/gds/architect-audit.js`** — *reuses* `grader.runSubagentCached` (so it inherits the port for free) but hard-codes `ARCHITECT_MODEL = 'claude-opus-4-7'` (≈ line 55). One constant to parameterize.
-- **`scripts/gds/run-routine.js`** — the scheduled-routine runner; `judgment`/`hybrid` modes "spawn `claude -p`" over a skill body (≈ lines 11–14, 140). Its own spawn helper.
+- **`scripts/bongos/architect-audit.js`** — *reuses* `grader.runSubagentCached` (so it inherits the port for free) but hard-codes `ARCHITECT_MODEL = 'claude-opus-4-7'` (≈ line 55). One constant to parameterize.
+- **`scripts/bongos/run-routine.js`** — the scheduled-routine runner; `judgment`/`hybrid` modes "spawn `claude -p`" over a skill body (≈ lines 11–14, 140). Its own spawn helper.
 - **`modules/autonomy/pollers/routine-timers.js`** — drives routine spawns (autonomy module).
-- **`scripts/gds/onboarding-analyze.js`**, **`scripts/gds/newcomer-floor.js`**, **`scripts/gds/doctor.js`** — each references the `claude` binary directly (onboarding analysis, newcomer-floor classification, env doctor checks).
-- **`scripts/gds/session-cost.js`** — does **not** spawn; it *parses* Claude Code's transcript layout: `~/.claude/projects/<encoded-cwd>/*.jsonl`, per-turn `message.usage` token blocks, and excludes grader-worker subprocess transcripts (≈ lines 32–86, `priceTranscript` ≈ line 140). This is a coupling to the **Claude Code interactive harness's on-disk format**, not to the model — see §2.4.
+- **`scripts/bongos/onboarding-analyze.js`**, **`scripts/bongos/newcomer-floor.js`**, **`scripts/bongos/doctor.js`** — each references the `claude` binary directly (onboarding analysis, newcomer-floor classification, env doctor checks).
+- **`scripts/bongos/session-cost.js`** — does **not** spawn; it *parses* Claude Code's transcript layout: `~/.claude/projects/<encoded-cwd>/*.jsonl`, per-turn `message.usage` token blocks, and excludes grader-worker subprocess transcripts (≈ lines 32–86, `priceTranscript` ≈ line 140). This is a coupling to the **Claude Code interactive harness's on-disk format**, not to the model — see §2.4.
 
 ### 2.4 The interactive session is coupled to the harness, not just the model
 
@@ -78,7 +78,7 @@ The main builder session runs inside the **Claude Code CLI harness** itself, whi
 
 - **`session-cost.js`** reads the harness's JSONL transcript format and prices it with `llm-pricing` (the interactive session has no `total_cost_usd` envelope, only token counts — that's the whole reason `llm-pricing.js` exists, per its header). ✅
 - The **subagent model-routing policy** lives in `CLAUDE.md §2` as prose ("main session = Opus 4.8 (1M); subagents set `model` explicitly; Haiku for plumbing, Opus for everything else"). It is a *human/agent instruction*, not code — so "model-agnostic" at the interactive tier is partly a **docs/policy** change, not only a code change. ⚠️
-- `scripts/gds/cli-lib.js`, `setup.js`, `me.js`, `auth.js`, `db.js`, `db-kernel.js` matched the grep but on inspection reference Claude only in **comments / `~/.config/otb/` paths / the `claude`-CLI auth story**, not in a model call. Low-priority for a provider port; relevant only if the platform ever wants the *interactive* tier on a non-Claude harness (out of scope for ADR 0089, which targets the **grader/platform** calls, not the human's editor). ✅🔧
+- `scripts/bongos/cli-lib.js`, `setup.js`, `me.js`, `auth.js`, `db.js`, `db-kernel.js` matched the grep but on inspection reference Claude only in **comments / `~/.config/otb/` paths / the `claude`-CLI auth story**, not in a model call. Low-priority for a provider port; relevant only if the platform ever wants the *interactive* tier on a non-Claude harness (out of scope for ADR 0089, which targets the **grader/platform** calls, not the human's editor). ✅🔧
 
 ### 2.5 What is NOT coupled (already abstracted, leave alone)
 
@@ -222,6 +222,6 @@ Per the task's instruction, this doc lists recommended follow-ups rather than cr
 
 ## 9. Sources
 
-- The live repo, read 2026-06-28: `modules/grading/grader.js`, `modules/grading/grader-workers/index.js`, `modules/grading/CLAUDE.md`, `src/bongos/llm-pricing.js`, `src/bongos/cascade-dispatch.js`, `modules/builder-settings/skill-prefs.js`, `scripts/gds/ci-grade.js`, `scripts/gds/architect-audit.js`, `scripts/gds/session-cost.js`, `scripts/gds/run-routine.js`.
+- The live repo, read 2026-06-28: `modules/grading/grader.js`, `modules/grading/grader-workers/index.js`, `modules/grading/CLAUDE.md`, `src/bongos/llm-pricing.js`, `src/bongos/cascade-dispatch.js`, `modules/builder-settings/skill-prefs.js`, `scripts/bongos/ci-grade.js`, `scripts/bongos/architect-audit.js`, `scripts/bongos/session-cost.js`, `scripts/bongos/run-routine.js`.
 - [ADR 0089 — Modular, multi-model adversarial grader](../adr/0089-modular-multi-model-adversarial-grader.md) (the accepted direction this spike grounds; includes the external literature + market sweep — self-preference, PoLL, *Nine Judges*, open-weight model licenses, hosting math).
 - [ADR 0028 — Honest LLM spend accounting](../adr/0028-honest-llm-spend-accounting.md), [ADR 0077 — Content-addressed LLM cache](../adr/0077-content-addressed-llm-cache.md), [ADR 0080 — LLM cache API transport & trust model](../adr/0080-llm-cache-api-transport-and-trust-model.md), [ADR 0062 — Instance-model decoupling](../adr/0062-medusa-instance-model-decoupling.md), [ADR 0021 — Per-builder skill model preferences](../adr/0021-per-builder-skill-model-preferences.md).

package/docs/research/task-network-map-readability.md

@@ -2,7 +2,7 @@
 
 - **Task:** [1003282](https://cloudbongos.com/builders#/task/1003282) · goal 1000072 (Human legibility)
 - **Date:** 2026-08-28
-- **Harness:** [`scripts/gds/spike-task-map.js`](../../scripts/gds/spike-task-map.js) — no dependencies, no network, no DB. Re-run with `node scripts/gds/spike-task-map.js`.
+- **Harness:** `scripts/bongos/spike-task-map.js` — no dependencies, no network, no DB. Deleted once this verdict was written ([task 1004857](https://cloudbongos.com/builders#/task/1004857)); recover it with `git show b8c20cba2:scripts/bongos/spike-task-map.js > spike-task-map.js` to re-run it.
 - **Figures:** [`docs/research/task-network-map/`](task-network-map/) — rendered by the harness, not drawn by hand.
 
 ## The answer
@@ -35,7 +35,7 @@ not change the verdict. Point the harness at a real dump to replace every number
 with a measured one:
 
 ```
-node scripts/gds/spike-task-map.js --from tasks.json     # a GET /tasks?include=deps dump
+node spike-task-map.js --from tasks.json     # a GET /tasks?include=deps dump (harness recovered from history, see above)
 ```
 
 Four views of the same corpus, all at 1280×720 (a laptop viewport with the hall's chrome
@@ -179,7 +179,7 @@ of new map to build is none.**
   is what makes the verdict robust — every conclusion above holds from p=2% to p=40% —
   but the *specific* numbers are model output, not observation. Re-run with `--from`.
 - **The goal count (40) and the 85% within-goal edge preference are modelled**, from the
-  repo's own record of ~38 open goals on BONGOS-V1 (`scripts/gds/goal-names.js`) and from
+  repo's own record of ~38 open goals on BONGOS-V1 (`scripts/bongos/goal-names.js`) and from
   how dependencies are declared in practice. A very different real distribution would
   change C's edge count — not A's isolation, which is bounded by p by construction.
 - **`marks` is a proxy for legibility, not legibility.** It counts what is

package/migrations/core_278_builder_tester_tag.sql

@@ -0,0 +1,18 @@
+-- core_278 a builder account can carry the tester tag
+-- Applied under task 1004845.
+--
+-- WHY. Some accounts exist to try the product, not to build it (the dormant-accounts
+-- sweep of 2026-10-23 found five). Merging or archiving them loses something the owner
+-- wants kept, and leaving them untouched fills the leaderboard and the directory with
+-- people who are not really there. The tag keeps the account whole and takes it out of
+-- the public lists.
+--
+-- SHAPE. One boolean, false by default, NOT NULL: every existing builder is an ordinary
+-- builder and an older release that never names the column keeps inserting as before.
+-- It is not system_role: that column marks machine principals, with its own CHECK and
+-- no API writer, and a human tester is neither.
+
+ALTER TABLE builders ADD COLUMN IF NOT EXISTS is_tester boolean NOT NULL DEFAULT false;
+
+INSERT INTO schema_migrations (version) VALUES ('core_278_builder_tester_tag')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/core_279_bongos_shipper_new_scripts_path.sql

@@ -0,0 +1,13 @@
+-- core_279_bongos_shipper_new_scripts_path.sql — the shipper badge names the builder
+-- CLI's new folder (task 1004848).
+--
+-- scripts/gds/ moved to scripts/bongos/ (criterion C3 of goal 1000073). The badge's
+-- description is what the hall and the locked-progress hint show a builder, so it
+-- names the folder they will actually touch. The evaluator in
+-- modules/economy/achievements.js matches BOTH spellings — tasks shipped before the
+-- move recorded the old path in touches[] and still count — so only the words change.
+-- The id `gds-shipper` stays: builder_achievements rows key on it.
+
+UPDATE achievements
+   SET description = 'Ship a task whose touches[] include src/bongos/ or scripts/bongos/.'
+ WHERE id = 'gds-shipper';

package/modules/agents/lib/answer-hold.js

@@ -27,7 +27,7 @@
 //     agent read sitting in memory for no one.
 //
 // A caller that needs the answer durably passes `--out` to
-// `scripts/gds/agent-invoke.js` and owns the file. That is the deliberate split:
+// `scripts/bongos/agent-invoke.js` and owns the file. That is the deliberate split:
 // the CLI delivers to the operator's disk, the route delivers to the operator's
 // next request, and neither writes agent prose into a table.
 //

package/modules/agents/lib/gate.js

@@ -4,7 +4,7 @@
 // not, what does the ledger row say (task 1002493).
 //
 // WHY IT IS ITS OWN FILE. Two callers ask the same question from opposite sides
-// of the trust boundary: `scripts/gds/agent-invoke.js` (task 1002491) runs where
+// of the trust boundary: `scripts/bongos/agent-invoke.js` (task 1002491) runs where
 // the operator is, and `POST /agents/:name/invoke` runs on the server. A gate
 // with two implementations is a gate with two behaviours the day one of them is
 // edited — and the interesting half of this answer is the REASON, which is the

package/modules/agents/lib/validate.js

@@ -54,7 +54,7 @@ const TRIGGER_TYPES = Object.freeze(['event', 'on-demand', 'cron']);
 
 // The cadence vocabulary a 'cron' trigger may declare, in trigger_spec.cadence.
 //
-// DUPLICATED FROM scripts/gds/routine-schedule.js ON PURPOSE, for the reason
+// DUPLICATED FROM scripts/bongos/routine-schedule.js ON PURPOSE, for the reason
 // RANK_ORDER below is duplicated: a module may require only src/module-api.js
 // (ADR 0083), so it cannot reach into scripts/. The two copies are kept honest by
 // tests/agents_cron_trigger.mjs, which reads routine-schedule.js's own CADENCES +

package/modules/autonomy/gauge.js

@@ -24,7 +24,7 @@
 // failure a missing file looks most like.
 //
 // PURE. No I/O, no clock of its own — `now` is always injected. The readers that
-// touch disk live in the CLI (scripts/gds/autonomy-gauge.js), the same split
+// touch disk live in the CLI (scripts/bongos/autonomy-gauge.js), the same split
 // autonomy-gate.js draws between `decide` and `gatherSignals`.
 
 const WEEK_SECONDS = 7 * 24 * 60 * 60;

package/modules/autonomy/governor-docket.js

@@ -9,7 +9,7 @@
 // only when it needs a governor: the switch is off, or it is on with no goal
 // allowed (nothing can build either way). And the "money" reading: the one
 // budget this project actually records is the unattended-spend ceiling the
-// autonomy gate brakes on (scripts/gds/autonomy-gate.js `ceilingUsd`), against
+// autonomy gate brakes on (scripts/bongos/autonomy-gate.js `ceilingUsd`), against
 // the month's unattended spend (economy's `autonomousApiSpendMtd`, through the
 // `reward` port). So "money left" is honestly "what unattended building may still
 // spend this month" — the project has no wider budget to count down from, and the
@@ -20,7 +20,7 @@
 
 const api = require('../../src/module-api');
 const db = require('./db');
-const autonomyGate = require('../../scripts/gds/autonomy-gate');
+const autonomyGate = require('../../scripts/bongos/autonomy-gate');
 const runnerHealth = require('./runner-health');
 
 const POINT = 'governor.docket';

package/modules/autonomy/pollers/routine-timers.js

@@ -17,13 +17,13 @@
 //
 // WHY THIS EXISTS
 // ADR 0078 demoted peer-vote-tally to `mode: deterministic` and built an EXTERNAL
-// dispatcher (scripts/gds/run-routine.js) the operator was meant to wire into
+// dispatcher (scripts/bongos/run-routine.js) the operator was meant to wire into
 // cron. But nothing was ever durably scheduled — every scheduler layer (the
 // local app tasks, the session cron, the claude.ai cloud routines) was empty, so
 // the realized run count was ZERO. A deterministic routine that never fires saves
 // nothing. The routine's real work is server-side and needs no model, so the
 // durable realization is an in-process timer inside the always-on Node process —
-// the SAME pattern as the publish-reconciler / uptime-poller. No external cron, no
+// the SAME pattern as the publish-reconciler. No external cron, no
 // `claude -p`, no token spend.
 //
 //   - peer-vote-tally (weekly): folds matured peer votes into karma. The work is
@@ -39,7 +39,7 @@
 //
 // (diagram-drift was intentionally NOT made a timer: all five onboarding diagrams
 // already auto-regenerate from live facts on every deploy, so a daily drift check
-// is near-redundant; the manual `node scripts/gds/run-routine.js diagram-drift`
+// is near-redundant; the manual `node scripts/bongos/run-routine.js diagram-drift`
 // remains for on-demand use. See the ADR 0078 amendment.)
 //
 // Mirrors the publish-reconciler contract: env-overridable interval, an UNREF'd

package/modules/autonomy/routes/autonomy.js

@@ -13,7 +13,7 @@
 // accident), and it is Archon-gated, because the answer decides autonomous spend.
 //
 // The decision logic is not here — it lives in the gate CLI
-// `scripts/gds/autonomy-gate.js`, deliberately OUTSIDE the module boundary, since
+// `scripts/bongos/autonomy-gate.js`, deliberately OUTSIDE the module boundary, since
 // gathering signals means reading ideas/economy/lifecycle, which a modules/ file
 // may not do. This route is a thin wrapper over its `precheck`.
 
@@ -26,7 +26,7 @@ const auth = api;
 // but stays a command; its gatherSignals reaches the ideas/economy/lifecycle reads
 // from OUTSIDE the kernel boundary, which a modules/ file may not do). scripts/ is
 // neither core internals nor a sibling module, so importing it here is allowed.
-const autonomyGate = require('../../../scripts/gds/autonomy-gate');
+const autonomyGate = require('../../../scripts/bongos/autonomy-gate');
 const db = require('../db');
 const fence = require('../fence');
 const runnerHealth = require('../runner-health');
@@ -37,7 +37,7 @@ const log = api.logger('autonomy');
 const { validateOrRespond } = api;
 
 // System 3 (task 1351): the autonomy precheck over HTTP. The deterministic
-// decision logic lives in scripts/gds/autonomy-gate.js (run directly as a CLI
+// decision logic lives in scripts/bongos/autonomy-gate.js (run directly as a CLI
 // Step 0 by the nightly routines on the droplet); this endpoint exposes the same
 // decision for any other caller. BUILT DISABLED: while OTB_AUTONOMY_ENABLED!=1
 // it always returns decision:'go' (inert).

package/modules/builder-settings/interaction-prefs.js

@@ -102,7 +102,7 @@ const FIELDS = {
   // rendering of tool calls or thinking blocks — see ADR 0271 §4. Default is
   // `show` (today's behavior) so existing builders are untouched; the ideator
   // CRAFT gets `quiet` from its claim directive instead of from this default
-  // (scripts/gds/discipline-modes.json), because the surface follows the ROLE
+  // (scripts/bongos/discipline-modes.json), because the surface follows the ROLE
   // and this key follows the PERSON.
   machinery: {
     label: 'Machinery in replies',

package/modules/builder-settings/render-prefs.js

@@ -258,7 +258,7 @@ function describeForApi(behaviorPrefs) {
     // --- levels (task 1002518) ---
     level,
     // The three booleans a card emitter needs, RESOLVED SERVER-SIDE. This is not
-    // a convenience: a CLI (scripts/gds/start.js) reaches module logic through
+    // a convenience: a CLI (scripts/bongos/start.js) reaches module logic through
     // the server, never by requiring this file, so it cannot learn what a rung
     // draws any other way. Shipping the answers keeps the ladder in one place
     // AND keeps the CLI dependency-free.

package/modules/builder-settings/routes/settings.js

@@ -114,7 +114,7 @@ module.exports = function buildBuilderSettingsRouter() {
   // The toggle list shows every sound from sound-prefs.KNOWN_SOUNDS with its
   // label/description, system default (ON), the builder's override if any, and
   // the effective enabled-state. The local player (.claude/sounds/play.js) reads
-  // a mirror of these prefs written by scripts/gds/fetch-sound-prefs.js at
+  // a mirror of these prefs written by scripts/bongos/fetch-sound-prefs.js at
   // session start — this endpoint is the source of truth.
   //
   // rank: any-builder — own profile config; mirrors the skill-prefs route.

package/modules/builder-settings/skill-prefs.js

@@ -11,7 +11,7 @@
 // classified as one of:
 //
 //   - 'script'         — pure mechanism; no LLM judgment needed. Slash
-//                        command shells out to a script in scripts/gds/ and
+//                        command shells out to a script in scripts/bongos/ and
 //                        formats the output. No model selection meaningful.
 //   - 'opus'  (default for heavy judgment) — design/strategy work the
 //                        builder really wants right.
@@ -63,7 +63,7 @@ const KNOWN_SKILLS = Object.freeze([
 // System default per skill. The audit's verdict — what runs when the
 // builder hasn't expressed a preference.
 const SKILL_DEFAULTS = Object.freeze({
-  // Pure mechanism — script wrappers around scripts/gds/*.js. No LLM
+  // Pure mechanism — script wrappers around scripts/bongos/*.js. No LLM
   // judgment needed for the wrapped operation; the slash command just
   // routes input → script → formatted output.
   'builder-start': 'script',

package/modules/builder-settings/wandering-prefs.js

@@ -83,7 +83,7 @@ const LEVEL_CONTRACT = Object.freeze({
     + 'The instant its done-when is met, report what you did and stop; your only forward '
     + 'pointer is `/builder-start` for the next task. If you notice anything beyond the claim '
     + '(a bug, an oddity, a number that looks off, an improvement), file it in one line with '
-    + '`node scripts/gds/capture.js "…"` and move on — do not raise it, explain it, or offer to '
+    + '`node scripts/bongos/capture.js "…"` and move on — do not raise it, explain it, or offer to '
     + 'investigate. In-task work is unaffected: do whatever it takes to finish the claim well.',
   focused:
     'Focus mode (wandering: Focused). Stay on your claimed task; in-task initiative is full. '
@@ -139,7 +139,7 @@ function rankWandering(rankKey) {
     : NO_RANK_WANDERING;
 }
 
-// DERIVED projections of the metadata above, kept because scripts/gds/session-eval.js
+// DERIVED projections of the metadata above, kept because scripts/bongos/session-eval.js
 // and the /me payload read them by rank. Deriving them means the two views cannot drift.
 const RANK_DEFAULT = Object.freeze(
   Object.fromEntries(Object.entries(RANK_WANDERING).map(([role, meta]) => [role, meta.default])),

package/modules/copy-desk/module.json

@@ -1,13 +1,13 @@
 {
   "key": "copy-desk",
   "title": "Copy desk (the artist's loop over user-facing text)",
-  "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/gds/copy-inventory.js (R01); this module reads it and never writes it. R03 (task 1003114) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a patch, which scripts/gds/copy-apply.js lands as a real diff under a claim — the design half's adapter.export() contract (ADR 0081) applied to text. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; a proposal is a work request with a suggested fix; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
+  "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/bongos/copy-inventory.js (R01); this module reads it and never writes it. R03 (task 1003114) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a patch, which scripts/bongos/copy-apply.js lands as a real diff under a claim — the design half's adapter.export() contract (ADR 0081) applied to text. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; a proposal is a work request with a suggested fix; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
   "version": "1.0.0",
   "coreVersion": "^1.8.0",
   "category": { "parent": "quality" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["copy-desk", "copy-desk-artist"], "migrations": true, "skills": ["tweak"], "pollers": ["stuck-page-digest"] },
+  "contributes": { "routes": ["copy-desk", "copy-desk-artist", "copy-desk-release"], "migrations": true, "skills": ["tweak"], "pollers": ["stuck-page-digest"] },
   "provides": ["copy-desk.artistStats", "copy-desk.stuckPageTweaksFor"],
   "consumes": ["lifecycle"]
 }

package/modules/copy-desk/page-data.js

@@ -2,12 +2,12 @@
 // artifacts Tweak Mode keys on (task 1004316 / BV2.TW05, ADR 0341 D1 and D3).
 //
 //   docs/page-inventory.json   every page, its surface, title and files
-//                              (scripts/gds/page-inventory.js, TW02)
+//                              (scripts/bongos/page-inventory.js, TW02)
 //   docs/page-readings.json    every page's visible lines, in page order
-//                              (scripts/gds/page-reader.js, TW04)
+//                              (scripts/bongos/page-reader.js, TW04)
 //
 // This is the first SERVER path that reads either, so both now ship in the
-// publish manifest (scripts/gds/publish-manifest.js, the copy-registry
+// publish manifest (scripts/bongos/publish-manifest.js, the copy-registry
 // precedent of ADR 0178). Same rules as registry.js, for the same reasons:
 //
 //   * READ, never written or regenerated here. The reader opens a browser; a GET
@@ -30,13 +30,13 @@ const ROOT = path.resolve(__dirname, '..', '..');
 const ARTIFACTS = Object.freeze({
   inventory: Object.freeze({
     rel: 'docs/page-inventory.json',
-    run: 'node scripts/gds/page-inventory.js',
+    run: 'node scripts/bongos/page-inventory.js',
     missing: 'page_inventory_missing',
     unreadable: 'page_inventory_unreadable',
   }),
   readings: Object.freeze({
     rel: 'docs/page-readings.json',
-    run: 'node scripts/gds/page-reader.js --stale',
+    run: 'node scripts/bongos/page-reader.js --stale',
     missing: 'page_readings_missing',
     unreadable: 'page_readings_unreadable',
   }),

package/modules/copy-desk/page-decisions.js

@@ -9,6 +9,18 @@
 'use strict';
 
 const pageStatus = require('./page-status');
+const pages = require('./pages');
+
+// The page's OPEN round, from the same read the page routes use: the last round
+// of the page that has neither shipped nor been abandoned. The one definition,
+// shared by routes/copy-desk.js and routes/copy-desk-release.js.
+function openRoundOf(tasks, pageId) {
+  const open = (tasks || []).filter((t) => {
+    const ref = pages.parseRoundRef(t.source_ref);
+    return ref && ref.page_id === pageId && t.status !== 'shipped' && t.status !== 'abandoned';
+  });
+  return open.length ? open[open.length - 1] : null;
+}
 
 // The page's round that is waiting for its artist, or the named refusal.
 // `task_id` in the body, when sent, pins the round the artist looked at: a
@@ -68,4 +80,4 @@ async function nextWaiting(lifecycle, invData, builderId, crafts) {
   return { count: q.count, page: n ? { page_id: n.page_id, title: n.title, path: n.path, task_id: n.task_id } : null };
 }
 
-module.exports = { waitingRoundOrFail, refuseDecision, nextWaiting };
+module.exports = { openRoundOf, waitingRoundOrFail, refuseDecision, nextWaiting };

package/modules/copy-desk/proposals.js

@@ -17,7 +17,7 @@
 // the copy desk is where they author; the proposal is the export. So a proposal
 // is not a row this module keeps — it is a PATCH, rendered into the description
 // of a task, which is the ledger the methodology already requires every change
-// to pass through. Nothing renders from it; scripts/gds/copy-apply.js is the
+// to pass through. Nothing renders from it; scripts/bongos/copy-apply.js is the
 // only reader, and it runs under a claim.
 //
 // WHERE THE PATCH LIVES, AND WHY IT IS A FENCED BLOCK. It has to be readable by
@@ -29,7 +29,7 @@
 // erosion ADR 0178 describes.
 //
 // PURE — no DB, no fs, no clock. Both callers import it: the route
-// (routes/copy-desk.js) composes, the applier (scripts/gds/copy-apply.js)
+// (routes/copy-desk.js) composes, the applier (scripts/bongos/copy-apply.js)
 // parses, and neither owns a second copy of the format.
 
 'use strict';
@@ -52,7 +52,7 @@ const MIN_WHY_CHARS = 10;
 const MAX_WHY_CHARS = 2000;
 
 // 400 is the registry's own upper bound on what counts as one string
-// (`looksLikeCopy` in scripts/gds/copy-inventory.js). Proposing something longer
+// (`looksLikeCopy` in scripts/bongos/copy-inventory.js). Proposing something longer
 // than the inventory can hold would produce a patch that lands and then vanishes
 // from the next registry — a change that silently un-inventories itself.
 const MAX_TEXT_CHARS = 400;
@@ -237,7 +237,7 @@ function proposalTaskBody(patch) {
     'This is a proposal, not a change — nothing has been written. Claim this task and run:',
     '',
     '```bash',
-    'node scripts/gds/copy-apply.js',
+    'node scripts/bongos/copy-apply.js',
     '```',
     '',
     'That re-derives the string’s position in the working tree, replaces exactly those characters, regenerates the copy registry and prints the diff for review. Then ship it like any other change — the grader sees the real diff.',

package/modules/copy-desk/registry.js

@@ -1,7 +1,7 @@
 // modules/copy-desk/registry.js — the READ side of R01's committed copy registry
 // (task 1003113 / R02 of goal 1000074).
 //
-// R01 (scripts/gds/copy-inventory.js) walks the tree and writes
+// R01 (scripts/bongos/copy-inventory.js) walks the tree and writes
 // docs/copy-registry.json: every user-facing string, with a stable id, the file
 // and line it lives at, and the render path that puts it in front of a person.
 // This file READS that artifact and never writes it. The generator stays a
@@ -37,7 +37,7 @@ const REGISTRY_REL = 'docs/copy-registry.json';
 const REGISTRY_ABS = path.resolve(__dirname, '..', '..', REGISTRY_REL);
 // The command that produces it — quoted verbatim to the reader when it is
 // missing or stale, so the fix never has to be looked up.
-const GENERATOR_CMD = 'node scripts/gds/copy-inventory.js';
+const GENERATOR_CMD = 'node scripts/bongos/copy-inventory.js';
 
 // mtime+size cache. The registry is a committed file that changes at deploy, not
 // per request, so re-reading and re-parsing ~1300 rows on every queue load is