@bongos/core 1.21.175 → 1.21.176

package/modules/ideas/routes/inbox.js

@@ -35,6 +35,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const inbox = require('../inbox');
+const ideaVotes = require('../votes'); // task 1004727: karma votes on ideas
 const bornOf = require('../born-of');
 const ideatorStats = require('../ideator-stats');
 // The trail read to the FULL depth of the descent (task 1004089, BV2.R09). Its
@@ -752,7 +753,7 @@ module.exports = function buildInboxRouter() {
   // records) only fixes collisions INSIDE this file; it cannot reach a route
   // another module contributes. The digit constraint can, because it makes the
   // non-numeric path fall THROUGH to whatever is mounted later, whatever the
-  // order. `scripts/gds/route-shadow-guard.js` fails the build on any remaining
+  // order. `scripts/bongos/route-shadow-guard.js` fails the build on any remaining
   // pair of this shape, and gen-api-docs strips the constraint so it never
   // reaches the published spec.
   //
@@ -771,6 +772,33 @@ module.exports = function buildInboxRouter() {
   // would dead-end at a "no such idea" card. getIdea() reads any idea by id.
   // Authed: a logged-out resolve hits the hall's softAuth "sign in" card, so no
   // idea text is exposed publicly (the linked refs are public, the bodies aren't).
+  // GET /inbox/votes?ids=1,2,3 — net votes and the caller's own vote for every
+  // idea row on a page, in one call, for the hall's shared list vote control
+  // (vote-control.js, task 1004727): { votes: { [id]: { net, mine } } }.
+  // Declared above /inbox/:id. At most 200 ids.
+  router.get('/inbox/votes', api.requireBuilder, api.asyncHandler('GET /inbox/votes', async (req, res) => {
+    const ids = String(req.query.ids || '').split(',');
+    res.json({ votes: await ideaVotes.readIdeaVotes(api.pool, { voterId: req.builder.id, ids }) });
+  }));
+
+  // POST /inbox/:id/vote { vote: 1 | -1 | 0 } — a karma vote on an idea (task
+  // 1004727). Earns karma for the idea's SUBMITTER through the same weekly fold
+  // as task votes, after the same 7-day lag, weighing the same (owner,
+  // 2026-10-23). The same guards as POST /tasks/:id/vote: Metic+ by default, via
+  // its own idea.vote permission (task 1004834; seeded wherever task.vote is), 403 on your own idea, 409 once the
+  // vote has been folded into karma; 0 clears an untallied vote.
+  // rank: metic+archon — a trusted-builder reputation action.
+  router.post('/inbox/:id(\\d+)/vote', api.requireBuilder, api.requirePermission('idea.vote'), api.asyncHandler('POST /inbox/:id/vote', async (req, res) => {
+    if (validateOrRespond(req, res, {
+      vote: { required: true, type: 'integer', enum: [-1, 0, 1] },
+    })) return;
+    const id = parseId(req, res, { code: 'bad_id', positiveInt: true });
+    if (id === null) return;
+    const r = await ideaVotes.castIdeaVote(api.pool, { voterId: req.builder.id, ideaId: id, vote: req.body.vote });
+    if (!r.ok) return res.fail(r.code, r.status, r.detail ? { detail: r.detail } : undefined);
+    res.json(r);
+  }));
+
   router.get('/inbox/:id(\\d+)', api.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_id', positiveInt: true });
     if (id === null) return;

package/modules/ideas/routes/ratify-goal.js

@@ -3,7 +3,7 @@
 // BV2.R17, spec R23, goal 1000095, criterion `ideator-full-idea-shapes-the-space`).
 //
 // WHY IT IS ITS OWN FILE, and not one more route in inbox.js. That file sits at
-// the 1,500-line size ratchet (`scripts/gds/fitness-ratchets.js` OVERSIZE_LINES)
+// the 1,500-line size ratchet (`scripts/bongos/fitness-ratchets.js` OVERSIZE_LINES)
 // and this route pushed it 24 lines over. Trimming back under would have left it
 // at ~1,497 — a landmine for whoever adds the next line — so the route moved
 // out instead. It is the same call `trail-descent.js`, `trail-size.js` and

package/modules/ideas/routing.js

@@ -89,7 +89,7 @@ const NEVER_ROUTE_GRADE = 'full';
 //
 // Both members carry a human or a channel that means "this is broken":
 //   'api'           — POST /inbox, an authenticated builder naming the kind. This
-//                     is also how `scripts/gds/capture.js` files (it posts to the
+//                     is also how `scripts/bongos/capture.js` files (it posts to the
 //                     route rather than calling this module), so the CLI inherits
 //                     it and needs no member of its own.
 //   'discord-bugs'  — the #bugs channel, where the CHANNEL is the classification

package/modules/ideas/templates.js

@@ -140,7 +140,7 @@ const BASE_V2_TEMPLATE = Object.freeze({
 });
 
 // The template a NEW Full Idea is written against — an alias, not a sixth
-// declaration. Consumers that mean "the current questions" (scripts/gds/spark.js
+// declaration. Consumers that mean "the current questions" (scripts/bongos/spark.js
 // prints them; the tests build a full payload from them) read this, so the alias
 // is what makes flipping the default a one-line change here rather than a sweep.
 // Anything that means a SPECIFIC vintage names `BASE_V1_TEMPLATE` /

package/modules/ideas/trail-descent.js

@@ -13,7 +13,7 @@
 //
 // WHY IT IS A SEPARATE FILE rather than more of listIdeaTrailForBuilder. Two
 // reasons, and the second is the real one. inbox.js is AT the 1500-line size
-// ratchet (scripts/gds/fitness-ratchets.js), so a line added there fails the
+// ratchet (scripts/bongos/fitness-ratchets.js), so a line added there fails the
 // build — the same wall that put descent.js beside it. And the descent is a
 // different relation from the trail: the trail is idea → task (one query, one
 // page window), the descent is task → task (a walk). Composing them here keeps

package/modules/ideas/trail-size.js

@@ -8,7 +8,7 @@
 // money: the sum of every stream-1 payout the descent has produced.
 //
 // WHY IT IS A SEPARATE FILE, like trail-descent.js beside it. inbox.js is AT the
-// 1500-line size ratchet (scripts/gds/fitness-ratchets.js), so a line added
+// 1500-line size ratchet (scripts/bongos/fitness-ratchets.js), so a line added
 // there fails the build. And this is a different read again: the trail is
 // idea → task, the descent is a task → task walk, and size is a read of the
 // LEDGER keyed by idea. Three relations, three files.

package/modules/ideas/votes.js

@@ -0,0 +1,93 @@
+'use strict';
+// modules/ideas/votes.js — karma votes on ideas (task 1004727).
+//
+// The idea twin of POST /tasks/:id/vote (modules/lifecycle/routes/tasks.js), with
+// the SAME guards, as the owner decided (2026-10-23): no voting on your own idea,
+// and a vote already folded into karma is frozen. The karma itself is written by
+// the one weekly fold that also counts task votes (tallyPeerVotes in
+// modules/lifecycle/db-analytics.js), which credits the idea's SUBMITTER
+// (idea_inbox.captured_by) after the same 7-day lag. Table: ideas_votes
+// (migrations/ideas_011_idea_votes.sql).
+//
+// Pure over an injected pool, so tests/karma_vote_lists.mjs drives every guard
+// with a scripted pool; the route only maps the result onto HTTP.
+
+async function ideaVoteTally(pool, ideaId) {
+  const { rows } = await pool.query(
+    `SELECT COALESCE(SUM(vote), 0)::int AS net, COUNT(*)::int AS total
+       FROM ideas_votes WHERE target_idea_id = $1`,
+    [ideaId]
+  );
+  const r = rows[0] || {};
+  return { net: Number(r.net) || 0, total: Number(r.total) || 0 };
+}
+
+// Cast (1 / -1) or clear (0) one builder's vote on one idea.
+// -> { ok: true, idea_id, my_vote, net_votes, total_votes }
+//  | { ok: false, status, code, detail }
+async function castIdeaVote(pool, { voterId, ideaId, vote }) {
+  if (![-1, 0, 1].includes(vote)) {
+    return { ok: false, status: 400, code: 'bad_vote', detail: 'vote must be 1, -1, or 0 (clear)' };
+  }
+  const { rows } = await pool.query(`SELECT id, captured_by FROM idea_inbox WHERE id = $1`, [ideaId]);
+  if (!rows.length) return { ok: false, status: 404, code: 'idea_not_found' };
+  const idea = rows[0];
+  if (idea.captured_by == null) {
+    return { ok: false, status: 409, code: 'no_submitter', detail: 'this idea has no submitter to credit' };
+  }
+  if (Number(idea.captured_by) === Number(voterId)) {
+    return { ok: false, status: 403, code: 'self_vote_forbidden', detail: 'you cannot vote on your own idea' };
+  }
+  const frozen = { ok: false, status: 409, code: 'vote_already_counted', detail: 'this vote was folded into karma and can no longer be changed' };
+  if (vote === 0) {
+    // Same freeze semantics as the task path: only an untallied vote clears, and
+    // a 0-row delete is disambiguated so a frozen vote is never reported cleared.
+    const del = await pool.query(
+      `DELETE FROM ideas_votes WHERE voter_builder_id = $1 AND target_idea_id = $2 AND tallied_at IS NULL RETURNING id`,
+      [voterId, ideaId]
+    );
+    if (del.rowCount === 0) {
+      const ex = await pool.query(
+        `SELECT 1 FROM ideas_votes WHERE voter_builder_id = $1 AND target_idea_id = $2`,
+        [voterId, ideaId]
+      );
+      if (ex.rowCount > 0) return frozen;
+    }
+  } else {
+    // The freeze check and the write are ONE statement (no TOCTOU with the fold).
+    // recorded_at is left alone on a change, so the 7-day lag clock is not reset.
+    const up = await pool.query(
+      `INSERT INTO ideas_votes (voter_builder_id, target_idea_id, vote)
+       VALUES ($1, $2, $3)
+       ON CONFLICT (voter_builder_id, target_idea_id)
+       DO UPDATE SET vote = EXCLUDED.vote
+         WHERE ideas_votes.tallied_at IS NULL
+       RETURNING id`,
+      [voterId, ideaId, vote]
+    );
+    if (up.rowCount === 0) return frozen;
+  }
+  const { net, total } = await ideaVoteTally(pool, ideaId);
+  return { ok: true, idea_id: ideaId, my_vote: vote === 0 ? null : vote, net_votes: net, total_votes: total };
+}
+
+// Batched read for a list: { [ideaId]: { net, mine } } for every id asked.
+async function readIdeaVotes(pool, { voterId, ids }) {
+  const clean = [...new Set((ids || []).map(Number).filter((n) => Number.isInteger(n) && n > 0))].slice(0, 200);
+  if (!clean.length) return {};
+  const { rows } = await pool.query(
+    `SELECT target_idea_id AS id,
+            SUM(vote)::int AS net,
+            MAX(CASE WHEN voter_builder_id = $2 THEN vote END) AS mine
+       FROM ideas_votes
+      WHERE target_idea_id = ANY($1::bigint[])
+      GROUP BY target_idea_id`,
+    [clean, voterId]
+  );
+  const out = {};
+  for (const id of clean) out[id] = { net: 0, mine: null };
+  for (const r of rows) out[r.id] = { net: Number(r.net) || 0, mine: r.mine == null ? null : Number(r.mine) };
+  return out;
+}
+
+module.exports = { castIdeaVote, readIdeaVotes, ideaVoteTally };

package/modules/lifecycle/abandon-leftovers.js

@@ -93,7 +93,7 @@ function leftoverNotice(taskId, leftovers) {
     'off its review sits against code that does not exist on main. Decide which:',
     '',
     `  git push origin --delete ${leftovers[0].branch}    # the work is cut — drop it`,
-    `  node scripts/gds/api.js POST /api/gds/tasks/${taskId}/promote   # it is not cut — revive the task`,
+    `  node scripts/bongos/api.js POST /api/gds/tasks/${taskId}/promote   # it is not cut — revive the task`,
     '',
     'Close or draft the branch\'s PR either way — the remote is not this tool\'s to change.',
   );

package/modules/lifecycle/cascade.js

@@ -108,7 +108,7 @@
 //
 // What stays, and why:
 //   • `hasCopyOrVisualWork` stays exported. The grader's advisory reader lens
-//     (ADR 0298, scripts/gds/ship-grade.js) is scoped by it.
+//     (ADR 0298, scripts/bongos/ship-grade.js) is scoped by it.
 //   • The runner still resolves `ctx.artistGate` and `ctx.changedFiles` when a
 //     caller injects them (routes/lifecycle.js does). No production rule reads
 //     either today; the reads are shared with the removal rule's (ship-files.js

package/modules/lifecycle/conflict-resolve.js

@@ -11,7 +11,7 @@
 // reliably hit:
 //   • generated artifacts (docs/repo-map.md, docs/file-map.md, docs/session-log-
 //     index.md, the nested CLAUDE.md symbol blocks) — regenerated from the merged
-//     tree by `otb-regen` (scripts/gds/git-merge-regen.js); and
+//     tree by `otb-regen` (scripts/bongos/git-merge-regen.js); and
 //   • the docs/adr/README.md append-index — `merge=union` keeps both new rows.
 // But that machinery only runs in a LOCAL merge (a builder's box, /merge-mode,
 // ship's pre-stage). The default ship path is server-mediated (ADR 0055): the box
@@ -50,7 +50,7 @@ const { promisify } = require('node:util');
 const githubPush = require('./github-push');
 const { repoInfo, branding } = require('../../src/module-api');
 const { loadRepoInfo } = repoInfo;
-const { registerMergeDriver } = require('../../scripts/gds/install-git-hooks');
+const { registerMergeDriver } = require('../../scripts/bongos/install-git-hooks');
 const { computeExecutedClosure, branchTouchesExecutedCode } = require('./executed-closure');
 
 // The closure is a property of the SERVER's trusted tree, not of the branch being
@@ -211,7 +211,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     //    driver only writes its own %A temp file, and the artifacts it produces are
     //    provisional by design (step 7b regenerates them from the merged tree).
     try {
-      register(work, { driverScript: path.join(repoRoot, 'scripts', 'gds', 'git-merge-regen.js') });
+      register(work, { driverScript: path.join(repoRoot, 'scripts', 'bongos', 'git-merge-regen.js') });
     } catch (_) {
       /* fall through — the merge will just leave generated conflicts unresolved */
     }
@@ -235,7 +235,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     //     live server's environment — the merge driver at step 6 and the generators at
     //     7b — so a branch that rewrote any of it would be running its own code as the
     //     server. This check must sit BEFORE the merge, not after it: `git merge` invokes
-    //     `node scripts/gds/git-merge-regen.js` by RELATIVE path with cwd at the clone
+    //     `node scripts/bongos/git-merge-regen.js` by RELATIVE path with cwd at the clone
     //     root, so the driver is the clone's copy and it runs at step 6.
     //
     //     Fail CLOSED and hand the merge to a human. The alternative — scrubbing the
@@ -339,9 +339,9 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
 // heal regenerates exactly these from the merged tree. Kept as the clone's OWN
 // scripts (each resolves its repo root from its __dirname), never the server's.
 const GENERATOR_SCRIPTS = [
-  'scripts/gds/gen-repo-map.js',
-  'scripts/gds/gen-file-map.js',
-  'scripts/gds/gen-session-index.js',
+  'scripts/bongos/gen-repo-map.js',
+  'scripts/bongos/gen-file-map.js',
+  'scripts/bongos/gen-session-index.js',
   // task 1003546: copy-inventory.js writes docs/copy-registry.json +
   // docs/copy-inventory.md, and its rows carry a `line` per copy string — so ANY
   // merge that shifts lines in a scanned UI file re-stales it and `unit`
@@ -351,20 +351,12 @@ const GENERATOR_SCRIPTS = [
   // staleness" — so copy-registry staleness was MISDIAGNOSED as a genuine failure,
   // burned the attempt cap, and announceStrand flagged the task needs_rebase
   // (PR #536 / task 1003544).
-  'scripts/gds/copy-inventory.js',
-  // task 1003537: the generated API contract + client. gen-api-docs.js writes
-  // docs/api/openapi.json + docs/api-reference.md + docs/routes-permissions.md from a
-  // scan of the route files; gen-api-client.js then writes the six
-  // clients/bongos-client files FROM that spec. Both are `--check` gates on the merge
-  // ref, so the same trap copy-inventory.js fell into applies verbatim: covered by the
-  // merge driver, regenerated by nobody, and the resulting staleness reported as
-  // `no_regen_diff` — "a real check failure" — rather than as drift.
-  //
-  // ORDER IS LOAD-BEARING: gen-api-client.js reads docs/api/openapi.json off disk, so
-  // it must run AFTER gen-api-docs.js has rewritten it for the merged tree. This list
-  // is walked in order, one await at a time, which is what makes that safe.
-  'scripts/gds/gen-api-docs.js',
-  'scripts/gds/gen-api-client.js',
+  'scripts/bongos/copy-inventory.js',
+  // task 1003537: gen-api-docs.js writes the committed docs/routes-permissions.md stub
+  // (a --check gate on the merge ref). The spec, the reference and the typed client it
+  // and gen-api-client.js also produce are gitignored since task 1004866 — nothing on
+  // the merge ref can be stale — so gen-api-client.js no longer runs here at all.
+  'scripts/bongos/gen-api-docs.js',
 ];
 
 // Run the CLONE's generator scripts in WRITE mode against the merged working tree.

package/modules/lifecycle/criterion-ref.js

@@ -3,7 +3,7 @@
 //
 // WHY THIS FILE EXISTS. `parseCriterionRef` lived inside db-deps-criteria.js,
 // which requires ../../src/module-api and therefore a database pool. The read
-// side — scripts/gds/status.js, which is public and unauthenticated — could not
+// side — scripts/bongos/status.js, which is public and unauthenticated — could not
 // require it, so
 // it grew its own parser: `Number(ref.slice(1))`, positional only. The system
 // ended up PRINTING an identifier its own write path refuses as unsafe, because

package/modules/lifecycle/db-analytics.js

@@ -135,16 +135,24 @@ async function estimationDriftSummary() {
 }
 
 
+// The rows a builder's own ship list shows: shipped by them, never a smoke task.
+// Shared by the list and its count so the two can never disagree on what "a ship" is.
+const LISTED_SHIPS_WHERE = `t.shipped_by = $1
+        AND t.status = 'shipped'
+        AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'`;
+
 async function recentShippedTasksByBuilder(builderId, limit = 10) {
   const { rows } = await pool.query(
     // task 1004433: the profile's recent works show what THIS builder was paid
     // (creditsEarnedBySql), not the task's whole payout across everyone.
+    // That figure is a per-row subquery over the builder's sessions, so its cost
+    // grows with rows returned x sessions; Postgres evaluates it only for the rows
+    // that survive the LIMIT, which is why a caller wanting a number should ask
+    // countListedShipsByBuilder rather than fetching every row (task 1004854).
     `SELECT t.id, t.title, t.value_summary, t.visual_url, t.visual_alt, t.version_id, t.status, t.shipped_at, t.credits_reward,
             ${creditsEarnedBySql('$1')} AS credits_awarded
        FROM tasks t
-      WHERE t.shipped_by = $1
-        AND t.status = 'shipped'
-        AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
+      WHERE ${LISTED_SHIPS_WHERE}
       ORDER BY t.shipped_at DESC NULLS LAST
       LIMIT $2`,
     [builderId, limit]
@@ -152,6 +160,19 @@ async function recentShippedTasksByBuilder(builderId, limit = 10) {
   return rows;
 }
 
+// How many ships recentShippedTasksByBuilder would list with no limit — a plain
+// count (task 1004854). No new index: idx_tasks_shipped_by_shipped_at
+// ON tasks (shipped_by, shipped_at DESC) WHERE status = 'shipped' already matches
+// this predicate (migrations/core_228_idea_inbox_captured_by_idx.sql). Measured on
+// a freshly migrated copy with a 3,000-ship builder in 8,000 tasks: 0.8 ms.
+async function countListedShipsByBuilder(builderId) {
+  const { rows } = await pool.query(
+    `SELECT count(*)::int AS n FROM tasks t WHERE ${LISTED_SHIPS_WHERE}`,
+    [builderId]
+  );
+  return rows[0]?.n ?? 0;
+}
+
 // -------------------------------------------------------------------------
 // Achievement getters (listAchievements / getBuilderAchievements /
 // getLeaderboardWithAchievements / getLockedAchievementsProgress /
@@ -812,6 +833,30 @@ async function tallyPeerVotes() {
       voteIds.push(r.id);
       netByBuilder.set(r.builder_id, (netByBuilder.get(r.builder_id) || 0) + r.vote);
     }
+    // task 1004727: idea votes fold HERE, in the same transaction, with the same
+    // lag, into the idea's SUBMITTER, and weigh the same as a task vote (owner,
+    // 2026-10-23). ideas_votes is the ideas module's table, so it is reached only
+    // when it exists: a core with that module off still folds task votes.
+    const ideaVoteIds = [];
+    const { rows: [{ has: hasIdeaVotes }] } = await client.query(
+      `SELECT to_regclass('ideas_votes') IS NOT NULL AS has`
+    );
+    if (hasIdeaVotes) {
+      const { rows: maturedIdeas } = await client.query(
+        `SELECT iv.id, i.captured_by AS builder_id, iv.vote
+           FROM ideas_votes iv
+           JOIN idea_inbox i ON i.id = iv.target_idea_id
+          WHERE iv.tallied_at IS NULL
+            AND iv.recorded_at <= now() - ($1::int * interval '1 day')
+            AND i.captured_by IS NOT NULL
+          FOR UPDATE OF iv`,
+        [PEER_VOTE_KARMA_LAG_DAYS]
+      );
+      for (const r of maturedIdeas) {
+        ideaVoteIds.push(r.id);
+        netByBuilder.set(r.builder_id, (netByBuilder.get(r.builder_id) || 0) + r.vote);
+      }
+    }
     const karmaRows = [];
     for (const [builderId, net] of netByBuilder) {
       if (net === 0) continue; // no net signal → no karma row, but still mark tallied
@@ -828,9 +873,16 @@ async function tallyPeerVotes() {
         [voteIds]
       );
     }
+    if (ideaVoteIds.length) {
+      await client.query(
+        `UPDATE ideas_votes SET tallied_at = now() WHERE id = ANY($1::bigint[])`,
+        [ideaVoteIds]
+      );
+    }
     return {
       ok: true,
-      votes_tallied: voteIds.length,
+      votes_tallied: voteIds.length + ideaVoteIds.length,
+      idea_votes_tallied: ideaVoteIds.length,
       builders_credited: karmaRows.length,
       karma: karmaRows,
       lag_days: PEER_VOTE_KARMA_LAG_DAYS,
@@ -857,6 +909,7 @@ module.exports = {
   recentGradesForBuilder,
   recentShippedTasks,
   recentShippedTasksByBuilder,
+  countListedShipsByBuilder,
   releaseMergeLease,
   rollingAvgGrade,
   tallyPeerVotes,

package/modules/lifecycle/db-deps-criteria.js

@@ -335,7 +335,7 @@ async function removeDependency(fromKind, fromId, toKind, toId) {
 //
 // The DEFINITION lives in ./criterion-ref.js, which requires nothing at all —
 // because the READ side needs the same vocabulary and cannot pay for a pool.
-// scripts/gds/status.js is public and unauthenticated, so while this classifier sat behind
+// scripts/bongos/status.js is public and unauthenticated, so while this classifier sat behind
 // ../../src/module-api it was unreachable from there and the CLI grew its own
 // positional-only parser (`Number(ref.slice(1))`). The system ended up PRINTING
 // and REQUIRING the very ref shape resolveCriterionIds below refuses as unsafe

package/modules/lifecycle/db-ship.js

@@ -871,7 +871,7 @@ async function getBuildersRoster({ staleHours } = {}) {
        b.display_name,
        b.avatar_url,
        b.rank,
-       b.status,
+       b.status, b.is_tester,
        b.total_credits,
        b.karma,
        b.created_at,
@@ -1445,7 +1445,7 @@ async function mergeTask({ taskId, intoTaskId, reason }, deps = {}) {
 
     // Abandoned blocks its dependents forever (owner ruling 2026-08-21, see this
     // module's CLAUDE.md), so the merge must say who it just stranded — the same
-    // report scripts/gds/abandon.js prints. Live dependents only; read inside the
+    // report scripts/bongos/abandon.js prints. Live dependents only; read inside the
     // txn so it agrees with the row we just flipped.
     const { rows: stranded } = await client.query(
       `SELECT t.id, t.title, t.status

package/modules/lifecycle/db-tasks.js

@@ -849,7 +849,7 @@ async function listTasks({ versionId, status, kind, discipline, goalId, createdB
 
 // task 1002827 — the candidate pool for the dependency advisory (POST /tasks'
 // `dependency_advisory` + the periodic sweep): OPEN tasks in this version that
-// carry touches[], the same OPEN set scripts/gds/audit-deps.js already treats
+// carry touches[], the same OPEN set scripts/bongos/audit-deps.js already treats
 // as "auditable" (ready, backlog, active, blocked). Bounded and cheap —
 // measured 2026-09-22, BONGOS-V2 carries ~51 such rows, since most tasks
 // declare no touches[] at all (ADR 0049 demoted the field to advisory, so
@@ -1203,7 +1203,7 @@ function taskTouchesProtectedPath(task) {
 //   3. est_minutes ASC         — shorter wins the tiebreak (easier to try)
 //   4. id ASC                  — stable final tiebreak
 //
-// scripts/gds/start.js keeps a hand-copied mirror of this function (it is a
+// scripts/bongos/start.js keeps a hand-copied mirror of this function (it is a
 // pure HTTP client and cannot import this module). The two are a documented
 // mirror pair: tests/cross_discipline_priority_direction.mjs executes BOTH and
 // fails if either drifts. Change one, change the other.

package/modules/lifecycle/db-versions.js

@@ -230,7 +230,7 @@ async function createVersion({ id, name, status = 'planning', scopeDocPath = nul
 // THE TIEBREAK IS NOT NEW. More than one version may sit at 'building' — ADR 0250
 // D5 closes the PLANNING slot only, and refusing a second building version is
 // still unshipped work (task 1003606, BV1.R19) — so a rule was needed, and the
-// project already has one: scripts/gds/version-select.js pickDefaultVersion,
+// project already has one: scripts/bongos/version-select.js pickDefaultVersion,
 // extracted to end nine hardcoded version literals and pinned by
 // tests/version_literals.mjs. This is that rule in SQL: building only, most
 // recently started first, a null started_at sorting LAST so a half-filled row

package/modules/lifecycle/db.js

@@ -179,6 +179,7 @@ const {
   recentGradesForBuilder,
   recentShippedTasks,
   recentShippedTasksByBuilder,
+  countListedShipsByBuilder,
   releaseMergeLease,
   rollingAvgGrade,
   tallyPeerVotes,
@@ -353,6 +354,7 @@ module.exports = {
   releaseClaimOnBehalf,
   recentShippedTasks,
   recentShippedTasksByBuilder,
+  countListedShipsByBuilder,
   getEstVsActualRatio,
   estimationDriftSummary,
   recentGradesForBuilder,

package/modules/lifecycle/dead-deps.js

@@ -19,8 +19,8 @@
 // actual bug: the CLI used to answer a dead edge with "Ship those first (or
 // release them) and try again", advice that can never be followed.
 //
-// Pure + DB-free so the CLI (scripts/gds/claim.js), the route
-// (modules/lifecycle/routes/claims.js) and the detector (scripts/gds/audit-deps.js)
+// Pure + DB-free so the CLI (scripts/bongos/claim.js), the route
+// (modules/lifecycle/routes/claims.js) and the detector (scripts/bongos/audit-deps.js)
 // all speak from ONE definition — the goal-authz.js precedent.
 
 // The one terminal task status that can gate a dependency edge. 'shipped' is the
@@ -155,7 +155,7 @@ function deadDepHint(deps, taskId = null) {
     + tail;
 }
 
-// Detector core (scripts/gds/audit-deps.js --stranded): which LIVE tasks are
+// Detector core (scripts/bongos/audit-deps.js --stranded): which LIVE tasks are
 // gated by an abandoned dependency? `tasks` are rows carrying { id, status,
 // title, blocked_by: [{ id, status, title }] } — the GET /tasks?include=deps
 // shape. A dependent that is itself terminal is NOT stranded (nothing is

package/modules/lifecycle/dependency-advisory.js

@@ -3,7 +3,7 @@
 // modules/lifecycle/dependency-advisory.js — the MISSING-DEPENDENCY advisory
 // (task 1002827, goal 1000089).
 //
-// THE HOLE. scripts/gds/audit-deps.js has shipped a working
+// THE HOLE. scripts/bongos/audit-deps.js has shipped a working
 // likely-missing-dependency detector since task 1000349 (unit-tested,
 // tests/audit_deps.mjs, tests/missing_dep_classify.mjs) — and nothing ever
 // called it. A task can be created touching the exact same files an
@@ -18,7 +18,7 @@
 //      file's `buildDependencyAdvisory`), read by the /goal-create skill's
 //      "sibling advisory" section (.claude/skills/goal-create/SKILL.md).
 //   2. The periodic sweep: `/goal-close`'s residue walk (was `/goal-review`) runs
-//      `node scripts/gds/audit-deps.js --min high` as one more housekeeping
+//      `node scripts/bongos/audit-deps.js --min high` as one more housekeeping
 //      step (idea 1000276's half — see .claude/skills/goal-close/SKILL.md, Part 2).
 //
 // HARD CONSTRAINT, same as goal-advisory.js: advisory only (a finding addressed
@@ -41,7 +41,7 @@ const { candidateEdge } = require('./missing-dep-classify.js');
 // How many candidates the advisory offers. Small on purpose (the
 // goal-advisory.js CANDIDATE_LIMIT precedent) — this is a hint for the author
 // to triage, not a browsable report; the full corpus scan already exists as
-// `node scripts/gds/audit-deps.js` for that. Separate from (and much smaller
+// `node scripts/bongos/audit-deps.js` for that. Separate from (and much smaller
 // than) db.listOpenTasksWithTouches's own query-side LIMIT, which bounds cost
 // rather than display.
 const CANDIDATE_LIMIT = 5;

package/modules/lifecycle/goal-category.js

@@ -18,7 +18,7 @@
 // the scope_modules wall, per-task rank floors, goal membership — and a second
 // thing that LOOKS like a hierarchy gets mistaken for one, after which work is
 // refused because of a label nobody meant as a permission. Enforced by
-// `scripts/gds/category-advisory-guard.js` (a fitness check), because a comment is
+// `scripts/bongos/category-advisory-guard.js` (a fitness check), because a comment is
 // not a guardrail. See ADR 0192.
 //
 // Two consequences that look like bugs and are not:

package/modules/lifecycle/goal-forest.js

@@ -27,7 +27,7 @@ const { pool } = api;
 
 // goalForestRows — the two raw reads. `edges`: one row per task-level dependency
 // whose BOTH endpoints sit in `goalId` (the ADR 0227 §10.5 measurement's own
-// filter — see scripts/gds/spike-task-map.js's per-goal grouping). `tasks`: the
+// filter — the spike harness's per-goal grouping, ADR 0227). `tasks`: the
 // facts for exactly the task ids that appear in at least one such edge — never
 // the goal's whole task list, which the page already holds from GET
 // /tasks?goal_id=.

package/modules/lifecycle/goal-task-relevance-advisory.js

@@ -119,7 +119,7 @@ async function runRelevanceJudge({ db, api, goal, task }) {
     // (only what needs a human's attention becomes one), so its cost would
     // otherwise vanish entirely — logged here at minimum. It does NOT reach
     // cost_log: that table is written by builder-facing CLI flows through an
-    // authenticated session (scripts/gds/ship-grade-steps.js), and this judge
+    // authenticated session (scripts/bongos/ship-grade-steps.js), and this judge
     // runs inside the live server with no such session to post through; wiring
     // a live-server spend port for the economy module is real work beyond this
     // task's scope, tracked as a known gap rather than silently left unstated.

package/modules/lifecycle/kickoff-checklist.js

@@ -2,7 +2,7 @@
 // instance needs that the platform CANNOT do for its owner, as task specs (task 1003239).
 //
 // ONE list, two filers. `bongos init` files it at scaffold time on the self-host path
-// (scripts/gds/init.js kickoffTasks); the lifecycle module files it at the founder's
+// (scripts/bongos/init.js kickoffTasks); the lifecycle module files it at the founder's
 // FIRST SIGN-IN on the control-plane path (modules/lifecycle/kickoff-seed.js), where
 // the scaffold ran `init --no-seed` and no Archon existed to file anything — walk
 // finding W4: the founder reached an empty board. Moved here from init.js so both

package/modules/lifecycle/kickoff-seed.js

@@ -2,7 +2,7 @@
 // sign-in (task 1003239; behind the `lifecycle.kickoffSeed` port).
 //
 // WHY HERE, WHY THEN. `bongos init` files the kickoff checklist as tasks — but the
-// control-plane scaffold runs `init --no-seed` (scripts/gds/provision-repo.js), and a
+// control-plane scaffold runs `init --no-seed` (scripts/bongos/provision-repo.js), and a
 // hub-provisioned project has no Archon until its founder signs in, so nothing could
 // be filed earlier: the founder reached an EMPTY board (walk finding W4). The kernel's
 // first-admin seating (src/bongos/auth-admission.js) resolves this port the moment the

package/modules/lifecycle/lifecycle.js

@@ -135,6 +135,7 @@ module.exports = {
   // See modules/lifecycle/page-tweak-approve.js.
   approveHeldTweak: (...a) => pageTweakApprove.approveHeldTweak(...a),
   sendBackHeldTweak: (...a) => pageTweakApprove.sendBackHeldTweak(...a),
+  releaseStuckTweak: (...a) => pageTweakApprove.releaseStuckTweak(...a),
   // A builder's crafts (help-requests' reader, from builders.preferred_disciplines),
   // so the queue read can say whether the caller may decide before they try.
   builderCrafts: (...a) => helpRequests.craftsForBuilder(...a),
@@ -151,6 +152,7 @@ module.exports = {
   recentGradesForBuilder: (...a) => db.recentGradesForBuilder(...a),
   countShippedTasksForBuilder: (...a) => db.countShippedTasksForBuilder(...a),
   recentShippedTasksByBuilder: (...a) => db.recentShippedTasksByBuilder(...a),
+  countListedShipsByBuilder: (...a) => db.countListedShipsByBuilder(...a),
   // builders.js (the profile's per-craft activity log, task 1003281): the paged
   // "what did I do as an engineer / an artist" reads. Separate from the two
   // above because those answer "how much, in total" and these answer "what,