@bongos/core 1.21.175 → 1.21.176

package/modules/lifecycle/merge-reach.js

@@ -1,18 +1,22 @@
 // modules/lifecycle/merge-reach.js — who sees a merge, and when. The ONE source of
-// the sentence (task 1004682).
+// the sentence (task 1004682; corrected by task 1004873).
 //
-// Two audiences, two rules:
-//   1. The hub this checkout ships to (cloudbongos.com: the projects hub and the
-//      builders hall) redeploys from main on every merge, within minutes.
-//   2. Projects hosted on the platform get a change only when a published core
-//      release carries it (auto-published per merge, ADR 0161) AND their pin moves
-//      (a patch-channel subscription or a core-upgrade).
+// One path, for every instance — the hub included:
+//   1. A merge to main is first carried by a PUBLISHED core release. The publish
+//      lane cuts one per merge (ADR 0161), but only while its integration gate is
+//      green; a red integration lane stalls every release behind it.
+//   2. An instance gets that release only when its PIN moves. On the hub
+//      (cloudbongos.com: the projects hub and the builders hall) that is
+//      owner-gated; on a hosted project it is a patch-channel subscription or a
+//      core-upgrade.
 //
-// Before this, deploy-divergence.js printed "Merging to main deploys nothing" on
-// every ship — true under ADR 0137, false since ADR 0161 — and sessions repeated
-// it to the owner about work that was in fact live. The ship card, the divergence
-// report and the SessionStart line all read their wording from here, so the three
-// cannot drift apart again.
+// History: this file used to say the hub "redeploys from main on every merge,
+// within minutes". It never did — the hub pins a published core like any other
+// instance — and on 2026-10-25 it had served the same build through 200+ merges
+// while sessions told the owner that work was live (task 1004873). Before that,
+// deploy-divergence.js printed "Merging to main deploys nothing" (ADR 0137), false
+// in the other direction. The ship card, the divergence report and the SessionStart
+// line all read their wording from here, so they cannot drift apart again.
 //
 // PURE and dependency-free: callers pass an already-sanitised reading (host, short
 // sha, inclusion), never a raw network response — some of this text is injected
@@ -23,7 +27,7 @@
 const HOSTED_LINE = 'Hosted projects: only when a published core release carries the change and their pin moves (patch-channel subscription or a core-upgrade).';
 
 function hubRule(host) {
-  return `${host || 'The hub'} redeploys from main on every merge, within minutes`;
+  return `${host || 'The hub'} gets a merge only when a published core release carries it and its pin moves (owner-gated)`;
 }
 
 // includes: true (the live build carries this merge), false (not yet), null (cannot tell).
@@ -32,7 +36,17 @@ function hubLine({ host = null, liveShort = null, includes = null } = {}) {
   const state = includes === true ? 'includes this merge'
     : includes === false ? 'not yet'
       : 'cannot tell yet whether it includes this merge';
-  return `${host || 'The hub'}: live at ${liveShort} (${state}) — it redeploys from main on every merge, within minutes.`;
+  return `${host || 'The hub'}: live at ${liveShort} (${state}) — it gets a merge only when a published core release carries it and its pin moves (owner-gated).`;
+}
+
+// Is main's latest merge in a published release yet? `tipShort` is a short sha,
+// `version` the release that carries it (null = none yet). Both are bounded here,
+// because the result is injected into SessionStart context.
+function releaseState({ tipShort = null, version = null } = {}) {
+  const tip = typeof tipShort === 'string' && /^[0-9a-f]{4,40}$/i.test(tipShort) ? tipShort : null;
+  const ver = typeof version === 'string' && /^\d{1,6}\.\d{1,6}\.\d{1,6}$/.test(version) ? version : null;
+  const which = tip ? `main's latest merge (${tip})` : "main's latest merge";
+  return ver ? `${which} is in release ${ver}` : `${which} is in NO release yet, so no instance can have it`;
 }
 
 // Re-bound a reading that may have travelled (a land-watch breadcrumb file) before
@@ -53,4 +67,4 @@ function whoSeesAMerge(reading) {
   return [hubLine(reading || {}), HOSTED_LINE];
 }
 
-module.exports = { HOSTED_LINE, hubRule, whoSeesAMerge, boundReading };
+module.exports = { HOSTED_LINE, hubRule, releaseState, whoSeesAMerge, boundReading };

package/modules/lifecycle/missing-dep-classify.js

@@ -2,7 +2,7 @@
 
 // modules/lifecycle/missing-dep-classify.js — the PURE core of the
 // likely-missing-dependency detector (task 349, moved here from
-// scripts/gds/audit-deps.js by task 1002827 so a live route can reuse it
+// scripts/bongos/audit-deps.js by task 1002827 so a live route can reuse it
 // without pulling in that script's CLI-only machinery — cliClient(),
 // resolveDefaultVersion() — into the server process. The `dead-deps.js`
 // precedent beside this file: a pure lifecycle module, consumed both by the
@@ -30,8 +30,8 @@ const isUnshippedBlocker = (s) => s !== 'shipped' && s !== 'abandoned';
 // bare directory) is demoted to `low`. Deliberately broad; tune as the repo moves.
 const HOTSPOTS = [
   'src/bongos/db.js', 'src/bongos/routes.js', 'server.js', 'migrations/', 'CLAUDE.md',
-  'modules/hall-ui/', 'tests/', 'scripts/gds/', 'src/bongos/', 'src/bongos/routes/',
-  'scripts/gds/ship.js', 'scripts/gds/api.js', 'scripts/gds/cli-lib.js',
+  'modules/hall-ui/', 'tests/', 'scripts/bongos/', 'src/bongos/', 'src/bongos/routes/',
+  'scripts/bongos/ship.js', 'scripts/bongos/api.js', 'scripts/bongos/cli-lib.js',
   'modules/grading/grader.js', 'docs/', 'docs/adr/', 'docs/adr/README.md', 'docs/recipes/',
   'docs/architecture.md', 'docs/file-map.md', '.claude/skills/', '.claude/hooks/',
   'infra/', 'public/assets/tiles/',

package/modules/lifecycle/module.json

@@ -34,7 +34,8 @@
       "removal-proposals",
       "sky",
       "goal-task-relevance",
-      "moving"
+      "moving",
+      "task-votes"
     ],
     "pollers": [
       "publish-reconciler"

package/modules/lifecycle/page-tweak-approve.js

@@ -239,4 +239,88 @@ async function sendBackHeldTweak({ taskId, builderId, compose }, deps = {}) {
   return out;
 }
 
-module.exports = { approveHeldTweak, sendBackHeldTweak };
+// releaseStuckTweak({ taskId, builderId, expectedStatus, compose, note }, deps)
+//
+// The Studio's way to move a page round the reads cannot classify (copy-desk's
+// `unknown` state: an active round nobody holds, or a ready round whose applied
+// block says nothing more). Those rounds counted as stuck at once and had no
+// action anywhere, so the digest told people to open a Studio that could not
+// move them (task 1004837).
+//
+//   compose(task) -> { ok: true, description } | { ok: false, code, detail }
+//     given: the round keeps its frozen batch, takes copy-desk's sent-back
+//     block and returns to `ready`, so it reads `submitted` (the /tweak queue).
+//     omitted: nothing is worth keeping, and the round is `abandoned` with
+//     `note` as its reason, which frees the page for a fresh round.
+//
+// Refused unless the round is still in `expectedStatus` (the status copy-desk
+// classified), is not held for its artist (that is approve / send-back's), and
+// is not terminal. Any open claim is released and the grade row dropped, as
+// send-back does. Authority is the route's (rank), checked before this runs.
+// Outcomes: released | abandoned | not_found | wrong_source | not_stuck |
+// round_moved | builder_inactive | refused
+async function releaseStuckTweak({ taskId, builderId, expectedStatus, compose = null, note = '' }, deps = {}) {
+  const out = await inTx(deps, async (client) => {
+    const { rows } = await client.query(
+      `SELECT id, status, title, description, source, source_ref, version_id, goal_id, touches
+         FROM tasks WHERE id = $1 FOR UPDATE`,
+      [taskId]
+    );
+    const task = rows[0];
+    if (!task) return { outcome: 'not_found' };
+    if (!hold.isPageTweak(task)) return { outcome: 'wrong_source', task };
+    if (task.status === 'shipped' || task.status === 'abandoned') return { outcome: 'not_stuck', task };
+    if (task.status !== expectedStatus) return { outcome: 'round_moved', task };
+    const { rows: g } = await client.query('SELECT passed, signals FROM task_grades WHERE task_id = $1', [taskId]);
+    if (hold.isHeldForArtist(task, g[0] ? g[0].passed : null)) return { outcome: 'not_stuck', task };
+    const { rows: b } = await client.query(
+      'SELECT id, status, github_login, display_name FROM builders WHERE id = $1', [builderId]
+    );
+    if (!b[0] || b[0].status === 'inactive') return { outcome: 'builder_inactive', task };
+    // An `active` round reads unknown only while nobody holds it: a claim taken
+    // since copy-desk looked means the round moved, so it is not released.
+    if (task.status === 'active') {
+      const { rows: open } = await client.query('SELECT id FROM claims WHERE task_id = $1 AND released_at IS NULL LIMIT 1', [taskId]);
+      if (open.length) return { outcome: 'round_moved', task };
+    }
+    let updated;
+    if (compose) {
+      const r = compose(task);
+      if (!r || !r.ok) return { outcome: 'refused', refusal: r, task };
+      ({ rows: updated } = await client.query(
+        `UPDATE tasks SET description = $2, status = 'ready', updated_at = now() WHERE id = $1
+         RETURNING id, status, description, source_ref, updated_at`,
+        [taskId, r.description]
+      ));
+    } else {
+      ({ rows: updated } = await client.query(
+        `UPDATE tasks SET status = 'abandoned', value_summary = $2, updated_at = now() WHERE id = $1
+         RETURNING id, status, description, source_ref, updated_at`,
+        [taskId, `Abandoned: ${note}`]
+      ));
+    }
+    const { rows: released } = await client.query(
+      compose
+        ? `UPDATE claims SET released_at = now(), outcome = 'partial'
+            WHERE task_id = $1 AND released_at IS NULL
+            RETURNING id`
+        : `UPDATE claims SET released_at = now(), outcome = 'abandoned'
+            WHERE task_id = $1 AND released_at IS NULL
+            RETURNING id`,
+      [taskId]
+    );
+    await client.query('DELETE FROM task_grades WHERE task_id = $1', [taskId]);
+    return {
+      commit: true,
+      outcome: compose ? 'released' : 'abandoned',
+      task: updated[0],
+      released_claim_ids: released.map((x) => String(x.id)),
+    };
+  });
+  delete out.commit;
+  if (out.outcome !== 'released' && out.outcome !== 'abandoned') return out;
+  out.pr = await closeRoundPr(taskId, deps.push || PUSH);
+  return out;
+}
+
+module.exports = { approveHeldTweak, sendBackHeldTweak, releaseStuckTweak };

package/modules/lifecycle/page-tweak-hold.js

@@ -14,7 +14,7 @@
 // and strand-watch / grade-recover (a held pass is not a failed grade). Every
 // one of them asks the questions below.
 //
-// PURE: no require, no fs, no DB. The scripts under scripts/gds/ require it
+// PURE: no require, no fs, no DB. The scripts under scripts/bongos/ require it
 // directly, so it must load without the module doorway.
 //
 // Every other task is untouched by construction: each predicate is false unless

package/modules/lifecycle/publish-reconciler.js

@@ -68,8 +68,7 @@
 // `task.shipped` had (the Discord module listens and posts a notice). Ambiguous
 // shapes (open PR, CI still running, no proof yet) keep the 30-min grace.
 //
-// Mirrors the in-process poller precedent (src/bongos/uptime-poller.js) and the
-// Discord reconcile timers (src/bongos/discord-bot.js): unref'd timers (never hold
+// Mirrors the Discord reconcile timers (src/bongos/discord-bot.js): unref'd timers (never hold
 // the process open), best-effort (a GitHub/DB hiccup logs and waits for the next
 // sweep), and a no-op when the server holds no push credential (local dev, tests).
 

package/modules/lifecycle/rot.js

@@ -104,7 +104,7 @@ const GOAL_VERBS = Object.freeze([
 // back out of the route source and fails if the two ever disagree — the same
 // pairing guard the rot clock gets against migration core_231.
 //
-// A SECOND copy of this decision lives in scripts/gds/backlog-review.js
+// A SECOND copy of this decision lives in scripts/bongos/backlog-review.js
 // (`verbsFor`, task 1003746), deliberately: that script is an HTTP client that must
 // run from a scoped checkout without loading the server's module tree, so it cannot
 // require this file. The route-guard pairing test below is what keeps both honest.

package/modules/lifecycle/routes/artist-gate.js

@@ -7,7 +7,7 @@
 // POLICY (`artist_gate`) is pushed into this instance's branding pack by the
 // platform and read by the core; the STATE it reads — which artist review tasks
 // are still open — is this instance's own board. The thing that has to consult
-// both is `scripts/gds/go-live.js`, the pin move, which runs from a core checkout
+// both is `scripts/bongos/go-live.js`, the pin move, which runs from a core checkout
 // against a LIVE instance and can see neither from where it stands. So the
 // instance answers the question about itself, in one call, and the deploy script
 // decides what to do with the answer.

package/modules/lifecycle/routes/gate-approvals.js

@@ -28,12 +28,32 @@ const githubPush = require('../github-push');
 // re-arms auto-merge on the reopened PR, and a page tweak held for its artist must
 // never be armed from here. Called through the module object so tests can stub it.
 const pageTweakReads = require('../page-tweak-reads');
+
+// Would POST /gate-approvals/:pr/approve let this viewer through? The same two
+// checks it mounts, read for the list (task 1004829): the hall draws a held PR as
+// an ask card only on true, so a Metic who may read the gate never sees an Approve
+// the route would refuse. Fail-closed like requirePermission: no government port,
+// or one that throws, is false; an absent act-alone check passes, as the
+// requireActAlone gate does.
+async function viewerMayApprove(builderId) {
+  try {
+    const government = api.resolveOptional('government');
+    if (!government || typeof government.builderHasPermissions !== 'function') return false;
+    if (!(await government.builderHasPermissions(Number(builderId), ['gate_approval.decide']))) return false;
+    if (typeof government.checkActAlone !== 'function') return true;
+    const out = await government.checkActAlone('release', builderId);
+    return !!(out && out.ok === true);
+  } catch {
+    // authority that cannot be established is a denial (ADR 0016); the list still answers
+    return false;
+  }
+}
 const { HELD_NOT_ARMED } = require('../page-tweak-hold');
 const { parseId } = api;
 // The SAME pure classifier the CI gate runs — reused (never duplicated) so the hall
 // shows identical verdict + reasons. Safe to require: gate-review.js guards its CLI
 // entrypoint behind `require.main === module`, so importing it runs no side effects.
-const { classifyChanges, resolveAction } = require('../../../scripts/gds/gate-review');
+const { classifyChanges, resolveAction } = require('../../../scripts/bongos/gate-review');
 
 // Pull a GDS task id out of a server-published PR's title ("task 1163: …") or body
 // ("… for task 1163."). Returns a number or null. Display-only.
@@ -238,6 +258,7 @@ module.exports = function buildGateApprovalsRouter() {
         awaiting,
         count: awaiting.length,
         checking,
+        viewer_may_approve: await viewerMayApprove(req.builder.id),
         checks_readable: checksReadable,
         ...(checksReadable ? {} : {
           note: 'PR check rollup is unreadable — the server GitHub App is missing the Checks:read permission, so gate-review-red PRs cannot be listed. Grant it and reinstall.',

package/modules/lifecycle/routes/goals.js

@@ -416,7 +416,7 @@ module.exports = function buildGoalsRouter() {
   // ---- the ADVISORY human category (task 1003275, criterion legibility-categories) ----
   // A category ORIENTS a person and steers Claude; it authorises nothing. Nothing
   // in this file, in claim eligibility, or in the claimable feed may branch on it —
-  // scripts/gds/category-advisory-guard.js fails the build if that changes (ADR 0192).
+  // scripts/bongos/category-advisory-guard.js fails the build if that changes (ADR 0192).
   //
   // GET /work-categories — the project's set. rank: any-builder; it is a vocabulary,
   // and a client that cannot read it hard-codes the labels instead.

package/modules/lifecycle/routes/task-route-helpers.js

@@ -42,7 +42,7 @@ const VALID_FITS = new Set(['autonomous', 'parallel']);
 // tasks.needs_migration boolean (migration 081, touches[] cleanup [1/8] /
 // task 876), which is what the claim-time allocator now keys off — replacing
 // the old "inject 'migrations/' into touches[]" sentinel. Conservative,
-// whole-token, case-insensitive. The former scripts/gds/capture.js mirror was
+// whole-token, case-insensitive. The former scripts/bongos/capture.js mirror was
 // deleted with the same task: captured ideas have no touches[] and the server
 // re-detects on create, so the CLI copy earned its keep no longer.
 // task 1003910: "schema" is QUALIFIED, not bare.

package/modules/lifecycle/routes/task-votes.js

@@ -0,0 +1,54 @@
+'use strict';
+// modules/lifecycle/routes/task-votes.js — the batched vote read behind the
+// hall's ONE list vote control (modules/hall-ui/public/vote-control.js, task
+// 1004727). Every task list in the hall renders that control on its confirmed
+// and shipped rows; the control asks for net votes and the caller's own vote
+// for every row on the page in ONE call, instead of one read per row.
+//
+// Casting stays on POST /tasks/:id/vote (routes/tasks.js) with its rank gate;
+// this is a read, open to any signed-in builder like the acclaim feed.
+// Two path segments on purpose: GET /tasks/:id would swallow a single one.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+
+const log = api.logger('lifecycle');
+const MAX_IDS = 200;
+
+async function readTaskVotes(pool, { voterId, ids }) {
+  const clean = [...new Set((ids || []).map(Number).filter((n) => Number.isInteger(n) && n > 0))].slice(0, MAX_IDS);
+  if (!clean.length) return {};
+  const { rows } = await pool.query(
+    `SELECT target_task_id AS id,
+            SUM(vote)::int AS net,
+            MAX(CASE WHEN voter_builder_id = $2 THEN vote END) AS mine
+       FROM peer_votes
+      WHERE target_task_id = ANY($1::bigint[])
+      GROUP BY target_task_id`,
+    [clean, voterId]
+  );
+  const out = {};
+  for (const id of clean) out[id] = { net: 0, mine: null };
+  for (const r of rows) out[r.id] = { net: Number(r.net) || 0, mine: r.mine == null ? null : Number(r.mine) };
+  return out;
+}
+
+module.exports = function buildTaskVotesRouter() {
+  const router = express.Router();
+
+  // GET /tasks/peer-votes/lookup?ids=1,2,3 — { votes: { [id]: { net, mine } } }
+  // for the hall's list vote control (task 1004727). At most 200 ids.
+  // rank: any-builder — a read; casting is gated on POST /tasks/:id/vote.
+  router.get('/tasks/peer-votes/lookup', api.requireBuilder, async (req, res) => {
+    try {
+      const ids = String(req.query.ids || '').split(',');
+      res.json({ votes: await readTaskVotes(api.pool, { voterId: req.builder.id, ids }) });
+    } catch (err) {
+      log.error('[gds] GET /tasks/peer-votes/lookup', err);
+      res.fail('votes_read_failed', 500);
+    }
+  });
+
+  return router;
+};
+module.exports.readTaskVotes = readTaskVotes;

package/modules/lifecycle/routes/task-write-routes.js

@@ -292,7 +292,7 @@ module.exports = function registerTaskWriteRoutes(router) {
       const goal_advisory = await buildGoalAdvisory({
         db, versionId: body.version_id, task, hasCriterionLink: criteria.length > 0,
       });
-      // task 1002827 — the missing-dependency advisory (scripts/gds/audit-deps.js's
+      // task 1002827 — the missing-dependency advisory (scripts/bongos/audit-deps.js's
       // detector, wired live for the first time): OPEN tasks in this version that
       // touch the same files as this one and are not declared dependencies.
       // Non-blocking by construction — see dependency-advisory.js.

package/modules/lifecycle/routes/tasks.js

@@ -249,7 +249,7 @@ module.exports = function buildTasksRouter() {
   // statuses: `ready` (claimable now — what the floor is measured against, per
   // the canonical query in task 614) and `backlog` (held / pending review —
   // proposals an Archon hasn't promoted yet). The AI floor replenisher
-  // (scripts/gds/newcomer-floor.js) reads this to decide which disciplines are
+  // (scripts/bongos/newcomer-floor.js) reads this to decide which disciplines are
   // under-supplied, counting `ready + backlog` so a re-run never piles fresh
   // proposals on top of ones already awaiting review (idempotency). The hall can
   // also render it as a live gauge.
@@ -630,7 +630,7 @@ module.exports = function buildTasksRouter() {
       // whichever entry point wins the transition is the only one that reaches
       // this line — the emit fires exactly ONCE per ship across all three
       // paths. The server is thus the SINGLE ship broadcaster (the laptop
-      // local post in scripts/gds/ship.js was removed as a duplicate, task
+      // local post in scripts/bongos/ship.js was removed as a duplicate, task
       // 1749). Best-effort: emitAsync isolates listener errors so a broadcast
       // hiccup can never turn a successful ship into a 500.
       try { await seams.emitAsync('task.shipped', task); } catch (_) { /* non-blocking */ }

package/modules/lifecycle/routes/versions.js

@@ -82,7 +82,7 @@ module.exports = function buildVersionsRouter() {
 
   // Per-criterion progress rollup: each done-when criterion → the tasks that
   // gate it (task_criteria, migration 055) → live statuses → what remains.
-  // Powers `scripts/gds/status.js` + the /status skill (#435) and is reusable
+  // Powers `scripts/bongos/status.js` + the /status skill (#435) and is reusable
   // by the public status dashboard. Registered AFTER the static /versions/*
   // routes above so ':id' can't swallow them.
   // rank: public — read-only aggregate, same posture as /versions/:id/done-when.
@@ -257,7 +257,7 @@ module.exports = function buildVersionsRouter() {
   //
   // The hierarchy had a bottom and no top: tasks close, criteria close, goals
   // close, and a version only ever moved by hand-run SQL on the droplet —
-  // `scripts/gds/version-close.js` still PRINTS that the API cannot do this (task
+  // `scripts/bongos/version-close.js` still PRINTS that the API cannot do this (task
   // 1003610, R23, points it here). A thing with no closing move does not close,
   // which is how two versions ended up building at once.
   //

package/modules/lifecycle/ship-card.js

@@ -118,7 +118,7 @@ function stageFor(postGradeStatus) {
 //               blocker/major. A dark lens beside a real finding is a rejection
 //               with a missing axis, and must keep the ordinary red card.
 //
-// The twin of this predicate is formatGradeOutcome in scripts/gds/ship-grade-steps.js,
+// The twin of this predicate is formatGradeOutcome in scripts/bongos/ship-grade-steps.js,
 // which decides the same two shapes for the CLI text. Change one, look at the other.
 function gradeUnavailability(grade) {
   const g = grade || {};
@@ -211,7 +211,7 @@ function fmtMins(n) {
   return m ? `~${h}h${m}m` : `~${h}h`;
 }
 
-// Mirrors scripts/gds/discipline-modes.json, which routes a claim to its playbook. 'ui'
+// Mirrors scripts/bongos/discipline-modes.json, which routes a claim to its playbook. 'ui'
 // was missing here, so a UI task's card sent the builder to /dev while the claim
 // had just sent them to /design (task 1003487).
 //
@@ -233,7 +233,7 @@ function nextActionFor(stage, { taskId, discipline, sandboxUrl } = {}) {
   if (stage === 'shipped') return { kind: 'prompt', label: 'Start next task', cmd: '/builder-start' };
   if (stage === 'confirmed') return { kind: 'prompt', label: 'Land it', cmd: '/merge-mode' };
   if (stage === 'held') return { kind: 'prompt', label: 'Start next task', cmd: '/builder-start' };
-  if (stage === 'failed') return { kind: 'prompt', label: 'Fix & re-grade', cmd: `node scripts/gds/ship.js ${taskId} --regrade` };
+  if (stage === 'failed') return { kind: 'prompt', label: 'Fix & re-grade', cmd: `node scripts/bongos/ship.js ${taskId} --regrade` };
   if (stage === 'review') return { kind: 'link', label: 'Open in sandbox', url: sandboxUrl || '' };
   if (stage === 'claimed') {
     const skill = DISCIPLINE_SKILL[discipline];
@@ -512,7 +512,7 @@ function buildCardModel(input = {}) {
   const action = (landBailed && land.nextStep)
     ? { kind: 'prompt', label: 'Land it', cmd: land.nextStep }
     : outage
-      ? { kind: 'prompt', label: 'Try grading again', cmd: `node scripts/gds/ship.js ${taskId} --regrade` }
+      ? { kind: 'prompt', label: 'Try grading again', cmd: `node scripts/bongos/ship.js ${taskId} --regrade` }
       : nextActionFor(stage, { taskId, discipline: input.discipline, sandboxUrl: input.sandboxUrl });
 
   return {

package/modules/lifecycle/ship-preflight.js

@@ -1,4 +1,4 @@
-// Shared helpers for scripts/gds/ship.js — extracted so the guards have unit
+// Shared helpers for scripts/bongos/ship.js — extracted so the guards have unit
 // tests instead of only being exercised via the CLI.
 // (task 1155 / ADR 0058: needs_trust gate-surface change — e2e proof that a
 //  trusted author's PR auto-merges under the enforcing gatekeeper.)

package/modules/lifecycle/task-classifier.js

@@ -414,7 +414,7 @@ const ENGINEERING_PATH_PREFIXES = [
   'src/seats.js',
   'src/rooms/',
   'src/world/',
-  'scripts/gds/',
+  'scripts/bongos/',
   'scripts/migrate',
   'scripts/snapshots/',
   'infra/',

package/modules/lifecycle/task-status.js

@@ -33,7 +33,7 @@
 //     enough on its own to bucket a task.
 //
 // NO DEPENDENCIES, deliberately. This file requires nothing — not even
-// `module-api` — so a CLI (`scripts/gds/sequence.js`) can read the vocabulary
+// `module-api` — so a CLI (`scripts/bongos/sequence.js`) can read the vocabulary
 // without dragging the server's `db.js` and its connection pool into a process
 // that only needs a Set of two strings.
 

package/modules/lifecycle/task-visual-db.js

@@ -5,7 +5,7 @@
 //
 // WHY ITS OWN FILE. These belong logically in ../db.js with the rest of the
 // lifecycle data layer — but that file is already ~5,800 lines, and the size
-// ratchet (scripts/gds/fitness-ratchets.js, task 1003129) is shrink-only: an
+// ratchet (scripts/bongos/fitness-ratchets.js, task 1003129) is shrink-only: an
 // oversized file may not grow. A feature's data access going into a small,
 // cohesive file next to the feature's storage lib is the shape that rule is
 // asking for, so this is the rule working rather than an exception to it.

package/modules/memory/learnings.js

@@ -196,7 +196,7 @@ async function findLearningsByTags(tags, { limit = 50 } = {}) {
 // learning was tagged 'infra' or 'caddyfile' (basename match).
 //
 // Consumers:
-//   - scripts/gds/claim.js calls this indirectly via
+//   - scripts/bongos/claim.js calls this indirectly via
 //     GET /api/bongos/learnings?touches=a,b,c so /builder-claim N can surface
 //     up to 3 most-recent relevant learnings right after a successful claim.
 //     Query overhead is bounded by the GIN(tags) + GIN(related_files) indexes

package/modules/memory/pollers/search-index.js

@@ -43,8 +43,8 @@ const path = require('node:path');
 const { execFile } = require('node:child_process');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
-const MD_INGESTER = path.join(REPO_ROOT, 'scripts', 'gds', 'search-ingest-md.js');
-const DB_INGESTER = path.join(REPO_ROOT, 'scripts', 'gds', 'search-ingest-db.js');
+const MD_INGESTER = path.join(REPO_ROOT, 'scripts', 'bongos', 'search-ingest-md.js');
+const DB_INGESTER = path.join(REPO_ROOT, 'scripts', 'bongos', 'search-ingest-db.js');
 
 // Nightly-ish. DB prose changes slowly and the md corpus only moves on deploy, so
 // a long period is right; the value is that it recurs at all, not that it is tight.

package/modules/memory/routes/learnings.js

@@ -5,7 +5,7 @@
 // worth exactly nothing if the next agent has to rediscover it. Learnings are the
 // short-form half of that cure (the long-form half is a recipe under
 // `docs/recipes/`): one durable, searchable rule per finding, captured via
-// `node scripts/gds/learning-capture.js` and surfaced again through `/recall`.
+// `node scripts/bongos/learning-capture.js` and surfaced again through `/recall`.
 //
 // Capture is open to any signed-in builder on purpose. The agent that just paid
 // for the discovery is the one holding it, and a rank gate on writing down what

package/modules/memory/routes/memory.js

@@ -6,7 +6,7 @@
 // src/bongos/memory.js (storeMemoryFile), last-write-wins.
 //
 // Scope of THIS task (#274 / V3.R55): the POST /memory/sync endpoint + the
-// ship.js wiring (in scripts/gds/ship.js). The READ side (GET /memory/files,
+// ship.js wiring (in scripts/bongos/ship.js). The READ side (GET /memory/files,
 // GET /memory/file) + the isolation-hardening + Archon forensic read land in
 // #276 (this task); the pull-on-start wiring lands in #275. Those build ON
 // this.

package/modules/memory/search.js

@@ -551,8 +551,8 @@ function classifyEmptyResult(health) {
       healthy: false,
       message: 'THE SEARCH INDEX IS EMPTY — this is an outage, not an answer. No chunk has ever been '
         + 'written, or the table was wiped and never rebuilt. Nothing can be found until an ingest '
-        + 'succeeds: run `node scripts/gds/search-ingest-md.js` (repo docs) and '
-        + '`node scripts/gds/search-ingest-db.js` (DB prose), and check their exit codes — they run '
+        + 'succeeds: run `node scripts/bongos/search-ingest-md.js` (repo docs) and '
+        + '`node scripts/bongos/search-ingest-db.js` (DB prose), and check their exit codes — they run '
         + 'best-effort from the deploy and a failure there is easy to miss (task 1002859).',
     };
   }

package/modules/npm-release/release.js

@@ -16,7 +16,7 @@
 //   requestRelease    — what the button does: the same rule the workflow applies (release-core.js,
 //                       imported, never restated), then the dispatch.
 
-const { releaseDecision } = require('../../scripts/gds/release-core.js');
+const { releaseDecision } = require('../../scripts/bongos/release-core.js');
 
 const VERSION_RE = /^\d+\.\d+\.\d+$/;
 // The ledger window the evidence reads. A candidate older than this has been superseded many

package/modules/onboarding/howto-moments.js

@@ -9,7 +9,7 @@
 //     already has (the prompt, the active claims, whether this is the session's first
 //     prompt), injects the step, and marks it read;
 //   • any other AI tool: the instance CLAUDE.md tells it to run
-//     `npx bongos howto moment <id>` (scripts/gds/howto.js), which prints the step and
+//     `npx bongos howto moment <id>` (scripts/bongos/howto.js), which prints the step and
 //     marks it read the same way.
 //
 // Short by design: at most MAX_STEPS steps, from ONE moment, per prompt. A read (or

package/modules/onboarding/newcomer-restock.js

@@ -15,7 +15,7 @@
 // Each instance is a NORMAL one-shot task (credits / ship / graduation / version-
 // progress all unchanged) with source='newcomer-template' and a monotonic source_ref
 // `tmpl:<discipline>:<template_id>:<seq>`. The chore CONTENT (and per-template floor)
-// lives in scripts/gds/newcomer-floor.templates.json; the per-discipline DEFAULT floor
+// lives in scripts/bongos/newcomer-floor.templates.json; the per-discipline DEFAULT floor
 // is in newcomer-floor.config.json. Nothing is generated — only blank copies of the
 // same chore are restocked.
 //
@@ -28,8 +28,8 @@ const path = require('node:path');
 const db = require('./db');
 
 const REPO_ROOT = path.resolve(__dirname, '../..');
-const TEMPLATES_PATH = path.join(REPO_ROOT, 'scripts/gds/newcomer-floor.templates.json');
-const CONFIG_PATH = path.join(REPO_ROOT, 'scripts/gds/newcomer-floor.config.json');
+const TEMPLATES_PATH = path.join(REPO_ROOT, 'scripts/bongos/newcomer-floor.templates.json');
+const CONFIG_PATH = path.join(REPO_ROOT, 'scripts/bongos/newcomer-floor.config.json');
 const SOURCE_TAG = 'newcomer-template';
 const HARD_MAX_MINUTES = 60;
 // The crafts THIS instance offers, read through the published doorway (the one

package/modules/onboarding/onboarding.js

@@ -8,7 +8,7 @@
 // This module is the *pure* half of the pipeline: parse a Claude Code
 // transcript, compute deterministic friction signals, build the subagent
 // prompt, validate the subagent's JSON, and shape the idea_inbox payload.
-// No filesystem, no network, no DB — that lives in scripts/gds/onboarding-*.js
+// No filesystem, no network, no DB — that lives in scripts/bongos/onboarding-*.js
 // so this stays unit-testable and side-effect free (mirrors how grader.js
 // keeps buildPrompt/validateAndScore pure while runSubagent does the I/O).
 //

package/modules/pixel-art/skills/otb-tile-generate/SKILL.md

@@ -37,7 +37,7 @@ Runs `modules/art-pipeline/pipeline/orchestrator.py` for the requested tiles. Th
 
    **View it on your sandbox without placing it in-game** (#1262): every tile you've generated — native + zoomed, with its score and critique — is served at **`https://sandbox-<login>.example.com/art`** (locally: `http://localhost:<port>/art`). This is the generated-art *gallery* (`modules/art-pipeline/generated/preview.html`), so you can show the builder what they made even when the tile isn't placed in the world yet. The atlas-rebuild in-game step below is only needed once you actually want it *in the playable world*.
 
-6. **See it in-game on your sandbox** (#1067): run `node scripts/gds/art-stage.js` (**ships with the `art-pipeline` host module, not the portable core** — absent from a core-only checkout, where this step doesn't apply) — it rebuilds the atlas the client loads, surfaces it on your sandbox live preview (`sandbox-<login>.example.com`, ADR 0044), and prints the URL + affected tiles. With the auto-reload (task 1065) an already-open tab refreshes itself. (The family/refresh runs also accept `--stage` to do this automatically: `family_orchestrator.py <id> --publish --stage`, `refresh_all.py --stage`.) Only a genuinely NEW base-tile *type* still needs a `public/game/world/tilePalette.js` mapping edit; an updated existing tile just needs the atlas rebuild above.
+6. **See it in-game on your sandbox** (#1067): run `node scripts/bongos/art-stage.js` (**ships with the `art-pipeline` host module, not the portable core** — absent from a core-only checkout, where this step doesn't apply) — it rebuilds the atlas the client loads, surfaces it on your sandbox live preview (`sandbox-<login>.example.com`, ADR 0044), and prints the URL + affected tiles. With the auto-reload (task 1065) an already-open tab refreshes itself. (The family/refresh runs also accept `--stage` to do this automatically: `family_orchestrator.py <id> --publish --stage`, `refresh_all.py --stage`.) Only a genuinely NEW base-tile *type* still needs a `public/game/world/tilePalette.js` mapping edit; an updated existing tile just needs the atlas rebuild above.
 
 ## Constraints
 

package/modules/platform-identity/origin-containment.js

@@ -29,7 +29,7 @@
 // instance's own public origin — so it is not offered.
 //
 // WHY ITS OWN FILE. The rule could not simply be shared where it sat: `platform-identity.js`
-// is AT its file-size ratchet (scripts/gds/fitness-ratchets.js, 1500 lines, no headroom)
+// is AT its file-size ratchet (scripts/bongos/fitness-ratchets.js, 1500 lines, no headroom)
 // and `project-stats.js` is a different file besides — the account-visibility.js /
 // publish-gate.js / projects-feed.js precedent, taken here for the same reason. It is
 // deliberately NOT re-exported from `platform-identity.js`: both callers require it