@bongos/core 1.21.175 → 1.21.176

package/src/bongos/routes/builders.js

@@ -205,7 +205,7 @@ function contributeBuilderDesk() {
       const mayRank = ctx.has('builder.rank.set');
       const mayStop = ctx.has('builder.status.set');
       if (!mayRank && !mayStop) return [];
-      return builderDeskRows(await db.listActiveBuilders(), { viewerId: ctx.builderId, mayRank, mayStop, ranks: db.LIVE_RANK_LADDER });
+      return builderDeskRows(await db.listActiveBuilders({ includeTesters: true }), { viewerId: ctx.builderId, mayRank, mayStop, ranks: db.LIVE_RANK_LADDER });
     },
   });
 }
@@ -394,6 +394,34 @@ module.exports = function buildBuildersRouter() {
     }
   });
 
+  // PATCH /builders/:id/tester — mark or unmark an account as a tester (task 1004845).
+  // Body: { is_tester: boolean }. A tester keeps everything it has and only drops out
+  // of the public leaderboard and the any-builder directory, so an account that exists
+  // to try the product need not be merged or archived to stay off the lists. Refuses
+  // your own account (403 cannot_change_own_tester, as PATCH /status does) and a
+  // machine principal (403 target_is_system_principal).
+  // rank: archon — changes who the public lists show. Gate:
+  // requirePermission('builder.status.set'), the same atom as deactivating an account.
+  router.patch('/builders/:id/tester', auth.requireBuilder, auth.requirePermission('builder.status.set'), async (req, res) => {
+    if (validateOrRespond(req, res, { is_tester: { required: true, type: 'boolean' } })) return;
+    const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
+    if (targetId === null) return;
+    if (String(targetId) === String(req.builder.id)) {
+      return res.fail('cannot_change_own_tester', 403);
+    }
+    try {
+      const builder = await db.setBuilderTester({ builderId: targetId, isTester: req.body.is_tester });
+      if (!builder) return res.fail('builder_not_found', 404);
+      res.json({ builder });
+    } catch (err) {
+      if (err && err.code === 'TARGET_IS_SYSTEM_PRINCIPAL') {
+        return res.fail('target_is_system_principal', 403);
+      }
+      log.error('[gds] PATCH /builders/:id/tester', err);
+      res.fail('tester_change_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // PATCH /builders/:id/budget — set or clear a builder's monthly spend ceiling
   // (V3.R84 #302, criterion C3). Archon-only. Body: { monthly_budget_usd: <num> }
   // sets the per-builder override — the manual emergency brake; a positive value

package/src/bongos/routes/me.js

@@ -75,6 +75,23 @@ function boundShipDaysToYear(rows, todayStr) {
     return o != null && o >= cutoff && o <= todayOrd;
   });
 }
+// claimsWithStreakPreview(reward, builderId, claims, streak, craftModes) — each
+// active claim with its streak_preview + craft_mode (task 1004853). The streak is
+// the one /me already computed for this request, and every claimed task's kind +
+// est_minutes comes from ONE query, so the cost is fixed however many claims the
+// builder holds. It used to call wouldExtendStreak per claim, re-running the two
+// streak queries plus a task lookup each time: 3 queries per claim, same answer.
+async function claimsWithStreakPreview(reward, builderId, claims, streak, craftModes) {
+  const list = claims || [];
+  const previews = list.length
+    ? await reward.streakPreviewsForTasks(builderId, list.map((c) => c.task_id), { streak })
+    : new Map();
+  return list.map((c) => ({
+    ...c,
+    streak_preview: previews.get(String(c.task_id)),
+    craft_mode: describeCraftMode(c.discipline, craftModes),
+  }));
+}
 // The art-pipeline "is the shared newcomer key configured?" signal, read through
 // the kernel seam (ADR 0083 / BV1.R48). The art-pipeline module provides
 // 'art.sharedKeyConfigured' when enabled; resolveOptional degrades to false on a
@@ -124,7 +141,11 @@ const discordIsLinked = (builderId) =>
 // itself runs the existing POST /tasks/:id/promote, which stays the wall.
 // `board.item.open` (task 1004714): My agents offers 'Make it a law' — a laws vote,
 // POST /government/board/laws — only to a builder who may open a board item.
-const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast', 'core.pin.move', 'idea.triage', 'board.item.open']);
+// task 1004834: idea.vote rides along so the shared vote control can hide idea
+// buttons for a viewer who cannot vote on ideas, without re-deriving it from rank.
+// `blocker.review` (task 1004824): the Blockers page and its overlay offer Resolve and
+// Link only to a builder who holds it; POST /blockers/:id/{resolve,link} stays the wall.
+const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast', 'core.pin.move', 'idea.triage', 'board.item.open', 'idea.vote', 'blocker.review']);
 
 // navPermissionsFor(builderId) → { '<atom>': boolean } over NAV_PERMISSION_ATOMS,
 // or null when authority could not be established (government off, port missing,
@@ -143,7 +164,7 @@ async function navPermissionsFor(builderId) {
   } catch (err) {
     // Message only — a resolver error can carry query text or row data. Through
     // the structured logger rather than console.*, which is ratcheted in server
-    // paths (scripts/gds/fitness-ratchets.js).
+    // paths (scripts/bongos/fitness-ratchets.js).
     log.error({ err: err && err.message }, 'GET /me nav permissions');
     return null;
   }
@@ -156,7 +177,7 @@ module.exports = function buildMeRouter() {
   // achievement metadata) + `locked_with_progress` (server-computed
   // human-readable progress hint per locked achievement) so the /builders
   // UI can render achievements without a follow-up API call. Additive only —
-  // existing keys preserved for back-compat with scripts/gds/me.js and the
+  // existing keys preserved for back-compat with scripts/bongos/me.js and the
   // /builders web client.
   //
   // V3.R24 (#244): the `builder` payload now carries `karma` (migration 040
@@ -397,11 +418,8 @@ module.exports = function buildMeRouter() {
     // role registry, so the Conductor can tell the session which playbook to open
     // for the claim in ITS worktree. Read once per request; fail-open to null.
     const craftModes = readCraftModes();
-    const activeClaimsWithPreview = await Promise.all(
-      activeClaims.map(async (c) => {
-        const preview = await reward.wouldExtendStreak(req.builder.id, c.task_id);
-        return { ...c, streak_preview: preview, craft_mode: describeCraftMode(c.discipline, craftModes) };
-      })
+    const activeClaimsWithPreview = await claimsWithStreakPreview(
+      reward, req.builder.id, activeClaims, streakInfo, craftModes
     );
     const payload = {
       builder,
@@ -715,18 +733,16 @@ module.exports = function buildMeRouter() {
     res.json({ unlocked });
   });
 
-  // Tasks this builder has shipped, most recent first.
-  // ?limit=all returns every shipped task for this builder (the /builders UI
-  // uses this to render the full "Works Wrought by Thy Hand" ledger). Numeric
-  // limits are clamped to 1..500.
+  // Tasks this builder has shipped, most recent first, plus `total` — how many
+  // there are in all. Numeric limits are clamped to 1..500. Home asks for a
+  // handful and shows `total` as its count (task 1004854: it used to download
+  // the whole history on every load and live refresh, and each row carries a
+  // per-session credits subquery). ?limit=all returns every shipped task; only
+  // the Accomplishments ledger asks for it, and only when that view is open.
   // rank: any-builder — own shipped-task ledger.
   router.get('/me/recent-ships', auth.requireBuilder, async (req, res) => {
-    const raw = req.query.limit;
-    const limit = String(raw).toLowerCase() === 'all'
-      ? 100000
-      : Math.min(Math.max(Number(raw) || 10, 1), 500);
-    const ships = await lc().recentShippedTasksByBuilder(req.builder.id, limit);
-    res.json({ ships });
+    const { ships, total } = await recentShipsPayload(lc(), req.builder.id, req.query.limit);
+    res.json({ ships, total });
   });
 
   // All seeded achievements — lets /builders render locked + unlocked side by side.
@@ -751,7 +767,22 @@ module.exports = function buildMeRouter() {
   return router;
 };
 
+// GET /me/recent-ships's answer (task 1004854): the newest `rawLimit` ships
+// ('all', or a number clamped to 1..500, default 10) and `total`, the whole count.
+// A short page needs no count query: fewer rows than asked for IS the whole list.
+async function recentShipsPayload(lifecycle, builderId, rawLimit) {
+  const all = String(rawLimit).toLowerCase() === 'all';
+  const limit = all ? 100000 : Math.min(Math.max(Number(rawLimit) || 10, 1), 500);
+  const ships = await lifecycle.recentShippedTasksByBuilder(builderId, limit);
+  const total = all || ships.length < limit
+    ? ships.length
+    : await lifecycle.countListedShipsByBuilder(builderId);
+  return { ships, total };
+}
+
 // Exported for tests only: the "bounded to a year" + timezone-safe cutoff behind the
 // contribution calendar (task 1003572). The route mounts the router; this is the one
 // pure function inside it whose correctness is worth pinning without a DB.
 module.exports.boundShipDaysToYear = boundShipDaysToYear;
+module.exports.claimsWithStreakPreview = claimsWithStreakPreview;
+module.exports.recentShipsPayload = recentShipsPayload;

package/src/bongos/routes/modules.js

@@ -81,18 +81,18 @@ const loader = require('../../module-loader/loader');
 const { restartPendingFor } = require('../../module-loader/loader');
 const catalog = require('../../module-loader/catalog');
 const modulesLib = require('../../modules');
-// scripts/gds/ is a sibling CORE-package dir (both resolve under
-// resolveCoreRoot() — see scripts/gds/CLAUDE.md), so requiring its pure fs
+// scripts/bongos/ is a sibling CORE-package dir (both resolve under
+// resolveCoreRoot() — see scripts/bongos/CLAUDE.md), so requiring its pure fs
 // logic from here is in-boundary. module.js never statically requires the CLI
 // session/fetch layer (cli-lib.js) — only cmdSubmit lazy-requires it, and only
 // when actually invoked from the CLI — so this stays safe in the always-on
 // server process.
-const moduleCli = require('../../../scripts/gds/module');
+const moduleCli = require('../../../scripts/bongos/module');
 const moduleSubmissions = require('../module-submissions');
 const moduleRechecks = require('../module-rechecks');
 const seams = require('../../module-seams');
-const moduleArtifact = require('../../../scripts/gds/module-artifact');
-const moduleAssessVersion = require('../../../scripts/gds/module-assess-version');
+const moduleArtifact = require('../../../scripts/bongos/module-artifact');
+const moduleAssessVersion = require('../../../scripts/bongos/module-assess-version');
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
@@ -102,7 +102,7 @@ const {
 const {
   isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
 } = require('../module-usage-reports');
-const { recordInstallSignals } = require('../../../scripts/gds/module-assess-installs');
+const { recordInstallSignals } = require('../../../scripts/bongos/module-assess-installs');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
 const log = require('../logger').logger.child({ src: 'modules' });
@@ -110,7 +110,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
-const { listCatalog, SORT_PARTS } = require('../module-listing');
+const { listCatalog, readListing, SORT_PARTS } = require('../module-listing');
 const { readTesting, setTester, setGeneralOnly, testsVersionsOf } = require('../module-testing');
 const { readStanding, releaseHeld } = require('../module-promotion');
 
@@ -473,7 +473,7 @@ module.exports = function buildModulesRouter() {
 
   // POST /api/bongos/store/modules/:key/versions — publish one module version to
   // the store (task 1004271, ADR 0338 D1). Body: the gzip tarball
-  // `bongos module publish` builds (scripts/gds/module-artifact.js), sent as
+  // `bongos module publish` builds (scripts/bongos/module-artifact.js), sent as
   // application/gzip. The route trusts nothing but the bytes: it recomputes every
   // hash, re-runs the publish denylist, validates module.json and checks that
   // HOWTO.md has its required sections (ADR 0347 D4) itself (verifyModuleArtifact),
@@ -534,7 +534,7 @@ module.exports = function buildModulesRouter() {
       // assessment after answering, since the Security gate asks npm about its
       // dependencies and can take a minute. The queue runs one at a time and is
       // capped; a failure is logged, never the author's error, and
-      // `node scripts/gds/module-assess-version.js <id>` re-runs it.
+      // `node scripts/bongos/module-assess-version.js <id>` re-runs it.
       setImmediate(() => moduleAssessVersion.queueAssessment(result.version.id, { log }));
     }));
 
@@ -871,6 +871,26 @@ module.exports = function buildModulesRouter() {
       res.json(listing);
     }));
 
+  // GET /api/bongos/store/modules/:key/listing — whether one module is in the
+  // catalog and why (task 1003810): the reason in a sentence, what would change it,
+  // and its parts reading, weakest first. Judges the newest version, as the catalog
+  // does (readListing in module-listing.js), so an author held below the floor is
+  // never left guessing. What the Security gate found is shown to the author only.
+  //
+  // rank: any-builder — the same public store metadata the catalog and the channel
+  // read show; nothing changed, no entitlement taken.
+  router.get('/store/modules/:key/listing', auth.requireBuilder,
+    asyncHandler('GET /store/modules/:key/listing', async (req, res) => {
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const listing = await readListing(key, { viewerId: req.builder.id });
+      if (!listing) return res.fail('module_not_found', { status: 404, message: `The store has no module "${key}".` });
+      res.set('Cache-Control', 'no-store');
+      res.json(listing);
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/bongos/routes/public.js

@@ -122,7 +122,7 @@ module.exports = function buildPublicRouter() {
 
   // Per-IP read rate limit on the public surface (red-team #604 / task 1035).
   // The global limiter (routes.js) bypasses reads by design, leaving these ~13
-  // unauthenticated GETs uncapped; /public/uptime + /public/repo-health run
+  // unauthenticated GETs uncapped; /public/repo-health runs
   // multi-row 90-day aggregates per uncached call, so the surface is a DoS /
   // cost-amplification target. Mounted AFTER the CORS block on purpose: OPTIONS
   // preflights are answered above and never metered, and the ACAO header is
@@ -258,75 +258,6 @@ module.exports = function buildPublicRouter() {
     res.json(drift);
   });
 
-  // Uptime: current status + 90-day history bucketed by hour.
-  // Returns per-service: current_status, uptime_pct_90d, history (array of
-  // { hour: ISO string, up: n, total: n } for the last 90*24 hours).
-  // rank: public — uptime feed (90-day hourly history).
-  router.get('/public/uptime', async (_req, res) => {
-    try {
-      const services = ['game_server', 'api', 'database'];
-
-      // Latest check per service
-      const latestRows = await pool.query(`
-        SELECT DISTINCT ON (service)
-          service, status, latency_ms, checked_at
-        FROM uptime_checks
-        ORDER BY service, checked_at DESC
-      `);
-      const latest = {};
-      for (const r of latestRows.rows) latest[r.service] = r;
-
-      // 90-day uptime % per service
-      const pctRows = await pool.query(`
-        SELECT service,
-          ROUND(100.0 * SUM(CASE WHEN status = 'up' THEN 1 ELSE 0 END) / COUNT(*), 2) AS uptime_pct
-        FROM uptime_checks
-        WHERE checked_at > now() - interval '90 days'
-        GROUP BY service
-      `);
-      const pct = {};
-      for (const r of pctRows.rows) pct[r.service] = Number(r.uptime_pct);
-
-      // Hourly buckets for the last 90 days (for the bar history UI)
-      const histRows = await pool.query(`
-        SELECT service,
-          date_trunc('hour', checked_at) AS hour,
-          SUM(CASE WHEN status = 'up' THEN 1 ELSE 0 END) AS up,
-          COUNT(*) AS total
-        FROM uptime_checks
-        WHERE checked_at > now() - interval '90 days'
-        GROUP BY service, hour
-        ORDER BY service, hour
-      `);
-      const history = {};
-      for (const svc of services) history[svc] = [];
-      for (const r of histRows.rows) {
-        if (history[r.service]) {
-          history[r.service].push({
-            hour: r.hour,
-            up: Number(r.up),
-            total: Number(r.total),
-          });
-        }
-      }
-
-      const result = services.map((svc) => ({
-        service: svc,
-        current_status: latest[svc]?.status ?? 'unknown',
-        current_latency_ms: latest[svc]?.latency_ms ?? null,
-        last_checked_at: latest[svc]?.checked_at ?? null,
-        uptime_pct_90d: pct[svc] ?? null,
-        history: history[svc],
-      }));
-
-      res.set('Cache-Control', 'public, max-age=30');
-      res.json({ services: result });
-    } catch (err) {
-      log.error('[gds] GET /public/uptime', err);
-      res.fail('uptime_failed', 500);
-    }
-  });
-
   // PMS-V2 #197: rolling 7d quality-grade tile + 30d trend for the dashboard.
   // rank: public — rolling quality-grade tile + 30d trend.
   router.get('/public/grades', async (req, res) => {
@@ -357,7 +288,7 @@ module.exports = function buildPublicRouter() {
   });
 
   // V3.R91 #352: repo-health substrate. Latest daily snapshot from
-  // repo_health_snapshots (written by scripts/gds/repo-metrics.js) + a small
+  // repo_health_snapshots (written by scripts/bongos/repo-metrics.js) + a small
   // trailing trend so the status page can draw LOC / dead-exports / stale-
   // branch lines over time. Same auth-free + cached + JSON-shape contract as
   // the other public surfaces above. `?days=N` (1..90, default 30) sizes the
@@ -477,7 +408,7 @@ module.exports = function buildPublicRouter() {
     }
   });
 
-  // The id allow-list the doc-ref linkifier (scripts/gds/linkify-refs.js) and
+  // The id allow-list the doc-ref linkifier (scripts/bongos/linkify-refs.js) and
   // its CI gate consult to decide which bare "#NNN" are real references worth
   // rewriting — and to WHICH resolver (#629: task vs idea vs blocker, since the
   // hall resolves /#/task/N, /#/idea/N, /#/blocker/N). IDs only — no titles or

package/src/bongos/schema-lag.js

@@ -17,7 +17,7 @@
 // opt-in no running code depends on, so they are never counted.
 //
 // Surfaced as `schemaPending` on /version (a count, never the names) and logged at boot;
-// scripts/gds/deploy-divergence.js turns a non-zero count into the SessionStart alarm.
+// scripts/bongos/deploy-divergence.js turns a non-zero count into the SessionStart alarm.
 
 const fs = require('node:fs');
 const path = require('node:path');

package/src/bongos/sensitive-surfaces.js

@@ -1,7 +1,7 @@
 // MAS — single source of truth for the security-relevant file surfaces the
 // system watches. Used by BOTH the Conductor hook (.claude/hooks/conductor.js,
 // to decide when to dispatch the Hacker) and the dispatcher CLI
-// (scripts/gds/conductor-dispatch.js, for `auto` specialist selection).
+// (scripts/bongos/conductor-dispatch.js, for `auto` specialist selection).
 //
 // Defined ONCE here so the two can't drift — the Phase 4 dogfood (#439) had
 // the Hacker AND Quality workers independently flag that the set was

package/src/bongos/serve-internal.js

@@ -24,7 +24,7 @@
 // preview-server.js from drifting on the game-room list (ADR 0052).
 //
 // CORE-SAFE: this file lives under src/bongos/ and so is held to the core↔host
-// import boundary (scripts/gds/fitness.js §1) — it imports nothing from the host
+// import boundary (scripts/bongos/fitness.js §1) — it imports nothing from the host
 // game runtime (no src/db.js, no src/rooms/, no src/world/, no Colyseus). It
 // serves only static files + the GDS router, so a non-game Cloud Bongos instance
 // runs it unchanged.
@@ -39,7 +39,7 @@ const metrics = require('./metrics');
 const { logger } = require('./logger');
 const gdsAuth = require('./auth');
 const { loadIdpConfig } = require('./auth-config');
-const { buildStampedHtml } = require('../asset-version');
+const { buildStampedHtml, hashFile } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding, applyBrandConditionals } = require('../branding');
@@ -400,7 +400,7 @@ function openapiJson() {
     generate() {
       // Lazy require: boot never pays for it, and a generator hiccup is contained
       // to this one endpoint rather than taking down server start.
-      const gen = require('../../scripts/gds/gen-api-docs.js');
+      const gen = require('../../scripts/bongos/gen-api-docs.js');
       return JSON.stringify(gen.build().spec, null, 2) + '\n';
     },
   });
@@ -409,18 +409,44 @@ function openapiJson() {
 
 // The browser-global build of the generated typed client (task 1996 / R09),
 // served at /lib/bongos-client.js so classic <script> web pages can consume the
-// same generated client the CLI uses (window.BongosClient). Read once at boot
-// from clients/bongos-client/bongos-client.global.js — the SAME committed file
-// the freshness test guards, so the browser can never drift from the spec. ''
-// (→ 404) if the build is somehow absent, so a missing file fails loudly per page.
+// same generated client the CLI uses (window.BongosClient). Resolved once per
+// process, in tiers like openapiJson(): the packaged
+// clients/bongos-client/bongos-client.global.js (package-core generates it into every
+// tarball), else — a fresh checkout, where the client is gitignored (task 1004866) —
+// GENERATED in-process from the live routes (gen-api-docs → gen-api-client, both pure
+// and DB-free). '' (→ 404) only if every tier fails, so a broken generator fails
+// loudly per page rather than at boot. resolveClientBundleJs is the injectable core
+// (tests/client_bundle_route.mjs).
+function resolveClientBundleJs({ candidates = [], generate } = {}) {
+  for (const p of candidates) {
+    try { const raw = fs.readFileSync(p, 'utf8'); if (raw) return raw; } catch { /* absent → next tier */ }
+  }
+  if (typeof generate === 'function') {
+    try {
+      const out = generate();
+      if (out) return out;
+    } catch (e) {
+      logger.error({ err: e && e.message }, '[client] in-process client generation failed');
+    }
+  }
+  return '';
+}
+
+// Lazy requires: boot never pays for them, and a generator hiccup is contained to
+// the one endpoint (same posture as openapiJson's generate tier).
+function generateClientBundleJs() {
+  const docs = require('../../scripts/bongos/gen-api-docs.js');
+  const client = require('../../scripts/bongos/gen-api-client.js');
+  return client.build(docs.build().spec).files['bongos-client.global.js'];
+}
+
 let _clientBundle;
 function clientBundleJs() {
   if (_clientBundle === undefined) {
-    try {
-      _clientBundle = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/bongos-client.global.js'), 'utf8');
-    } catch {
-      _clientBundle = '';
-    }
+    _clientBundle = resolveClientBundleJs({
+      candidates: [path.join(ROOT, 'clients/bongos-client/bongos-client.global.js')],
+      generate: generateClientBundleJs,
+    });
   }
   return _clientBundle;
 }
@@ -618,7 +644,7 @@ function mountInternalSurfaces(app) {
   // V3.R01-followup (#308, 2026-05-13) after a repo audit confirmed no caller
   // still hits the legacy path. Read-side back-compat for the `pms_session`
   // cookie, the `PMS_GITHUB_*` env vars, and the `~/.config/otb/pms-session.json`
-  // file path continues to live in src/bongos/auth.js + scripts/gds/cli-lib.js —
+  // file path continues to live in src/bongos/auth.js + scripts/bongos/cli-lib.js —
   // those are independent of the URL surface and protect existing local
   // sessions during the rollout.
   // Machine-discovery index (task 1918): a bare GET on the API root answers with a
@@ -1076,10 +1102,33 @@ function mountInternalSurfaces(app) {
   // the browser to /api/bongos/auth/web/start, which (per src/bongos/routes/auth.js)
   // loops back to /builders with a gds_session cookie set.
   const BUILDERS_DIR = path.join(ROOT, 'modules', 'hall-ui', 'public');
+  // task 1004855: a hall file requested with ?v=<its CURRENT content hash> — the
+  // URL every stamped page link carries (buildStampedHtml below) — can never name
+  // different bytes, so the browser may keep it for a year instead of re-checking
+  // ~26 files a minute after each page view. Only an exact match earns it: a page
+  // fetched just before a deploy (old hash), a hand-typed ?v=, or a bare URL keeps
+  // the short lifetime below, so a changed file is still picked up on the next
+  // load. The hash is memoised per file and re-read when its mtime/size moves.
+  const fingerprintCache = new Map();
+  function isCurrentFingerprint(res, filePath, stat) {
+    const v = res.req && res.req.query && res.req.query.v;
+    if (typeof v !== 'string' || !/^[0-9a-f]{12}$/.test(v)) return false;
+    const key = stat ? `${stat.mtimeMs}:${stat.size}` : '';
+    let hit = fingerprintCache.get(filePath);
+    if (!hit || hit.key !== key) {
+      hit = { key, hash: hashFile(filePath) };
+      fingerprintCache.set(filePath, hit);
+    }
+    return hit.hash === v;
+  }
   const buildersStatic = express.static(BUILDERS_DIR, {
     extensions: ['html'],
-    setHeaders: (res, filePath) => {
-      if (/\.(html|js|json)$/.test(filePath)) {
+    setHeaders: (res, filePath, stat) => {
+      if (/\.(css|js)$/.test(filePath) && isCurrentFingerprint(res, filePath, stat)) {
+        res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+      } else if (/\.(html|css|js|json)$/.test(filePath)) {
+        // css is here too: a stylesheet without its current fingerprint must turn
+        // over within a minute of a deploy, exactly like a script.
         res.setHeader('Cache-Control', 'public, max-age=60');
       } else {
         res.setHeader('Cache-Control', 'public, max-age=300');
@@ -1420,4 +1469,4 @@ function mountInternalSurfaces(app) {
   return app;
 }
 
-module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };
+module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, resolveClientBundleJs, generateClientBundleJs, clientBundleJs, tryLoadInstanceConfig };

package/src/bongos/software-update.js

@@ -11,7 +11,7 @@
 //
 // WHAT'S NEW COMES FROM THE PACKAGE'S OWN RELEASE NOTES, never from the changelog. Every CI
 // version's changelog line reads "carrier for merges landed since X", which names no work;
-// release-notes.json (scripts/gds/release-notes.js, task 1004218) is the one per-version
+// release-notes.json (scripts/bongos/release-notes.js, task 1004218) is the one per-version
 // list of what landed, and the newest package carries the whole history. The running core's
 // own copy stops at its own version, so an update's notes always come off the registry
 // (package-registry.js: streamed, cached, fail-soft).
@@ -32,7 +32,7 @@ const {
   normalizeChannel,
   resolveChannelTarget,
   compareSemver,
-} = require('../../scripts/gds/update-channel.js');
+} = require('../../scripts/bongos/update-channel.js');
 const { readRegistry } = require('./package-registry');
 
 const VERSION_RE = /^\d+\.\d+\.\d+$/;

package/src/bongos/upgrade-hold.js

@@ -8,7 +8,7 @@
 // page and its blockers said so; the project's OWNER, in their own hall, saw only "Update
 // ready" for a version that had already been tried and undone on their project.
 //
-// NO NEW CHANNEL. The move itself is `bongos upgrade` (scripts/gds/upgrade.js), run with
+// NO NEW CHANNEL. The move itself is `bongos upgrade` (scripts/bongos/upgrade.js), run with
 // PGDATABASE set to THIS project's database, and its auto-rollback writes one row to this
 // project's own `core_upgrades` ledger: `rolled_back: <why> (attempted A → B, restored A)`.
 // So the fact is already here, in this hall's own database, written by the run that failed.
@@ -24,8 +24,8 @@
 //   • nothing newer than the tried version is offered (a newer release clears the hold —
 //     it may carry the fix, and the hub queues it).
 
-const { compareSemver } = require('../../scripts/gds/update-channel.js');
-const { upgradeReason, classifyFailure } = require('../../scripts/gds/upgrade-outcome.js');
+const { compareSemver } = require('../../scripts/bongos/update-channel.js');
+const { upgradeReason, classifyFailure } = require('../../scripts/bongos/upgrade-outcome.js');
 
 const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
 // upgrade.js rollback()'s note, exactly: `rolled_back: ${reason} (attempted F → T, restored P)`.

package/src/hall-look.js

@@ -52,13 +52,14 @@ function readLibraryLook(name, { root } = {}) {
   return ui;
 }
 
-// The favicon a looked hall shows without a logo: the chrome world's two-circle mark
-// redrawn in the look's own accent, terracotta and card.
+// The favicon a looked hall shows without a logo: the Bongos mark (task 1004846) in the
+// look's own ink with its accent as the moon, and the Night ink twin in dark mode.
 function lookFavicon(colors) {
   const c = (k) => encodeURIComponent(colors[k]);
-  return "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'>" +
-    `<circle cx='12' cy='17' r='8' fill='${c('accent')}'/><circle cx='22' cy='17' r='6' fill='${c('terracotta')}'/>` +
-    `<circle cx='12' cy='17' r='3.5' fill='${c('bgCard')}'/><circle cx='22' cy='17' r='2.5' fill='${c('bgCard')}'/></svg>`;
+  return "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 200 200'>" +
+    `<style>.r{stroke:${c('ink')}}.p{fill:${c('ink')}}@media (prefers-color-scheme:dark){.r{stroke:%23e2e1e4}.p{fill:%23e2e1e4}}</style>` +
+    "<path class='r' d='M137 31A78 78 0 1 0 170 66' fill='none' stroke-width='24' stroke-linecap='round'/>" +
+    `<circle class='p' cx='100' cy='100' r='50'/><circle cx='156' cy='46' r='18' fill='${c('accent')}'/></svg>`;
 }
 
 // What the hall wears: { name, ui } or null for its own pack. PURE given readLook.

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // the only place that use can be seen. knip credits a destructured binding and
 // not a member access on a namespace object, which is why the sibling exports
 // (`responsibilitiesFor` via src/modules.js, `ROLE_RESPONSIBILITIES` via
-// scripts/gds/gen-role-responsibilities.js) were never flagged and this one was.
+// scripts/bongos/gen-role-responsibilities.js) were never flagged and this one was.
 const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibilities');
 
 // ---------------------------------------------------------------------------
@@ -68,14 +68,14 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // grew this file past the 1500-line oversized-file fitness ratchet and made the
 // `unit` check on main permanently red — a condition every further release made
 // worse. Markdown is exempt from the .js line budget, so the ledger now grows
-// there. scripts/gds/bump-version.js still rewrites the literal below; it appends
+// there. scripts/bongos/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
 // The body behind a retired doorway export that must stay callable until the next
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.175'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.176'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/module-loader/catalog.js

@@ -34,7 +34,7 @@ const { CATEGORY_PARENTS } = require('./manifest-schema');
 
 // The core's own published + source package names. A checkout whose package.json
 // says one of these IS the core, so its modules/ IS the catalog (see
-// coreCheckout below). Mirrors CORE_PKG in scripts/gds/{init,upgrade,update-channel}.js.
+// coreCheckout below). Mirrors CORE_PKG in scripts/bongos/{init,upgrade,update-channel}.js.
 const CORE_PACKAGE_NAMES = ['@bongos/core', 'cloud-bongos'];
 
 // The credit a core-shipped module carries when its manifest declares none.

package/src/module-loader/error-tally.js

@@ -5,7 +5,7 @@
 // WHY. The store scores Reliability from a daily runtime-error count per module
 // version, but nothing on an instance counted one: the loader console.errored a
 // poller that failed to load and attributed nothing else to a module at all. This
-// file is the instance-side tally the loader feeds; scripts/gds/module-error-report.js
+// file is the instance-side tally the loader feeds; scripts/bongos/module-error-report.js
 // is the sender that turns it into reports.
 //
 // WHAT COUNTS. A request a module's router took and answered 500 (a thrown error or
@@ -42,7 +42,7 @@ const FIRST_SEND_DELAY_MS = 10 * 60 * 1000;
 const EXACT_VERSION = /^\d+\.\d+\.\d+$/;
 // The sender, rooted at this file so what the server runs is answerable by reading
 // this line (exec-path-guard, task 1003371).
-const SENDER = path.join(__dirname, '..', '..', 'scripts', 'gds', 'module-error-report.js');
+const SENDER = path.join(__dirname, '..', '..', 'scripts', 'bongos', 'module-error-report.js');
 
 function utcDay(ms = Date.now()) { return new Date(ms).toISOString().slice(0, 10); }
 
@@ -154,7 +154,7 @@ function start({ file = defaultFile(), now } = {}) {
   return file;
 }
 
-// Run the sender now and then (scripts/gds/module-error-report.js) as a child
+// Run the sender now and then (scripts/bongos/module-error-report.js) as a child
 // process. It sends nothing without a builder sign-in on this box, and only days
 // before today, so running it often is cheap and safe. Returns the timers.
 function startDailySend({ spawnImpl } = {}) {