@bongos/core 1.21.175 → 1.21.177

package/modules/autonomy/pollers/routine-timers.js

@@ -17,13 +17,13 @@
 //
 // WHY THIS EXISTS
 // ADR 0078 demoted peer-vote-tally to `mode: deterministic` and built an EXTERNAL
-// dispatcher (scripts/gds/run-routine.js) the operator was meant to wire into
+// dispatcher (scripts/bongos/run-routine.js) the operator was meant to wire into
 // cron. But nothing was ever durably scheduled — every scheduler layer (the
 // local app tasks, the session cron, the claude.ai cloud routines) was empty, so
 // the realized run count was ZERO. A deterministic routine that never fires saves
 // nothing. The routine's real work is server-side and needs no model, so the
 // durable realization is an in-process timer inside the always-on Node process —
-// the SAME pattern as the publish-reconciler / uptime-poller. No external cron, no
+// the SAME pattern as the publish-reconciler. No external cron, no
 // `claude -p`, no token spend.
 //
 //   - peer-vote-tally (weekly): folds matured peer votes into karma. The work is
@@ -38,9 +38,9 @@
 //     so over-/under-firing is harmless and a second instance can't double-fold.
 //
 // (diagram-drift was intentionally NOT made a timer: all five onboarding diagrams
-// already auto-regenerate from live facts on every deploy, so a daily drift check
-// is near-redundant; the manual `node scripts/gds/run-routine.js diagram-drift`
-// remains for on-demand use. See the ADR 0078 amendment.)
+// already auto-regenerate from live facts on every deploy. Task 1004878 retired
+// the routine outright. The daily checks that ARE timed live beside this file, in
+// daily-checks.js.)
 //
 // Mirrors the publish-reconciler contract: env-overridable interval, an UNREF'd
 // timer (never holds the process open across a systemd restart), best-effort (a
@@ -57,9 +57,11 @@
 // core load at module-discovery time, and so tests that pass deps.db bypass it.
 const api = require('../../../src/module-api');
 
-const WEEK_MS = 7 * 24 * 60 * 60_000;
+// The period comes from ../server-schedule.js, the table the merge-gate cadence check
+// (scripts/bongos/routine-schedule.js) also reads — so the two cannot disagree.
+const { periodMs } = require('../server-schedule');
 
-const PEER_VOTE_INTERVAL_MS = Number(process.env.ROUTINE_PEER_VOTE_MS) || WEEK_MS;
+const PEER_VOTE_INTERVAL_MS = Number(process.env.ROUTINE_PEER_VOTE_MS) || periodMs('peer-vote-tally');
 // First-fire delay: let the server finish binding + the other in-process pollers
 // settle before the first tally. Jitter spreads first-fire across a minute so a
 // crash-loop / deploy storm doesn't synchronize every restart's first run.

package/modules/autonomy/rank-roles.js

@@ -0,0 +1,64 @@
+'use strict';
+
+// modules/autonomy/rank-roles.js — which builders hold a rank the governance
+// backfill cannot match? (task 1002873; moved here from
+// scripts/bongos/audit-rank-roles.js in task 1004878 so the server's daily check and
+// the CLI share ONE definition).
+//
+// Pure: no I/O, no core require. The live ladder is an ARGUMENT — the poller passes
+// api.LIVE_RANK_LADDER, the CLI passes db-kernel's — because a module file reaches
+// core only through the doorway.
+
+// findRanksWithoutRoles — given roster rows and the live ladder, which builders hold
+// a rank that `governance_002`'s INNER JOIN cannot match?
+//
+// A row with NO rank at all counts: NULL fails the INNER JOIN the same way a
+// legacy value does, and reads as "fine" in every UI that renders a blank.
+function findRanksWithoutRoles(rows, liveRanks) {
+  const live = new Set(liveRanks || []);
+  return (Array.isArray(rows) ? rows : [])
+    .filter((b) => b && !live.has(b.rank))
+    .map((b) => ({
+      id: b.id != null ? String(b.id) : null,
+      // The login is what an operator needs to act; it is already visible to any
+      // caller authorised to read the roster, so this adds no exposure.
+      github_login: b.github_login || null,
+      rank: b.rank === undefined ? null : b.rank,
+      status: b.status || null,
+    }));
+}
+
+// summarize — the rank histogram, so a CLEAN run still says what it looked at.
+// A green check that prints nothing is indistinguishable from one that read
+// nothing, which is the failure mode this whole check is about.
+function summarize(rows) {
+  const counts = new Map();
+  for (const b of Array.isArray(rows) ? rows : []) {
+    const key = b && b.rank ? b.rank : '(none)';
+    counts.set(key, (counts.get(key) || 0) + 1);
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
+}
+
+// ideaFor — the one idea a finding becomes, filed by either caller.
+function ideaFor(offenders, { filedBy = 'scripts/bongos/audit-rank-roles.js' } = {}) {
+  return {
+    title: `[rank-roles] ${offenders.length} builder(s) on a rank with no governance role`,
+    bodyMd: [
+      `${offenders.length} builder(s) hold a rank with no matching governance_roles row.`,
+      '',
+      'They resolve to ZERO permissions — admitted by rank threshold under requireRank,',
+      'refused by the permission resolver, and given no reason (ADR 0151 fail-closed).',
+      '',
+      ...offenders.map((o) => `- builder ${o.id}${o.github_login ? ` (${o.github_login})` : ''} rank=${o.rank === null ? '(none)' : o.rank} status=${o.status || '?'}`),
+      '',
+      'Fix: move each to a live rank through the normal rank-change path, which rotates',
+      'the governance role in the same transaction. Not auto-repaired: changing a rank is',
+      'an authority decision, and a sweep is the wrong actor for it.',
+      '',
+      `Filed by ${filedBy} (task 1002873).`,
+    ].join('\n'),
+  };
+}
+
+module.exports = { findRanksWithoutRoles, summarize, ideaFor };

package/modules/autonomy/routes/autonomy.js

@@ -13,7 +13,7 @@
 // accident), and it is Archon-gated, because the answer decides autonomous spend.
 //
 // The decision logic is not here — it lives in the gate CLI
-// `scripts/gds/autonomy-gate.js`, deliberately OUTSIDE the module boundary, since
+// `scripts/bongos/autonomy-gate.js`, deliberately OUTSIDE the module boundary, since
 // gathering signals means reading ideas/economy/lifecycle, which a modules/ file
 // may not do. This route is a thin wrapper over its `precheck`.
 
@@ -26,7 +26,7 @@ const auth = api;
 // but stays a command; its gatherSignals reaches the ideas/economy/lifecycle reads
 // from OUTSIDE the kernel boundary, which a modules/ file may not do). scripts/ is
 // neither core internals nor a sibling module, so importing it here is allowed.
-const autonomyGate = require('../../../scripts/gds/autonomy-gate');
+const autonomyGate = require('../../../scripts/bongos/autonomy-gate');
 const db = require('../db');
 const fence = require('../fence');
 const runnerHealth = require('../runner-health');
@@ -37,7 +37,7 @@ const log = api.logger('autonomy');
 const { validateOrRespond } = api;
 
 // System 3 (task 1351): the autonomy precheck over HTTP. The deterministic
-// decision logic lives in scripts/gds/autonomy-gate.js (run directly as a CLI
+// decision logic lives in scripts/bongos/autonomy-gate.js (run directly as a CLI
 // Step 0 by the nightly routines on the droplet); this endpoint exposes the same
 // decision for any other caller. BUILT DISABLED: while OTB_AUTONOMY_ENABLED!=1
 // it always returns decision:'go' (inert).

package/modules/autonomy/server-schedule.js

@@ -0,0 +1,37 @@
+'use strict';
+
+// modules/autonomy/server-schedule.js — which routines the always-on server fires
+// itself, and how often (task 1004878).
+//
+// ONE TABLE, TWO READERS THAT MUST AGREE. The pollers in ./pollers/ take their
+// periods from here, and scripts/bongos/routine-schedule.js reads the same rows to
+// decide whether a routine's declared `cadence:` has something that fires it. Before
+// this table the only scheduler that check could see was .github/workflows/, so a
+// routine fired in-process (peer-vote-tally) read as "manual only", and the routines
+// nothing fired at all read the same way — the two cases were indistinguishable.
+//
+// Deliberately dependency-free: the merge-gate check requires this file in a plain
+// checkout with no database and no module loader.
+
+const DAY_MS = 24 * 60 * 60_000;
+const WEEK_MS = 7 * DAY_MS;
+
+// The cadence names a server row may use, and the period each one means. A subset of
+// routine-schedule.js's vocabulary: nothing in-process runs more often than daily.
+const CADENCE_MS = Object.freeze({ daily: DAY_MS, weekly: WEEK_MS });
+
+const SERVER_ROUTINES = Object.freeze([
+  { routine: 'peer-vote-tally', cadence: 'weekly', poller: 'routine-timers' },
+  { routine: 'rank-roles-audit', cadence: 'daily', poller: 'daily-checks' },
+  { routine: 'dep-audit-nightly', cadence: 'daily', poller: 'daily-checks' },
+].map(Object.freeze));
+
+// periodMs('rank-roles-audit') → 86400000. Throws on a routine the table does not
+// carry, so a poller can never quietly fall back to a period nobody declared.
+function periodMs(routine) {
+  const row = SERVER_ROUTINES.find((r) => r.routine === routine);
+  if (!row) throw new Error(`server-schedule: '${routine}' is not a server-fired routine`);
+  return CADENCE_MS[row.cadence];
+}
+
+module.exports = { SERVER_ROUTINES, CADENCE_MS, periodMs, DAY_MS, WEEK_MS };

package/modules/builder-settings/interaction-prefs.js

@@ -102,7 +102,7 @@ const FIELDS = {
   // rendering of tool calls or thinking blocks — see ADR 0271 §4. Default is
   // `show` (today's behavior) so existing builders are untouched; the ideator
   // CRAFT gets `quiet` from its claim directive instead of from this default
-  // (scripts/gds/discipline-modes.json), because the surface follows the ROLE
+  // (scripts/bongos/discipline-modes.json), because the surface follows the ROLE
   // and this key follows the PERSON.
   machinery: {
     label: 'Machinery in replies',

package/modules/builder-settings/render-prefs.js

@@ -258,7 +258,7 @@ function describeForApi(behaviorPrefs) {
     // --- levels (task 1002518) ---
     level,
     // The three booleans a card emitter needs, RESOLVED SERVER-SIDE. This is not
-    // a convenience: a CLI (scripts/gds/start.js) reaches module logic through
+    // a convenience: a CLI (scripts/bongos/start.js) reaches module logic through
     // the server, never by requiring this file, so it cannot learn what a rung
     // draws any other way. Shipping the answers keeps the ladder in one place
     // AND keeps the CLI dependency-free.

package/modules/builder-settings/routes/settings.js

@@ -114,7 +114,7 @@ module.exports = function buildBuilderSettingsRouter() {
   // The toggle list shows every sound from sound-prefs.KNOWN_SOUNDS with its
   // label/description, system default (ON), the builder's override if any, and
   // the effective enabled-state. The local player (.claude/sounds/play.js) reads
-  // a mirror of these prefs written by scripts/gds/fetch-sound-prefs.js at
+  // a mirror of these prefs written by scripts/bongos/fetch-sound-prefs.js at
   // session start — this endpoint is the source of truth.
   //
   // rank: any-builder — own profile config; mirrors the skill-prefs route.

package/modules/builder-settings/skill-prefs.js

@@ -11,7 +11,7 @@
 // classified as one of:
 //
 //   - 'script'         — pure mechanism; no LLM judgment needed. Slash
-//                        command shells out to a script in scripts/gds/ and
+//                        command shells out to a script in scripts/bongos/ and
 //                        formats the output. No model selection meaningful.
 //   - 'opus'  (default for heavy judgment) — design/strategy work the
 //                        builder really wants right.
@@ -63,7 +63,7 @@ const KNOWN_SKILLS = Object.freeze([
 // System default per skill. The audit's verdict — what runs when the
 // builder hasn't expressed a preference.
 const SKILL_DEFAULTS = Object.freeze({
-  // Pure mechanism — script wrappers around scripts/gds/*.js. No LLM
+  // Pure mechanism — script wrappers around scripts/bongos/*.js. No LLM
   // judgment needed for the wrapped operation; the slash command just
   // routes input → script → formatted output.
   'builder-start': 'script',

package/modules/builder-settings/wandering-prefs.js

@@ -83,7 +83,7 @@ const LEVEL_CONTRACT = Object.freeze({
     + 'The instant its done-when is met, report what you did and stop; your only forward '
     + 'pointer is `/builder-start` for the next task. If you notice anything beyond the claim '
     + '(a bug, an oddity, a number that looks off, an improvement), file it in one line with '
-    + '`node scripts/gds/capture.js "…"` and move on — do not raise it, explain it, or offer to '
+    + '`node scripts/bongos/capture.js "…"` and move on — do not raise it, explain it, or offer to '
     + 'investigate. In-task work is unaffected: do whatever it takes to finish the claim well.',
   focused:
     'Focus mode (wandering: Focused). Stay on your claimed task; in-task initiative is full. '
@@ -139,7 +139,7 @@ function rankWandering(rankKey) {
     : NO_RANK_WANDERING;
 }
 
-// DERIVED projections of the metadata above, kept because scripts/gds/session-eval.js
+// DERIVED projections of the metadata above, kept because scripts/bongos/session-eval.js
 // and the /me payload read them by rank. Deriving them means the two views cannot drift.
 const RANK_DEFAULT = Object.freeze(
   Object.fromEntries(Object.entries(RANK_WANDERING).map(([role, meta]) => [role, meta.default])),

package/modules/copy-desk/module.json

@@ -1,13 +1,13 @@
 {
   "key": "copy-desk",
   "title": "Copy desk (the artist's loop over user-facing text)",
-  "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/gds/copy-inventory.js (R01); this module reads it and never writes it. R03 (task 1003114) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a patch, which scripts/gds/copy-apply.js lands as a real diff under a claim — the design half's adapter.export() contract (ADR 0081) applied to text. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; a proposal is a work request with a suggested fix; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
+  "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/bongos/copy-inventory.js (R01); this module reads it and never writes it. R03 (task 1003114) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a patch, which scripts/bongos/copy-apply.js lands as a real diff under a claim — the design half's adapter.export() contract (ADR 0081) applied to text. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; a proposal is a work request with a suggested fix; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
   "version": "1.0.0",
   "coreVersion": "^1.8.0",
   "category": { "parent": "quality" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["copy-desk", "copy-desk-artist"], "migrations": true, "skills": ["tweak"], "pollers": ["stuck-page-digest"] },
+  "contributes": { "routes": ["copy-desk", "copy-desk-artist", "copy-desk-release"], "migrations": true, "skills": ["tweak"], "pollers": ["stuck-page-digest"] },
   "provides": ["copy-desk.artistStats", "copy-desk.stuckPageTweaksFor"],
   "consumes": ["lifecycle"]
 }

package/modules/copy-desk/page-data.js

@@ -2,12 +2,12 @@
 // artifacts Tweak Mode keys on (task 1004316 / BV2.TW05, ADR 0341 D1 and D3).
 //
 //   docs/page-inventory.json   every page, its surface, title and files
-//                              (scripts/gds/page-inventory.js, TW02)
+//                              (scripts/bongos/page-inventory.js, TW02)
 //   docs/page-readings.json    every page's visible lines, in page order
-//                              (scripts/gds/page-reader.js, TW04)
+//                              (scripts/bongos/page-reader.js, TW04)
 //
 // This is the first SERVER path that reads either, so both now ship in the
-// publish manifest (scripts/gds/publish-manifest.js, the copy-registry
+// publish manifest (scripts/bongos/publish-manifest.js, the copy-registry
 // precedent of ADR 0178). Same rules as registry.js, for the same reasons:
 //
 //   * READ, never written or regenerated here. The reader opens a browser; a GET
@@ -30,13 +30,13 @@ const ROOT = path.resolve(__dirname, '..', '..');
 const ARTIFACTS = Object.freeze({
   inventory: Object.freeze({
     rel: 'docs/page-inventory.json',
-    run: 'node scripts/gds/page-inventory.js',
+    run: 'node scripts/bongos/page-inventory.js',
     missing: 'page_inventory_missing',
     unreadable: 'page_inventory_unreadable',
   }),
   readings: Object.freeze({
     rel: 'docs/page-readings.json',
-    run: 'node scripts/gds/page-reader.js --stale',
+    run: 'node scripts/bongos/page-reader.js --stale',
     missing: 'page_readings_missing',
     unreadable: 'page_readings_unreadable',
   }),

package/modules/copy-desk/page-decisions.js

@@ -9,6 +9,18 @@
 'use strict';
 
 const pageStatus = require('./page-status');
+const pages = require('./pages');
+
+// The page's OPEN round, from the same read the page routes use: the last round
+// of the page that has neither shipped nor been abandoned. The one definition,
+// shared by routes/copy-desk.js and routes/copy-desk-release.js.
+function openRoundOf(tasks, pageId) {
+  const open = (tasks || []).filter((t) => {
+    const ref = pages.parseRoundRef(t.source_ref);
+    return ref && ref.page_id === pageId && t.status !== 'shipped' && t.status !== 'abandoned';
+  });
+  return open.length ? open[open.length - 1] : null;
+}
 
 // The page's round that is waiting for its artist, or the named refusal.
 // `task_id` in the body, when sent, pins the round the artist looked at: a
@@ -68,4 +80,4 @@ async function nextWaiting(lifecycle, invData, builderId, crafts) {
   return { count: q.count, page: n ? { page_id: n.page_id, title: n.title, path: n.path, task_id: n.task_id } : null };
 }
 
-module.exports = { waitingRoundOrFail, refuseDecision, nextWaiting };
+module.exports = { openRoundOf, waitingRoundOrFail, refuseDecision, nextWaiting };

package/modules/copy-desk/proposals.js

@@ -17,7 +17,7 @@
 // the copy desk is where they author; the proposal is the export. So a proposal
 // is not a row this module keeps — it is a PATCH, rendered into the description
 // of a task, which is the ledger the methodology already requires every change
-// to pass through. Nothing renders from it; scripts/gds/copy-apply.js is the
+// to pass through. Nothing renders from it; scripts/bongos/copy-apply.js is the
 // only reader, and it runs under a claim.
 //
 // WHERE THE PATCH LIVES, AND WHY IT IS A FENCED BLOCK. It has to be readable by
@@ -29,7 +29,7 @@
 // erosion ADR 0178 describes.
 //
 // PURE — no DB, no fs, no clock. Both callers import it: the route
-// (routes/copy-desk.js) composes, the applier (scripts/gds/copy-apply.js)
+// (routes/copy-desk.js) composes, the applier (scripts/bongos/copy-apply.js)
 // parses, and neither owns a second copy of the format.
 
 'use strict';
@@ -52,7 +52,7 @@ const MIN_WHY_CHARS = 10;
 const MAX_WHY_CHARS = 2000;
 
 // 400 is the registry's own upper bound on what counts as one string
-// (`looksLikeCopy` in scripts/gds/copy-inventory.js). Proposing something longer
+// (`looksLikeCopy` in scripts/bongos/copy-inventory.js). Proposing something longer
 // than the inventory can hold would produce a patch that lands and then vanishes
 // from the next registry — a change that silently un-inventories itself.
 const MAX_TEXT_CHARS = 400;
@@ -237,7 +237,7 @@ function proposalTaskBody(patch) {
     'This is a proposal, not a change — nothing has been written. Claim this task and run:',
     '',
     '```bash',
-    'node scripts/gds/copy-apply.js',
+    'node scripts/bongos/copy-apply.js',
     '```',
     '',
     'That re-derives the string’s position in the working tree, replaces exactly those characters, regenerates the copy registry and prints the diff for review. Then ship it like any other change — the grader sees the real diff.',

package/modules/copy-desk/registry.js

@@ -1,7 +1,7 @@
 // modules/copy-desk/registry.js — the READ side of R01's committed copy registry
 // (task 1003113 / R02 of goal 1000074).
 //
-// R01 (scripts/gds/copy-inventory.js) walks the tree and writes
+// R01 (scripts/bongos/copy-inventory.js) walks the tree and writes
 // docs/copy-registry.json: every user-facing string, with a stable id, the file
 // and line it lives at, and the render path that puts it in front of a person.
 // This file READS that artifact and never writes it. The generator stays a
@@ -37,7 +37,7 @@ const REGISTRY_REL = 'docs/copy-registry.json';
 const REGISTRY_ABS = path.resolve(__dirname, '..', '..', REGISTRY_REL);
 // The command that produces it — quoted verbatim to the reader when it is
 // missing or stale, so the fix never has to be looked up.
-const GENERATOR_CMD = 'node scripts/gds/copy-inventory.js';
+const GENERATOR_CMD = 'node scripts/bongos/copy-inventory.js';
 
 // mtime+size cache. The registry is a committed file that changes at deploy, not
 // per request, so re-reading and re-parsing ~1300 rows on every queue load is

package/modules/copy-desk/routes/copy-desk-release.js

@@ -0,0 +1,119 @@
+// modules/copy-desk/routes/copy-desk-release.js — move a page round the reads
+// cannot name (task 1004837).
+//
+// POST /copy-desk/pages/:pageId/release  { note, task_id? }
+//
+// A round in copy-desk's `unknown` state (an active round nobody holds, or a
+// ready round whose applied block says nothing more) counted as stuck the moment
+// it appeared, and the Studio had no action for it: its link opened the approval
+// card, which only holds rounds waiting for their artist. This is that action.
+//
+//   • a round that still carries its frozen batch goes back to the /tweak queue
+//     with the note (the send-back block, so the next applier reads why);
+//   • any other is abandoned with the note as its reason, freeing the page for a
+//     fresh round.
+// Either way the move runs through the lifecycle port (releaseStuckTweak), which
+// owns the status change, so this file writes no row, no file and no wording.
+//
+// Apart from routes/copy-desk.js because that file sits at the 1,500-line
+// ratchet. Gated on the task.abandon permission (Metic and up): releasing a
+// round is the applier's call, the floor `/tweak` and the stuck digest already
+// name; the artist's own decisions stay approve and send-back.
+//
+//   200 released | abandoned · 400 note_too_short / note_too_long ·
+//   404 unknown_page · 409 not_stuck · 409 round_moved · 403 (rank)
+
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const pages = require('../pages');
+const pageData = require('../page-data');
+const pageStatus = require('../page-status');
+const { openRoundOf } = require('../page-decisions');
+
+const log = api.logger('copy-desk');
+
+const RELEASE_BODY_SCHEMA = Object.freeze({
+  note:    { required: true, type: 'string', maxLength: pages.MAX_NOTE_CHARS * 2, minLength: 1 },
+  task_id: { type: 'string', maxLength: 20, minLength: 1 },
+});
+
+module.exports = function buildCopyDeskReleaseRouter() {
+  const router = express.Router();
+
+  // POST /copy-desk/pages/:pageId/release — release a page round the reads cannot
+  // name: back to the /tweak queue with a note when it still holds its batch,
+  // otherwise closed so the page can start fresh. Metic and up; body { note, task_id? }.
+  router.post('/copy-desk/pages/:pageId/release', api.requireBuilder, api.requirePermission('task.abandon'), async (req, res) => {
+    try {
+      if (api.validateOrRespond(req, res, RELEASE_BODY_SCHEMA)) return;
+      const pageId = String(req.params.pageId || '');
+      const inv = pageData.loadInventory();
+      const known = pages.PAGE_ID_RE.test(pageId) && inv.ok && (inv.data.pages || []).some((p) => p && p.id === pageId);
+      if (!known) {
+        return res.fail('unknown_page', 404, { page_id: pageId, what_this_means: 'There is no page with that id. Pick the page from the Studio list.' });
+      }
+      const note = pages.normalizeSentBackNote(req.body.note);
+      if (!note.ok) {
+        return res.fail(note.code, 400, {
+          ...note.detail,
+          what_this_means: `Say in one line why this round is being released, in at least ${pages.MIN_NOTE_CHARS} characters, so whoever picks the page up next knows. Nothing was changed.`,
+        });
+      }
+      const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+      if (!lifecycle || typeof lifecycle.releaseStuckTweak !== 'function' || typeof lifecycle.listPageTweakTasks !== 'function') {
+        return res.fail('lifecycle_unavailable', 503, { what_this_means: 'This instance cannot move a page round on. Nothing was changed.' });
+      }
+      const rounds = await lifecycle.listPageTweakTasks({ pageId });
+      const round = openRoundOf(rounds, pageId);
+      const state = round ? pageStatus.roundState(round) : null;
+      if (!round || state !== 'unknown') {
+        return res.fail('not_stuck', 409, {
+          page_id: pageId,
+          round: round ? { task_id: String(round.id), status: round.status, state } : null,
+          what_this_means: 'This round is not stuck. Approve or send back a page waiting for its artist from the Approval queue.',
+        });
+      }
+      if (req.body.task_id != null && String(req.body.task_id) !== String(round.id)) {
+        return res.fail('round_moved', 409, {
+          page_id: pageId,
+          round: { task_id: String(round.id) },
+          what_this_means: 'The round on this page now is a different one from the one you looked at. Open the Studio again; nothing was changed.',
+        });
+      }
+      const at = new Date().toISOString();
+      const by = String(req.builder.id);
+      const keepsBatch = round.status === 'ready' && pages.parseBatchBlock(round.description).ok;
+      const r = await lifecycle.releaseStuckTweak({
+        taskId: round.id,
+        builderId: req.builder.id,
+        expectedStatus: round.status,
+        note: note.note,
+        compose: keepsBatch ? (task) => pages.appendSentBack(task.description, { at, by, note: note.note }) : null,
+      });
+      if (r.outcome !== 'released' && r.outcome !== 'abandoned') {
+        const gone = r.outcome === 'round_moved' || r.outcome === 'not_stuck' || r.outcome === 'not_found' || r.outcome === 'wrong_source';
+        if (r.outcome === 'builder_inactive') return res.fail('builder_inactive', 403);
+        if (r.outcome === 'refused') return res.fail((r.refusal && r.refusal.code) || 'release_refused', 400, (r.refusal && r.refusal.detail) || {});
+        return res.fail(gone ? 'round_moved' : 'release_failed', 409, {
+          page_id: pageId,
+          what_this_means: 'The round changed while you were looking at it. Open the Studio again; nothing was changed.',
+        });
+      }
+      return res.json({
+        ok: true,
+        outcome: r.outcome,
+        page_id: pageId,
+        round: { task_id: String(r.task.id), status: r.task.status },
+        released: { at, by, note: note.note },
+        pr: r.pr || null,
+      });
+    } catch (err) {
+      log.error({ err }, 'POST /copy-desk/pages/:pageId/release failed');
+      if (!res.headersSent) res.fail('copy_page_release_failed', 500);
+    }
+  });
+
+  return router;
+};

package/modules/copy-desk/routes/copy-desk.js

@@ -62,7 +62,7 @@ const pageStatus = require('../page-status');
 const pages = require('../pages');
 const guarded = require('../guarded-lines');
 const docx = require('../docx');
-const { waitingRoundOrFail, refuseDecision, nextWaiting } = require('../page-decisions');
+const { openRoundOf, waitingRoundOrFail, refuseDecision, nextWaiting } = require('../page-decisions');
 const { tallyCreditRows, readArtistStats } = require('../artist-stats');
 
 const { validateOrRespond } = api;
@@ -195,7 +195,7 @@ function readingPageOrFail(res, pageId) {
   const readings = readingsState();
   if (!readings.data) {
     res.fail('readings_missing', 503, {
-      run: readings.info.run || 'node scripts/gds/page-reader.js',
+      run: readings.info.run || 'node scripts/bongos/page-reader.js',
       what_this_means: 'A draft is resolved against the committed page readings, and this instance has none. Nothing was saved.',
     });
     return null;
@@ -211,15 +211,6 @@ function readingPageOrFail(res, pageId) {
   return readingPage;
 }
 
-// The page's OPEN round, from the same read the page routes use.
-function openRoundOf(tasks, pageId) {
-  const open = (tasks || []).filter((t) => {
-    const ref = pages.parseRoundRef(t.source_ref);
-    return ref && ref.page_id === pageId && t.status !== 'shipped' && t.status !== 'abandoned';
-  });
-  return open.length ? open[open.length - 1] : null;
-}
-
 // The answer to a repeated submit: the round is in the queue (ready, a frozen
 // batch, nobody holding it) and the caller is its artist, the builder of its
 // latest web claim. Null when that is not the case.
@@ -584,7 +575,7 @@ module.exports = function buildCopyDeskRouter() {
   // strict. What it produces is a TASK carrying a patch, in the ledger every
   // change already has to pass through, which nothing renders from. The wording
   // reaches a person only after somebody claims that task, runs
-  // `node scripts/gds/copy-apply.js --task <id>`, and ships the resulting diff
+  // `node scripts/bongos/copy-apply.js --task <id>`, and ships the resulting diff
   // through the normal pipeline with the grader reading it.
   //
   // The shape is borrowed, not invented: it is `adapter.export()` from the

package/modules/copy-desk/skills/tweak/SKILL.md

@@ -16,7 +16,7 @@ You are applying ONE page an artist rewrote in the studio (Tweak Mode, ADR 0341)
 ## 1. Take the next submitted round
 
 ```bash
-node scripts/gds/api.js GET /api/bongos/copy-desk/pages --quiet
+node scripts/bongos/api.js GET /api/bongos/copy-desk/pages --quiet
 ```
 
 A round is in the queue when its page's `open_round.state` is `submitted`. Take the one with the lowest `open_round.task_id` (the oldest). None? Say "the tweak queue is empty" and stop.
@@ -24,7 +24,7 @@ A round is in the queue when its page's `open_round.state` is `submitted`. Take
 Claim it in THIS worktree, on a fresh branch from `origin/main`:
 
 ```bash
-node scripts/gds/claim.js <task-id>
+node scripts/bongos/claim.js <task-id>
 ```
 
 Read the whole printout and confirm it says "Claimed". A refusal can be silent under grep. The round sits in the version's catch-all goal: a `GOAL_MEMBERSHIP_REQUIRED` refusal means join that goal first. Writing the applied block (step 3) needs `task.edit`, which is Metic+.
@@ -32,7 +32,7 @@ Read the whole printout and confirm it says "Claimed". A refusal can be silent u
 ## 2. Render the page BEFORE
 
 ```bash
-node scripts/gds/tweak-renders.js shoot --page <page-id> --phase before --out <scratchpad>/tweak-<task-id>
+node scripts/bongos/tweak-renders.js shoot --page <page-id> --phase before --out <scratchpad>/tweak-<task-id>
 ```
 
 The page id is in the round's title, `Tweak: <title> (<page-id>)`. Four shots: desktop 1440 and phone 390, light and dark. A page that pins one mode is shot in that mode for both, and the run says so.
@@ -40,13 +40,13 @@ The page id is in the round's title, `Tweak: <title> (<page-id>)`. Four shots: d
 ## 3. Apply every line
 
 ```bash
-node scripts/gds/copy-apply.js --batch --dry-run
-node scripts/gds/copy-apply.js --batch
+node scripts/bongos/copy-apply.js --batch --dry-run
+node scripts/bongos/copy-apply.js --batch
 ```
 
 It reads the round you hold, applies every line of its `page-tweak` block by ADR 0233's rules (the `${expr}` holes go back in), regenerates the copy registry, re-reads the changed pages (it opens a browser) and records a `page-tweak-applied` block on the task.
 
-**A refused line is named, never skipped.** Each one prints `REFUSED (<code>)`: `target_gone`, `ambiguous_target`, `no_exact_span`, `placeholder_mismatch` or `path_outside_surface`. It is recorded in the applied block, and the artist sees it at approval. Do not hand-edit a refused line into place, because that would put words on the page the artist cannot see were refused. The rest of the batch still lands. Exit 2 means no line applied: release the claim (`node scripts/gds/release.js <task-id>`) and say which lines refused.
+**A refused line is named, never skipped.** Each one prints `REFUSED (<code>)`: `target_gone`, `ambiguous_target`, `no_exact_span`, `placeholder_mismatch` or `path_outside_surface`. It is recorded in the applied block, and the artist sees it at approval. Do not hand-edit a refused line into place, because that would put words on the page the artist cannot see were refused. The rest of the batch still lands. Exit 2 means no line applied: release the claim (`node scripts/bongos/release.js <task-id>`) and say which lines refused.
 
 Review `git diff`: only the artist's words changed, plus the regenerated registry and readings. Commit.
 
@@ -55,8 +55,8 @@ If a line changed `modules/hall-ui/public/shell.js` (a shared line), bump the sh
 ## 4. Render AFTER and attach all eight
 
 ```bash
-node scripts/gds/tweak-renders.js shoot --page <page-id> --phase after --out <scratchpad>/tweak-<task-id>
-node scripts/gds/tweak-renders.js attach <task-id> --dir <scratchpad>/tweak-<task-id>
+node scripts/bongos/tweak-renders.js shoot --page <page-id> --phase after --out <scratchpad>/tweak-<task-id>
+node scripts/bongos/tweak-renders.js attach <task-id> --dir <scratchpad>/tweak-<task-id>
 ```
 
 Look at the after shots yourself. If a rewritten line overflows or breaks the layout, say so in the ship notes: the artist decides, not you.
@@ -64,13 +64,13 @@ Look at the after shots yourself. If a rewritten line overflows or breaks the la
 ## 5. Ship it to wait for the artist
 
 ```bash
-node scripts/gds/ship-check.js
-node scripts/gds/ship.js <task-id> --notes-file <notes> --summary-file <summary>
+node scripts/bongos/ship-check.js
+node scripts/bongos/ship.js <task-id> --notes-file <notes> --summary-file <summary>
 ```
 
 Heal whatever ship-check names first (`git add` new files before it). Run ship.js in the background and wait for it; never pipe it through tail. On a passed grade it prints **WAITING FOR THE ARTIST**: the branch and its PR are published, auto-merge is not armed, and the task stays at `completed`. That is the finish line. Never pass `--skip-grade`: it would confirm the round past the artist.
 
-A failed grade is an ordinary one: read it (`GET /api/bongos/tasks/<task-id>?include=grade`), fix, commit, `node scripts/gds/ship.js <task-id> --regrade`. If the branch did not publish, a plain `node scripts/gds/ship.js <task-id>` publishes it again without re-grading.
+A failed grade is an ordinary one: read it (`GET /api/bongos/tasks/<task-id>?include=grade`), fix, commit, `node scripts/bongos/ship.js <task-id> --regrade`. If the branch did not publish, a plain `node scripts/bongos/ship.js <task-id>` publishes it again without re-grading.
 
 ## Unattended mode: `/tweak --page <page-id> --unattended`
 
@@ -84,7 +84,7 @@ The Autobongos tweak lane (ADR 0371 D1, D8) runs this skill with nobody at the t
 **On any halt, release and exit.** Run the matching line and stop; do not retry, and do not try another round:
 
 ```bash
-node scripts/gds/tweak-halt.js <task-id> --code <code>
+node scripts/bongos/tweak-halt.js <task-id> --code <code>
 ```
 
 | What happened | `--code` |

package/modules/copy-desk/tests/copy_flags.mjs

@@ -28,7 +28,7 @@ async function test(name, fn) {
 // never depend on what the real tree happens to say today.
 const FAKE = {
   schema: 1,
-  generator: 'scripts/gds/copy-inventory.js',
+  generator: 'scripts/bongos/copy-inventory.js',
   counts: { strings: 3, unique_ids: 2, certain: 3, heuristic: 0, duplicate_ids: 1 },
   surfaces: {
     'builders-hall': { at: 'modules/hall-ui/public', files: 2, strings: 2 },