@bongos/core 1.21.175 → 1.21.177

package/modules/copy-desk/tests/copy_no_cms.mjs

@@ -74,8 +74,8 @@ const MODULE_FILES = ['registry.js', 'flags.js', 'proposals.js', 'pages.js', 'pa
 
 console.log('copy-desk: NO LIVE CMS');
 
-await test('the route files are exactly the two the module declares', () => {
-  assert.deepEqual(ROUTE_FILES, ['routes/copy-desk-artist.js', 'routes/copy-desk.js'],
+await test('the route files are exactly the three the module declares', () => {
+  assert.deepEqual(ROUTE_FILES, ['routes/copy-desk-artist.js', 'routes/copy-desk-release.js', 'routes/copy-desk.js'],
     'a new route file is a new place a write could hide: add it here, and to the write-surface scan below');
 });
 
@@ -103,6 +103,10 @@ await test('the write surface is exactly the verbs the module defines', () => {
     // round's DRAFT through the autosave's own port call and resolver, never a
     // row here, a file, or the site.
     'POST /copy-desk/pages/:pageId/draft.docx',
+    // Task 1004837: release a round the reads cannot name. Through the lifecycle
+    // port (releaseStuckTweak): back to the /tweak queue or abandoned, with the
+    // applier's note. No row here, no file, no wording.
+    'POST /copy-desk/pages/:pageId/release',
     'POST /copy-desk/pages/:pageId/send-back',
     // TW08 (task 1004319, ADR 0341 D4, D11): the draft autosave and the
     // submit. Both write the page round's TASK DESCRIPTION through the
@@ -320,7 +324,7 @@ await test('the module manifest declares no seam another module could write copy
 await test('the applier is the only writer, it lives outside the request path, and it is path-guarded', () => {
   // The one thing in this feature that does write a surface file. Three
   // properties make that safe, and all three are pinned here.
-  const applier = readRepo('scripts/gds/copy-apply.js');
+  const applier = readRepo('scripts/bongos/copy-apply.js');
   const stripped = stripComments(applier);
 
   // 1. It is a COMMAND, not a route: nothing in the module's request path

package/modules/copy-desk/tests/copy_proposals.mjs

@@ -23,7 +23,7 @@ import { createRequire } from 'node:module';
 const HERE = path.dirname(url.fileURLToPath(import.meta.url));
 const require_ = createRequire(import.meta.url);
 const proposals = require_(path.join(HERE, '..', 'proposals.js'));
-const applier = require_(path.join(HERE, '..', '..', '..', 'scripts', 'gds', 'copy-apply.js'));
+const applier = require_(path.join(HERE, '..', '..', '..', 'scripts', 'bongos', 'copy-apply.js'));
 
 let passed = 0;
 let failed = 0;
@@ -128,7 +128,7 @@ await test('a composed proposal block parses back to the same patch', () => {
   // RUNNABLE AS WRITTEN. The task cannot know its own id while its description is
   // being composed, so the command takes none and acts on the claim you hold —
   // a placeholder here would be a step for the claimer to get wrong.
-  assert.match(body, /```bash\nnode scripts\/gds\/copy-apply\.js\n```/,
+  assert.match(body, /```bash\nnode scripts\/(?:gds|bongos)\/copy-apply\.js\n```/,
     'the task must tell its claimer the exact line that lands it, with nothing to substitute');
   assert.ok(!/<this task id>|--task <|\$\{/.test(body), 'and no placeholder survives into the instructions');
 });

package/modules/copy-desk/tests/copy_queue.mjs

@@ -29,7 +29,7 @@ async function test(name, fn) {
 
 const REG = {
   schema: 1,
-  generator: 'scripts/gds/copy-inventory.js',
+  generator: 'scripts/bongos/copy-inventory.js',
   goal: 1000074,
   counts: { strings: 3, unique_ids: 2, duplicate_ids: 1 },
   surfaces: { 'builders-hall': { at: 'modules/hall-ui/public', files: 2, strings: 3 } },

package/modules/design-styles/skills/README.md

@@ -1,6 +1,6 @@
 # `modules/design-styles/skills/` — the vetted UI skills: the policy, the roster, and why the roster is what it is
 
-The home for the design-style skills the `design-styles` module ships to every builder on every instance that turns the module on. They lived in `modules/ui-design/skills/` until task 1004470 split them out: `ui-design` stays default-on with `/design`, the sync skills, the kit and the style library, and this module is **off by default** — an instance opts in with `"design-styles": true` in `config/modules.json`, because thirteen descriptions are resident in every session whether a project designs pages or not. The policy below is unchanged by the move ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
+The home for the design-style skills the `design-styles` module ships to every builder on every instance that turns the module on. They lived in `modules/ui-design/skills/` until task 1004470 split them out: `ui-design` stays default-on with `/design`, the sync skills, the kit and the style library, and this module is **off by default** — an instance opts in with `"design-styles": true` in `config/modules.json`, because thirteen descriptions are resident in every session whether a project designs pages or not. The policy below is unchanged by the move ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/bongos/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
 
 ## The policy (enforced by `tests/ui_design_skills.mjs`, declared in [`policy.json`](policy.json))
 
@@ -8,9 +8,9 @@ A third-party skill lands here **only** as a copy of a pinned commit that:
 
 1. was scanned with `/scan-before-install` at the `default` tier or higher and reduced to **`clean` or `caution`** — a `dangerous` verdict never lands a copy, not for a skill already installed on a builder's machine, not for one that "ran the last round"; the arithmetic is the scanner's, not a session's;
 2. carries a licence on the allowlist — `Apache-2.0`, `MIT`, `BSD-2-Clause`, `BSD-3-Clause`, `CC-BY-4.0` — with the upstream `LICENSE` text beside the copy; anything else or unlicensed becomes a rebuild spec, not a copy;
-3. carries a `PROVENANCE.md` sidecar (YAML frontmatter with the fields [`policy.json`](policy.json) names: `name`, `origin`, `sourcePath`, `commit`, `licence`, `scanVerdict`, `scanTier`, `scanReport`, `scannedOn`, `vendoredOn`, then prose) — and the materialiser reads it **at copy time** (`vendoredSkillGate` in `scripts/gds/claude-materialize.js`): a vendored dir with no sidecar, an off-list licence or a verdict that may not land is refused and logged, whatever the CI test says;
+3. carries a `PROVENANCE.md` sidecar (YAML frontmatter with the fields [`policy.json`](policy.json) names: `name`, `origin`, `sourcePath`, `commit`, `licence`, `scanVerdict`, `scanTier`, `scanReport`, `scannedOn`, `vendoredOn`, then prose) — and the materialiser reads it **at copy time** (`vendoredSkillGate` in `scripts/bongos/claude-materialize.js`): a vendored dir with no sidecar, an off-list licence or a verdict that may not land is refused and logged, whatever the CI test says;
 4. opens its `SKILL.md` body with the **PLATFORM PREAMBLE** — [`PREAMBLE.md`](PREAMBLE.md), one fenced block, byte-identical in every copy so an upstream refresh is a three-way merge — which reads the instance's world (its branding pack, its design tokens, its `DESIGN.md`) before any taste rule, keeps the fifteen-token contract the only colour source, makes a style skill produce variants *inside* that world, confines image generation to hero plates and hero objects, applies the instance's taste bans, restates the platform floors and the kill switch, and points at the look-before-you-ship loop;
-5. is declared in `module.json` `contributes.skills` (the manifest stays the single declaration; an undeclared dir is not a skill) and lives under **`vendor/<name>/`** — the `vendor/` segment is the one `scripts/gds/fitness-ratchets.js` exempts from the first-party line and duplication budgets, so a 150-file upstream tree does not count as our debt. A skill the module *authors* lives at `<name>/` and is counted.
+5. is declared in `module.json` `contributes.skills` (the manifest stays the single declaration; an undeclared dir is not a skill) and lives under **`vendor/<name>/`** — the `vendor/` segment is the one `scripts/bongos/fitness-ratchets.js` exempts from the first-party line and duplication budgets, so a 150-file upstream tree does not count as our debt. A skill the module *authors* lives at `<name>/` and is counted.
 
 No auto-update: a refresh is a task that re-scans the new commit and re-applies the preamble. An instance may disable the module (`config/modules.json`), which withdraws every skill here; it may add its own skills under its own `.claude/skills/` — never by editing a vendored copy.
 
@@ -55,7 +55,7 @@ A skill the platform wrote from nothing declares the **other** origin. It lives
 |---|---|---|---|
 | `style` | first party (no upstream) | [task 1003475](https://cloudbongos.com/builders#/task/1003475) | the `/style` session: four bounded steps in which an owner authors their own look as a branding pack. SEARCH renders the nearest two library entries before asking two or three questions about feel; CREATE drafts the three files inside the contract, never a fork of a sheet and never a sixteenth token; PROVE retunes the thirteen against `contrast.js`, the styles suite, `check-mock.js` and the renders with a failure-to-fix table so the retune is arithmetic; ADOPT hands the owner the one-step switch, never writes `config/branding.json`, and files the catalogue rows. Its first output is [`../styles/blueprint`](../../ui-design/styles/README.md), the library's first cool look |
 
-**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/gds/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
+**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/bongos/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
 
 **The playwright plugin** (`claude-plugins-official`, an MCP plugin) is the LIVE browser-driving loop, where the kit is the headless one. It is a prerequisite, documented — `claude plugin install playwright@claude-plugins-official` — never vendored.
 

package/modules/design-styles/skills/imagegen-frontend-mobile/SKILL.md

@@ -57,7 +57,7 @@ The first view at 390 by 844 holds **one focal point** (the masthead or the fiel
 
 ## Step 4: the prompt, the key, the run
 
-A narrow plate is a text-free hero plate or hero object like any other, and the same rule holds: text-free hero plates and hero objects only. The prompt is the family's sentence plus the object, whole and centred, then the refusals every time: **no text, no letters, no logo, no watermark, no UI, no phone**. A portrait plate is generated at its portrait aspect, never cropped down from a landscape one, because the crop destroys the proportion the slot was sized for. Generation goes through the instance's art pipeline (the builder's own image key at the hall's settings, `/builders/settings#art-key`, or the instance's shared key); preflight the cost, generate at 2k, log the spend with `node scripts/gds/cost.js <usd> art --task-id <id>`; a white ground goes through the pipeline's background remover and the alpha is verified with `ffmpeg -vf alphaextract` before anything is called a cutout.
+A narrow plate is a text-free hero plate or hero object like any other, and the same rule holds: text-free hero plates and hero objects only. The prompt is the family's sentence plus the object, whole and centred, then the refusals every time: **no text, no letters, no logo, no watermark, no UI, no phone**. A portrait plate is generated at its portrait aspect, never cropped down from a landscape one, because the crop destroys the proportion the slot was sized for. Generation goes through the instance's art pipeline (the builder's own image key at the hall's settings, `/builders/settings#art-key`, or the instance's shared key); preflight the cost, generate at 2k, log the spend with `node scripts/bongos/cost.js <usd> art --task-id <id>`; a white ground goes through the pipeline's background remover and the alpha is verified with `ffmpeg -vf alphaextract` before anything is called a cutout.
 
 ## Step 5: the output contract
 

package/modules/design-styles/skills/imagegen-frontend-web/SKILL.md

@@ -77,7 +77,7 @@ One prompt per plate, written in this order: the object, whole and centred; the
 
 ## Step 6: the run, through the instance's key
 
-Generation goes through the instance's art pipeline: the builder's own image key at the hall's settings (`/builders/settings#art-key`) or the instance's shared key, never a credential this skill carries or a service it installs. Preflight the cost, generate at 2k, and log the spend with `node scripts/gds/cost.js <usd> art --task-id <id>` under the claim. The model ignores the black-ground instruction about one time in six and returns a white ground; a plate that must sit on a non-black ground goes through the pipeline's background remover for a real-alpha cutout, and the alpha is verified with `ffmpeg -vf alphaextract` (a `signalstats` YAVG strictly between 0 and 255 is real alpha; an image viewer that drops alpha makes a good cutout look opaque).
+Generation goes through the instance's art pipeline: the builder's own image key at the hall's settings (`/builders/settings#art-key`) or the instance's shared key, never a credential this skill carries or a service it installs. Preflight the cost, generate at 2k, and log the spend with `node scripts/bongos/cost.js <usd> art --task-id <id>` under the claim. The model ignores the black-ground instruction about one time in six and returns a white ground; a plate that must sit on a non-black ground goes through the pipeline's background remover for a real-alpha cutout, and the alpha is verified with `ffmpeg -vf alphaextract` (a `signalstats` YAVG strictly between 0 and 255 is real alpha; an image viewer that drops alpha makes a good cutout look opaque).
 
 ## Step 7: the output contract (the pair and the sidecar)
 

package/modules/discord/bug-attachments.js

@@ -60,7 +60,7 @@ const NAME_RE = /^bug-[a-z0-9]{1,40}-[0-9a-f]{16}\.(png|jpg|gif|webp)$/;
 // long as its message exists, and `GET /channels/{channel}/messages/{message}`
 // with the bot token returns a freshly-signed URL. The stored filename carries
 // the message id (`bug-<messageId>-<rand>.<ext>`), so a lost file is still
-// addressable — `scripts/gds/bug-attachment-recover.js` re-fetches it to its
+// addressable — `scripts/bongos/bug-attachment-recover.js` re-fetches it to its
 // original name (task 1004667). It stops working the day the message is deleted
 // or the channel history is gone, so our copy is still the copy to keep. All five
 // attachments this instance ever stored went missing from disk (the 2026-07-05

package/modules/discord/ship-broadcast.js

@@ -2,7 +2,7 @@
 //
 // chooseBroadcastTargets is the PURE channel-routing decision (task 990): given a
 // shipped task's security flag, which Discord channels + lines the broadcast goes
-// to. It lived in scripts/gds/ship.js; task 1045 extracted it here so BOTH the
+// to. It lived in scripts/bongos/ship.js; task 1045 extracted it here so BOTH the
 // laptop-local ship.js path AND the server-mediated publish path (ADR 0055) route
 // by the EXACT same rule — a security fix must never leak to a public channel from
 // either path. ship.js re-exports it so its existing regression test is unchanged.

package/modules/economy/achievements.js

@@ -153,7 +153,7 @@ async function evaluateAfterShip(client, builderId, taskId, changedFiles = null)
     }
   }
 
-  // gds-shipper: the shipped diff includes src/bongos/ or scripts/gds/ (falls back to touches[]).
+  // gds-shipper: the shipped diff includes src/bongos/ or scripts/bongos/ (falls back to touches[]).
   if (!await alreadyUnlocked(client, builderId, 'gds-shipper')) {
     const task = await client.query(
       'SELECT touches FROM tasks WHERE id=$1',
@@ -161,7 +161,9 @@ async function evaluateAfterShip(client, builderId, taskId, changedFiles = null)
     );
     if (task.rowCount > 0) {
       const files = filesForBadges(changedFiles, task.rows[0].touches || []);
-      if (files.some((t) => t.startsWith('src/bongos/') || t.startsWith('scripts/gds/'))) {
+      // The old scripts/ spelling (pre task 1004848) still counts: ships recorded before the move. rename-keep
+      if (files.some((t) => t.startsWith('src/bongos/') || t.startsWith('scripts/bongos/')
+        || t.startsWith('scripts/gds/'))) { // rename-keep: recorded touches[] carry the old path
         const unlocked = await unlockAchievement(client, builderId, 'gds-shipper', taskId);
         if (unlocked) results.push(unlocked);
       }
@@ -274,7 +276,7 @@ async function evaluateAfterCreditAward(client, builderId, totalBefore, totalAft
 //     builders.total_credits, credit_log), so it works no matter which ship
 //     path ran. Callers wrap it in a SAVEPOINT so it can never fail a ship.
 //   - the SINGLE SOURCE OF TRUTH for eligibility (STATE_EVALUATORS below).
-//     scripts/gds/diagnose-achievements.js and the backfill CLI import this same
+//     scripts/bongos/diagnose-achievements.js and the backfill CLI import this same
 //     list, so the stale-prefix drift that silently broke gds-shipper
 //     (idea 44/idea 50: the diagnose/backfill copies still said src/pms/) cannot
 //     recur — there is now one definition, not three.
@@ -313,7 +315,8 @@ async function eligible_gdsShipper(client, builderId) {
        FROM claims c JOIN tasks t ON t.id = c.task_id
       WHERE c.builder_id = $1 AND c.outcome = 'shipped'
         AND EXISTS (SELECT 1 FROM unnest(t.touches) AS p
-                     WHERE p LIKE 'src/bongos/%' OR p LIKE 'scripts/gds/%')
+                     WHERE p LIKE 'src/bongos/%' OR p LIKE 'scripts/bongos/%'
+                        OR p LIKE 'scripts/gds/%') -- rename-keep: recorded touches[] carry the old path
       LIMIT 1`,
     [builderId]
   );
@@ -589,7 +592,43 @@ async function getBuilderAchievements(builderId) {
 // top N (by total_credits), includes an `achievements` string[] of up to
 // `perBuilderCap` achievement IDs the builder has unlocked, sorted by
 // achievements.sort_order. No N+1: one round trip total.
-async function getLeaderboardWithAchievements(limit = 10, perBuilderCap = 5) {
+//
+// task 1004853: served from a short in-process cache. The query sums
+// total_tokens over every session_records row of every listed builder, and the
+// route already tells browsers max-age=60 — but nothing on the server cached,
+// so every hall refresh from every viewer re-ran it. Entries are keyed on the
+// arguments and live LEADERBOARD_CACHE_MS (60 s, matching the header). The
+// in-flight promise is what is cached, so concurrent first reads share one
+// query; a failed read is evicted so the next request retries.
+const LEADERBOARD_CACHE_MS = 60 * 1000;
+const leaderboardCache = new Map(); // `${limit}:${perBuilderCap}` → { at, promise }
+
+function getLeaderboardWithAchievements(limit = 10, perBuilderCap = 5) {
+  const key = `${limit}:${perBuilderCap}`;
+  const now = Date.now();
+  let hit = leaderboardCache.get(key);
+  if (!hit || now - hit.at >= LEADERBOARD_CACHE_MS) {
+    // The key comes from ?limit=&offset=, so sweep expired entries on every
+    // miss: the map holds only what the last minute asked for.
+    for (const [k, v] of leaderboardCache) {
+      if (now - v.at >= LEADERBOARD_CACHE_MS) leaderboardCache.delete(k);
+    }
+    const entry = { at: now, promise: queryLeaderboardWithAchievements(limit, perBuilderCap) };
+    leaderboardCache.set(key, entry);
+    entry.promise.catch(() => {
+      if (leaderboardCache.get(key) === entry) leaderboardCache.delete(key);
+    });
+    hit = entry;
+  }
+  // The route stamps roles onto each row; hand every caller its own copies so
+  // no request can edit the cached answer another request is served.
+  return hit.promise.then((rows) => rows.map((r) => ({ ...r })));
+}
+
+// Test seam: drop every cached leaderboard.
+function clearLeaderboardCache() { leaderboardCache.clear(); }
+
+async function queryLeaderboardWithAchievements(limit, perBuilderCap) {
   const { rows } = await pool.query(
     `SELECT b.id,
             b.github_login,
@@ -621,6 +660,7 @@ async function getLeaderboardWithAchievements(limit = 10, perBuilderCap = 5) {
                WHERE sr.builder_id = b.id
             ), 0)::bigint AS tokens_used
        FROM builders b
+      WHERE b.is_tester = false
        ORDER BY b.total_credits DESC, b.created_at ASC
        LIMIT $1`,
     [limit, perBuilderCap]
@@ -659,7 +699,8 @@ async function getLockedAchievementsProgress(builderId) {
          (SELECT COUNT(*) FROM tasks
            WHERE shipped_by = $1 AND status = 'shipped'
              AND EXISTS (SELECT 1 FROM unnest(COALESCE(touches, ARRAY[]::text[])) t
-                          WHERE t LIKE 'src/bongos/%' OR t LIKE 'scripts/gds/%')) AS pms_ships,
+                          WHERE t LIKE 'src/bongos/%' OR t LIKE 'scripts/bongos/%'
+                             OR t LIKE 'scripts/gds/%')) AS pms_ships, -- rename-keep: recorded touches[] carry the old path
          (SELECT COALESCE(b.total_credits, 0) FROM builders b WHERE b.id = $1) AS total_credits,
          (SELECT COUNT(*)
             FROM claims a
@@ -789,7 +830,7 @@ function renderProgressText(row) {
       return 'needs every page of one surface rewritten by you and approved';
     case 'gds-shipper':
       return pmsShips === 0
-        ? 'needs one shipped task touching src/bongos/ or scripts/gds/'
+        ? 'needs one shipped task touching src/bongos/ or scripts/bongos/'
         : 'keep building';
     case 'breaking-the-100c-bar': {
       const have = Math.max(0, Math.min(totalCredits, 100));
@@ -814,6 +855,7 @@ module.exports = {
   listAchievements,
   getBuilderAchievements,
   getLeaderboardWithAchievements,
+  clearLeaderboardCache,
   getLockedAchievementsProgress,
   renderProgressText,
 };

package/modules/economy/cost-classify.js

@@ -30,20 +30,20 @@ const COST_WRITE_SURFACES = [
     builder_id: 'defaults to the authed builder; a provided value must equal the caller or 403s. A builder can only attribute to themselves.',
   },
   {
-    surface: 'scripts/gds/backfill-cost.js → POST /api/bongos/cost',
-    file: 'scripts/gds/backfill-cost.js',
+    surface: 'scripts/bongos/backfill-cost.js → POST /api/bongos/cost',
+    file: 'scripts/bongos/backfill-cost.js',
     builder_id: 'inherits the POST /cost rule. Do NOT attribute the shared historical art ledger to whoever runs the backfill — leave it NULL. The audit flags it if it happens.',
   },
   {
     // ADR 0028 path 1 (#486): the 4-worker grader panel logs its own cost.
-    surface: 'scripts/gds/ship.js (grader) → POST /api/bongos/cost (source=grader)',
-    file: 'scripts/gds/ship.js',
+    surface: 'scripts/bongos/ship.js (grader) → POST /api/bongos/cost (source=grader)',
+    file: 'scripts/bongos/ship.js',
     builder_id: 'the authed shipper; category=api, source_ref=grade-<task>-<sha>. Idempotent per HEAD.',
   },
   {
     // ADR 0028 path 2 (#560): the interactive session logs its own cost.
-    surface: 'scripts/gds/session-cost.js (SessionEnd hook) → POST /api/bongos/cost (source=session)',
-    file: 'scripts/gds/session-cost.js',
+    surface: 'scripts/bongos/session-cost.js (SessionEnd hook) → POST /api/bongos/cost (source=session)',
+    file: 'scripts/bongos/session-cost.js',
     builder_id: 'the authed builder; category=api, source_ref=<session-id>, task_id=null. Idempotent per session.',
   },
   {

package/modules/economy/cost-report.js

@@ -1,7 +1,7 @@
 // modules/economy/cost-report.js — the spend read-out's text rendering (task
 // 1001621: "what did this cost, by month, category and source", the figures
 // hosting ROI is sized against). Pure (no DB, no I/O) so the CLI
-// (scripts/gds/cost-report.js) stays a thin fetch-and-print shell and the
+// (scripts/bongos/cost-report.js) stays a thin fetch-and-print shell and the
 // wording is unit-testable DB-free (tests/cost_report.mjs). Reads a
 // db.costSummary() payload / the GET /public/cost-summary response as-is.
 

package/modules/economy/cost.js

@@ -207,7 +207,7 @@ async function logCost({
 
 // task 1366 (System 1) — server-side session-cost reconciler.
 //
-// WHY THIS EXISTS. The client cost hook (scripts/gds/session-cost.js, a
+// WHY THIS EXISTS. The client cost hook (scripts/bongos/session-cost.js, a
 // SessionEnd hook) silently fails to write a cost_log row for the MAJORITY of
 // sessions: a cloud box / cowork VM / overnight agent runs with no GDS token,
 // so the hook quiet-skips, and some sessions post a digest but the cost POST

package/modules/economy/credits.js

@@ -48,6 +48,7 @@ async function leaderboard(limit = 20) {
                WHERE sr.builder_id = builders.id
             ), 0)::bigint AS tokens_used
        FROM builders
+      WHERE is_tester = false
        ORDER BY total_credits DESC, created_at ASC
        LIMIT $1`,
     [limit]
@@ -1094,7 +1095,7 @@ async function awardSessionTokenReward(
 //
 // The bonus is a flat +1 drachma when lines_removed > lines_added in the ship's
 // diff_stats (the same shortstat the grader already records in
-// signals.diff_stats — see scripts/gds/ship.js computeDiffShortstat). Net-zero
+// signals.diff_stats — see scripts/bongos/ship.js computeDiffShortstat). Net-zero
 // or net-positive ships get nothing. The credit_log description embeds the raw
 // removed/added values and the reason so the audit trail is self-explaining.
 //

package/modules/economy/idea-size.js

@@ -18,9 +18,9 @@
 // deliberate — so "the karma a thought caused" is not a quantity that exists to
 // be summed. Credits are already idea-attributed at the moment they are booked.
 //
-// WHY NO MIGRATION. scripts/gds/sequence.js flagged this task `needs_migration`,
+// WHY NO MIGRATION. scripts/bongos/sequence.js flagged this task `needs_migration`,
 // but that flag is a keyword scan of the title and description
-// (scripts/gds/sequence.js:169), not a fact about the schema. The reason key
+// (scripts/bongos/sequence.js:169), not a fact about the schema. The reason key
 // stream 1 books under ALREADY embeds the idea:
 //
 //     idea.credit.task_ship:<ideaId>:<taskId>

package/modules/economy/reward.js

@@ -141,4 +141,6 @@ module.exports = {
   get CRAFTS() { return creditsByCraftLib.CRAFTS; },
   computeStreak: (...a) => streak.computeStreak(...a),
   wouldExtendStreak: (...a) => streak.wouldExtendStreak(...a),
+  // task 1004853: /me's batched form — one streak + one task query per request.
+  streakPreviewsForTasks: (...a) => streak.streakPreviewsForTasks(...a),
 };

package/modules/economy/routes/cost.js

@@ -54,7 +54,7 @@ module.exports = function buildCostRouter() {
       // must match the authed builder — we don't let one builder attribute
       // spend to another. Archons could in theory be allowed to override
       // (e.g. for backfill), but the only existing backfill path is
-      // scripts/gds/backfill-cost.js, which runs as Lars (archon) and reads
+      // scripts/bongos/backfill-cost.js, which runs as Lars (archon) and reads
       // the historical ledger that had no builder_id anyway. Keep the rule
       // tight; relax later if/when a real cross-builder use case appears.
       builder_id: { type: 'integer', min: 1 },

package/modules/economy/streak.js

@@ -206,7 +206,7 @@ async function computeStreak(builderId, client) {
 }
 
 // -------------------------------------------------------------------------
-// Public: wouldExtendStreak(builderId, taskId, [client])
+// Public: wouldExtendStreak(builderId, taskId, [client], [{ streak }])
 //
 // Preview helper: "if this task were shipped right now (qualifying), what
 // would the streak become?" Used by /me to render hints like
@@ -217,16 +217,53 @@ async function computeStreak(builderId, client) {
 //   #354 kind='cleanup' is NO LONGER a disqualifier — cleanup/refactor ships
 //   count toward streaks like any other ship.)
 //   reason explains why (rendered by CLI).
+//   opts.streak: a computeStreak result already in hand, so the two streak
+//   queries are not re-run (task 1004853).
 // -------------------------------------------------------------------------
-async function wouldExtendStreak(builderId, taskId, client) {
+async function wouldExtendStreak(builderId, taskId, client, opts = {}) {
   const c = client || pool;
-  const cur = await computeStreak(builderId, c);
+  const cur = opts.streak || await computeStreak(builderId, c);
 
   const { rows: taskRows } = await c.query(
     'SELECT id, kind, est_minutes FROM tasks WHERE id = $1',
     [taskId]
   );
-  const task = taskRows[0];
+  return previewFromStreak(cur, taskRows[0]);
+}
+
+// -------------------------------------------------------------------------
+// Public: streakPreviewsForTasks(builderId, taskIds, { streak?, client? })
+//
+// The batched form /me uses (task 1004853). wouldExtendStreak per claim re-ran
+// computeStreak (2 queries) plus a task lookup for EVERY claim, although /me had
+// already computed the same streak once for the request: 5 claims = 15 queries
+// returning one answer. Here the streak is computed once (or handed in via
+// opts.streak) and every task's kind + est_minutes comes from ONE query, so the
+// cost is fixed however many claims the builder holds.
+//
+// Returns: Map<String(taskId), preview> — each preview the exact shape
+// wouldExtendStreak returns for that task.
+// -------------------------------------------------------------------------
+async function streakPreviewsForTasks(builderId, taskIds, opts = {}) {
+  const out = new Map();
+  const ids = [...new Set((taskIds || []).map(String))];
+  if (ids.length === 0) return out;
+  const c = opts.client || pool;
+  const cur = opts.streak || await computeStreak(builderId, c);
+  const { rows } = await c.query(
+    'SELECT id, kind, est_minutes FROM tasks WHERE id = ANY($1::bigint[])',
+    [ids]
+  );
+  const byId = new Map(rows.map((r) => [String(r.id), r]));
+  for (const id of ids) out.set(id, previewFromStreak(cur, byId.get(id)));
+  return out;
+}
+
+// -------------------------------------------------------------------------
+// Pure: the preview for one task given an already-computed streak. Shared by
+// wouldExtendStreak and streakPreviewsForTasks so the two can never disagree.
+// -------------------------------------------------------------------------
+function previewFromStreak(cur, task) {
   if (!task) {
     return { current_streak: cur.current_streak, projected_streak: cur.current_streak,
              qualifies: false, reason: 'task-not-found' };
@@ -278,6 +315,8 @@ async function wouldExtendStreak(builderId, taskId, client) {
 module.exports = {
   computeStreak,
   wouldExtendStreak,
+  streakPreviewsForTasks,
+  previewFromStreak,
   // Exported for testing
   qualifyingShipDays,
   todayInBuilderTz,

package/modules/government/asks.js

@@ -200,7 +200,7 @@ function refusalLine(errors) {
 const ASK_REQUIRED_MESSAGE = 'An AI session files a blocker with an ask: a question of at most '
   + `${ASK_RULES.question_words} words, ${ASK_RULES.options_min} or ${ASK_RULES.options_max} tap answers each with a one-line result, `
   + 'a pick and why, who it waits on, and what happens if nobody answers. Put the long text in detail. '
-  + 'Check the card first with: node scripts/gds/ask.js check <file>';
+  + 'Check the card first with: node scripts/bongos/ask.js check <file>';
 
 // How a seat reads to a person.
 function seatWords(seat) {

package/modules/government/board.js

@@ -1115,7 +1115,7 @@ async function genesisStageStatus() {
 // so R17's vote UI can grey out the anti-self case for ideas without a second
 // round trip — the SERVER still refuses regardless (castVote), this is only
 // the courtesy rendering.
-async function boardRoomView({ closedLimit = 20 } = {}) {
+async function boardRoomView({ closedLimit = 20, viewerId = null } = {}) {
   const [open, closed] = await Promise.all([
     db.listOpenBoardItems(),
     db.listClosedBoardItems(closedLimit),
@@ -1191,7 +1191,24 @@ async function boardRoomView({ closedLimit = 20 } = {}) {
       votes: votesByItem.get(String(item.id)) || [],
     };
   };
-  return { open: open.map(project), closed: closed.map(project) };
+  // task 1004825: whether THIS viewer may cast on each open sitting, so the page
+  // shows the ballot only to someone the vote route would accept — membership
+  // under the item's OWN snapshot and a clock that has not run out (castVote's
+  // checks; an author may vote, so authorship is not one). One membership answer
+  // per distinct predicate; a failed resolve is false — the ballot hides.
+  const membershipCache = new Map();
+  const mayVote = async (item) => {
+    if (viewerId == null || viewerId === '' || item.expired === true) return false;
+    const constitution = item.constitution || {};
+    const key = String(constitution.membership || '');
+    if (!membershipCache.has(key)) {
+      membershipCache.set(key, await isBoardMember(viewerId, constitution).catch(() => false));
+    }
+    return membershipCache.get(key);
+  };
+  const openOut = [];
+  for (const item of open) openOut.push({ ...project(item), viewer_may_vote: await mayVote(item) });
+  return { open: openOut, closed: closed.map(project) };
 }
 
 // ── the Constitution view (BV1.R18 of goal 1000069, criterion C3/C5) ────────

package/modules/government/catalog.js

@@ -209,6 +209,9 @@ const PERMISSIONS = [
   { key: 'task.abandon', system: false, floor: 'metic', scope: 'any', resource: 'task', verb: 'act', guards: 'POST /tasks/:id/abandon — scope removal on ANY task; undo = POST /tasks/:id/promote (ADR 0152, was archon). The cross-owner counterpart of task.abandon.own (task 1002443)' },
   { key: 'task.merge', system: false, floor: 'metic', guards: 'POST /tasks/:id/merge — mark a duplicate task merged into another (task 1001478, the idea.triage merge analogue)' },
   { key: 'task.vote', system: false, floor: 'metic', guards: 'POST /tasks/:id/vote' },
+  // task 1004834: its own key so a project can widen or narrow idea voting apart
+  // from task voting. Seeded exactly where task.vote is (same floor).
+  { key: 'idea.vote', system: false, floor: 'metic', guards: 'POST /inbox/:id/vote — a karma vote on an idea, credited to its submitter (task 1004727)' },
   { key: 'task.dependency.manage', system: false, floor: 'metic', guards: 'POST|PUT|DELETE /tasks/:id/dependencies (same-tier)' },
   { key: 'task.criterion.manage', system: false, floor: 'metic', guards: 'POST|DELETE /tasks/:id/criteria' },
   { key: 'criterion.satisfy', system: false, floor: 'metic', guards: 'POST /done-when/:id/satisfy' },

package/modules/government/migrations/government_033_idea_vote.sql

@@ -0,0 +1,46 @@
+-- government_033_idea_vote.sql — the new `idea.vote` atom, granted exactly where
+-- `task.vote` is held (task 1004834, follow-up to task 1004727).
+--
+-- WHAT IT IS. Voting on an idea (POST /inbox/:id/vote) earns karma for the
+-- idea's submitter. Task 1004727 gated it on task.vote, so one setting governed
+-- both kinds of vote; the owner chose to separate them (2026-10-23). From here a
+-- project can widen or narrow idea voting on its own.
+--
+-- NOTHING CHANGES FOR ANYONE TODAY. The grant is copied from task.vote:
+--   1. the seeded ladder — metic and archon, the catalog floor both keys share —
+--      but only where that rank still holds task.vote (a project that took
+--      task.vote away from a rank does not find idea.vote handed to it);
+--   2. every OTHER rank that holds task.vote on this project (custom ranks, a
+--      reviewer job grant, a widened floor) gets idea.vote too.
+-- So after this runs, the ranks holding idea.vote are exactly the ranks holding
+-- task.vote.
+--
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- (tests/government_seed.mjs) scans for it literally.
+-- Additive only; idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'idea.vote'
+])
+WHERE EXISTS (SELECT 1 FROM government_rank_permissions
+               WHERE rank_key = 'metic' AND permission_key = 'task.vote')
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'idea.vote'
+])
+WHERE EXISTS (SELECT 1 FROM government_rank_permissions
+               WHERE rank_key = 'archon' AND permission_key = 'task.vote')
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT rp.rank_key, 'idea.vote'
+  FROM government_rank_permissions rp
+ WHERE rp.permission_key = 'task.vote'
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;