@bongos/core 1.21.175 → 1.21.177

package/src/bongos/prelaunch-gate.js

@@ -82,7 +82,10 @@ const SUBMIT_PATHS = [SUBMIT_PATH, LEGACY_SUBMIT_PATH];
 //   /metrics  Prometheus, already access-gated on its own terms (loopback or
 //             bearer token) — double-gating it would break the scrape
 //   /version  the deploy pin check, a public commit sha
-const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__prelaunch$/, /^\/__stealth$/];
+//   /raise    the investor page (task 1004847, ADR 0384) carries its own password
+//             gate and NDA; investors are not told the pre-launch password. On an
+//             instance without the raise module the path is simply a 404.
+const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__prelaunch$/, /^\/__stealth$/, /^\/raise(\/|$)/];
 
 // PRELAUNCH_PASSWORD is primary; STEALTH_PASSWORD is the deprecated alias. This
 // is the ONE read site for either, which is what makes honouring both a single
@@ -198,10 +201,8 @@ body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;
   background:#edecee;color:#17181a}
 @media(prefers-color-scheme:dark){body{background:#000000;color:#ffffff}}
 .box{width:min(380px,100%);text-align:center}
-.dots{display:flex;gap:10px;justify-content:center;margin-bottom:22px}
-.dots i{display:block;border-radius:50%;background:#fb9569}
-.dots i:first-child{width:38px;height:38px}
-.dots i:last-child{width:28px;height:28px;background:#c9512c;align-self:flex-end}
+.mark{display:block;width:48px;height:48px;margin:0 auto 22px}
+@media(prefers-color-scheme:dark){.mark .mr{stroke:#e2e1e4}.mark .mp{fill:#e2e1e4}}
 h1{font-size:20px;font-weight:700;margin:0 0 6px}
 p{margin:0 0 20px;opacity:.72;font-size:14px}
 form{display:flex;gap:8px}
@@ -215,7 +216,7 @@ button{padding:11px 20px;border:0;border-radius:999px;background:#fb9569;color:#
 .err{margin:14px 0 0;color:#b3261e;font-size:13.5px}
 @media(prefers-color-scheme:dark){.err{color:#ffb4a8}}
 </style></head><body><div class="box">
-<div class="dots"><i></i><i></i></div>
+<svg class="mark" viewBox="0 0 200 200" aria-hidden="true"><path class="mr" d="M137 31 A78 78 0 1 0 170 66" fill="none" stroke="#17181a" stroke-width="15" stroke-linecap="round"/><circle class="mp" cx="100" cy="100" r="55" fill="#17181a"/><circle cx="156" cy="46" r="12" fill="#fb9569"/></svg>
 <h1>${name}</h1>
 <p>Not open to the world yet. Enter the password to have a look.</p>
 <form method="POST" action="${SUBMIT_PATH}">

package/src/bongos/route-rank-check.js

@@ -56,7 +56,7 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // here; a second list is a list that drifts.
 //
 // READ AS DATA, NOT require()d. ADR 0083's one-way rule forbids core from importing a
-// MODULE's code (scripts/gds/fitness.js enforces it on require edges) and this file is
+// MODULE's code (scripts/bongos/fitness.js enforces it on require edges) and this file is
 // core, so we parse the catalog's `floor:` declarations out of its SOURCE — the same
 // technique this file already applies to modules/*/routes/*.js, and the posture the
 // sibling trust primitive permission-path-check.js takes with
@@ -779,7 +779,7 @@ const PATH_LOOKAHEAD = 5;
 // it. Canonicalising at the scanner fixes all of them in one place; doing it per-consumer
 // is how the contract and the gate list drift apart.
 //
-// The CONSTRAINT ITSELF still matters to one reader: scripts/gds/route-shadow-guard.js
+// The CONSTRAINT ITSELF still matters to one reader: scripts/bongos/route-shadow-guard.js
 // reads raw source with its own regex, precisely because a constrained param is the thing
 // that makes a route safe to mount before a literal. That guard must keep seeing it.
 const PARAM_CONSTRAINT_RE = /:([A-Za-z0-9_]+)\([^)]*\)/g;

package/src/bongos/routes/auth.js

@@ -645,6 +645,9 @@ module.exports = function buildAuthRouter() {
       if (err && err.code === 'NOT_APPROVED') {
         return res.status(403).json({ state: 'not_approved', error: 'not_approved' });
       }
+      if (err && err.code === 'BUILDER_INACTIVE') {
+        return res.status(403).json({ state: 'builder_inactive', error: 'builder_inactive' });
+      }
       log.error('[gds] device/poll', err);
       // 424 for the same reason as device/start above (finding W2, task 1003052):
       // this catch proxies GitHub's poll refusals too, and a 5xx body never
@@ -1011,6 +1014,16 @@ module.exports = function buildAuthRouter() {
           },
         ));
       }
+      if (err && err.code === 'BUILDER_INACTIVE') {
+        return res.status(403).type('text/html').send(renderAuthErrorPage(
+          'This account has been switched off',
+          `The GitHub account ${err.login ? `“${err.login}” ` : ''}belongs to a builder whose account has been switched off, so it can no longer sign in. If that is a mistake, ask the ${admitterLabel()} to switch it back on. To use a different GitHub account, sign in again and choose it.`,
+          {
+            subtitle: 'A switched-off account cannot sign in.',
+            cta: { href: '/builders', label: 'Go to the hall' },
+          },
+        ));
+      }
       log.error('[gds] web/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The handshake threw an error',
@@ -1308,8 +1321,8 @@ module.exports = function buildAuthRouter() {
         api_base: issuer || null,
         // A VERB, never a path (task 1003961). This string is composed HERE and run
         // THERE — on an instance, where the core is an installed dependency and
-        // `scripts/gds/` does not exist, so the previous
-        // `node scripts/gds/paste-token.js <token>` named a file the builder did not
+        // `scripts/bongos/` does not exist, so the previous
+        // `node scripts/bongos/paste-token.js <token>` named a file the builder did not
         // have and the copy button handed out a command that could not run. The verb
         // is run through `npx` (task 1004575): a builder's clone does not put bare
         // `bongos` on PATH, and `npx bongos` resolves the project's own bin there.

package/src/bongos/routes/backup.js

@@ -40,7 +40,7 @@ const DB_NAME = resolveEnv('BACKUP_DB')
   || (() => { try { return branding().db && branding().db.database; } catch { return null; } })()
   || 'gds';
 const BACKUP_SCRIPT = resolveEnv('BACKUP_SCRIPT')
-  || path.join(REPO_ROOT, 'scripts', 'gds', 'db-backup-nightly.sh');
+  || path.join(REPO_ROOT, 'scripts', 'bongos', 'db-backup-nightly.sh');
 
 // In-memory guard: true while a trigger-initiated dump is running.
 let triggerRunning = false;

package/src/bongos/routes/builders.js

@@ -205,7 +205,7 @@ function contributeBuilderDesk() {
       const mayRank = ctx.has('builder.rank.set');
       const mayStop = ctx.has('builder.status.set');
       if (!mayRank && !mayStop) return [];
-      return builderDeskRows(await db.listActiveBuilders(), { viewerId: ctx.builderId, mayRank, mayStop, ranks: db.LIVE_RANK_LADDER });
+      return builderDeskRows(await db.listActiveBuilders({ includeTesters: true }), { viewerId: ctx.builderId, mayRank, mayStop, ranks: db.LIVE_RANK_LADDER });
     },
   });
 }
@@ -394,6 +394,34 @@ module.exports = function buildBuildersRouter() {
     }
   });
 
+  // PATCH /builders/:id/tester — mark or unmark an account as a tester (task 1004845).
+  // Body: { is_tester: boolean }. A tester keeps everything it has and only drops out
+  // of the public leaderboard and the any-builder directory, so an account that exists
+  // to try the product need not be merged or archived to stay off the lists. Refuses
+  // your own account (403 cannot_change_own_tester, as PATCH /status does) and a
+  // machine principal (403 target_is_system_principal).
+  // rank: archon — changes who the public lists show. Gate:
+  // requirePermission('builder.status.set'), the same atom as deactivating an account.
+  router.patch('/builders/:id/tester', auth.requireBuilder, auth.requirePermission('builder.status.set'), async (req, res) => {
+    if (validateOrRespond(req, res, { is_tester: { required: true, type: 'boolean' } })) return;
+    const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
+    if (targetId === null) return;
+    if (String(targetId) === String(req.builder.id)) {
+      return res.fail('cannot_change_own_tester', 403);
+    }
+    try {
+      const builder = await db.setBuilderTester({ builderId: targetId, isTester: req.body.is_tester });
+      if (!builder) return res.fail('builder_not_found', 404);
+      res.json({ builder });
+    } catch (err) {
+      if (err && err.code === 'TARGET_IS_SYSTEM_PRINCIPAL') {
+        return res.fail('target_is_system_principal', 403);
+      }
+      log.error('[gds] PATCH /builders/:id/tester', err);
+      res.fail('tester_change_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // PATCH /builders/:id/budget — set or clear a builder's monthly spend ceiling
   // (V3.R84 #302, criterion C3). Archon-only. Body: { monthly_budget_usd: <num> }
   // sets the per-builder override — the manual emergency brake; a positive value

package/src/bongos/routes/me.js

@@ -75,6 +75,23 @@ function boundShipDaysToYear(rows, todayStr) {
     return o != null && o >= cutoff && o <= todayOrd;
   });
 }
+// claimsWithStreakPreview(reward, builderId, claims, streak, craftModes) — each
+// active claim with its streak_preview + craft_mode (task 1004853). The streak is
+// the one /me already computed for this request, and every claimed task's kind +
+// est_minutes comes from ONE query, so the cost is fixed however many claims the
+// builder holds. It used to call wouldExtendStreak per claim, re-running the two
+// streak queries plus a task lookup each time: 3 queries per claim, same answer.
+async function claimsWithStreakPreview(reward, builderId, claims, streak, craftModes) {
+  const list = claims || [];
+  const previews = list.length
+    ? await reward.streakPreviewsForTasks(builderId, list.map((c) => c.task_id), { streak })
+    : new Map();
+  return list.map((c) => ({
+    ...c,
+    streak_preview: previews.get(String(c.task_id)),
+    craft_mode: describeCraftMode(c.discipline, craftModes),
+  }));
+}
 // The art-pipeline "is the shared newcomer key configured?" signal, read through
 // the kernel seam (ADR 0083 / BV1.R48). The art-pipeline module provides
 // 'art.sharedKeyConfigured' when enabled; resolveOptional degrades to false on a
@@ -124,7 +141,11 @@ const discordIsLinked = (builderId) =>
 // itself runs the existing POST /tasks/:id/promote, which stays the wall.
 // `board.item.open` (task 1004714): My agents offers 'Make it a law' — a laws vote,
 // POST /government/board/laws — only to a builder who may open a board item.
-const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast', 'core.pin.move', 'idea.triage', 'board.item.open']);
+// task 1004834: idea.vote rides along so the shared vote control can hide idea
+// buttons for a viewer who cannot vote on ideas, without re-deriving it from rank.
+// `blocker.review` (task 1004824): the Blockers page and its overlay offer Resolve and
+// Link only to a builder who holds it; POST /blockers/:id/{resolve,link} stays the wall.
+const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast', 'core.pin.move', 'idea.triage', 'board.item.open', 'idea.vote', 'blocker.review']);
 
 // navPermissionsFor(builderId) → { '<atom>': boolean } over NAV_PERMISSION_ATOMS,
 // or null when authority could not be established (government off, port missing,
@@ -143,7 +164,7 @@ async function navPermissionsFor(builderId) {
   } catch (err) {
     // Message only — a resolver error can carry query text or row data. Through
     // the structured logger rather than console.*, which is ratcheted in server
-    // paths (scripts/gds/fitness-ratchets.js).
+    // paths (scripts/bongos/fitness-ratchets.js).
     log.error({ err: err && err.message }, 'GET /me nav permissions');
     return null;
   }
@@ -156,7 +177,7 @@ module.exports = function buildMeRouter() {
   // achievement metadata) + `locked_with_progress` (server-computed
   // human-readable progress hint per locked achievement) so the /builders
   // UI can render achievements without a follow-up API call. Additive only —
-  // existing keys preserved for back-compat with scripts/gds/me.js and the
+  // existing keys preserved for back-compat with scripts/bongos/me.js and the
   // /builders web client.
   //
   // V3.R24 (#244): the `builder` payload now carries `karma` (migration 040
@@ -397,11 +418,8 @@ module.exports = function buildMeRouter() {
     // role registry, so the Conductor can tell the session which playbook to open
     // for the claim in ITS worktree. Read once per request; fail-open to null.
     const craftModes = readCraftModes();
-    const activeClaimsWithPreview = await Promise.all(
-      activeClaims.map(async (c) => {
-        const preview = await reward.wouldExtendStreak(req.builder.id, c.task_id);
-        return { ...c, streak_preview: preview, craft_mode: describeCraftMode(c.discipline, craftModes) };
-      })
+    const activeClaimsWithPreview = await claimsWithStreakPreview(
+      reward, req.builder.id, activeClaims, streakInfo, craftModes
     );
     const payload = {
       builder,
@@ -715,18 +733,16 @@ module.exports = function buildMeRouter() {
     res.json({ unlocked });
   });
 
-  // Tasks this builder has shipped, most recent first.
-  // ?limit=all returns every shipped task for this builder (the /builders UI
-  // uses this to render the full "Works Wrought by Thy Hand" ledger). Numeric
-  // limits are clamped to 1..500.
+  // Tasks this builder has shipped, most recent first, plus `total` — how many
+  // there are in all. Numeric limits are clamped to 1..500. Home asks for a
+  // handful and shows `total` as its count (task 1004854: it used to download
+  // the whole history on every load and live refresh, and each row carries a
+  // per-session credits subquery). ?limit=all returns every shipped task; only
+  // the Accomplishments ledger asks for it, and only when that view is open.
   // rank: any-builder — own shipped-task ledger.
   router.get('/me/recent-ships', auth.requireBuilder, async (req, res) => {
-    const raw = req.query.limit;
-    const limit = String(raw).toLowerCase() === 'all'
-      ? 100000
-      : Math.min(Math.max(Number(raw) || 10, 1), 500);
-    const ships = await lc().recentShippedTasksByBuilder(req.builder.id, limit);
-    res.json({ ships });
+    const { ships, total } = await recentShipsPayload(lc(), req.builder.id, req.query.limit);
+    res.json({ ships, total });
   });
 
   // All seeded achievements — lets /builders render locked + unlocked side by side.
@@ -751,7 +767,22 @@ module.exports = function buildMeRouter() {
   return router;
 };
 
+// GET /me/recent-ships's answer (task 1004854): the newest `rawLimit` ships
+// ('all', or a number clamped to 1..500, default 10) and `total`, the whole count.
+// A short page needs no count query: fewer rows than asked for IS the whole list.
+async function recentShipsPayload(lifecycle, builderId, rawLimit) {
+  const all = String(rawLimit).toLowerCase() === 'all';
+  const limit = all ? 100000 : Math.min(Math.max(Number(rawLimit) || 10, 1), 500);
+  const ships = await lifecycle.recentShippedTasksByBuilder(builderId, limit);
+  const total = all || ships.length < limit
+    ? ships.length
+    : await lifecycle.countListedShipsByBuilder(builderId);
+  return { ships, total };
+}
+
 // Exported for tests only: the "bounded to a year" + timezone-safe cutoff behind the
 // contribution calendar (task 1003572). The route mounts the router; this is the one
 // pure function inside it whose correctness is worth pinning without a DB.
 module.exports.boundShipDaysToYear = boundShipDaysToYear;
+module.exports.claimsWithStreakPreview = claimsWithStreakPreview;
+module.exports.recentShipsPayload = recentShipsPayload;

package/src/bongos/routes/modules.js

@@ -81,18 +81,18 @@ const loader = require('../../module-loader/loader');
 const { restartPendingFor } = require('../../module-loader/loader');
 const catalog = require('../../module-loader/catalog');
 const modulesLib = require('../../modules');
-// scripts/gds/ is a sibling CORE-package dir (both resolve under
-// resolveCoreRoot() — see scripts/gds/CLAUDE.md), so requiring its pure fs
+// scripts/bongos/ is a sibling CORE-package dir (both resolve under
+// resolveCoreRoot() — see scripts/bongos/CLAUDE.md), so requiring its pure fs
 // logic from here is in-boundary. module.js never statically requires the CLI
 // session/fetch layer (cli-lib.js) — only cmdSubmit lazy-requires it, and only
 // when actually invoked from the CLI — so this stays safe in the always-on
 // server process.
-const moduleCli = require('../../../scripts/gds/module');
+const moduleCli = require('../../../scripts/bongos/module');
 const moduleSubmissions = require('../module-submissions');
 const moduleRechecks = require('../module-rechecks');
 const seams = require('../../module-seams');
-const moduleArtifact = require('../../../scripts/gds/module-artifact');
-const moduleAssessVersion = require('../../../scripts/gds/module-assess-version');
+const moduleArtifact = require('../../../scripts/bongos/module-artifact');
+const moduleAssessVersion = require('../../../scripts/bongos/module-assess-version');
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
@@ -102,7 +102,7 @@ const {
 const {
   isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
 } = require('../module-usage-reports');
-const { recordInstallSignals } = require('../../../scripts/gds/module-assess-installs');
+const { recordInstallSignals } = require('../../../scripts/bongos/module-assess-installs');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
 const log = require('../logger').logger.child({ src: 'modules' });
@@ -110,7 +110,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
-const { listCatalog, SORT_PARTS } = require('../module-listing');
+const { listCatalog, readListing, SORT_PARTS } = require('../module-listing');
 const { readTesting, setTester, setGeneralOnly, testsVersionsOf } = require('../module-testing');
 const { readStanding, releaseHeld } = require('../module-promotion');
 
@@ -473,7 +473,7 @@ module.exports = function buildModulesRouter() {
 
   // POST /api/bongos/store/modules/:key/versions — publish one module version to
   // the store (task 1004271, ADR 0338 D1). Body: the gzip tarball
-  // `bongos module publish` builds (scripts/gds/module-artifact.js), sent as
+  // `bongos module publish` builds (scripts/bongos/module-artifact.js), sent as
   // application/gzip. The route trusts nothing but the bytes: it recomputes every
   // hash, re-runs the publish denylist, validates module.json and checks that
   // HOWTO.md has its required sections (ADR 0347 D4) itself (verifyModuleArtifact),
@@ -534,7 +534,7 @@ module.exports = function buildModulesRouter() {
       // assessment after answering, since the Security gate asks npm about its
       // dependencies and can take a minute. The queue runs one at a time and is
       // capped; a failure is logged, never the author's error, and
-      // `node scripts/gds/module-assess-version.js <id>` re-runs it.
+      // `node scripts/bongos/module-assess-version.js <id>` re-runs it.
       setImmediate(() => moduleAssessVersion.queueAssessment(result.version.id, { log }));
     }));
 
@@ -871,6 +871,26 @@ module.exports = function buildModulesRouter() {
       res.json(listing);
     }));
 
+  // GET /api/bongos/store/modules/:key/listing — whether one module is in the
+  // catalog and why (task 1003810): the reason in a sentence, what would change it,
+  // and its parts reading, weakest first. Judges the newest version, as the catalog
+  // does (readListing in module-listing.js), so an author held below the floor is
+  // never left guessing. What the Security gate found is shown to the author only.
+  //
+  // rank: any-builder — the same public store metadata the catalog and the channel
+  // read show; nothing changed, no entitlement taken.
+  router.get('/store/modules/:key/listing', auth.requireBuilder,
+    asyncHandler('GET /store/modules/:key/listing', async (req, res) => {
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const listing = await readListing(key, { viewerId: req.builder.id });
+      if (!listing) return res.fail('module_not_found', { status: 404, message: `The store has no module "${key}".` });
+      res.set('Cache-Control', 'no-store');
+      res.json(listing);
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/bongos/routes/public.js

@@ -122,7 +122,7 @@ module.exports = function buildPublicRouter() {
 
   // Per-IP read rate limit on the public surface (red-team #604 / task 1035).
   // The global limiter (routes.js) bypasses reads by design, leaving these ~13
-  // unauthenticated GETs uncapped; /public/uptime + /public/repo-health run
+  // unauthenticated GETs uncapped; /public/repo-health runs
   // multi-row 90-day aggregates per uncached call, so the surface is a DoS /
   // cost-amplification target. Mounted AFTER the CORS block on purpose: OPTIONS
   // preflights are answered above and never metered, and the ACAO header is
@@ -258,75 +258,6 @@ module.exports = function buildPublicRouter() {
     res.json(drift);
   });
 
-  // Uptime: current status + 90-day history bucketed by hour.
-  // Returns per-service: current_status, uptime_pct_90d, history (array of
-  // { hour: ISO string, up: n, total: n } for the last 90*24 hours).
-  // rank: public — uptime feed (90-day hourly history).
-  router.get('/public/uptime', async (_req, res) => {
-    try {
-      const services = ['game_server', 'api', 'database'];
-
-      // Latest check per service
-      const latestRows = await pool.query(`
-        SELECT DISTINCT ON (service)
-          service, status, latency_ms, checked_at
-        FROM uptime_checks
-        ORDER BY service, checked_at DESC
-      `);
-      const latest = {};
-      for (const r of latestRows.rows) latest[r.service] = r;
-
-      // 90-day uptime % per service
-      const pctRows = await pool.query(`
-        SELECT service,
-          ROUND(100.0 * SUM(CASE WHEN status = 'up' THEN 1 ELSE 0 END) / COUNT(*), 2) AS uptime_pct
-        FROM uptime_checks
-        WHERE checked_at > now() - interval '90 days'
-        GROUP BY service
-      `);
-      const pct = {};
-      for (const r of pctRows.rows) pct[r.service] = Number(r.uptime_pct);
-
-      // Hourly buckets for the last 90 days (for the bar history UI)
-      const histRows = await pool.query(`
-        SELECT service,
-          date_trunc('hour', checked_at) AS hour,
-          SUM(CASE WHEN status = 'up' THEN 1 ELSE 0 END) AS up,
-          COUNT(*) AS total
-        FROM uptime_checks
-        WHERE checked_at > now() - interval '90 days'
-        GROUP BY service, hour
-        ORDER BY service, hour
-      `);
-      const history = {};
-      for (const svc of services) history[svc] = [];
-      for (const r of histRows.rows) {
-        if (history[r.service]) {
-          history[r.service].push({
-            hour: r.hour,
-            up: Number(r.up),
-            total: Number(r.total),
-          });
-        }
-      }
-
-      const result = services.map((svc) => ({
-        service: svc,
-        current_status: latest[svc]?.status ?? 'unknown',
-        current_latency_ms: latest[svc]?.latency_ms ?? null,
-        last_checked_at: latest[svc]?.checked_at ?? null,
-        uptime_pct_90d: pct[svc] ?? null,
-        history: history[svc],
-      }));
-
-      res.set('Cache-Control', 'public, max-age=30');
-      res.json({ services: result });
-    } catch (err) {
-      log.error('[gds] GET /public/uptime', err);
-      res.fail('uptime_failed', 500);
-    }
-  });
-
   // PMS-V2 #197: rolling 7d quality-grade tile + 30d trend for the dashboard.
   // rank: public — rolling quality-grade tile + 30d trend.
   router.get('/public/grades', async (req, res) => {
@@ -357,7 +288,7 @@ module.exports = function buildPublicRouter() {
   });
 
   // V3.R91 #352: repo-health substrate. Latest daily snapshot from
-  // repo_health_snapshots (written by scripts/gds/repo-metrics.js) + a small
+  // repo_health_snapshots (written by scripts/bongos/repo-metrics.js) + a small
   // trailing trend so the status page can draw LOC / dead-exports / stale-
   // branch lines over time. Same auth-free + cached + JSON-shape contract as
   // the other public surfaces above. `?days=N` (1..90, default 30) sizes the
@@ -477,7 +408,7 @@ module.exports = function buildPublicRouter() {
     }
   });
 
-  // The id allow-list the doc-ref linkifier (scripts/gds/linkify-refs.js) and
+  // The id allow-list the doc-ref linkifier (scripts/bongos/linkify-refs.js) and
   // its CI gate consult to decide which bare "#NNN" are real references worth
   // rewriting — and to WHICH resolver (#629: task vs idea vs blocker, since the
   // hall resolves /#/task/N, /#/idea/N, /#/blocker/N). IDs only — no titles or

package/src/bongos/schema-lag.js

@@ -17,7 +17,7 @@
 // opt-in no running code depends on, so they are never counted.
 //
 // Surfaced as `schemaPending` on /version (a count, never the names) and logged at boot;
-// scripts/gds/deploy-divergence.js turns a non-zero count into the SessionStart alarm.
+// scripts/bongos/deploy-divergence.js turns a non-zero count into the SessionStart alarm.
 
 const fs = require('node:fs');
 const path = require('node:path');

package/src/bongos/sensitive-surfaces.js

@@ -1,7 +1,7 @@
 // MAS — single source of truth for the security-relevant file surfaces the
 // system watches. Used by BOTH the Conductor hook (.claude/hooks/conductor.js,
 // to decide when to dispatch the Hacker) and the dispatcher CLI
-// (scripts/gds/conductor-dispatch.js, for `auto` specialist selection).
+// (scripts/bongos/conductor-dispatch.js, for `auto` specialist selection).
 //
 // Defined ONCE here so the two can't drift — the Phase 4 dogfood (#439) had
 // the Hacker AND Quality workers independently flag that the set was

package/src/bongos/serve-internal.js

@@ -24,7 +24,7 @@
 // preview-server.js from drifting on the game-room list (ADR 0052).
 //
 // CORE-SAFE: this file lives under src/bongos/ and so is held to the core↔host
-// import boundary (scripts/gds/fitness.js §1) — it imports nothing from the host
+// import boundary (scripts/bongos/fitness.js §1) — it imports nothing from the host
 // game runtime (no src/db.js, no src/rooms/, no src/world/, no Colyseus). It
 // serves only static files + the GDS router, so a non-game Cloud Bongos instance
 // runs it unchanged.
@@ -39,7 +39,7 @@ const metrics = require('./metrics');
 const { logger } = require('./logger');
 const gdsAuth = require('./auth');
 const { loadIdpConfig } = require('./auth-config');
-const { buildStampedHtml } = require('../asset-version');
+const { buildStampedHtml, hashFile } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding, applyBrandConditionals } = require('../branding');
@@ -400,7 +400,7 @@ function openapiJson() {
     generate() {
       // Lazy require: boot never pays for it, and a generator hiccup is contained
       // to this one endpoint rather than taking down server start.
-      const gen = require('../../scripts/gds/gen-api-docs.js');
+      const gen = require('../../scripts/bongos/gen-api-docs.js');
       return JSON.stringify(gen.build().spec, null, 2) + '\n';
     },
   });
@@ -409,18 +409,44 @@ function openapiJson() {
 
 // The browser-global build of the generated typed client (task 1996 / R09),
 // served at /lib/bongos-client.js so classic <script> web pages can consume the
-// same generated client the CLI uses (window.BongosClient). Read once at boot
-// from clients/bongos-client/bongos-client.global.js — the SAME committed file
-// the freshness test guards, so the browser can never drift from the spec. ''
-// (→ 404) if the build is somehow absent, so a missing file fails loudly per page.
+// same generated client the CLI uses (window.BongosClient). Resolved once per
+// process, in tiers like openapiJson(): the packaged
+// clients/bongos-client/bongos-client.global.js (package-core generates it into every
+// tarball), else — a fresh checkout, where the client is gitignored (task 1004866) —
+// GENERATED in-process from the live routes (gen-api-docs → gen-api-client, both pure
+// and DB-free). '' (→ 404) only if every tier fails, so a broken generator fails
+// loudly per page rather than at boot. resolveClientBundleJs is the injectable core
+// (tests/client_bundle_route.mjs).
+function resolveClientBundleJs({ candidates = [], generate } = {}) {
+  for (const p of candidates) {
+    try { const raw = fs.readFileSync(p, 'utf8'); if (raw) return raw; } catch { /* absent → next tier */ }
+  }
+  if (typeof generate === 'function') {
+    try {
+      const out = generate();
+      if (out) return out;
+    } catch (e) {
+      logger.error({ err: e && e.message }, '[client] in-process client generation failed');
+    }
+  }
+  return '';
+}
+
+// Lazy requires: boot never pays for them, and a generator hiccup is contained to
+// the one endpoint (same posture as openapiJson's generate tier).
+function generateClientBundleJs() {
+  const docs = require('../../scripts/bongos/gen-api-docs.js');
+  const client = require('../../scripts/bongos/gen-api-client.js');
+  return client.build(docs.build().spec).files['bongos-client.global.js'];
+}
+
 let _clientBundle;
 function clientBundleJs() {
   if (_clientBundle === undefined) {
-    try {
-      _clientBundle = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/bongos-client.global.js'), 'utf8');
-    } catch {
-      _clientBundle = '';
-    }
+    _clientBundle = resolveClientBundleJs({
+      candidates: [path.join(ROOT, 'clients/bongos-client/bongos-client.global.js')],
+      generate: generateClientBundleJs,
+    });
   }
   return _clientBundle;
 }
@@ -618,7 +644,7 @@ function mountInternalSurfaces(app) {
   // V3.R01-followup (#308, 2026-05-13) after a repo audit confirmed no caller
   // still hits the legacy path. Read-side back-compat for the `pms_session`
   // cookie, the `PMS_GITHUB_*` env vars, and the `~/.config/otb/pms-session.json`
-  // file path continues to live in src/bongos/auth.js + scripts/gds/cli-lib.js —
+  // file path continues to live in src/bongos/auth.js + scripts/bongos/cli-lib.js —
   // those are independent of the URL surface and protect existing local
   // sessions during the rollout.
   // Machine-discovery index (task 1918): a bare GET on the API root answers with a
@@ -1076,10 +1102,33 @@ function mountInternalSurfaces(app) {
   // the browser to /api/bongos/auth/web/start, which (per src/bongos/routes/auth.js)
   // loops back to /builders with a gds_session cookie set.
   const BUILDERS_DIR = path.join(ROOT, 'modules', 'hall-ui', 'public');
+  // task 1004855: a hall file requested with ?v=<its CURRENT content hash> — the
+  // URL every stamped page link carries (buildStampedHtml below) — can never name
+  // different bytes, so the browser may keep it for a year instead of re-checking
+  // ~26 files a minute after each page view. Only an exact match earns it: a page
+  // fetched just before a deploy (old hash), a hand-typed ?v=, or a bare URL keeps
+  // the short lifetime below, so a changed file is still picked up on the next
+  // load. The hash is memoised per file and re-read when its mtime/size moves.
+  const fingerprintCache = new Map();
+  function isCurrentFingerprint(res, filePath, stat) {
+    const v = res.req && res.req.query && res.req.query.v;
+    if (typeof v !== 'string' || !/^[0-9a-f]{12}$/.test(v)) return false;
+    const key = stat ? `${stat.mtimeMs}:${stat.size}` : '';
+    let hit = fingerprintCache.get(filePath);
+    if (!hit || hit.key !== key) {
+      hit = { key, hash: hashFile(filePath) };
+      fingerprintCache.set(filePath, hit);
+    }
+    return hit.hash === v;
+  }
   const buildersStatic = express.static(BUILDERS_DIR, {
     extensions: ['html'],
-    setHeaders: (res, filePath) => {
-      if (/\.(html|js|json)$/.test(filePath)) {
+    setHeaders: (res, filePath, stat) => {
+      if (/\.(css|js)$/.test(filePath) && isCurrentFingerprint(res, filePath, stat)) {
+        res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+      } else if (/\.(html|css|js|json)$/.test(filePath)) {
+        // css is here too: a stylesheet without its current fingerprint must turn
+        // over within a minute of a deploy, exactly like a script.
         res.setHeader('Cache-Control', 'public, max-age=60');
       } else {
         res.setHeader('Cache-Control', 'public, max-age=300');
@@ -1420,4 +1469,4 @@ function mountInternalSurfaces(app) {
   return app;
 }
 
-module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };
+module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, resolveClientBundleJs, generateClientBundleJs, clientBundleJs, tryLoadInstanceConfig };

package/src/bongos/software-update.js

@@ -11,7 +11,7 @@
 //
 // WHAT'S NEW COMES FROM THE PACKAGE'S OWN RELEASE NOTES, never from the changelog. Every CI
 // version's changelog line reads "carrier for merges landed since X", which names no work;
-// release-notes.json (scripts/gds/release-notes.js, task 1004218) is the one per-version
+// release-notes.json (scripts/bongos/release-notes.js, task 1004218) is the one per-version
 // list of what landed, and the newest package carries the whole history. The running core's
 // own copy stops at its own version, so an update's notes always come off the registry
 // (package-registry.js: streamed, cached, fail-soft).
@@ -32,7 +32,7 @@ const {
   normalizeChannel,
   resolveChannelTarget,
   compareSemver,
-} = require('../../scripts/gds/update-channel.js');
+} = require('../../scripts/bongos/update-channel.js');
 const { readRegistry } = require('./package-registry');
 
 const VERSION_RE = /^\d+\.\d+\.\d+$/;