@bongos/core 1.23.20 → 1.23.22

package/modules/lifecycle/db-analytics.js

@@ -860,12 +860,19 @@ async function tallyPeerVotes() {
     const karmaRows = [];
     for (const [builderId, net] of netByBuilder) {
       if (net === 0) continue; // no net signal → no karma row, but still mark tallied
+      karmaRows.push({ builder_id: builderId, delta: net });
+    }
+    // task 1004929: ONE insert for every credited builder, not one per builder.
+    // WITH ORDINALITY + ORDER BY keeps the karma_log ids in the order the loop
+    // inserted them (first vote seen first).
+    if (karmaRows.length) {
       await client.query(
         `INSERT INTO karma_log (builder_id, delta, reason, granted_by)
-         VALUES ($1, $2, 'peer_vote_weekly', NULL)`,
-        [builderId, net]
+         SELECT k.builder_id, k.delta, 'peer_vote_weekly', NULL::bigint
+           FROM unnest($1::bigint[], $2::int[]) WITH ORDINALITY AS k(builder_id, delta, ord)
+          ORDER BY k.ord`,
+        [karmaRows.map((r) => r.builder_id), karmaRows.map((r) => r.delta)]
       );
-      karmaRows.push({ builder_id: builderId, delta: net });
     }
     if (voteIds.length) {
       await client.query(

package/modules/lifecycle/db-goals.js

@@ -16,7 +16,7 @@ const doneWhen = require('./done-when.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql, isTerminalStatus } = require('./task-status');
 const { maintenanceGoalTitle } = require('./goal-advisory.js');
-const { SMOKE_NOT_LIKE } = require('./db-shared.js');
+const { SMOKE_NOT_LIKE, idKey } = require('./db-shared.js');
 const { executorFor, inTransaction } = require('./db-executor.js');
 // Task 1003660 — closing a goal cancels its pending invites + join requests.
 const { cancelPendingMembershipRequests } = require('./goal-close-sweep.js');
@@ -733,28 +733,43 @@ async function archiveGoalWithDispositions({ goalId, plan = [], reason }, deps =
       return { goal: goalRows[0], applied: [], alreadyArchived: true };
     }
 
-    const applied = [];
-    for (const step of plan) {
+    // task 1004929: every plan task is locked and read in ONE statement, and the
+    // active claims on them in one more, instead of two round trips per step. The
+    // locks are taken in id order (no deadlock against another batch), then the
+    // plan is walked in memory in PLAN order, so the applied list and the first
+    // error are what the per-step loop produced. `inGoal` tracks this call's own
+    // writes, so a task named twice reads the state the first step left behind.
+    const inGoal = new Map();
+    const claimedIds = new Set();
+    if (plan.length > 0) {
+      const ids = plan.map((step) => step.taskId);
       const { rows: tRows } = await client.query(
-        `SELECT id, title, status FROM tasks WHERE id = $1 AND goal_id = $2 FOR UPDATE`,
-        [step.taskId, goalId]
+        `SELECT id, title, status FROM tasks WHERE id = ANY($1::bigint[]) AND goal_id = $2 ORDER BY id FOR UPDATE`,
+        [ids, goalId]
       );
+      for (const row of tRows) inGoal.set(idKey(row.id), row);
+      const { rows: claimed } = await client.query(
+        `SELECT DISTINCT task_id FROM claims WHERE task_id = ANY($1::bigint[]) AND released_at IS NULL`, [ids]
+      );
+      for (const row of claimed) claimedIds.add(idKey(row.task_id));
+    }
+
+    const applied = [];
+    for (const step of plan) {
+      const task = inGoal.get(idKey(step.taskId));
       // The task left this goal (or shipped) while the caller was deciding. Not an
       // error: the disposition is moot, and the final re-count is what actually
       // guards the invariant. Recorded as 'skipped' so the response tells the
       // truth about what this call did rather than claiming a write it never made.
-      if (!tRows[0]) { applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_not_in_goal' }); continue; }
-      if (isTerminalStatus(tRows[0].status)) {
-        applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_already_terminal', status: tRows[0].status });
+      if (!task) { applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_not_in_goal' }); continue; }
+      if (isTerminalStatus(task.status)) {
+        applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_already_terminal', status: task.status });
         continue;
       }
 
-      const { rows: claimed } = await client.query(
-        `SELECT id FROM claims WHERE task_id = $1 AND released_at IS NULL LIMIT 1`, [step.taskId]
-      );
-      if (claimed[0]) {
+      if (claimedIds.has(idKey(step.taskId))) {
         throw Object.assign(new Error('task has an active claim'), {
-          code: 'TASK_HAS_ACTIVE_CLAIM', taskId: String(step.taskId), taskTitle: tRows[0].title,
+          code: 'TASK_HAS_ACTIVE_CLAIM', taskId: String(step.taskId), taskTitle: task.title,
         });
       }
 
@@ -766,6 +781,7 @@ async function archiveGoalWithDispositions({ goalId, plan = [], reason }, deps =
             WHERE id = $1`,
           [step.taskId, `Abandoned: ${reason}`]
         );
+        task.status = 'abandoned';
         applied.push({ task_id: String(step.taskId), verb: 'abandon', result: 'abandoned' });
       } else {
         const { rows: dest } = await client.query(
@@ -780,6 +796,7 @@ async function archiveGoalWithDispositions({ goalId, plan = [], reason }, deps =
           });
         }
         await client.query(`UPDATE tasks SET goal_id = $2, updated_at = now() WHERE id = $1`, [step.taskId, step.toGoalId]);
+        if (idKey(step.toGoalId) !== idKey(goalId)) inGoal.delete(idKey(step.taskId));
         applied.push({ task_id: String(step.taskId), verb: 'move', result: 'moved', to_goal_id: String(step.toGoalId) });
       }
     }

package/modules/lifecycle/db-shared.js

@@ -104,10 +104,19 @@ async function mostRecentClaimHolderId(client, taskId) {
   return rows[0]?.builder_id ?? null;
 }
 
+// One spelling of a bigint id as a Map key (task 1004929). pg returns bigint
+// columns as strings while a plan may carry numbers, so a batched locked read
+// (the goal archive, the version close) matches its rows back to the plan steps
+// through this on both sides. A value BigInt cannot read keeps its own string.
+function idKey(v) {
+  try { return BigInt(v).toString(); } catch { return String(v); }
+}
+
 module.exports = {
   SMOKE_NOT_LIKE,
   gradePassCount,
   gradeQualityWhere,
+  idKey,
   median,
   mostRecentClaimHolderId,
   sealSessionLog,

package/modules/lifecycle/db-versions.js

@@ -14,7 +14,7 @@ const api = require('../../src/module-api');
 const { pool, withTx } = api;
 const doneWhen = require('./done-when.js');
 const { nonTerminalSql } = require('./task-status');
-const { SMOKE_NOT_LIKE } = require('./db-shared.js');
+const { SMOKE_NOT_LIKE, idKey } = require('./db-shared.js');
 const { executorFor, inTransaction } = require('./db-executor.js');
 // db-goals.js does NOT require this file, so this direction adds no require cycle
 // (fitness pins the count). createVersion needs it to seed a version's FIRST goal
@@ -372,18 +372,29 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
       });
     }
 
-    const applied = [];
-    for (const step of plan) {
+    // task 1004929: every plan goal is locked and read in ONE statement instead of
+    // one round trip per step. Locks are taken in id order (no deadlock against
+    // another batch); the plan is then walked in memory in PLAN order, so the
+    // applied list is what the per-step loop produced. Each step's own archive is
+    // mirrored into `onVersion`, so a goal named twice reads 'archived' second time.
+    const onVersion = new Map();
+    if (plan.length > 0) {
       const { rows: gRows } = await client.query(
-        `SELECT id, title, status FROM goals WHERE id = $1 AND version_id = $2 FOR UPDATE`,
-        [step.goalId, versionId]
+        `SELECT id, title, status FROM goals WHERE id = ANY($1::bigint[]) AND version_id = $2 ORDER BY id FOR UPDATE`,
+        [plan.map((step) => step.goalId), versionId]
       );
+      for (const row of gRows) onVersion.set(idKey(row.id), row);
+    }
+
+    const applied = [];
+    for (const step of plan) {
+      const goal = onVersion.get(idKey(step.goalId));
       // The goal moved or closed itself while the caller was deciding. Not an
       // error — the final re-count is what guards the invariant — but recorded so
       // the response says what this call actually did.
-      if (!gRows[0]) { applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_not_on_version' }); continue; }
-      if (gRows[0].status !== 'open') {
-        applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_already_closed', status: gRows[0].status });
+      if (!goal) { applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_not_on_version' }); continue; }
+      if (goal.status !== 'open') {
+        applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_already_closed', status: goal.status });
         continue;
       }
 
@@ -410,6 +421,7 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
           [step.goalId, `Abandoned: ${reason}`]
         );
         await client.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [step.goalId]);
+        Object.assign(goal, { status: 'archived' }); // mirror the write above for a goal named twice
         await cancelPendingMembershipRequests(client, step.goalId);
         applied.push({ goal_id: String(step.goalId), verb: 'abandon', result: 'archived', tasks_abandoned: killed.length });
       } else {
@@ -502,6 +514,7 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
         // on the way out rather than being special-cased around it (the brief's
         // explicit ask).
         await client.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [step.goalId]);
+        Object.assign(goal, { status: 'archived' }); // mirror the write above for a goal named twice
         await cancelPendingMembershipRequests(client, step.goalId);
 
         applied.push({

package/modules/lifecycle/ship-assurance.js

@@ -194,12 +194,15 @@ function githubAccessCause(errors) {
 // best-effort by design: insertAuditLog uses the module pool rather than the
 // ship's transaction client, and an audit miss must never roll back a landed ship
 // (the posture src/bongos/middleware/audit.js already takes).
+// method is 'POST' — the ship route's own verb. audit_log's CHECK admits only
+// POST/PATCH/PUT/DELETE (migration 033), so the old 'SHIP' failed every write
+// and the record never existed (task 1004879).
 async function recordShipAssurance({ insertAuditLog, taskId, builderId, assurance, log }) {
   try {
     await insertAuditLog({
       builderId,
       route: `/tasks/${taskId}/ship`,
-      method: 'SHIP',
+      method: 'POST',
       requestBodyRedacted: { ship_assurance: assurance },
       responseStatus: 200,
       surface: 'lifecycle',

package/modules/lifecycle/ship-card.js

@@ -447,10 +447,15 @@ function buildCardModel(input = {}) {
     let deployText;
     let deployCommit = null;
     let hostedText = null;
+    // task 1004741: "live" only when a reading SAYS the live build carries this
+    // merge. Shipped means merged; a merge reaches no instance until a published
+    // release carries it and the pin moves (merge-reach.js).
+    let liveConfirmed = false;
     if (stage === 'shipped') {
       deployCommit = input.deploy && input.deploy.commit ? String(input.deploy.commit) : null;
       const reach = boundReading(input.deploy && input.deploy.reach);
       if (reach) {
+        liveConfirmed = reach.includes === true;
         // task 1004682: who sees this merge, in the one shared wording
         // (merge-reach.js) — the hub's live build as read, then the hosted rule.
         // A bare "live · <sha>" read as "every user has it", which is only true
@@ -458,7 +463,8 @@ function buildCardModel(input = {}) {
         // boundReading re-bounds it (host-shaped, hex, boolean) before printing.
         [deployText, hostedText] = whoSeesAMerge(reach);
       } else {
-        deployText = deployCommit ? `live · ${deployCommit}` : 'live';
+        // No reading of the live build: say what is known (it merged), never "live".
+        deployText = `merged${deployCommit ? ` · ${deployCommit}` : ''} — not live until a published release carries it and the pin moves`;
       }
     } else if (stage === 'confirmed') {
       // task 1002541: this line used to be unconditional, driven by the STATUS
@@ -491,7 +497,7 @@ function buildCardModel(input = {}) {
 
     addFact('', changed);
     if (gradeText) addFact('grade', gradeText, { cls: gradeCls });
-    if (stage === 'shipped') addFact('live', deployCommit, { mono: true });
+    if (stage === 'shipped') addFact(liveConfirmed ? 'live' : 'merged', deployCommit, { mono: true });
     // The reason can be a full sentence — too long for a fact chip, so the chip
     // carries the alarm and the reason rides in its tooltip (the Deploy row above
     // always shows it in full).

package/modules/onboarding/howto-moments.js

@@ -46,9 +46,16 @@ const REQUESTS = [
   ['show', new RegExp(String.raw`\b(?:show|open|reopen|see|view)\b.{0,24}\b${GUIDE}\b|\b${GUIDE}\b.{0,12}\bprogress\b`, 'i')],
 ];
 
+// Only a prompt that IS the request counts (task 1004744): one short line. A pasted
+// handoff or a long message that merely QUOTES "skip the tutorial" is about
+// something else, and running `howto skip` on it would change the person's guide
+// state unasked.
+const REQUEST_MAX_CHARS = 100;
+
 // 'show' | 'next' | 'skip' | 'reset' when the prompt asks for the guide itself, else null.
 function guideRequest(prompt) {
-  const p = typeof prompt === 'string' ? prompt : '';
+  const p = typeof prompt === 'string' ? prompt.trim() : '';
+  if (p.length > REQUEST_MAX_CHARS || /[\r\n]/.test(p)) return null;
   for (const [kind, re] of REQUESTS) if (re.test(p)) return kind;
   return null;
 }

package/modules/provisioning/starter-bundles.js

@@ -78,8 +78,10 @@ const ALWAYS_ON_CORE = Object.freeze([
 // Render: it is turned on by the connect-Render step, never chosen in this picker, so it is
 // kept out of the opt-in catalog by the same list. `raise` (task 1004847) is the hub's own
 // investor page: its copy is Cloud Bongos's raise, so offering it to a new project would hand
-// that project someone else's fundraise (task 1004852).
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise']);
+// that project someone else's fundraise (task 1004852). `ai-studio` (task 1004916, ADR 0392)
+// bills AI generation through Cloud Bongos's own payment processor account, so it stays on
+// the hub until a project can bring its own billing.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise', 'ai-studio']);
 
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.20",
+  "version": "1.23.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.20",
+      "version": "1.23.22",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.20",
+  "version": "1.23.22",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10509,5 +10509,77 @@
       "id": "1002983",
       "text": "The Community home now shows a rising builder and the projects on the move this month, under the builders of the week, month and year."
     }
+  ],
+  "1.23.21": [
+    {
+      "id": "1004904",
+      "text": "In Tweak Mode, the shared top bar, navigation, footer and skip link no longer clutter every page; each is now its own page to review once."
+    }
+  ],
+  "1.23.22": [
+    {
+      "id": "1004916",
+      "text": "Groundwork for letting artists generate images with AI: the design for pricing and key storage is written down and the new module has its place in the project."
+    },
+    {
+      "id": "1004742",
+      "text": "Asking the session guide for the next tutorial step a second time now shows just that step, instead of repeating every earlier reminder."
+    },
+    {
+      "id": "1004929",
+      "text": "Four database jobs that used to ask the database one question per item now ask once for the whole batch: adding a recommended set of ranks, archiving a goal, closing a version, and the weekly karma count. Results are the same,"
+    },
+    {
+      "id": "1004944",
+      "text": "The goal-planning guide no longer tells people to send a setting the server rejects, and now reminds them to name each task's role."
+    },
+    {
+      "id": "1004931",
+      "text": "AI sessions run faster. The safety checks that run around every command the AI types used to start four or five separate small programs each time; they now share two, cutting that overhead about in half with the same checks an"
+    },
+    {
+      "id": "1004909",
+      "text": "How module sales are shared is now decided. The buyer pays a small platform fee on top of the price (processing cost plus 1 percent), so builders lose nothing to it. Each project sets how its module money is split between the"
+    },
+    {
+      "id": "1004741",
+      "text": "The finished-task card no longer says a change is \"live\" just because it was merged. It now says \"merged\" until the live site is actually confirmed to be running it, so nobody acts on work that has not reached the site yet."
+    },
+    {
+      "id": "1004928",
+      "text": "AI sessions now start several seconds faster: the stuck-work check reuses its recent answer instead of asking the server every time, and the check for newer code no longer waits on the network while still saying how up to date"
+    },
+    {
+      "id": "1004925",
+      "text": "Pages load a little faster: the city page no longer waits on each of its scripts in turn, and returning visitors to the landing keep its styles and scripts for a year instead of fetching them again every few hours."
+    },
+    {
+      "id": "1004932",
+      "text": "Quality reviews now cost less. Each reviewer used to be handed up to twice as much file text as it needs; it now gets half, starting with the files the change is mostly about, and can still open the rest itself."
+    },
+    {
+      "id": "1003180",
+      "text": "Credits and money are now two separate records. Credits keep measuring who did how much work, and money lives in its own record tied to the payment processor, so a payout can always be explained from one place. Old credit reco"
+    },
+    {
+      "id": "1004744",
+      "text": "Pasting a long message that happens to mention \"skip the tutorial\" no longer switches off your how-to guide. Only a short request that actually asks for it does."
+    },
+    {
+      "id": "1003181",
+      "text": "Each project now decides what happens when it runs short of money: refuse new work, refuse completion, or carry on and record what it owes. A project that picks nothing gets the safest default, which stops a builder from start"
+    },
+    {
+      "id": "1004915",
+      "text": "Artists now get /tweak (and any other enabled module skill) automatically when a session starts, instead of needing a manual copy step. Other builders see no change."
+    },
+    {
+      "id": "1004879",
+      "text": "Every ship now keeps its record of why it was allowed to land. Before, that record was silently thrown away on every ship because the database refused how it was labelled."
+    },
+    {
+      "id": "1004905",
+      "text": "The money plan is now decided on paper: a licensed payment processor holds all user and project money, never Bongos. Credits stay a per-project measure of contribution and are never cash. Each project sets what its work pays a"
+    }
   ]
 }

package/scripts/bongos/copy-apply.js

@@ -62,6 +62,7 @@ const ci = require('./copy-inventory.js');
 const proposals = require('../../modules/copy-desk/proposals.js');
 // The page tweak format's one reader and writer (ADR 0341 D4), for --batch.
 const pages = require('../../modules/copy-desk/pages.js');
+const chromePages = require('../../modules/copy-desk/chrome-pages.js');
 const { apiCall, arg, hasFlag, cliExit } = require('./cli-lib.js');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
@@ -559,7 +560,8 @@ function rereadStalePages({ spawn = spawnSync } = {}) {
 function readingFor(pageId, { readFile = (p) => fs.readFileSync(p, 'utf8') } = {}) {
   try {
     const doc = JSON.parse(readFile(path.join(REPO_ROOT, 'docs', 'page-readings.json')));
-    return (doc.pages || []).find((p) => p.id === pageId) || null;
+    // A shared-chrome page (task 1004904) exists only in the derived reading.
+    return (chromePages.splitReadings(doc).readings.pages || []).find((p) => p.id === pageId) || null;
   } catch { return null; }
 }
 

package/scripts/bongos/publish-manifest.js

@@ -76,6 +76,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/agents/',         // the declarative agent registry + spawn seam (goal 1000038) — CORE: its own manifest declares maintenance.status 'core-maintained', and it consumes the core `grade` port, so a released core without it cannot run the MAS machinery the methodology describes. default:false — shipped is not enabled (ADR 0083), exactly like provisioning + platform-identity below. Omitted at module-creation time (tasks 1002485/1002486): the omission was invisible until tests/agents_spawn.mjs became the first PUBLISHABLE file to import it and the R89 boundary guard caught it (task 1002489).
   'modules/npm-release/',    // the deploy page's "where is the work" + version history (task 1002622). default:false — on only in the hall that publishes the core. MUST be here: modules/hall-ui/ ships as one subtree, so a released core without this carries deploy.js's loader and the #nr-work mounts with no routes behind them — the copy-desk asymmetry above.
   'modules/render-deploy/',  // the deploy page of a project whose app deploys through Render (task 1004270). default:false. MUST be here for the npm-release reason: modules/hall-ui/ ships as one subtree, so a released core without it carries deploy.js's loader for #rd-panel with no routes behind it.
+  'modules/ai-studio/',      // AI generation for artists (task 1004916, ADR 0392): keys, prepaid balance, generate. default:false.
   'modules/raise/',           // the /raise investor page (task 1004847, ADR 0384) — ships in core, enabled ONLY on the hub, like platform-identity. Owner decision 2026-10-25: the whole page, its copy and starting numbers included, lives in the repo so builders can contribute to it, accepting that it publishes with the core. Secrets never do: the investor password is RAISE_PASSWORD_HASH in the instance env. default:false.
   'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.
   // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---

package/scripts/bongos/strand-watch.js

@@ -31,7 +31,8 @@
 //
 // Usage:
 //   node scripts/bongos/strand-watch.js                 # human-readable report
-//   node scripts/bongos/strand-watch.js --line          # ONE line, or nothing; always exit 0
+//   node scripts/bongos/strand-watch.js --line          # ONE line, or nothing; always exit 0 (cached; see linePlan)
+//   node scripts/bongos/strand-watch.js --refresh-line  # refresh that cache; prints nothing (spawned detached by --line)
 //   node scripts/bongos/strand-watch.js --json          # machine shape
 //   node scripts/bongos/strand-watch.js --hours N       # override the `completed` threshold
 //
@@ -273,6 +274,77 @@ function report(r) {
   console.log('');
 }
 
+// ---- the SessionStart line, kept off the critical path (task 1004928) --------
+//
+// THE MEASUREMENT. The credit-burn audit timed this hook at 8.2 s — the slowest SessionStart
+// producer, and so the floor for every session start. The shared cache it used (task 1003689)
+// lived 60 s, which only helps sessions opened together; the next session an hour later paid
+// the whole ledger read again, up to 8 s per call (and the held-tweak pass can add another).
+//
+// THE FIX. A strand is measured in hours (one hour for `confirmed`, twelve for `completed`), so
+// an answer a few minutes old is as true as a fresh one. So: keep the answer LINE_FRESH_MS and
+// print it at once; past that, up to LINE_STALE_MAX_MS, print it at once LABELLED WITH ITS AGE
+// and refresh the cache in a detached child for the next session; with nothing usable, read the
+// ledger but give up after LINE_DEADLINE_MS. An undetermined read is never cached — a stored
+// silence would pass for a clean board for the whole fresh window.
+const LINE_CACHE_KEY = 'strand-watch-line';
+const LINE_FRESH_MS = 15 * 60 * 1000;
+const LINE_STALE_MAX_MS = 2 * 60 * 60 * 1000;
+const LINE_DEADLINE_MS = 4000;
+
+// PURE — what to do with the cached record: 'fresh' (print it), 'stale' (print it with its age
+// and refresh in the background) or 'miss' (read the ledger now, time-boxed). A record from the
+// future means the clock moved, and is treated as a miss rather than trusted.
+function linePlan(record, nowMs, { freshMs = LINE_FRESH_MS, staleMaxMs = LINE_STALE_MAX_MS } = {}) {
+  if (!record || typeof record.at !== 'number' || !Number.isFinite(nowMs)) return 'miss';
+  const age = nowMs - record.at;
+  if (age < 0) return 'miss';
+  if (age < freshMs) return 'fresh';
+  if (age < staleMaxMs) return 'stale';
+  return 'miss';
+}
+
+// PURE — the line as printed from a stale cache: the same words, plus how old they are, so a
+// reader can weigh them. A clean (null) answer stays silent: there is nothing to label.
+function labelStale(text, ageMs) {
+  if (!text) return null;
+  return `${text} (Checked ${humanAge(ageMs)} ago; refreshing for the next session.)`;
+}
+
+// The ledger read for the line, bounded as a WHOLE (check() bounds each call, not the sum).
+// Throws on an undetermined read so probe-cache stores nothing.
+async function produceLine(opts, deadlineMs) {
+  let timer;
+  const deadline = new Promise((_, rej) => { timer = setTimeout(() => rej(new Error('deadline')), deadlineMs); });
+  try {
+    const r = await Promise.race([check({ ...opts, timeoutMs: Math.min(deadlineMs, DEFAULT_TIMEOUT_MS) }), deadline]);
+    if (!r || r.undetermined) throw new Error('undetermined');
+    return line(r);
+  } finally { clearTimeout(timer); }
+}
+
+function readLineRecord() {
+  try {
+    const { cachePath } = require('./probe-cache.js');
+    return JSON.parse(require('node:fs').readFileSync(cachePath(LINE_CACHE_KEY), 'utf8'));
+  } catch { return null; }
+}
+
+// Detached + unref'd + hidden, so the session start never waits on it (windowsHide: a detached
+// child on Windows otherwise flashes a console window). --hours is passed through so the
+// refreshed answer uses the same threshold.
+function spawnRefresh() {
+  try {
+    const args = [__filename, '--refresh-line'];
+    const hours = arg('--hours');
+    if (hours) args.push('--hours', String(hours));
+    const child = require('node:child_process').spawn(process.execPath, args, {
+      detached: true, stdio: 'ignore', windowsHide: true, cwd: process.cwd(),
+    });
+    child.unref();
+  } catch { /* the next session reads the ledger itself */ }
+}
+
 async function main() {
   const hours = Number(arg('--hours'));
   const opts = Number.isFinite(hours) && hours > 0 ? { completedStaleMs: hours * 3600000 } : {};
@@ -285,16 +357,39 @@ async function main() {
   // deploy-divergence's identical comment).
   if (hasFlag('--line')) {
     try {
-      // SHARED ACROSS CONCURRENT SESSION STARTS (task 1003689). Four sessions opened
-      // within three seconds — one worktree per claim, the normal pattern here — used
-      // to make this same call four times and ALL of them timed out, which produces no
-      // line at all. Silence from a truth-teller is indistinguishable from 'nothing to
-      // report', so the brief was lost without a symptom. The first session to ask now
-      // answers for the rest.
+      // SHARED ACROSS SESSION STARTS (task 1003689, widened by task 1004928). Four sessions
+      // opened within three seconds — one worktree per claim, the normal pattern here — used
+      // to make this same call four times and ALL of them timed out, which produces no line
+      // at all. The first session to ask answers for the rest; see linePlan for how long.
+      const rec = readLineRecord();
+      const plan = linePlan(rec, Date.now());
+      if (plan === 'fresh') {
+        if (rec.value) console.log(rec.value);
+      } else if (plan === 'stale') {
+        const one = labelStale(rec.value, Date.now() - rec.at);
+        if (one) console.log(one);
+        spawnRefresh();
+      } else {
+        const { cached } = require('./probe-cache.js');
+        const { value: one, from } = await cached(LINE_CACHE_KEY, () => produceLine(opts, LINE_DEADLINE_MS), { ttlMs: LINE_FRESH_MS });
+        // A sibling holds the lock and the cache handed back its last answer, however old:
+        // say how old, so a long-expired line is never passed off as current.
+        const shown = from === 'stale-while-locked' && rec && typeof rec.at === 'number'
+          ? labelStale(one, Date.now() - rec.at) : one;
+        if (shown) console.log(shown);
+      }
+    } catch { /* no session, offline, unreadable, past the deadline — all silence */ }
+    process.exitCode = 0;
+    return;
+  }
+
+  // --refresh-line: the detached child spawnRefresh starts. ttlMs 0 forces a fresh read; a
+  // sibling already refreshing holds the lock, and then this child simply stops. Prints nothing.
+  if (hasFlag('--refresh-line')) {
+    try {
       const { cached } = require('./probe-cache.js');
-      const { value: one } = await cached('strand-watch-line', async () => line(await check(opts)));
-      if (one) console.log(one);
-    } catch { /* no session, offline, unreadable — all silence */ }
+      await cached(LINE_CACHE_KEY, () => produceLine(opts, DEFAULT_TIMEOUT_MS * 2), { ttlMs: 0 });
+    } catch { /* the next session reads the ledger itself */ }
     process.exitCode = 0;
     return;
   }
@@ -311,5 +406,6 @@ if (require.main === module) {
 
 module.exports = {
   check, line, report, classifyStrand, rankStrands, humanAge,
+  linePlan, labelStale, produceLine, LINE_FRESH_MS, LINE_STALE_MAX_MS, LINE_DEADLINE_MS,
   CONFIRMED_STALE_MS, COMPLETED_STALE_MS, STRAND_REASON_PREFIX, WATCHED, PAGE_LIMIT,
 };

package/scripts/bongos/tweak-renders.js

@@ -87,10 +87,17 @@ function slotFilesIn(dir, { exists = (p) => fs.existsSync(p) } = {}) {
 
 // ---- the browser half --------------------------------------------------------
 
+// The inventory as Tweak Mode sees it, shared-chrome pages included (task 1004904):
+// the committed file does not list them, so planning from it alone is unknown_page.
+function derivedInventory() {
+  const r = require('../../modules/copy-desk/page-data.js').loadInventory();
+  return r.ok ? r.data : { pages: [] };
+}
+
 async function shoot({ pageId, phase, out }) {
   const reader = require('./page-reader.js');
   const kit = require('../../modules/ui-design/kit/lib');
-  const inventory = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, reader.INVENTORY_REL), 'utf8'));
+  const inventory = derivedInventory();
   const planned = planForPage(pageId, { inventory, planRenders: reader.planRenders });
   if (!planned.ok) { console.error(`tweak-renders: ${planned.code} (${pageId})`); return 2; }
   const { page, plan } = planned;
@@ -172,7 +179,7 @@ async function main(args) {
     if (!pageId) { console.error('usage: node scripts/bongos/tweak-renders.js shoot --page <id> --phase before|after --out <dir>'); return 2; }
     if (cmd === 'plan') {
       const reader = require('./page-reader.js');
-      const inventory = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, reader.INVENTORY_REL), 'utf8'));
+      const inventory = derivedInventory();
       const planned = planForPage(pageId, { inventory, planRenders: reader.planRenders });
       if (!planned.ok) { console.error(`tweak-renders: ${planned.code} (${pageId})`); return 2; }
       for (const phase of taskVisuals.TWEAK_RENDER_PHASES) for (const s of shotsFor(phase, planned.plan)) console.log(`${s.slot}\t${s.width}px\t${s.renderMode}\t${planned.plan.url}`);

package/src/bongos/module-scope-map.js

@@ -182,6 +182,10 @@ const MODULE_GLOBS = {
   'page-notes': [
     'modules/page-notes/',
   ],
+  // AI generation for artists (task 1004916, ADR 0392): keys, prepaid balance, generate.
+  'ai-studio': [
+    'modules/ai-studio/',
+  ],
   // The /raise investor page (task 1004847, ADR 0384): hub-only.
   raise: [
     'modules/raise/',

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.20'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.22'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');