@bongos/core 1.23.21 → 1.23.22

package/modules/government/routes/government.js

@@ -434,40 +434,50 @@ module.exports = function buildGovernmentRouter() {
 
   // rank: perm government.manage — add a RECOMMENDED RANK SET (task 1004400):
   // the custom ranks recommendations.js names for a project type and size, each
-  // with its grants. It is the create form and the grant toggle run in a loop,
-  // under the same checks: a rank that already exists is LEFT ALONE (never
+  // with its grants. It does what the create form and the grant toggle do, for
+  // every rank in the set, under the same checks: a rank that already exists is LEFT ALONE (never
   // re-granted, never relabelled — an owner may have edited it), and every grant
   // is re-checked with catalog.isGrantableTo, so a set can never write what the
   // toggle would refuse. Re-applying is safe; the reply says what was added.
+  //
+  // task 1004929: the whole set is written by db.applyRankSet in ONE transaction
+  // and three statements, instead of a read + insert + one insert per grant for
+  // every rank. A rank this route creates is always a CUSTOM rank (is_system
+  // false, no seeded_rank — what createRank returns), so each grant is screened
+  // against that shape before the write, exactly as the toggle would screen it.
+  // A failure now writes nothing, so a 500 reports empty created/skipped lists.
   router.post('/government/rank-sets/apply', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       type: { type: 'string', maxLength: 32 },
       headcount: { required: true, type: 'integer', min: 0, max: 100000 },
     })) return;
     const set = recommendations.recommendedRankSet(req.body.type, req.body.headcount);
-    const created = [];
-    const skipped = [];
+    const customRank = { is_system: false, seeded_rank: null };
     try {
+      const granted = await db.applyRankSet({
+        createdBy: req.builder.id,
+        ranks: set.ranks.map((r) => ({
+          rankKey: r.rank_key,
+          label: r.label,
+          description: r.description,
+          permissionKeys: r.permissions.filter((key) => catalog.byKey(key) && catalog.isGrantableTo(key, customRank)),
+        })),
+      });
+      const created = [];
+      const skipped = [];
       for (const r of set.ranks) {
-        if (await db.getRankByKey(r.rank_key)) { skipped.push({ rank_key: r.rank_key, label: r.label }); continue; }
-        let rank;
-        try {
-          rank = await db.createRank({ rankKey: r.rank_key, label: r.label, description: r.description, createdBy: req.builder.id });
-        } catch (err) {
-          if (err && err.code === '23505') { skipped.push({ rank_key: r.rank_key, label: r.label }); continue; }
-          throw err;
-        }
-        const granted = [];
-        for (const key of r.permissions) {
-          if (!catalog.byKey(key) || !catalog.isGrantableTo(key, rank)) continue;
-          if (await db.grantRankPermission({ rankKey: r.rank_key, permissionKey: key })) granted.push(key);
+        // delete-on-read: a key named twice in a set is created once, then skipped.
+        if (granted.has(r.rank_key)) {
+          created.push({ rank_key: r.rank_key, label: r.label, permissions: granted.get(r.rank_key) });
+          granted.delete(r.rank_key);
+        } else {
+          skipped.push({ rank_key: r.rank_key, label: r.label });
         }
-        created.push({ rank_key: r.rank_key, label: r.label, permissions: granted });
       }
       res.json({ ok: true, type: set.type, size: set.size, created, skipped });
     } catch (err) {
       log.error('[gds] POST /government/rank-sets/apply', err);
-      res.fail('rank_set_apply_failed', { status: 500, message: 'internal error', details: { created, skipped } });
+      res.fail('rank_set_apply_failed', { status: 500, message: 'internal error', details: { created: [], skipped: [] } });
     }
   });
 

package/modules/grading/grader-subagent.js

@@ -183,18 +183,23 @@ function runSubagent({ prompt, opts = {} }) {
 // agentic Read turns re-opening the same changed files. Read them ONCE here
 // and hand every worker the post-change contents inline (fenced, untrusted),
 // so a worker's Read tool is only needed for files beyond the bundle.
+//
+// task 1004932: the bundle rides in EVERY worker prompt, so its total is paid
+// once per worker; 120k chars made it the largest fixed input of a grade.
 const CONTEXT_BUNDLE_MAX_FILES = 24;
-const CONTEXT_BUNDLE_MAX_TOTAL_CHARS = 120_000;
+const CONTEXT_BUNDLE_MAX_TOTAL_CHARS = 60_000;
 const CONTEXT_BUNDLE_MAX_FILE_CHARS = 16_000;
 // Binary-ish extensions never worth inlining (the diff already names them).
 const CONTEXT_BUNDLE_SKIP_RE = /\.(?:png|jpe?g|gif|webp|ico|svgz|woff2?|ttf|eot|zip|gz|tgz|tar|pdf|mp[34]|wav|ogg|bin|exe|dll|node)$/i;
 
-// Added lines per file, from the unified diff. Only lines long enough to be a
-// meaningful fingerprint (a bare `}` or `});` matches anywhere) — used to prove
-// a truncated bundle prefix actually SHOWS the change (task 1002905).
+// One pass over a unified diff, per file: how many lines it adds (a relevance
+// weight), and the added lines long enough to be a meaningful fingerprint (a bare
+// `}` or `});` matches anywhere) — used to prove a truncated bundle prefix
+// actually SHOWS the change (task 1002905).
 const BUNDLE_EVIDENCE_MIN_CHARS = 12;
-function diffAddedLinesByFile(diff) {
-  const byFile = new Map();
+function scanDiff(diff) {
+  const evidence = new Map();
+  const added = new Map();
   let cur = null;
   let prevWasOldHeader = false;
   for (const line of String(diff || '').split('\n')) {
@@ -209,12 +214,26 @@ function diffAddedLinesByFile(diff) {
     prevWasOldHeader = line.startsWith('--- ');
     if (prevWasOldHeader || line.startsWith('diff --git')) continue;
     if (!cur || !line.startsWith('+')) continue;
+    added.set(cur, (added.get(cur) || 0) + 1);
     const t = line.slice(1).trim();
     if (t.length < BUNDLE_EVIDENCE_MIN_CHARS) continue;
-    if (!byFile.has(cur)) byFile.set(cur, []);
-    byFile.get(cur).push(t);
+    if (!evidence.has(cur)) evidence.set(cur, []);
+    evidence.get(cur).push(t);
   }
-  return byFile;
+  return { evidence, added };
+}
+function diffAddedLinesByFile(diff) { return scanDiff(diff).evidence; }
+
+// The order the bundle is filled in (task 1004932): the files the diff adds the
+// most lines to first, so when the total cap bites it is the lightly touched
+// files (a one-line doc pointer, a generated index) that fall to skipped[] for
+// the worker to Read, not the heart of the change. Stable: ties, and every file
+// when there is no diff, keep the caller's order.
+function orderByChange(changedFiles, added) {
+  return changedFiles
+    .map((file, i) => ({ file, i, n: added.get(file) || 0 }))
+    .sort((a, b) => (b.n - a.n) || (a.i - b.i))
+    .map((x) => x.file);
 }
 
 // Pure-ish (fs reads only, injectable): returns { files: [{file, content,
@@ -241,8 +260,8 @@ function buildContextBundle({ changedFiles, cwd, diff, fsImpl = fs } = {}) {
   // exactly the pre-change state). A prefix that contains none of the change is
   // worse than no bundle at all, so refuse it: skipped[] already tells the worker
   // to Read the file.
-  const addedByFile = diffAddedLinesByFile(diff);
-  for (const rel of (Array.isArray(changedFiles) ? changedFiles : [])) {
+  const { evidence: addedByFile, added } = scanDiff(diff);
+  for (const rel of orderByChange(Array.isArray(changedFiles) ? changedFiles : [], added)) {
     if (files.length >= CONTEXT_BUNDLE_MAX_FILES || total >= CONTEXT_BUNDLE_MAX_TOTAL_CHARS) {
       skipped.push(rel);
       continue;

package/modules/hall-ui/public/city.html

@@ -106,24 +106,24 @@
 </div>
 
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
-<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-escape"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab" defer></script>
+<script src="/builders/craft-mode.js?v=2026-10-09-living3" defer></script>
+<script src="/builders/shell.js?v=2026-10-25-escape" defer></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
-<script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>
-<script src="/builders/city-draw.js?v=2026-10-17-tidy"></script>
+<script src="/builders/gov-living.js?v=2026-10-09-positions1" defer></script>
+<script src="/builders/gov-feeds.js?v=2026-10-09-living3" defer></script>
+<script src="/builders/city-draw.js?v=2026-10-17-tidy" defer></script>
 <!-- a building's card answers its first ask in place through the deck's own
      route (task 1004702): the desk rows (street-desk.js over the street's kit)
      and the deck's card and sender (street-deck.js) -->
-<script src="/builders/hall-kit.js?v=2026-10-23-decide12"></script>
-<script src="/builders/street-draw.js?v=2026-10-09-living3"></script>
-<script src="/builders/street-card.js?v=2026-10-04-record1"></script>
-<script src="/builders/street-inside.js?v=2026-10-09-living3"></script>
-<script src="/builders/street-desk.js?v=2026-10-04-record1"></script>
-<script src="/builders/street-deck.js?v=2026-10-13-glass1"></script>
-<script src="/builders/city-decide.js?v=2026-10-23-decide12"></script>
-<script src="/builders/city-switchboard.js?v=2026-10-23-board5"></script>
-<script src="/builders/city.js?v=2026-10-23-decide12"></script>
+<script src="/builders/hall-kit.js?v=2026-10-23-decide12" defer></script>
+<script src="/builders/street-draw.js?v=2026-10-09-living3" defer></script>
+<script src="/builders/street-card.js?v=2026-10-04-record1" defer></script>
+<script src="/builders/street-inside.js?v=2026-10-09-living3" defer></script>
+<script src="/builders/street-desk.js?v=2026-10-04-record1" defer></script>
+<script src="/builders/street-deck.js?v=2026-10-13-glass1" defer></script>
+<script src="/builders/city-decide.js?v=2026-10-23-decide12" defer></script>
+<script src="/builders/city-switchboard.js?v=2026-10-23-board5" defer></script>
+<script src="/builders/city.js?v=2026-10-23-decide12" defer></script>
 </body>
 </html>

package/modules/lifecycle/db-analytics.js

@@ -860,12 +860,19 @@ async function tallyPeerVotes() {
     const karmaRows = [];
     for (const [builderId, net] of netByBuilder) {
       if (net === 0) continue; // no net signal → no karma row, but still mark tallied
+      karmaRows.push({ builder_id: builderId, delta: net });
+    }
+    // task 1004929: ONE insert for every credited builder, not one per builder.
+    // WITH ORDINALITY + ORDER BY keeps the karma_log ids in the order the loop
+    // inserted them (first vote seen first).
+    if (karmaRows.length) {
       await client.query(
         `INSERT INTO karma_log (builder_id, delta, reason, granted_by)
-         VALUES ($1, $2, 'peer_vote_weekly', NULL)`,
-        [builderId, net]
+         SELECT k.builder_id, k.delta, 'peer_vote_weekly', NULL::bigint
+           FROM unnest($1::bigint[], $2::int[]) WITH ORDINALITY AS k(builder_id, delta, ord)
+          ORDER BY k.ord`,
+        [karmaRows.map((r) => r.builder_id), karmaRows.map((r) => r.delta)]
       );
-      karmaRows.push({ builder_id: builderId, delta: net });
     }
     if (voteIds.length) {
       await client.query(

package/modules/lifecycle/db-goals.js

@@ -16,7 +16,7 @@ const doneWhen = require('./done-when.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql, isTerminalStatus } = require('./task-status');
 const { maintenanceGoalTitle } = require('./goal-advisory.js');
-const { SMOKE_NOT_LIKE } = require('./db-shared.js');
+const { SMOKE_NOT_LIKE, idKey } = require('./db-shared.js');
 const { executorFor, inTransaction } = require('./db-executor.js');
 // Task 1003660 — closing a goal cancels its pending invites + join requests.
 const { cancelPendingMembershipRequests } = require('./goal-close-sweep.js');
@@ -733,28 +733,43 @@ async function archiveGoalWithDispositions({ goalId, plan = [], reason }, deps =
       return { goal: goalRows[0], applied: [], alreadyArchived: true };
     }
 
-    const applied = [];
-    for (const step of plan) {
+    // task 1004929: every plan task is locked and read in ONE statement, and the
+    // active claims on them in one more, instead of two round trips per step. The
+    // locks are taken in id order (no deadlock against another batch), then the
+    // plan is walked in memory in PLAN order, so the applied list and the first
+    // error are what the per-step loop produced. `inGoal` tracks this call's own
+    // writes, so a task named twice reads the state the first step left behind.
+    const inGoal = new Map();
+    const claimedIds = new Set();
+    if (plan.length > 0) {
+      const ids = plan.map((step) => step.taskId);
       const { rows: tRows } = await client.query(
-        `SELECT id, title, status FROM tasks WHERE id = $1 AND goal_id = $2 FOR UPDATE`,
-        [step.taskId, goalId]
+        `SELECT id, title, status FROM tasks WHERE id = ANY($1::bigint[]) AND goal_id = $2 ORDER BY id FOR UPDATE`,
+        [ids, goalId]
       );
+      for (const row of tRows) inGoal.set(idKey(row.id), row);
+      const { rows: claimed } = await client.query(
+        `SELECT DISTINCT task_id FROM claims WHERE task_id = ANY($1::bigint[]) AND released_at IS NULL`, [ids]
+      );
+      for (const row of claimed) claimedIds.add(idKey(row.task_id));
+    }
+
+    const applied = [];
+    for (const step of plan) {
+      const task = inGoal.get(idKey(step.taskId));
       // The task left this goal (or shipped) while the caller was deciding. Not an
       // error: the disposition is moot, and the final re-count is what actually
       // guards the invariant. Recorded as 'skipped' so the response tells the
       // truth about what this call did rather than claiming a write it never made.
-      if (!tRows[0]) { applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_not_in_goal' }); continue; }
-      if (isTerminalStatus(tRows[0].status)) {
-        applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_already_terminal', status: tRows[0].status });
+      if (!task) { applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_not_in_goal' }); continue; }
+      if (isTerminalStatus(task.status)) {
+        applied.push({ task_id: String(step.taskId), verb: step.verb, result: 'skipped_already_terminal', status: task.status });
         continue;
       }
 
-      const { rows: claimed } = await client.query(
-        `SELECT id FROM claims WHERE task_id = $1 AND released_at IS NULL LIMIT 1`, [step.taskId]
-      );
-      if (claimed[0]) {
+      if (claimedIds.has(idKey(step.taskId))) {
         throw Object.assign(new Error('task has an active claim'), {
-          code: 'TASK_HAS_ACTIVE_CLAIM', taskId: String(step.taskId), taskTitle: tRows[0].title,
+          code: 'TASK_HAS_ACTIVE_CLAIM', taskId: String(step.taskId), taskTitle: task.title,
         });
       }
 
@@ -766,6 +781,7 @@ async function archiveGoalWithDispositions({ goalId, plan = [], reason }, deps =
             WHERE id = $1`,
           [step.taskId, `Abandoned: ${reason}`]
         );
+        task.status = 'abandoned';
         applied.push({ task_id: String(step.taskId), verb: 'abandon', result: 'abandoned' });
       } else {
         const { rows: dest } = await client.query(
@@ -780,6 +796,7 @@ async function archiveGoalWithDispositions({ goalId, plan = [], reason }, deps =
           });
         }
         await client.query(`UPDATE tasks SET goal_id = $2, updated_at = now() WHERE id = $1`, [step.taskId, step.toGoalId]);
+        if (idKey(step.toGoalId) !== idKey(goalId)) inGoal.delete(idKey(step.taskId));
         applied.push({ task_id: String(step.taskId), verb: 'move', result: 'moved', to_goal_id: String(step.toGoalId) });
       }
     }

package/modules/lifecycle/db-shared.js

@@ -104,10 +104,19 @@ async function mostRecentClaimHolderId(client, taskId) {
   return rows[0]?.builder_id ?? null;
 }
 
+// One spelling of a bigint id as a Map key (task 1004929). pg returns bigint
+// columns as strings while a plan may carry numbers, so a batched locked read
+// (the goal archive, the version close) matches its rows back to the plan steps
+// through this on both sides. A value BigInt cannot read keeps its own string.
+function idKey(v) {
+  try { return BigInt(v).toString(); } catch { return String(v); }
+}
+
 module.exports = {
   SMOKE_NOT_LIKE,
   gradePassCount,
   gradeQualityWhere,
+  idKey,
   median,
   mostRecentClaimHolderId,
   sealSessionLog,

package/modules/lifecycle/db-versions.js

@@ -14,7 +14,7 @@ const api = require('../../src/module-api');
 const { pool, withTx } = api;
 const doneWhen = require('./done-when.js');
 const { nonTerminalSql } = require('./task-status');
-const { SMOKE_NOT_LIKE } = require('./db-shared.js');
+const { SMOKE_NOT_LIKE, idKey } = require('./db-shared.js');
 const { executorFor, inTransaction } = require('./db-executor.js');
 // db-goals.js does NOT require this file, so this direction adds no require cycle
 // (fitness pins the count). createVersion needs it to seed a version's FIRST goal
@@ -372,18 +372,29 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
       });
     }
 
-    const applied = [];
-    for (const step of plan) {
+    // task 1004929: every plan goal is locked and read in ONE statement instead of
+    // one round trip per step. Locks are taken in id order (no deadlock against
+    // another batch); the plan is then walked in memory in PLAN order, so the
+    // applied list is what the per-step loop produced. Each step's own archive is
+    // mirrored into `onVersion`, so a goal named twice reads 'archived' second time.
+    const onVersion = new Map();
+    if (plan.length > 0) {
       const { rows: gRows } = await client.query(
-        `SELECT id, title, status FROM goals WHERE id = $1 AND version_id = $2 FOR UPDATE`,
-        [step.goalId, versionId]
+        `SELECT id, title, status FROM goals WHERE id = ANY($1::bigint[]) AND version_id = $2 ORDER BY id FOR UPDATE`,
+        [plan.map((step) => step.goalId), versionId]
       );
+      for (const row of gRows) onVersion.set(idKey(row.id), row);
+    }
+
+    const applied = [];
+    for (const step of plan) {
+      const goal = onVersion.get(idKey(step.goalId));
       // The goal moved or closed itself while the caller was deciding. Not an
       // error — the final re-count is what guards the invariant — but recorded so
       // the response says what this call actually did.
-      if (!gRows[0]) { applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_not_on_version' }); continue; }
-      if (gRows[0].status !== 'open') {
-        applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_already_closed', status: gRows[0].status });
+      if (!goal) { applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_not_on_version' }); continue; }
+      if (goal.status !== 'open') {
+        applied.push({ goal_id: String(step.goalId), verb: step.verb, result: 'skipped_already_closed', status: goal.status });
         continue;
       }
 
@@ -410,6 +421,7 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
           [step.goalId, `Abandoned: ${reason}`]
         );
         await client.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [step.goalId]);
+        Object.assign(goal, { status: 'archived' }); // mirror the write above for a goal named twice
         await cancelPendingMembershipRequests(client, step.goalId);
         applied.push({ goal_id: String(step.goalId), verb: 'abandon', result: 'archived', tasks_abandoned: killed.length });
       } else {
@@ -502,6 +514,7 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
         // on the way out rather than being special-cased around it (the brief's
         // explicit ask).
         await client.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [step.goalId]);
+        Object.assign(goal, { status: 'archived' }); // mirror the write above for a goal named twice
         await cancelPendingMembershipRequests(client, step.goalId);
 
         applied.push({

package/modules/lifecycle/ship-assurance.js

@@ -194,12 +194,15 @@ function githubAccessCause(errors) {
 // best-effort by design: insertAuditLog uses the module pool rather than the
 // ship's transaction client, and an audit miss must never roll back a landed ship
 // (the posture src/bongos/middleware/audit.js already takes).
+// method is 'POST' — the ship route's own verb. audit_log's CHECK admits only
+// POST/PATCH/PUT/DELETE (migration 033), so the old 'SHIP' failed every write
+// and the record never existed (task 1004879).
 async function recordShipAssurance({ insertAuditLog, taskId, builderId, assurance, log }) {
   try {
     await insertAuditLog({
       builderId,
       route: `/tasks/${taskId}/ship`,
-      method: 'SHIP',
+      method: 'POST',
       requestBodyRedacted: { ship_assurance: assurance },
       responseStatus: 200,
       surface: 'lifecycle',

package/modules/lifecycle/ship-card.js

@@ -447,10 +447,15 @@ function buildCardModel(input = {}) {
     let deployText;
     let deployCommit = null;
     let hostedText = null;
+    // task 1004741: "live" only when a reading SAYS the live build carries this
+    // merge. Shipped means merged; a merge reaches no instance until a published
+    // release carries it and the pin moves (merge-reach.js).
+    let liveConfirmed = false;
     if (stage === 'shipped') {
       deployCommit = input.deploy && input.deploy.commit ? String(input.deploy.commit) : null;
       const reach = boundReading(input.deploy && input.deploy.reach);
       if (reach) {
+        liveConfirmed = reach.includes === true;
         // task 1004682: who sees this merge, in the one shared wording
         // (merge-reach.js) — the hub's live build as read, then the hosted rule.
         // A bare "live · <sha>" read as "every user has it", which is only true
@@ -458,7 +463,8 @@ function buildCardModel(input = {}) {
         // boundReading re-bounds it (host-shaped, hex, boolean) before printing.
         [deployText, hostedText] = whoSeesAMerge(reach);
       } else {
-        deployText = deployCommit ? `live · ${deployCommit}` : 'live';
+        // No reading of the live build: say what is known (it merged), never "live".
+        deployText = `merged${deployCommit ? ` · ${deployCommit}` : ''} — not live until a published release carries it and the pin moves`;
       }
     } else if (stage === 'confirmed') {
       // task 1002541: this line used to be unconditional, driven by the STATUS
@@ -491,7 +497,7 @@ function buildCardModel(input = {}) {
 
     addFact('', changed);
     if (gradeText) addFact('grade', gradeText, { cls: gradeCls });
-    if (stage === 'shipped') addFact('live', deployCommit, { mono: true });
+    if (stage === 'shipped') addFact(liveConfirmed ? 'live' : 'merged', deployCommit, { mono: true });
     // The reason can be a full sentence — too long for a fact chip, so the chip
     // carries the alarm and the reason rides in its tooltip (the Deploy row above
     // always shows it in full).

package/modules/onboarding/howto-moments.js

@@ -46,9 +46,16 @@ const REQUESTS = [
   ['show', new RegExp(String.raw`\b(?:show|open|reopen|see|view)\b.{0,24}\b${GUIDE}\b|\b${GUIDE}\b.{0,12}\bprogress\b`, 'i')],
 ];
 
+// Only a prompt that IS the request counts (task 1004744): one short line. A pasted
+// handoff or a long message that merely QUOTES "skip the tutorial" is about
+// something else, and running `howto skip` on it would change the person's guide
+// state unasked.
+const REQUEST_MAX_CHARS = 100;
+
 // 'show' | 'next' | 'skip' | 'reset' when the prompt asks for the guide itself, else null.
 function guideRequest(prompt) {
-  const p = typeof prompt === 'string' ? prompt : '';
+  const p = typeof prompt === 'string' ? prompt.trim() : '';
+  if (p.length > REQUEST_MAX_CHARS || /[\r\n]/.test(p)) return null;
   for (const [kind, re] of REQUESTS) if (re.test(p)) return kind;
   return null;
 }

package/modules/provisioning/starter-bundles.js

@@ -78,8 +78,10 @@ const ALWAYS_ON_CORE = Object.freeze([
 // Render: it is turned on by the connect-Render step, never chosen in this picker, so it is
 // kept out of the opt-in catalog by the same list. `raise` (task 1004847) is the hub's own
 // investor page: its copy is Cloud Bongos's raise, so offering it to a new project would hand
-// that project someone else's fundraise (task 1004852).
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise']);
+// that project someone else's fundraise (task 1004852). `ai-studio` (task 1004916, ADR 0392)
+// bills AI generation through Cloud Bongos's own payment processor account, so it stays on
+// the hub until a project can bring its own billing.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise', 'ai-studio']);
 
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.21",
+  "version": "1.23.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.21",
+      "version": "1.23.22",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.21",
+  "version": "1.23.22",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10515,5 +10515,71 @@
       "id": "1004904",
       "text": "In Tweak Mode, the shared top bar, navigation, footer and skip link no longer clutter every page; each is now its own page to review once."
     }
+  ],
+  "1.23.22": [
+    {
+      "id": "1004916",
+      "text": "Groundwork for letting artists generate images with AI: the design for pricing and key storage is written down and the new module has its place in the project."
+    },
+    {
+      "id": "1004742",
+      "text": "Asking the session guide for the next tutorial step a second time now shows just that step, instead of repeating every earlier reminder."
+    },
+    {
+      "id": "1004929",
+      "text": "Four database jobs that used to ask the database one question per item now ask once for the whole batch: adding a recommended set of ranks, archiving a goal, closing a version, and the weekly karma count. Results are the same,"
+    },
+    {
+      "id": "1004944",
+      "text": "The goal-planning guide no longer tells people to send a setting the server rejects, and now reminds them to name each task's role."
+    },
+    {
+      "id": "1004931",
+      "text": "AI sessions run faster. The safety checks that run around every command the AI types used to start four or five separate small programs each time; they now share two, cutting that overhead about in half with the same checks an"
+    },
+    {
+      "id": "1004909",
+      "text": "How module sales are shared is now decided. The buyer pays a small platform fee on top of the price (processing cost plus 1 percent), so builders lose nothing to it. Each project sets how its module money is split between the"
+    },
+    {
+      "id": "1004741",
+      "text": "The finished-task card no longer says a change is \"live\" just because it was merged. It now says \"merged\" until the live site is actually confirmed to be running it, so nobody acts on work that has not reached the site yet."
+    },
+    {
+      "id": "1004928",
+      "text": "AI sessions now start several seconds faster: the stuck-work check reuses its recent answer instead of asking the server every time, and the check for newer code no longer waits on the network while still saying how up to date"
+    },
+    {
+      "id": "1004925",
+      "text": "Pages load a little faster: the city page no longer waits on each of its scripts in turn, and returning visitors to the landing keep its styles and scripts for a year instead of fetching them again every few hours."
+    },
+    {
+      "id": "1004932",
+      "text": "Quality reviews now cost less. Each reviewer used to be handed up to twice as much file text as it needs; it now gets half, starting with the files the change is mostly about, and can still open the rest itself."
+    },
+    {
+      "id": "1003180",
+      "text": "Credits and money are now two separate records. Credits keep measuring who did how much work, and money lives in its own record tied to the payment processor, so a payout can always be explained from one place. Old credit reco"
+    },
+    {
+      "id": "1004744",
+      "text": "Pasting a long message that happens to mention \"skip the tutorial\" no longer switches off your how-to guide. Only a short request that actually asks for it does."
+    },
+    {
+      "id": "1003181",
+      "text": "Each project now decides what happens when it runs short of money: refuse new work, refuse completion, or carry on and record what it owes. A project that picks nothing gets the safest default, which stops a builder from start"
+    },
+    {
+      "id": "1004915",
+      "text": "Artists now get /tweak (and any other enabled module skill) automatically when a session starts, instead of needing a manual copy step. Other builders see no change."
+    },
+    {
+      "id": "1004879",
+      "text": "Every ship now keeps its record of why it was allowed to land. Before, that record was silently thrown away on every ship because the database refused how it was labelled."
+    },
+    {
+      "id": "1004905",
+      "text": "The money plan is now decided on paper: a licensed payment processor holds all user and project money, never Bongos. Credits stay a per-project measure of contribution and are never cash. Each project sets what its work pays a"
+    }
   ]
 }

package/scripts/bongos/publish-manifest.js

@@ -76,6 +76,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/agents/',         // the declarative agent registry + spawn seam (goal 1000038) — CORE: its own manifest declares maintenance.status 'core-maintained', and it consumes the core `grade` port, so a released core without it cannot run the MAS machinery the methodology describes. default:false — shipped is not enabled (ADR 0083), exactly like provisioning + platform-identity below. Omitted at module-creation time (tasks 1002485/1002486): the omission was invisible until tests/agents_spawn.mjs became the first PUBLISHABLE file to import it and the R89 boundary guard caught it (task 1002489).
   'modules/npm-release/',    // the deploy page's "where is the work" + version history (task 1002622). default:false — on only in the hall that publishes the core. MUST be here: modules/hall-ui/ ships as one subtree, so a released core without this carries deploy.js's loader and the #nr-work mounts with no routes behind them — the copy-desk asymmetry above.
   'modules/render-deploy/',  // the deploy page of a project whose app deploys through Render (task 1004270). default:false. MUST be here for the npm-release reason: modules/hall-ui/ ships as one subtree, so a released core without it carries deploy.js's loader for #rd-panel with no routes behind it.
+  'modules/ai-studio/',      // AI generation for artists (task 1004916, ADR 0392): keys, prepaid balance, generate. default:false.
   'modules/raise/',           // the /raise investor page (task 1004847, ADR 0384) — ships in core, enabled ONLY on the hub, like platform-identity. Owner decision 2026-10-25: the whole page, its copy and starting numbers included, lives in the repo so builders can contribute to it, accepting that it publishes with the core. Secrets never do: the investor password is RAISE_PASSWORD_HASH in the instance env. default:false.
   'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.
   // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---