@bongos/core 1.23.21 → 1.24.1

package/release-notes.json

@@ -10515,5 +10515,291 @@
       "id": "1004904",
       "text": "In Tweak Mode, the shared top bar, navigation, footer and skip link no longer clutter every page; each is now its own page to review once."
     }
+  ],
+  "1.23.22": [
+    {
+      "id": "1004916",
+      "text": "Groundwork for letting artists generate images with AI: the design for pricing and key storage is written down and the new module has its place in the project."
+    },
+    {
+      "id": "1004742",
+      "text": "Asking the session guide for the next tutorial step a second time now shows just that step, instead of repeating every earlier reminder."
+    },
+    {
+      "id": "1004929",
+      "text": "Four database jobs that used to ask the database one question per item now ask once for the whole batch: adding a recommended set of ranks, archiving a goal, closing a version, and the weekly karma count. Results are the same,"
+    },
+    {
+      "id": "1004944",
+      "text": "The goal-planning guide no longer tells people to send a setting the server rejects, and now reminds them to name each task's role."
+    },
+    {
+      "id": "1004931",
+      "text": "AI sessions run faster. The safety checks that run around every command the AI types used to start four or five separate small programs each time; they now share two, cutting that overhead about in half with the same checks an"
+    },
+    {
+      "id": "1004909",
+      "text": "How module sales are shared is now decided. The buyer pays a small platform fee on top of the price (processing cost plus 1 percent), so builders lose nothing to it. Each project sets how its module money is split between the"
+    },
+    {
+      "id": "1004741",
+      "text": "The finished-task card no longer says a change is \"live\" just because it was merged. It now says \"merged\" until the live site is actually confirmed to be running it, so nobody acts on work that has not reached the site yet."
+    },
+    {
+      "id": "1004928",
+      "text": "AI sessions now start several seconds faster: the stuck-work check reuses its recent answer instead of asking the server every time, and the check for newer code no longer waits on the network while still saying how up to date"
+    },
+    {
+      "id": "1004925",
+      "text": "Pages load a little faster: the city page no longer waits on each of its scripts in turn, and returning visitors to the landing keep its styles and scripts for a year instead of fetching them again every few hours."
+    },
+    {
+      "id": "1004932",
+      "text": "Quality reviews now cost less. Each reviewer used to be handed up to twice as much file text as it needs; it now gets half, starting with the files the change is mostly about, and can still open the rest itself."
+    },
+    {
+      "id": "1003180",
+      "text": "Credits and money are now two separate records. Credits keep measuring who did how much work, and money lives in its own record tied to the payment processor, so a payout can always be explained from one place. Old credit reco"
+    },
+    {
+      "id": "1004744",
+      "text": "Pasting a long message that happens to mention \"skip the tutorial\" no longer switches off your how-to guide. Only a short request that actually asks for it does."
+    },
+    {
+      "id": "1003181",
+      "text": "Each project now decides what happens when it runs short of money: refuse new work, refuse completion, or carry on and record what it owes. A project that picks nothing gets the safest default, which stops a builder from start"
+    },
+    {
+      "id": "1004915",
+      "text": "Artists now get /tweak (and any other enabled module skill) automatically when a session starts, instead of needing a manual copy step. Other builders see no change."
+    },
+    {
+      "id": "1004879",
+      "text": "Every ship now keeps its record of why it was allowed to land. Before, that record was silently thrown away on every ship because the database refused how it was labelled."
+    },
+    {
+      "id": "1004905",
+      "text": "The money plan is now decided on paper: a licensed payment processor holds all user and project money, never Bongos. Credits stay a per-project measure of contribution and are never cash. Each project sets what its work pays a"
+    }
+  ],
+  "1.24.0": [
+    {
+      "id": "1004986",
+      "text": "Tests now prove a project's environment-variable list can be edited and pruned only by its owner or an Archon, never stores a secret value, and never reveals or touches another project's variables."
+    },
+    {
+      "id": "1004967",
+      "text": "Credits are now described everywhere in the core as a meter of work done, never as money, cash-out value or ownership, and the settings page says equity is something a project grants separately."
+    },
+    {
+      "id": "1004983",
+      "text": "New tests prove a builder cannot hand back someone else's claimed task, even in bulk, and that new builders cannot grab several tasks at once; two small gaps they found are filed as bugs."
+    },
+    {
+      "id": "1004985",
+      "text": "The project's monthly spend cap now has tests proving it can be set and turned off, and that anyone without permission, or blocked by the Treasury's rules, is refused with nothing changed."
+    },
+    {
+      "id": "1003640",
+      "text": "The report that decides which past sessions are owed extra pay no longer says a session's cost tracking broke just because it used no helper agents. It now says most of those sessions simply owe nothing, so whoever reads it is"
+    },
+    {
+      "id": "1004956",
+      "text": "When several AI sessions run at once and a finished piece of work gets stuck on its way in, only one session now goes to fix it. The first one to start takes it; every other session is told which session already has it and car"
+    },
+    {
+      "id": "1004914",
+      "text": "Before anyone is paid, the platform now checks their age and a sanctions screening, on every route that moves money and again at the moment of payment. Under-13s and 13-15s are paid no money; 16-17s only into an account their"
+    },
+    {
+      "id": "1004935",
+      "text": "Market Watch now exists as a switched-off, empty module that every project knows about, ready for the weekly market-watch features to be built into it."
+    },
+    {
+      "id": "1004992",
+      "text": "Bongos accounts no longer have to be GitHub accounts. A person can now have GitHub, Google, or both as ways to sign in, and every existing GitHub account keeps working exactly as before. This is the groundwork: the next steps"
+    },
+    {
+      "id": "1004943",
+      "text": "The owner's chosen Market Watch designs are now saved in the project, one per screen, and each screen's build task points at the design it must match."
+    },
+    {
+      "id": "1004998",
+      "text": "While the site is in pre-launch (stealth), no project can have a public GitHub repo through Bongos. Adopting a repo that is public is refused with a plain sentence telling the founder to make it private first or start a fresh"
+    },
+    {
+      "id": "1004918",
+      "text": "Builders who have linked their own OpenRouter or Gemini key now generate on it and pay us nothing: no money is held or taken, and the request still shows what it cost them (or that Google did not say). Their key is unlocked on"
+    },
+    {
+      "id": "1004966",
+      "text": "The nightly backup and a \"Back up now\" press can no longer run at the same time: if one is already going, the second politely steps aside instead of starting a duplicate copy."
+    },
+    {
+      "id": "1004945",
+      "text": "The Studio now shows three clear action buttons with the review summaries tucked below, and live-site reviews open as a full page you can read instead of a pop-up."
+    },
+    {
+      "id": "1004965",
+      "text": "Two background clean-up jobs, moving waiting tasks forward and catching up missed badges, now run once an hour instead of every five minutes, and the badge job only looks at what changed since its last run."
+    },
+    {
+      "id": "1004917",
+      "text": "Artists can now send a sketch or reference images (or a PDF) with a request, and get back a Gemini reply plus generated artwork, with the project's own look and context added automatically. Each one is paid for from the builde"
+    },
+    {
+      "id": "1004963",
+      "text": "The server now works out which site a visitor is asking for once per request instead of re-checking it in a dozen places, with every page still going to exactly the same place as before."
+    },
+    {
+      "id": "1004964",
+      "text": "The server's short-term memory of who is knocking on the door now has a fixed size, so a flood of visitors from many addresses can no longer make it swell and slow the site down."
+    },
+    {
+      "id": "1004960",
+      "text": "Two background checks now ask the database far less often: board votes still close right on time because the checker wakes up just after the next deadline, and the \"is your app live yet\" check runs every five minutes instead o"
+    },
+    {
+      "id": "1004962",
+      "text": "Announcing a builder's rank change on Discord no longer starts a separate program each time, so the server uses far less memory and a failed announcement can never block the rank change."
+    },
+    {
+      "id": "1004961",
+      "text": "The server now checks its own responsiveness every ten seconds instead of every second, so an idle project can rest and stop burning hosting credits."
+    },
+    {
+      "id": "1004959",
+      "text": "Closes a hole in how AI spending is recorded: a builder can no longer log fake spending that pauses every automatic agent, or charge spending to someone else's task."
+    },
+    {
+      "id": "1004745",
+      "text": "Tasks and goals now have a Notes section where anyone can add scoping info, decisions, questions, risks and links, grouped by purpose so a long history stays easy to scan."
+    },
+    {
+      "id": "1004948",
+      "text": "Engineers and AI sessions now get a one-line heads-up when the page they are working on is being updated by an artist, and artists see when engineering work is open on their page. Nothing is blocked."
+    },
+    {
+      "id": "1004946",
+      "text": "Blockers that ask the owner to choose between options now show HUMAN DECISION; ones that only need something done still show HUMAN TASK."
+    },
+    {
+      "id": "1004933",
+      "text": "Every AI session starts a little lighter. The project guide every session reads was trimmed of repeated lines, and the list of commands the AI sees was tightened, with no rule or command removed."
+    },
+    {
+      "id": "1004919",
+      "text": "Builders can now link their own OpenRouter or Gemini key in Settings, so AI generations can run on their own account; the key is stored encrypted and never shown again."
+    },
+    {
+      "id": "1004926",
+      "text": "The unit test check now runs several test files at the same time instead of one by one. Tests that touch shared things (a browser, a fixed port, a fixed temp folder, or real project files) still run alone. On a 12-core machine"
+    },
+    {
+      "id": "1004954",
+      "text": "Every pending change can land again: two database updates that had both been given the same number no longer trip the safety check that was holding everyone's work back."
+    },
+    {
+      "id": "1004953",
+      "text": "The welcome screen now opens with the animated Cloud Bongos logo instead of a line of text, and shows a small \"Built on cloudbongos.com\" credit in the corner."
+    },
+    {
+      "id": "1004913",
+      "text": "Every payout now needs a personal approval from the project's authorised person, kept in a log nobody can edit. A person can sign a standing payout rule (limits, how pay is worked out, a schedule, and a pause before each run),"
+    },
+    {
+      "id": "1004922",
+      "text": "Anything waiting on a person is now marked HUMAN TASK or HUMAN DECISION, with a person icon in the hall and the same words in Claude, ChatGPT and Gemini chats."
+    },
+    {
+      "id": "1004924",
+      "text": "The server stays lighter under load: bot traffic no longer grows its memory, background checks no longer pile up, and settings files are no longer re-read on every request."
+    },
+    {
+      "id": "1004947",
+      "text": "When an artist is updating a page, engineers can still see and claim coding tasks on that page. Artist claims are now just a marker and never hide or block engineering work."
+    },
+    {
+      "id": "1004952",
+      "text": "AI helpers stop repeating the routine \"not live yet\" and \"stranded ship\" notes to you every session; they only mention them when you ask or when something is actually stuck."
+    },
+    {
+      "id": "1004930",
+      "text": "The world art on the landing page and the hall's genesis pictures now download about 0.7 MB less, with no visible change: the same pictures at the same size, just packed more tightly (1.27 MB off the stored art in all). Pages"
+    },
+    {
+      "id": "1004923",
+      "text": "Every AI session prompt now loads a builder's specialities with one database read instead of two per speciality, and looking up a builder by GitHub name no longer scans the whole builders table."
+    }
+  ],
+  "1.24.1": [
+    {
+      "id": "1005010",
+      "text": "The automatic core release can run again: two test failures that had blocked every release since this morning are fixed, with no safety check loosened."
+    },
+    {
+      "id": "1005009",
+      "text": "Hosted projects can talk to GitHub again: new projects get their GitHub key in a form the server can read, so finished work is recognised as landed."
+    },
+    {
+      "id": "1004921",
+      "text": "Artists can now make things with AI from the Studio: pick sketches, pictures or a PDF, say what you want, choose your own key (free) or your balance, and get an answer and pictures back on a full results page. The request can"
+    },
+    {
+      "id": "1005008",
+      "text": "Fixed two database checks that were failing on every change and blocking new releases, and added a guard so two such checks can never collide on the same test records again."
+    },
+    {
+      "id": "1004993",
+      "text": "People without a GitHub account can now sign up and sign in to Cloud Bongos with Google. Every Sign in button opens one short page with Continue with GitHub and Continue with Google. A first Google sign-in creates the account"
+    },
+    {
+      "id": "1004999",
+      "text": "Every open blocker now shows who it is actually waiting on, by name. The Blockers page lists them under each person (your own first), the Collab page has a \"Blockers waiting on you\" list, and the City's cards say \"waits on Ana"
+    },
+    {
+      "id": "1004937",
+      "text": "Market Watch now runs itself once a week on the project's own Anthropic key, writing sourced findings and fresh scores for every tracked item, stopping at the monthly cap, and recording every skipped run and every item's cost."
+    },
+    {
+      "id": "1004979",
+      "text": "Planning sessions now fill in a simple task list file instead of copying a whole script; one tool files it, and a test proves it creates exactly the same tasks the three old scripts did."
+    },
+    {
+      "id": "1004950",
+      "text": "A task can now say it needs the project owner or server access, and each person's list of work to pick up shows only what they can actually do; server tasks refuse anyone not given server access, and the board can filter by wh"
+    },
+    {
+      "id": "1005002",
+      "text": "As you decided, removed the four old test scripts that nothing ran, plus the check that only read their text, so there is less unused code to maintain."
+    },
+    {
+      "id": "1004984",
+      "text": "New tests check that linking work to a goal's finish line, or removing that link, only works for people allowed to do it and cannot close a goal by mistake; bad ids are now refused cleanly."
+    },
+    {
+      "id": "1001693",
+      "text": "Finishing a goal now earns the people who built it some karma. Each achieved goal shares 10 karma by how much of its work each person shipped, with a small share to whoever set the goal up. Joining a goal without shipping earn"
+    },
+    {
+      "id": "1004977",
+      "text": "Removed five old scripts nothing used, plus the outdated guide for one; checked first that no release step still builds the CLI binaries with bun build, so nothing depended on them."
+    },
+    {
+      "id": "1004987",
+      "text": "Tests now prove the hub's sign-out-everywhere message only works when genuinely signed by the hub, works once per message, and never reveals whether a person has an account here."
+    },
+    {
+      "id": "1004936",
+      "text": "Market Watch now has somewhere to keep its findings: the tables for tracked companies, their sourced log, scores over time, the watch rules, proposals and weekly questions, plus the 2026-10-28 research loaded into the hub."
+    },
+    {
+      "id": "1004974",
+      "text": "The automatic page-tweak runner now refuses to hand a worker any instruction to take a project live. Tests also show a gap: a worker running as the owner could still do it. That gap is filed privately as security report 100003"
+    },
+    {
+      "id": "1004934",
+      "text": "We decided that Market Watch will search the web each week on the project's own AI key and under the owner's monthly cap, at about $4 to $5 per weekly check of 40 competitors."
+    }
   ]
 }

package/scripts/bongos/autobongos-tweak-lane.js

@@ -95,6 +95,41 @@ function decideRound({ task, claims, files, failedAt, matchProtected }) {
   });
 }
 
+// THE HAND-OFF FENCE (task 1004974): land only, going live waits for a person.
+// What a worker is handed is its prompt, the scripts this lane runs around it,
+// and the command lines of the skill it is told to follow. fence.refusePinMove
+// reads all three and refuses before the claim if any names a door that would
+// take a project live. The skill is read fresh each round, so an edit to it is
+// checked by the next round rather than trusted from the last one.
+const SKILL_PATH = path.join('modules', 'copy-desk', 'skills', 'tweak', 'SKILL.md');
+const LANE_SCRIPTS = Object.freeze([
+  'node scripts/bongos/worktree.js add|remove',
+  'node scripts/bongos/claim.js <id> --auto-pickup',
+  'node scripts/bongos/tweak-halt.js <id> --code <code>',
+]);
+
+function readSkill(root = REPO_ROOT) {
+  return fs.readFileSync(path.join(root, SKILL_PATH), 'utf8');
+}
+
+// The command lines inside the skill's fenced blocks: the scripts it tells a
+// worker to run.
+function skillCommands(text) {
+  const out = [];
+  let inFence = false;
+  for (const line of String(text || '').split(/\r?\n/)) {
+    if (/^\s*```/.test(line)) { inFence = !inFence; continue; }
+    if (inFence && line.trim()) out.push(line.trim());
+  }
+  return out;
+}
+
+// Unreadable refuses: a skill the fence cannot read is one it cannot vouch for.
+function guardHandOff({ prompt, skillText }) {
+  if (typeof skillText !== 'string') return fence.refusePinMove({ prompt, scripts: null });
+  return fence.refusePinMove({ prompt, scripts: [...LANE_SCRIPTS, ...skillCommands(skillText)] });
+}
+
 function buildTweakPrompt({ task, pageId }) {
   return [
     `You are an unattended Autobongos worker applying ONE page tweak: task ${task.id}, page ${pageId}.`,
@@ -193,6 +228,11 @@ async function workRound({ round, opts, state }, d) {
     state.tweakFailed.set(id, after && after.task ? after.task.updated_at : task.updated_at);
     return after;
   };
+  const prompt = buildTweakPrompt({ task, pageId });
+  let skillText = null;
+  try { skillText = (d.readSkill || readSkill)(); } catch (_) { skillText = null; }
+  const handOff = guardHandOff({ prompt, skillText });
+  if (!handOff.go) return d.log({ event: 'fenced', lane: 'tweak', task_id: task.id, page_id: pageId, code: handOff.code, reason: handOff.reason });
   const name = d.worktreeName(task.id);
   const made = await d.runCmd(node, [path.join('scripts', 'bongos', 'worktree.js'), 'add', name, '--base', 'origin/main']);
   if (!made.ok) return d.log({ event: 'worktree_failed', lane: 'tweak', task_id: task.id, page_id: pageId, worktree: name });
@@ -208,7 +248,7 @@ async function workRound({ round, opts, state }, d) {
   // grade ledger, read after the worker, never the worker's word.
   const gradeLedger = d.gradeLedgerPath ? d.gradeLedgerPath(task.id) : null;
   const capCheck = d.gradeCapReader ? await d.gradeCapReader({ api: d.api, taskId: task.id, ledger: gradeLedger }) : null;
-  const res = await d.spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: treePath, gradeLedger, capCheck, prompt: buildTweakPrompt({ task, pageId }), deps: d.spawnDeps || {} });
+  const res = await d.spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: treePath, gradeLedger, capCheck, prompt, deps: d.spawnDeps || {} });
   const grades = capCheck ? await capCheck() : null;
   if (gradeLedger) { try { fs.rmSync(gradeLedger, { force: true }); } catch (_) { /* its counts travel in the row */ } }
   let after = await (d.readRound || readRound)(d.api, id).catch(() => null);
@@ -256,6 +296,11 @@ module.exports = {
   pageFiles,
   decideRound,
   buildTweakPrompt,
+  SKILL_PATH,
+  LANE_SCRIPTS,
+  readSkill,
+  skillCommands,
+  guardHandOff,
   tweakOutcome,
   readRound,
   pickRound,

package/scripts/bongos/backfill-subagent-rewards.js

@@ -99,7 +99,7 @@ const CLASS_NOTE = Object.freeze({
   [CLASSES.UP_TO_DATE]: 'already paid at or above this basis — nothing owed',
   [CLASSES.OVERPAID]: 'paid ABOVE its worth; ADR 0054 is append-only, so never clawed back',
   [CLASSES.PRE_DEDUP_FIX]: 'subagent cost row predates the task-1003217 de-dup fix (~2.22x inflated) — paying it would OVERPAY',
-  [CLASSES.NO_SUBAGENT_RECORD]: 'no subagent cost row: the cost hook never ran (no token / hard kill / 401). Unrecoverable — never guessed at',
+  [CLASSES.NO_SUBAGENT_RECORD]: 'no subagent cost row. Usually the session ran no subagent, so nothing is owed. Rarely the cost hook never ran (no token / hard kill / 401); the data cannot tell the two apart, so neither is guessed at',
   [CLASSES.PRE_SPLIT]: 'only a pre-split single `session` cost row, which lumps interactive + subagent and cannot be separated',
   [CLASSES.LEGACY]: 'reward_basis=0 legacy row — a DIFFERENT gap that ADR 0173 already declined to backfill; not folded in here',
 });
@@ -255,7 +255,7 @@ function renderReport(plan, { loginFor = () => null } = {}) {
   out.push('WHAT THIS RUN DOES NOT SETTLE (state it before deciding — ADR 0173 §Rationale 2/3)');
   out.push(`  $${plan.unpaidSubagentUsd.toFixed(2)} of subagent spend sits in pre-dedup-fix rows that are ~2.22x inflated and cannot be paid from.`);
   out.push(`  ${plan.overpaidExcess} credits of existing OVERpayment are not recovered; this corrects in one direction only.`);
-  out.push('  Sessions whose cost hook never ran left no trace at all and are unrecoverable.');
+  out.push(`  The ${plan.counts[CLASSES.NO_SUBAGENT_RECORD]} no_subagent_record session(s) are mostly sessions that ran no subagent; any among them whose cost hook failed left no trace and cannot be recovered.`);
   out.push('');
   out.push(`GRAND TOTAL to mint: ${plan.grandTotal} credits`);
   return { text: out.join('\n'), total: plan.grandTotal };

package/scripts/bongos/claim.js

@@ -301,6 +301,17 @@ function clip(s, max = 160) {
 // ({ worktree, isMainCheckout }) so the session-claim branch can tell a real
 // conflict apart from a failed worktree detection. Optional and defaulted — the
 // function stays pure and every existing caller/test keeps working.
+// task 1004956: who is fixing which strand on this machine, as { task_id, by, mine }.
+// Fail-open — a refusal must print even when the lease folder cannot be read.
+function liveStrandLeases() {
+  try {
+    const lease = require('./strand-lease.js');
+    const me = lease.currentHolder();
+    return lease.liveLeases({ dir: lease.leaseDir() })
+      .map((l) => ({ task_id: l.task_id, by: lease.describe(l), mine: !!me && l.holder === me.holder }));
+  } catch { return []; }
+}
+
 function formatClaimFailure(r, taskId, ctx) {
   const info = claimErrorInfo(r);
   const { lines, exit } = claimFailureGuidance(info, r, taskId, ctx);
@@ -376,9 +387,14 @@ function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
     lines.push(owed.length
       ? `Your queue is gated — ${owed.length} confirmed task(s) are waiting on your rebase:`
       : 'Your queue is gated — a confirmed task is waiting on your rebase.');
+    // task 1004956: a strand another session is already fixing is named with that session,
+    // so this one leaves it alone instead of piling onto the same /strand-fix.
+    const leases = (ctx && ctx.strandLeases) || [];
     for (const t of owed) {
       lines.push(`  - task ${t.id}${t.title ? `  ${clip(t.title)}` : ''}`);
       if (t.reason) lines.push(`      flagged: ${clip(t.reason)}`);
+      const held = leases.find((l) => String(l.task_id) === String(t.id) && !l.mine);
+      if (held) lines.push(`      already being fixed by ${held.by} — leave it to that session`);
     }
     if (waiting.length) lines.push('  Waiting, not on you (set aside; they land on their own):');
     for (const t of waiting) lines.push(`  - task ${t.id}${t.title ? `  ${clip(t.title)}` : ''} — ${clip(t.waits_on || t.reason || 'outside you')}`);
@@ -661,6 +677,10 @@ async function main() {
       console.log(`\n⚠ touches[] overlaps an active claim: ${r.data.overlap_warning.join(', ')}`);
       console.log('  Advisory only — your claim stands; git merge is the authoritative collision check.');
     }
+    // task 1004948: a page an artist is updating — one gentle line each, no refusal.
+    for (const n of (Array.isArray(r.data.page_notice) ? r.data.page_notice : [])) {
+      if (n && typeof n.line === 'string') console.log(`\nℹ ${n.line}`);
+    }
     // task 1001741: goal-aware — an unclaimed OPEN sibling in the same goal
     // declares overlapping files. Same advisory posture as above.
     if (Array.isArray(r.data.sibling_overlap_warning) && r.data.sibling_overlap_warning.length > 0) {
@@ -768,6 +788,7 @@ async function main() {
   const failure = formatClaimFailure(r, taskId, {
     worktree,
     isMainCheckout: tree ? tree.isMainCheckout : null,
+    strandLeases: liveStrandLeases(),
   });
   for (const line of failure.lines) console.error(line);
   // task 1002592: this exit runs immediately after the claim request, which is
@@ -786,4 +807,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, QUEUE_GATED_EXIT };
+module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, liveStrandLeases, QUEUE_GATED_EXIT };

package/scripts/bongos/db-backup-nightly.sh

@@ -85,6 +85,35 @@ if ! command -v pg_dump >/dev/null 2>&1; then
   exit 2
 fi
 
+# ---- one backup at a time (task 1004966) ------------------------------------
+
+# The nightly timer (gds-db-backup.service) and the hall's "Back up now"
+# (POST /backup/trigger in src/bongos/routes/backup.js) BOTH run this script, so
+# the lock lives here and both paths take the same one. The server's in-memory
+# flag only stops two manual runs; this stops a manual run overlapping the timer.
+#
+# One lock file per DATABASE under the backup dir, not one for the whole dir:
+# every project's unit shares BACKUP_DIR and the timer fires them all at 04:00,
+# so a dir-wide lock would make every project but the first skip its night.
+#
+# A second run does NOT wait — it exits 0 with the SKIPPED line below, because
+# the run already in progress IS the backup it asked for. The lock is held on
+# fd 9 for the life of this process and released by the kernel on exit, so a
+# killed run can never leave it stuck.
+#
+# flock is util-linux (every Linux host). Where it is missing (macOS, Git Bash)
+# the script warns and runs unlocked rather than refusing to back up at all.
+LOCK_FILE="${BACKUP_DIR}/.${DB_NAME}.backup.lock"
+if command -v flock >/dev/null 2>&1; then
+  exec 9>>"$LOCK_FILE"
+  if ! flock -n 9; then
+    echo "[$(date -u +%FT%TZ)] gds-db-backup: SKIPPED another backup of ${DB_NAME} is already running (lock ${LOCK_FILE} is held) — this run exits without dumping"
+    exit 0
+  fi
+else
+  echo "[$(date -u +%FT%TZ)] gds-db-backup: WARN flock not found — running without the one-backup-at-a-time lock" >&2
+fi
+
 # ---- the dump ---------------------------------------------------------------
 
 echo "[$(date -u +%FT%TZ)] gds-db-backup: dumping ${DB_NAME} → ${OUT}"

package/scripts/bongos/deploy-divergence.js

@@ -364,6 +364,11 @@ function report(r, { quiet = false } = {}) {
 // Returns null when there is nothing an agent must know: aligned, or the check
 // could not be determined at all. A SessionStart hook prints only a string, so
 // null IS the silence — an unreachable instance must never editorialize.
+// The line is context for the AGENT: queued work lands on its own, so repeating it to the
+// builder every session is noise. Fixed text only — it is injected every session.
+const RELAY_RULE = 'This note is for you, not the builder: do not repeat it to them unless they ask '
+  + 'whether work is live, or something here stays stuck and needs a person.';
+
 function line(r) {
   if (!r || r.undetermined || r.ok) return null;
 
@@ -400,6 +405,8 @@ function line(r) {
   // Fixed vocabulary + the bounded host only (this line is injected context).
   if (versionParts) advice.push(`${hubRule(host)}; ${HOSTED_LINE.charAt(0).toLowerCase()}${HOSTED_LINE.slice(1)} Never call work live until that instance's /version shows it.`);
   if (pending) advice.push('Run migrate against that instance DB (PGDATABASE set) before anything else.');
+  // Agents kept relaying this to the owner on every session (owner, 2026-10-28; task 1004952).
+  advice.push(RELAY_RULE);
   return `Deploy state (read from ${host}/version): ${parts.join('; ')}. ${advice.join(' ')}`;
 }
 

package/scripts/bongos/doc-cli-guard.js

@@ -50,6 +50,12 @@ const DOC_CLI_ALLOW = new Map([
     'a dated session log — the historical record, never rewritten — of the spike whose harness task 1004857 deleted; it describes what was run then, not what to run now.'],
   ['docs/session-logs/2026-09-16-task-1003752-stranded-detector-never-ran.md::scripts/bongos/gate-review.js',
     'a dated session log — the historical record, never rewritten — naming the gate-review classifier task 1004859 deleted (its CI check never ran); it describes what was run then, not what to run now.'],
+  ['docs/audits/goal-1000090-relevance-audit-2026-09-09.md::scripts/bongos/build-bongos.js',
+    'a dated audit — docs/audits is frozen record exactly like docs/adr and docs/session-logs (rename-history-check.js property 2 pins its literal floors, and the rename codemod never rewrites it) — naming the CLI binary builder task 1004977 deleted once ADR 0324 retired the npm CLI channel; it describes what was true then.'],
+  ['docs/session-logs/2026-09-17-task-1002988-discipline-required.md::scripts/bongos/backfill-disciplines.js',
+    'a dated session log — the historical record, never rewritten — of the one-shot discipline backfill task 1004977 deleted after it had run; it describes what was run then, not what to run now.'],
+  ['docs/session-logs/2026-09-17-task-1003975-session-type.md::scripts/bongos/backfill-session-types.js',
+    'a dated session log — the historical record, never rewritten — of the one-shot session-type backfill task 1004977 deleted after it had run; it describes what was run then, not what to run now.'],
 ]);
 
 // `node scripts/bongos/foo.js` … up to the end of the line/segment, so the flags that

package/scripts/bongos/fitness.js

@@ -565,7 +565,8 @@ const KERNEL_FILES = [
   // task 1002969 (ADR 0356): when an invite's door closes is part of the admission
   // gate db-kernel.js runs, and the doorway hands the same definition to the
   // onboarding and hub modules. It requires NOTHING, so joining costs nothing.
-  'src/bongos/invite-expiry.js',             // the read-time invite expiry (INVITE_EXPIRY_DAYS + its SQL)
+  'src/bongos/invite-expiry.js', 'src/bongos/task-needs.js', // the read-time invite expiry + what a builder can do (task 1004950: capabilities read like rank, ADR 0016/0395; requires only pool/seams/db-kernel)
+  'src/bongos/prelaunch-switch.js',          // is pre-launch (stealth) on? — the doorway's prelaunchActive (task 1004998); imports nothing
   'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
   // config / identity (host context a module reads, never hardcodes)
   'src/instance-config.js',
@@ -651,7 +652,7 @@ const KERNEL_NAMES_MODULES_OK = new Set([
   'src/bongos/auth-github.js',           // ticks the 'onboarding' port on first sign-in
   'src/bongos/auth-idp.js',              // same, on the federated path
   'src/bongos/auth-discord.js',          // the Discord account-link flow itself
-  'src/bongos/act-alone.js',             // resolves the 'government' port by key for checkActAlone (task 1004657)
+  'src/bongos/act-alone.js', 'src/bongos/task-needs.js', // resolve the 'government' port by key: checkActAlone (task 1004657), the owner seat (task 1004950)
   'src/bongos/permission-path-check.js', // names module path subtrees to PROTECT them
   'src/bongos/route-rank-check.js',      // names module route dirs to rank-gate them
   'src/role-responsibilities.js',        // the ideator's VERBATIM statement reads "Make good ideas" — the English word, colliding with the `ideas` key. Owner text; unparaphrasable.

package/scripts/bongos/gen-diagrams.js

@@ -294,9 +294,9 @@ function drachmaeKarmaMmd(f) {
     `title: ${cap(currency)} & karma — where each comes from, where each goes  (AUTO-GENERATED from live facts — do not hand-edit; see scripts/bongos/gen-diagrams.js)`,
     '---',
     'flowchart LR',
-    `    subgraph CURRENCY["${CUR}  (the builder reward — equity / reputation, a stake, not a spendable currency)"]`,
+    `    subgraph CURRENCY["${CUR}  (the builder reward — a contribution meter: not money, not equity, not a spendable currency)"]`,
     '        direction TB',
-    '        D_TOKEN["Ship a SESSION — the main reward\\nround(true_cost_usd × 1.20) cents — cost-plus on real token spend\\n(LIVE: priced server-side from token counts; ADR 0054, idempotent per session)"]',
+    '        D_TOKEN["Ship a SESSION — the main reward\\nround(true_cost_usd × 1.20) — sized by real token spend in USD\\n(LIVE: priced server-side from token counts; ADR 0054, idempotent per session)"]',
     '        D_SHIP["SHIP a TASK — books when the code lands on main, not at confirm\\ncredits_reward × kind multiplier (0.8–1.5×)\\n+ 25% idea-promotion bonus to the capturer\\n(LIVE: ADR 0023; pay-on-land ADR 0120; withheld entirely on a cost-plus-only instance, ADR 0146)"]',
     `        D_ACH["Unlock an achievement\\nachievements.credit_bonus (LIVE: ${nAch} seeded)\\n+ small net-negative-ship bonus"]`,
     `        D_BOUNTY["Red-team / security bounty\\n${currency} payout by severity\\n(rate card ${rateCard ? 'LIVE' : 'PLANNED'}: R65 #284 — src/bongos/security.js + shown on /builders;\\nawarding still ${awarding ? 'LIVE' : 'PLANNED'}: R67 #286 + vulnerability_reports R63 #282)"]`,
@@ -308,7 +308,7 @@ function drachmaeKarmaMmd(f) {
     '        D_ACH --> D_BAL',
     `        D_BOUNTY ${awarding ? '-->' : '-.PLANNED.->'} D_BAL`,
     '',
-    `        D_SPEND["Spent on: nothing yet.\\n${cap(currency)} are EQUITY / reputation — a stake, not a\\nspendable currency. They persist losslessly across exit (migration 025)."]`,
+    `        D_SPEND["Spent on: nothing yet.\\n${cap(currency)} measure contribution — never money, never\\nredeemable, never equity (ADR 0387). They persist losslessly across exit (migration 025)."]`,
     '        D_BAL --> D_SPEND',
     '    end',
     '',

package/scripts/bongos/lib.sh

@@ -18,11 +18,10 @@
 # not run on a Windows builder's machine.
 #
 # Deliberately NOT here:
-#   - the per-script curl `call()` wrapper — the two contracts differ in
-#     load-bearing ways (smoke-batch-claim echoes "PAYLOAD\nCODE" and never exits
-#     non-zero so its caller can read CODE/PAYLOAD; smoke-write/-consistency echo
-#     the payload and `return 1` on a non-2xx so `set -e` aborts). Merging them
-#     would break one or the other, so each script keeps its own.
+#   - the per-script curl `call()` wrapper — what a non-2xx means is the
+#     caller's contract (smoke-write echoes the payload and `return 1`s so
+#     `set -e` aborts; another smoke may want to read the code and carry on),
+#     so each script keeps its own.
 
 # lib.sh's own directory, captured at SOURCE time (BASH_SOURCE, not $0 — $0 is
 # the sourcing script). Captured eagerly because a caller may cd afterwards:

package/scripts/bongos/migration-namespace.js

@@ -187,7 +187,7 @@ function stemCollisions(files) {
 // series/number exemption: that would also wave through a FOURTH file landing at 012,
 // which is the very bug this detects. Only the already-applied files are forgiven, so
 // the number stays closed to anything new.
-// Seven races that already landed. Every one of these files is applied on prod, and
+// Eight races that already landed. Every one of these files is applied on prod, and
 // renaming an applied migration changes its schema_migrations stem, so migrate.sh would
 // see it as unapplied and RE-RUN it — the same constraint that produced
 // LEGACY_BARE_MODULES and RENAMED_MODULE_PREFIXES above. They are recorded rather than
@@ -204,6 +204,18 @@ const GRANDFATHERED_NUMBER_COLLISIONS = new Map([
   ['core/core/189', new Set(['core_189_core_upgrades_ledger', 'core_189_credit_log_task_id_index'])],
   ['core/core/223', new Set(['core_223_blocker_resolve_respects_other_open_blockers', 'core_223_task_visual'])],
   ['core/core/240', new Set(['core_240_artist_gate_indexes', 'core_240_goal_members_drop_legacy_role'])],
+  // 2026-10-28: tasks 1004923 and 1004947 each allocated 282 and both landed on main
+  // the same day, turning this check red for every branch. Order between them
+  // does not matter: one indexes builders by lower(github_login), the other replaces
+  // the claimable-list function; neither reads what the other writes.
+  ['core/core/282', new Set(['core_282_builders_lower_login_idx', 'core_282_claimable_ignores_page_markers'])],
+  // 2026-10-28, the same race one number up: tasks 1004913 and 1004953 each renamed
+  // their file off 282 into 283 and both merged within eight minutes, so the rename
+  // that was meant to clear 282 re-opened the check at 283. Order between them does
+  // not matter: one creates the payout_approvals table, the other re-creates the
+  // claimable_tasks view (DROP VIEW IF EXISTS + CREATE), and neither reads the other.
+  // Grandfathered, not renamed again: both stems are applied on the hub.
+  ['core/core/283', new Set(['core_283_claimable_ignores_page_markers', 'core_283_payout_approvals'])],
   ['module:platform-identity/platform_identity/012', new Set([
     // 2026-08-28, the collision task 1003646 was filed for: three parallel sessions each
     // allocated 012 from its own branch point. Order between them does not matter — they

package/scripts/bongos/plain-cards.js

@@ -82,6 +82,10 @@ const CARDS = Object.freeze({
     'This task belongs to a goal you have not joined.',
     'I will offer to join it for you — or apply, if it is private. I will not do either without your yes.',
     'For a private goal, its owner approves the request.', RULE),
+  NEEDS_SERVER_ACCESS: card(
+    'This task needs server access, which this account does not have yet.',
+    'I will pick a task that can be done from here instead.',
+    'The project owner, if you should have server access.', RULE),
   archon_approval_required: card(
     'This goal covers a protected part of the project, so joining it needs an Archon to say yes.',
     'I will file the request for you and we pick other work while it waits.',