@bongos/core 1.23.22 → 1.24.1

package/modules/autonomy/fence.js

@@ -53,6 +53,7 @@ const REFUSALS = {
   not_permitted: 'your rank does not hold autonomy.run, so your runner may not work on this project',
   builder_paused: 'the owner paused your runner',
   no_builder_scope: 'you have not picked any goals for your runner — choose them in Settings',
+  pin_move: 'the worker would be told to move a live core pin, and going live always waits for a person',
 };
 
 // The stop codes effectiveFence may set, and the refusal each one becomes.
@@ -361,4 +362,66 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
   return { go: true, code: null, reason: null };
 }
 
-module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, effectiveFence, decideRun, decideTask, needsHostAccess };
+// PIN MOVES — "land only, ask before going live" (task 1004974).
+//
+// An unattended worker may land work; moving a hosted project's live core pin
+// always waits for a person. refusePinMove is asked over everything the runner
+// HANDS a worker — its prompt and the command lines it is told to run — and
+// refuses when any of them names a pin-moving door. Each pattern is one door:
+//
+//   core-upgrade / core_upgrade   POST /provisioning/instances/:id/core-upgrade, its
+//                                 provision-core-upgrade.js runner and ledger
+//   update-channel                the rule that decides which moves the runner makes
+//   core.pin.move                 the atom every other pin door sits behind
+//   /core-update, software-update the platform's own update request routes
+//   render-deploy/*               the Render deploy act and its app settings
+//   npm-release/*                 publishing a core release, which a patch-channel
+//                                 project's pin then follows on its own
+//   bongos upgrade                the CLI that performs the move on a host
+//   "pin move" / "move the pin"   the act named in words
+//
+// A NAMED LIST, KEPT HONEST BY A DERIVED TEST. A denylist admits every door added
+// after it. tests/autobongos_tweak_lane.mjs therefore enumerates every MUTATING
+// route gated on core.pin.move or the owner-or-pin gate, straight from the route
+// files, and fails when one is not matched here. A new pin door reds the build
+// until it is named.
+//
+// THIS IS THE RUNNER NOT ASKING, NOT THE WALL. The worker carries its builder's
+// own CLI session, and the server cannot tell an unattended worker from that
+// builder at a terminal, so a worker that wanders past its prompt (or paraphrases
+// past these patterns) meets only the route's own gate, which today ADMITS the
+// owner's and an Archon's session. That server-side wall is out of this task's
+// scope by the owner's instruction. It is tracked as private security report
+// 1000030 and pinned by the todo tests in tests/autobongos_tweak_pin_identity.mjs.
+// This check guarantees one narrower thing: the runner is never the one that asked.
+const PIN_MOVE_PATTERNS = Object.freeze([
+  { door: 'core-upgrade', re: /core[-_ ]?upgrade/i },
+  { door: 'update-channel', re: /update[-_ ]channel/i },
+  { door: 'npm-release', re: /npm-release\//i },
+  { door: 'core.pin.move', re: /core\.pin\.move/i },
+  { door: 'core-update', re: /\/core-update\b|software-update/i },
+  { door: 'render-deploy', re: /render-deploy\//i },
+  { door: 'bongos upgrade', re: /\bbongos\s+upgrade\b/i },
+  { door: 'pin move', re: /\bpin[-_ ]mov(?:e|es|ing)\b|\bmov(?:e|es|ing)\s+(?:the\s+|a\s+|its\s+)?(?:live\s+|core\s+)*pin\b/i },
+]);
+
+// Which doors does this text name? Pure; [] for anything that is not a string.
+function pinMoveDoors(text) {
+  if (typeof text !== 'string' || !text) return [];
+  return PIN_MOVE_PATTERNS.filter((p) => p.re.test(text)).map((p) => p.door);
+}
+
+// refusePinMove — may this prompt and this list of command lines go to a worker?
+// FAILS CLOSED: a prompt that is not a string, or a script list that is not an
+// array of strings, refuses, because a hand-off the fence cannot read is one it
+// cannot vouch for.
+function refusePinMove({ prompt, scripts } = {}) {
+  if (typeof prompt !== 'string' || !Array.isArray(scripts) || scripts.some((s) => typeof s !== 'string')) {
+    return { go: false, code: 'pin_move', reason: `${REFUSALS.pin_move} (the prompt or script list could not be read)`, doors: [] };
+  }
+  const doors = [...new Set([prompt, ...scripts].flatMap(pinMoveDoors))];
+  if (doors.length) return { go: false, code: 'pin_move', reason: `${REFUSALS.pin_move} (${doors.join(', ')})`, doors };
+  return { go: true, code: null, reason: null, doors: [] };
+}
+
+module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, effectiveFence, decideRun, decideTask, needsHostAccess, PIN_MOVE_PATTERNS, pinMoveDoors, refusePinMove };

package/modules/builder-settings/builder-needs.js

@@ -270,7 +270,31 @@ function stuckPageTweakNeeds(ctx) {
   });
 }
 
-const NEEDS = [artKeyNeed, helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed, mingleIntroductionsNeed, stuckPageTweakNeeds];
+// ---- need: payout_holds (task 1004914, goal 1000092 N10; ADR 0385 D8) -------
+//
+// Pay you are owed is on hold — a sanctions check, an age rule, or a person's
+// freeze. The owner's framework (cited by Article only) forbids withholding
+// earned pay silently, so every open hold is a need here until it is lifted: it
+// reaches the hall's Standing card and every session's nudge, the same shape as
+// a waiting board vote. ctx.openPayoutHolds is { count, first_id }, read by core
+// /me from src/bongos/payout-gates.js; absent means none.
+function payoutHoldsNeed(ctx) {
+  const holds = ctx.openPayoutHolds;
+  const n = Number(holds && holds.count) || 0;
+  if (n <= 0) return null;
+  return {
+    id: 'payout_holds',
+    count: n,
+    title: n === 1 ? 'A payout to you is on hold' : 'Payouts to you are on hold',
+    what: 'Money you are owed cannot be paid yet. The notice says why and what clears it.',
+    state: 'action_needed',
+    severity: 'action',
+    message: 'Nothing you earned is lost while it is held. Your payout status lists each hold, why it was made and what clears it; if you think one is wrong, you can appeal and a person reviews it with you.',
+    action: null,
+  };
+}
+
+const NEEDS = [artKeyNeed, helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed, mingleIntroductionsNeed, stuckPageTweakNeeds, payoutHoldsNeed];
 
 // Priority WITHIN a state bucket (task 1003738). computeNeeds used to sort by
 // state alone with a stable sort, so the NEEDS array order silently decided
@@ -296,6 +320,8 @@ const NEEDS = [artKeyNeed, helpRequestsNeed, taskRecommendationsNeed, boardVotes
 const NEED_PRIORITY = {
   founding_welcome: -1,
   board_votes: 0,
+  // Money you are owed and cannot get outranks your own setup chores (task 1004914).
+  payout_holds: 0.5,
   help_requests: 1,
   art_key: 2,
   task_recommendations: 3,

package/modules/copy-desk/routes/copy-desk.js

@@ -998,6 +998,11 @@ module.exports = function buildCopyDeskRouter() {
       if (!readingPage) return;
       const round = openRoundOf(await lifecycle.listPageTweakTasks({ pageId }), pageId);
       const out = pageStatus.composeEditor({ page, readingPage, round, builderId: req.builder.id });
+      // task 1004948: engineering work open on this page's files — information only,
+      // so an artist knows to expect code changes. A missing port or failed read is [].
+      out.engineering_active = typeof lifecycle.engineeringActiveOnPage === 'function'
+        ? await lifecycle.engineeringActiveOnPage(Array.isArray(page.files) ? page.files : [])
+        : [];
       res.set('Cache-Control', 'no-store');
       res.json(out);
     } catch (err) {

package/modules/economy/achievements.js

@@ -512,25 +512,37 @@ async function reconcileCraftAchievements(client, builderId, opts = {}) {
 // backfillCraftAchievements — the part of the backfill a migration cannot do.
 // migrations/core_270 backfills six badges from the ledger in SQL, but "A Whole
 // Surface" needs the page inventory, which is a file the database never sees. So
-// the lifecycle's periodic sweep (publish-reconciler.js) runs this ONCE per
-// process start: every builder the craft ledger has paid, through the craft-only
-// reconcile, in id order, bounded. Idempotent, so a restart that runs it again
-// unlocks nothing twice. Returns { checked, unlocked }.
-async function backfillCraftAchievements({ client = null, limit = 500 } = {}) {
+// the lifecycle's periodic sweep (publish-reconciler.js) runs this hourly: every
+// builder the craft ledger has paid SINCE `sinceId` (a credit_log id; 0 = all),
+// through the craft-only reconcile, in id order, bounded. INCREMENTAL (task
+// 1004965): it returns a `watermark`, the highest credit_log id it covered, and
+// the caller passes it back next time, so a caught-up run reads only rows newer
+// than the watermark (the primary key serves `id > $5`) and finds none. A run
+// that hit the limit has not covered everything, so it keeps the old watermark
+// rather than skip the builders past the limit. (A row committed late under a
+// lower id than the watermark is not lost: every craft payment already runs
+// reconcileAfterCraftCredit for its payee — this is the drain behind that hook,
+// and a process restart rescans from 0.) Idempotent, so a rescan unlocks
+// nothing twice. Returns { checked, unlocked, watermark }.
+async function backfillCraftAchievements({ client = null, limit = 500, sinceId = 0 } = {}) {
   const q = client || pool;
+  const since = Number(sinceId) > 0 ? Number(sinceId) : 0;
   const { rows } = await q.query(
-    `SELECT DISTINCT builder_id FROM credit_log
-      WHERE delta > 0 AND (reason LIKE $1 OR reason LIKE $2 OR reason LIKE $3 OR reason LIKE $4)
+    `SELECT builder_id, MAX(id) AS last_id FROM credit_log
+      WHERE id > $5 AND delta > 0 AND (reason LIKE $1 OR reason LIKE $2 OR reason LIKE $3 OR reason LIKE $4)
+      GROUP BY builder_id
       ORDER BY builder_id
-      LIMIT $5`,
-    [IDEA_SHIP_LIKE, IDEA_FULL_LIKE, IDEA_BOARD_LIKE, PAGE_LIKE, limit]
+      LIMIT $6`,
+    [IDEA_SHIP_LIKE, IDEA_FULL_LIKE, IDEA_BOARD_LIKE, PAGE_LIKE, since, limit]
   );
   let unlocked = 0;
   for (const r of rows) {
     const got = await reconcileAfterCraftCredit(q, r.builder_id);
     unlocked += got.length;
   }
-  return { checked: rows.length, unlocked };
+  const covered = rows.length < limit;
+  const watermark = covered ? rows.reduce((m, r) => Math.max(m, Number(r.last_id) || 0), since) : since;
+  return { checked: rows.length, unlocked, watermark };
 }
 
 // reconcileAfterCraftCredit — the craft writers' hook (task 1004438). An idea

package/modules/economy/cost-classify.js

@@ -57,6 +57,15 @@ const COST_WRITE_SURFACES = [
     file: 'modules/agents/spawn.js',
     builder_id: 'whoever REQUESTED the fire, or null for an event fire, which nobody asked for. Not the PAYER — that is payer_kind on the agents_runs row, a different question.',
   },
+  {
+    // task 1004937 (ADR 0394 §3): the weekly Market Watch run mirrors each researched
+    // item's cost here, in-process, after market_watch_run_items.cost_usd (the
+    // accounting its monthly cap sums) is final. Keyed source_ref=item-<item id> under
+    // source=market-watch:<run id>, so a resumed run cannot double-post an item.
+    surface: 'modules/market-watch/run.js (weekly run) → reward port → db.logCost() (source=market-watch:<run id>)',
+    file: 'modules/market-watch/run.js',
+    builder_id: 'null — the project pays on its own Anthropic key, and nobody asked for a scheduled run.',
+  },
   {
     surface: 'migrations / direct DB',
     file: '—',

package/modules/economy/cost-write-guard.js

@@ -0,0 +1,52 @@
+// modules/economy/cost-write-guard.js — who may book what through POST /cost
+// (task 1004959, security report 1000029).
+//
+// WHY. The cost route took `source`, `task_id` and `amount_usd` on the caller's
+// word. Two ledger readers trust those fields: the autonomous spend brake
+// (`autonomousApiSpendMtd` sums api rows tagged `agent:`/`cron:`, against a
+// ceiling of about $30) and the Treasury's per-goal pots (rows joined to a task's
+// goal). So any builder could stop every agent for the month with one row, or
+// charge spend to someone else's goal. Payouts were never exposed: cost-plus is
+// priced from session uploads, not from cost_log.
+//
+// The rules, each one keyed to a real writer so no legitimate caller breaks:
+//   - `agent:` rows are written in-process by modules/agents/spawn.js and never
+//     over HTTP, so the route refuses them outright. `market-watch:` rows are the
+//     same kind: the weekly Market Watch run writes them in-process (task 1004937).
+//   - `cron:` rows come from session-cost.js on a scheduled run, which is set up
+//     by trusted builders, so the route takes them from Metic+ only.
+//   - a `task_id` must be a task the caller has claimed (now or before). The
+//     grader and the cost CLI both log against the caller's own claim. An Archon
+//     may name any task, for backfills.
+//   - one row is capped at MAX_ROW_USD, far above any real session (a long
+//     marathon session costs a few hundred dollars).
+//
+// Pure apart from the injected `callerHasClaimed` lookup, so every refusal is
+// unit-tested without a database.
+
+const MAX_ROW_USD = 5000;
+
+// Written in-process only: `agent:` by modules/agents/spawn.js, `market-watch:` by the
+// weekly Market Watch run (modules/market-watch/run.js, task 1004937). A row under
+// either prefix that arrived over HTTP is a forgery of server spend.
+const SERVER_ONLY_PREFIXES = Object.freeze(['agent:', 'market-watch:']);
+const TRUSTED_ONLY_PREFIX = 'cron:';
+
+// rankMeets(rank, floor) — the doorway's ladder check; `callerHasClaimed(taskId)`
+// resolves true when the caller holds or held a claim on that task.
+// Returns null when the write may go ahead, else { code, status, message }.
+async function checkCostWrite({ source, taskId, rank, rankMeets, callerHasClaimed }) {
+  const src = typeof source === 'string' ? source.trim().toLowerCase() : '';
+  if (SERVER_ONLY_PREFIXES.some((p) => src.startsWith(p))) {
+    return { code: 'reserved_source', status: 403, message: 'this spend is recorded by the server itself, not through this route' };
+  }
+  if (src.startsWith(TRUSTED_ONLY_PREFIX) && !rankMeets(rank, ['metic'])) {
+    return { code: 'reserved_source', status: 403, message: 'scheduled-run spend can only be logged by a Metic or above' };
+  }
+  if (taskId != null && !rankMeets(rank, ['archon']) && !(await callerHasClaimed(taskId))) {
+    return { code: 'task_not_yours', status: 403, message: 'cost can only be logged against a task you have claimed' };
+  }
+  return null;
+}
+
+module.exports = { checkCostWrite, MAX_ROW_USD };

package/modules/economy/cost.js

@@ -89,7 +89,8 @@ async function autonomousApiSpendMtd() {
 }
 
 // The Treasury's three spending lines, month by month (task 1004527, the
-// Governor City): rewards paid to builders (credit_log, 1 credit = $1), what the
+// Governor City): credits awarded to builders (credit_log — a contribution meter
+// sized by session cost in USD, never money; ADR 0387), what the
 // grader cost (cost_log source 'grader') and hosting (categories infra, compute,
 // domain). The same ledgers GET /public/cost-summary already publishes, cut the
 // one way the Treasury building reads them. Newest month first, bounded.

package/modules/economy/credits.js

@@ -132,16 +132,18 @@ const IDEA_GOVERNANCE_PASS_FLOOR = 30;  // owner: floor ~30 — see the note on
 //
 // A SHIPPED session earns drachmae proportional to its TRUE API token cost:
 //   drachmae = round(true_cost_usd * (1 + REWARD_MARGIN_PCT/100))
-// i.e. cost + 20%, with 1 DRACHMA = $1 (owner re-denomination 2026-06-15,
-// task 1138 — see the ADR 0054 amendment). This reward was originally minted in
+// i.e. cost + 20%: the reward is SIZED BY the session's cost in USD, one drachma
+// per dollar of cost-plus at the default scale (task 1138, the ADR 0054
+// amendment). A drachma is not worth a dollar: credits are a contribution meter,
+// never money, never redeemable and never equity (ADR 0385 decision 2, ADR 0387),
+// and no dollar value is read off one. This reward was originally minted in
 // integer CENTS (the formula carried a trailing ×100); that 100× factor was
-// dropped so a token-reward drachma reads as a whole DOLLAR of cost-plus value
-// — de-inflating balances ~100× and bringing this path onto the same scale as
-// the per-task credits_reward path above (still a unitless author estimate).
-// Both accrue to builders.total_credits (= equity drachmae); ADR 0054 (+ its
-// 2026-06-15 amendment) records the convention and why the cents form existed.
+// dropped — de-inflating balances ~100× and bringing this path onto the same scale
+// as the per-task credits_reward path above (still a unitless author estimate).
+// Both accrue to builders.total_credits (the contribution meter); ADR 0054 (+ its
+// 2026-06-15 amendment) records the scale and why the cents form existed.
 //
-// REWARD_MARGIN_PCT (and the 1 drachma = $1 peg) are the code-default reward
+// REWARD_MARGIN_PCT (and the 1:1 cost-to-drachma scale, `usdPeg`) are the code-default reward
 // POLICY. They stay a code-reviewed default — not a live UI knob — for the same
 // reasons KIND_MULTIPLIERS does: a policy decision deserves a commit trail and
 // the grader reads it deterministically. But the reward policy is also
@@ -175,16 +177,16 @@ function rewardConfig() {
 // The two streams (ADR 0054 "two drachma conventions, one ledger") are:
 //   (1) the per-task author ESTIMATE — credits_reward × kind multiplier (ADR 0023),
 //       a unitless bounty set when the task is authored; and
-//   (2) the COST-PLUS session reward — round(true_cost_usd × 1.20), 1 drachma = $1
-//       (ADR 0054), grounded in the session's real API spend.
+//   (2) the COST-PLUS session reward — round(true_cost_usd × 1.20), sized by the
+//       session's real API spend in USD (ADR 0054); still a credit, not money.
 // mode picks which of the two an instance actually PAYS:
 //   'cost-plus-and-estimate' (DEFAULT) — pay both, the historical behavior. Every
 //       existing instance keeps paying exactly as before on upgrade.
-//   'cost-plus-only' — the cost-plus session reward is the SOLE equity reward; the
+//   'cost-plus-only' — the cost-plus session reward is the SOLE credit reward; the
 //       per-task estimate PAYOUT is withheld (and its idea-promotion slice, being a
 //       fraction of it, cascades to 0). credits_reward still rides the task row for
 //       display + the no-zero-reward claim gate (ADR 0096) — only the payout is
-//       suppressed, so a credit means one dollar of cost-plus value and nothing
+//       suppressed, so every credit is sized by cost-plus and nothing
 //       else. Cloud Bongos's choice (owner decision, 2026-07-16).
 // Unknown/garbage mode → treated as the default (pay both): a config typo must
 // never silently zero out every builder's per-task reward.
@@ -203,8 +205,9 @@ function rewardConfig() {
 // absent/any-non-false → the default TRUE (a pre-ADR-0172 config keeps paying).
 
 // Pure helper — exported for tests. Returns { trueCostUsd, marginPct, drachmae,
-// description }. drachmae = round(cost × (1+margin) × usdPeg); at the 1:1 peg a
-// drachma is a whole dollar of cost-plus value (task 1138), e.g.
+// description }. drachmae = round(cost × (1+margin) × usdPeg); at the 1:1 scale
+// one drachma is earned per dollar of cost-plus (task 1138) — sized by USD, not
+// worth USD (ADR 0387), e.g.
 //   "$15.00 true cost × 1.20 = 18 drachmae (token reward)"
 // NOTE a sub-$0.42 session (at the 1:1 peg) rounds to 0 drachmae — intended:
 // sub-dollar sessions earn nothing. Kept pure (code-default params); the call
@@ -256,7 +259,7 @@ function applyKindMultiplier(rawCredits, kind) {
 async function insertMultipliedConfirmCredit(client, builderId, taskId, rawCredits, kind, reason = 'task.confirmed', config = rewardConfig()) {
   const result = applyKindMultiplier(rawCredits, kind);
   // Reward-mode gate (ADR 0146): in 'cost-plus-only' mode this instance pays no
-  // per-task estimate credit — the cost-plus session reward is the sole equity
+  // per-task estimate credit — the cost-plus session reward is the sole credit
   // reward. Return the same zero-shape the effective<=0 path returns (so the
   // caller's idea-promotion slice, a fraction of creditsAwarded, cascades to 0)
   // but write NO credit_log row. The task's credits_reward still exists for

package/modules/economy/goal-reward.js

@@ -0,0 +1,161 @@
+'use strict';
+
+// modules/economy/goal-reward.js — the KARMA a goal's contributors earn when the
+// goal is ACHIEVED (task 1001693 / BV1.P5.3, ADR 0101 Part 3).
+//
+// WHY KARMA AND NOT CREDITS. Credits are paid per task already (the estimate and
+// the cost-plus session reward, ADR 0054), and a goal is a coordination construct,
+// not a unit of billable work. A credit bonus on top would pay the same shipping
+// twice out of a tight budget. Karma recognises the collaboration at no monetary
+// cost. Whether ANY money attaches to an achievement, and the size of the karma
+// pool below, are the owner's call (ADR 0101 Part 3 "owner-gated"): the numbers
+// here are the budget-safe default, surfaced to the owner rather than presumed.
+//
+// CONTRIBUTION-WEIGHTED, NEVER MEMBERSHIP-FLAT. The pool is split by the number of
+// tasks each builder SHIPPED under the goal (tasks.shipped_by, the attribution
+// every shipped-work reader already keys on). Joining a goal earns nothing, so
+// squatting on goals buys nothing. The goal's owner (goals.created_by) takes a
+// small coordination share on top of whatever they shipped. The weight is a COUNT,
+// deliberately not credits_reward: that is the task author's own estimate, so
+// weighting by it would let whoever writes the tasks size their own share.
+//
+// ON ACHIEVEMENT, NEVER ON CREATION, AND ONCE PER GOAL EVER. The lifecycle calls
+// this only from the statement that actually flipped the goal open→achieved, so
+// exactly one caller reaches it per flip. The reason key `goal.achieved:<id>` is
+// checked inside the one INSERT as well, so a goal that is reopened and achieved
+// again pays nothing the second time: reopen/re-achieve cannot be farmed.
+//
+// A goal whose work was all abandoned shipped nothing and earns nothing.
+//
+// karma_log rows reach builders.karma through the migration-040 trigger; nothing
+// here touches builders directly.
+
+const GOAL_ACHIEVEMENT_KARMA_POOL = 10;
+const GOAL_OWNER_SHARE = 0.1;
+const GOAL_REASON_PREFIX = 'goal.achieved:';
+
+// Largest-remainder apportionment: integer shares that always sum to `total`, ties
+// broken by builder id so the same inputs always give the same split.
+function apportion(total, weights) {
+  const sum = weights.reduce((t, w) => t + w.weight, 0);
+  if (!(total > 0) || !(sum > 0)) return weights.map((w) => ({ ...w, share: 0 }));
+  const raw = weights.map((w) => {
+    const exact = (total * w.weight) / sum;
+    return { ...w, share: Math.floor(exact), rem: exact - Math.floor(exact) };
+  });
+  let left = total - raw.reduce((t, r) => t + r.share, 0);
+  const order = [...raw].sort((a, b) => (b.rem - a.rem) || (String(a.builderId) < String(b.builderId) ? -1 : 1));
+  for (const r of order) {
+    if (left <= 0) break;
+    r.share += 1;
+    left -= 1;
+  }
+  return raw.map(({ rem, ...r }) => r);
+}
+
+// goalRewardSplit — PURE. Who earns what from one achieved goal.
+// `contributions` is [{ builderId, shipped }]; returns [{ builderId, delta, role }],
+// one row per builder, zero rows dropped. Conserves the pool exactly whenever at
+// least one task shipped.
+function goalRewardSplit({ contributions = [], ownerId = null,
+  pool = GOAL_ACHIEVEMENT_KARMA_POOL, ownerShare = GOAL_OWNER_SHARE } = {}) {
+  const shippers = contributions
+    .map((c) => ({ builderId: c.builderId, weight: Number(c.shipped) || 0 }))
+    .filter((c) => c.builderId != null && c.weight > 0);
+  if (shippers.length === 0 || !(pool > 0)) return [];
+
+  const ownerCut = ownerId == null ? 0 : Math.round(pool * ownerShare);
+  const byBuilder = new Map();
+  for (const s of apportion(pool - ownerCut, shippers)) {
+    if (s.share > 0) byBuilder.set(String(s.builderId), { builderId: s.builderId, delta: s.share, role: 'contributor' });
+  }
+  if (ownerCut > 0) {
+    const key = String(ownerId);
+    const prior = byBuilder.get(key);
+    byBuilder.set(key, prior
+      ? { ...prior, delta: prior.delta + ownerCut, role: 'owner_contributor' }
+      : { builderId: ownerId, delta: ownerCut, role: 'owner' });
+  }
+  return [...byBuilder.values()];
+}
+
+// awardGoalAchievementKarma — book the split for one just-achieved goal on the
+// caller's executor (the ship transaction, or the pool for the reconciler sweep).
+// Returns { awarded, reason, payees }; `awarded` is the karma NEWLY booked, 0 on a
+// re-achieve or a goal that shipped nothing.
+//
+// IT CAN NEVER FAIL THE ACHIEVEMENT. A failed statement inside the ship
+// transaction would abort the whole ship, so on a transaction client the booking
+// runs under a SAVEPOINT and rolls back to it on any error; on a pool, SAVEPOINT
+// itself fails, nothing is open to poison, and the booking runs plainly. The
+// reconcileAfterCraftCredit precedent in achievements.js, exactly. A failure
+// returns reason 'failed' with the message, and books nothing.
+async function awardGoalAchievementKarma(exec, opts = {}) {
+  let saved = false;
+  try {
+    await exec.query('SAVEPOINT goal_achievement_karma');
+    saved = true;
+  } catch (_) { /* not in a transaction: a pool */ }
+  try {
+    const out = await bookGoalKarma(exec, opts);
+    if (saved) await exec.query('RELEASE SAVEPOINT goal_achievement_karma');
+    return out;
+  } catch (e) {
+    if (saved) {
+      try { await exec.query('ROLLBACK TO SAVEPOINT goal_achievement_karma'); } catch (_e) { /* the caller's tx decides */ }
+    }
+    return { awarded: 0, reason: 'failed', error: e && e.message, payees: [] };
+  }
+}
+
+async function bookGoalKarma(exec, { goalId } = {}) {
+  const id = Number(goalId);
+  if (!Number.isFinite(id)) return { awarded: 0, reason: 'bad_goal_id', payees: [] };
+  const reason = `${GOAL_REASON_PREFIX}${id}`;
+  const { rows: goalRows } = await exec.query('SELECT created_by FROM goals WHERE id = $1', [id]);
+  if (goalRows.length === 0) return { awarded: 0, reason: 'not_found', payees: [] };
+  const { rows } = await exec.query(
+    `SELECT shipped_by AS builder_id, count(*)::int AS shipped
+       FROM tasks
+      WHERE goal_id = $1 AND status = 'shipped' AND shipped_by IS NOT NULL
+        AND title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
+      GROUP BY shipped_by`,
+    [id]
+  );
+  const payees = goalRewardSplit({
+    contributions: rows.map((r) => ({ builderId: r.builder_id, shipped: r.shipped })),
+    ownerId: goalRows[0].created_by,
+  });
+  if (payees.length === 0) return { awarded: 0, reason: 'nothing_shipped', payees: [] };
+  // ONE statement for every payee, guarded on the goal's reason key: either the
+  // whole split is booked or none of it is.
+  //
+  // THE GUARD IS BUILDER-SCOPED so it is served by idx_karma_log_builder: karma_log
+  // has no index on `reason` and is the whole instance's append-only karma history,
+  // so a reason-only NOT EXISTS would scan all of it. Scoping to the builders who
+  // could hold an earlier row for this goal loses nothing: an earlier award paid
+  // the goal's owner (always a payee when the goal has one) and every builder who
+  // had shipped by then, and shipped tasks stay shipped, so a re-achieve's guard
+  // set always contains at least one earlier payee. The owner is added to the set
+  // explicitly for that reason.
+  const guardIds = [...new Set([...payees.map((p) => String(p.builderId)),
+    ...(goalRows[0].created_by == null ? [] : [String(goalRows[0].created_by)])])];
+  const { rowCount } = await exec.query(
+    `INSERT INTO karma_log (builder_id, delta, reason, granted_by)
+     SELECT u.builder_id, u.delta, $3, NULL
+       FROM unnest($1::bigint[], $2::int[]) AS u(builder_id, delta)
+      WHERE NOT EXISTS (SELECT 1 FROM karma_log
+                         WHERE builder_id = ANY($4::bigint[]) AND reason = $3)`,
+    [payees.map((p) => p.builderId), payees.map((p) => p.delta), reason, guardIds]
+  );
+  if (rowCount === 0) return { awarded: 0, reason: 'already_awarded', payees: [] };
+  return { awarded: payees.reduce((t, p) => t + p.delta, 0), reason: 'awarded', payees };
+}
+
+module.exports = {
+  GOAL_ACHIEVEMENT_KARMA_POOL,
+  GOAL_OWNER_SHARE,
+  GOAL_REASON_PREFIX,
+  goalRewardSplit,
+  awardGoalAchievementKarma,
+};

package/modules/economy/reward.js

@@ -23,6 +23,7 @@ const ideaSizeLib = require('./idea-size');
 const ideaSizeHistorical = require('./idea-size-historical');
 const ideaBrightnessLib = require('./idea-brightness');
 const creditsByCraftLib = require('./credits-by-craft');
+const goalReward = require('./goal-reward');
 
 module.exports = {
   // credit allocation — transaction-participant: caller passes its tx `client`
@@ -30,6 +31,9 @@ module.exports = {
   maybeAwardIdeaPromotionBonus: (...a) => credits.maybeAwardIdeaPromotionBonus(...a),
   // ADR 0172 IC2 — the ideator credit lane (stream 2): a passing Full Idea pays its author, once.
   awardIdeaFullPassCredit: (...a) => credits.awardIdeaFullPassCredit(...a),
+  // BV1.P5.3 / ADR 0101 Part 3 — an achieved goal's karma, split by shipped work.
+  // Called by the lifecycle on the executor of the statement that flipped the goal.
+  awardGoalAchievementKarma: (...a) => goalReward.awardGoalAchievementKarma(...a),
   // ADR 0172 IC4 — stream 1: pay the idea's author per shipped task, grade-scaled (replaces the 25% slice at ship).
   awardIdeaTaskShipCredit: (...a) => credits.awardIdeaTaskShipCredit(...a),
   // BV2.R09 / ADR 0312 — the same stream, for the origins the shipping task

package/modules/economy/routes/cost.js

@@ -20,20 +20,38 @@ const express = require('express');
 // intra-module require — a module never requires a core internal.
 const api = require('../../../src/module-api');
 const cost = require('../cost');
+const { checkCostWrite, MAX_ROW_USD } = require('../cost-write-guard');
 const { validateOrRespond, LIMITS } = api;
 
 const COST_CATEGORIES = ['api', 'compute', 'infra', 'domain', 'art', 'other'];
 
-module.exports = function buildCostRouter() {
+// Has this builder ever claimed this task? A released claim still counts: a
+// session's cost lands after its ship frees the claim (task 1004959). Served by
+// idx_claims_task_all (claims (task_id), core_263): a task carries a handful of
+// claims ever, so the builder_id filter runs over those rows, never the table.
+async function builderHasClaimed(taskId, builderId) {
+  const { rows } = await api.pool.query(
+    'SELECT 1 FROM claims WHERE task_id = $1 AND builder_id = $2 LIMIT 1',
+    [taskId, builderId],
+  );
+  return rows.length > 0;
+}
+
+// deps.logCost / deps.hasClaimed are test seams; production uses the real ones.
+module.exports = function buildCostRouter(deps = {}) {
   // The Treasury's floors and record in the Governor City (task 1004527).
   require('../governor-docket').contributeEconomyToDocket();
   const router = express.Router();
+  const logCost = deps.logCost || ((...a) => cost.logCost(...a));
+  const hasClaimed = deps.hasClaimed || builderHasClaimed;
 
   // rank: any-builder — log cost on own claim (idempotent via source/source_ref).
+  // Who may book what (reserved sources, the caller's own task, the per-row cap)
+  // is cost-write-guard.js — security report 1000029.
   router.post('/cost', api.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       task_id: { type: 'integer', min: 1 },
-      amount_usd: { required: true, type: 'number', min: 0, max: 1000000 },
+      amount_usd: { required: true, type: 'number', min: 0, max: MAX_ROW_USD },
       // Don't enum-restrict category — the existing skills set categories that
       // may legitimately drift; just cap the length. (CLAUDE.md mentions
       // api|compute|infra|domain|art|other as the canonical set.)
@@ -45,10 +63,10 @@ module.exports = function buildCostRouter() {
       // System 1 / task 1344: optional per-tier USD split (cost_log columns
       // added by migration 123). session-cost.js sends these so spend can be
       // attributed by tier (cache_read is the marathon sink). Omitted → NULL.
-      fresh_input_usd: { type: 'number', min: 0, max: 1000000 },
-      cache_read_usd: { type: 'number', min: 0, max: 1000000 },
-      cache_write_usd: { type: 'number', min: 0, max: 1000000 },
-      output_usd: { type: 'number', min: 0, max: 1000000 },
+      fresh_input_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
+      cache_read_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
+      cache_write_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
+      output_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
       // V3.R11 (#91): builder_id is optional. When absent we default to the
       // authed builder (the right answer 99% of the time). When provided it
       // must match the authed builder — we don't let one builder attribute
@@ -85,7 +103,15 @@ module.exports = function buildCostRouter() {
       recordedAtDate = parsed;
     }
     try {
-      const out = await cost.logCost({
+      const refused = await checkCostWrite({
+        source,
+        taskId: taskId ?? null,
+        rank: req.builder?.rank,
+        rankMeets: api.rankMeetsThreshold,
+        callerHasClaimed: (id) => hasClaimed(id, authedBuilderId),
+      });
+      if (refused) return res.fail(refused.code, { status: refused.status, message: refused.message });
+      const out = await logCost({
         taskId: taskId ?? null,
         amountUsd,
         category,

package/modules/government/catalog.js

@@ -238,6 +238,12 @@ const PERMISSIONS = [
   // Review the store's proposed sub-categories (task 1004355, ADR 0342 D3): approve,
   // rename then approve, or merge into an existing one (a merge moves its modules).
   { key: 'module.subcategory.review', system: false, floor: 'metic', guards: 'GET /store/subcategories/queue, POST /store/subcategories/:id/approve, POST /store/subcategories/:id/merge' },
+  // The project's authorised person for money (task 1004913, ADR 0385 D4): sign,
+  // narrow or revoke a standing payout rule, hold a noticed run, approve one payout,
+  // sign one equity grant or contract, and read the approval log. Archon by default;
+  // not a system key, so a project may hand it to a treasurer rank of its own. The
+  // routes additionally refuse anything but a person's own web session.
+  { key: 'payout.approve', system: false, floor: 'archon', guards: 'GET /payouts/approvals, GET /payouts/rules, POST /payouts/rules[/:id/{narrow,revoke,runs,runs/:runKey/hold}], POST /payouts/{approve,grants,contracts}' },
   // Take a module out of the store (task 1003797, ADR 0338 D2). Stops new installs,
   // versions and downloads; never reaches an instance that already holds it.
   { key: 'module.delist', system: false, floor: 'metic', guards: 'POST /store/modules/:key/delist, POST /store/modules/:key/versions/:version/release (a version the promotion gate held on tester — task 1003804), POST /store/modules/:key/versions/:version/withdraw (take a version back — task 1004895)' },