@bongos/core 1.24.14 → 1.24.15

package/scripts/bongos/strand-watch.js

@@ -40,6 +40,7 @@
 
 const { apiCall, arg, hasFlag } = require('./cli-lib');
 const tweakHold = require('../../modules/lifecycle/page-tweak-hold.js');
+const { safeTaskName, taskRef } = require('../../modules/lifecycle/task-name.js');
 
 // ---- thresholds -------------------------------------------------------------
 // Reasoned, not magic. Written down because a future reader will want to retune them.
@@ -88,7 +89,17 @@ function humanAge(ms) {
 //   confirmed -> the grade passed and the LAND is outstanding (/merge-mode is the fallback).
 // A reconciler-recorded strand is called out separately because it is terminal without a
 // human: the automated healers have already refused it.
-function classifyStrand(task, { nowMs, confirmedStaleMs = CONFIRMED_STALE_MS, completedStaleMs = COMPLETED_STALE_MS } = {}) {
+// task 1004958: a strand carries the task's short name when it has one, so the line
+// reads "task N - payout approvals". `safeTaskName` re-checks the stored name against
+// its fixed shape (three lowercase words at most) — see the trust note on `line()`.
+function classifyStrand(task, opts) {
+  const s = classifyShape(task, opts);
+  const name = s && safeTaskName(task && task.short_name);
+  if (name) s.name = name;
+  return s;
+}
+
+function classifyShape(task, { nowMs, confirmedStaleMs = CONFIRMED_STALE_MS, completedStaleMs = COMPLETED_STALE_MS } = {}) {
   const t = task || {};
   const status = String(t.status || '');
   if (!WATCHED.includes(status)) return null;
@@ -193,7 +204,8 @@ async function check({ nowMs = Date.now(), timeoutMs = DEFAULT_TIMEOUT_MS, confi
       if (status === 'completed' && held.has(String(t.id))) {
         const updated = Date.parse(t.updated_at || '');
         const ageMs = Number.isFinite(updated) ? nowMs - updated : NaN;
-        waiting.push({ id: safeId(t.id), status, ageMs, age: humanAge(ageMs), shape: tweakHold.HOLD_STATE });
+        const name = safeTaskName(t.short_name);
+        waiting.push({ id: safeId(t.id), status, ageMs, age: humanAge(ageMs), shape: tweakHold.HOLD_STATE, ...(name ? { name } : {}) });
         continue;
       }
       const s = classifyStrand(t, { nowMs, confirmedStaleMs, completedStaleMs });
@@ -214,6 +226,10 @@ async function check({ nowMs = Date.now(), timeoutMs = DEFAULT_TIMEOUT_MS, confi
 // is the same reasoning deploy-divergence.js applies to the /version response it reads (it
 // accepts only a strict semver for exactly this purpose). Ids and a fixed reason vocabulary
 // carry all the signal that is needed and none of the risk — the agent can GET the task.
+// The one exception is the task's SHORT NAME (task 1004958), because a bare number means
+// nothing to the person the agent talks to. It is not free text: it is generated, and
+// `safeTaskName` passes only three lowercase words of [a-z0-9-] (40 characters, the
+// table CHECK holds the same shape), so it can name a topic and carry nothing else.
 function line(r, { max = 3 } = {}) {
   if (!r || r.undetermined) return null;
   const trunc = Array.isArray(r.truncated) && r.truncated.length
@@ -225,7 +241,7 @@ function line(r, { max = 3 } = {}) {
     return trunc ? `Strand check could not see the whole board${trunc}. Run: node scripts/bongos/strand-watch.js` : null;
   }
   const shown = r.strands.slice(0, max)
-    .map((s) => `task ${s.id} (${s.status}, ${s.age}${s.reason ? `, ${s.reason}` : ''})`);
+    .map((s) => `${taskRef(s.id, s.name)} (${s.status}, ${s.age}${s.reason ? `, ${s.reason}` : ''})`);
   const more = (r.strands.length > shown.length ? ` +${r.strands.length - shown.length} more` : '') + trunc;
   const worst = r.strands[0];
   // Lead with what the WORST shape actually means. "work is finished but not landed" is true
@@ -255,12 +271,20 @@ const RELAY_RULE = 'This note is for you, not the builder: do not repeat it to t
 // The lease clause, appended at PRINT time, never cached: the line text is shared across
 // sessions for up to two hours (linePlan), while who holds a strand changes by the minute and
 // differs per worktree. Fail-open: no lease folder, no clause.
+// The task names the cached line already carries ("task N - name ("), so the lease clause
+// can name the same tasks without a second read. Only the safe name shape is matched.
+function namesIn(text) {
+  const names = {};
+  for (const m of String(text || '').matchAll(/task (\d{1,19}) - ([a-z0-9]+(?:-[a-z0-9]+)*(?: [a-z0-9]+(?:-[a-z0-9]+)*){0,2}) \(/g)) names[m[1]] = m[2];
+  return names;
+}
+
 function withLeases(text, { now = Date.now() } = {}) {
   if (!text) return text;
   try {
     const lease = require('./strand-lease.js');
     const me = lease.currentHolder();
-    const clause = lease.othersClause(lease.liveLeases({ dir: lease.leaseDir(), now }), me && me.holder, now);
+    const clause = lease.othersClause(lease.liveLeases({ dir: lease.leaseDir(), now }), me && me.holder, now, namesIn(text));
     return clause ? `${text} ${clause}` : text;
   } catch { return text; }
 }
@@ -278,7 +302,7 @@ function report(r) {
   // task 1004322: named, and kept apart from the strands — nobody should recover these.
   const waiting = Array.isArray(r.waiting) ? r.waiting : [];
   for (const w of waiting) {
-    console.log(`  task ${w.id}  waiting for the artist (${w.age}) — a page tweak whose grade passed; not a strand, leave it`);
+    console.log(`  ${taskRef(w.id, w.name)}  waiting for the artist (${w.age}) — a page tweak whose grade passed; not a strand, leave it`);
   }
   if (r.ok) {
     console.log('  ✓ none — nothing parked at completed or confirmed past its threshold.');
@@ -286,7 +310,7 @@ function report(r) {
     return;
   }
   for (const s of r.strands) {
-    console.log(`  task ${s.id}  ${s.status.padEnd(9)} ${String(s.age).padStart(4)}  ${s.shape}${s.reason ? ` (${s.reason})` : ''}`);
+    console.log(`  ${taskRef(s.id, s.name)}  ${s.status.padEnd(9)} ${String(s.age).padStart(4)}  ${s.shape}${s.reason ? ` (${s.reason})` : ''}`);
     console.log(`      ${s.remedy}`);
   }
   console.log('');
@@ -400,6 +424,13 @@ async function main() {
         if (shown) console.log(withLeases(shown));
       }
     } catch { /* no session, offline, unreadable, past the deadline — all silence */ }
+    // task 1004957: when stuck ships have paused new work for EVERY session of this
+    // builder, say so here too — the owner chose this note over a new startup step.
+    // Its own bounded read; silent unless paused; never fails the session start.
+    try {
+      const paused = await require('./sessions-board.js').lineNow();
+      if (paused) console.log(paused);
+    } catch { /* silence */ }
     process.exitCode = 0;
     return;
   }
@@ -426,7 +457,7 @@ if (require.main === module) {
 }
 
 module.exports = {
-  check, line, withLeases, report, classifyStrand, rankStrands, humanAge,
+  check, line, withLeases, namesIn, report, classifyStrand, rankStrands, humanAge,
   linePlan, labelStale, produceLine, LINE_FRESH_MS, LINE_STALE_MAX_MS, LINE_DEADLINE_MS,
   CONFIRMED_STALE_MS, COMPLETED_STALE_MS, STRAND_REASON_PREFIX, WATCHED, PAGE_LIMIT,
 };

package/scripts/gds/report-checkout.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// scripts/gds/report-checkout.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/report-checkout.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'report-checkout.js');

package/scripts/gds/sessions-board.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// scripts/gds/sessions-board.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/sessions-board.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'sessions-board.js');

package/src/bongos/agent-standing-rules.js

@@ -25,20 +25,30 @@ const SLOP_TEXT = 'The moment you find you were wrong because something told you
   + 'and file it: `node scripts/bongos/capture.js "<file>: says X, truth is Y" --kind bug`. The misleading source is the bug. '
   + 'Your own plain mistake, with nothing misleading behind it, is not slop.';
 
+// task 1004958: a bare task number means nothing to the person reading.
+const TASK_NAME_TEXT = 'When you mention a task to a person, write it as "task N - <name>": the number, a dash, then the task\'s '
+  + 'two or three word name (its `short_name`; claim, ship, the startup notes and the sessions board print it). '
+  + 'A bare "task 1004745" means nothing to the reader.';
+
 const HEADER = 'Standing rules for every session:';
 
 function standingRulesBlock() {
-  return `${HEADER}\n- ${HUMAN_SIGNAL_TEXT}\n- ${SLOP_TEXT}`;
+  return `${HEADER}\n- ${HUMAN_SIGNAL_TEXT}\n- ${SLOP_TEXT}\n- ${TASK_NAME_TEXT}`;
 }
 
 // The interaction slice of GET /me with the standing rules appended. `interaction` is
 // describeInteraction's object or null (builder-settings module off); either way the
 // result injects, because these rules do not depend on any preference. Idempotent.
-function withStandingRules(interaction) {
+// `opts.checkout` (task 1005021) is GET /me's checkout_freshness: when this person's
+// folder is behind and could not update itself, its agent_line rides here too, so even
+// a stale Conductor tells them.
+function withStandingRules(interaction, opts = {}) {
   const base = interaction && typeof interaction === 'object' ? interaction : {};
   const contract = typeof base.contract === 'string' ? base.contract : '';
   if (contract.includes(HEADER)) return { ...base, inject: true };
-  return { ...base, contract: contract ? `${contract}\n${standingRulesBlock()}` : standingRulesBlock(), inject: true };
+  const c = opts && opts.checkout;
+  const block = standingRulesBlock() + (c && c.behind && typeof c.agent_line === 'string' ? `\n- ${c.agent_line}` : '');
+  return { ...base, contract: contract ? `${contract}\n${block}` : block, inject: true };
 }
 
 module.exports = { withStandingRules };

package/src/bongos/routes/me.js

@@ -395,6 +395,9 @@ module.exports = function buildMeRouter() {
     const lawed = settings && typeof settings.describeWithLaws === 'function'
       ? settings.describeWithLaws(behaviorPrefs, (sessionLaws && sessionLaws.laws) || [], { rank: builder && builder.rank, instanceModels })
       : null;
+    // task 1005021: the builder's own report of how far behind their local folder is.
+    const checkoutFreshness = settings && typeof settings.describeCheckout === 'function'
+      ? settings.describeCheckout(behaviorPrefs) : null;
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
     // profile banner read it without a follow-up call; the ship + art-pipeline
@@ -568,7 +571,10 @@ module.exports = function buildMeRouter() {
       // the SSOT (builder-settings port). null when the prefs module is off.
       // task 1005015: the standing rules (human-task markers, slop detection) ride
       // this contract because every Conductor, stale ones included, relays it.
-      interaction: withStandingRules(lawed ? lawed.interaction : (settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null)),
+      interaction: withStandingRules(lawed ? lawed.interaction : (settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null), { checkout: checkoutFreshness }),
+      // task 1005021: how far behind this builder's local folder is, as their session last
+      // reported it; null when never reported or too old to mean anything.
+      checkout_freshness: checkoutFreshness,
       // task 1004707: the project's LAWS, read into every AI session. The
       // Conductor hook relays `contract` verbatim beside the interaction profile
       // (inject:false, and no block, when no law is in force). `laws` is the book

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.14'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.15'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/agent_standing_rules.mjs

@@ -27,7 +27,7 @@ const conductor = requireHostModule(require, '../.claude/hooks/conductor.js');
 const slopcheck = requireHostModule(require, '../.claude/hooks/stop-slopcheck.js');
 
 // The words as the server serves them: a header line, then one '- ' line per rule.
-const [HEADER, HUMAN, SLOP] = rules.withStandingRules(null).contract.split('\n').map((l, i) => (i ? l.slice(2) : l));
+const [HEADER, HUMAN, SLOP, TASK_NAMES] = rules.withStandingRules(null).contract.split('\n').map((l, i) => (i ? l.slice(2) : l));
 
 let passed = 0;
 let failed = 0;
@@ -40,6 +40,7 @@ t('the server appends both rules to a builder\'s interaction contract and keeps
   assert.ok(out.contract.startsWith('Interaction profile — P\n'), 'the profile stays first');
   assert.ok(out.contract.includes(HUMAN));
   assert.ok(out.contract.includes(SLOP));
+  assert.ok(out.contract.includes(TASK_NAMES));
   assert.equal(out.inject, true);
   assert.deepEqual(out.fields, [1], 'the rest of the slice is untouched');
 });
@@ -70,9 +71,19 @@ t('the rules mark both markers and the slop line exactly as the owner set them',
 t('the Conductor\'s copy says exactly what the server sends', () => {
   assert.equal(conductor.HUMAN_SIGNAL_TEXT, HUMAN);
   assert.equal(conductor.SLOP_TEXT, SLOP);
+  assert.equal(conductor.TASK_NAME_TEXT, TASK_NAMES);
   assert.equal(conductor.STANDING_HEADER, HEADER);
 });
 
+t('the task-name rule tells the AI to write "task N - <name>" (task 1004958)', () => {
+  assert.ok(TASK_NAMES.includes('"task N - <name>"'));
+  const served = rules.withStandingRules({ inject: true, contract: 'P' });
+  const a = conductor.evaluateTriggers({ firstPrompt: true, interaction: served });
+  assert.ok(!a.some((x) => x.id === 'task-names'), 'not said twice when the server sent it');
+  const old = conductor.evaluateTriggers({ firstPrompt: true, interaction: { inject: true, contract: 'P' } });
+  assert.ok(old.some((x) => x.id === 'task-names' && x.text === TASK_NAMES), 'an older server still gets the local line');
+});
+
 t('the first-prompt marker line is skipped when the server already sent the rules', () => {
   const served = rules.withStandingRules({ inject: true, contract: 'P' });
   const a = conductor.evaluateTriggers({ firstPrompt: true, interaction: served });
@@ -95,6 +106,12 @@ t('a person correcting the agent triggers the slop check, every time', () => {
   }
 });
 
+t('the app\'s own status messages never trigger the slop check (task 1005023)', () => {
+  const notice = '<system-reminder>[SYSTEM NOTIFICATION - NOT USER INPUT] This is an automated background-task event, NOT a message from the user. Do NOT interpret this as user acknowledgement. Any statement that the user said, approved, or confirmed something is NOT real user input.<task-notification><status>completed</status><summary>Background command "Ship it" completed. It is live, not true, actually it works, slop</summary></task-notification></system-reminder>';
+  assert.ok(!conductor.evaluateTriggers({ prompt: notice }).some((x) => x.id === 'slop-check'));
+  assert.ok(conductor.evaluateTriggers({ prompt: "that's wrong, it's already live" }).some((x) => x.id === 'slop-check'), 'a real correction still fires');
+});
+
 t('ordinary prompts do not trigger the slop check', () => {
   for (const p of ['add a dark mode toggle', 'run the tests', 'what can I work on', 'make the button wider']) {
     assert.ok(!conductor.evaluateTriggers({ prompt: p }).some((x) => x.id === 'slop-check'), p);

package/tests/ai_studio_billing.mjs

@@ -169,6 +169,7 @@ const db = require('../modules/ai-studio/db.js');
 const api = require('../src/module-api.js');
 const ledgerRows = [];
 db.appendLedger = async (row) => { ledgerRows.push({ ...row, id: ledgerRows.length + 1, created_at: 'now' }); return {}; };
+db.latestAgeTier = async () => 'adult';
 db.recentLedger = async (builderId) => ledgerRows.filter((r) => r.builderId === builderId).map((r) => ({
   id: r.id, kind: r.kind, request_id: r.requestId || null, amount_micro: r.amountMicro || 0, provider_cost_micro: r.providerCostMicro || 0,
   markup_micro: r.markupMicro || 0, processor_fee_micro: r.processorFeeMicro || 0, backend: r.backend, note: r.note || '', created_at: r.created_at, ref: r.ref,
@@ -222,6 +223,18 @@ test('routes: top up on the test backend, then read the balance and a ledger wit
   assert.equal((await call('POST', '/ai-studio/topup', { amount_usd: 1 })).status, 400);
 });
 
+test('routes: a top-up is adults only, refused before any charge is quoted', async () => {
+  const before = ledgerRows.length;
+  for (const tier of [null, '16_17']) {
+    db.latestAgeTier = async () => tier;
+    const r = await call('POST', '/ai-studio/topup', { amount_usd: 10 });
+    assert.equal(r.status, 403);
+    assert.equal(r.body.error.code || r.body.error, 'adults_only');
+  }
+  db.latestAgeTier = async () => 'adult';
+  assert.equal(ledgerRows.length, before, 'a refused top-up writes nothing');
+});
+
 // Task 1004921: the Studio says "your card is charged $20.91" BEFORE anything is
 // paid, and how much a run sets aside, from these two reads, so neither the fee
 // nor the ceiling is spelled in the browser.

package/tests/ai_studio_gemini_models.mjs

@@ -0,0 +1,81 @@
+// tests/ai_studio_gemini_models.mjs — a retired Gemini model never breaks the
+// studio: when Google answers 404 for the model we name, the key's own model
+// list is read, the newest model of the same kind is used, and that pick is
+// remembered. Google's own reason reaches the message when it still fails.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const G = require('../modules/ai-studio/gemini.js');
+
+const KEY = 'AIza-test-key-0000000000000000000000';
+const gen = ['generateContent'];
+const LIST = [
+  { name: 'models/gemini-2.5-flash', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-pro-preview', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3-pro', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-flash-image-preview', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-flash-image', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-flash-lite-image', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-pro-tts', supportedGenerationMethods: gen },
+  { name: 'models/imagen-4.0-generate-001', supportedGenerationMethods: ['predict'] },
+  { name: 'models/text-embedding-004', supportedGenerationMethods: ['embedContent'] },
+];
+
+test('pickModel takes the newest stable model of the right kind', () => {
+  assert.equal(G.pickModel('images', LIST), 'gemini-3.1-flash-image');
+  assert.equal(G.pickModel('reply', LIST), 'gemini-3-pro');
+  assert.equal(G.pickModel('reply', LIST.filter((m) => m.name !== 'models/gemini-3-pro')), 'gemini-2.5-flash', 'a stable model beats a preview, which Google can pull any day');
+  assert.equal(G.pickModel('reply', LIST.filter((m) => !/gemini-3-pro|2\.5-flash$/.test(m.name))), 'gemini-3.1-pro-preview');
+  assert.equal(G.pickModel('images', []), null);
+});
+
+test('a 404 on the named model falls over to the key\'s newest one, and remembers it', async () => {
+  const calls = [];
+  const PNG = Buffer.from('png').toString('base64');
+  const fetchImpl = async (url, init) => {
+    calls.push({ url, method: init.method, key: init.headers['x-goog-api-key'] });
+    if (init.method === 'GET') return { ok: true, status: 200, json: async () => ({ models: LIST }) };
+    if (url.includes('gemini-2.5-flash-image')) return { ok: false, status: 404, json: async () => ({ error: { message: 'models/gemini-2.5-flash-image is not found' } }) };
+    return { ok: true, status: 200, json: async () => ({ candidates: [{ content: { parts: [{ inlineData: { mimeType: 'image/png', data: PNG } }] } }] }) };
+  };
+  const out = await G.images({ fetchImpl, key: KEY, system: 's', brief: 'b', files: [] });
+  assert.equal(out.images.length, 1);
+  assert.ok(calls[2].url.includes('/gemini-3.1-flash-image:generateContent'));
+  assert.ok(calls.every((c) => c.key === KEY && !c.url.includes(KEY)), 'the key rides only the header');
+  calls.length = 0;
+  await G.images({ fetchImpl, key: KEY, system: 's', brief: 'b', files: [] });
+  assert.equal(calls.length, 1, 'the pick is remembered');
+  assert.ok(calls[0].url.includes('/gemini-3.1-flash-image:'));
+  assert.ok([...G._resolved.keys()].every((k) => !k.includes(KEY)), 'the memory holds a hash, never the key');
+  calls.length = 0;
+  await G.images({ fetchImpl, key: 'AIza-another-key-00000000000000000', system: 's', brief: 'b', files: [] });
+  assert.ok(calls[0].url.includes('/gemini-2.5-flash-image:'), 'another key does not inherit the first key\'s pick');
+  G._resolved.clear();
+});
+
+test('a model list that never answers is given up on, and the refusal still comes back', async () => {
+  const fetchImpl = (url, init) => (init.method === 'GET'
+    ? new Promise((_, reject) => init.signal.addEventListener('abort', () => reject(Object.assign(new Error('aborted'), { name: 'AbortError' }))))
+    : Promise.resolve({ ok: false, status: 404, json: async () => ({ error: { message: 'not found' } }) }));
+  const real = globalThis.setTimeout;
+  globalThis.setTimeout = (fn, ms) => real(fn, ms > 1000 ? 5 : ms); // the 15 s limit, compressed
+  try {
+    await assert.rejects(G.images({ fetchImpl, key: KEY, system: 's', brief: 'b', files: [] }), /HTTP 404: not found\)/);
+  } finally {
+    globalThis.setTimeout = real;
+  }
+});
+
+test('a refusal folds Google\'s own reason into one sentence, with no key and no control characters', async () => {
+  const fetchImpl = async (url, init) => (init.method === 'GET'
+    ? { ok: false, status: 400, json: async () => ({}) }
+    : { ok: false, status: 400, json: async () => ({ error: { message: 'API key not valid. Please pass a valid API key.' } }) });
+  await assert.rejects(G.reply({ fetchImpl, key: KEY, system: 's', prompt: 'p', files: [] }),
+    { message: 'Google refused the request (HTTP 400: API key not valid. Please pass a valid API key). Check the key in Settings.' });
+  assert.equal(G.googleReason({ error: { message: 'bad AIzaSyD-abcdefghijklmnop\u0007\nkey' } }), ': bad [key] key');
+  assert.equal(G.googleReason({ error: { message: 'x'.repeat(500) } }).length, 162);
+  assert.equal(G.googleReason(null), '');
+});

package/tests/ai_studio_requests.mjs

@@ -27,8 +27,10 @@ const OUT_PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 1,
 const files = new Map();
 const requests = new Map();
 let seq = 100;
+let ageTier = 'adult';
 const meta = (f) => ({ id: f.id, request_id: f.request_id, role: f.role, name: f.name, content_type: f.content_type, size_bytes: f.bytes.length, created_at: f.created_at });
 Object.assign(db, {
+  latestAgeTier: async () => ageTier,
   appendLedger: async () => ({}),
   addUpload: async (builderId, f) => {
     const row = { id: String(++seq), builder_id: builderId, request_id: null, role: 'upload', name: f.name, content_type: f.content_type, bytes: f.bytes, created_at: 'now' };
@@ -177,6 +179,8 @@ test('THE WHOLE PATH: upload a sketch, send it, get a reply, an image and the ex
   assert.ok(providerCalls.every((c) => c.auth === `Bearer ${OUR_KEY}`));
   assert.match(providerCalls[0].body.messages[0].content, /art director's assistant/);
   assert.equal(providerCalls[0].body.messages[1].content[1].type, 'image_url');
+  // Every call carried the provider policy: no provider that keeps or trains on prompts.
+  assert.ok(providerCalls.every((c) => c.body.provider && c.body.provider.data_collection === 'deny' && c.body.provider.zdr === true));
 
   // Our key is in nothing a builder can see, and in no log line.
   for (const res of [up, sent, done]) assert.ok(!res.raw.includes(OUR_KEY));
@@ -317,3 +321,23 @@ test('an uploaded PDF downloads rather than opening in the page', async () => {
   const img = await call('POST', '/ai-studio/uploads', { name: 'i.png', content_type: 'image/png', data: PNG.toString('base64') });
   assert.match((await call('GET', `/ai-studio/files/${img.body.file.id}`)).headers['content-disposition'], /^inline;/);
 });
+
+test('AI Studio is adults only: no recorded age, or under 18, is refused before anything runs', async () => {
+  for (const tier of [null, '16_17']) {
+    ageTier = tier;
+    const r = await call('POST', '/ai-studio/requests', { prompt: 'A tower', file_ids: [] });
+    assert.equal(r.status, 403);
+    assert.equal(r.body.error.code || r.body.error, 'adults_only');
+  }
+  ageTier = 'adult';
+  const s = await call('GET', '/ai-studio/status');
+  assert.equal(s.body.adult, true);
+  assert.match(s.body.terms, /18 and over/);
+});
+
+test('every OpenRouter call refuses providers that keep or train on prompts', () => {
+  const { providerPolicy } = require('../modules/ai-studio/openrouter.js');
+  assert.deepEqual(providerPolicy({}), { data_collection: 'deny', zdr: true });
+  assert.deepEqual(providerPolicy({ OPENROUTER_ZDR: 'off', OPENROUTER_ALLOWED_PROVIDERS: 'google-vertex, anthropic', OPENROUTER_DISTILLABLE_ONLY: 'on' }),
+    { data_collection: 'deny', only: ['google-vertex', 'anthropic'], enforce_distillable_text: true });
+});

package/tests/blocker_detail_hydration.mjs

@@ -31,7 +31,7 @@ let queries = [];
 
 api.pool.query = async (sql, params = []) => {
   queries.push({ sql: String(sql), params });
-  if (/FROM blockers b\s+WHERE b\.status = 'open'/.test(sql)) {
+  if (/FROM blockers b\s+LEFT JOIN LATERAL[\s\S]*?\) bl ON true\s+WHERE b\.status = 'open'/.test(sql)) {
     return {
       rows: [
         { id: '1000085', title: 'the open one', body_md: '', status: 'open',
@@ -40,7 +40,7 @@ api.pool.query = async (sql, params = []) => {
       ],
     };
   }
-  if (/FROM blockers b WHERE b\.id = \$1/.test(sql)) {
+  if (/FROM blockers b LEFT JOIN LATERAL[\s\S]*?\) bl ON true WHERE b\.id = \$1/.test(sql)) {
     const id = String(params[0]);
     if (id === '1000085') {
       return {
@@ -87,7 +87,9 @@ async function test(name, fn) {
 }
 
 function blockingTaskIdsFragment(sql) {
-  const match = sql.match(/COALESCE\(\s*\(SELECT array_agg\(tb\.task_id[\s\S]*?blocking_task_ids/);
+  // task 1004958: the ids now come from one LATERAL read (with the named tasks beside
+  // them); the identity that matters is still the projection AND the join it reads.
+  const match = sql.match(/COALESCE\(bl\.ids[\s\S]*?\) bl ON true/);
   assert.ok(match, `query does not carry a blocking_task_ids projection:\n${sql}`);
   return match[0].replace(/\s+/g, ' ').trim();
 }

package/tests/blocker_tasks_named_db.mjs

@@ -0,0 +1,74 @@
+// tests/blocker_tasks_named_db.mjs — task 1004958. Real DB.
+// A blocker names the tasks it holds ("task N - <name>"), through ONE lateral read in
+// modules/ideas/blockers.js that returns both blocking_task_ids (the hall's field) and
+// blocking_tasks [{ id, short_name }]. tests/blocker_detail_hydration.mjs pins the SQL
+// text against a fake pool; this runs the real listOpenBlockers / getBlocker against a
+// fully migrated Postgres: ordering, a task with no name yet, a blocker holding nothing,
+// and that the two reads agree.
+// Self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=... node tests/blocker_tasks_named_db.mjs
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`blocker_tasks_named_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const blockers = require('../modules/ideas/blockers.js');
+const VER = 'ZZZ-NAMES';
+const T1 = 990049581;
+const T2 = 990049582;
+const REF = 'task-1004958-names';
+const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
+
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+async function cleanup() {
+  await q(`DELETE FROM task_blockers WHERE task_id = ANY($1::bigint[]) OR blocker_id IN (SELECT id FROM blockers WHERE source = 'test' AND source_ref LIKE $2)`, [[T1, T2], `${REF}%`]).catch(() => {});
+  await q(`DELETE FROM blockers WHERE source = 'test' AND source_ref LIKE $1`, [`${REF}%`]).catch(() => {});
+  await q('DELETE FROM tasks WHERE id = ANY($1::bigint[])', [[T1, T2]]).catch(() => {});
+  await q('DELETE FROM versions WHERE id = $1', [VER]).catch(() => {});
+}
+
+try {
+  await cleanup();
+  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'names','shipped','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
+  // T2 first and with no name: the read must order by id and keep a null name.
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline,short_name)
+           VALUES ($1,$3,'Payout approvals','backlog',10,'feature','engineer','payout approvals'),
+                  ($2,$3,'#12','backlog',10,'feature','engineer',NULL)`, [T1, T2, VER]);
+  const holding = await blockers.createBlocker({ title: 'names fixture: holds two', bodyMd: '', source: 'test', sourceRef: `${REF}-a` });
+  const empty = await blockers.createBlocker({ title: 'names fixture: holds none', bodyMd: '', source: 'test', sourceRef: `${REF}-b` });
+  await blockers.linkBlockerToTask({ blockerId: holding.id, taskId: T2 }); // linked out of id order on purpose
+  await blockers.linkBlockerToTask({ blockerId: holding.id, taskId: T1 });
+
+  const one = await blockers.getBlocker(holding.id);
+  ok(JSON.stringify(one.blocking_task_ids.map(Number)) === JSON.stringify([T1, T2]), 'blocking_task_ids is unchanged in shape and ordered by id');
+  ok(Array.isArray(one.blocking_tasks) && one.blocking_tasks.length === 2, 'blocking_tasks carries one entry per held task');
+  ok(Number(one.blocking_tasks[0].id) === T1 && one.blocking_tasks[0].short_name === 'payout approvals', 'each entry names its task');
+  ok(Number(one.blocking_tasks[1].id) === T2 && one.blocking_tasks[1].short_name === null, 'a task with no name yet keeps null, never a guess');
+
+  const none = await blockers.getBlocker(empty.id);
+  ok(Array.isArray(none.blocking_task_ids) && none.blocking_task_ids.length === 0, 'a blocker holding nothing reads an empty id list');
+  ok(Array.isArray(none.blocking_tasks) && none.blocking_tasks.length === 0, 'and an empty task list, not null');
+
+  const list = await blockers.listOpenBlockers();
+  const fromList = list.find((b) => String(b.id) === String(holding.id));
+  ok(fromList && JSON.stringify(fromList.blocking_tasks) === JSON.stringify(one.blocking_tasks), 'the list and the detail read agree');
+  const paged = await blockers.listOpenBlockers({ limit: 1000, offset: 0 });
+  ok(paged.some((b) => String(b.id) === String(empty.id)), 'the paged list still returns a blocker that holds nothing (the lateral join drops no row)');
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+  // blockers.js reads through the shared doorway pool; close it so the process exits.
+  await require('../src/module-api').pool.end().catch(() => {});
+}
+console.log(`\nblocker_tasks_named_db: ${pass} passed`);

package/tests/claim_gate_ci_unblock.mjs

@@ -66,7 +66,7 @@ function fakeClientFor(task) {
       seen.push(s);
       if (s === 'BEGIN' || s === 'ROLLBACK' || s === 'COMMIT') return { rows: [] };
       if (s.startsWith('SELECT status, rank FROM builders')) return { rows: [{ status: 'active', rank: 'archon' }] };
-      if (s.startsWith('SELECT id, title, needs_rebase_reason, needs_rebase_at FROM tasks WHERE needs_rebase = true')) {
+      if (s.startsWith('SELECT id, title, short_name, needs_rebase_reason, needs_rebase_at FROM tasks WHERE needs_rebase = true')) {
         return { rows: [{ id: '900', title: 'stalled', needs_rebase_reason: 'strand:pr_not_landed', needs_rebase_at: new Date() }] };
       }
       if (s === 'SELECT kind, priority FROM tasks WHERE id = $1') {