@bongos/core 1.24.3 → 1.24.4

package/release-notes.json

@@ -10812,7 +10812,23 @@
       "text": "The payments decision record now carries the owner's answers: credits can be tuned but not switched off, pay rules live on the settings page, and Verro is Verro Labs."
     }
   ],
-  "1.24.3": [
+  "1.24.4": [
+    {
+      "id": "1004968",
+      "text": "The setting that sizes credit rewards is now called a cost scale instead of a dollar peg, so it no longer reads like an exchange rate; old project settings keep working and nobody's rewards change."
+    },
+    {
+      "id": "1004940",
+      "text": "Every member of a project with Market Watch on now gets a 30-second weekly card in the hall asking what counts as a competitor and what else to watch, and each tap becomes a proposal the owner sees, with matching answers count"
+    },
+    {
+      "id": "1004969",
+      "text": "AI-written ship summaries, new ideas and board proposals that describe credits or models as an investment are now flagged for review, and a test fails if the project's own pages or guides ever say it."
+    },
+    {
+      "id": "1004994",
+      "text": "Someone who signed up with Google, with no GitHub account, can now apply to a project and sign in to its hall like anyone else, so they can work as an ideator or artist, earn credits and hold a rank there. Projects still on an"
+    },
     {
       "id": "1005006",
       "text": "The Treasury screen now counts builder rewards in credits instead of dollars, and no longer says one credit is a dollar."

package/scripts/bongos/backfill-subagent-rewards.js

@@ -111,9 +111,9 @@ const round4 = (n) => Math.round((Number(n) || 0) * 10000) / 10000;
 // unit-tested with no DB (tests/backfill_subagent_rewards.mjs).
 //
 // `row` is the shape fetchCandidates() returns. `cutoffMs` is the dedup-fix
-// boundary; `marginPct`/`usdPeg` come from the instance reward policy so the
+// boundary; `marginPct`/`costScale` come from the instance reward policy so the
 // arithmetic matches what actually pays.
-function classifySession(row, { cutoffMs, marginPct, usdPeg } = {}) {
+function classifySession(row, { cutoffMs, marginPct, costScale } = {}) {
   const sessionId = String(row.session_id);
   const builderId = Number(row.builder_id);
   const paid = Number(row.paid) || 0;
@@ -159,7 +159,7 @@ function classifySession(row, { cutoffMs, marginPct, usdPeg } = {}) {
     row.model_usage, row.total_tokens
   );
   const trueCostUsd = round4(interactiveUsd + subagentUsd);
-  const { drachmae: owed } = credits.computeSessionTokenReward(trueCostUsd, marginPct, usdPeg);
+  const { drachmae: owed } = credits.computeSessionTokenReward(trueCostUsd, marginPct, costScale);
   const delta = owed - paid;
 
   if (delta > 0) {
@@ -177,10 +177,10 @@ function classifySession(row, { cutoffMs, marginPct, usdPeg } = {}) {
 function buildBackfillPlan(rows, opts = {}) {
   const cutoffMs = Date.parse(opts.since || DEDUP_FIX_AT);
   const marginPct = opts.marginPct;
-  const usdPeg = opts.usdPeg;
+  const costScale = opts.costScale;
 
   const sessions = (Array.isArray(rows) ? rows : [])
-    .map((r) => classifySession(r, { cutoffMs, marginPct, usdPeg }));
+    .map((r) => classifySession(r, { cutoffMs, marginPct, costScale }));
 
   const counts = {};
   for (const k of Object.values(CLASSES)) counts[k] = 0;
@@ -393,13 +393,13 @@ async function main() {
     return 2;
   }
 
-  const { marginPct, usdPeg } = credits.rewardConfig();
+  const { marginPct, costScale } = credits.rewardConfig();
   const pool = loadPool();
   let plan;
   let rows;
   try {
     rows = await fetchCandidates(pool);
-    plan = buildBackfillPlan(rows, { since, marginPct, usdPeg });
+    plan = buildBackfillPlan(rows, { since, marginPct, costScale });
   } catch (err) {
     console.error(`could not read the ledger: ${err && err.message ? err.message : err}`);
     await pool.end().catch(() => {});

package/scripts/bongos/run-unit-tests.js

@@ -93,6 +93,10 @@ const INTEGRATION = new Set([
   // idempotent and a resumed run unable to record an item twice. DB-free sibling:
   // market_watch_data.
   'market_watch_data_db',
+  // task 1004940: the weekly ask's SQL store — once per week by constraint, one pooled
+  // proposal per similar answer, the project guard on an answer. DB-free sibling:
+  // market_watch_ask.
+  'market_watch_ask_db',
   // bfg, bfg_write, memory_isolation, memory_pull and setup_smoke LEFT this set under task
   // 1004865: none of them ever needed a database. Each failed on a stale test harness (a fake
   // server without res.fail, a stub on the wrong module, an old error shape, a renamed session

package/scripts/hall-preview/server.js

@@ -188,6 +188,8 @@ const CANNED_WRITES = [
   // the owner choosing what a speciality offers (task 1004404): on create, and
   // afterwards from the card's "Offered skills" editor.
   ['POST', /^specialities$/, 'specialities.post'],
+  // the Market Watch weekly ask's answer (task 1004940), so its "sent." state renders.
+  ['POST', /^market-watch\/ask\/answer$/, 'market-watch__ask__answer.post'],
   ['PATCH', /^specialities\/\d+$/, 'specialities__12.patch'],
   // a vote cast from the street's matter card (task 1004528), so the card's
   // answer (the toast, the building lighting) renders here too.
@@ -423,6 +425,17 @@ for (const key of MODULES_ON) {
   const isOn = (k) => !!(mods.enabled && mods.enabled[k]);
   if (stamped['index.html']) stamped['index.html'] = injectModuleHallWidgets(stamped['index.html'], hallWidgetScripts({ isEnabled: isOn }));
   if (stamped['task.html']) stamped['task.html'] = injectModuleHallWidgets(stamped['task.html'], hallWidgetScripts({ isEnabled: isOn, file: 'task-widget.js' }), 'task');
+  // ...and their assets, for the same set. The real asset route (serve-internal.js) gates on
+  // the instance config's enabled set, which ignores --modules-on, so a widget injected for
+  // a module this checkout's config leaves off 404'd and the slot stayed empty (task 1004940).
+  app.get(/^\/modules\/([a-z][a-z0-9-]*)\/public\/([A-Za-z0-9_-][A-Za-z0-9._-]*)$/, (req, res, next) => {
+    // One file name, never a dot-led segment: `..` (or a dotfile) cannot match.
+    const key = req.params[0];
+    if (!isOn(key)) return next();
+    const abs = path.join(ROOT, 'modules', key, 'public', req.params[1]);
+    if (!fs.existsSync(abs)) return next();
+    return res.sendFile(abs);
+  });
 }
 
 function sendPage(res, name) {

package/src/bongos/auth-idp.js

@@ -31,11 +31,19 @@ const { loadIdpConfig } = require('./auth-config.js');
 const { newSessionToken } = require('./auth-github.js');
 const log = require('./logger').logger.child({ src: 'auth-idp' });
 
+// This hall can take a person who joined with Google: a negative person key and
+// a stand-in `~handle` login (ADR 0393/0396, task 1004994). The hub sends such a
+// person only to a hall whose authorize link says so, because an older core must
+// never receive one. Mirrored, boundary-forced, by the hub's PERSON_KEYS_PARAM
+// (modules/platform-identity/account-logins.js); tests/google_halls.mjs pins both.
+const PERSON_KEYS_PARAM = 'person_keys';
+
 function idpAuthorizeUrl(origin, clientId, state, redirectUri) {
   const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/bongos/sso/authorize`);
   u.searchParams.set('client_id', clientId);
   u.searchParams.set('redirect_uri', redirectUri);
   u.searchParams.set('state', state);
+  u.searchParams.set(PERSON_KEYS_PARAM, '1');
   return u.toString();
 }
 
@@ -88,7 +96,7 @@ async function completeIdpFlow({ code, redirectUri, userAgent: ua }) {
   const ghLogin = identity.github_login;
   const existing = await getBuilderByGithubId(ghId);
   if (!existing && !openEnrollmentEnabled()) {
-    const approved = await hasInvitedAccessRequest(ghLogin);
+    const approved = await hasInvitedAccessRequest(ghLogin, ghId);
     if (firstTimeAdmissionBlocked({ existing, approved, login: ghLogin })) {
       const err = new Error('not_approved');
       err.code = 'NOT_APPROVED';
@@ -286,9 +294,12 @@ function applicationVouchIdentity(token, { githubLogin, publicKey, clientId, now
   }
   // The body's login is a string anyone may type: a vouch for another account is no vouch.
   if (String(payload.applicant_login).toLowerCase() !== String(githubLogin || '').toLowerCase()) return null;
-  // The hub mints only for a numeric GitHub id; anything else is not one, and the id
-  // feeds readApplicantProfileFromHub (defence in depth, the ADR 0171 D2 guard).
-  if (!/^\d+$/.test(String(payload.sub))) return null;
+  // The hub mints only for a numeric GitHub id, or for a person who joined with
+  // Google: a negative key that always travels with a stand-in `~handle` login
+  // (task 1004994). They come as a pair, so neither can borrow the other's shape.
+  // The id feeds readApplicantProfileFromHub (defence in depth, the ADR 0171 D2 guard).
+  const standIn = String(payload.applicant_login || '').startsWith('~');
+  if (!(standIn ? /^-\d+$/ : /^\d+$/).test(String(payload.sub))) return null;
   if (vouchJtiSeenAndRecord(payload.jti, payload.exp, nowMs)) return null;
   return {
     githubId: String(payload.sub),
@@ -321,7 +332,7 @@ async function completeDeviceExchange({ assertion, userAgent: ua }) {
   const ghLogin = payload.github_login;
   const existing = await getBuilderByGithubId(ghId);
   if (!existing && !openEnrollmentEnabled()) {
-    const approved = await hasInvitedAccessRequest(ghLogin);
+    const approved = await hasInvitedAccessRequest(ghLogin, ghId);
     if (firstTimeAdmissionBlocked({ existing, approved, login: ghLogin })) {
       const err = new Error('not_approved');
       err.code = 'NOT_APPROVED';
@@ -380,6 +391,7 @@ module.exports = {
   idpAuthorizeUrl,
   loadHubPublicKey,
   logoutTokenJtiSeenAndRecord,
+  PERSON_KEYS_PARAM,
   readApplicationVouch,
   verifyHubApplicationVouch,
   verifyHubAssertion,

package/src/bongos/db-kernel.js

@@ -239,7 +239,20 @@ async function getBuilderByGithubId(githubId) {
 // row at status='invited', case-insensitive)? The approval signal that lets a
 // first-time web sign-in through. An invite older than 30 days no longer counts
 // (inviteLiveSql, task 1002969 / ADR 0356); an approved application never expires.
-async function hasInvitedAccessRequest(login) {
+//
+// A person who joined with Google (a negative person key, ADR 0393) is matched by
+// the key the hub vouched for, never by their stand-in `~handle`: a handle can be
+// renamed and later taken by someone else, so an approval of `~ana` must not
+// admit whoever is `~ana` next (task 1004994).
+async function hasInvitedAccessRequest(login, githubId) {
+  if (/^-\d+$/.test(String(githubId ?? ''))) {
+    const { rows } = await pool.query(
+      `SELECT 1 FROM access_requests
+        WHERE applicant_github_id = $1 AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`,
+      [String(githubId)]
+    );
+    return rows.length > 0;
+  }
   const { rows } = await pool.query(
     `SELECT 1 FROM access_requests
       WHERE lower(github_login) = lower($1) AND status = 'invited' AND ${inviteLiveSql()} LIMIT 1`,

package/src/bongos/module-scope-map.js

@@ -198,6 +198,7 @@ const MODULE_GLOBS = {
     'modules/market-watch/', 'tests/market_watch_module.mjs',
     'tests/market_watch_data.mjs', 'tests/market_watch_data_db.mjs',
     'tests/market_watch_run.mjs',
+    'tests/market_watch_ask.mjs', 'tests/market_watch_ask_db.mjs',
   ],
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.3'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/account_logins.mjs

@@ -307,7 +307,7 @@ test('GET /me/sign-in-methods fails closed on a read error', async () => {
   }
 });
 
-test('a Google-only person is not relayed to a project until halls can take one (task 1004994)', async () => {
+test('a Google-only person goes on to the project lookup like anyone else (task 1004994)', async () => {
   ME = '-3';
   scriptRoute([]);
   try {
@@ -319,8 +319,10 @@ test('a Google-only person is not relayed to a project until halls can take one
       });
       r.on('error', reject); r.end(body);
     });
-    assert.equal(res.status, 409);
-    assert.equal(res.body.error.code, 'google_join_not_yet');
-    assert.equal(routePool.log.length, 0, 'nothing was read or relayed');
+    // No project is scripted, so the lookup answers unknown_project: the point is
+    // that the join reached it rather than refusing the person first.
+    assert.equal(res.status, 404);
+    assert.equal(res.body.error.code, 'unknown_project');
+    assert.ok(routePool.log.length > 0, 'the registered project was looked up');
   } finally { ME = '4242'; }
 });

package/tests/backfill_subagent_rewards.mjs

@@ -26,7 +26,7 @@ const { test, summary } = makeRunner();
 
 const AFTER = '2026-08-25T00:00:00Z';  // safely after the de-dup cutoff
 const BEFORE = '2026-08-20T00:00:00Z'; // safely before it
-const OPTS = { cutoffMs: Date.parse(DEDUP_FIX_AT), marginPct: 20, usdPeg: 1 };
+const OPTS = { cutoffMs: Date.parse(DEDUP_FIX_AT), marginPct: 20, costScale: 1 };
 
 // 1M opus input tokens = $5.00 interactive (PRICES.opus.input = $5/M).
 const OPUS_1M = { 'claude-opus-4-8': { input: 1_000_000 } };
@@ -115,7 +115,7 @@ await test('no_subagent_record: the reason does not blame a failed cost hook for
   assert.doesNotMatch(note, /: the cost hook never ran/, 'does not assert the hook failure as the cause');
   assert.match(note, /cannot (be )?tell|cannot tell|indistinguishable|same trace/i, 'says the two cases look the same in the data');
   const plan = buildBackfillPlan([row({ subagent_usd: null, subagent_recorded_at: null })],
-    { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+    { since: DEDUP_FIX_AT, marginPct: 20, costScale: 1 });
   const { text } = renderReport(plan);
   assert.doesNotMatch(text, /Sessions whose cost hook never ran left no trace at all/,
     'the closing summary no longer reads every no-record session as a lost hook');
@@ -164,7 +164,7 @@ await test('a folded session never reaches the mint, and is reported', () => {
   const plan = buildBackfillPlan([
     row({ session_id: 's1' }),                            // +4
     row({ session_id: 's2', has_folded_usage: true }),    // excluded
-  ], { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+  ], { since: DEDUP_FIX_AT, marginPct: 20, costScale: 1 });
   assert.equal(plan.grandTotal, 4, 'only the un-folded session is paid');
   assert.equal(plan.counts[CLASSES.ALREADY_FOLDED], 1);
   assert.match(renderReport(plan).text, /already_folded/);
@@ -193,7 +193,7 @@ await test('the plan groups payables by builder and totals them', () => {
     row({ session_id: 's3', builder_id: 9 }),                       // +4
     row({ session_id: 's4', builder_id: 9, legacy_rows: 1 }),       // not paid
     row({ session_id: 's5', builder_id: 9, subagent_recorded_at: BEFORE }), // not paid
-  ], { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+  ], { since: DEDUP_FIX_AT, marginPct: 20, costScale: 1 });
 
   assert.equal(plan.totalCandidates, 5);
   assert.equal(plan.plans.length, 2);
@@ -208,14 +208,14 @@ await test('the plan reports what it does NOT settle (ADR 0173 objected to a sil
   const plan = buildBackfillPlan([
     row({ session_id: 's1', subagent_usd: 7.5, subagent_recorded_at: BEFORE }),
     row({ session_id: 's2', paid: 25 }),
-  ], { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+  ], { since: DEDUP_FIX_AT, marginPct: 20, costScale: 1 });
   assert.equal(plan.unpaidSubagentUsd, 7.5, 'inflated-but-real spend is surfaced, not hidden');
   assert.equal(plan.overpaidExcess, 15, 'correcting in one direction only is stated');
   assert.equal(plan.grandTotal, 0);
 });
 
 await test('an empty ledger plans nothing and totals zero', () => {
-  const plan = buildBackfillPlan([], { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+  const plan = buildBackfillPlan([], { since: DEDUP_FIX_AT, marginPct: 20, costScale: 1 });
   assert.equal(plan.grandTotal, 0);
   assert.equal(plan.plans.length, 0);
   assert.match(renderReport(plan).text, /NOTHING PAYABLE/);
@@ -223,7 +223,7 @@ await test('an empty ledger plans nothing and totals zero', () => {
 
 await test('the report leads with the grand total and names every refusal reason', () => {
   const plan = buildBackfillPlan([row(), row({ session_id: 's2', legacy_rows: 1 })],
-    { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+    { since: DEDUP_FIX_AT, marginPct: 20, costScale: 1 });
   const { text, total } = renderReport(plan, { loginFor: (id) => (id === 7 ? 'jaxri' : null) });
   assert.equal(total, 4);
   assert.match(text, /GRAND TOTAL to mint: 4 credits/);

package/tests/credit_grant.mjs

@@ -490,20 +490,20 @@ await test('REWARD_MARGIN_PCT exported as 20', () => {
 //     per-task ESTIMATE payout on. The cost-plus session reward is untouched.
 // =========================================================================
 
-await test('rewardPolicy: default (no mode) → pay both streams; margin/peg resolve', () => {
+await test('rewardPolicy: default (no mode) → pay both streams; margin/scale resolve', () => {
   const p = rewardPolicy({});
   assert.equal(p.mode, REWARD_MODE_DEFAULT);
   assert.equal(p.perTaskCredit, true, 'a default instance pays the per-task estimate');
   assert.equal(p.marginPct, 20);
-  assert.equal(p.usdPeg, 1);
+  assert.equal(p.costScale, 1);
 });
 
 await test('rewardPolicy: mode "cost-plus-only" → per-task estimate payout OFF, cost-plus untouched', () => {
-  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 20, usdPeg: 1 });
+  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 20, costScale: 1 });
   assert.equal(p.mode, REWARD_MODE_COST_PLUS_ONLY);
   assert.equal(p.perTaskCredit, false, 'cost-plus-only suppresses the per-task estimate payout');
   assert.equal(p.marginPct, 20, 'the cost-plus margin is unaffected — that stream is still paid');
-  assert.equal(p.usdPeg, 1);
+  assert.equal(p.costScale, 1);
 });
 
 await test('rewardPolicy: unknown/garbage mode → default (a typo never silently zeroes rewards)', () => {
@@ -546,11 +546,11 @@ await test('rewardPolicy: ideatorCredit is opt-out-only — only an explicit fal
   }
 });
 
-await test('rewardPolicy: cost-plus-only still honors a custom margin + peg', () => {
-  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 35, usdPeg: 2 });
+await test('rewardPolicy: cost-plus-only still honors a custom margin + scale', () => {
+  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 35, costScale: 2 });
   assert.equal(p.perTaskCredit, false);
   assert.equal(p.marginPct, 35);
-  assert.equal(p.usdPeg, 2);
+  assert.equal(p.costScale, 2);
 });
 
 await test('insertMultipliedConfirmCredit: cost-plus-only mode writes NO credit_log row', async () => {

package/tests/credit_wording.mjs

@@ -0,0 +1,154 @@
+// tests/credit_wording.mjs — no investment wording next to credits or models
+// (task 1004969; ADR 0385 decision 9).
+//
+// Credits are a contribution meter, not money and not a stake. This fails when
+// the hall's words, the role packs, the onboarding docs or the branding pack
+// describe credits or models as an investment, a return, appreciation, passive
+// income, equity or ownership — and proves the server's publish paths FLAG such
+// text in the log while publishing it unchanged.
+//
+// Run: node tests/credit_wording.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+const wording = require('../modules/economy/credit-wording.js');
+const reward = require('../modules/economy/reward.js');
+const shipBroadcast = require('../modules/discord/ship-broadcast.js');
+
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+function walk(rel) {
+  const out = [];
+  for (const e of fs.readdirSync(path.join(ROOT, rel), { withFileTypes: true })) {
+    const p = `${rel}/${e.name}`;
+    if (e.isDirectory()) out.push(...walk(p));
+    else if (/\.(md|mmd|json|txt|html)$/.test(e.name)) out.push(p);
+  }
+  return out;
+}
+
+// The corpus the task names: hall copy (the generated copy registry — every
+// string the hall, status page and landing render), the role packs, the
+// onboarding docs and the branding pack.
+function corpus() {
+  const docs = [
+    'config/branding.neutral.json',
+    ...fs.readdirSync(path.join(ROOT, 'docs/packs')).filter((f) => f.endsWith('.md')).map((f) => `docs/packs/${f}`),
+    ...walk('docs/onboarding'),
+  ].map((rel) => ({ where: rel, text: read(rel) }));
+  const registry = JSON.parse(read('docs/copy-registry.json'));
+  const copy = registry.entries.map((e) => ({ where: `hall copy ${e.file}:${e.line}`, text: e.text }));
+  return { docs, copy };
+}
+
+test('the corpus is really read (a scan that finds nothing to scan is not a pass)', () => {
+  const { docs, copy } = corpus();
+  assert.ok(docs.length >= 8, `expected the packs, onboarding docs and branding pack, read ${docs.length}`);
+  assert.ok(copy.length > 1000, `expected the hall copy registry, read ${copy.length} strings`);
+  assert.ok(docs.some((d) => /credit/i.test(d.text)) && copy.some((c) => /credit/i.test(c.text)), 'the corpus talks about credits at all');
+});
+
+test('no investment wording next to credits or models in hall copy, packs, onboarding or branding', () => {
+  const { docs, copy } = corpus();
+  const hits = [];
+  for (const { where, text } of [...docs, ...copy]) {
+    for (const h of wording.findInvestmentWording(text)) hits.push(`${where}: "${h.phrase}" near "${h.anchor}" — ${h.sentence.slice(0, 160)}`);
+  }
+  assert.deepEqual(hits, [], `credits and models are not an investment (ADR 0385 decision 9):\n  ${hits.join('\n  ')}`);
+});
+
+test('a planted phrase is caught — the probe that shows the scan can go red', () => {
+  const planted = [
+    ['Credits are a smart investment in the project.', 'investment'],
+    ['Hold your credits and watch for a return on them.', 'return'],
+    ['Your credits earn a return every month.', 'return'],
+    ['Expect appreciation of credits as the project grows.', 'appreciation'],
+    ['Credits will appreciate in value over time.', 'appreciation'],
+    ['Turn your credits into passive income.', 'passive income'],
+    ['Credits give you equity in the project.', 'equity'],
+    ['Owning the model means ownership of what it builds.', 'ownership'],
+    ['Investing in models pays off.', 'investment'],
+  ];
+  for (const [text, term] of planted) {
+    const hits = wording.findInvestmentWording(text);
+    assert.deepEqual(hits.map((h) => h.term), [term], `"${text}" should flag ${term}`);
+  }
+  // The same corpus with one planted sentence goes red.
+  const { docs } = corpus();
+  const doctored = `${docs[0].text}\n\nCredits are a smart investment.`;
+  assert.equal(wording.findInvestmentWording(doctored).length, 1);
+});
+
+test('the wording we want is left alone: denials, the verb "return", and investment words with no credit nearby', () => {
+  const fine = [
+    'Credits are not an investment.',
+    'They are not money, not redeemable and not equity.',
+    'Credits measure contribution, never money, never equity.',
+    'When a claim is released the task returns to ready, and no credits are awarded.',
+    'Return to the hall to see your credits.',
+    'Equity, if a project offers any, is granted by the project separately.',
+    'We appreciate every credit you earn.',
+  ];
+  for (const text of fine) assert.deepEqual(wording.findInvestmentWording(text), [], text);
+  // Too far apart to be talking about each other.
+  const far = 'Credits are what you earn for shipped work. '.repeat(1) + 'Some unrelated paragraph about how a company may raise money, take outside investment and sell equity.';
+  assert.deepEqual(wording.findInvestmentWording(far), []);
+});
+
+test('flagInvestmentWording logs one line per hit, returns the hits, and never throws', () => {
+  const lines = [];
+  const hits = wording.flagInvestmentWording('Credits are an investment. Credits are not equity.', { where: 'ship summary', ref: 'task 7', log: (l) => lines.push(l) });
+  assert.equal(hits.length, 1);
+  assert.equal(lines.length, 1);
+  assert.match(lines[0], /^\[credit-wording\] flagged ship summary task 7: "investment" near "credits"/);
+  assert.match(lines[0], /published unchanged/);
+  assert.deepEqual(wording.flagInvestmentWording(null, { log: () => { throw new Error('x'); } }), []);
+  assert.deepEqual(wording.flagInvestmentWording('Credits are an investment.', { log: () => { throw new Error('log down'); } }), []);
+});
+
+test('the reward port carries both, so other modules reach it without importing economy', () => {
+  assert.equal(typeof reward.findInvestmentWording, 'function');
+  assert.equal(typeof reward.flagInvestmentWording, 'function');
+  assert.equal(reward.findInvestmentWording('Credits are an investment.').length, 1);
+});
+
+test('a flagged ship summary is RECORDED and posted unchanged — never blocked, never rewritten', async () => {
+  const summary = 'Builders can now treat their credits as an investment in the project.';
+  const posts = [];
+  const logs = [];
+  const r = await shipBroadcast.postShipBroadcast(
+    { id: 42, value_summary: summary, security_sensitive: false, kind: 'feature' },
+    { postWebhook: async (channel, line) => { posts.push([channel, line]); }, log: (l) => logs.push(l), reward },
+  );
+  assert.deepEqual(r.posted, ['ship_feed', 'ship_news']);
+  assert.equal(r.wording_flags, 1);
+  assert.deepEqual(posts, [['ship_feed', `#42 shipped — ${summary}`], ['ship_news', summary]], 'the text goes out exactly as written');
+  assert.equal(logs.filter((l) => l.startsWith('[credit-wording] flagged ship summary task 42')).length, 1);
+
+  // A clean summary logs nothing; no economy module means no check, still posted.
+  const quiet = [];
+  const clean = await shipBroadcast.postShipBroadcast({ id: 43, value_summary: 'The Treasury counts credits.', security_sensitive: false, kind: 'bug' }, { postWebhook: async () => {}, log: (l) => quiet.push(l), reward });
+  assert.equal(clean.wording_flags, 0);
+  assert.deepEqual(quiet, []);
+  const none = await shipBroadcast.postShipBroadcast({ id: 44, value_summary: summary, security_sensitive: false, kind: 'bug' }, { postWebhook: async () => {}, log: () => {}, reward: null });
+  assert.deepEqual(none.posted, ['ship_feed', 'ship_news']);
+  assert.equal(none.wording_flags, undefined);
+});
+
+test('the idea and board publish paths flag through the port and never return early on it', () => {
+  const inbox = read('modules/ideas/routes/inbox.js');
+  const gov = read('modules/government/routes/government.js');
+  for (const [src, where] of [[inbox, "where: 'idea'"], [gov, "where: 'board item'"]]) {
+    const at = src.indexOf(where);
+    assert.ok(at > 0, `${where} is wired`);
+    const block = src.slice(src.lastIndexOf("resolveOptional('reward')", at), at + 80);
+    assert.match(block, /flagInvestmentWording\(/);
+    assert.doesNotMatch(block, /return\s+res\.|res\.fail|throw /, 'a flag never refuses or rewrites the text');
+  }
+});