@bongos/core 1.24.3 → 1.24.5

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 634 operations across 79 resource groups
+- 636 operations across 80 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -754,6 +754,12 @@ function createClient(opts = {}) {
       // POST /llm-cache/store — rank: metic+archon — POST /llm-cache/store
       postLlmCacheStore: (args) => request("POST", "/llm-cache/store", { hasBody: true }, args),
     },
+    "marketWatch": {
+      // GET /market-watch/ask — rank: any-builder — GET /market-watch/ask
+      getMarketWatchAsk: (args) => request("GET", "/market-watch/ask", { hasBody: false }, args),
+      // POST /market-watch/ask/answer — rank: any-builder — POST /market-watch/ask/answer
+      postMarketWatchAskAnswer: (args) => request("POST", "/market-watch/ask/answer", { hasBody: true }, args),
+    },
     "me": {
       // GET /me — rank: any-builder — GET /me
       getMe: (args) => request("GET", "/me", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -753,6 +753,12 @@ function createClient(opts = {}) {
       // POST /llm-cache/store — rank: metic+archon — POST /llm-cache/store
       postLlmCacheStore: (args) => request("POST", "/llm-cache/store", { hasBody: true }, args),
     },
+    "marketWatch": {
+      // GET /market-watch/ask — rank: any-builder — GET /market-watch/ask
+      getMarketWatchAsk: (args) => request("GET", "/market-watch/ask", { hasBody: false }, args),
+      // POST /market-watch/ask/answer — rank: any-builder — POST /market-watch/ask/answer
+      postMarketWatchAskAnswer: (args) => request("POST", "/market-watch/ask/answer", { hasBody: true }, args),
+    },
     "me": {
       // GET /me — rank: any-builder — GET /me
       getMe: (args) => request("GET", "/me", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -107,6 +107,7 @@ export interface GetInboxTemplateResponse { template: unknown }
 export interface GetInboxVotesResponse { votes: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
+export interface GetMarketWatchAskResponse { card: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
 export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; handle: unknown; display_name: unknown; bio: unknown; links: unknown; cross_project: unknown; account_visibility: unknown; recruiter_discoverable: unknown; recruiter_discoverable_effective: unknown }
 export interface GetMeDisplayNameResponse { display_name: unknown; max_length: unknown }
@@ -461,6 +462,7 @@ export interface PostLlmCacheLookupRequest { cache_key?: unknown; tokens_saved_e
 export interface PostLlmCacheLookupResponse { hit: boolean; result: unknown }
 export interface PostLlmCacheStoreRequest { spec?: unknown; result_stdout?: unknown; result_cost_usd?: unknown }
 export interface PostLlmCacheStoreResponse { stored: boolean; result_cost_usd?: unknown }
+export interface PostMarketWatchAskAnswerRequest { week_of?: string; picks?: unknown[]; names?: unknown[]; nothing?: boolean; builder_id?: number }
 export interface PostMeAnthropicLinkRequest { anthropic_email: string; anthropic_user_id: string }
 export interface PostMeAnthropicLinkResponse { linked: unknown }
 export interface PostMeFilterViewsRequest { page: string; name: string; values: Record<string, unknown>; is_default?: boolean }
@@ -1371,6 +1373,12 @@ export interface BongosClient {
     /** POST /llm-cache/store — rank: metic+archon */
     postLlmCacheStore(args?: RequestArgs & { body?: PostLlmCacheStoreRequest }): Promise<PostLlmCacheStoreResponse>;
   };
+  "marketWatch": {
+    /** GET /market-watch/ask — rank: any-builder */
+    getMarketWatchAsk(args?: RequestArgs): Promise<GetMarketWatchAskResponse>;
+    /** POST /market-watch/ask/answer — rank: any-builder */
+    postMarketWatchAskAnswer(args?: RequestArgs & { body?: PostMarketWatchAskAnswerRequest }): Promise<ApiResponse>;
+  };
   "me": {
     /** GET /me — rank: any-builder */
     getMe(args?: RequestArgs): Promise<ApiResponse>;

package/clients/bongos-client/index.mjs

@@ -750,6 +750,12 @@ export function createClient(opts = {}) {
       // POST /llm-cache/store — rank: metic+archon — POST /llm-cache/store
       postLlmCacheStore: (args) => request("POST", "/llm-cache/store", { hasBody: true }, args),
     },
+    "marketWatch": {
+      // GET /market-watch/ask — rank: any-builder — GET /market-watch/ask
+      getMarketWatchAsk: (args) => request("GET", "/market-watch/ask", { hasBody: false }, args),
+      // POST /market-watch/ask/answer — rank: any-builder — POST /market-watch/ask/answer
+      postMarketWatchAskAnswer: (args) => request("POST", "/market-watch/ask/answer", { hasBody: true }, args),
+    },
     "me": {
       // GET /me — rank: any-builder — GET /me
       getMe: (args) => request("GET", "/me", { hasBody: false }, args),

package/config/branding.neutral.json

@@ -48,7 +48,6 @@
   },
   "reward": {
     "marginPct": 20,
-    "usdPeg": 1,
     "mode": "cost-plus-and-estimate"
   },
   "models": {

package/docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md

@@ -39,3 +39,14 @@ Three things stood in the way:
 ## What this does not do
 
 It adds no other provider, no email codes and no passwords. It does not link accounts, show a Link GitHub chip, or guide anyone to GitHub (tasks 1004995–1004997).
+
+## Amendment — project halls take a Google-only person (task 1004994)
+
+Decision 8's two refusals are lifted, without ever sending a minted key to a core that cannot take one:
+
+- **A hall says it can.** Core's `idpAuthorizeUrl` adds `person_keys=1` to the hub authorize link. The hub's `/sso/authorize` hands a minted key only to a link that carries it (`hallTakesPersonKey`); an older hall's link does not, and the person reads a plain page saying the project needs an update. GitHub people are unchanged on every hall.
+- **Joining is relayed by the stand-in.** `POST /my-projects/join` sends `~<handle>` with the application vouch for the person key. The hall's public `POST /access-requests` accepts a stand-in **only** with that vouch (a stand-in is not an identity anyone may type), and an older hall's `bad_github_login` refusal is said as "this project needs an update" (`needs_update`).
+- **The approval is matched on the key, never the handle.** A handle can be renamed and later taken by someone else, so `hasInvitedAccessRequest(login, githubId)` matches a minted key on `applicant_github_id` alone; both hub sign-ins on a hall pass it. A vouch is accepted only when a negative key and a stand-in login come together.
+- **People read the handle.** The hall's admission queue shows `ana`, not `~ana`.
+
+Credits, ranks and community pages needed no change: the hub's check-in and rollup already take a negative key. Still open: a hall's command-line sign-in (`/sso/device/*`) is GitHub's device flow, so a Google-only person signs in to a hall in the browser; engineering work still needs GitHub (task 1004997).

package/docs/api/openapi.json

@@ -197,6 +197,10 @@
       "name": "llm-cache",
       "description": "Endpoints under `/api/bongos/llm-cache`."
     },
+    {
+      "name": "market-watch",
+      "description": "Endpoints under `/api/bongos/market-watch`."
+    },
     {
       "name": "me",
       "description": "Endpoints under `/api/bongos/me`."
@@ -13952,6 +13956,86 @@
         ]
       }
     },
+    "/market-watch/ask": {
+      "get": {
+        "operationId": "get_market_watch_ask",
+        "tags": [
+          "market-watch"
+        ],
+        "summary": "GET /market-watch/ask",
+        "description": "every member reads their own card; nobody else's (isMember in gate()).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/market-watch/routes/ask.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetMarketWatchAskResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/market-watch/ask/answer": {
+      "post": {
+        "operationId": "post_market_watch_ask_answer",
+        "tags": [
+          "market-watch"
+        ],
+        "summary": "POST /market-watch/ask/answer",
+        "description": "a member answers for themselves only (isMember in gate()).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/market-watch/routes/ask.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMarketWatchAskAnswerRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me": {
       "get": {
         "operationId": "get_me",
@@ -19493,7 +19577,7 @@
           "project-settings"
         ],
         "summary": "GET /project-settings",
-        "description": "GET /project-settings — all five rows in ONE read. rank: project.settings.manage (metic+, government_010), the SAME floor as the page it serves (requireGovernmentPage). The first cut gated this any-builder on the reasoning that it is \"the project's own published terms\" — but the payload also carries reward-policy internals (marginPct, usdPeg, mode), a raw rejected project_settings value, and internal file/migration paths, and a xenos who cannot even load the page could still curl those. Matching the read floor to the page's (task 1003280 grade, hacker lens) closes that asymmetry; the two WRITES already gate on this same atom, so the whole surface is now one floor. One read, not five: the page draws five rows, so it asks for five rows. Fetching per-row would put the hall's own settings page in the shape goal 1000072's criterion names (hall-ui/CLAUDE.md, \"a card asks the server for the rows it draws\").\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "description": "GET /project-settings — all five rows in ONE read. rank: project.settings.manage (metic+, government_010), the SAME floor as the page it serves (requireGovernmentPage). The first cut gated this any-builder on the reasoning that it is \"the project's own published terms\" — but the payload also carries reward-policy internals (marginPct, costScale, mode), a raw rejected project_settings value, and internal file/migration paths, and a xenos who cannot even load the page could still curl those. Matching the read floor to the page's (task 1003280 grade, hacker lens) closes that asymmetry; the two WRITES already gate on this same atom, so the whole surface is now one floor. One read, not five: the page draws five rows, so it asks for five rows. Fetching per-row would put the hall's own settings page in the shape goal 1000072's criterion names (hall-ui/CLAUDE.md, \"a card asks the server for the rows it draws\").\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/project-settings.js",
         "x-permissions": [
@@ -31051,6 +31135,15 @@
           "learnings"
         ]
       },
+      "GetMarketWatchAskResponse": {
+        "type": "object",
+        "properties": {
+          "card": {}
+        },
+        "required": [
+          "card"
+        ]
+      },
       "GetMeAchievementsResponse": {
         "type": "object",
         "properties": {
@@ -36533,6 +36626,30 @@
           "stored"
         ]
       },
+      "PostMarketWatchAskAnswerRequest": {
+        "type": "object",
+        "properties": {
+          "week_of": {
+            "type": "string",
+            "maxLength": 10
+          },
+          "picks": {
+            "type": "array",
+            "maxItems": 20
+          },
+          "names": {
+            "type": "array",
+            "maxItems": 6
+          },
+          "nothing": {
+            "type": "boolean"
+          },
+          "builder_id": {
+            "type": "integer"
+          }
+        },
+        "additionalProperties": false
+      },
       "PostMeAnthropicLinkRequest": {
         "type": "object",
         "properties": {
@@ -40319,9 +40436,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 634,
-  "x-schema-count": 684,
+  "x-endpoint-count": 636,
+  "x-schema-count": 686,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 440,
+  "x-response-schemas": 441,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 634 endpoints across 104 route files.
+> **Generated from the live route files** — the route file is authoritative. 636 endpoints across 105 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -518,6 +518,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
+## `market-watch` (2)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/market-watch/ask` | `any-builder` | — | every member reads their own card; nobody else's (isMember in gate()). |
+| POST | `/api/bongos/market-watch/ask/answer` | `any-builder` | `week_of`, `picks`, `names`, `nothing`, `builder_id` | a member answers for themselves only (isMember in gate()). |
+
 ## `me` (54)
 
 | Method | Path | Rank | Body | Description |

package/docs/branding-contract.md

@@ -33,7 +33,7 @@ env override   →   instance config (config/branding.json)   →   neutral star
 | `repo` | `{ owner, name }` GitHub binding. |
 | `db.database` | DB name Bongos pool connects to when neither `DATABASE_URL` nor `PGHOST`/`PGDATABASE` is set (`src/bongos/pool.js`, ADR 0062 §5). `null` in the neutral starter = **fail loud** rather than silently target a host DB. |
 | `currency` | `{ label, symbol }` — the reward unit label (e.g. "example"). Display only. |
-| `reward` | `{ marginPct, usdPeg, mode }` — the per-instance reward POLICY the economy module reads ([ADR 0054](adr/0054-session-token-reward-cost-plus.md) + ADR 0146, tasks 2009/1002270): the cost-plus margin percent (default `20`), the example-per-USD peg (default `1`), and `mode` — `"cost-plus-and-estimate"` (default; pay both the per-task author estimate AND the cost-plus session reward) or `"cost-plus-only"` (suppress the per-task estimate payout; the cost-plus session reward is the sole equity reward). Two per-craft lanes sit beside `mode` and are not derived from it: `ideatorCredit` ([ADR 0172](adr/0172-per-craft-compensation-ideator-credit-lane.md)) and `artistCredit` ([ADR 0341](adr/0341-the-page-is-the-unit-of-tweak-mode.md) D10, an approved page tweak pays its artist), each default on and withheld only by an explicit `false`. A committed, code-reviewed change — not a live UI knob. Omit ⇒ code defaults (20% margin, 1:1 peg, pay both streams, both lanes on). |
+| `reward` | `{ marginPct, costScale, mode }` — the per-instance reward POLICY the economy module reads ([ADR 0054](adr/0054-session-token-reward-cost-plus.md) + ADR 0146, tasks 2009/1002270): the cost-plus margin percent (default `20`), the sizing factor `costScale` (default `1`; it sizes credits from cost and is not an exchange rate — a credit has no price, [ADR 0387](adr/0387-two-ledgers-credits-measure-work-money-stays-with-the-processor.md)), and `mode` — `"cost-plus-and-estimate"` (default; pay both the per-task author estimate AND the cost-plus session reward) or `"cost-plus-only"` (suppress the per-task estimate payout; the cost-plus session reward is the sole equity reward). Two per-craft lanes sit beside `mode` and are not derived from it: `ideatorCredit` ([ADR 0172](adr/0172-per-craft-compensation-ideator-credit-lane.md)) and `artistCredit` ([ADR 0341](adr/0341-the-page-is-the-unit-of-tweak-mode.md) D10, an approved page tweak pays its artist), each default on and withheld only by an explicit `false`. A committed, code-reviewed change — not a live UI knob. Omit ⇒ code defaults (20% margin, scale 1, pay both streams, both lanes on). **`usdPeg` is the deprecated old name of `costScale`** (task 1004968): it is still read, with a one-line deprecation note in the server log, so no host pack breaks; when both are set `costScale` wins. The neutral pack sets neither key (the default `1` lives in code), so a host pack's old `usdPeg` is never shadowed by the deep-merge. Rename it at your next pack edit — support for the old key goes in a later release. |
 | `models` | `{ main, subagentDefault, subagentRoutine }` — the per-instance subagent model-allocation DEFAULT the builder-settings module reads (task 2011): the tier for the main session, subagent-default work, and routine plumbing (tiers: `haiku`/`sonnet`/`opus`/`fable`). A per-builder override resolves over this. Omit ⇒ code defaults (`opus`/`opus`/`haiku`). |
 | `tracks` | The configurable version-track set (replaces the hardcoded `product\|internal`). |
 | `theme` | `{ palette, mode, ui }` — palette file ref + theme mode, plus `ui`, the WEB look `themeMarkup()` splices into every served page as a plain `:root` after the page's stylesheet: `colors` (the thirteen contract tokens — **light-mode values**; each stylesheet derives its own dark tier from them at `:root[data-mode="dark"]` + its `prefers-color-scheme` twin, which outrank the pack), `fonts` (`display`, `body`, `links`), `favicon`, and `backdrop` — a `body{background:…}` rule that outranks every sheet in **both** modes, so a dual-mode world sets it to `var(--bg)` (the neutral pack does since [task 1003298](https://cloudbongos.com/builders#/task/1003298), ADR 0196) rather than a literal. The neutral values are the chrome world's; `config/design-tokens.neutral.json` must mirror `colors` + `fonts` key for key (`tests/design_tokens_sync.mjs`), and the world's derived recipes are recorded in `DESIGN.md`. The ui-design module's **style library** (`modules/ui-design/styles/`, [ADR 0219](adr/0219-a-look-is-a-branding-pack-the-style-library.md)) ships ready-made `theme.ui` blocks (looks) an instance copies into this field; every served sheet reads only these fifteen, so a look re-themes every surface with no page edit. |

package/docs/copy-inventory.md

@@ -848,7 +848,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4f89817b92e5` | certain | No onboarding steps recorded yet. | `modules/hall-ui/public/hall-render.js:893` |
 | `421ae031594e` | certain | No open goals in this version | `modules/hall-ui/public/task.js:577` |
 | `2a6d7552e21f` | certain | No other sessions. | `modules/hall-ui/public/settings-sessions.js:64` |
-| `90623fec4cfa` | certain | No page is open. | `modules/hall-ui/public/tweak-editor.js:574` |
+| `90623fec4cfa` | certain | No page is open. | `modules/hall-ui/public/tweak-editor.js:575` |
 | `1a46c31343cb` | certain | No projects are hosted here yet. | `modules/hall-ui/public/fleet-costs.js:69` |
 | `9f73b3f3dad0` | certain | No rank floor — any builder can claim this task | `modules/hall-ui/public/task-lib.js:77` |
 | `4ffd939755e0` | certain | No real-world data yet, so it is listed but not ranked. | `modules/hall-ui/public/modules.js:343` |
@@ -874,7 +874,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `730a248e7888` | certain | No {…} {…} render; showing {…} {…}. | `modules/hall-ui/public/approval-queue.js:141` |
 | `1967d2176f2e` | certain | Nobody has an open ask right now. | `modules/hall-ui/public/collab.html:95` |
 | `c65c9f5c02e3` | certain | Nobody is waiting on you. Requests reach you by role — | `modules/hall-ui/public/collab.html:54` |
-| `d5cf262e671d` | certain | Nobody is writing this page. Take it, and every line here is yours to type over. | `modules/hall-ui/public/tweak-editor.js:323` |
+| `d5cf262e671d` | certain | Nobody is writing this page. Take it, and every line here is yours to type over. | `modules/hall-ui/public/tweak-editor.js:324` |
 | `380b924cd4a0` | certain | Nobody recorded — it falls to the owner | `modules/hall-ui/public/government-access.js:35` |
 | `91c409a4aea5` | certain | Nobody vouched for this name — anyone can file a request naming anyone. Confirm who is asking before you admit | `modules/hall-ui/public/watch.js:397` |
 | `4016b9cf8d57` | certain | None of your asks have been settled yet. | `modules/hall-ui/public/collab.html:145` |
@@ -1299,7 +1299,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `59fcf7f5ac27` | certain | Switch to light mode | `modules/hall-ui/public/street.html:95` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:72` |
 | `da9da6e866bd` | certain | Take it offline | `modules/hall-ui/public/project-settings.html:59` |
-| `aa8da34fe237` | certain | Take the next page, or pick one from the studio. | `modules/hall-ui/public/tweak-editor.js:575` |
+| `aa8da34fe237` | certain | Take the next page, or pick one from the studio. | `modules/hall-ui/public/tweak-editor.js:576` |
 | `fc53e250e86f` | certain | Take this page | `modules/hall-ui/public/paintbrush.js:116` |
 | `8b3cdb88b0f4` | certain | Taken out of the store. Your copy keeps working, but it will get no more updates. | `modules/hall-ui/public/modules.js:134` |
 | `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:138` |
@@ -1353,7 +1353,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `51633ea53205` | certain | The doc is now this page's reference. Every idea links back to it. | `modules/hall-ui/public/page-notes.js:195` |
 | `239d641c20fa` | certain | The document | `modules/hall-ui/public/settings-specialities.js:354` |
 | `784618f83a42` | certain | The earlier ideas could not be loaded. Reload the page to try again. | `modules/hall-ui/public/lightbulb.js:118` |
-| `ffaa4df90f66` | certain | The editor could not load. | `modules/hall-ui/public/tweak-editor.js:723` |
+| `ffaa4df90f66` | certain | The editor could not load. | `modules/hall-ui/public/tweak-editor.js:724` |
 | `6e2554615883` | certain | The event sounds could not be loaded. Reload the page to try again. | `modules/hall-ui/public/settings.js:391` |
 | `6a208d46dd0f` | certain | The founding mark is numbered in the order people joined while the project was founded. It is kept for good an | `modules/hall-ui/public/ranks.html:41` |
 | `7e77b1ed9c86` | certain | The founding wall | `modules/hall-ui/public/hall-widgets.js:133` |
@@ -1380,7 +1380,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `27037792dd7d` | certain | The mobile layout can wait until the desktop one ships. | `modules/hall-ui/public/notes-panel.js:68` |
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:140` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:78` |
-| `4b20ecf5528b` | certain | The next page could not be read. | `modules/hall-ui/public/tweak-editor.js:586` |
+| `4b20ecf5528b` | certain | The next page could not be read. | `modules/hall-ui/public/tweak-editor.js:587` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
 | `329a1d350f07` | certain | The page changed after your draft was saved, so the draft is not shown over its new words. Rewrite the lines a | `modules/hall-ui/public/tweak-editor.js:319` |
 | `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1409` |
@@ -1456,7 +1456,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c7d2bc751184` | certain | This goal was added to {…} after it had already started building — an Archon override of the scope gate | `modules/hall-ui/public/goals-render.js:895` |
 | `23f531302e9e` | certain | This is you — | `modules/hall-ui/public/profile.js:363` |
 | `d313d3dfe438` | certain | This move is decided by the project’s government, not by one person here. | `modules/hall-ui/public/deploy.js:583` |
-| `f303bd107422` | certain | This page has been submitted and is on its way to the site. Its words are frozen until it ships or is sent bac | `modules/hall-ui/public/tweak-editor.js:331` |
+| `f303bd107422` | certain | This page has been submitted and is on its way to the site. Its words are frozen until it ships or is sent bac | `modules/hall-ui/public/tweak-editor.js:332` |
 | `e54578188187` | certain | This page is for members of the board. | `modules/hall-ui/public/board-room.html:43` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/deploy.html:33` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/fleet.html:32` |
@@ -1740,7 +1740,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a3fd52d9513b` | certain | document{…} you added · learned | `modules/hall-ui/public/settings-specialities.js:322` |
 | `fcec9cad1c69` | certain | download .docx | `modules/hall-ui/public/tweak-editor.html:65` |
 | `7c1f761ff7c0` | certain | download this page again | `modules/hall-ui/public/tweak-editor.html:131` |
-| `87129aa3ab0a` | certain | downloaded .docx | `modules/hall-ui/public/tweak-editor.js:481` |
+| `87129aa3ab0a` | certain | downloaded .docx | `modules/hall-ui/public/tweak-editor.js:482` |
 | `16d18b40bd23` | certain | drag to pan · ⌘/ctrl + scroll to zoom · ⤢ fullscreen | `modules/hall-ui/public/diagram-viewer.js:125` |
 | `91a14a57b576` | certain | e.g. My open goals | `modules/hall-ui/public/hall-kit.js:409` |
 | `77b0b2b446a1` | certain | e.g. octocat | `modules/hall-ui/public/hall-render.js:300` |
@@ -1890,7 +1890,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `70bbd20d223f` | certain | take it | `modules/hall-ui/public/studio.js:743` |
 | `d4f99c118825` | certain | take next | `modules/hall-ui/public/tweak-editor.html:106` |
 | `357cc737dd98` | certain | take the studio page | `modules/hall-ui/public/studio.html:109` |
-| `24fc2b94ea7d` | certain | take this page | `modules/hall-ui/public/tweak-editor.js:324` |
+| `24fc2b94ea7d` | certain | take this page | `modules/hall-ui/public/tweak-editor.js:325` |
 | `a6e803a31a4d` | certain | task #{…} | `modules/hall-ui/public/copy-desk.js:105` |
 | `eb808f2daba3` | certain | task dependenc{…} · click to chart it · double-click to chart every route from here | `modules/hall-ui/public/sky-interaction.js:37` |
 | `3906fbc07bbe` | certain | task id | `modules/hall-ui/public/task.js:608` |
@@ -1941,7 +1941,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `73e8a560927b` | certain | up for a vote | `modules/hall-ui/public/my-agents.js:424` |
 | `f98966dc7cac` | certain | upkeep undeclared | `modules/hall-ui/public/modules.js:104` |
 | `432def6844b7` | certain | upload .docx | `modules/hall-ui/public/tweak-editor.html:66` |
-| `432def6844b7` | certain | upload .docx | `modules/hall-ui/public/tweak-editor.js:506` |
+| `432def6844b7` | certain | upload .docx | `modules/hall-ui/public/tweak-editor.js:507` |
 | `f26117caa2f1` | certain | usually done in about a minute | `modules/hall-ui/public/ai-studio.js:377` |
 | `4de556377db2` | certain | verdict {…} | `modules/hall-ui/public/task.js:432` |
 | `f20985df3729` | certain | version · {…} | `modules/hall-ui/public/sky-interaction.js:38` |
@@ -1994,8 +1994,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `78ba2bd4bc44` | certain | {…} criteria · started {…} | `modules/hall-ui/public/roadmap.js:259` |
 | `5ccebd39118e` | certain | {…} deleted. | `modules/hall-ui/public/government.js:324` |
 | `cf89ac85440d` | certain | {…} earned | `modules/hall-ui/public/goals-render.js:821` |
-| `55b949873848` | certain | {…} is in. | `modules/hall-ui/public/tweak-editor.js:577` |
-| `80b4aa799a4b` | certain | {…} is writing this page now. You can read it, download it, or take another page from the studio. | `modules/hall-ui/public/tweak-editor.js:328` |
+| `55b949873848` | certain | {…} is in. | `modules/hall-ui/public/tweak-editor.js:578` |
+| `80b4aa799a4b` | certain | {…} is writing this page now. You can read it, download it, or take another page from the studio. | `modules/hall-ui/public/tweak-editor.js:329` |
 | `c80c3434ae36` | certain | {…} key ending {…} | `modules/hall-ui/public/ai-studio.js:272` |
 | `5ad81ff61920` | certain | {…} lands in your balance; your card is charged {…}. | `modules/hall-ui/public/ai-studio.js:517` |
 | `830d2be6f859` | certain | {…} line | `modules/hall-ui/public/tweak-editor.js:235` |

package/docs/copy-registry.json

@@ -2845,7 +2845,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/tweak-editor.html:66",
-        "modules/hall-ui/public/tweak-editor.js:506"
+        "modules/hall-ui/public/tweak-editor.js:507"
       ]
     },
     {
@@ -9949,7 +9949,7 @@
       "surface": "builders-hall",
       "text": "No page is open.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 574,
+      "line": 575,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10183,7 +10183,7 @@
       "surface": "builders-hall",
       "text": "Nobody is writing this page. Take it, and every line here is yours to type over.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 323,
+      "line": 324,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14008,7 +14008,7 @@
       "surface": "builders-hall",
       "text": "Take the next page, or pick one from the studio.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 575,
+      "line": 576,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -14494,7 +14494,7 @@
       "surface": "builders-hall",
       "text": "The editor could not load.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 723,
+      "line": 724,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -14737,7 +14737,7 @@
       "surface": "builders-hall",
       "text": "The next page could not be read.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 586,
+      "line": 587,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -15421,7 +15421,7 @@
       "surface": "builders-hall",
       "text": "This page has been submitted and is on its way to the site. Its words are frozen until it ships or is sent back.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 331,
+      "line": 332,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17977,7 +17977,7 @@
       "surface": "builders-hall",
       "text": "downloaded .docx",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 481,
+      "line": 482,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -19327,7 +19327,7 @@
       "surface": "builders-hall",
       "text": "take this page",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 324,
+      "line": 325,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19786,7 +19786,7 @@
       "surface": "builders-hall",
       "text": "upload .docx",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 506,
+      "line": 507,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -20263,7 +20263,7 @@
       "surface": "builders-hall",
       "text": "{…} is in.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 577,
+      "line": 578,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -20272,7 +20272,7 @@
       "surface": "builders-hall",
       "text": "{…} is writing this page now. You can read it, download it, or take another page from the studio.",
       "file": "modules/hall-ui/public/tweak-editor.js",
-      "line": 328,
+      "line": 329,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -461,7 +461,7 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 ```
 .claude/hooks/
 ├── secret-gate.js            ← PreToolUse (Edit|Write|MultiEdit|NotebookEdit|Bash|PowerShell): cooperative, fail-OPEN block of secret-shaped content before it reaches the tree or a shell (task 1003125, ADR 0022)
-├── run-node.sh               ← the node resolver every hook command runs through (task 1003548): $OTB_NODE_BIN → PATH → known install dirs → nvm; one actionable line + exit 1 when none is found. 1,055 hook runs had died silently with `node: command not found`
+├── run-node.sh               ← the node resolver every hook command runs through (task 1003548): $OTB_NODE_BIN → PATH → known install dirs → nvm; one actionable line + exit 1 when none is found. 1,055 hook runs had died silently with `node: command not found`. Also runs the SESSION's checkout's copy of a hook when the session sits in a worktree, since Claude Code points $CLAUDE_PROJECT_DIR at the main checkout (task 1005015; off-switch OTB_HOOKS_FROM_PROJECT_DIR=1)
 ├── edit-hints.js             ← PostToolUse (Edit|Write|MultiEdit): lints a saved SKILL.md's frontmatter (scripts/bongos/skill-lint.js) and names the generator an edited path makes stale (copy-registry, repo-map blocks, file-map, openapi, §13 snippet) with its command (task 1003548)
 ├── git-guard.js              ← PreToolUse (Bash|PowerShell): same contract as secret-gate — blocks `git stash` (repo-global stack, learning 1000215), raw `git worktree remove` (follows the node_modules junction, task 1002809), `git push origin main` (PR-only) and `git branch -D`, each with its remedy; kill-switch BONGOS_GIT_GUARD_OFF=1 (task 1003365)
 ├── allow-rule-guard.js       ← PreToolUse (PowerShell): a command that names something the project's allow-list pre-approves ASKS unless it is PLAIN — command names, bare-word arguments, `$name` reads, literal strings, `; | && ||`, `2>&1` / `> $null`, and nothing else. An allowlist of shape, not a denylist of tricks (the denylist cut was evaded eleven ways in review). Never blocks, fails open, silent for commands nobody pre-allowed. Exists because the client ordering that already does this for PowerShell is undocumented (ADR 0304 amendment, task 1004014); kill-switch BONGOS_ALLOW_RULE_GUARD_OFF=1
@@ -483,7 +483,8 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 ├── stuck-strikes.js          ← shared helper, not a hook: the per-session strike counter (hashed signatures in os.tmpdir()) + the static instruction text; stuck-detector.js, git-guard.js and worktree-guard.js all count through it (task 1003990)
 ├── pre-compact.js            ← PreCompact: thin reader around eviction-policy.js — emits an eviction directive (blocks to drop + one-line recovery stubs) at the compaction seam (task 1349)
 ├── eviction-policy.js        ← pure deterministic in-session compaction classifier (transcript turns → eviction set + replacement stubs); no I/O, unit-tested in tests/eviction_policy.mjs; consumed by pre-compact.js (task 1348)
-└── stop-refcheck.js          ← Stop: deterministic backstop that catches a bare `#NNN` Bongos ref in live session text (autolinks to a 404 GitHub issue) and asks for the clickable form (follow-on to task 929)
+├── stop-refcheck.js          ← Stop: deterministic backstop that catches a bare `#NNN` Bongos ref in live session text (autolinks to a 404 GitHub issue) and asks for the clickable form (follow-on to task 929)
+└── stop-slopcheck.js         ← Stop: when the agent's last message reverses an earlier belief ("turns out", "I was wrong"), asks once whether a doc/hook/output misled it — the Slop Bongo rule; words from src/bongos/agent-standing-rules.js, with a local copy held equal by tests for a checkout whose core cannot load; reads only the transcript tail (task 1005015)
 ```
 
 > Restored in task 1003365 from the box's pre-re-seed checkout: the tree was lost when core was re-seeded to 1.18.0 (task 1003272 found the sound half; this brought back the rest). `stop-sound.js` was NOT restored — `scripts/bongos/turn-end-sound.js` superseded it. Every hook above is wired in `.claude/settings.json`, which is the authority on what actually runs.

package/docs/module-api-changelog.md

@@ -3266,7 +3266,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.0 with no explicit bump. run 40985289858. (task 1002620)
   1.24.2 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.1 with no explicit bump. run 41000649913. (task 1002620)
-  1.24.3 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.24.2 with no explicit bump. run 41001671514. (task 1002620)
+  1.24.5 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.2 with no explicit bump. run 41006914357. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -4300,7 +4300,7 @@
       "surface": "builders",
       "title": "Tweak a page",
       "states_read": ["doc","typed","chrome","submitted","picking","out"],
-      "files_hash": "a2b68a2fa0504a35",
+      "files_hash": "6ea8b7ad13d0121d",
       "reading_hash": "711c540ebc7ef977",
       "counts": {"lines":23,"placed":15,"shared":1,"unplaced":7},
       "omitted": {"data":35},