@bongos/core 1.19.1032 → 1.19.1034

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1032'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1034'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/adr_0089_scope.mjs

@@ -0,0 +1,70 @@
+// tests/adr_0089_scope.mjs — ADR 0089 §8 names what the grading engine does NOT own,
+// and this file keeps that list true (task 1002844).
+//
+// WHY. Four surfaces spend model tokens on the repository or guard the pipeline,
+// so a reader planning the engine can take them for graders: the BFG session
+// evaluator, gate-review, main-audit and the Architect audit. §8 records, for each,
+// exactly what it shares with the grader. A prose boundary rots the moment one of
+// them quietly starts calling grading code, so the coupling the ADR states is
+// asserted from the source: the Architect uses exactly the three plumbing helpers
+// §8 names, and the other three import no grading module at all.
+//
+// Run:  node tests/adr_0089_scope.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const read = (rel) => fs.readFileSync(new URL(`../${rel}`, import.meta.url), 'utf8');
+const adr = read('docs/adr/0089-modular-multi-model-adversarial-grader.md');
+const section = adr.slice(adr.indexOf('### 8. Scope: what the engine does NOT own'), adr.indexOf('## Consequences'));
+
+const SURFACES = [
+  'scripts/gds/session-eval.js',
+  'scripts/gds/gate-review.js',
+  'scripts/gds/main-audit.js',
+  'scripts/gds/architect-audit.js',
+];
+
+test('ADR 0089 carries the §8 scope section, before Consequences', () => {
+  assert.ok(adr.includes('### 8. Scope: what the engine does NOT own'), 'the section heading');
+  assert.ok(section.length > 200, 'the section sits between §7 and Consequences');
+});
+
+test('§8 names each of the four surfaces by path, and each path exists', () => {
+  for (const p of SURFACES) {
+    assert.ok(section.includes(p), `§8 names ${p}`);
+    assert.ok(fs.existsSync(new URL(`../${p}`, import.meta.url)), `${p} exists`);
+  }
+});
+
+test('the Architect uses exactly the three grader helpers §8 names — nothing from the grade path', () => {
+  // Code only: a comment that mentions grader.<thing> is not a call.
+  const src = read('scripts/gds/architect-audit.js').replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+  const used = [...new Set([...src.matchAll(/\bgrader\.([A-Za-z_]\w*)/g)].map((m) => m[1]))].sort();
+  assert.deepEqual(used, ['extractAssistantResult', 'extractJson', 'runSubagentCached'],
+    'a new grader.* call from the Architect means §8 is out of date');
+  for (const name of used) assert.ok(section.includes(name), `§8 names ${name}`);
+});
+
+test('session-eval, gate-review and main-audit import no grading module', () => {
+  for (const p of SURFACES.filter((s) => !s.endsWith('architect-audit.js'))) {
+    assert.doesNotMatch(read(p), /require\([^)]*modules\/grading/, `${p} must not require grading code`);
+  }
+});
+
+test('main-audit and gate-review share only the rank-permission checker §8 names', () => {
+  for (const p of ['scripts/gds/main-audit.js', 'scripts/gds/gate-review.js']) {
+    assert.match(read(p), /permission-path-check/, `${p} reads the checker`);
+  }
+  assert.ok(section.includes('src/bongos/permission-path-check.js'), '§8 names the shared checker');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/adr_0162_citation.mjs

@@ -0,0 +1,184 @@
+// tests/adr_0162_citation.mjs — "a verdict is advisory, never self-executing" is
+// ADR 0158 §2's rule, not ADR 0162's; no surface may cite 0162 for it (task 1003573).
+//
+// WHAT WENT WRONG. ADR 0162 retired REVIEW gates on `main`: no human approval sits in
+// the land path, and the compensating controls it keeps are automatic — three of its
+// four fail CLOSED, the grader among them. Surfaces across the repo nonetheless cited it
+// by a slogan, "verdicts are advisory, never self-executing". ADR 0241 caught that the
+// slogan is false as a blanket claim about gates. This task found the slogan is not
+// 0162's wording at all: it is, nearly verbatim, the heading of ADR 0158 §2 — a rule
+// about what an audit FINDING authorizes (nothing, until a human acts on it). So every
+// gloss of 0162 with that slogan cited the wrong ADR, and the worst of them turned it
+// into a claim 0162 contradicts ("grader verdicts are advisory").
+//
+// WHAT THIS PINS. (1) The premise, read from the two ADRs themselves: the slogan's text
+// is in 0158 and absent from 0162. If either ADR is amended, this goes red and the
+// question is re-asked, instead of the citations quietly drifting back. (2) No tracked
+// surface glosses 0162 with the verdict rule, in any of the shapes the sweep found.
+//
+// Run:  node --test tests/adr_0162_citation.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
+
+const ADR_0158 = 'docs/adr/0158-choke-point-verdict-taxonomy.md';
+const ADR_0162 = 'docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md';
+
+// The shapes the 2026-09-25 sweep found, each named by the surface it came from.
+// A match is a line that attributes the verdict rule to 0162.
+const MISATTRIBUTIONS = [
+  // 0162 glossed with the rule: "0162 (verdicts advisory, never self-executing)",
+  // "0162 (grader verdicts are advisory…)", "[ADR 0162] (patrol findings are advisory…)",
+  // "ADR 0162 — verdicts never self-execute", "[ADR 0162]: verdicts advisory".
+  /\b0162\b[\])]?\s*(?:\(|—|–|:|=)\s*(?:[\w-]+\s+){0,2}(?:verdicts?|findings?)\b[^\n]{0,30}?\b(?:advisory|self-execut)/i,
+  // The rule, then 0162 as its source: "findings are advisory (ADR 0162)",
+  // "never self-executes (ADR 0162)", "advisory per ADR 0162", "(advisory, ADR 0162)".
+  /\b(?:advisory|self-execut\w*)\b\**\s*(?:\(ADR\s+0162\b|,\s*ADR 0162\b|per ADR 0162\b)/i,
+  // 0162's real content, then the rule tacked on as if it were 0162's too:
+  // "[ADR 0162] — review gates retired on `main`; a verdict is advisory and never …".
+  /\b0162\b[^\n]{0,70};\s*an? verdicts? (?:is|are) advisory/i,
+  // The rule's consequences cited to 0162: "filed for adjudication (ADR 0162)",
+  // "describe-only (ADR 0162)", "describes and queues only, never confirms (ADR 0162".
+  /\b(?:adjudicat\w*|describe-only|describes and queues only)\b[^\n]{0,45}?\(ADR 0162\b/i,
+  // The rule as the sentence that follows a 0162 citation:
+  // "(ADR 0162).** Verdicts are advisory", "The ADR 0162 discipline.** Verdicts are advisory".
+  /\b0162\)?(?: discipline)?\.?\**\s*Verdicts? (?:is|are) advisory/i,
+  // "the same family of error ADR 0162 rules out" — 0162 rules out no verdict-handling.
+  /\bADR 0162 rules out\b/i,
+  // "ADVISORY ONLY, same posture as ADR 0162" / "ADR 0162: advisory only".
+  /\badvisory only\b[^\n]{0,30}\bADR 0162\b|\bADR 0162\b[^\n]{0,30}\badvisory only\b/i,
+  // "it stays advisory in precisely 0162's sense" — the sense is 0158 §2's.
+  /\badvisory in (?:precisely|exactly) (?:ADR )?0162's sense\b/i,
+  // "ADR 0162's "advisory, never self-executing" holding" (a migration comment).
+  /\b0162's\s+["“]?(?:advisory|never self-execut)/i,
+];
+
+// Deliberately NOT corrected, each with its reason. Shrink-only: when one of these is
+// fixed, delete its row — the last test below fails until you do, so a stale exemption
+// cannot outlive the thing it excused.
+const KNOWN_DEFERRED = new Map([
+  // A comment on a HARD-FLOOR gate surface (scripts/gds/gate-review.js HARD_FLOOR_GLOBS
+  // lists `.github/`): even a comment-only edit there escalates to the owner, which a
+  // citation fix does not justify on its own. Correct it with the next real edit.
+  ['.github/workflows/redteam-patrol.yml', 'hard-floor gate surface'],
+  // An applied migration is never edited: its text is part of what was run.
+  ['modules/government/migrations/government_004_board_permissions.sql', 'applied migration'],
+]);
+
+// A session log records what a session believed at the time; rewriting one would
+// falsify history, which is worse than the stale citation it carries.
+const HISTORICAL = /^docs\/session-logs\//;
+// This file quotes every shape it hunts, as examples — so it would flag itself.
+const SELF = 'tests/adr_0162_citation.mjs';
+const TEXT = /\.(?:md|js|mjs|cjs|json|ya?ml|sql|sh|html|txt)$/;
+
+// A line that NAMES the slogan as its subject is discussing it (ADR 0241's own
+// analysis; the task-title list in a relevance audit), not citing by it.
+const DISCUSSES_SLOGAN = /paraphrase|shorthand/i;
+
+// Markdown link targets carry the ADR's filename ("0162-review-gates-…"), which would
+// otherwise sit between a citation and its gloss.
+const stripLinkTargets = (s) => s.replace(/\]\([^)\s]*\)/g, ']');
+// The continuation of a hard-wrapped line, minus its comment/quote/list lead.
+const continuation = (s) => (s || '').replace(/^\s*(?:\/\/+|#+|--|\*|>|-)?\s*/, '');
+
+function offendersIn(rel, text) {
+  const lines = stripLinkTargets(text).split('\n');
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    const here = lines[i];
+    if (DISCUSSES_SLOGAN.test(here)) continue;
+    // Join the next line so a citation wrapped mid-phrase ("(ADR\n0162)") still reads
+    // as one; only a match that STARTS on this line is this line's.
+    const window = `${here} ${continuation(lines[i + 1])}`;
+    if (!/0162/.test(window)) continue;
+    for (const re of MISATTRIBUTIONS) {
+      const m = re.exec(window);
+      if (m && m.index < here.length) { hits.push(`${rel}:${i + 1}: ${here.trim().slice(0, 140)}`); break; }
+    }
+  }
+  return hits;
+}
+
+function trackedTextFiles() {
+  const r = spawnSync('git', ['ls-files', '-z'], { cwd: ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (r.status !== 0) return null; // a packaged core is not a git checkout
+  return r.stdout.split('\0').filter((f) => f && TEXT.test(f));
+}
+
+test('the premise: the verdict rule is written in ADR 0158 §2, and ADR 0162 never states it', () => {
+  const adr0158 = read(ADR_0158);
+  assert.match(adr0158, /^### 2\. A verdict is advisory and never self-executing$/m,
+    'ADR 0158 §2 is the rule\'s source — if it moved, re-point the citations this test guards');
+  const adr0162 = read(ADR_0162);
+  assert.doesNotMatch(adr0162, /self-execut/i, 'ADR 0162 does not say "self-executing"');
+  assert.doesNotMatch(adr0162, /advisory/i, 'ADR 0162 does not say "advisory"');
+  // What 0162 DOES say, so a citation of it has something true to point at.
+  assert.match(adr0162, /Review requirements on `main` are \*\*retired permanently\*\*/);
+});
+
+test('the detector recognises every shape the sweep corrected, and passes the true citations', () => {
+  const flag = (line) => offendersIn('probe.md', line).length > 0;
+  for (const bad of [
+    '- **Related:** 0157 (Archon is rank and identity only), 0162 (verdicts advisory, never self-executing), 0172',
+    '0016 (authority resolved server-side), 0162 (grader verdicts are advisory, never self-executing), 0175',
+    '- **Related:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (patrol findings are advisory — verdicts never self-execute),',
+    '// doctrine (ADR 0162 — verdicts never self-execute): findings are FILED as',
+    'deliberate. Findings are **advisory** (ADR 0162) — they are filed for',
+    'description: `Weekly deterministic red-team patrol (task 1003128; advisory per ADR 0162 — adjudicate)`',
+    '//     is that: history-wide, time-based, filed for adjudication (ADR 0162).',
+    '- **Read-only, describe-only (ADR 0162).** No confirms, no regrades run by this skill.',
+    '- **Never confirm, never flip, never re-grade (ADR 0162).** Verdicts are advisory and never self-executing here',
+    '**1. The ADR 0162 discipline.** Verdicts are advisory and never self-executing. A gate that',
+    'judgement is finished because a hash moved — the same family of error ADR 0162 rules out for grader',
+    '// HARD CONSTRAINT, same as goal-advisory.js and ADR 0162: advisory only. This',
+    'it stays advisory in precisely 0162\'s sense.',
+    '- **Reconciles:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) — review gates retired on `main`; a verdict is advisory and never self-executing',
+    '→ files security reports (advisory, ADR 0162). FIRED BY .github/workflows/redteam-patrol.yml',
+    '-- — which is also ADR 0162\'s "advisory, never self-executing" holding.',
+    'decision 2026-08-18: AI review deferred), and findings are **advisory** (ADR\n0162): they are POSTed to',
+  ]) assert.ok(flag(bad), `should flag: ${bad}`);
+
+  for (const good of [
+    '- **Reconciles:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) — review gates retired on `main`, so no human approval sits in the land path',
+    '0016 (authority resolved server-side), 0158 §2 (a verdict is advisory, never self-executing), 0162 (review gates retired — no human approval in the land path), 0175',
+    'deliberate. Findings are **advisory** (ADR 0158 §2) — they are filed for',
+    '- **Related:** ADR 0162 (no new human gates on the ship path)',
+    'No review requirement — gates are CI checks, not human approvals (ADR 0162).',
+    'It never holds a builder\'s ship, which is what keeps it compatible with ADR 0162.',
+    'This matters, because the shorthand it is usually cited by — "a verdict is advisory" (ADR 0162) — is a paraphrase',
+  ]) assert.ok(!flag(good), `should pass: ${good}`);
+});
+
+test('no tracked surface cites ADR 0162 for the verdict rule', (t) => {
+  const files = trackedTextFiles();
+  if (!files) return t.skip('not a git checkout — nothing tracked to scan');
+  const offenders = [];
+  for (const rel of files) {
+    if (rel === SELF || HISTORICAL.test(rel) || KNOWN_DEFERRED.has(rel)) continue;
+    let text;
+    try { text = readFileSync(path.join(ROOT, rel), 'utf8'); } catch { continue; }
+    if (!text.includes('0162')) continue;
+    offenders.push(...offendersIn(rel, text));
+  }
+  assert.deepEqual(offenders, [],
+    'these cite ADR 0162 for "a verdict is advisory, never self-executing" — that rule is ADR 0158 §2. '
+    + 'Cite 0158 §2 for the verdict rule, and 0162 only for what it retired (human approval in the land path).');
+});
+
+test('every deferred exemption still has something to excuse (shrink-only)', (t) => {
+  if (!trackedTextFiles()) return t.skip('not a git checkout');
+  for (const [rel, why] of KNOWN_DEFERRED) {
+    let text = '';
+    try { text = read(rel); } catch { /* deleted: the exemption is stale too */ }
+    assert.ok(offendersIn(rel, text).length > 0,
+      `${rel} (${why}) no longer misattributes the rule — delete its KNOWN_DEFERRED row`);
+  }
+});

package/tests/autobongos_cadence.mjs

@@ -600,3 +600,77 @@ test('the suite never reads the real heartbeat file', () => {
   // writing right now.
   assert.match(runner.heartbeatPath(), /ab-cadence-/, 'the suite must point at a throwaway path, not the real one');
 });
+
+// --- a worker that never RAN is breakage, not quiet (task 1004179) ----------
+//
+// Found by the 1003907 proof run. With the Windows argv bug in play every worker
+// exited in ~2s with "worker output was not JSON". Each run filed a blocker,
+// parked a task, and was classed `quiet` — which neither trips nor forgives the
+// failure count. consecutive_failures stayed 0, mode stayed `full`, and the
+// runner would have worked through the whole allowlisted goal one task every
+// five minutes, parking every one, while the hall showed it alive and allowed to
+// work. A human stopped it after one task.
+
+// The exact row the runner logged on the night this was found.
+const brokenWorkerRow = {
+  event: 'worked',
+  task_id: '1004047',
+  outcome: 'worker_failed',
+  reason: 'worker output was not JSON',
+  duration_s: 2,
+  cost_usd: null,
+  verified: false,
+  ledger_shape: 'still_held',
+  claim_released: true,
+  task_parked: true,
+};
+
+test('the real broken-worker row is a FAILURE, not quiet', () => {
+  const c = cadence.classifyEvent(brokenWorkerRow);
+  assert.notEqual(c.class, 'quiet', 'this is the exact misclassification the task exists to fix');
+  assert.ok(cadence.COUNTS_AS_FAILURE.has(c.class), 'and it must advance the failure count');
+  assert.match(c.detail, /never ran/);
+});
+
+test('three broken workers drop the runner out of full speed', () => {
+  let state = cadence.START;
+  for (let i = 0; i < 3; i++) {
+    state = cadence.nextCadence(state, cadence.classifyEvent(brokenWorkerRow));
+  }
+  assert.equal(state.mode, 'probing',
+    'the whole point: a runner that cannot spawn must stop chewing the queue');
+});
+
+test('a worker that RAN and hit a real obstacle is still quiet', () => {
+  // 1003564: 31 minutes, real cost, stopped at a grader refusal. The machine is
+  // fine and the next task is the right move — escalating this would "fix" a
+  // working runner into a broken one.
+  const c = cadence.classifyEvent({
+    event: 'worked', outcome: 'needs_human', reason: 'the grader refused the ship',
+    duration_s: 1888, cost_usd: 13.74, verified: false, ledger_shape: 'ungraded',
+  });
+  assert.equal(c.class, 'quiet');
+});
+
+test('a worker that burned real time and then failed is NOT "never ran"', () => {
+  // A 90-minute timeout is breakage of a different kind, and this predicate must
+  // not swallow it by calling it a failed launch.
+  assert.equal(cadence.workerNeverRan({ outcome: 'worker_failed', duration_s: 5400, cost_usd: 9.1 }), false);
+});
+
+test('a spawn error is "never ran" whatever the numbers say', () => {
+  assert.equal(cadence.workerNeverRan({ outcome: 'worker_failed', spawn_error: 'ENOENT' }), true);
+});
+
+test('a fast worker that still cost something is not called a failed launch', () => {
+  assert.equal(cadence.workerNeverRan({ outcome: 'worker_failed', duration_s: 4, cost_usd: 0.4 }), false,
+    'it ran; both conditions are required');
+});
+
+test('unworkable_queue is still never escalated', () => {
+  // The sibling distinction: a queue where every task halts is a HEALTHY machine
+  // with nothing to do. This fix must not blur the two.
+  const c = cadence.classifyEvent({ event: 'nothing_claimable', skipped: [{ id: '1', title: 't', reasons: ['x'] }] });
+  assert.equal(c.class, 'unworkable_queue');
+  assert.equal(cadence.COUNTS_AS_FAILURE.has('unworkable_queue'), false);
+});

package/tests/autobongos_loop.mjs

@@ -654,3 +654,117 @@ test('workerEnv passes Claude auth through, and still refuses the rest', () => {
     assert.equal(env[leak], undefined, `${leak} must never reach a bypassPermissions worker`);
   }
 });
+// --- a derived gauge buys BOUNDED work (task 1004178) -----------------------
+//
+// `derived` retires a reading whose window has reset. That is sound for the
+// five-hour window, which turns over during a night. The SEVEN-day one does
+// not, so its stale reading is dropped and the weekly pace check — what the
+// module's notes call the thing that actually binds a heavy week — does not run
+// at all on a derived reading. The task cap is what stands in for it, so the
+// cap has to work, and it has to survive a restart: the count comes from the
+// run log, not from memory.
+
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const derivedLog = () => {
+  const dir = mkdtempSync(join(tmpdir(), 'autobongos-cap-'));
+  return join(dir, 'runs.jsonl');
+};
+
+test('countWorkedSince counts only worked rows at or after the mark', () => {
+  const p = derivedLog();
+  process.env.AUTOBONGOS_LOG_FILE = p;
+  const at = (s) => new Date(s * 1000).toISOString();
+  writeFileSync(p, [
+    JSON.stringify({ at: at(1000), event: 'worked', task_id: '1' }),   // before the mark
+    JSON.stringify({ at: at(3000), event: 'hold' }),                   // not a worked row
+    JSON.stringify({ at: at(3100), event: 'worked', task_id: '2' }),
+    '{ this line is torn',                                             // costs one row, not the count
+    JSON.stringify({ at: at(3200), event: 'worked', task_id: '3' }),
+  ].join('\n'));
+  assert.equal(runner.countWorkedSince(2000), 2);
+  assert.equal(runner.countWorkedSince(0), 0, 'a zero/absent mark counts nothing rather than everything');
+  delete process.env.AUTOBONGOS_LOG_FILE;
+});
+
+test('countWorkedSince treats an unreadable log as zero, not as a refusal', () => {
+  process.env.AUTOBONGOS_LOG_FILE = join(tmpdir(), 'autobongos-cap-nope', 'missing.jsonl');
+  assert.equal(runner.countWorkedSince(1), 0,
+    'the fence and the gauge are the gates; a bound that bricks the runner when its own log is gone is worse');
+  delete process.env.AUTOBONGOS_LOG_FILE;
+});
+
+test('a derived gauge HOLDS once the cap is reached, and the reason says why', async () => {
+  const p = derivedLog();
+  process.env.AUTOBONGOS_LOG_FILE = p;
+  process.env.AUTOBONGOS_DERIVED_TASK_CAP = '2';
+  const at = (s) => new Date(s * 1000).toISOString();
+  writeFileSync(p, [
+    JSON.stringify({ at: at(5100), event: 'worked', task_id: '1' }),
+    JSON.stringify({ at: at(5200), event: 'worked', task_id: '2' }),
+  ].join('\n'));
+
+  const events = [];
+  await runner.iteration({ goals: [], maxTasks: 1 }, {
+    readFence: async () => ({ raw: { enabled: true, goals: [{ goal_id: 7 }] }, graderBypassed: false }),
+    gauge: () => ({ decision: { go: true, unknown: false, derived: true, derivedSince: 5000, reason: 'derived' } }),
+    pickTask: async () => { throw new Error('CAP BREACHED: reached the picker'); },
+    record: (row) => { events.push(row); return row; },
+    run: async () => { throw new Error('CAP BREACHED: ran a command'); },
+    spawnWorker: async () => { throw new Error('CAP BREACHED: spawned a worker'); },
+  });
+  assert.equal(events[0].event, 'hold');
+  assert.equal(events[0].derived, true);
+  assert.equal(events[0].worked_since_derived, 2);
+  assert.match(events[0].reason, /cap is 2/);
+  delete process.env.AUTOBONGOS_LOG_FILE; delete process.env.AUTOBONGOS_DERIVED_TASK_CAP;
+});
+
+test('a derived gauge still WORKS while under the cap', async () => {
+  const p = derivedLog();
+  process.env.AUTOBONGOS_LOG_FILE = p;
+  process.env.AUTOBONGOS_DERIVED_TASK_CAP = '2';
+  writeFileSync(p, JSON.stringify({ at: new Date(5100 * 1000).toISOString(), event: 'worked', task_id: '1' }));
+  let reachedPicker = false;
+  const events = [];
+  await runner.iteration({ goals: [], maxTasks: 1 }, {
+    readFence: async () => ({ raw: { enabled: true, goals: [{ goal_id: 7 }] }, graderBypassed: false }),
+    gauge: () => ({ decision: { go: true, unknown: false, derived: true, derivedSince: 5000, reason: 'derived' } }),
+    pickTask: async () => { reachedPicker = true; return { none: true, skipped: [] }; },
+    record: (row) => { events.push(row); return row; },
+  });
+  assert.equal(reachedPicker, true, 'one task done against a cap of two must still proceed');
+  delete process.env.AUTOBONGOS_LOG_FILE; delete process.env.AUTOBONGOS_DERIVED_TASK_CAP;
+});
+
+test('countWorkedSince is bounded: a huge log does not mean a huge scan', () => {
+  const p = derivedLog();
+  process.env.AUTOBONGOS_LOG_FILE = p;
+  const at = (s) => new Date(s * 1000).toISOString();
+  // 40k old rows, then the two that matter. A whole-file parse would touch
+  // every one of them on EVERY iteration of a loop that never exits.
+  const old = [];
+  for (let i = 0; i < 40000; i++) old.push(JSON.stringify({ at: at(1000 + i), event: 'worked', task_id: String(i) }));
+  old.push(JSON.stringify({ at: at(900000), event: 'worked', task_id: 'recent-1' }));
+  old.push(JSON.stringify({ at: at(900100), event: 'worked', task_id: 'recent-2' }));
+  writeFileSync(p, old.join('\n'));
+  const t0 = Date.now();
+  assert.equal(runner.countWorkedSince(800000), 2, 'only the rows at or after the mark count');
+  assert.ok(Date.now() - t0 < 500, 'and it must not walk the whole log to say so');
+  delete process.env.AUTOBONGOS_LOG_FILE;
+});
+
+test('countWorkedSince stops at the first row older than the mark', () => {
+  const p = derivedLog();
+  process.env.AUTOBONGOS_LOG_FILE = p;
+  const at = (s) => new Date(s * 1000).toISOString();
+  writeFileSync(p, [
+    JSON.stringify({ at: at(100), event: 'worked', task_id: 'ancient' }),
+    JSON.stringify({ at: at(5000), event: 'worked', task_id: 'before-mark' }),
+    JSON.stringify({ at: at(9000), event: 'worked', task_id: 'after-mark' }),
+  ].join('\n'));
+  assert.equal(runner.countWorkedSince(8000), 1);
+  delete process.env.AUTOBONGOS_LOG_FILE;
+});

package/tests/autonomy_gauge.mjs

@@ -342,3 +342,59 @@ test('evaluate on a missing file is UNKNOWN — the CLI never defaults to go', (
     assert.equal(d.unknown, true);
   });
 });
+
+// --- a reading whose window has RESET is retired, not stale (task 1004178) ---
+//
+// An unattended host cannot refresh the gauge (see modules/autonomy/CLAUDE.md
+// for the evidence). These pin the behaviour that makes it survivable.
+
+test('an aged-out reading whose window has RESET is derived, not unknown', () => {
+  const now = 100000;
+  const g = {
+    written_at: now - 10 * HOUR,
+    five_hour: { used_percentage: 92, resets_at: now - 2 * HOUR, observed_at: now - 10 * HOUR },
+  };
+  const d = decideCapacity({ gauge: g, now });
+  assert.equal(d.go, true, 'the window it described has ended; 92% is no longer a fact about now');
+  assert.equal(d.unknown, false);
+  assert.equal(d.derived, true, 'and it must SAY so — the caller bounds work on a derived reading');
+  assert.equal(d.derivedSince, now - 2 * HOUR, 'the reset it stands on, so the cap has a start');
+});
+
+test('an aged-out reading whose window is STILL RUNNING stays unknown', () => {
+  const now = 100000;
+  const g = {
+    written_at: now - 10 * HOUR,
+    five_hour: { used_percentage: 92, resets_at: now + HOUR, observed_at: now - 10 * HOUR },
+  };
+  const d = decideCapacity({ gauge: g, now });
+  assert.equal(d.go, false, 'usage only GROWS inside a window, so an old 92% is a floor, never headroom');
+  assert.equal(d.unknown, true);
+});
+
+test('a fresh reading is unchanged and is never marked derived', () => {
+  const now = 100000;
+  const g = {
+    written_at: now - 60,
+    five_hour: { used_percentage: 10, resets_at: now + HOUR, observed_at: now - 60 },
+    seven_day: { used_percentage: 5, resets_at: now + 6 * 24 * HOUR, observed_at: now - 60 },
+  };
+  const d = decideCapacity({ gauge: g, now });
+  assert.equal(d.go, true);
+  assert.equal(d.derived, false);
+  assert.equal(d.derivedSince, null);
+});
+
+test('a derived seven-day window is NOT paced against a boundary we invented', () => {
+  const now = 100000;
+  // 90% used and only just past its reset: paced, this would refuse. But the
+  // boundary is inferred, so pacing it measures progress through a week nobody
+  // observed. Skipped rather than faked.
+  const g = {
+    written_at: now - 10 * HOUR,
+    seven_day: { used_percentage: 90, resets_at: now - HOUR, observed_at: now - 10 * HOUR },
+  };
+  const d = decideCapacity({ gauge: g, now });
+  assert.equal(d.derived, true);
+  assert.equal(d.go, true);
+});