@bongos/core 1.19.1081 → 1.20.1

package/modules/ui-design/kit/fixtures/me__cross-project.json

@@ -0,0 +1,15 @@
+{
+  "hide_stats": false,
+  "profile_state": "active",
+  "account_visibility": "public",
+  "recruiter_discoverable": null,
+  "recruiter_discoverable_effective": true,
+  "handle": "builder",
+  "display_name": "A Builder",
+  "bio": "Builds small tools that make shipping calmer. Mostly the hall, sometimes the sky.",
+  "links": { "website": "https://example.com/", "x": "https://x.com/builder" },
+  "cross_project": {
+    "projects": [],
+    "totals": { "projects": 3, "credits": 1000, "works_shipped": 19, "karma": 10, "shipped": 19 }
+  }
+}

package/modules/ui-design/kit/fixtures/provisioning-instance-render.json

@@ -0,0 +1,39 @@
+{
+  "101": {
+    "ok": true,
+    "app": {
+      "platform": "render", "state": "live", "stage": "live", "waiting": false, "mode": "greenfield",
+      "workspace": "tea-aaaaaaaa1111", "url": "https://demo.onrender.com",
+      "links": { "service": "https://dashboard.render.com/web/srv-aaaaaaaa1111", "env": "https://dashboard.render.com/web/srv-aaaaaaaa1111/env" },
+      "error": null, "retry": null
+    },
+    "env_vars": [
+      { "name": "DATABASE_URL", "required": true, "set_for_you": true },
+      { "name": "SESSION_SECRET", "required": true, "set_for_you": false },
+      { "name": "STRIPE_KEY", "required": false, "set_for_you": false }
+    ],
+    "values_held": false
+  },
+  "105": {
+    "ok": true,
+    "app": {
+      "platform": "render", "state": "failed", "stage": null, "waiting": false, "mode": "greenfield",
+      "workspace": "tea-aaaaaaaa1111", "url": null, "links": null,
+      "error": "This Render key cannot reach workspace tea-aaaaaaaa1111.",
+      "retry": { "owner_id": "tea-aaaaaaaa1111", "mode": "greenfield", "runtime": "node", "start_command": "npm start", "web_plan": "starter", "database": false }
+    },
+    "env_vars": [{ "name": "SESSION_SECRET", "required": true, "set_for_you": false }],
+    "values_held": false
+  },
+  "102": {
+    "ok": true,
+    "app": {
+      "platform": "render", "state": "deploying", "stage": "building", "waiting": false, "mode": "greenfield",
+      "workspace": "tea-aaaaaaaa1111", "url": "https://harbor.onrender.com",
+      "links": { "service": "https://dashboard.render.com/web/srv-bbbbbbbb2222", "env": "https://dashboard.render.com/web/srv-bbbbbbbb2222/env" },
+      "error": null, "retry": null
+    },
+    "env_vars": [],
+    "values_held": false
+  }
+}

package/modules/ui-design/kit/lib.js

@@ -35,7 +35,9 @@ const FLOORS = Object.freeze([
 ]);
 
 // 1280 is the review sheet's desktop width; render.js renders DEFAULT_SIZES unless --sizes names it.
-const SIZES = Object.freeze({ 1440: [1440, 900], 1280: [1280, 800], 390: [390, 844], 320: [320, 700] });
+// 1024 is a laptop-window width the owner reads panels at (task 1004381: the
+// Approval queue ran off-screen there). Opt-in with --sizes; not a default.
+const SIZES = Object.freeze({ 1440: [1440, 900], 1280: [1280, 800], 1024: [1024, 768], 390: [390, 844], 320: [320, 700] });
 const DEFAULT_SIZES = Object.freeze([1440, 390, 320]);
 const MODES = Object.freeze(['dark', 'light']);
 const CHANNELS = Object.freeze(['msedge', 'chrome']);

package/modules/ui-design/kit/serve.js

@@ -280,6 +280,89 @@ function me(origin) {
   return m;
 }
 
+// The hub account page (task 1004259): GET/PATCH /me/cross-project, PATCH /me/profile and
+// PATCH /me/handle, answered from ONE account held for the run (me__cross-project.json, or
+// the file a states file's stub.fixtures names) so a save the page re-reads comes back
+// saved. The routes' refusals are mirrored — the unknown key, the off-vocabulary value, the
+// bio over its cap, a typed link off its pinned host, the malformed or taken handle — because
+// a stub that takes any body is how task 1003352 shipped a key the real route 400s on. The
+// caps and pins are copied from platform-identity.js (a kit module may not import one), and
+// "taken" is the one handle already in use, so a probe can drive that refusal too.
+let ACCOUNT = null;
+function account() {
+  if (!ACCOUNT) {
+    const name = 'me__cross-project';
+    ACCOUNT = JSON.parse(fs.readFileSync(path.join(FIXTURES, (ALIAS[name] || name) + '.json'), 'utf8'));
+  }
+  return ACCOUNT;
+}
+const STUB_BIO_MAX = 280;
+const STUB_LINK_HOSTS = { website: null, x: ['x.com', 'twitter.com'], linkedin: ['linkedin.com'], discord: ['discord.gg', 'discord.com'] };
+const STUB_HANDLE = /^(?=.{1,39}$)[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function refuse(res, status, code, message) { return json(res, status, { error: { code, message } }); }
+function effectiveReach(a) { return a.recruiter_discoverable == null ? a.account_visibility !== 'private' : !!a.recruiter_discoverable; }
+function crossProjectPatch(res, body) {
+  const a = account();
+  const keys = Object.keys(body);
+  const bad = keys.find((k) => !['hide_stats', 'account_visibility', 'recruiter_discoverable'].includes(k));
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  if (!keys.length) return refuse(res, 400, 'no_fields', 'send at least one of hide_stats, account_visibility, recruiter_discoverable');
+  if ('hide_stats' in body && typeof body.hide_stats !== 'boolean') return refuse(res, 400, 'validation_failed', 'hide_stats must be a boolean');
+  if ('account_visibility' in body && !['public', 'private'].includes(body.account_visibility)) return refuse(res, 400, 'validation_failed', 'account_visibility is one of public, private');
+  if ('recruiter_discoverable' in body && typeof body.recruiter_discoverable !== 'boolean') return refuse(res, 400, 'validation_failed', 'recruiter_discoverable must be a boolean');
+  if ('hide_stats' in body) a.hide_stats = body.hide_stats;
+  if ('account_visibility' in body) {
+    // setAccountPrivacy's consent-timing rule: turning private without naming reach resets it
+    if (body.account_visibility === 'private' && a.account_visibility !== 'private' && !('recruiter_discoverable' in body)) a.recruiter_discoverable = null;
+    a.account_visibility = body.account_visibility;
+  }
+  if ('recruiter_discoverable' in body) a.recruiter_discoverable = body.recruiter_discoverable;
+  a.recruiter_discoverable_effective = effectiveReach(a);
+  return json(res, 200, { hide_stats: !!a.hide_stats, account_visibility: a.account_visibility, recruiter_discoverable: a.recruiter_discoverable, recruiter_discoverable_effective: a.recruiter_discoverable_effective });
+}
+function profilePatch(res, body) {
+  const a = account();
+  const bad = Object.keys(body).find((k) => !['display_name', 'bio', 'links'].includes(k));
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  if (!Object.keys(body).length) return refuse(res, 400, 'no_fields', 'send at least one of display_name, bio, links');
+  if ('display_name' in body) {
+    const n = typeof body.display_name === 'string' ? body.display_name.trim() : '';
+    if (!n) return refuse(res, 400, 'invalid_display_name', 'a display name must be non-empty plain text');
+    if (Array.from(n).length > 60) return refuse(res, 400, 'display_name_too_long', 'a display name is at most 60 characters');
+  }
+  if (body.bio != null && Array.from(String(body.bio).trim()).length > STUB_BIO_MAX) return refuse(res, 400, 'bio_too_long', `a bio is at most ${STUB_BIO_MAX} characters of plain text`);
+  let links = a.links;
+  if ('links' in body) {
+    links = null;
+    for (const [type, raw] of Object.entries(body.links || {})) {
+      if (!(type in STUB_LINK_HOSTS)) return refuse(res, 400, 'invalid_links', `links are a typed set (${Object.keys(STUB_LINK_HOSTS).join(', ')}), https URLs only — problem with '${type}'`);
+      if (raw == null || raw === '') continue;
+      let u = null;
+      try { u = new URL(String(raw).trim()); } catch { /* refused below */ }
+      const pins = STUB_LINK_HOSTS[type];
+      if (!u || u.protocol !== 'https:' || (pins && !pins.some((h) => u.hostname === h || u.hostname.endsWith('.' + h)))) {
+        return refuse(res, 400, 'invalid_link', `links are a typed set (${Object.keys(STUB_LINK_HOSTS).join(', ')}), https URLs only — problem with '${type}'`);
+      }
+      links = { ...(links || {}), [type]: u.href };
+    }
+  }
+  if ('display_name' in body) a.display_name = body.display_name.trim();
+  if ('bio' in body) a.bio = body.bio == null || !String(body.bio).trim() ? null : String(body.bio).trim();
+  a.links = links;
+  return json(res, 200, { display_name: a.display_name, bio: a.bio, links: a.links });
+}
+function handlePatch(res, body) {
+  const bad = Object.keys(body).find((k) => k !== 'handle');
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  const h = typeof body.handle === 'string' ? body.handle.trim().toLowerCase() : '';
+  if (!STUB_HANDLE.test(h)) return refuse(res, 400, 'invalid_handle', 'a handle is 1–39 characters of a–z, 0–9, and hyphens (not at the ends)');
+  if (h === 'taken') return refuse(res, 409, 'handle_taken', 'that handle is already in use');
+  const a = account();
+  const previous = a.handle;
+  a.handle = h;
+  return json(res, 200, { handle: h, previous_handle: previous || null });
+}
+
 const server = http.createServer((req, res) => {
   const u = new URL(req.url, 'http://x');
   const p = u.pathname;
@@ -292,7 +375,20 @@ const server = http.createServer((req, res) => {
     if (FEEDS[rest]) return LIVE ? proxy(req, res) : fixture(FEEDS[rest], res, origin);
     if (rest === '/me') return AUTH ? json(res, 200, me(origin)) : json(res, 401, UNAUTH);
     if (AUTHED[rest]) return AUTH ? fixture(AUTHED[rest], res) : json(res, 401, UNAUTH);
+    // the account page (task 1004259): one account for the run, reads and the three writes
+    if (rest === '/me/cross-project' && req.method === 'GET') return AUTH ? json(res, 200, account()) : json(res, 401, UNAUTH);
+    if (rest === '/me/cross-project' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => crossProjectPatch(res, body)) : json(res, 401, UNAUTH);
+    if (rest === '/me/profile' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => profilePatch(res, body)) : json(res, 401, UNAUTH);
+    if (rest === '/me/handle' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => handlePatch(res, body)) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
+    // where a project's app runs (task 1004353): the status read, from a fixture keyed by
+    // project id — a project the fixture does not name has no platform chosen
+    const appRead = rest.match(/^\/provisioning\/instances\/(\d+)\/render$/);
+    if (appRead && req.method === 'GET') {
+      if (!AUTH) return json(res, 401, UNAUTH);
+      const all = JSON.parse(fs.readFileSync(path.join(FIXTURES, 'provisioning-instance-render.json'), 'utf8'));
+      return json(res, 200, all[appRead[1]] || { ok: true, app: null, env_vars: [], values_held: false });
+    }
     const one = rest.match(/^\/provisioning\/instances\/(\d+)(\/settings)?$/);
     if (one && req.method === 'GET') return AUTH ? instances(res, one[1], !!one[2]) : json(res, 401, UNAUTH);
     // the hub's own cross-project surface (task 1003774): the requested/leave/

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1081",
+  "version": "1.20.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1081",
+      "version": "1.20.1",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1081",
+  "version": "1.20.1",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7883,5 +7883,168 @@
       "id": "1004364",
       "text": "Every module in the store will now come with a how-to guide. Publishing is refused without one, and an AI gives each guide a Docs score that buyers can see next to the module's other scores."
     }
+  ],
+  "1.20.0": [],
+  "1.20.1": [
+    {
+      "id": "1004401",
+      "text": "New Cloud Bongos releases were stuck: since late yesterday, every release was held back because a set of automatic database checks kept failing on the main line of work. Three recent changes each added a check that could never"
+    },
+    {
+      "id": "1004370",
+      "text": "When the project's shared tests break for a reason nobody's work caused, builders could no longer pick up the fix, because their approved tasks could not land and that paused their queue. Now a top-priority infrastructure task"
+    },
+    {
+      "id": "1004184",
+      "text": "A project that was created without choosing where its app runs can now connect Render straight from its own page. The owner gets the same steps as in the setup wizard: check the key, choose the workspace, a new app or one they"
+    },
+    {
+      "id": "1004072",
+      "text": "Specialities can now come with a set of skills, and each person chooses which of them to switch on. A speciality lists the skills it offers; when someone adopts it, every skill starts switched off, as you decided, and they tur"
+    },
+    {
+      "id": "1003485",
+      "text": "The hall's \"add a short bio\" prompt now opens your account page, where your bio can actually be written."
+    },
+    {
+      "id": "1004134",
+      "text": "The idea page now shows what a Full Idea's author thinks it is: a goal of its own, or a smaller piece inside an existing goal. The author answers that question when filing, and the board reads it when deciding, but the idea's"
+    },
+    {
+      "id": "1004254",
+      "text": "After a ship, any files left behind now stay where they are and get listed, instead of being tucked into a shared hiding place that other sessions could accidentally grab."
+    },
+    {
+      "id": "1004259",
+      "text": "You can now change your handle, bio, links and privacy in one place on your Cloud Bongos account page, and every project's hall links to it."
+    },
+    {
+      "id": "1004234",
+      "text": "The reply box on Collab threads no longer shows an old message about a removed metrics stack as its hint. It now just says \"Write a reply…\", so nobody mistakes the hint for a real reply."
+    },
+    {
+      "id": "1003405",
+      "text": "Correct the public-mirror export docs: publishing is manual, the workflow it named never existed."
+    },
+    {
+      "id": "1003656",
+      "text": "Creating a task no longer re-runs a full historical estimate aggregate every time; it is reused for a minute."
+    },
+    {
+      "id": "1004381",
+      "text": "The Approval queue now works on the live site. Page pictures attached to a round are kept in the site's own data folder instead of inside the Cloud Bongos package, so updating Cloud Bongos no longer deletes them, and any pictu"
+    },
+    {
+      "id": "1004398",
+      "text": "The session helper that tells each work session how to talk to you and what to watch out for had been silently broken since 16 September. A single mistake made it crash every time, and the crash was hidden, so for about two we"
+    },
+    {
+      "id": "1004270",
+      "text": "A project whose app runs on Render can now turn on a deploy page in its hall that lists its Render deploys with the tasks in each, marks what is live, and deploys or rolls back after two confirmations, though it has not yet be"
+    },
+    {
+      "id": "1002865",
+      "text": "A planning session no longer throws away its interview when your sign-in runs out partway through. Planning sessions can run long, and if the login expired before the final step, every task write failed and the answers from th"
+    },
+    {
+      "id": "1004395",
+      "text": "The platform can now finish renaming the site's pre-launch password setting by itself. Before, someone had to log into the server by hand. The next time a settings change is pushed to the live site, it copies the password over"
+    },
+    {
+      "id": "1004075",
+      "text": "The house style guide for the product's wording can now grow. The automatic reviewer that checks wording against the guide had the guide's rule numbers typed into its own instructions, so adding a twelfth rule, or splitting on"
+    },
+    {
+      "id": "1004353",
+      "text": "After setting a project's app up on Render, the owner can now see how it's going, in the setup wizard and on the project's page: creating, building, then live with its address and a link to Render. If it fails they get one pla"
+    },
+    {
+      "id": "1004344",
+      "text": "The studio's night scene now fills tall screens properly. The picture (the window with the moon, the plant, the lamp) was drawn for a screen about 900 pixels tall, so on a taller screen it stayed at the top and left a wide emp"
+    },
+    {
+      "id": "1004291",
+      "text": "Hosted projects now get their own lasting key to their GitHub repo, so a core upgrade always saves its new version there instead of leaving GitHub behind."
+    },
+    {
+      "id": "1004386",
+      "text": "The tweak editor drops its title header, and artists can open the live page in a new tab or a resizable split view below their words; the editor remembers the choice for the next page."
+    },
+    {
+      "id": "1004342",
+      "text": "Your sky no longer slides to the left. The page's frame could be scrolled sideways by the browser even though it showed no scrollbar, and a line of hint text at the bottom was wider than the screen, so moving the cursor into t"
+    },
+    {
+      "id": "1004191",
+      "text": "Checked the nine old, never-verified problems with how tasks are linked as \"do this first\". Fixed three real ones: adding several links at once can no longer half-succeed, two people adding links at the same moment can no long"
+    },
+    {
+      "id": "1004360",
+      "text": "The last leftover of the old dev boxes is gone from the database: four unused columns on the builders table are removed. Nothing users see changes."
+    },
+    {
+      "id": "1004300",
+      "text": "You can now open any recent Bongos version from the deploy page to see the hall as it was, on a copy of the data, with a banner on every page."
+    },
+    {
+      "id": "1004374",
+      "text": "Fixes to the overnight builder now actually reach it — until now it kept running whatever code it started with, so four days of fixes did nothing."
+    },
+    {
+      "id": "1004385",
+      "text": "Artists can now check off each line in the tweak editor with a green check, restore a line to the page's original words, and press Shift+Enter to check a line and jump to the next."
+    },
+    {
+      "id": "1004226",
+      "text": "The ten Full Ideas the board has passed can now become goals. They were all written on the older question form, which never asked \"what does success look like\", and a goal needs that as its finish line, so every one was being"
+    },
+    {
+      "id": "1004187",
+      "text": "Typing fast in the idea composer no longer makes the goal picker flicker back to suggestions for words you already replaced: a slow answer that arrives late is now ignored, the same way the landing line already ignored one."
+    },
+    {
+      "id": "1004007",
+      "text": "Automatic agents written as files can now say which kinds of change should wake them up, and where to send what they find. Before, that part of the file was silently thrown away, so an agent meant to look only at, say, documen"
+    },
+    {
+      "id": "1004188",
+      "text": "The core upgrade no longer refuses to run just because the new version adds a brand-new skill folder. It used to mistake that folder for someone's unsaved work and stop."
+    },
+    {
+      "id": "1001691",
+      "text": "Adds the ADR 0101 Part 1 advisory relevance/anti-hack judge to goal-task creation: reuses the ADR 0024 grader harness via cascade-dispatch, flags likely scope-gaming to a Metic review queue, and can raise claim-time friction o"
+    },
+    {
+      "id": "1004292",
+      "text": "Grade attempts now keep each worker's verdict per round, so the correlation audit can see objections from rounds a re-grade overwrote."
+    },
+    {
+      "id": "1004116",
+      "text": "Sixteen of the core's web request handlers (sign-in, the public status data, software updates, the builder roster and others) could not be worked on through any goal, because they belonged to no area of the codebase. They were"
+    },
+    {
+      "id": "1004352",
+      "text": "The setup wizard can now put a new project's app on the owner's own Render account. The owner pastes their Render key, the wizard checks it with Render straight away, and they choose which Render workspace to use, whether to c"
+    },
+    {
+      "id": "1004376",
+      "text": "The overnight builder was refusing to work because it thought it had already used up today's allowance — on work it did days ago."
+    },
+    {
+      "id": "1004057",
+      "text": "Each of the eleven working areas now carries its number as a proper piece of data, instead of the number only existing inside the goal's name. Before, anything that wanted to sort or label goals by area had to read it out of t"
+    },
+    {
+      "id": "1003457",
+      "text": "Added a live-DB proof that resolving a blocker through the hall's own HTTP routes actually auto-promotes the tasks it was blocking — closing the last gap in blocker test coverage, which had only ever exercised the trigger via"
+    },
+    {
+      "id": "1004350",
+      "text": "The Render setup now puts the project owner's own app on their Render account, built from their repository the way they say, with a database only if they ask for one. The Builders' hall stays hosted by us. Linking an existing"
+    },
+    {
+      "id": "1004368",
+      "text": "CI checks were failing on every change because of a newly published security flaw in a networking library; updating it made the checks pass again so approved work can land."
+    }
   ]
 }

package/scripts/gds/agents-sync.js

@@ -202,9 +202,19 @@ function parseAgentFile(text, { name } = {}) {
     candidate.trigger_type = candidate.trigger;
     delete candidate.trigger;
   }
-  if (candidate.event && !candidate.trigger_spec) {
-    candidate.trigger_spec = { event: candidate.event };
-    delete candidate.event;
+  // Every trigger PARAMETER, not just `event` (task 1004007). The frontmatter
+  // is flat on purpose (no YAML parser in a deploy script), so the file spells
+  // trigger_spec's keys at the top level and they are folded in here. Only
+  // `event` used to be, so a file's `touches:` filter reached the validator as
+  // a stray top-level key and was dropped, and every file-authored event agent
+  // fired on EVERY ship whatever its author wrote. `touches_globs` is the
+  // router's second spelling of the same filter. Values are moved VERBATIM: a
+  // malformed one is the validator's to refuse, not this parser's to coerce.
+  const SPEC_KEYS = ['event', 'touches', 'touches_globs', 'sink', 'cadence'];
+  const present = SPEC_KEYS.filter((k) => Object.prototype.hasOwnProperty.call(candidate, k));
+  if (present.length > 0 && candidate.trigger_spec === undefined) {
+    candidate.trigger_spec = {};
+    for (const k of present) { candidate.trigger_spec[k] = candidate[k]; delete candidate[k]; }
   }
   return candidate;
 }

package/scripts/gds/autobongos-run.js

@@ -611,7 +611,9 @@ function writeHeartbeat(now = Date.now()) {
   try {
     const p = heartbeatPath();
     fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, JSON.stringify({ pid: process.pid, at: now }));
+    // `head` is what this process is RUNNING, not what is on disk (task 1004374).
+    // Alive and alive-on-stale-code look identical from a check-in age alone.
+    fs.writeFileSync(p, JSON.stringify({ pid: process.pid, at: now, head: LOADED_HEAD }));
     return true;
   } catch (_) { return false; }
 }
@@ -735,6 +737,67 @@ async function pollSignals(deps = {}) {
   return cadence.signalFingerprint({ head, fenceUpdatedAt, claimableCount });
 }
 
+// UPGRADE_EXIT_CODE — the one exit `--forever` is allowed to make (task 1004374).
+//
+// THE PROBLEM. autobongos-service.cmd refreshes the checkout with git fetch +
+// reset --hard origin/main BEFORE launching node, and only then. `--forever`
+// never returns, by design (task 1003904): a stopped daemon on an always-on
+// machine is indistinguishable from a working one. Together those mean a
+// process never re-reads its code, so a shipped fix reaches the disk and never
+// reaches the runner, and nothing restarts it — not stopping IS the design. On
+// the host this ran week-old code for four days across three landed fixes,
+// while the heartbeat said alive and the hall showed a healthy runner.
+//
+// WHY AN EXIT IS SAFE HERE, when task 1003904 forbids exiting. That rule exists
+// so a machine nobody watches cannot look idle while it is dead. This exit is
+// the opposite: it is deliberate, it is logged as `upgrade_exit`, and the
+// WRAPPER loops on this specific code — re-running the fetch + reset and
+// relaunching — so the runner is not depending on Task Scheduler noticing.
+// Every other exit still falls through to the scheduler exactly as before.
+const UPGRADE_EXIT_CODE = 75;
+
+// MIN_UPTIME_BEFORE_UPGRADE_MS — the guard against a restart storm.
+//
+// The wrapper's `git reset --hard origin/main` is BEST EFFORT: a fetch that
+// fails leaves the checkout behind on purpose, because being a commit behind
+// beats not running at all. Without this guard that becomes a spin — the runner
+// starts behind, sees drift on its first loop, exits, and the wrapper relaunches
+// it into the same state as fast as the machine allows. One minute of required
+// uptime turns a failing fetch into a slow retry instead.
+const MIN_UPTIME_BEFORE_UPGRADE_MS = 60_000;
+
+// loadedHead — the commit this PROCESS is running, read once. Not re-read: the
+// point is to compare what is executing against what has landed, and re-reading
+// would just track the disk, which the wrapper already moves.
+let LOADED_HEAD = null;
+async function loadedHead(deps = {}) {
+  if (LOADED_HEAD !== null) return LOADED_HEAD;
+  const runCmd = deps.run || run;
+  try {
+    const r = await runCmd('git', ['rev-parse', 'HEAD'], { cwd: REPO_ROOT });
+    LOADED_HEAD = r && r.ok ? String(r.stdout || '').trim() || null : null;
+  } catch (_) { LOADED_HEAD = null; }
+  return LOADED_HEAD;
+}
+
+// codeDrifted — has main moved past the code this process loaded?
+//
+// Fails CLOSED in the "keep running" direction: an unreadable local head or an
+// unreachable origin returns false, so a network blip never cycles the runner.
+// The cost of a missed upgrade is one more loop; the cost of a false positive is
+// a restart storm.
+async function codeDrifted(deps = {}) {
+  // Injectable like every other collaborator here: the module-level cache is
+  // right for production (read the running commit ONCE) and would otherwise make
+  // the comparison untestable in isolation.
+  const mine = deps.loadedHead ? await deps.loadedHead(deps) : await loadedHead(deps);
+  if (!mine) return null;
+  let tip = null;
+  try { tip = await runFetchHead(deps); } catch (_) { return null; }
+  if (!tip) return null;
+  return tip !== mine ? { from: mine.slice(0, 8), to: String(tip).slice(0, 8) } : false;
+}
+
 // The head of origin/main, or null. `git ls-remote` rather than `fetch`: it moves
 // no refs and writes nothing, so polling it every few minutes cannot interfere
 // with a worker building in a tree beside it.
@@ -849,6 +912,21 @@ async function forever(opts, deps = {}) {
       if (seen.class !== 'progress') break;
     }
 
+    // AFTER the burst, never during one: a worker mid-task must not be abandoned
+    // to pick up a fix. Before the wait, because waiting is where the runner
+    // spends nearly all of its time and an upgrade should not sit behind it.
+    const upMs = (deps.now ? deps.now() : Date.now()) - Date.parse(RUNNER_STARTED_AT);
+    const mayUpgrade = upMs >= MIN_UPTIME_BEFORE_UPGRADE_MS;
+    const drift = mayUpgrade
+      ? (deps.codeDrifted ? await deps.codeDrifted(deps) : await codeDrifted(deps))
+      : false;
+    if (drift) {
+      log({ event: 'upgrade_exit', from: drift.from, to: drift.to,
+        reason: `main moved from ${drift.from} to ${drift.to} — exiting so the wrapper can relaunch on the new code` });
+      await beat({ mode: state.mode, last_event: 'upgrade_exit' });
+      return UPGRADE_EXIT_CODE;
+    }
+
     const { waited, jumped } = await wait(state.waitS, { ...deps, beat }, opts.cadence);
     if (jumped) log({ event: 'cadence', mode: state.mode, jumped: true, waited_s: waited, why: 'a new signal arrived — main moved, the fence changed, or the queue did' });
   }
@@ -886,7 +964,7 @@ if (require.main === module) {
 
 module.exports = {
   readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
-  worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, countWorkedSince,
+  worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, countWorkedSince, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT,
 };

package/scripts/gds/autobongos-service.cmd

@@ -24,6 +24,14 @@ if not exist "%LOGDIR%" mkdir "%LOGDIR%"
 
 cd /d "%REPO%" || exit /b 1
 
+REM THE UPGRADE LOOP (task 1004374). The runner exits 75 when main has moved
+REM past the code it loaded; we refresh and relaunch. Without this --forever
+REM never returns and so never picks up a fix: on the host this ran week-old
+REM code for four days across three landed fixes while the heartbeat reported
+REM it alive. Looping HERE rather than leaning on the scheduler matters,
+REM because MultipleInstances IgnoreNew makes a restart a silent no-op while
+REM the old process is still up.
+:run
 echo. >> "%LOG%"
 echo ==== autobongos starting %DATE% %TIME% ==== >> "%LOG%"
 
@@ -34,5 +42,9 @@ git reset --quiet --hard origin/main >> "%LOG%" 2>&1
 
 node scripts\gds\autobongos-run.js --forever --json >> "%LOG%" 2>&1
 set EXITCODE=%ERRORLEVEL%
+if "%EXITCODE%"=="75" (
+  echo ==== autobongos relaunching for an upgrade at %DATE% %TIME% ==== >> "%LOG%"
+  goto run
+)
 echo ==== autobongos exited %EXITCODE% at %DATE% %TIME% ==== >> "%LOG%"
 exit /b %EXITCODE%

package/scripts/gds/copy-apply.js

@@ -368,6 +368,11 @@ function registryRowFor(line, registryById) {
 
 const rowKey = (e) => `${e.id}|${e.file}|${e.line}`;
 
+// The {{token}} brand holes in a line, sorted (a hole may move within the line).
+function brandHoles(text) {
+  return (String(text == null ? '' : text).match(/\{\{[A-Za-z][A-Za-z0-9_]*\}\}/g) || []).sort();
+}
+
 // One batch line -> the single-proposal patch shape (proposals.js), resolved
 // against the registry row its string_id names. `texts` carries a row's text as
 // earlier lines of this batch left it. Pure.
@@ -381,6 +386,15 @@ function patchForBatchLine(line, registryById, texts = new Map()) {
   if (want !== got) {
     return { ok: false, code: 'placeholder_mismatch', detail: { expected: want, got, what_this_means: 'The rewrite does not keep the values the page drops into this line.' } };
   }
+  // A {{token}} is a brand hole the server fills at serve time (ADR 0233's hole
+  // rule, for the instance's names; task 1004381). It is written back VERBATIM,
+  // so the same tokens must survive the rewrite: a dropped one would bake a
+  // brand value (or nothing) into brand-free source.
+  const wantHoles = brandHoles(line.before);
+  const gotHoles = brandHoles(line.after);
+  if (wantHoles.join('|') !== gotHoles.join('|')) {
+    return { ok: false, code: 'placeholder_mismatch', detail: { expected: wantHoles, got: gotHoles, what_this_means: 'The rewrite drops or adds a name the page fills in from the instance\'s branding ({{productName}} and the like).' } };
+  }
   const current = texts.has(rowKey(entry)) ? texts.get(rowKey(entry)) : entry.text;
   let proposed;
   if (current === line.before) proposed = line.after;

package/scripts/gds/dev-box-guard.js

@@ -47,8 +47,7 @@ const DEV_BOX_EXEMPT = new Map([
   ['limitations/', 'historical record: shipped-version scope archives'],
   ['docs/module-api-changelog.md', 'history ledger of doorway releases; entries are appended, never rewritten'],
   // Applied migrations: they created the box objects and, last, dropped them. Named one
-  // by one so a NEW migration is still checked. The column drop of task 1004360 joins
-  // this list when it lands.
+  // by one so a NEW migration is still checked.
   ['migrations/067_builder_boxes.sql', 'applied migration (created the box tables)'],
   ['migrations/069_builder_ssh_keys.sql', 'applied migration'],
   ['migrations/070_box_intents.sql', 'applied migration'],
@@ -66,6 +65,7 @@ const DEV_BOX_EXEMPT = new Map([
   ['migrations/core_238_box_unattended_cap.sql', 'applied migration'],
   ['migrations/core_248_module_enablement_overrides.sql', 'applied migration (names the key in an example)'],
   ['migrations/core_258_drop_dev_box_tables.sql', 'the migration that drops the box tables and session source by name (task 1003895)'],
+  ['migrations/core_262_drop_builder_box_blocked.sql', 'the migration that drops the box_blocked columns by name (task 1004360)'],
   ['modules/government/migrations/governance_002_seed_and_backfill.sql', 'applied migration (seeded the box.* keys)'],
   ['modules/government/migrations/governance_007_delegate_archon_ops_to_metic.sql', 'applied migration'],
   ['modules/government/migrations/government_019_retire_box_permissions.sql', 'the migration that revokes the box.* keys by name (task 1003894)'],
@@ -78,6 +78,7 @@ const DEV_BOX_EXEMPT = new Map([
   ['tests/auth_page_gate.mjs', 'proves a leftover source=box session is refused a page'],
   ['tests/terms_acceptance.mjs', 'proves a leftover source=box session cannot mint an acceptance'],
   ['tests/government_seed.mjs', 'proves government_019 revoked the box.* keys from every rank'],
+  ['tests/core_262_drop_box_blocked_db.mjs', 'proves core_262 leaves builders with no box_blocked column (task 1004360)'],
   ['tests/core_258_box_session_claims_db.mjs', 'proves core_258 applies over a claim created from a box session (task 1004362)'],
   ['tests/government_protected_surfaces.mjs', 'RETIRED_SINCE_R101: retired protected paths may leave the registry only once gone'],
   ['scripts/gds/dev-box-guard.js', 'this guard (it defines the rules)'],

package/scripts/gds/fitness.js

@@ -754,6 +754,15 @@ const KERNEL_IMPORT_ALLOWLIST = new Set([
   // them; they never flip the kernel→domain leak.
   'src/bongos/llm-cache.js',
   'src/bongos/llm-pricing.js',
+  // The cheapest-model-first cascade router (task 1001691 / ADR 0101 Part 1):
+  // a pure ladder + an INJECTED runner (never a domain call itself — its own
+  // header says so: "nothing calls it but its mock unit test" until this
+  // task), holding no domain state of its own. Its first real caller is the
+  // lifecycle module's relevance judge, which reaches it through the doorway
+  // exactly as grading reaches llm-cache — same category as the pg pool /
+  // path-match / llm-cache above, not a domain module core would otherwise
+  // depend on.
+  'src/bongos/cascade-dispatch.js',
 ]);
 
 // Pure: for relative require `spec` from kernel file `fromRel` (repo-relative),