@bongos/core 1.19.129 → 1.19.131

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.129",
-  "core_contract": "1.19.129",
-  "source_commit": "4f6f1fe2d419e1f7a6b2877ce6d3b2f793308257",
+  "core_version": "1.19.131",
+  "core_contract": "1.19.131",
+  "source_commit": "7fc91a6722c91cd40c09ce632c2a765377952e49",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T02:03:44.422Z",
+  "built_at": "2026-08-15T03:23:58.787Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1246,
+    "functional_verbatim": 1247,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1570,
-  "tree_sha256": "15adcb143cdb095a549345805c5491c08b64429b4ef6730ef4878344c15d2ea9",
+  "file_count": 1571,
+  "tree_sha256": "81215c25cbaed99553dba15247df2e2f9daf37245d8144df0a5e32b507b4c0b9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4172,12 +4172,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "113fa76500c41f49120cb6a76558c693e3862d5f7dbd754c6b6f9e604bd0d45e"
+      "sha256": "ad651e607ce3937ca8522552d21ecfbaa03108734f9c7987c79a2e8ef8a7c7f3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "88877c77760c0d9d44361b8522fa2e871a8a62f85a500454acc9af972db8b00e"
+      "sha256": "178ddf3d5958c428d370e3381cdca505455abe6006b9f920245de0062bc2d5aa"
     },
     {
       "path": "public-docs/index.html",
@@ -4992,7 +4992,7 @@
     {
       "path": "scripts/gds/mirror-lineage-check.js",
       "mode": "0000644",
-      "sha256": "ec187c4a4ad91a3758ff4635baa5ad32dcad7fbf0b61e4f8d3fbc81784254833"
+      "sha256": "31296eda794e640ce5f7191d166d08710b35290be67878826a2c7209f0216e54"
     },
     {
       "path": "scripts/gds/mirror-redact.js",
@@ -5157,7 +5157,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "5ff111416adc80a4513bc91488185f5f47800f16c1fe8b746e0982ee9b4ffeb9"
+      "sha256": "4c3bef6907b4807d93426e754ff20c75e56b498e4302c1cd47e4b3953bd8b4d0"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5322,7 +5322,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "7ae14021dbae94ffc5a70cf05081e645ca2dcf9685ccf135658538cb44e79dde"
+      "sha256": "681de343f8491a2f22165246f21ac371a8f76411b395991c784635e8e9646ed7"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5762,7 +5762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0d17e220c27abd9a9064c461404fa8fdf2f352f404e10673b76ff8a34ccd04c2"
+      "sha256": "fd76c822f4e795248c2c010052dab9cce8cc237a5f501fbf90e66c413c58eac6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7052,12 +7052,12 @@
     {
       "path": "tests/mirror_lineage_fulltree.mjs",
       "mode": "0000644",
-      "sha256": "ce44c9b95988aa587164f2bfbd002046a188be34f14d968635b5d88bb8e98c56"
+      "sha256": "0482cd900a7c45a18ece314deb977eef852060b50d56b814d58ac631bc568426"
     },
     {
       "path": "tests/mirror_lineage_proof.mjs",
       "mode": "0000644",
-      "sha256": "5c9ec605b7e34b046f6df9b1d9f6efa532d394d1134e69990542dde2e86e4ffe"
+      "sha256": "74301070c93c5cb5b4f31d32e508336c96ba199064db9fdf810f07f8d431a98d"
     },
     {
       "path": "tests/mirror_redact.mjs",
@@ -7654,6 +7654,11 @@
       "mode": "0000644",
       "sha256": "23731936e26feb6406333f484c86210be2f2eaee1b4060ba34c9e03f8fd09685"
     },
+    {
+      "path": "tests/ship_publish_error.mjs",
+      "mode": "0000644",
+      "sha256": "eb8c52362355479a50c83ba84968d605b93f98e93513cf8436dd096e6514f6e8"
+    },
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
@@ -7767,7 +7772,7 @@
     {
       "path": "tests/subdomain_auth.mjs",
       "mode": "0000644",
-      "sha256": "e28409f9063a36482482bcb295de5c629430dd28c53a03e1b3c979d5566306dd"
+      "sha256": "24257ca4ad1a7bcefb735ee1b02609469035730e0723645f71e10eb71525bb72"
     },
     {
       "path": "tests/task_classifier_vocab.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.129",
+  "version": "1.19.131",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.129",
+      "version": "1.19.131",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.129",
+  "version": "1.19.131",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/mirror-lineage-check.js

@@ -13,10 +13,11 @@
 //      export does (mirror-redact + secret-scrub, via the SHARED redactBlob) and
 //      assert ZERO residual instance literals, public IPs, or secrets survive.
 //      Same detector the export gates on — "one detector, two consumers."
-//   2. MIGRATION NUMBERING — the set of core migrations/NNN_*.sql numbers that
-//      reach the mirror is IDENTICAL to the private set (redaction never renames
-//      a file), so the claim-time next-number allocator computes the SAME next
-//      migration on both sides. A dropped/renumbered migration = divergence = fail.
+//   2. MIGRATION NUMBERING — the set of core migration numbers (bare NNN_*.sql and
+//      namespaced core_NNN_*.sql alike) that reach the mirror is IDENTICAL to the
+//      private set (redaction never renames a file), so the claim-time next-number
+//      allocator computes the SAME next migration on both sides. A dropped or
+//      renumbered migration = divergence = fail.
 //   3. ENUM VALUES — for every publishable migration, the CHECK (... IN (...))
 //      value-lists are byte-identical before and after redaction. Redaction may
 //      touch a domain in a comment; it must NEVER alter a schema enum value.
@@ -46,6 +47,7 @@ const {
 const { isBinary } = require(path.join(REPO_ROOT, 'scripts/public-mirror-export.js'));
 const { scrubSecrets, collectEnvSecrets, SECRET_PATTERNS } = require(path.join(REPO_ROOT, 'modules/security/secret-scrub.js'));
 const { nextFree } = require(path.join(REPO_ROOT, 'scripts/gds/next-number.js'));
+const { migrationNumberOf } = require(path.join(REPO_ROOT, 'scripts/gds/migration-namespace.js'));
 
 // Known secret SHAPES as NON-GLOBAL clones. We scan each file with .test(), and a
 // `/g` regex carries lastIndex state across .test() calls — reused in a loop over
@@ -55,30 +57,41 @@ const { nextFree } = require(path.join(REPO_ROOT, 'scripts/gds/next-number.js'))
 // deterministic regardless of file order.
 const KNOWN_SECRET_SHAPES = SECRET_PATTERNS.map((re) => new RegExp(re.source, re.flags.replace('g', '')));
 
-// Core migrations are migrations/NNN_slug.sql (3+ digit prefix) DIRECTLY under
-// migrations/. Module migrations live under modules/<key>/migrations/ and instance
-// SEEDS under migrations/instance/ (ADR 0105) — both numbered independently and
-// excluded from the publishable mirror; the claim-time allocator only reads the
-// top-level core dir, so only core numbering can diverge.
-const MIGRATION_BASENAME_RE = /^(\d{3,})_.*\.sql$/;
-
 // ---- pure helpers (exported for tests) ------------------------------------
 
+// The CORE migration number for a repo-relative path, or null if it is not one.
+//
+// Core migrations sit DIRECTLY under migrations/ as either the legacy bare NNN_slug.sql
+// or the namespaced core_NNN_slug.sql every NEW core migration must use (ADR 0108 §5).
+// The prefix namespaces the FILENAME (so a core stem can't collide with an instance/
+// module one across repos), NOT the number line — core_188 continues the bare 001–187
+// sequence as ONE sequence. Hence the shared migrationNumberOf, the SAME parser the
+// claim-time allocator (next-number.js) counts from: this proof and the allocator can
+// never disagree about which numbers are taken. (Task 1002527 — the bare-regex version
+// was blind to core_188+, leaving BOTH halves equally blind and the gate falsely green.)
+//
+// Module migrations (modules/<key>/migrations/) and instance SEEDS
+// (migrations/instance/, ADR 0105) are numbered independently and excluded from the
+// publishable mirror; the allocator only reads the top-level core dir, so only core
+// numbering can diverge.
+function coreMigrationNumber(repoRelPath) {
+  const s = String(repoRelPath);
+  if (!s.startsWith('migrations/')) return null; // the migrations dir …
+  // … and ONLY its top level. Counting migrations/instance/NNN_*.sql put every instance
+  // seed in the PRIVATE set but not the MIRROR set (they are unpublishable, task 2140) —
+  // a false private⇄mirror divergence that red-lined the unit gate (task 2152). A path
+  // with a further slash is a subdir, never a core migration.
+  const rest = s.slice('migrations/'.length);
+  if (rest.includes('/')) return null;
+  return migrationNumberOf(rest);
+}
+
 // The set of CORE migration numbers among a list of repo-relative paths.
 function migrationNumbersFromPaths(paths) {
   const out = new Set();
   for (const p of paths || []) {
-    const s = String(p);
-    if (!s.startsWith('migrations/')) continue; // the migrations dir …
-    // … and ONLY its top level. migrations/instance/NNN_*.sql are this instance's host
-    // seeds (ADR 0105), excluded from the publishable mirror (task 2140) — counting them
-    // here put every instance seed in the PRIVATE set but not the MIRROR set, a false
-    // private⇄mirror divergence that red-lined the unit gate (task 2152). A path with a
-    // further slash is a subdir, never a core migration.
-    const rest = s.slice('migrations/'.length);
-    if (rest.includes('/')) continue;
-    const m = MIGRATION_BASENAME_RE.exec(rest);
-    if (m) out.add(parseInt(m[1], 10));
+    const n = coreMigrationNumber(p);
+    if (n != null) out.add(n);
   }
   return out;
 }
@@ -178,10 +191,12 @@ function proveLineage({ publishableFiles, privateMigrationNumbers, ctx }) {
   for (const f of publishableFiles) {
     const { redactedText, leaks: fileLeaks } = scanFile(f.buf, ctx);
     for (const l of fileLeaks) leaks.push({ path: f.path, label: l.label, sample: l.sample });
-    if (f.path.startsWith('migrations/') && MIGRATION_BASENAME_RE.test(f.path.split('/').pop())) {
+    // Same predicate as the private half (migrationNumbersFromPaths) — the two sets are
+    // only comparable if both are built by the identical parser.
+    const migNum = coreMigrationNumber(f.path);
+    if (migNum != null) {
       migFiles.push({ path: f.path, original: f.buf.toString('utf8'), redacted: redactedText != null ? redactedText : f.buf.toString('utf8') });
-      const mm = MIGRATION_BASENAME_RE.exec(f.path.split('/').pop());
-      mirrorNums.add(parseInt(mm[1], 10));
+      mirrorNums.add(migNum);
     }
   }
 
@@ -317,7 +332,7 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
-  MIGRATION_BASENAME_RE,
+  coreMigrationNumber,
   migrationNumbersFromPaths,
   parseEnumChecks,
   numberingDivergence,

package/scripts/gds/run-unit-tests.js

@@ -77,7 +77,7 @@ const INTEGRATION = new Set([
   'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
   'session_records', 'setup_smoke',
-  'status-probe', 'subdomain_auth',
+  'status-probe',
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):

package/scripts/gds/ship.js

@@ -1213,6 +1213,34 @@ async function ciLand(taskId, branch, valueSummary) {
   return await ciLandLocal(taskId, branch, valueSummary);
 }
 
+// task 1001916: render a FAILED POST /tasks/:id/publish-branch for the builder.
+// The server has carried { step, reason } — which git step failed + the
+// credential-scrubbed stderr — since task 1547, but the bail site printed only
+// `data.message || data.error`: "[object Object]" on the ADR 0116 envelope, a
+// bare `publish_failed` on the legacy flat shape. That hid a non-fast-forward
+// rejection (the server had already freshened the branch itself) across several
+// blind retry laps, so that case also gets its specific remedy. Pure + exported
+// for tests/ship_publish_error.mjs (no git, no network).
+const NON_FAST_FORWARD_RE = /fetch first|non-fast-forward/i;
+
+function formatPublishFailure(data, status, branch) {
+  const { code, message } = normalizeApiError(data);
+  const envelopeDetails = (data && data.error && typeof data.error === 'object' && data.error.details) || null;
+  const details = envelopeDetails || data || {};
+  const label = message || code || (data && data.message) || `HTTP ${status}`;
+  // git stderr is multi-line; this is embedded mid-sentence in one log line.
+  const reason = details.reason ? String(details.reason).replace(/\s+/g, ' ').trim() : '';
+  const parts = [];
+  if (details.step) parts.push(`step: ${details.step}`);
+  if (reason) parts.push(`reason: ${reason}`);
+  let out = parts.length ? `${label} (${parts.join('; ')})` : label;
+  if (NON_FAST_FORWARD_RE.test(reason)) {
+    out += ` — the server already moved ${branch}: fetch origin, reset onto origin/${branch}, `
+      + 're-run the generators, and re-ship so the push fast-forwards.';
+  }
+  return out;
+}
+
 // ciLandServer — the dev-box path: no GitHub push credential on this machine, so
 // hand the branch to the GDS, which pushes it + opens the PR + auto-merges with
 // the server-side credential. Requires a RE-AUTHED (non-box) cli session — a
@@ -1249,7 +1277,7 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed('server-mediated push is not configured (operator action)', strandCommand(taskId, 'server'));
     }
     if (!r.ok) {
-      const e = (r.data && (r.data.message || r.data.error)) || `HTTP ${r.status}`;
+      const e = formatPublishFailure(r.data, r.status, branch);
       console.log(`  ci-land: server publish failed — ${e}. Task stays at confirmed. ${strandNextStep(taskId, 'server')}`);
       return landBailed(`server publish failed — ${e}`, strandCommand(taskId, 'server'));
     }
@@ -4472,6 +4500,10 @@ module.exports = {
   // object, so a consumer MUST test `.ok`; the old `if (!merged)` would sail past
   // a bail. Also pins pending (a poll timeout) as distinct from bailed.
   landed, landPending, landBailed, strandCommand,
+  // task 1001916: the publish-branch failure formatter — exported pure so both
+  // wire shapes (envelope + legacy flat), the step/reason surfacing, and the
+  // non-fast-forward remedy hint are pinned without a server.
+  formatPublishFailure,
   // task 1719: pure post-land status reconciler — a task that reached 'shipped'
   // in-session shows the SHIPPED banner + writes no breadcrumb; otherwise keep the
   // pre-merge status (confirmed → next-turn breadcrumb fallback). Exported for tests.

package/src/module-api.js

@@ -685,8 +685,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.127 with no explicit bump. run 31857842473. (task 1002620)
 //   1.19.129 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.128 with no explicit bump. run 31858158416. (task 1002620)
+//   1.19.130 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.129 with no explicit bump. run 31861289412. (task 1002620)
+//   1.19.131 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.130 with no explicit bump. run 31861682626. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.129'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.131'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/mirror_lineage_fulltree.mjs

@@ -12,11 +12,18 @@
 // and asserts zero residual leaks + private⇄public migration-numbering/enum stability.
 // Filesystem + git (git ls-files) are the only dependencies — no DB, no network.
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { runSimulation } = require('../scripts/gds/mirror-lineage-check.js');
+const { migrationNumberOf } = require('../scripts/gds/migration-namespace.js');
+const { nextFree } = require('../scripts/gds/next-number.js');
+
+const MIGRATIONS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'migrations');
 
 test('C9 full-tree simulation: the redacted publishable mirror leaks nothing', () => {
   const report = runSimulation();
@@ -43,3 +50,24 @@ test('C9 full-tree simulation: the redacted publishable mirror leaks nothing', (
     `redaction altered enum value-list(s) in ${report.drift.length} migration(s): ${report.drift.map((d) => d.path).join(', ')}`
   );
 });
+
+// The proof is only worth its green tick if it actually SEES every core migration.
+// Before task 1002527 it parsed the bare `NNN_` form only, so every `core_NNN_` file
+// (ADR 0108 §5) was invisible to BOTH halves — equally blind, therefore silently
+// "consistent". This asserts the simulation's coverage against the real tree so the
+// gate can't quietly stop covering new core migrations again.
+test('C9 full-tree simulation covers namespaced core_NNN_ migrations too (task 1002527)', () => {
+  const basenames = fs.readdirSync(MIGRATIONS_DIR).filter((n) => migrationNumberOf(n) != null);
+  const namespaced = basenames.filter((n) => !/^\d/.test(n));
+  assert.ok(namespaced.length > 0, 'expected at least one core_NNN_ migration on disk — update this test if the namespace discipline changed');
+
+  const report = runSimulation();
+  assert.equal(
+    report.counts.migrations,
+    basenames.length,
+    `the proof saw ${report.counts.migrations} core migrations but migrations/ holds ${basenames.length} — a naming form is not being parsed`
+  );
+  // Bare and namespaced core files share ONE number line, so the proof's next-free must
+  // match what next-number.js hands a claim; if they disagree a number gets re-used.
+  assert.equal(report.nextPrivate, nextFree(new Set(basenames.map(migrationNumberOf))));
+});

package/tests/mirror_lineage_proof.mjs

@@ -8,7 +8,9 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const {
   migrationNumbersFromPaths, parseEnumChecks, numberingDivergence, enumDrift,
+  proveLineage, buildRedactionContext,
 } = require('../scripts/gds/mirror-lineage-check.js');
+const { nextFree } = require('../scripts/gds/next-number.js');
 
 test('migrationNumbersFromPaths picks CORE migrations only (not module/ADR numbers)', () => {
   const set = migrationNumbersFromPaths([
@@ -31,9 +33,61 @@ test('migrationNumbersFromPaths excludes migrations/instance/ seeds (task 2152)'
     'migrations/080_core_thing.sql',                    // bare core → counted
     'migrations/instance/080_gds_v4_planning_seed.sql', // instance seed → NOT core
     'migrations/instance/186_governance_seed.sql',      // instance seed → NOT core
-    'migrations/core_192_namespaced.sql',               // core_ prefix ≠ bare NNN_ form → not counted either
+    'migrations/core_192_namespaced.sql',               // namespaced core (ADR 0108 §5) → counted
   ]);
-  assert.deepEqual([...set].sort((a, b) => a - b), [80]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [80, 192]);
+});
+
+// ---- namespaced core migrations (ADR 0108 §5 / task 1002527) ---------------
+// Core migrations above LEGACY_BARE_CORE_MAX are `core_NNN_`-prefixed so their stem
+// can't collide with an instance/module migration across repos. The prefix namespaces
+// the FILENAME, not the NUMBER LINE: core_188 continues the bare 001–187 sequence as
+// ONE sequence (migration-namespace.js pins the cutoff so no bare core file can ever
+// exceed it, and next-number.js unions both forms into a single max+1). The C9 proof
+// must parse both forms or it silently stops covering every new core migration.
+
+test('migrationNumbersFromPaths parses namespaced core_NNN_ names as ONE sequence with the bare ones (task 1002527)', () => {
+  const set = migrationNumbersFromPaths([
+    'migrations/003_pms.sql',              // legacy bare core
+    'migrations/187_goal_sort_order.sql',  // the last bare core number
+    'migrations/core_188_goal_visibility.sql',
+    'migrations/core_219_grade_attempts_idx.sql',
+    'modules/game/migrations/game_001_world.sql', // module migration — still excluded
+  ]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [3, 187, 188, 219]);
+  // ONE sequence, so the next free core number continues past the namespaced files —
+  // the same number next-number.js hands a claim (188 here would re-use core_188).
+  assert.equal(nextFree(set), 220);
+});
+
+test('proveLineage counts namespaced core_NNN_ migrations in the MIRROR set (task 1002527)', () => {
+  const ctx = buildRedactionContext();
+  const file = (p, sql) => ({ path: p, buf: Buffer.from(sql, 'utf8') });
+  const publishableFiles = [
+    file('migrations/003_pms.sql', "CREATE TABLE a (s TEXT CHECK (s IN ('x', 'y')));\n"),
+    file('migrations/core_188_goal_visibility.sql', "CREATE TABLE b (s TEXT CHECK (s IN ('p', 'q')));\n"),
+    file('src/bongos/db.js', 'module.exports = {};\n'), // not a migration
+  ];
+  const report = proveLineage({ publishableFiles, privateMigrationNumbers: new Set([3, 188]), ctx });
+
+  // Both halves must agree: the private set (migrationNumbersFromPaths) and the mirror
+  // set (proveLineage) parse the SAME names, so a namespaced file is never a false
+  // "missing" divergence — the failure mode that would red-line the C9 gate.
+  assert.equal(report.counts.migrations, 2);
+  assert.deepEqual(report.numbering, { missing: [], extra: [], consistent: true });
+  assert.equal(report.nextMirror, 189);
+  assert.equal(report.nextPrivate, 189);
+});
+
+test('proveLineage still CATCHES a genuinely dropped namespaced core migration (task 1002527)', () => {
+  const ctx = buildRedactionContext();
+  const publishableFiles = [
+    { path: 'migrations/003_pms.sql', buf: Buffer.from('SELECT 1;\n', 'utf8') },
+  ];
+  // core_188 exists privately but never reached the mirror → a real divergence.
+  const report = proveLineage({ publishableFiles, privateMigrationNumbers: new Set([3, 188]), ctx });
+  assert.equal(report.numbering.consistent, false);
+  assert.deepEqual(report.numbering.missing, [188]);
 });
 
 test('parseEnumChecks extracts the quoted value-lists from CHECK (... IN (...))', () => {

package/tests/ship_publish_error.mjs

@@ -0,0 +1,119 @@
+// tests/ship_publish_error.mjs
+//
+// Unit tests for formatPublishFailure (scripts/gds/ship.js, task 1001916) — the
+// display string ciLandServer prints when POST /tasks/:id/publish-branch fails.
+//
+// Why this exists: the server has carried { step, reason } (the credential-
+// scrubbed git stderr) since task 1547, but ciLandServer printed only
+// `r.data.message || r.data.error`. On the ADR 0116 envelope that renders
+// "[object Object]", and on the legacy flat shape a bare "publish_failed" — so a
+// non-fast-forward rejection (the server had already freshened the branch) was
+// invisible and the builder retried blind for several laps. What we prove here:
+//   1. Both wire shapes resolve to the CODE, never "[object Object]".
+//   2. step + reason appear when the server sent them.
+//   3. A non-fast-forward reason carries the specific remedy hint (reset onto
+//      origin/<branch>, re-run the generators, re-ship) — and only then.
+// Pure: no network, no git, no fs.
+//
+// Run:  node tests/ship_publish_error.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const BRANCH = 'claude/task-1001916';
+const fmt = (data, status = 500, branch = BRANCH) => ship.formatPublishFailure(data, status, branch);
+
+// ---------- 1. bare error, no step/reason ----------
+
+test('legacy flat { error: code } with no details reads as the bare code', () => {
+  const out = fmt({ error: 'publish_failed' });
+  assert.match(out, /publish_failed/);
+  assert.ok(!/step:/.test(out), 'no step was sent, so none is invented');
+  assert.ok(!/reason:/.test(out), 'no reason was sent, so none is invented');
+});
+
+test('ADR 0116 envelope with no details resolves to the code, never [object Object]', () => {
+  const out = fmt({ error: { code: 'publish_failed', message: 'publish_failed' } });
+  assert.match(out, /publish_failed/);
+  assert.ok(!/\[object Object\]/.test(out), 'the envelope object must never be stringified raw');
+});
+
+test('no body at all falls back to the HTTP status', () => {
+  assert.match(fmt(null, 502), /HTTP 502/);
+});
+
+// ---------- 2. error + step + reason ----------
+
+test('envelope details carry step + reason into the message', () => {
+  const out = fmt({
+    error: {
+      code: 'publish_failed',
+      message: 'publish_failed',
+      details: { step: 'push', reason: 'remote: Permission to org/repo.git denied' },
+    },
+  });
+  assert.match(out, /publish_failed/);
+  assert.match(out, /step: push/);
+  assert.match(out, /Permission to org\/repo\.git denied/);
+});
+
+test('legacy flat top-level step + reason are surfaced the same way', () => {
+  const out = fmt({ error: 'publish_failed', step: 'fetch', reason: 'could not read Username' });
+  assert.match(out, /step: fetch/);
+  assert.match(out, /could not read Username/);
+});
+
+test('a non-git failure reason gets NO fast-forward remedy hint', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'Permission denied (publickey)' });
+  assert.ok(!/fast-forward/i.test(out), 'the remedy hint is for a stale-branch push only');
+  assert.ok(!/reset/i.test(out), 'nor the reset instruction');
+});
+
+// ---------- 3. the non-fast-forward remedy hint ----------
+
+const NON_FF_STDERR =
+  '! [rejected] claude/task-1001916 -> claude/task-1001916 (fetch first)\n' +
+  "error: failed to push some refs to 'github.com/org/repo.git'";
+
+test('a "fetch first" rejection names the branch and the reset-onto-origin remedy', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: NON_FF_STDERR });
+  assert.match(out, /step: push/);
+  assert.match(out, new RegExp(`origin/${BRANCH}`), 'points at the ref the server already moved');
+  assert.match(out, /reset/i, 'names the reset');
+  assert.match(out, /generator/i, 'and the regenerate step before re-shipping');
+  assert.match(out, /re-ship|fast-forward/i, 'and why: so the push fast-forwards');
+  assert.ok(!/\n/.test(out), 'multi-line git stderr is collapsed — this goes mid-sentence into one log line');
+});
+
+test('the "non-fast-forward" wording triggers the same hint through the envelope', () => {
+  const out = fmt({
+    error: {
+      code: 'publish_failed',
+      message: 'publish_failed',
+      details: { step: 'push', reason: 'Updates were rejected: non-fast-forward' },
+    },
+  });
+  assert.match(out, new RegExp(`origin/${BRANCH}`));
+  assert.match(out, /reset/i);
+});
+
+console.log('');
+console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/subdomain_auth.mjs

@@ -1,14 +1,46 @@
 // tests/subdomain_auth.mjs — the builders-subdomain auth helpers (#726).
 //
 // Locks down the two security-sensitive pure helpers added for the dedicated
-// builders.amazonprimea.com subdomain:
+// builders.<apex> subdomain:
 //   - safeReturnTo: the open-redirect guard on the post-sign-in return target.
 //   - sessionCookieDomainOpts: which hosts get an apex-scoped session cookie
 //     (so one sign-in spans the subdomains) vs a host-only one (localhost,
 //     staging — which must NOT bleed a token across environments).
 // Pure functions, no DB — requiring the route module does not open a pool.
+//
+// Both helpers derive their allowed hosts from the instance branding pack's
+// domains.cookieDomain, so the fixtures inject a SYNTHETIC pack (the
+// GDS_BRANDING_FILE seam, as tests/single_host_hall.mjs does) instead of
+// reading whatever config/branding.json happens to be on disk. That keeps the
+// assertions identical on every instance — the neutral core (cookieDomain "")
+// and a branded host alike. envPrefix is overridden too so an ambient
+// <PREFIX>_COOKIE_DOMAIN in the shell cannot reach the resolver.
+//
+// Run:  node tests/subdomain_auth.mjs
 
 import { createRequire } from 'node:module';
+import { writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// The apex every fixture below is built from. RFC 2606 reserved TLD — clearly
+// synthetic, never routable, and no host brand is baked into this file.
+const APEX = 'bongos-test.example';
+
+const brandDir = mkdtempSync(join(tmpdir(), 'cb-subdomain-auth-'));
+const brandFile = join(brandDir, 'branding.json');
+writeFileSync(brandFile, JSON.stringify({
+  envPrefix: 'SUBDOMAIN_AUTH_FIXTURE',
+  // Leading dot mirrors the real packs; configuredCookieApex() strips it.
+  domains: { cookieDomain: `.${APEX}`, publicOrigin: `https://${APEX}` },
+}));
+process.env.GDS_BRANDING_FILE = brandFile;
+// The pack is only read once (auth.js resolves COOKIE_APEX at module load);
+// remove the temp dir on every exit path so runs don't accumulate in tmpdir.
+process.on('exit', () => { try { rmSync(brandDir, { recursive: true, force: true }); } catch { /* best-effort */ } });
+
+// Required AFTER the pack is in place — auth.js resolves COOKIE_APEX at module
+// load, and branding() memoizes on its first call.
 const require = createRequire(import.meta.url);
 const authRoute = require('../src/bongos/routes/auth.js');
 
@@ -24,15 +56,15 @@ console.log('\nsafeReturnTo — accepts safe same-city targets:');
 ok(safeReturnTo('/builders') === '/builders', 'relative /builders');
 ok(safeReturnTo('/watch') === '/watch', 'relative /watch');
 ok(safeReturnTo('/builders/settings?x=1') === '/builders/settings?x=1', 'relative path with query');
-ok(safeReturnTo('https://builders.amazonprimea.com/watch') === 'https://builders.amazonprimea.com/watch', 'absolute builders subdomain');
-ok(safeReturnTo('https://amazonprimea.com/builders') === 'https://amazonprimea.com/builders', 'absolute apex');
-ok(safeReturnTo('https://status.amazonprimea.com/') === 'https://status.amazonprimea.com/', 'absolute status subdomain');
+ok(safeReturnTo(`https://builders.${APEX}/watch`) === `https://builders.${APEX}/watch`, 'absolute builders subdomain');
+ok(safeReturnTo(`https://${APEX}/builders`) === `https://${APEX}/builders`, 'absolute apex');
+ok(safeReturnTo(`https://status.${APEX}/`) === `https://status.${APEX}/`, 'absolute status subdomain');
 
 console.log('\nsafeReturnTo — rejects everything else (→ null, caller falls back):');
 ok(safeReturnTo('//evil.com') === null, 'protocol-relative //evil.com');
 ok(safeReturnTo('https://evil.com/builders') === null, 'foreign https origin');
-ok(safeReturnTo('https://amazonprimea.com.evil.com/') === null, 'lookalike suffix host');
-ok(safeReturnTo('http://amazonprimea.com/builders') === null, 'http (non-https) apex');
+ok(safeReturnTo(`https://${APEX}.evil.com/`) === null, 'lookalike suffix host');
+ok(safeReturnTo(`http://${APEX}/builders`) === null, 'http (non-https) apex');
 ok(safeReturnTo('javascript:alert(1)') === null, 'javascript: scheme');
 ok(safeReturnTo('/path\\with\\backslash') === null, 'backslash path');
 ok(safeReturnTo('') === null, 'empty');
@@ -43,15 +75,15 @@ ok(safeReturnTo('builders') === null, 'bare word (no leading slash, not a URL)')
 // ---- sessionCookieDomainOpts: cross-subdomain scoping ----------------------
 const reqWith = (host) => ({ headers: { host } });
 console.log('\nsessionCookieDomainOpts — apex-scoped on production hosts:');
-ok(sessionCookieDomainOpts(reqWith('amazonprimea.com')).domain === '.amazonprimea.com', 'apex → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('www.amazonprimea.com')).domain === '.amazonprimea.com', 'www → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('builders.amazonprimea.com')).domain === '.amazonprimea.com', 'builders → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('status.amazonprimea.com')).domain === '.amazonprimea.com', 'status → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('amazonprimea.com:3000')).domain === '.amazonprimea.com', 'apex with port');
+ok(sessionCookieDomainOpts(reqWith(APEX)).domain === `.${APEX}`, `apex → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`www.${APEX}`)).domain === `.${APEX}`, `www → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`builders.${APEX}`)).domain === `.${APEX}`, `builders → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`status.${APEX}`)).domain === `.${APEX}`, `status → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`${APEX}:3000`)).domain === `.${APEX}`, 'apex with port');
 
 console.log('\nsessionCookieDomainOpts — host-only elsewhere (no domain key):');
 ok(sessionCookieDomainOpts(reqWith('localhost:3000')).domain === undefined, 'localhost → host-only');
-ok(sessionCookieDomainOpts(reqWith('staging.amazonprimea.com')).domain === undefined, 'staging → host-only (no cross-env bleed)');
+ok(sessionCookieDomainOpts(reqWith(`staging.${APEX}`)).domain === undefined, 'staging → host-only (no cross-env bleed)');
 ok(sessionCookieDomainOpts(reqWith('127.0.0.1')).domain === undefined, 'raw IP → host-only');
 
 console.log(`\nSubdomain-auth tests: ${pass} passed, ${fail} failed`);