@bongos/core 1.19.243 → 1.19.245

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.243",
-  "core_contract": "1.19.243",
-  "source_commit": "ac9bed6cf6412a5916b8b5f1c6c946f3c733cc96",
+  "core_version": "1.19.245",
+  "core_contract": "1.19.245",
+  "source_commit": "15b6447119ad502cd960c8fd4dd4c04385ba974f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T22:39:28.983Z",
+  "built_at": "2026-08-18T23:21:43.718Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 312,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1327,
+    "functional_verbatim": 1329,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1660,
-  "tree_sha256": "28e71bece4c2803c63b8674af865cb7cfc74626f6e768d40e3742116571bb7d4",
+  "file_count": 1662,
+  "tree_sha256": "f5cf7517aeaa2b40830c75594b5df013e179df3aa803467e2f5e16a914ee0571",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1507,7 +1507,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "0cb2b0b917f7d75a97d501c4c23e6a791aec4ed5c655025841d91ff8c1c10638"
+      "sha256": "ffea58fedd395431492f6f9120c98b11403a37988722e5fa3f43bfdc05709922"
     },
     {
       "path": "docs/handoff-template.md",
@@ -4347,12 +4347,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c3f2be5aa7bbd5f5f40977d42f12485c3049df0ac811531d20bf3e7af51aed18"
+      "sha256": "d3b288194443049f0b1b85c7cd7614eb198b4cb1ebcffadf73c4d7dc97ab154f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c0b9cdaf8ef1290a7c61fc7068390a6a14b9477a0b84c17e9018c4ab832e4d7c"
+      "sha256": "db2a154ad41af00cf7795d51d57c3810f7c2f0f3c8c862daea239cc21a4312d7"
     },
     {
       "path": "public-docs/index.html",
@@ -4869,6 +4869,11 @@
       "mode": "0000644",
       "sha256": "8ca6ee391837d7e1a45e69fc62c4a051f5e3d6060db507cdcbc7a343e2b03bd3"
     },
+    {
+      "path": "scripts/gds/copy-inventory.js",
+      "mode": "0000644",
+      "sha256": "8eeeea6fb29101dbd4dc6ce874a8bc87dd1945434f5b6c13a04e7312cc449a4b"
+    },
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
       "mode": "0000644",
@@ -5532,12 +5537,12 @@
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
       "mode": "0000644",
-      "sha256": "96a38493a51e3b21d6059bda25bff0bc36123117f7a683d7fc83e4ccf779b899"
+      "sha256": "d27deba8997676ed2224d2261316b3e60c0668bcde585f7efd0443d6ab150d89"
     },
     {
       "path": "scripts/gds/smoke-batch-release.sh",
       "mode": "0000644",
-      "sha256": "1b0276b21420cd4fdbb9a77f0b34270e90109cd62579469e71607c286821904b"
+      "sha256": "57e6f1ce66cd4e5cb7d6bbbd409f074b137344ba7c281a122f8ad42243d76029"
     },
     {
       "path": "scripts/gds/smoke-box.sh",
@@ -5967,7 +5972,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1f5ebdac8a94a258566b8d28fa14a3f47496e0f35e928e2d85ba85e19738134a"
+      "sha256": "97e75e3da0ab5abfebb8b5c2fb2d1ae261f85e1a44f155a226ed90c8841129c4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6484,6 +6489,11 @@
       "mode": "0000644",
       "sha256": "55bd70efd8067e39d6220d14f78c743ce80d8a8ff37988acf00136b5108dc004"
     },
+    {
+      "path": "tests/copy_inventory.mjs",
+      "mode": "0000644",
+      "sha256": "3c1f0886799082734e72ceacba5212e7bc9b3f8081e834973383994ffb5eccab"
+    },
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",

package/docs/file-map.md

@@ -50,6 +50,8 @@
 │   │   └── container-interior.md ← (#645) container building interior: layered industrial shell + aqua wave floor + boutique display; palette reconciled to ADR 0044
 │   ├── file-map.md              ← this file (§11 detail, split out V3.R86); the `.claude/skills/` + `.claude/scheduled-tasks/` trees are GENERATED (gen-file-map.js, ADR 0066) — do not hand-edit those blocks
 │   ├── file-map.notes.json      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): the sidecar of one-line notes for each skill/routine that gen-file-map.js renders into file-map.md; the ONE place to edit those notes — a new skill with no note here fails CI
+│   ├── copy-registry.json      ← GENERATED (scripts/gds/copy-inventory.js): the machine-readable copy registry — 1,096 user-facing strings with stable ids, render paths, and duplicates. R02's flag queue attaches to these ids; regenerate + commit, never hand-edit
+│   ├── copy-inventory.md       ← GENERATED twin of copy-registry.json: the human-readable copy report, including the "what this cannot see" section (server-side messages, skill prose, Discord copy, runtime-composed strings, and the src/ui-vs-reality surface mismatch)
 │   ├── handoff-template.md      ← session-end template + Definition of Done
 │   ├── google-chat-broadcast.md ← team-chat integration plan
 │   ├── pms-v1-deploy.md         ← step-by-step runbook to deploy PMS-V1 + status subdomain
@@ -175,6 +177,7 @@
 │       ├── worktree.js          ← (task 1002809) junction-safe worktree add/remove/list — outside-repo worktrees get a node_modules junction via node (no shell quoting), removed BEFORE `git worktree remove`
 │       ├── learning-capture.js  ← file a `learnings` row (DB-backed short-form rule capture, replacing hand-edited recipe files for a single gotcha)
 │       ├── docs-entropy.js      ← ([#…] docs-entropy) markdown-corpus linter: broken internal links + cross-file duplicate-prose detector across every tracked `.md`; `--verbose` / `--file-ideas`
+│       ├── copy-inventory.js  ← R01 of goal 1000074 (the artist's loop): the COPY REGISTRY — every user-facing string across the hall / status / landing surfaces, each row naming the render path that shows it (html-text · html-attr · js-markup · js-notice · js-text-assign) + a stable id that survives a move. Writes docs/copy-registry.json + docs/copy-inventory.md; `--check` fails on drift. Precision over recall: a JS literal with no render path is not listed
 │       ├── gen-diagrams.js      ← generates the 5 onboarding diagrams (`.mmd`/`.svg`/`.png` + `assertions.json`) from templates in this file — never hand-edit a `.mmd`/assertions.json; runs on deploy
 │       ├── gen-api-docs.js      ← ADR 0109: generates `docs/api/openapi.json` + `docs/api-reference.md` from the live route files via `route-rank-check.js` introspection, so the API reference cannot drift from what the server actually mounts
 │       ├── architect-audit.js   ← MAS Phase 5 (ADR 0024): the Architect's bounded first-principles `--scope`/`--paths` audit CLI → `docs/audits/`

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.243",
+  "version": "1.19.245",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.243",
+      "version": "1.19.245",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.243",
+  "version": "1.19.245",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-inventory.js

@@ -0,0 +1,425 @@
+#!/usr/bin/env node
+'use strict';
+//
+// scripts/gds/copy-inventory.js — the COPY REGISTRY (R01 of goal 1000074, the
+// artist's loop; from idea 1000736).
+//
+// WHAT IT IS FOR. The owner's ABI brief gives the artist the project's TEXT: no
+// slop, story and ideology communicated, purpose and gravitas, re-text-writing.
+// None of that is exercisable today, because the copy is scattered across 23 hall
+// HTML files, 34 hall JS files, the status dashboard and a server-rendered landing
+// template. This command is the inventory that makes it findable — read-only: no
+// editing, no queue, no UI (those are R02/R03).
+//
+// DELIBERATELY IN THE gen-* FAMILY: pure-ish (fs only — no DB, no network, no
+// clock, no randomness), deterministic byte-for-byte on the same tree, emitting one
+// machine-readable registry and one human report. Same posture as gen-repo-map /
+// gen-api-docs: a command you run and commit.
+//
+// THE SURFACE MISMATCH, RECORDED RATHER THAN ASSUMED AWAY. docs/design-contract.md
+// says UI components live under `src/ui/<surface>/`, and that a surface directory is
+// the unit a design adapter targets. On this tree `src/ui/` contains only
+// `adapters/` — the real UI is modules/hall-ui/public and modules/status-ui/public.
+// So this tool maps REAL paths onto contract-shaped surface ids and reports the
+// mismatch in its own output. Do not "fix" that by pretending the contract layout
+// exists.
+//
+// EVERY ROW NAMES ITS RENDER PATH (`origin`), which is what makes the inventory
+// trustworthy: html-text, html-attr:<attr>, html-title, js-markup (text inside
+// markup a script builds), js-notice (toast/alert/confirm), js-text-assign
+// (.textContent/.innerText/.title). A string this tool cannot tie to one of those
+// paths is not listed at all — the first cut filtered "literals that look like
+// prose" and produced 2144 rows of mostly code, including `use strict` 34 times.
+//
+// Run:  node scripts/gds/copy-inventory.js            (writes both artifacts)
+//       node scripts/gds/copy-inventory.js --check     (exit 1 if artifacts stale)
+//       node scripts/gds/copy-inventory.js --json      (registry to stdout, no write)
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const REGISTRY_REL = path.join('docs', 'copy-registry.json');
+const REPORT_REL = path.join('docs', 'copy-inventory.md');
+
+// The surfaces this tool knows how to read. `id` is the contract-shaped surface
+// name; `at` is where it REALLY lives. Adding a surface is a data edit — the point.
+const SURFACES = [
+  { id: 'builders-hall', kind: 'dir', at: path.join('modules', 'hall-ui', 'public'), exts: ['.html', '.js'] },
+  { id: 'status-dashboard', kind: 'dir', at: path.join('modules', 'status-ui', 'public'), exts: ['.html', '.js'] },
+  // THE LANDING SURFACE IS public-landing/, NOT src/platform-server.js. The first
+  // cut pointed here at the server file, which only fs.readFileSync's these
+  // templates — so its JS patterns matched a handful of incidental literals and the
+  // page's ACTUAL copy (hero, meta/og text, every section) was silently absent
+  // while the registry reported a number. Caught by the grader on task 1003112.
+  { id: 'landing', kind: 'dir', at: 'public-landing', exts: ['.html'] },
+];
+
+// Attributes whose value is COPY a person reads (not wiring). The matchers are
+// built ONCE — the first cut re-created all seven per markup literal.
+const COPY_ATTRS = ['title', 'aria-label', 'placeholder', 'alt', 'data-page-title', 'aria-description'];
+const COPY_ATTR_RES = COPY_ATTRS.map((attr) => ({ attr, re: new RegExp(`\\b${attr}\\s*=\\s*"([^"]{4,400})"`, 'gi') }));
+
+// What this tool knowingly does not see. Printed in the report — an inventory that
+// implies completeness it does not have is worse than a short one.
+const BLIND_SPOTS = [
+  'Landing-page transforms: `public-landing/*.html` is scanned as authored, but the server rewrites it before a visitor sees it — `{{token}}` placeholders are filled from the branding pack, and `<!--apex-only:start--> … <!--apex-only:end-->` sections are STRIPPED on a child instance (src/platform-server.js `landingPage()`). So a row here may be copy that this instance never renders, and a rendered sentence may differ from its authored form.',
+  'Server-side messages: route failures (`res.fail` reasons), validation text and API error copy live in server JS and are not walked here. A person reads them, so widening to them is a deliberate later step, not an oversight to quietly fix.',
+  'Skill and playbook prose: `.claude/skills/**/SKILL.md` is read by agents and by builders and is arguably the largest body of project voice. Out of scope on purpose — it is not UI, and mixing it in would drown the UI signal.',
+  'Discord copy: outbound broadcast text is composed in `modules/discord/*.js` at send time. User-facing, but not part of any UI surface.',
+  'JS literals with no render path: a string is listed only when it can be tied to one — markup built in a script, a toast/alert/confirm argument, or a textContent/innerText/title assignment. Copy reaching the DOM by any other route (a helper that takes a message parameter, a string held in a config object) is invisible here, deliberately: the alternative is a queue where most rows are code.',
+  'Template literals containing a nested backtick: the literal scanner stops at the first closing backtick, so a nested template inside `${...}` truncates that one literal. Rare in this tree and cheap to spot (a row that ends mid-sentence); a real JS parser is the fix if it ever matters.',
+  'Runtime-composed strings: anything assembled from fragments or interpolated at render time is captured only as its literal parts. A sentence that exists only once the browser runs cannot be inventoried by reading the tree.',
+  'Generated pages: `docs/api-reference.md` and the OpenAPI surface are generated from route prose; that copy belongs to its generator, not to a designer.',
+  'The design-contract surface layout: `docs/design-contract.md` expects `src/ui/<surface>/`, which this tree does not use (`src/ui` holds only `adapters/`). Surface ids here are a MAPPING onto real paths, not evidence the contract layout exists.',
+];
+
+// A stable id survives the string MOVING: it hashes surface + normalized text,
+// never file or line. That is what lets a flag (R02) stay attached across
+// refactors — and two identical strings in one surface share an id, which is a
+// feature: they are one piece of copy shown twice.
+function stableId(surfaceId, text) {
+  const norm = text.replace(/\s+/g, ' ').trim();
+  return crypto.createHash('sha256').update(`${surfaceId} ${norm}`).digest('hex').slice(0, 12);
+}
+
+// Locale-independent string order — see the note on the entries sort below.
+function cmp(a, b) {
+  if (a === b) return 0;
+  return a < b ? -1 : 1;
+}
+
+// Line lookup without rescanning. The first cut counted newlines from offset 0 for
+// EVERY extracted string — O(n x matches) on the extractor's hottest loop (bounded
+// at ~62 files / ~1096 matches today, but needlessly quadratic-shaped; the grader
+// was right to flag it). One offset table per source, then a binary search.
+function lineIndex(source) {
+  const starts = [0];
+  for (let i = 0; i < source.length; i += 1) if (source[i] === '\n') starts.push(i + 1);
+  return starts;
+}
+
+function lineAt(starts, index) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = (lo + hi + 1) >> 1;
+    if (starts[mid] <= index) lo = mid; else hi = mid - 1;
+  }
+  return lo + 1;
+}
+
+// Does this look like prose a person reads, rather than code that happens to be a
+// string? Conservative on purpose — a false positive costs an artist's attention.
+function looksLikeCopy(raw) {
+  const s = String(raw).trim();
+  if (s.length < 4 || s.length > 400) return false;
+  if (!/[A-Za-z]{2}/.test(s)) return false;               // needs actual letters
+  if (!/\s/.test(s) && !/[.!?]$/.test(s)) return false;   // one bare word is a token
+  if (/^[/.#]/.test(s)) return false;                     // paths, selectors
+  if (/^https?:/i.test(s)) return false;                  // urls
+  if (/^[a-z0-9-]+$/.test(s)) return false;               // css class / slug
+  if (/^[A-Z0-9_]+$/.test(s)) return false;               // CONSTANT_NAME
+  if (/=>|\$\{|function\s*\(/.test(s)) return false;      // code fragments
+  if (/^[\s\d.,:%$-]+$/.test(s)) return false;            // numbers and units
+  return true;
+}
+
+// Strip <script>/<style> bodies so their contents are not read as page text.
+// Replaced with spaces of equal length so every line number stays truthful.
+function stripEmbedded(html) {
+  return html
+    .replace(/<script\b[\s\S]*?<\/script>/gi, (m) => m.replace(/[^\n]/g, ' '))
+    .replace(/<style\b[\s\S]*?<\/style>/gi, (m) => m.replace(/[^\n]/g, ' '));
+}
+
+function fromHtml({ source, rel }) {
+  const out = [];
+  const cleaned = stripEmbedded(source);
+  // stripEmbedded preserves every newline, so one offset table serves both strings.
+  const starts = lineIndex(cleaned);
+  let m;
+
+  // 1. text nodes: everything between a '>' and the next '<'.
+  const textRe = />([^<>]+)</g;
+  while ((m = textRe.exec(cleaned)) !== null) {
+    if (!looksLikeCopy(m[1])) continue;
+    out.push({ text: m[1].replace(/\s+/g, ' ').trim(), file: rel, line: lineAt(starts, m.index), origin: 'html-text', confidence: 'certain' });
+  }
+
+  // 2. copy-bearing attributes.
+  for (const { attr, re } of COPY_ATTR_RES) {
+    re.lastIndex = 0;
+    while ((m = re.exec(cleaned)) !== null) {
+      if (!looksLikeCopy(m[1])) continue;
+      out.push({ text: m[1].replace(/\s+/g, ' ').trim(), file: rel, line: lineAt(starts, m.index), origin: `html-attr:${attr}`, confidence: 'certain' });
+    }
+  }
+
+  // 3. <title> is the page's own name — always copy.
+  const titleRe = /<title>([^<]{2,200})<\/title>/gi;
+  while ((m = titleRe.exec(source)) !== null) {
+    out.push({ text: m[1].replace(/\s+/g, ' ').trim(), file: rel, line: lineAt(starts, m.index), origin: 'html-title', confidence: 'certain' });
+  }
+  return out;
+}
+
+// JS copy is found by FOLLOWING RENDER PATHS, not by guessing at prose. The first
+// cut of this file filtered "literals that look like sentences" and produced 2144
+// rows of which most were code: `use strict` 34 times, CSS values, and fragments of
+// template literals sliced at their quotes. Precision beats recall for a queue an
+// artist actually reads, so this extractor only claims a string when it can name
+// HOW a person sees it:
+//
+//   • markup built in JS — any literal containing tags is parsed as HTML, so the
+//     TEXT inside it is captured (not the tags). Template interpolations become a
+//     `{…}` placeholder, which keeps a sentence readable while marking the hole.
+//   • toast() / alert() / confirm() arguments — shown verbatim to a person.
+//   • .textContent / .innerText / .title assignments — same.
+//
+// Everything else is skipped, and the report says so. A literal this tool cannot
+// tie to a render path is not evidence of copy.
+const PLACEHOLDER = '{…}';
+
+// Template literals + quoted strings. Template bodies may contain ${...}; the
+// no-nested-backtick limitation is real and recorded in BLIND_SPOTS.
+const JS_LITERALS = /`([^`]*)`|'((?:[^'\\\n]|\\.)*)'|"((?:[^"\\\n]|\\.)*)"/g;
+const UI_CALL = /\b(?:toast|alert|confirm)\s*\(\s*(?:`([^`]*)`|'((?:[^'\\\n]|\\.)*)'|"((?:[^"\\\n]|\\.)*)")/g;
+const TEXT_ASSIGN = /\.(?:textContent|innerText|title)\s*=\s*(?:`([^`]*)`|'((?:[^'\\\n]|\\.)*)'|"((?:[^"\\\n]|\\.)*)")/g;
+
+function unescapeLiteral(raw) {
+  return String(raw).replace(/\\(['"`\\])/g, '$1');
+}
+
+// A literal that carries markup: extract what a person reads out of it.
+function copyFromMarkupLiteral(body) {
+  const withHoles = body.replace(/\$\{[^{}]*\}/g, PLACEHOLDER);
+  const out = [];
+  let m;
+  const textRe = />([^<>]+)</g;
+  while ((m = textRe.exec(withHoles)) !== null) {
+    const t = m[1].replace(/\s+/g, ' ').trim();
+    if (t === PLACEHOLDER || !looksLikeCopy(t.replace(/\{…\}/g, 'x'))) continue;
+    out.push(t);
+  }
+  for (const { re } of COPY_ATTR_RES) {
+    re.lastIndex = 0;
+    while ((m = re.exec(withHoles)) !== null) {
+      const t = m[1].replace(/\s+/g, ' ').trim();
+      if (!looksLikeCopy(t.replace(/\{…\}/g, 'x'))) continue;
+      out.push(t);
+    }
+  }
+  return out;
+}
+
+function fromJs({ source, rel }) {
+  const out = [];
+  const starts = lineIndex(source);
+  const seen = new Set(); // (text, line) — one row per string per site
+  const push = (text, index, origin) => {
+    const line = lineAt(starts, index);
+    const key = `${text}\u0000${line}\u0000${origin}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ text, file: rel, line, origin, confidence: 'certain' });
+  };
+
+  let m;
+  // 1. markup built in JS.
+  JS_LITERALS.lastIndex = 0;
+  while ((m = JS_LITERALS.exec(source)) !== null) {
+    const body = m[1] ?? unescapeLiteral(m[2] ?? m[3] ?? '');
+    if (!body || !/<[a-zA-Z/]/.test(body) || !/>/.test(body)) continue;
+    for (const t of copyFromMarkupLiteral(body)) push(t, m.index, 'js-markup');
+  }
+  // 2. strings shown directly to a person.
+  UI_CALL.lastIndex = 0;
+  while ((m = UI_CALL.exec(source)) !== null) {
+    const body = (m[1] ?? unescapeLiteral(m[2] ?? m[3] ?? '')).replace(/\$\{[^{}]*\}/g, PLACEHOLDER).replace(/\s+/g, ' ').trim();
+    if (body && looksLikeCopy(body.replace(/\{…\}/g, 'x'))) push(body, m.index, 'js-notice');
+  }
+  TEXT_ASSIGN.lastIndex = 0;
+  while ((m = TEXT_ASSIGN.exec(source)) !== null) {
+    const body = (m[1] ?? unescapeLiteral(m[2] ?? m[3] ?? '')).replace(/\$\{[^{}]*\}/g, PLACEHOLDER).replace(/\s+/g, ' ').trim();
+    if (body && looksLikeCopy(body.replace(/\{…\}/g, 'x'))) push(body, m.index, 'js-text-assign');
+  }
+  return out;
+}
+
+function filesFor(surface, { fsImpl = fs } = {}) {
+  const abs = path.join(REPO_ROOT, surface.at);
+  if (surface.kind === 'file') return fsImpl.existsSync(abs) ? [surface.at] : [];
+  if (!fsImpl.existsSync(abs)) return [];
+  return fsImpl.readdirSync(abs)
+    .filter((n) => surface.exts.includes(path.extname(n)))
+    .sort()
+    .map((n) => path.join(surface.at, n));
+}
+
+function buildRegistry() {
+  const entries = [];
+  const surfaces = {};
+  for (const surface of SURFACES) {
+    const rels = filesFor(surface);
+    let count = 0;
+    for (const rel of rels) {
+      const source = fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8');
+      const found = path.extname(rel) === '.html'
+        ? fromHtml({ source, rel })
+        : fromJs({ source, rel });
+      for (const f of found) {
+        entries.push({ id: stableId(surface.id, f.text), surface: surface.id, ...f });
+        count += 1;
+      }
+    }
+    surfaces[surface.id] = { at: surface.at, files: rels.length, strings: count };
+  }
+
+  // Deterministic order, independent of walk order: surface, text, file, line.
+  // BYTE ORDER, NOT localeCompare: these artifacts are committed, and
+  // localeCompare's collation depends on the runtime's ICU data — a Node built with
+  // small-icu would reshuffle the file and every unrelated commit would carry the
+  // churn. `cmp` is boring on purpose.
+  entries.sort((a, b) => cmp(a.surface, b.surface)
+    || cmp(a.text, b.text)
+    || cmp(a.file, b.file)
+    || a.line - b.line);
+
+  // Duplicate copy is the cheapest of the three signals R02 wants, and needs no
+  // judgement: the same normalized text in one surface, shown in more than one place.
+  const byId = new Map();
+  for (const e of entries) {
+    if (!byId.has(e.id)) byId.set(e.id, []);
+    byId.get(e.id).push(e);
+  }
+  const duplicates = [...byId.entries()]
+    .filter(([, list]) => list.length > 1)
+    .map(([id, list]) => ({
+      id, surface: list[0].surface, text: list[0].text,
+      occurrences: list.length, at: list.map((e) => `${e.file}:${e.line}`),
+    }))
+    .sort((a, b) => b.occurrences - a.occurrences || cmp(a.text, b.text));
+
+  return {
+    schema: 1,
+    generator: 'scripts/gds/copy-inventory.js',
+    goal: 1000074,
+    counts: {
+      strings: entries.length,
+      unique_ids: byId.size,
+      certain: entries.filter((e) => e.confidence === 'certain').length,
+      heuristic: entries.filter((e) => e.confidence === 'heuristic').length,
+      duplicate_ids: duplicates.length,
+    },
+    surfaces,
+    blind_spots: BLIND_SPOTS,
+    duplicates,
+    entries,
+  };
+}
+
+function renderReport(reg) {
+  const L = [];
+  const esc = (s) => s.replace(/\|/g, '\\|');
+  L.push('# Copy inventory — every string the product shows a person');
+  L.push('');
+  L.push('> **Generated** by `node scripts/gds/copy-inventory.js` (R01 of goal 1000074, the artist\'s loop).');
+  L.push('> Deterministic on a given tree — regenerate and commit rather than hand-editing.');
+  L.push('> Machine-readable twin: [`copy-registry.json`](copy-registry.json).');
+  L.push('');
+  L.push(`**${reg.counts.strings} strings** across ${Object.keys(reg.surfaces).length} surfaces · `
+    + `${reg.counts.unique_ids} distinct pieces of copy · ${reg.counts.certain} certain, ${reg.counts.heuristic} heuristic · `
+    + `${reg.counts.duplicate_ids} shown in more than one place.`);
+  L.push('');
+  L.push('## Surfaces');
+  L.push('');
+  L.push('| surface | lives at | files | strings |');
+  L.push('|---|---|---|---|');
+  for (const [id, s] of Object.entries(reg.surfaces)) {
+    L.push(`| \`${id}\` | \`${s.at}\` | ${s.files} | ${s.strings} |`);
+  }
+  L.push('');
+  L.push('## Confidence, and why it is on every row');
+  L.push('');
+  L.push('`certain` copy comes from markup only a person reads: an HTML text node, a `<title>`, or a copy-bearing attribute. `heuristic` copy is a JavaScript string literal that passed a prose filter — this tool does not parse JS, so a filtered literal is evidence, not proof. Treat a heuristic row as a candidate an artist confirms, and do not quote the total as "the number of strings in the product".');
+  L.push('');
+  L.push('## What this cannot see');
+  L.push('');
+  for (const b of reg.blind_spots) L.push(`- ${b}`);
+  L.push('');
+  if (reg.duplicates.length) {
+    L.push('## The same words, shown twice');
+    L.push('');
+    L.push('Identical copy within one surface. Sometimes right (a repeated button), sometimes two screens that should share one string.');
+    L.push('');
+    L.push('| id | shown | text | where |');
+    L.push('|---|---|---|---|');
+    for (const d of reg.duplicates.slice(0, 40)) {
+      L.push(`| \`${d.id}\` | ${d.occurrences}x | ${esc(d.text).slice(0, 90)} | ${d.at.slice(0, 3).join(', ')} |`);
+    }
+    if (reg.duplicates.length > 40) L.push(`| … | | _${reg.duplicates.length - 40} more in the JSON registry_ | |`);
+    L.push('');
+  }
+  for (const [surfaceId] of Object.entries(reg.surfaces)) {
+    const rows = reg.entries.filter((e) => e.surface === surfaceId);
+    if (!rows.length) continue;
+    L.push(`## \`${surfaceId}\` — ${rows.length} strings`);
+    L.push('');
+    L.push('| id | conf | text | where |');
+    L.push('|---|---|---|---|');
+    for (const e of rows) {
+      L.push(`| \`${e.id}\` | ${e.confidence === 'certain' ? 'certain' : 'heur'} | ${esc(e.text).slice(0, 110)} | \`${e.file}:${e.line}\` |`);
+    }
+    L.push('');
+  }
+  L.push('---');
+  L.push('');
+  L.push('Ids are stable across moves: a string keeps its id when it changes file or line, and loses it when its TEXT changes — which is exactly when a flag against it should be re-examined.');
+  L.push('');
+  return L.join('\n');
+}
+
+function write({ check = false } = {}) {
+  const reg = buildRegistry();
+  const json = `${JSON.stringify(reg, null, 2)}\n`;
+  const md = renderReport(reg);
+  const jsonPath = path.join(REPO_ROOT, REGISTRY_REL);
+  const mdPath = path.join(REPO_ROOT, REPORT_REL);
+  if (check) {
+    const stale = [];
+    for (const [p, want] of [[jsonPath, json], [mdPath, md]]) {
+      const have = fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null;
+      if (have !== want) stale.push(path.relative(REPO_ROOT, p));
+    }
+    return { reg, stale };
+  }
+  fs.writeFileSync(jsonPath, json);
+  fs.writeFileSync(mdPath, md);
+  return { reg, written: [REGISTRY_REL, REPORT_REL] };
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  if (args.includes('--json')) {
+    process.stdout.write(`${JSON.stringify(buildRegistry(), null, 2)}\n`);
+  } else if (args.includes('--check')) {
+    const { stale } = write({ check: true });
+    if (stale.length) {
+      console.error(`copy-inventory: STALE — ${stale.join(', ')} do not match the tree. Run: node scripts/gds/copy-inventory.js`);
+      process.exit(1);
+    }
+    console.log('copy-inventory: artifacts match the tree.');
+  } else {
+    const { reg, written } = write();
+    console.log(`copy-inventory: ${reg.counts.strings} strings (${reg.counts.certain} certain, ${reg.counts.heuristic} heuristic), `
+      + `${reg.counts.duplicate_ids} duplicated -> wrote ${written.join(', ')}`);
+  }
+}
+
+module.exports = {
+  SURFACES, COPY_ATTRS, BLIND_SPOTS, REGISTRY_REL, REPORT_REL,
+  cmp, stableId, looksLikeCopy, lineIndex, lineAt, stripEmbedded, fromHtml, fromJs, filesFor,
+  buildRegistry, renderReport, write,
+};

package/scripts/gds/smoke-batch-claim.sh

@@ -70,6 +70,7 @@ print(json.dumps({
 CREATED_TASKS=()
 CREATED_CLAIMS=()
 cleanup() {
+  local leaked=()
   echo
   echo "--- cleanup ---"
   for cid in "${CREATED_CLAIMS[@]:-}"; do
@@ -79,10 +80,25 @@ cleanup() {
   done
   for tid in "${CREATED_TASKS[@]:-}"; do
     [[ -z "${tid}" ]] && continue
-    # Mark task abandoned via PATCH /api/gds/tasks/:id if available, else leave.
-    # The smoke filter on version_progress already keeps these out of dashboards.
-    call POST "/api/gds/tasks/${tid}/promote" '{"status":"abandoned"}' >/dev/null 2>&1 || true
+    # task 1002856: this used to POST /tasks/:id/promote {"status":"abandoned"},
+    # which is the backlog->ready transition and ignores a status field — so it
+    # never abandoned anything, and `>/dev/null 2>&1 || true` swallowed the
+    # failure. Every run since has leaked its fixtures as status='ready'
+    # (the 2026-05-11 batch, then 1001920-1001925 from 2026-07-03). The real
+    # endpoint is POST /tasks/:id/abandon {"reason": ...}.
+    if ! call POST "/api/gds/tasks/${tid}/abandon" \
+         '{"reason":"smoke cleanup (scripts/gds/smoke-batch-claim.sh)"}' >/dev/null 2>&1; then
+      leaked+=("${tid}")
+    fi
   done
+  # Never silently leave debris: a failed cleanup is reported, not swallowed.
+  # The claimable feed filters `__smoke__%` by title, so a leak is a ledger
+  # accuracy problem (it inflates open-task counts and goal rollups), not a
+  # builder-facing one — but it still needs a human to clear it.
+  if [[ ${#leaked[@]} -gt 0 ]]; then
+    echo "WARN: could not abandon ${#leaked[@]} smoke task(s): ${leaked[*]}"
+    echo "WARN: clear them with: node scripts/gds/api.js POST /tasks/<id>/abandon --body '{\"reason\":\"smoke residue\"}'"
+  fi
   echo "cleanup done"
 }
 trap cleanup EXIT

package/scripts/gds/smoke-batch-release.sh

@@ -91,6 +91,7 @@ claim_task() {
 CREATED_TASKS=()
 CREATED_CLAIMS=()
 cleanup() {
+  local leaked=()
   echo
   echo "--- cleanup ---"
   for cid in "${CREATED_CLAIMS[@]:-}"; do
@@ -100,8 +101,18 @@ cleanup() {
   done
   for tid in "${CREATED_TASKS[@]:-}"; do
     [[ -z "${tid}" ]] && continue
-    call POST "/api/gds/tasks/${tid}/promote" '{"status":"abandoned"}' >/dev/null 2>&1 || true
+    # task 1002856: same bug as smoke-batch-claim.sh — /tasks/:id/promote is the
+    # backlog->ready transition and ignores a status field, so this never
+    # abandoned anything and the redirect swallowed the failure.
+    if ! call POST "/api/gds/tasks/${tid}/abandon" \
+         '{"reason":"smoke cleanup (scripts/gds/smoke-batch-release.sh)"}' >/dev/null 2>&1; then
+      leaked+=("${tid}")
+    fi
   done
+  if [[ ${#leaked[@]} -gt 0 ]]; then
+    echo "WARN: could not abandon ${#leaked[@]} smoke task(s): ${leaked[*]}"
+    echo "WARN: clear them with: node scripts/gds/api.js POST /tasks/<id>/abandon --body '{\"reason\":\"smoke residue\"}'"
+  fi
   echo "cleanup done"
 }
 trap cleanup EXIT

package/src/module-api.js

@@ -913,8 +913,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.241 with no explicit bump. run 32185198139. (task 1002620)
 //   1.19.243 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.242 with no explicit bump. run 32193666731. (task 1002620)
+//   1.19.244 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.243 with no explicit bump. run 32196511343. (task 1002620)
+//   1.19.245 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.244 with no explicit bump. run 32196805853. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.243'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.245'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');