@bongos/core 1.19.26 → 1.19.28

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.26",
-  "core_contract": "1.19.26",
-  "source_commit": "522fdcf67202b1961ce21cc5bb1e9e21f3455105",
+  "core_version": "1.19.28",
+  "core_contract": "1.19.28",
+  "source_commit": "10e31a3212982a5385e83bec33a5ba12b733929f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T13:25:13.567Z",
+  "built_at": "2026-08-11T14:01:24.503Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1511,
-  "tree_sha256": "ecaa7b2c50ea700a1da02925b30bc638ccef3e362d27f47a50c59957afc232be",
+  "tree_sha256": "e1dee62e1e6e30b75671474f69e5e6b97f0ea598c9a66b5ad49867906f85e51d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2882,7 +2882,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "a08e9c017a07bffa311a9de6df007c30d9f3766c86d0ce2ec88660fed60d37aa"
+      "sha256": "bc2b580d2be98f5b2acb9a0dd9416dd3c2cad387bbe61a6823e37102d3468675"
     },
     {
       "path": "modules/grading/module.json",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "c8f356746096a6fe39e456b12367d29b6bbf4e39df1515c09144c95e239f1b49"
+      "sha256": "60b9338ed47d01e9f38fe3fa9f2f2cde6ff241b8e47efcb8fcf4c4f19d32c766"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3457,7 +3457,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "f5041a43ea0a74bc6b16f8ceb6490c70090e7959e66f137c92040ee842db1ec0"
+      "sha256": "aa179ab79508a002e8f580fb839767d8aaa8b6f02a46d021bb61633dd9f8f9a4"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "08c0827545637895b730387d92d4a0ce7fef7b055a966cb88ab70e6be901880c"
+      "sha256": "8ecf54691f56a0579f3d732323aebbe9620b3b46fa6f8711a959f20dac1cffaa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1ac1c894e7f11d5502855775e3f2ca37031927a68ec7e8dca447661b872467e5"
+      "sha256": "d7dcf7da61008463a0e5ddb5da440f85bd845a2a0ea8d8125c2684dad24cdac6"
     },
     {
       "path": "public-docs/index.html",
@@ -5042,7 +5042,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "85712b5cd1e20a2d84646b117cbaadf0ee4903f278ca904eb863da4612ee937b"
+      "sha256": "7f0ad4e54c0e5c251f00c78c7a6065d4a8db7bc88f0492c75bc63f8929108203"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "39b05d86d4fbb1035769ff0c30a97b21c75eea8ee145a25784789d17fb20aa38"
+      "sha256": "b97afd8c79d048c057170fb03010be8d89f051cc8d4c43a2ecb85343785fe194"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6357,7 +6357,7 @@
     {
       "path": "tests/gate_approvals.mjs",
       "mode": "0000644",
-      "sha256": "900923ab39dee11de4c59ec977555346aa52ba875d12e2b4ca27013bf99e51c2"
+      "sha256": "df503f198853f6fe3497a2e0317d90bee69cc275f024027ad569ee1cef0155b6"
     },
     {
       "path": "tests/gate_review.mjs",
@@ -6587,7 +6587,7 @@
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",
-      "sha256": "c650bd3c79d469f3ffb1cdada6f23521dd09c97844affd5b9e7f340d1796daa6"
+      "sha256": "b0af74bc3b3e203716b13fbf3fc174a90f51daf659d5c5e5400725e85a0da4fc"
     },
     {
       "path": "tests/grade_unavailable_display.mjs",

package/modules/grading/grader.js

@@ -645,6 +645,37 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
     if (clientPassed) downgradeTo = 'fail';
   }
 
+  // --- Guard 1b: vacuous permission-path input (task 1002646 / report 1000021 G-1) ---
+  // The pre-pass above pairs the SERVER-known rank with CLIENT-supplied
+  // committed_files, so omitting the list (or sending []) made the sub-floor
+  // protected-path check pass VACUOUSLY — zero files, zero hits, hardFail:false —
+  // a trusted-rank check applied to an untrusted, omittable diff. The server
+  // still cannot re-derive the feature-branch diff at grade time (boundary note
+  // above; the task-1002645 published tip is recorded at ci-land, AFTER the
+  // grade), but it can refuse to treat "no input" as "no hits": a caller below
+  // the registry's lowest floor submitting NO file list makes the check
+  // UNPROVABLE → fail closed. Honest ships are unaffected (ship.js always sends
+  // the real committed list — task 878 — and a floor-clearing rank never enters
+  // this branch). The dishonest-LIST case (a sub-floor caller sending an
+  // innocuous list while touching protected paths) stays owned by gate-review CI
+  // + the post-push main audit, which read the REAL diff. Unknown rank keeps
+  // failing open at this layer (isBelowFloor → false) — the main audit reads the
+  // real author rank from the DB and owns that case, exactly as for the pre-pass.
+  const submittedFileCount = Array.isArray(committedFiles)
+    ? committedFiles.filter((f) => typeof f === 'string' && f.trim()).length
+    : 0;
+  if (permissionPathCheck.isBelowFloor(builderRank) && submittedFileCount === 0) {
+    // Resolve the floor label from the registry at runtime (the D-16/N-3
+    // stale-string rule) — never a hardcoded rank name.
+    const floorRank = Object.keys(permissionPathCheck.RANK_TIER)
+      .find((r) => permissionPathCheck.RANK_TIER[r] === permissionPathCheck.MIN_TIER) || 'the floor';
+    guardsTripped.push({ guard: 'permission_path_unprovable', severity: 'blocker',
+      summary: `rank '${builderRank}' is below the protected-path floor ('${floorRank}') and the grade submitted no committed_files — the permission-path check cannot run on an empty list, so a client PASS cannot stand (fail closed; task 1002646 / SR-9). Remedy: re-run the ship — ship.js submits the real committed file list; a genuinely file-less (DB-only) change needs a ${floorRank}+ builder to land it via /tasks/:id/confirm.` });
+    extraIssues.push({ severity: 'blocker', file: '(grade)', summary:
+      `[server permission-path] no committed_files submitted by a rank below the '${floorRank}' floor — the protected-path check is unprovable and fails closed (task 1002646)`, worker: 'server-permission-path' });
+    if (clientPassed) downgradeTo = 'fail';
+  }
+
   // --- Guard 2: implausible client verdict (SR-9) ---
   // A client PASS with an empty issues[] on a non-trivial diff is not a credible
   // default-fail panel verdict. Downgrade to manual-confirm (a human lands it via
@@ -697,7 +728,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       ...base,
       signals: {
         ...(base.signals || {}),
-        server_guard: { applied: ['route_rank', 'permission_path', 'implausible_pass', 'forged_net_negative'], ok: true, tripped: [] },
+        server_guard: { applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'], ok: true, tripped: [] },
       },
     };
   }
@@ -729,7 +760,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       // body already ran; this is the authoritative post-hoc adjustment).
       confidence: forwardedConfidence,
       server_guard: {
-        applied: ['route_rank', 'permission_path', 'implausible_pass', 'forged_net_negative'],
+        applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'],
         ok: guardsTripped.length === 0,
         downgraded_to: downgradeTo,
         client_passed: clientPassed,
@@ -739,7 +770,9 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
         // the code. Named here so clients render it as a wall, not a quality
         // FAIL the builder should fix-and-retry (the envelope used to teach
         // exactly that wrong lesson). route_rank stays a code finding.
-        authorization_refusal: guardsTripped.some((g) => g.guard === 'permission_path'),
+        // task 1002646: permission_path_unprovable is the same wall — the rank
+        // floor refusing an unverifiable diff — so it renders the same way.
+        authorization_refusal: guardsTripped.some((g) => g.guard === 'permission_path' || g.guard === 'permission_path_unprovable'),
       },
     },
     notes_md: `${base.notes_md || ''}${guardNote}`,

package/modules/lifecycle/github-push.js

@@ -1002,6 +1002,10 @@ async function recheckPullRequest({ number }, deps = {}) {
   const { owner, repo } = repoInfo;
   const doFetch = deps.fetchImpl || fetch;
   const reopenDelayMs = Number.isFinite(deps.reopenDelayMs) ? deps.reopenDelayMs : RECHECK_REOPEN_DELAY_MS;
+  // task 1002644: injectable so the unit test pins the sleep's PLACE in the
+  // close→reopen sequence without a real timer — a wall-clock elapsed assertion
+  // around a real sleep flaked the unit lane (the only required merge check).
+  const doSleep = deps.sleepImpl || sleep;
   const api = `https://api.github.com/repos/${owner}/${repo}`;
   const patchState = async (state) => {
     const res = await doFetch(`${api}/pulls/${number}`, {
@@ -1018,7 +1022,7 @@ async function recheckPullRequest({ number }, deps = {}) {
   await patchState('closed');
   // Let GitHub register the close as a distinct state transition before reopening, so
   // the reopen actually dispatches a `pull_request: reopened` event (task 1241).
-  if (reopenDelayMs > 0) await sleep(reopenDelayMs);
+  if (reopenDelayMs > 0) await doSleep(reopenDelayMs);
   const reopened = await patchState('open');
   let autoMerge = false;
   try {

package/modules/lifecycle/routes/tasks.js

@@ -1431,8 +1431,10 @@ module.exports = function buildTasksRouter() {
     // forged {ff:10,cq:10,issues:[]} to self-pass. serverSideGuards re-runs the
     // two DETERMINISTIC pre-passes here (route-rank against the server's own
     // route files; permission-path against the caller's LIVE, authoritative
-    // rank — req.builder.rank, read fresh from the DB per request), rejects an
-    // implausible empty-issues PASS on a non-trivial diff, and neutralizes an
+    // rank — req.builder.rank, read fresh from the DB per request), fails a
+    // sub-floor PASS that submitted NO committed_files closed (the check is
+    // unprovable on an empty list — task 1002646 / report 1000021 G-1), rejects
+    // an implausible empty-issues PASS on a non-trivial diff, and neutralizes an
     // obviously-forged net-negative credit signal (SR-18). It is DOWNGRADE-ONLY:
     // it can flip a client PASS to a hard FAIL or manual-confirm, but never
     // upgrades a fail and never relaxes the existing gate — so a legitimate

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.26",
+  "version": "1.19.28",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.26",
+      "version": "1.19.28",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.26",
+  "version": "1.19.28",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -184,16 +184,31 @@ function main() {
   const runOne = (displayName, filePath) => {
     try {
       execFileSync(process.execPath, [filePath], {
-        stdio: ['ignore', 'ignore', 'pipe'],
+        // task 1002644: stdout used to be IGNORED, so the failing assertion (test
+        // files print their FAIL lines to stdout) was discarded and the only
+        // context shown was the last 3 STDERR lines — often stale diagnostic
+        // noise from an EARLIER, PASSING test. The live example: gate_approvals'
+        // route-catch console.error dump made every failure in that file read as
+        // a GraphQL/network outage, and the real flaky assertion was invisible.
+        stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: 16 * 1024 * 1024,
         timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
       console.log(`  ok    ${displayName}`);
     } catch (err) {
       const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
-      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
       console.log(`  FAIL  ${displayName} (${why})`);
-      if (stderr) console.log(`      ${stderr}`);
+      const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
+      // The actual failures first: the file's own FAIL lines, then its stdout
+      // tail (the last failure's assertion detail + summary), both bounded.
+      const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
+      for (const l of failLines) console.log(`      ${l.trim()}`);
+      if (stdoutText) {
+        for (const l of stdoutText.split('\n').slice(-5)) console.log(`      ${l}`);
+      }
+      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
+      if (stderr) console.log(`      stderr: ${stderr}`);
       failures.push(displayName);
     }
   };

package/src/module-api.js

@@ -479,8 +479,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.24 with no explicit bump. run 31495418623. (task 1002620)
 //   1.19.26 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.25 with no explicit bump. run 31495996665. (task 1002620)
+//   1.19.27 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.26 with no explicit bump. run 31497212656. (task 1002620)
+//   1.19.28 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.27 with no explicit bump. run 31499228797. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.26'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.28'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/gate_approvals.mjs

@@ -208,21 +208,26 @@ await t('recheckPullRequest: waits between close and reopen so GitHub fires a di
   // into no net change and dispatches no `pull_request: reopened` event, so the
   // gate-review run never re-fires. recheckPullRequest must sleep BETWEEN the close
   // PATCH and the reopen PATCH (deps.reopenDelayMs, default 4s in prod) so the reopen
-  // lands as a distinct state transition. We assert the delay elapses strictly between
-  // the two PATCHes and not before the close / after the reopen.
+  // lands as a distinct state transition.
+  //
+  // task 1002644: this used to sleep a REAL 30ms and assert wall-clock elapsed >=
+  // 30 — Date.now() truncation + NTP slew on CI runners can read a punctual timer
+  // as 29ms, which flaked the unit lane (the ONLY required merge check, ADR 0162).
+  // Inject the sleep and assert its PLACE in the event sequence instead — strictly
+  // stronger (total elapsed never proved the wait sat BETWEEN the two PATCHes) and
+  // fully deterministic.
   const events = [];
-  const delayMs = 30;
+  const delayMs = 4000; // the prod-default shape — never actually slept (injected)
   const fetchImpl = async (url, opts) => {
     const method = (opts && opts.method) || 'GET';
     if (method === 'PATCH') { events.push('patch:' + JSON.parse(opts.body).state); return jsonRes(200, { node_id: 'N1', state: JSON.parse(opts.body).state }); }
     if (url === 'https://api.github.com/graphql') { events.push('automerge'); return jsonRes(200, { data: { enablePullRequestAutoMerge: {} } }); }
     throw new Error('unexpected ' + url + ' ' + method);
   };
-  const t0 = Date.now();
-  await gp.recheckPullRequest({ number: 202 }, { token: 'T', repoInfo: REPO, fetchImpl, reopenDelayMs: delayMs });
-  const elapsed = Date.now() - t0;
-  assert.deepEqual(events, ['patch:closed', 'patch:open', 'automerge'], 'close then (after a wait) reopen then re-arm');
-  assert.ok(elapsed >= delayMs, `total elapsed (${elapsed}ms) must be at least the configured reopen delay (${delayMs}ms)`);
+  const sleepImpl = async (ms) => { events.push(`sleep:${ms}`); };
+  await gp.recheckPullRequest({ number: 202 }, { token: 'T', repoInfo: REPO, fetchImpl, sleepImpl, reopenDelayMs: delayMs });
+  assert.deepEqual(events, ['patch:closed', `sleep:${delayMs}`, 'patch:open', 'automerge'],
+    'the wait happens BETWEEN the close and the reopen — a coalesced close+reopen dispatches no reopened event');
 });
 
 // ===========================================================================

package/tests/grade_server_authoritative.mjs

@@ -141,6 +141,93 @@ await test('route-rank hard-fail (forged routes dir) flips a client PASS to FAIL
   }
 });
 
+// ========================================================================
+// Guard 1b — vacuous permission-path input fails CLOSED (task 1002646 /
+// report 1000021 G-1). The pre-pass pairs the server-known rank with
+// CLIENT-supplied committed_files, so omitting the list (or sending []) made
+// the sub-floor protected-path check pass vacuously — the exact bypass the
+// report demonstrated. A sub-floor caller submitting NO file list now fails
+// closed; honest ships always send the real list (task 878).
+// ========================================================================
+
+const ppc = require('../src/bongos/permission-path-check.js');
+const REGISTRY_FLOOR = Object.keys(ppc.RANK_TIER).find((r) => ppc.RANK_TIER[r] === ppc.MIN_TIER);
+
+await test('1002646 sub-floor PASS with committed_files ABSENT → hard FAIL (omission no longer bypasses the floor)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: null, builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false, 'omitting committed_files must not make the protected-path floor vacuous');
+  assert.equal(g.signals.server_guard.downgraded_to, 'fail');
+  assert.equal(g.signals.confidence, 0, 'fail forwards confidence 0 so the server gate also fails');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+  assert.ok(g.issues.some((i) => i.worker === 'server-permission-path'));
+  assert.equal(g.signals.server_guard.authorization_refusal, true,
+    'the unprovable trip is the same rank wall as permission_path — not a quality verdict (task 1002614 shape)');
+});
+
+await test('1002646 sub-floor PASS with committed_files [] → hard FAIL (empty list is the same omission)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: [], builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false);
+  assert.equal(g.signals.server_guard.downgraded_to, 'fail');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+});
+
+await test('1002646 whitespace-only entries do not count as a submitted list → hard FAIL', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: ['   ', ''], builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, false, 'padding the list with blanks is still an empty list');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'permission_path_unprovable'));
+});
+
+await test('1002646 the refusal names the registry-resolved floor + the remedy (wave-5 speech standard)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'a', summary: 'x' }] }),
+    { committedFiles: null, builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 3, lines_removed: 1 } }
+  );
+  const trip = g.signals.server_guard.tripped.find((t) => t.guard === 'permission_path_unprovable');
+  assert.ok(trip, 'the guard must be recorded');
+  assert.ok(trip.summary.includes(`'${REGISTRY_FLOOR}'`),
+    'the floor name comes from the registry at runtime, never a hardcoded rank string (D-16/N-3)');
+  assert.match(trip.summary, /re-run the ship/i, 'carries the remedy');
+  assert.match(trip.summary, /\/tasks\/:id\/confirm/, 'names the file-less-change exit too');
+});
+
+await test('1002646 a floor-clearing rank with an absent list is NOT blocked (guard scoped to the floor)', () => {
+  const g = grader.serverSideGuards(clientGrade(), {
+    committedFiles: null, builderRank: 'metic',
+    diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
+  });
+  assert.equal(g.passed, true, 'the floor does not apply to metic+ — no new refusal for them (ADR 0162)');
+  assert.equal(g.signals.server_guard.ok, true);
+});
+
+await test('1002646 an honest sub-floor ship with a real, unprotected list still passes (no new gate on honest work)', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'docs/notes.md', summary: 'x' }] }),
+    { committedFiles: ['docs/notes.md'], builderRank: 'thetes', diffStats: { files_changed: 1, lines_added: 5, lines_removed: 1 } }
+  );
+  assert.equal(g.passed, true,
+    'a real submitted list keeps working; the dishonest-LIST residual is owned by gate-review CI + the post-push main audit');
+});
+
+await test('1002646 downgrade-only: a sub-floor client FAIL with an absent list stays FAIL (no behavior change)', () => {
+  const failGrade = grader.validateAndScore(
+    { functional_fidelity: 3, code_quality: 3, confidence: 1, issues: [{ severity: 'blocker', file: 'a', summary: 'broken' }] },
+    {}
+  );
+  const g = grader.serverSideGuards(failGrade, {
+    committedFiles: null, builderRank: 'xenos', diffStats: { files_changed: 1, lines_added: 1, lines_removed: 1 },
+  });
+  assert.equal(g.passed, false, 'still failed — the guard only ever downgrades');
+});
+
 // ========================================================================
 // Guard 2 — implausible empty-issues PASS on a non-trivial diff → manual-confirm.
 // ========================================================================