@bongos/core 1.19.29 → 1.19.30

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.29",
-  "core_contract": "1.19.29",
-  "source_commit": "653afa8efb0b5167d51ed1510c45977a56a575dd",
+  "core_version": "1.19.30",
+  "core_contract": "1.19.30",
+  "source_commit": "103b0c420b448f90a8f42f923f4e67891c45b210",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T14:19:03.503Z",
+  "built_at": "2026-08-11T14:41:56.292Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 285,
+    "docs_redacted": 286,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1205,
+    "functional_verbatim": 1206,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1511,
-  "tree_sha256": "0076ae91d3bb7f715ca250d05367d1eae9a660b5c015b88c0a6687d7a01a9794",
+  "file_count": 1513,
+  "tree_sha256": "66f1b7a904b38f7980ead45fe34e98228990e4be951b312f807251687b13d098",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1269,10 +1269,15 @@
       "mode": "0000644",
       "sha256": "f6176799c7731da3d4970b75e882e0ab88e31b1a412c87957b9a5085bfc799c7"
     },
+    {
+      "path": "docs/adr/0163-legacy-display-name-resolution.md",
+      "mode": "0000644",
+      "sha256": "f1d673faaffd4d8a92709bafdc0d5c33b715131beac8f12c02dfa59880242a64"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "b3ed6866c5042d2ee2f1c5680af8d6ef85d36c70a4f9e208eac2e5922461f6dc"
+      "sha256": "acaedbcf1451bdd23461b4d2e2e567678d1d5e4574ad615042a6c3d3db845fcc"
     },
     {
       "path": "docs/api-reference.md",
@@ -2194,6 +2199,11 @@
       "mode": "0000644",
       "sha256": "cfc4208327550710a64e44a401f552d78ab28814f033627f5fccc174f1c15b9d"
     },
+    {
+      "path": "migrations/core_214_display_name_source_backfill.sql",
+      "mode": "0000644",
+      "sha256": "5d970696a87e6f663f9fda83a268dbe99ced00ac02fb805d91114f54d4a8fece"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -4002,12 +4012,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7a14171b353dbfb6da83df462c031ecce9d4c97b085504845035072e5e97bbfa"
+      "sha256": "f1d885c73d1c6d6c7a1b5762e022f575045e320aa8e0fcfcaf3e9f00153fe8d5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3ff6057a4a6120421ce79d9593bdf54e424fdd143bd0a20fc616ba92582ee910"
+      "sha256": "ef7a211fb70fc0316e3146e7a35a09617ea7fc2e275e8b06af61da04da94db51"
     },
     {
       "path": "public-docs/index.html",
@@ -5402,7 +5412,7 @@
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
-      "sha256": "7951e23e770dc001f6893d42db1cdb6dbb91cf8b084f0651972c75bc8463083d"
+      "sha256": "fa80ba2c0bb742b83d637280e65965f450bc0387063e65dd06f6bd9171283f23"
     },
     {
       "path": "src/bongos/db.js",
@@ -5627,7 +5637,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "576d6afdcdf097366f36831d4b56ba300f71beefdc29c853605f9c0788cd260c"
+      "sha256": "696cdcbb043dc4b0792302807c0130d348e83d7d2e8b2fc992805f31a4a3d677"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6287,7 +6297,7 @@
     {
       "path": "tests/display_name.mjs",
       "mode": "0000644",
-      "sha256": "4eac4b50dc7e3b9797f7d7633eb480b04dd5ebde4fc867ec19765177ff22d8b4"
+      "sha256": "f5074a25ef511149149a6d708561ac639eff333519f703f015b6e72dc6adb56d"
     },
     {
       "path": "tests/dns_preflight.mjs",

package/docs/adr/0163-legacy-display-name-resolution.md

@@ -0,0 +1,44 @@
+# 0163 — Pre-197 display names: a transitional 'legacy' source, resolved at first sign-in
+
+- **Status:** Accepted
+- **Date:** 2026-08-11
+- **Deciders:** Claude (jaxri session), under the bug-wave mandate
+
+**Track:** `internal` (GDS / builder experience). Task [1002643](https://cloudbongos.com/builders#/task/1002643), from idea 1000659. Extends [ADR 0156](<redacted>.md).
+
+---
+
+## Context
+
+ADR 0156 (migration `core_197`) made a builder's self-chosen display name durable by recording *who last set it* (`builders.display_name_source`: `'github' | 'user'`) and guarding the sign-in upsert. It claimed `'github'` was "the correct default for every pre-existing row: whatever is stored survived the last sign-in, so it *is* the GitHub-derived value."
+
+That claim has a hole: a builder who renamed via `PATCH /me/display-name` **after their last sign-in but before 197 landed** still held their builder-set name in the row — 197 stamped it `'github'` anyway, so their next sign-in clobbers it. The fix shipped forward-only; the bug it fixed kept firing for exactly the people who had already hit it.
+
+A precise backfill is impossible: the rename route writes no `audit_log` entry, and nothing stores what GitHub reported per row. "Was this stored name builder-set?" has no answer in the data.
+
+## Decision
+
+**A third, transitional `display_name_source` value — `'legacy'` — for every row that predates 197 on the instance, resolved definitively by the upsert at each row's first subsequent sign-in.**
+
+- Migration `core_214` extends the CHECK constraint and marks `'legacy'` every row with `display_name_source = 'github'` created before `core_197`'s `applied_at` **on that instance** (read from `schema_migrations`, so the scoping is portable to self-hosted instances regardless of when they upgraded). A replay guard ensures resolved rows are never re-marked.
+- `upsertBuilder`'s conflict branch resolves each `'legacy'` row exactly once, using the one comparison that is only available at sign-in time — the incoming GitHub-derived name:
+  - stored name **equals** incoming → provably GitHub-derived → `'github'`; re-sync resumes as if 197's default had been right.
+  - stored name **differs** → treated as builder-set → kept, stamped `'user'`; durable from then on.
+- `'user'` and `'github'` remain terminal; post-197 rows are untouched.
+
+### The accepted misclassification
+
+A `'legacy'` row whose *GitHub-side* name changed between its last pre-214 sync and its first post-214 sign-in also "differs" — the stale GitHub name gets frozen as `'user'`. That trade is deliberate: the wrong outcome there is a stale *label*, visible and self-fixable in Settings; the wrong outcome under the status quo is the silent destruction of a deliberate rename — the reported bug. Preserve wins over sync when the evidence is ambiguous.
+
+### Rejected alternatives
+
+- **Backfill `'user'` where `display_name <> github_login`** — overwhelmingly wrong: most GitHub accounts have a profile name that differs from the login, so this would freeze GitHub-derived names for nearly everyone, silently reintroducing the frozen-name bug ADR 0156 rejected.
+- **Backfill nothing, compare names for ALL `'github'` rows forever** — turns every future GitHub rename into a frozen name; `'legacy'` scopes the ambiguity to the rows that actually carry it and expires it one sign-in later.
+- **Restore lost names from an audit trail** — there is no audit trail; rows already clobbered between 197 and 214 are unrecoverable, and this ADR does not pretend otherwise.
+
+## Consequences
+
+- `builders_display_name_source_check` now allows `'legacy'`; the value disappears from a row at its first post-214 sign-in and is never written by any other path.
+- `tests/display_name.mjs` evaluates the real conflict-branch SQL for all three source states and pins the migration's contract (only-`'github'` rows marked, `applied_at` scoping, replay guard).
+- Not surfaced in the API — same posture as ADR 0156; no UI copy branches on it.
+- Builders whose names were already re-clobbered between 197 and 214 must re-save once in Settings — with 214 in place, it now sticks.

package/docs/adr/README.md

@@ -235,4 +235,6 @@ This keeps the decision history honest and traceable.
 | 0161 | [**Publish on merge: every merge to core `main` auto-publishes `@bongos/core`** (task 1002620). Supersedes ADR 0137's manual owner-gated publish after its own "when to revisit" clause fired twice in three weeks: 171 commits/10 days, then 104 commits/5 days, sat on `main` reachable by no pin while every layer reported success. A `publish` workflow rides behind the required `unit` check (`workflow_run`, success-gated): when HEAD's `CORE_VERSION` is already on npm, CI bumps a PATCH via the shape-preserving `bump-version.js` (+ changelog line; pinned by `tests/bump_version.mjs`) and pushes the carrier commit; `package-core --self-verify --publish --live` builds through the fail-closed no-leak gate; the release is tagged `core-v<v>`. A MINOR/MAJOR stays a human in-task edit — it decides what patch-channel subscribers receive unattended (ADR 0136), a call CI must not make. Token custody knowingly reverses (owner-accepted): `NPM_TOKEN` write + `RELEASE_PUSH_TOKEN` PAT as Actions secrets, mitigated by the lane shipping INERT behind the `PUBLISH_ON_MERGE=1` repo variable — an owner kill-switch symmetrical to `gating.js`. Idempotent by version-compare; npm duplicate rejection is the backstop; queued no-cancel concurrency collapses merge races.](<redacted>.md) | build pipeline / distribution |
 | 0162 | [**Review gates retired: rank-consistent CI checks only on `main`** ([task 1002635](https://cloudbongos.com/builders#/task/1002635); owner directive, idea 1000657). Amends ADR 0159. Within a day of task 1002619 arming the merge gates, the code-owner review requirement had stranded two graded-PASS wave-4 ships (PR 28 sat BLOCKED behind a review only the repo-owner account could give) and then blocked the fixes for the strands it caused — structurally, not incidentally: GitHub can only express the gate as *accounts* (no rank concept, no self-approval), so on a solo-archon instance it degenerates into "one named login must click every gate-surface PR" — identity-pinned authority, against ADR 0016's rank principle and the remediation's own goal. Decision: branch protection carries required status checks ONLY; `gating.js` `DEFAULT_PROTECTION` sets `required_pull_request_reviews: null` and `cmdOn` normalizes BOTH restore paths so a pre-retirement snapshot cannot resurrect the gate (`tests/gating_review_retired.mjs` pins it with a counter-example); the CODEOWNERS *file* is deleted while its *glob* stays in the hard-floor lists so reintroducing it is itself gate-flagged. Accepted trade, chosen explicitly by the owner: no pre-merge human approval on safety-machinery changes — the unit check, the fail-closed gate-review sandbox, the grader panel, and the every-push main-audit are the net, catching a compromised session's merge after the fact rather than before.](<redacted>.md) | governance / build pipeline |
 
+| 0163 | [**Pre-197 display names: a transitional 'legacy' source, resolved at first sign-in** ([task 1002643](https://cloudbongos.com/builders#/task/1002643); idea 1000659). Amends [ADR 0156](<redacted>.md), whose migration defaulted every pre-existing row to `'github'` — false for builders who renamed after their last sign-in but before 197 landed, so their names kept reverting. No audit trail exists to backfill precisely, so `core_214` marks every pre-197 `'github'` row `'legacy'` (scoped by 197's `applied_at` on the instance — portable) and the upsert resolves each at its first sign-in: stored = incoming GitHub name → provably GitHub-derived → `'github'`; differs → treated as builder-set → kept, stamped `'user'`. Accepted misclassification: a GitHub-side rename in the window freezes a stale label (visible, self-fixable in Settings) — preferred over silently destroying deliberate renames. Rejected: `display_name <> github_login` heuristic (freezes nearly everyone), comparing forever on all `'github'` rows (turns every future GitHub rename into a frozen name).](<redacted>.md) | GDS / builder experience |
+
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/migrations/core_214_display_name_source_backfill.sql

@@ -0,0 +1,55 @@
+-- core_214_display_name_source_backfill.sql — heal pre-197 user-set names (task 1002643).
+--
+-- THE DEFECT. core_197 added display_name_source with DEFAULT 'github' for every
+-- existing row, reasoning that "whatever is stored survived the last sign-in, so
+-- it IS the GitHub-derived value" (ADR 0156). That is false for a builder who
+-- renamed via PATCH /me/display-name AFTER their last sign-in but BEFORE 197
+-- landed: their stored name is builder-set, the row says 'github', and their
+-- next sign-in still clobbers it — the exact bug 197 shipped to fix. The fix was
+-- forward-only; this migration is the missing backfill.
+--
+-- WHY NOT A PRECISE BACKFILL. The rename route writes no audit_log entry and
+-- nothing records what GitHub reported per row, so "was this name builder-set?"
+-- is unanswerable from stored data. Instead: a transitional third source value,
+-- 'legacy', for every row that predates 197 on THIS instance. The upsert guard
+-- (src/bongos/db-kernel.js) resolves each 'legacy' row definitively at its next
+-- sign-in: stored name equals what GitHub sends, so it is provably GitHub-derived,
+-- back to 'github' (re-sync resumes); differs, so treated as builder-set: kept, 'user'.
+--
+-- ACCEPTED TRADE (ADR 0163): a legacy row whose GitHub-side name changed before
+-- its first post-214 sign-in freezes the stale GitHub name as 'user' — a
+-- visible label, self-fixable in Settings. The status quo instead silently
+-- destroys deliberate renames. Preserve wins.
+--
+-- Scoped by created_at against 197's applied_at ON THIS INSTANCE — portable:
+-- every instance applied 197 at its own time. When 197 and 214 apply in the
+-- same run (fresh install / big upgrade / restore-replay), applied_at is ~now()
+-- so every pre-existing row is covered, which is then also correct: none of
+-- those rows ever had the guard protecting them.
+--
+-- Idempotent: constraint statements re-run cleanly, and the NOT EXISTS guard
+-- makes the UPDATE a no-op on replay against an up-to-date DB — rows resolved
+-- after the first run are never re-marked 'legacy'.
+
+BEGIN;
+
+ALTER TABLE builders DROP CONSTRAINT IF EXISTS builders_display_name_source_check;
+ALTER TABLE builders
+  ADD CONSTRAINT builders_display_name_source_check
+  CHECK (display_name_source IN ('github', 'user', 'legacy'));
+
+UPDATE builders
+   SET display_name_source = 'legacy'
+ WHERE display_name_source = 'github'
+   AND created_at < COALESCE(
+         (SELECT applied_at FROM schema_migrations
+           WHERE version = 'core_197_display_name_source'),
+         now())
+   AND NOT EXISTS (
+         SELECT 1 FROM schema_migrations
+          WHERE version = 'core_214_display_name_source_backfill');
+
+INSERT INTO schema_migrations (version) VALUES ('core_214_display_name_source_backfill')
+  ON CONFLICT DO NOTHING;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.29",
+  "version": "1.19.30",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.29",
+      "version": "1.19.30",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.29",
+  "version": "1.19.30",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/db-kernel.js

@@ -154,6 +154,10 @@ const RANKS = [
 // seeding and re-syncing the name for anyone who never renamed
 // (display_name_source='github'), and never overwrites one the builder set
 // themselves ('user', stamped by setBuilderDisplayName). See ADR 0156.
+// 'legacy' rows (pre-197 accounts, backfilled by core_214) are ambiguous — no
+// record says whether their stored name was builder-set. This sign-in resolves
+// each one: stored = incoming proves GitHub-derived → 'github'; differing is
+// treated as builder-set → kept and stamped 'user' (ADR 0163).
 async function upsertBuilder({ githubId, githubLogin, displayName, avatarUrl }) {
   const { rows } = await pool.query(
     `INSERT INTO builders (github_id, github_login, display_name, avatar_url)
@@ -162,7 +166,16 @@ async function upsertBuilder({ githubId, githubLogin, displayName, avatarUrl })
        SET github_login = EXCLUDED.github_login,
            display_name = CASE WHEN builders.display_name_source = 'user'
                                THEN builders.display_name
+                               WHEN builders.display_name_source = 'legacy'
+                                AND builders.display_name IS DISTINCT FROM EXCLUDED.display_name
+                               THEN builders.display_name
                                ELSE EXCLUDED.display_name END,
+           display_name_source = CASE WHEN builders.display_name_source = 'user'
+                                      THEN 'user'
+                                      WHEN builders.display_name_source = 'legacy'
+                                       AND builders.display_name IS DISTINCT FROM EXCLUDED.display_name
+                                      THEN 'user'
+                                      ELSE 'github' END,
            avatar_url   = EXCLUDED.avatar_url
      RETURNING id, github_id, github_login, display_name, avatar_url, total_credits, created_at, rank, preferred_disciplines`,
     [String(githubId), githubLogin, displayName, avatarUrl ?? null]

package/src/module-api.js

@@ -485,8 +485,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.27 with no explicit bump. run 31499228797. (task 1002620)
 //   1.19.29 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.28 with no explicit bump. run 31500810303. (task 1002620)
+//   1.19.30 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.29 with no explicit bump. run 31502880105. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.29'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.30'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/display_name.mjs

@@ -19,6 +19,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const d = require('../modules/builder-settings/display-name.js');
@@ -151,20 +152,38 @@ function conflictAssignment(sql, column) {
   throw new Error(`no "${column} = …" assignment in the conflict branch`);
 }
 
-// Evaluate the display_name assignment for one row, so the tests below read as
-// behaviour ("whose name ends up stored?") rather than string matching. An
+// Evaluate a conflict-branch assignment for one row, so the tests below read as
+// behaviour ("whose name ends up stored?") rather than string matching. Handles
+// the guard's exact grammar: multi-arm CASE, AND-joined conditions on
+// display_name_source and IS DISTINCT FROM, string-literal results. An
 // unguarded assignment — the shape that shipped the bug — is a bare column
 // reference and evaluates to whatever GitHub just sent.
-function resolvedDisplayName(expr, { source, stored, incoming }) {
-  const ref = (token) => {
-    if (/^EXCLUDED\.display_name$/i.test(token)) return incoming;
-    if (/^builders\.display_name$/i.test(token)) return stored;
-    throw new Error(`unrecognised display_name reference: ${token}`);
+function resolvedAssignment(expr, { source, stored, incoming }) {
+  const val = (token) => {
+    const t = token.trim();
+    if (/^EXCLUDED\.display_name$/i.test(t)) return incoming;
+    if (/^builders\.display_name$/i.test(t)) return stored;
+    const lit = /^'(\w+)'$/.exec(t);
+    if (lit) return lit[1];
+    throw new Error(`unrecognised token: ${t}`);
   };
+  const cond = (c) => c.split(/\s+AND\s+/i).every((one) => {
+    const t = one.trim();
+    let m = /^builders\.display_name_source = '(\w+)'$/i.exec(t);
+    if (m) return source === m[1];
+    m = /^builders\.display_name IS DISTINCT FROM EXCLUDED\.display_name$/i.exec(t);
+    if (m) return stored !== incoming;
+    throw new Error(`unrecognised condition: ${t}`);
+  });
   const norm = expr.replace(/\s+/g, ' ').trim();
-  const m = /^CASE WHEN builders\.display_name_source = '(\w+)' THEN (\S+) ELSE (\S+) END$/i.exec(norm);
-  if (!m) return ref(norm);
-  return source === m[1] ? ref(m[2]) : ref(m[3]);
+  if (!/^CASE WHEN /i.test(norm)) return val(norm);
+  const inner = norm.replace(/^CASE\s+/i, '').replace(/\s+END$/i, '');
+  const elseM = /\sELSE\s+(.+)$/i.exec(inner);
+  if (!elseM) throw new Error(`CASE without ELSE: ${norm}`);
+  for (const [, c, result] of inner.slice(0, elseM.index).matchAll(/WHEN\s+(.+?)\s+THEN\s+(\S+)/gi)) {
+    if (cond(c)) return val(result);
+  }
+  return val(elseM[1]);
 }
 
 // Drive both halves once (they're async), then assert on the captured SQL with
@@ -173,6 +192,7 @@ await kernel.upsertBuilder({
   githubId: 64553469, githubLogin: 'jaxri', displayName: 'GitHub Name', avatarUrl: null,
 });
 const upsertExpr = conflictAssignment(lastSql, 'display_name');
+const sourceExpr = conflictAssignment(lastSql, 'display_name_source');
 
 await settingsDb.setBuilderDisplayName(1000095, 'Renée the Builder');
 const setNameSql = lastSql.replace(/\s+/g, ' ');
@@ -187,14 +207,14 @@ t('the conflict branch keys display_name off display_name_source', () => {
 });
 
 t('a builder who set their own name keeps it when GitHub sends a different one', () => {
-  const kept = resolvedDisplayName(upsertExpr, {
+  const kept = resolvedAssignment(upsertExpr, {
     source: 'user', stored: 'Renée the Builder', incoming: 'renee-gh',
   });
   assert.equal(kept, 'Renée the Builder');
 });
 
 t('a builder who never renamed still picks up a GitHub rename', () => {
-  const synced = resolvedDisplayName(upsertExpr, {
+  const synced = resolvedAssignment(upsertExpr, {
     source: 'github', stored: 'Old GitHub Name', incoming: 'New GitHub Name',
   });
   assert.equal(synced, 'New GitHub Name');
@@ -208,5 +228,49 @@ t('setBuilderDisplayName stamps the name as user-set', () => {
   );
 });
 
+// --- pre-197 rows: 'legacy' resolves at first sign-in (task 1002643, ADR 0163)
+
+console.log('\nlegacy resolution (pre-197 rows backfilled by core_214):');
+
+t('a legacy row whose name differs from GitHub keeps it — and becomes user-set', () => {
+  const row = { source: 'legacy', stored: 'Percy Jackson', incoming: 'GitHub Name' };
+  assert.equal(resolvedAssignment(upsertExpr, row), 'Percy Jackson');
+  assert.equal(resolvedAssignment(sourceExpr, row), 'user');
+});
+
+t('a legacy row whose name matches GitHub resolves to github and resumes syncing', () => {
+  const row = { source: 'legacy', stored: 'Same Name', incoming: 'Same Name' };
+  assert.equal(resolvedAssignment(upsertExpr, row), 'Same Name');
+  assert.equal(resolvedAssignment(sourceExpr, row), 'github');
+});
+
+t('resolved sources are terminal: user stays user, github stays github', () => {
+  assert.equal(resolvedAssignment(sourceExpr, { source: 'user', stored: 'A', incoming: 'B' }), 'user');
+  assert.equal(resolvedAssignment(sourceExpr, { source: 'github', stored: 'A', incoming: 'B' }), 'github');
+});
+
+// The backfill migration is load-bearing for the guard above: without it no row
+// is ever 'legacy'. Pin its contract so a hand-edit can't silently unwind it.
+const migration = readFileSync(
+  new URL('../migrations/core_214_display_name_source_backfill.sql', import.meta.url),
+  'utf8'
+);
+
+t("core_214 extends the CHECK constraint to allow 'legacy'", () => {
+  assert.match(migration, /CHECK \(display_name_source IN \('github', 'user', 'legacy'\)\)/);
+});
+
+t("core_214 marks only 'github' rows — a user-set stamp is never touched", () => {
+  assert.match(migration, /SET display_name_source = 'legacy'\s+WHERE display_name_source = 'github'/);
+});
+
+t('core_214 scopes the backfill to rows created before 197 applied on this instance', () => {
+  assert.match(migration, /created_at < COALESCE\(\s*\(SELECT applied_at FROM schema_migrations\s+WHERE version = 'core_197_display_name_source'\)/);
+});
+
+t('core_214 is replay-safe: resolved rows are never re-marked legacy', () => {
+  assert.match(migration, /NOT EXISTS \(\s*SELECT 1 FROM schema_migrations\s+WHERE version = 'core_214_display_name_source_backfill'\)/);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);