@bongos/core 1.19.331 → 1.19.333

package/scripts/gds/fitness.js

@@ -29,62 +29,14 @@ const { parseRoutineFrontmatter } = require('./run-routine'); // System 4 (ADR 0
 const { filenameViolation, stemCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
 const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
 
-// ADR 0108 §Consequences #4 (configurable-root W6 / task 1886) — the guardrail walks TWO trees.
-// CORE code + core-owned docs (src/, server.js, scripts/, the src/bongos + scripts/gds nested docs)
-// live under the core PACKAGE; INSTANCE content (the root CLAUDE.md, the .claude/ methodology
-// surface, instance modules + migrations) lives under the host REPO. Modules ship from BOTH.
-// Today both resolve to the same checkout, so every walk below is byte-identical; once the core
-// installs from node_modules they diverge and each check inspects the CORRECT tree. A NEW
-// hardcoded `path.resolve(__dirname,'..','..')` here reintroduces the bug this check exists to stop.
-const CORE_ROOT = resolveCoreRoot();
-const INSTANCE_ROOT = resolveInstanceRoot();
-// REPO_ROOT retained as an alias to the core root for the many purely-core walks below (src/bongos,
-// KERNEL_FILES, scope map, …) — those keep their exact behavior. Instance-owned reads route
-// through INSTANCE_ROOT explicitly, and module reads through MODULE_ROOTS.
-const REPO_ROOT = CORE_ROOT;
-// Deduped module search roots — a module can ship from the core package OR the instance repo (the
-// loader errors on a cross-root key collision, so a key resolves to exactly one root). Deduped so
-// today's single checkout scans each module ONCE (no double-counting).
-const MODULE_ROOTS = [...new Set([CORE_ROOT, INSTANCE_ROOT])];
-
-// ---- shared fs helpers -----------------------------------------------------
-
-function walkJs(absRoot, out = []) {
-  let st;
-  try { st = fs.statSync(absRoot); } catch { return out; }
-  if (st.isFile()) { if (absRoot.endsWith('.js')) out.push(absRoot); return out; }
-  for (const ent of fs.readdirSync(absRoot, { withFileTypes: true })) {
-    if (ent.name === 'node_modules' || ent.name === '.git') continue;
-    walkJs(path.join(absRoot, ent.name), out);
-  }
-  return out;
-}
-// repo-relative POSIX path for an abs file under EITHER root (core or instance). The classifier
-// regexes throughout this file key on these relative strings, which are identical whichever tree
-// a file lives in — so only the WALK roots change under the split, not the classification.
-const rel = (abs) => {
-  for (const base of [CORE_ROOT, INSTANCE_ROOT]) {
-    const r = path.relative(base, abs);
-    if (r && !r.startsWith('..') && !path.isAbsolute(r)) return r.split(path.sep).join('/');
-  }
-  return path.relative(CORE_ROOT, abs).split(path.sep).join('/');
-};
-// Walk .js under `subpath` (e.g. 'modules') across ALL module roots, deduped by repo-relative
-// path so the same file is never scanned twice when the roots coincide (today).
-function walkJsAllRoots(subpath, roots = MODULE_ROOTS) {
-  const seen = new Set();
-  const out = [];
-  for (const root of roots) {
-    for (const abs of walkJs(path.join(root, subpath))) {
-      const r = rel(abs);
-      if (seen.has(r)) continue;
-      seen.add(r);
-      out.push(abs);
-    }
-  }
-  return out;
-}
-
+// task 1003206 (goal 1000079): fitness.js was 2,004 lines. Four cohesive pieces now
+// live beside it — the shared roots/walkers and three check clusters. They are
+// IMPORTED (not registered by path) so the CHECKS array and module.exports below
+// stay byte-identical to the single-file version every test was written against.
+const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
+const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
+const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
+const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
 // ============================================================================
 // Check 1 — core ↔ host/game import boundary (ADR 0062 §1 cut-line)
 // ============================================================================
@@ -521,6 +473,16 @@ const KERNEL_FILES = [
   'src/bongos/module-scope-map.js',          // the module→path registry (it NAMES every module — exempt below)
   // trust primitives (ADR 0091 §1) — the authz boundary + data substrate
   'src/bongos/auth.js',                      // authz gates (requireBuilder/requireRank, ADR 0016)
+  // task 1003206 (goal 1000079) split auth.js's 1,867 lines into these five sign-in
+  // flow modules. They are the SAME kernel machinery, not new domain — auth.js is a
+  // kernel file, so if they were left off this roster the boundary check would read
+  // its own carve as five kernel→non-kernel leaks. Being on the roster also means
+  // each of them is itself held to the kernel import rule, which is the point.
+  'src/bongos/auth-config.js',               // provider config + OAuth scope selection
+  'src/bongos/auth-admission.js',            // membership kind, admission gate, first-admin seating
+  'src/bongos/auth-github.js',               // GitHub device + web OAuth flows
+  'src/bongos/auth-idp.js',                  // hub federation, assertion + logout-token verification
+  'src/bongos/auth-discord.js',              // Discord OAuth link + guild membership
   'src/bongos/route-rank-check.js',          // deterministic route→rank classification
   'src/bongos/permission-path-check.js',     // protected-path matcher (PROTECTED_GLOBS, ADR 0043)
   'src/bongos/goal-scope-check.js',          // goal create-gate scope wall (composes the 3 matchers above; ADR 0086 §3, BV1.R60)
@@ -556,7 +518,19 @@ const KERNEL_FILES = [
 //     instance-config, build-info) are NOT exempt and must stay module-agnostic.
 const KERNEL_NAMES_MODULES_OK = new Set([
   'src/bongos/module-scope-map.js',      // the module→path registry
+  // auth.js and the auth-*.js flow modules task 1003206 split out of it: the
+  // sign-in path legitimately names modules — it resolves the 'onboarding' and
+  // 'government' PORTS by key, and carries the Discord OAuth account-link flow
+  // (core by design — see modules/discord/CLAUDE.md "NOT in this module"). The
+  // exemption follows the code, exactly as the KERNEL_FILES roster above does;
+  // Check 12 still guards these files' dependency DIRECTION, which is the
+  // stronger guarantee.
   'src/bongos/auth.js',                  // Discord OAuth account-link flow (core by design)
+  'src/bongos/auth-config.js',
+  'src/bongos/auth-admission.js',        // resolves the 'government' rank-role port by key
+  'src/bongos/auth-github.js',           // ticks the 'onboarding' port on first sign-in
+  'src/bongos/auth-idp.js',              // same, on the federated path
+  'src/bongos/auth-discord.js',          // the Discord account-link flow itself
   'src/bongos/permission-path-check.js', // names module path subtrees to PROTECT them
   'src/bongos/route-rank-check.js',      // names module route dirs to rank-gate them
 ]);
@@ -937,292 +911,6 @@ function checkMigrationNamespacing() {
   };
 }
 
-// ============================================================================
-// Check 13 — portable code carries no hardcoded host-brand identity (BV1.R76 + task 1705)
-// ============================================================================
-//
-// The portable core (src/bongos/**) and every feature MODULE (modules/**) must read
-// the instance's product/world name + domains from branding() / window.__BRANDING__,
-// never a baked-in "Off the Boats" / "Amazonprimea" / apex domain (ADR 0062 §3/§5;
-// the branding contract). R76 shipped this as an 8-FILE allowlist over the kernel
-// LLM-prompt headers; task 1705 WIDENS it to a directory-wide scan, so ANY new brand
-// leak in portable code reds the build — not just the nine files someone remembered
-// to list. (The 2026-07-02 separation audit found five leaks the old allowlist missed:
-// the rank/graduation broadcasts, the auth error-page title, the apex-origin default,
-// and ~124 served-UI strings.) Comments are stripped first (block /* */, HTML
-// <!-- -->, and JS // line comments via a `://`-safe strip so a URL is never
-// truncated) because the de-brand rationale legitimately names the old literals in
-// prose. Instance-injected placeholders ({{worldName}} etc.) carry no literal, so
-// they pass untouched.
-//
-// EXCLUDED — the small instance-1 / ops allowlist (task 1705):
-//   - modules/game/**  — the INSTANCE'S OWN PRODUCT. A product's identity is
-//     instance-specific by definition (a vanilla instance ships a different product,
-//     or none); it is not portable-platform code the branding pack can neutralize.
-//     A documented carve-out, not an oversight.
-//   - generated / build-output dirs (no authored source).
-const PROMPT_IDENTITY_LITERALS = [
-  /off the boats/i,
-  /amazonprimea/i,
-];
-// Scan roots (recursive) + kernel-prompt CLIs that live outside them.
-// scripts/gds joined at task 1002427: the builder CLI was UNSCANNED, which is how
-// paste-token.js kept a hardcoded 'https://amazonprimea.com' long after the task
-// 1002201 sweep replaced that literal everywhere else. The straggler surfaced as a
-// 401 that locked a builder out of re-authenticating — a valid token verified
-// against the wrong host — and nothing in CI could see it (idea 1000564).
-// Widened scripts/gds → ALL of scripts/ at task 1002756: migrate.sh's hardcoded
-// founder DB default (task 1002755) survived every gate because the detector never
-// saw the file — a gate that cannot see the file class the bug lives in is worse
-// than no gate, because it is trusted.
-const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts'];
-const IDENTITY_SCAN_EXTRA_FILES = [];
-// PERMANENT, COUNTED carve-outs for the scripts/gds root — {file: allowed hits}.
-//
-// Widening the root (task 1002427) surfaced 23 files. Task 1002428 swept them:
-// every one whose literal was a real runtime bug is FIXED (a wrong instance URL
-// printed to a builder, an `amazonprimea-*` User-Agent that should come from
-// branding().userAgent(), a hardcoded product name in user-facing copy). What is
-// left below is NOT a backlog — each entry is a literal that is CORRECT as
-// written, so this list is permanent rather than a ratchet-to-zero.
-//
-// The COUNT is still enforced, which is the point: an entry may not grow. A file
-// here that gains a NEW hardcoded host fails the build exactly like an unlisted
-// one, and any file NOT listed must have zero hits. Getting better never fails.
-//
-// Why each is legitimate:
-//   * box.js — REAL Cloudflare/DNS zone names for the operator plane
-//     (`dev.<host>`, the terminal zone). These are infrastructure identifiers,
-//     not an instance URL; routing them through branding would be wrong. (Its
-//     two genuine API-base defaults WERE fixed in 1002428.)
-//   * publish-manifest.js — the literal FILENAMES of two real committed docs
-//     (docs/recipes/amazonprimea-decouple-*.md). Renaming the strings without
-//     renaming the files would break the publish manifest.
-//   * backfill-sessions.js / version-close.js — one-time operator runbook text
-//     naming the actual prod DB + a historical local directory. Describing what
-//     an operator must literally type is the correct content.
-//   * seed-*.js — the hits are PROSE INSIDE seeded task descriptions: historical
-//     records of what those tasks said when they were filed. Rewriting them would
-//     falsify the record; deleting the files would destroy it. They are inert
-//     (idempotent on source_ref) and referenced only by generated manifests.
-//   * the four *.sh entries — surfaced when `.sh` joined the extension set (task
-//     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
-//     live box's actual Postgres database/role and its actual /etc secrets dir, and
-//     every one of those literals is already only the DEFAULT behind an env override
-//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Same rationale as box.js's real
-//     DNS zones — an infrastructure identifier, not an instance URL, and the systemd
-//     units on that box invoke these by path. Re-pointing an instance's backups is
-//     deployment work, not a branding read. Their COUNT is still frozen here, so a
-//     NEW literal in any of them fails exactly like one in an unlisted file.
-//   * fitness.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
-//     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
-//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
-//     three passed pre-1002756 only by the old stripper's accidents (phantom
-//     blocks + regex-blindness); now they are seen and counted.
-const IDENTITY_SCAN_ALLOWED = {
-  'scripts/gds/fitness.js': 2,
-  'scripts/gds/package-core.js': 1,
-  'scripts/gds/seed-v3-tasks.js': 14,
-  // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
-  // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
-  // now resolves its database from the branding pack (the migrate.sh pattern) and
-  // fails loudly rather than defaulting, so their counts ratcheted to zero and the
-  // entries are gone. seed-staging.sh keeps its carve-out on the OPPOSITE
-  // rationale: its literal is a fail-CLOSED safety interlock (the script wipes
-  // STAGING_DB and refuses unless the name matches exactly), so on any other
-  // instance it declines to run instead of destroying the wrong database.
-  'scripts/gds/seed-staging.sh': 4,
-  'scripts/gds/backfill-sessions.js': 2,
-  'scripts/gds/box.js': 3,
-  'scripts/gds/publish-manifest.js': 2,
-  'scripts/gds/seed-bongos-coreB-tranche1-tasks.js': 1,
-  'scripts/gds/seed-bongos-coreB-tranche2-tasks.js': 1,
-  'scripts/gds/seed-bongos-goal-hierarchy-tasks.js': 1,
-  'scripts/gds/seed-bongos-tasks.js': 1,
-  'scripts/gds/seed-gds-v4-tasks.js': 1,
-  'scripts/gds/seed-medusa-tasks.js': 7,
-  'scripts/gds/seed-module-upstreaming.js': 1,
-  'scripts/gds/seed-productization-tasks.js': 6,
-  'scripts/gds/seed-provisioning-tasks.js': 2,
-  'scripts/gds/version-close.js': 1,
-};
-// `.sh` joined at task 1002567: the extension set was `.js/.html/.css`, so NO shell
-// script had ever been scanned — which is how scripts/gds/lib.sh kept a hardcoded
-// founder host as its API-base default (and a hardcoded ~/.config/otb token path)
-// through the entire task 1002201 sweep, leaving all five bash smokes dead on any
-// instance with a different configDir. The guard could not see the file class the
-// bug lived in.
-const IDENTITY_SCAN_EXTS = new Set(['.js', '.html', '.css', '.sh']);
-// Path-prefix carve-outs (see the header note). Kept SMALL and documented.
-const IDENTITY_SCAN_EXCLUDE = ['modules/game/'];
-// Directories with no authored source to gate.
-const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'iterations', 'references']);
-
-// Comment stripping lives in identity-strip.js (task 1002756: extracted + replaced
-// the two-regex JS strip, which a `/*` inside a `//` comment could OPEN — it
-// silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
-const { stripCommentsForIdentity } = require('./identity-strip');
-
-// Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
-// Returns violation strings. Exported for the "actually catches a re-hardcode" test.
-function scanPromptIdentity(relFile, text, ext = path.extname(relFile)) {
-  const violations = [];
-  stripCommentsForIdentity(text, ext).split('\n').forEach((raw, i) => {
-    if (!raw.trim()) return;
-    for (const re of PROMPT_IDENTITY_LITERALS) {
-      const m = raw.match(re);
-      if (m) {
-        violations.push(`${relFile}:${i + 1} hardcodes the host-brand identity "${m[0]}" — read it from branding()/window.__BRANDING__ (identity/domains/currency), or use a {{worldName}}-style token, so a non-OTB instance renders ITS OWN brand (ADR 0062 §3/§5; BV1.R76 / task 1705).`);
-        break; // one hit per line is enough
-      }
-    }
-  });
-  return violations;
-}
-
-// Recursively collect scannable files under one root, honoring the skip-dir + carve-out lists.
-function collectIdentityFiles(absRoot, relRoot) {
-  const out = [];
-  let entries;
-  try { entries = fs.readdirSync(absRoot, { withFileTypes: true }); }
-  catch { return out; }
-  for (const e of entries) {
-    const rel = relRoot ? `${relRoot}/${e.name}` : e.name;
-    if (e.isDirectory()) {
-      if (IDENTITY_SCAN_SKIP_DIRS.has(e.name)) continue;
-      if (IDENTITY_SCAN_EXCLUDE.some((p) => `${rel}/`.startsWith(p))) continue;
-      out.push(...collectIdentityFiles(path.join(absRoot, e.name), rel));
-    } else if (IDENTITY_SCAN_EXTS.has(path.extname(e.name))
-               && !IDENTITY_SCAN_EXCLUDE.some((p) => rel.startsWith(p))) {
-      out.push(rel);
-    }
-  }
-  return out;
-}
-
-function checkKernelPromptsNoHardcodedIdentity() {
-  const violations = [];
-  let scanned = 0;
-  // Collect {abs, rel}: src/bongos is CORE; modules ship from BOTH roots (ADR 0108 §Consequences #4).
-  // Dedup by repo-relative path so a shared checkout never scans a file twice, and read each file
-  // from the root it was actually found under (a module may live in the instance repo post-split).
-  const seen = new Set();
-  const entries = [];
-  const addFrom = (rootAbs, sub) => {
-    for (const relFromRoot of collectIdentityFiles(path.join(rootAbs, sub), sub)) {
-      if (seen.has(relFromRoot)) continue;
-      seen.add(relFromRoot);
-      entries.push({ abs: path.join(rootAbs, relFromRoot), rel: relFromRoot });
-    }
-  };
-  for (const root of IDENTITY_SCAN_ROOTS) {
-    for (const rootAbs of (root === 'modules' ? MODULE_ROOTS : [CORE_ROOT])) addFrom(rootAbs, root);
-  }
-  for (const extra of IDENTITY_SCAN_EXTRA_FILES) {
-    if (!seen.has(extra)) { seen.add(extra); entries.push({ abs: path.join(CORE_ROOT, extra), rel: extra }); }
-  }
-  let ratcheted = 0;
-  for (const { abs, rel: relFile } of entries) {
-    let text;
-    try { text = fs.readFileSync(abs, 'utf8'); }
-    catch { continue; } // a file moved/carved away is not a failure of this gate
-    scanned += 1;
-    const found = scanPromptIdentity(relFile, text);
-    // Permanently allowed at a COUNT (task 1002428): the listed literals are
-    // correct as written, but an entry may not GROW — a new hardcode in one of
-    // these files fails exactly like one in an unlisted file.
-    const allowed = IDENTITY_SCAN_ALLOWED[relFile];
-    if (allowed !== undefined) {
-      if (found.length > allowed) {
-        violations.push(
-          `${relFile} now hardcodes the host-brand identity ${found.length} time(s), above its allowed ${allowed} — ` +
-          `the carve-out covers the EXISTING literals (see IDENTITY_SCAN_ALLOWED), not new ones. ` +
-          `Read the host from branding()/window.__BRANDING__ instead (task 1002428).`
-        );
-      } else {
-        ratcheted += 1;
-      }
-      continue;
-    }
-    violations.push(...found);
-  }
-  return {
-    name: 'portable code carries no hardcoded host identity (BV1.R76 / task 1705)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/** (whole root, task 1002756), minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
-  };
-}
-
-// ============================================================================
-// Check 15b — core-shipped NEUTRAL config packs carry no host identity (BV1.R102)
-// ============================================================================
-//
-// Sibling of Check 15 for the CONFIG class. IDENTITY_SCAN_EXTS is js/html/css, so
-// the scan above never opens a .json — yet config/*.neutral.json is precisely what
-// a vanilla instance boots from (branding R76, governance R96). A host name leaking
-// into a neutral pack ships one instance's brand to EVERY fresh instance, and until
-// this check nothing in CI could see it.
-//
-// Only the NEUTRAL packs are scanned, deliberately: an instance pack (config/
-// branding.json, config/government.json) is host content that legitimately names
-// its host, and is boundary-excluded from the published core anyway.
-function checkNeutralConfigsNoHostIdentity() {
-  const violations = [];
-  const dir = path.join(CORE_ROOT, 'config');
-  let names = [];
-  try { names = fs.readdirSync(dir).filter((n) => n.endsWith('.neutral.json')).sort(); }
-  catch { /* no config/ dir in this root — nothing to gate */ }
-  for (const name of names) {
-    const relFile = `config/${name}`;
-    let text;
-    try { text = fs.readFileSync(path.join(dir, name), 'utf8'); }
-    catch { continue; } // a pack that moved away is not a failure of this gate
-    violations.push(...scanPromptIdentity(relFile, text, '.json'));
-  }
-  return {
-    name: 'neutral config packs carry no host identity (BV1.R102)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${names.length} core-shipped config/*.neutral.json pack(s) scanned — a vanilla instance boots from these alone, so none may name a host brand. Instance packs (config/<name>.json) are host content and are deliberately NOT scanned.`,
-  };
-}
-
-// ---- design contract (ADR 0081 / task 1377) --------------------------------
-
-function checkDesignContract() {
-  const { spawnSync } = require('node:child_process');
-  const validatorPath = path.join(REPO_ROOT, 'scripts', 'gds', 'validate-design.js');
-  const adaptersDir = path.join(REPO_ROOT, 'src', 'ui', 'adapters');
-  const hasAdapters = (() => {
-    try { return fs.readdirSync(adaptersDir).some((e) => fs.statSync(path.join(adaptersDir, e)).isDirectory()); }
-    catch { return false; }
-  })();
-
-  const result = spawnSync(process.execPath, [validatorPath, '--json'], { encoding: 'utf8' });
-  let report = { ok: true, errors: [], warnings: [] };
-  try { report = JSON.parse(result.stdout || '{}'); } catch { /* fall through with defaults */ }
-  if (result.status !== 0 && !report.errors.length) {
-    report.errors.push(result.stderr ? result.stderr.trim() : 'validate-design.js exited non-zero');
-    report.ok = false;
-  }
-
-  return {
-    name: 'design contract valid (docs/design-contract.md / ADR 0081)',
-    ok: report.ok,
-    hardFail: !report.ok && hasAdapters,
-    violations: report.errors || [],
-    warnings: report.warnings || [],
-    note: hasAdapters
-      ? 'Hard-fail: adapters present — contract must be valid. Run: node scripts/gds/validate-design.js'
-      : 'Warn-only until first adapter lands (task 1378 / task 1379). Run: node scripts/gds/validate-design.js',
-  };
-}
-
 // ============================================================================
 // Check — hall sections are registry-owned, not hardcoded (BV1.R75 / ADR 0062 §4)
 // ============================================================================
@@ -1253,7 +941,19 @@ function checkDesignContract() {
 // that would either fail today or assert nothing.
 const HALL_INDEX = path.join(moduleDir('hall-ui'), 'public', 'index.html'); // hall-ui is a module — resolve its root (ADR 0108)
 const HALL_PUBLIC = path.join(moduleDir('hall-ui'), 'public');
+// task 1003206 split the hall page script: builders.js keeps state/loading/wiring
+// and hall-render.js holds the view painters — ZONE_BUDGETS travelled with the
+// widget mounting. Read whichever of the pair actually declares it, so this
+// check follows the code instead of a filename (it went vacuous on the move).
 const HALL_BUILDERS_JS = path.join(HALL_PUBLIC, 'builders.js');
+const HALL_RENDER_JS = path.join(HALL_PUBLIC, 'hall-render.js');
+function hallWidgetSource() {
+  const parts = [];
+  for (const f of [HALL_BUILDERS_JS, HALL_RENDER_JS]) {
+    try { parts.push(fs.readFileSync(f, 'utf8')); } catch { /* absent → skip */ }
+  }
+  return parts.join('\n');
+}
 
 // Parse builders.js's ZONE_BUDGETS object literal — the single source of truth
 // for the caps (this check must never carry its own copy of the numbers).
@@ -1290,10 +990,14 @@ function scanHallZoneCounts(dir = HALL_PUBLIC, fsImpl = fs) {
 
 function checkHallZoneBudgets(fsImpl = fs) {
   let js = '';
-  try { js = fsImpl.readFileSync(HALL_BUILDERS_JS, 'utf8'); } catch { return []; }
+  try {
+    js = [HALL_BUILDERS_JS, HALL_RENDER_JS]
+      .map((f) => { try { return fsImpl.readFileSync(f, 'utf8'); } catch { return ''; } })
+      .join('\n');
+  } catch { return []; }
   const budgets = parseZoneBudgets(js);
   if (!budgets) {
-    return ['modules/hall-ui/public/builders.js no longer declares a parseable ZONE_BUDGETS literal — the Home zone budgets are unenforced (task 2177).'];
+    return ['modules/hall-ui/public/{builders,hall-render}.js no longer declares a parseable ZONE_BUDGETS literal — the Home zone budgets are unenforced (task 2177).'];
   }
   const counts = scanHallZoneCounts(HALL_PUBLIC, fsImpl);
   const violations = [];
@@ -1561,329 +1265,6 @@ function checkErrorEnvelope() {
   };
 }
 
-// ============================================================================
-// Check 18 — every write route validates its body (BV1 R12 / task 1999 / ADR 0118)
-// ============================================================================
-//
-// Criterion api-validation: "the build fails on an unvalidated write route." R11
-// (#1998) gave every body-reading write route a strict validateOrRespond schema
-// (code-first, spec-driven — ADR 0118); this LOCKS that in. Reusing the SAME
-// route model that generates the OpenAPI spec (gen-api-docs.extractModel —
-// readsBody + validated), a POST/PUT/PATCH/DELETE that reads req.body must carry
-// a validateOrRespond()/validate(req.body) schema. Hard-zero (no ratchet — the
-// R11 sweep already reached 100%): a NEW write route that reads a body but
-// declares no schema fails the build immediately, so unknown/typo'd fields can
-// never again be silently dropped.
-//
-// EXEMPT — the builder-settings /me/*-prefs routes. Their bodies are DYNAMIC-KEY
-// maps ({ "<skill|sound|event-id>": <value> }, or a single-key toggle) that a
-// FIXED field schema cannot express; they validate via their module lib's
-// validatePatch()/validate() (which already rejects unknown keys with a 422). A
-// fixed strict schema would wrongly reject the valid dynamic keys — so these are
-// validated-by-lib, not by validateOrRespond. Documented per-route below; see
-// learning #133 / ADR 0118. Adding a route here is a deliberate, reviewable act.
-const WRITE_VALIDATION_EXEMPT = new Set([
-  'PATCH /me/skill-prefs',        // { "<skill>": "<model>"|null } — dynamic keys; skillPrefs.validatePatch
-  'PATCH /me/sound-prefs',        // { "<sound>": <bool>|null }    — dynamic keys; soundPrefs.validatePatch
-  'PATCH /me/event-sound-prefs',  // { "<event>": "<variant>"|null } — dynamic keys; eventSoundPrefs.validatePatch
-  'PATCH /me/wandering',          // { wandering: 0..3|null }      — rank-capped; wanderingPrefs.validatePatch
-  'PATCH /me/interaction',        // interaction profile           — interactionPrefs.validatePatch
-  'PATCH /me/model-allocation',   // per-slot tiers                — modelAllocPrefs.validatePatch
-  'PATCH /me/render',             // { widgets: <bool>|null }      — renderPrefs.validatePatch
-  'PATCH /me/display-name',       // { display_name }              — displayName.validate
-]);
-
-// KNOWN GAPS, NOT EXEMPTIONS (task 1002551 / BV1.R109b → tracked by task 1002552).
-//
-// These three are NOT validated-by-lib and do NOT belong in WRITE_VALIDATION_EXEMPT
-// above — they are genuine ADR 0118 gaps that must grow a validateOrRespond schema.
-// They surface here only because R109b taught route discovery to see MULTI-LINE
-// `router.<method>(` declarations: this check reuses gen-api-docs.extractModel(), so
-// the same regex hole that hid them from the rank auditor hid them from Check 18 too.
-// They are pre-existing (never validated), not a regression.
-//
-// They are recorded rather than fixed because modules/*/routes/*.js was being migrated
-// concurrently by BV1.R105, so editing those files would have collided. This is the
-// Check-17 ratchet posture: a NAMED, non-growing baseline. The list may only ever
-// SHRINK — a new unvalidated write route is not on it and still hard-fails the build,
-// and a stale entry (one that HAS been fixed) also fails, so the list cannot rot.
-// Delete this constant when task 1002552 lands and Check 18 returns to hard-zero.
-// EMPTY as of BV1.R109c (task 1002552) — all three original entries now validate.
-// Kept (rather than deleted) as the ratchet itself: an empty named baseline states
-// the invariant is hard-zero, and any future entry has to be added deliberately.
-const WRITE_VALIDATION_BASELINE = new Set([]);
-
-function scanUnvalidatedWriteRoutes(model = genApiDocs.extractModel()) {
-  const unvalidated = [];
-  const baselineSeen = new Set();
-  for (const r of model) {
-    if (!['POST', 'PUT', 'PATCH', 'DELETE'].includes(r.method)) continue;
-    // Only routes that actually read a body have an input surface to validate;
-    // a write that ignores req.body has nothing to declare.
-    if (!r.body || !r.body.readsBody || r.body.validated) continue;
-    const key = `${r.method} ${r.route}`;
-    if (WRITE_VALIDATION_EXEMPT.has(key)) continue;
-    if (WRITE_VALIDATION_BASELINE.has(key)) { baselineSeen.add(key); continue; }
-    unvalidated.push(`${key}  [${r.file}]`);
-  }
-  // A baseline entry that no longer reports as unvalidated has been FIXED — it must be
-  // removed, or the list would quietly license a future regression on that same route.
-  for (const key of WRITE_VALIDATION_BASELINE) {
-    if (!baselineSeen.has(key)) {
-      unvalidated.push(`${key}  [STALE BASELINE — this route now validates; remove it from WRITE_VALIDATION_BASELINE in scripts/gds/fitness.js]`);
-    }
-  }
-  return unvalidated;
-}
-
-function checkWriteRoutesValidated() {
-  const unvalidated = scanUnvalidatedWriteRoutes();
-  const violations = [];
-  if (unvalidated.length) {
-    violations.push(
-      `${unvalidated.length} write route(s) read req.body but declare NO validateOrRespond/validate schema (ADR 0118 / R11 requires one so unknown fields are rejected via the ADR-0116 envelope): ${unvalidated.join('; ')}. Add a strict validateOrRespond(req, res, { … }) listing every field the handler reads (see learning #133). A dynamic-key body validated by a module lib belongs in WRITE_VALIDATION_EXEMPT with a one-line reason.`
-    );
-  }
-  return {
-    name: 'every write route validates its body (ADR 0118 / R12)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `body-reading POST/PUT/PATCH/DELETE routes must call validateOrRespond/validate (${WRITE_VALIDATION_EXEMPT.size} dynamic-key prefs routes validate by lib; ${WRITE_VALIDATION_BASELINE.size} known gaps tracked by task 1002552, list may only shrink); ${unvalidated.length} unvalidated.`,
-  };
-}
-
-// ── Check 19 — the ADR 0174 vocabulary wall (goal 1000068 R07, task 1003008) ──
-//
-// "Role" means ONE thing in this codebase: a craft — Artist, Ideator, or Builder.
-// The permission system is the GOVERNMENT and the positions in it are RANKS.
-// Before ADR 0174 the same word named both, and goal 1000066 was about to claim
-// it for the crafts while modules/governance/ still used it for the ladder. This
-// check is what stops that collision reforming the first time someone copies an
-// old file.
-//
-// TWO RULES, both scoped to the GOVERNMENT SURFACE — not the whole repo. A repo-
-// wide ban would be wrong: `builders.system_role` is a core column for machine
-// identities, Discord's API owns its own "role" noun, and the crafts are supposed
-// to use the word.
-//
-//   1. no "role" under modules/government/ or on the Government hall page
-//   2. no "governance" there either — the old name of the same surface
-//
-// EXCLUDED BY CONSTRUCTION (not by allowlist):
-//   • modules/government/migrations/governance_*.sql — the already-applied
-//     migrations keep their filenames forever (schema_migrations is stem-keyed;
-//     renaming one re-runs it, and governance_002 is a seed/backfill). Their
-//     bodies necessarily name the pre-rename tables they created.
-//   • docs/adr/, docs/session-logs/, docs/governance/ — the historical record.
-//     An ADR describes a decision at a point in time; rewriting it to match
-//     today's vocabulary would erase the evidence that the words changed.
-//
-// The ALLOWLIST below is deliberately tiny and each entry carries its reason. A
-// rule that passes because everything is suppressed reads as evidence while
-// proving nothing — if this list grows, that is the signal to finish the rename,
-// not to add a line.
-const VOCAB_ALLOW = [
-  {
-    file: 'modules/government/config.js',
-    match: 'roles',
-    why: 'the legacy INSTANCE-config key fallback. The core ships `ranks`, but an '
-       + 'external self-hosted instance may still have a config/government.json '
-       + 'authored as `roles`; reading it is what stops their templates vanishing '
-       + 'on upgrade. Removing this line would break them silently.',
-  },
-  {
-    file: 'modules/government/config.js',
-    match: 'governance_role_labels',
-    why: 'the legacy ENV-VAR fallback. <PREFIX>_GOVERNMENT_RANK_LABELS is the current '
-       + 'name, but an operator sets this in their own shell or env file, outside this '
-       + 'repo, so the old spelling is still read. Dropping it would silently stop '
-       + 'honouring a label override someone already configured.',
-  },
-  {
-    file: 'modules/government/board.js',
-    match: 'governancepasscredit',
-    why: 'the R02 pass-event contract (docs/specs/board-room-pass-event-contract.md, agreed '
-       + 'cross-goal 2026-08-17) names the economy-side award awardIdeaGovernancePassCredit, '
-       + 'matching the credit_log reason family idea.credit.governance_pass:<id> that streams '
-       + '1-3 share. The board calls the CONSUMER\'s agreed method name — renaming it here '
-       + 'would break the contract, and the reason strings are durable ledger rows. Scoped to '
-       + 'the method name, so a stray "governance" elsewhere in board.js still reds the build.',
-  },
-  {
-    file: 'modules/government/module.json',
-    match: 'role',
-    why: 'the manifest states the rule itself — "The word `role` is deliberately '
-       + 'absent here". Meta-commentary about the ban has to be able to name it.',
-  },
-];
-
-// A line CITING a historical artifact by its real name: an ADR filename, the
-// docs/governance/ evidence folder, or one of the already-applied
-// governance_NNN migrations. These names are permanent (see the header), so a
-// reference to one is a citation, not drift.
-const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|governance_0\d\d/;
-
-const VOCAB_SURFACE = [
-  'modules/government',
-  'modules/hall-ui/public/government.js',
-  'modules/hall-ui/public/government.html',
-  'modules/hall-ui/public/government.css',
-];
-const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
-const VOCAB_BANNED = [
-  { re: /\brole/i,       label: 'role',       hint: '"role" is reserved for the crafts (Artist / Ideator / Builder). On this surface the noun is RANK.' },
-  { re: /governance/i,    label: 'governance', hint: 'the pre-ADR-0174 name of this surface. It is the GOVERNMENT now.' },
-];
-
-function vocabFilesToScan() {
-  const out = [];
-  const walk = (abs, rel) => {
-    let st;
-    try { st = fs.statSync(abs); } catch { return; }
-    if (st.isDirectory()) {
-      // the historical migrations keep their names + bodies (see header)
-      if (rel.endsWith('/migrations')) return;
-      for (const e of fs.readdirSync(abs)) walk(path.join(abs, e), `${rel}/${e}`);
-      return;
-    }
-    if (VOCAB_EXTS.has(path.extname(abs))) out.push({ abs, rel });
-  };
-  for (const s of VOCAB_SURFACE) walk(path.join(CORE_ROOT, s), s);
-  return out;
-}
-
-// ── Check 19b — the FOURTH and FIFTH "role": a membership is not a craft either ─
-//
-// task 1003013 / ADR 0177. ADR 0174 reserved `role` for the three crafts and R07
-// (checkVocabularyWall above) enforces it on the GOVERNMENT surface — deliberately
-// only there, because `builders.system_role` is a core machine-identity column and
-// Discord's API owns its own "role" noun. Goal membership was a fourth,
-// independent use of the word (`goal_members.role` = 'lead' | 'member'), which is
-// exactly why it survived the rename: the rule was silent on it, as designed.
-//
-// So this is a SECOND narrow wall rather than a widened first one — same reason the
-// first was scoped: the honest unit is a SURFACE, not the repo. Two surfaces carry
-// a membership, and both now say `membership_kind`:
-//   • GOAL membership (`goal_members`, task 1003013) — the routes and pure gate that
-//     decide it, the hall page that renders it, and (line-scoped) the membership SQL
-//     in modules/lifecycle/db.js;
-//   • PROJECT membership on the hub (`platform_identity_project_memberships`, task
-//     1003090) — whose old VALUE 'builder' was itself a craft name. Its check-in
-//     route keeps reading a legacy `role` field for the cross-version federation
-//     window (other instances upgrade on their own schedule), so the lines that
-//     handle that legacy field cite the task and are exempt like any other citation.
-//
-// Naming the rule stays legal — a line that cites ADR 0174 / ADR 0177 / task
-// 1003013 is meta-commentary about the ban, the same principle as
-// VOCAB_HISTORICAL_REF above. `role="…"` is stripped first: that is HTML's ARIA
-// attribute, a different word spelled the same.
-const GOAL_VOCAB_SURFACE = [
-  'modules/lifecycle/routes/goals.js',
-  'modules/lifecycle/goal-authz.js',
-  'modules/lifecycle/routes/done-when.js',
-  'modules/hall-ui/public/goals-page.js',
-  'modules/hall-ui/public/goals.html',
-  'modules/hall-ui/public/goals.css',
-  // The FIFTH use (task 1003090): the hub's coarse project membership.
-  'modules/platform-identity/platform-identity.js',
-  'modules/platform-identity/routes/my-projects.js',
-  'modules/hall-ui/public/my-projects.js',
-];
-// modules/lifecycle/db.js is 5k+ lines and legitimately says "role" about ranks
-// (the rank-sync port, builders.system_role). Scanning it whole would need an
-// allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
-// the only thing that can regress here — a membership query reaching for the old
-// column — with no false positives to excuse.
-// task 1003204 (goal 1000079) split that 5k-line file into db.js (a re-export
-// facade) + twelve db-*.js units, so the membership SQL is no longer in db.js at
-// all. Enumerate the family from disk rather than naming one file: a line-scoped
-// scan costs nothing on the units that hold no membership SQL, and a future
-// re-carve cannot silently disarm the rule by moving the queries again.
-const LIFECYCLE_DB_FILES = (() => {
-  const dir = path.join(CORE_ROOT, 'modules', 'lifecycle');
-  try {
-    return fs.readdirSync(dir)
-      .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
-      .sort()
-      .map((f) => `modules/lifecycle/${f}`);
-  } catch { return ['modules/lifecycle/db.js']; }
-})();
-const GOAL_VOCAB_LINE_SCOPED = [
-  ...LIFECYCLE_DB_FILES.map((file) => ({ file, mustMention: /goal_members/ })),
-  // sso.js is the federation surface: only the lines that name the membership table
-  // or its upsert are in scope, so the file's other server-to-server prose stays out.
-  { file: 'modules/platform-identity/routes/sso.js', mustMention: /project_memberships|upsertMembership/ },
-];
-const GOAL_VOCAB_CITATION = /ADR 017[47]|task 1003013|task 1003090/;
-
-function checkGoalMembershipVocabulary() {
-  const violations = [];
-  let scanned = 0;
-  const scanFile = (rel, lineFilter = null) => {
-    const abs = path.join(CORE_ROOT, rel);
-    let src;
-    try { src = fs.readFileSync(abs, 'utf8'); } catch { return; }
-    scanned += 1;
-    src.split('\n').forEach((line, i) => {
-      if (lineFilter && !lineFilter.test(line)) return;
-      const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
-      if (!/\brole/i.test(scanLine)) return;
-      if (GOAL_VOCAB_CITATION.test(scanLine)) return;
-      violations.push(`${rel}:${i + 1}: "role" — a membership is a 'membership_kind' (ADR 0174 reserves "role" for the crafts; ADR 0177).  →  ${line.trim().slice(0, 90)}`);
-    });
-  };
-  for (const rel of GOAL_VOCAB_SURFACE) scanFile(rel);
-  for (const { file, mustMention } of GOAL_VOCAB_LINE_SCOPED) scanFile(file, mustMention);
-  return {
-    name: 'a membership is a "membership_kind", never a role (ADR 0177)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${scanned} membership-surface file(s) scanned (${GOAL_VOCAB_SURFACE.length} whole — goal + project membership — plus `
-        + `${GOAL_VOCAB_LINE_SCOPED.length} line-scoped to the lines naming the membership tables); no allowlist — `
-        + 'a line that CITES the rule is the only exemption.',
-  };
-}
-
-function checkVocabularyWall() {
-  const violations = [];
-  let scanned = 0;
-  for (const { abs, rel } of vocabFilesToScan()) {
-    scanned += 1;
-    const lines = fs.readFileSync(abs, 'utf8').split('\n');
-    lines.forEach((line, i) => {
-      // `role="…"` is HTML's own ARIA attribute — a different word that happens to
-      // be spelled the same. Strip attributes before matching rather than
-      // allowlisting each occurrence: this is a property of HTML, not of any one file.
-      const scanLine = line.replace(/\srole\s*=\s*("[^"]*"|'[^']*')/g, ' ');
-      for (const b of VOCAB_BANNED) {
-        if (!b.re.test(scanLine)) continue;
-        // A REFERENCE to a historical artifact by its real name is not a
-        // vocabulary violation — it is a citation. The artifacts themselves are
-        // excluded by construction (see the header); naming one has to be legal
-        // too, or the code could not point at the migration that created its own
-        // tables. Same principle, applied to the line rather than the file.
-        if (VOCAB_HISTORICAL_REF.test(scanLine)) continue;
-        const excused = VOCAB_ALLOW.some((a) => a.file === rel && scanLine.toLowerCase().includes(a.match));
-        if (excused) continue;
-        violations.push(`${rel}:${i + 1}: "${b.label}" — ${b.hint}  →  ${line.trim().slice(0, 90)}`);
-      }
-    });
-  }
-  return {
-    name: 'the word "role" means a craft, never a rank (ADR 0174)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${scanned} government-surface file(s) scanned for "role"/"governance"; `
-        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies). Historical migrations + docs/adr are excluded by construction, not suppressed.`,
-  };
-}
-
 const CHECKS = [
   checkCoreHostBoundary,
   checkClaudeMdBudget,
@@ -1910,7 +1291,13 @@ const CHECKS = [
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
   require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
-  require('./skill-preflight.js').checkOpsSkillsDeclareMachine, require('./version-literal-guard.js').checkNoVersionLiterals, // Checks 23 (task 1003167/G03: a skill declares its machine) + 24 (task 1003166/G02: no script hardcodes a version id) — one line because fitness.js is 500 over the excess-lines ratchet and a new check must not cost a line (idea 1000810)
+  require('./skill-preflight.js').checkOpsSkillsDeclareMachine, // Check 23 — task 1003167 / G03: an ops skill declares the machine it needs
+  // Check 24 — task 1003166 / G02: no ops script hardcodes a version id. It landed
+  // sharing Check 23's line, deliberately, because fitness.js was ~500 lines over
+  // the excess-lines ratchet and a new check could not afford one (idea 1000810).
+  // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
+  // and the check gets its own line back.
+  require('./version-literal-guard.js').checkNoVersionLiterals,
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
 ];