@bongos/core 1.19.334 → 1.19.336

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.334",
-  "core_contract": "1.19.334",
-  "source_commit": "17d7b23f872fb3f64737ae5ffe270b91ace779a0",
+  "core_version": "1.19.336",
+  "core_contract": "1.19.336",
+  "source_commit": "85d561ede2a6c0ab512de0e97780813e9fea4112",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T00:36:48.394Z",
+  "built_at": "2026-08-25T00:56:17.081Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 325,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1490,
+    "functional_verbatim": 1483,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1837,
-  "tree_sha256": "15089adb0fd9a51245746cbd141dd57dceadee53a5e640beb0d7059c7f219610",
+  "file_count": 1830,
+  "tree_sha256": "5a51e5573725c512980eafa27efcd8c38c63d1ffddf8d108ca0803f5a3ebac68",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -287,7 +287,7 @@
     {
       "path": ".devcontainer/post-create.sh",
       "mode": "0000644",
-      "sha256": "db5db43fc7a692008eb1f70c6bec4345d6812939e9f09b302e2692621bbaece9"
+      "sha256": "69aef5fb55abc1bcd7c5f437df9bf7a38459eb52e1e4cc687b81d801f9c911ab"
     },
     {
       "path": ".dockerignore",
@@ -472,12 +472,12 @@
     {
       "path": "docs/adr/0011-terrain-id-rendering-model.md",
       "mode": "0000644",
-      "sha256": "68e9189dd2d99428b599d02011f8c88649151e9acaf9d8912c98b231eed4507e"
+      "sha256": "b3c9291fda6fd5e19601a9b79a97359682d26bb316b357f28db12dbb281d79cf"
     },
     {
       "path": "docs/adr/0012-ground-object-cell-split.md",
       "mode": "0000644",
-      "sha256": "bb26e441c48117377bbd451ea679a864bd58d5ac3a3a775cf20bc7219e5090e1"
+      "sha256": "a724bcd8c583d7f53515809da27202a7e512bad7862a8f77c8d8bd07c001792d"
     },
     {
       "path": "docs/adr/0013-paths-as-object-overlays-with-autotile-dispatch.md",
@@ -2987,7 +2987,7 @@
     {
       "path": "modules/economy/achievements.js",
       "mode": "0000644",
-      "sha256": "387c37df8b65bab755e8f006722e6665d9e5aafea29eabf868d1e2dfc4720e99"
+      "sha256": "fc270efbe9439442d2f51490a8a292313e3f66c7b5d33c28cd9e7f929f56b307"
     },
     {
       "path": "modules/economy/cost-classify.js",
@@ -3007,7 +3007,7 @@
     {
       "path": "modules/economy/credits.js",
       "mode": "0000644",
-      "sha256": "7c42fc848a1b7139d7ffa59cc3d81d89db84329b7beae9d5b8c5bc0afefc6f41"
+      "sha256": "a3d9d82cb5f19fdb8520c4df74022219886c767ae626dccf27728e07bf6d36f2"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -3019,6 +3019,11 @@
       "mode": "0000644",
       "sha256": "b8b3a4add551b32bc625dca0390afc2176dcd9e433b24d21128dd6e249e70623"
     },
+    {
+      "path": "modules/economy/policy.js",
+      "mode": "0000644",
+      "sha256": "cc953acd69f844d158c3a79ea4de3b12d652ea0247c878c6a6c33d5abf68eab3"
+    },
     {
       "path": "modules/economy/reward.js",
       "mode": "0000644",
@@ -4722,12 +4727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "27cc593724db16a7e292e6f8287d3fadfbda3a6eaff49c1c97a08fe5bf175ce5"
+      "sha256": "2aec5aabe3c60deec1e8f210e69d070f95b0e8d8a1a8fd55e9344399d67c66e5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5d2f06a29143a871ca7dd2f20d46ba2b05389a57aafddc6891147baa2a00e124"
+      "sha256": "417a1f2c9a79ec8492ee09886edc0e2cbefa35a1ba9686bc81a9dabe4527ce45"
     },
     {
       "path": "public-docs/index.html",
@@ -5377,7 +5382,7 @@
     {
       "path": "scripts/gds/fitness-checks-identity.js",
       "mode": "0000644",
-      "sha256": "5d731cf4703ca47be3dfd272f4bc74f6f49471f6b027474285cca4221fac47d5"
+      "sha256": "f87265779d60ae2d642e370f7af2d1d70fa6a1354a7389835d887b0dfe3c5dfc"
     },
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
@@ -5397,7 +5402,7 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "3f32080357abdecb0f0860c5c9313f12283f01774c8367ac22c1c12d0d176411"
+      "sha256": "1732691382d3ec82f4f59b44250fce6367179a44283395dc92c78cfd67493ed2"
     },
     {
       "path": "scripts/gds/fitness.js",
@@ -5802,7 +5807,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "c96e50e533f4e20dba91c6a26ac6efd2c6ad33ffcdc856eeb46af21a17e67975"
+      "sha256": "b3d816af249491e6187676ad084a60aaa72881615f8824a0263c31505d57a149"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5949,11 +5954,6 @@
       "mode": "0000644",
       "sha256": "14825fa0500e600efcc518e7120dd4b64fdae9235509e7a39d3865f179754f5f"
     },
-    {
-      "path": "scripts/gds/seed-v3-tasks.js",
-      "mode": "0000644",
-      "sha256": "a0d8c1530cfc80f5604fb4d520d131daa2a9001f0a28f5e184dd0386034af6e0"
-    },
     {
       "path": "scripts/gds/sequence.js",
       "mode": "0000644",
@@ -6239,26 +6239,6 @@
       "mode": "0000644",
       "sha256": "5860bf9daef3dd83a5ff4d3ee5e017e3cbd465ebda0c00df4ca622d629468ec4"
     },
-    {
-      "path": "scripts/snapshots/backfill-history.mjs",
-      "mode": "0000644",
-      "sha256": "536c5dce00bb8fc04d895396dfe593cfef1317c6d5666d76a0e0586f08f08987"
-    },
-    {
-      "path": "scripts/snapshots/maybe-render-on-deploy.sh",
-      "mode": "0000644",
-      "sha256": "e8392d7dc47f583c75acdf87bdd8ba9cae19fd348dd8f559802955690938545d"
-    },
-    {
-      "path": "scripts/snapshots/render-pre-art-eras.mjs",
-      "mode": "0000644",
-      "sha256": "a5e5498067075212e7a38eda2faf1d4cdf5f98421a71bed85e46a2c0f9dc882c"
-    },
-    {
-      "path": "scripts/snapshots/render-world.mjs",
-      "mode": "0000644",
-      "sha256": "deb5f6169f53771bc119cdbaa3164112b8cf480b49c1adf0d65914b7c96ee84f"
-    },
     {
       "path": "scripts/status-mirror-sync.js",
       "mode": "0000644",
@@ -6577,7 +6557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "717fc58e2725b43ec1bc0a0e995172992ed0b42cba603c68482292b70da67c57"
+      "sha256": "0a68c727fa467947704e21c886c0de2839aea5ecad7bf8b67f72867b7028ffb8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6654,11 +6634,6 @@
       "mode": "0000644",
       "sha256": "125edcec8c7d7536365b9675daa1fceb9fe072a30e2a4a68ee2911cd258a8c10"
     },
-    {
-      "path": "tests/anti_grid.mjs",
-      "mode": "0000644",
-      "sha256": "2d78ef9e446efa0aa66e716b362d72432024773b28d94f5768bcbaaf79c99dad"
-    },
     {
       "path": "tests/api_cli_flags.mjs",
       "mode": "0000644",
@@ -6824,16 +6799,6 @@
       "mode": "0000644",
       "sha256": "034114a63f2d8a431755f6cf35a7e66b1cbb3b7931bb251e3a8f235ff5057e29"
     },
-    {
-      "path": "tests/autotile_variants.mjs",
-      "mode": "0000644",
-      "sha256": "0cd3167548071272f13a3072a87d6071c46540a1fc0f810ca4584ac3f93693f6"
-    },
-    {
-      "path": "tests/autotile_xverify.mjs",
-      "mode": "0000644",
-      "sha256": "4986f25a93ef89f0312eeb1f4ff32cd82e2f8e7bcc9749143443537e734d5193"
-    },
     {
       "path": "tests/backfill_sessions.mjs",
       "mode": "0000644",
@@ -8072,7 +8037,7 @@
     {
       "path": "tests/lib_sh_resolution.mjs",
       "mode": "0000644",
-      "sha256": "4ec5ac626d9f8a72fe0e0066b266feb1f87b38c0dd8ac52f107c23e37a6a2e97"
+      "sha256": "97630ec5029469ec99c6a87160822f319833857f12a79e42b4a465e362836ef0"
     },
     {
       "path": "tests/lifecycle-card.mjs",
@@ -8712,7 +8677,7 @@
     {
       "path": "tests/search_isolation.mjs",
       "mode": "0000644",
-      "sha256": "4832744832280a72cc84b8c4b7a4b836612fbec733972bedaa1810124a90de8b"
+      "sha256": "21a352003eac3ef3975aecf758163bd90fb58c34daef643055b2423ea2ffdc17"
     },
     {
       "path": "tests/search_route.mjs",

package/.devcontainer/post-create.sh

@@ -102,13 +102,9 @@ echo
 
 # --- 3. Full-stack verification -----------------------------------------------
 say "4/4  Verifying the box is ready"
-# sharp: the native image dep — proves npm ci produced a working binary on this
-# arch (x64 or arm64).
-if node -e "require('sharp'); console.log('sharp', require('sharp/package.json').version)" >/dev/null 2>&1; then
-  echo "  ${green}ok${reset}  sharp loads ($(node -e "console.log(require('sharp/package.json').version)" 2>/dev/null))"
-else
-  echo "  ${yellow}!!${reset} sharp failed to load — the game/art build will break"
-fi
+# sharp was verified here as "the native image dep". Task 1003207 removed it: its
+# only consumers were the game-era snapshot renderers and an art-pipeline test,
+# all of which left this core with the game. Nothing native remains to prove.
 # The five art libs must import in the venv.
 if python3 -c "import PIL, numpy, scipy, sklearn, certifi" >/dev/null 2>&1; then
   echo "  ${green}ok${reset}  art libs import (Pillow, numpy, scipy, scikit-learn, certifi)"

package/docs/adr/0011-terrain-id-rendering-model.md

@@ -94,7 +94,8 @@ chooses the foam variant at the boundary. One less hand-tuned terrain
 in the map.
 
 A Python↔JS cross-verification smoke test
-([`tests/autotile_xverify.mjs`](../../tests/autotile_xverify.mjs) plus
+(`tests/autotile_xverify.mjs` — deleted by task 1003207 with the rest of the
+game-era art pipeline; named here as the historical record, not a live file — plus
 its emitter [`art/pipeline/autotile_xverify.py`](../../art/pipeline/autotile_xverify.py))
 asserts that all 256 blob47 inputs and all 16 path16 inputs map to the
 same tile index in both implementations. Wired into

package/docs/adr/0012-ground-object-cell-split.md

@@ -113,7 +113,8 @@ server module directly to guard against drift.
 ### Cross-verify safety
 
 The Python↔JS autotile lookup table cross-verifier
-([`tests/autotile_xverify.mjs`](../../tests/autotile_xverify.mjs))
+(`tests/autotile_xverify.mjs`, deleted by task 1003207 with the game-era art
+pipeline — named here as the historical record, not a live file)
 tests `selectBlob47` / `selectPath16` directly — unchanged by this
 ADR. Picker behavior change is captured in the new
 [`tests/terrain_picker.mjs`](../../tests/terrain_picker.mjs), which

package/modules/economy/achievements.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { SUBTRACTOR_THRESHOLD } = require('./policy');
+
 // Achievement evaluation — runs inside existing DB transactions so unlocks
 // are atomic with the action that triggered them.
 //
@@ -318,10 +320,9 @@ async function eligible_breaking100c(client, builderId) {
 
 async function eligible_subtractor(client, builderId) {
   // Mirror credits.awardNetNegativeBonus: subtractor unlocks at SUBTRACTOR_THRESHOLD
-  // net-negative ship bonuses. Lazy-require the threshold (credits.js requires
-  // this module, so a top-level require would be circular — same lazy pattern
-  // renderProgressText uses for ./streak).
-  const { SUBTRACTOR_THRESHOLD } = require('./credits');
+  // net-negative ship bonuses. The threshold used to be lazy-required from
+  // credits.js to dodge a circular import; task 1003207 moved it to ./policy.js,
+  // which both files read, so the cycle is gone rather than deferred.
   const r = await client.query(
     `SELECT COUNT(*)::int AS n FROM credit_log
       WHERE builder_id = $1 AND reason = 'ship.net_negative'`,

package/modules/economy/credits.js

@@ -712,7 +712,9 @@ async function awardSessionTokenReward(client, builderId, sessionId, modelUsage,
 // ship's bonus row is inserted — and that insert lives here. Doing the unlock
 // inline keeps the read-then-unlock atomic with the insert in one transaction.
 const NET_NEGATIVE_BONUS = 1;
-const SUBTRACTOR_THRESHOLD = 3; // net-negative ships needed to unlock Subtractor
+// task 1003207: moved to ./policy.js so achievements.js can read it without a
+// lazy require back into this file (that circularity was a tracked cycle).
+const { SUBTRACTOR_THRESHOLD } = require('./policy');
 function netNegativeBonusAmount(diffStats) {
   if (!diffStats) return 0;
   const added = Number(diffStats.lines_added) || 0;

package/modules/economy/policy.js

@@ -0,0 +1,22 @@
+// modules/economy/policy.js — economy policy constants that BOTH the credit
+// writers and the achievement predicates need.
+//
+// Extracted by task 1003207 (goal 1000079) to break a genuine require cycle:
+// credits.js requires achievements.js at load, and achievements.js needed
+// SUBTRACTOR_THRESHOLD back from credits.js. The workaround was a lazy
+// require() inside the function body, with a comment explaining the circularity
+// — a cycle papered over rather than removed, and one of the five the
+// require_cycle_count ratchet was holding.
+//
+// A shared constant is the honest seam: the threshold is neither a credit-writing
+// concern nor an achievement concern, it is the POLICY both read. credits.js
+// still re-exports it, so no caller outside this module changed.
+
+'use strict';
+
+// Net-negative ships needed to unlock Subtractor. Read by credits.js when it
+// awards the bonus, and by achievements.js when it decides the badge is earned —
+// the two must agree, which is why it lives in one place.
+const SUBTRACTOR_THRESHOLD = 3;
+
+module.exports = { SUBTRACTOR_THRESHOLD };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.334",
+  "version": "1.19.336",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.334",
+      "version": "1.19.336",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.334",
+  "version": "1.19.336",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-identity.js

@@ -101,7 +101,6 @@ const IDENTITY_SCAN_ALLOWED = {
   // when the monolith was split, so the detector's self-carve-out moved with them.
   'scripts/gds/fitness-checks-identity.js': 2,
   'scripts/gds/package-core.js': 1,
-  'scripts/gds/seed-v3-tasks.js': 14,
   // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
   // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
   // now resolves its database from the branding pack (the migrate.sh pattern) and

package/scripts/gds/fitness-ratchets.js

@@ -143,9 +143,19 @@ function requireGraph(contentsByFile) {
   const edges = new Map();
   for (const [file, text] of contentsByFile) {
     const deps = [];
-    for (const m of text.matchAll(REQUIRE_RE)) {
-      const target = resolveRelative(file, m[2], exists);
-      if (target && target !== file) deps.push(target);
+    // Scan line by line and skip WHOLE-LINE comments. A comment that merely
+    // NAMES a require — "// re-exports every name, so no require('./db') call
+    // site had to change" — used to create a phantom edge, and during the task
+    // 1003204 carve one such header comment on twelve new files fabricated a
+    // twelve-file cycle and reddened CI. Only a `//`- or `*`-leading line is
+    // dropped, so an inline trailing comment still counts, which is the safe
+    // direction: a missed real edge would hide a cycle.
+    for (const line of text.split('\n')) {
+      if (/^\s*(\/\/|\*)/.test(line)) continue;
+      for (const m of line.matchAll(REQUIRE_RE)) {
+        const target = resolveRelative(file, m[2], exists);
+        if (target && target !== file) deps.push(target);
+      }
     }
     edges.set(file, deps);
   }

package/scripts/gds/run-unit-tests.js

@@ -49,7 +49,11 @@ const MODULE_TESTS = {
     'terrain_picker', 'local_preview',
   ],
   'art-pipeline': [
-    'anti_grid', 'autotile_variants', 'autotile_xverify', 'art_key', 'art_stage',
+    // task 1003207 deleted anti_grid / autotile_variants / autotile_xverify — the
+    // art pipeline is not a module of this core any more, so they targeted a
+    // directory that no longer exists. art_key / art_stage still gate on the
+    // module being enabled, which is what this map is for.
+    'art_key', 'art_stage',
   ],
 };
 
@@ -116,21 +120,17 @@ const INTEGRATION = new Set([
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):
-//   - autotile_variants / autotile_xverify: depend on a python-generated artifact
-//     (modules/art-pipeline/pipeline/_autotile_tables.json) / build output absent in a fresh clone,
-//     so they exit non-zero standalone. Belong in an art-pipeline gate, not here.
-//   - anti_grid: runs modules/art-pipeline/pipeline/anti_grid_eval.py, which needs numpy (absent in
-//     the Node-only CI runner) -> ModuleNotFoundError. Same python-artifact class
-//     as autotile; belongs in an art-pipeline gate (task 859 / ADR 0042 cutover).
+//   - autotile_variants / autotile_xverify / anti_grid were parked here because they
+//     needed modules/art-pipeline artifacts. Task 1003207 DELETED all three: the
+//     art pipeline left this core with the game, so they targeted a module that no
+//     longer exists and could never have gone green again. A permanently-parked
+//     test is not a gate, it is a file that looks like one.
 //
 // grader_panel was excluded here (2 "failing" assertions, idea #225) until #954
 // (V4.R16) diagnosed them as STALE — they predated #481's Narc-advisory change,
 // NOT a grader regression. Now green and back under this gate so the quality-
 // gate brain can't silently regress.
 const KNOWN_FAILING = new Set([
-  'autotile_variants',
-  'autotile_xverify',
-  'anti_grid',
   // #1002617: red in every clean environment (Linux CI and a Windows checkout
   // alike), surfaced by the unit lane's first-ever runs. Parked so the `unit`
   // check can be required (a gate that's already red gates nothing); per-test

package/src/module-api.js

@@ -1095,8 +1095,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.332 with no explicit bump. run 32793666555. (task 1002620)
 //   1.19.334 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.333 with no explicit bump. run 32794305277. (task 1002620)
+//   1.19.335 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.334 with no explicit bump. run 32795232997. (task 1002620)
+//   1.19.336 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.335 with no explicit bump. run 32795564021. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.334'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.336'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/lib_sh_resolution.mjs

@@ -26,6 +26,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { fitnessSource } from './helpers.mjs';
@@ -152,3 +153,144 @@ test('the whole host-identity check is green on this tree', () => {
   const r = fitness.checkKernelPromptsNoHardcodedIdentity();
   assert.equal(r.ok, true, `violations:\n${r.violations.join('\n')}`);
 });
+
+// ---- 4. the SAME rule applies to the baked box scripts (task 1003252) ------
+//
+// THE SECOND BUG, same class, different file group. The sweep above fixed
+// scripts/gds/*.sh but never looked at infra/box-*.sh — the scripts baked onto a
+// dev box. Those kept reading a hardcoded ~/.config/otb/gds-session.json while
+// paste-token.js writes to ~/.config/<branding.configDir>/. On this instance
+// (configDir "cloudbongos") that meant every /builder-reauth silently stranded the
+// box: the 5-min heartbeat, the terminal/host-key/version reporters and the
+// GDS-backed git credential helper all kept presenting a DEAD token and failing
+// with a misleading "session expired — re-auth on the box", which is exactly what
+// the builder had just done. Observed live: four reporters 401ing every tick and a
+// checkout 311 commits behind origin/main.
+//
+// The fix mirrors instance-config.js's read-side fallback in bash: prefer the most
+// recently written gds-session.json across ~/.config/*/, since branding is not
+// readable from a script that must also run before any clone exists.
+
+const BOX_SCRIPTS = [
+  'box-heartbeat.sh',
+  'box-report-terminal.sh',
+  'box-report-host-keys.sh',
+  'box-report-version.sh',
+];
+
+const INFRA = path.join(ROOT, 'infra');
+const boxCode = (f) => fitness.stripCommentsForIdentity(fs.readFileSync(path.join(INFRA, f), 'utf8'), '.sh');
+
+test('every baked box script resolves the session across config dirs, not just the legacy one', () => {
+  for (const f of BOX_SCRIPTS) {
+    const src = boxCode(f);
+    assert.match(src, /\.config\/\*\/gds-session\.json/,
+      `${f} must fall back across ~/.config/*/ — without it a /builder-reauth into a `
+      + 'non-"otb" configDir strands the box on a dead token');
+    // The legacy literal may survive ONLY as the last-resort default, never as the
+    // sole source — i.e. it must be preceded by the glob scan.
+    // The scan widens what these scripts will read, so each candidate must be owned
+    // by the box user -- otherwise a file dropped by another local account could win
+    // simply by being newest.
+    assert.match(src, /\[ -O "\$_sess" \]/,
+      `${f} must require candidate session files to be owned by the current user`);
+    const globAt = src.indexOf('.config/*/gds-session.json');
+    const legacyAt = src.indexOf('.config/otb/gds-session.json');
+    if (legacyAt !== -1) {
+      assert.ok(globAt < legacyAt,
+        `${f} reaches the legacy path before scanning ~/.config/*/ — the fallback must come first`);
+    }
+  }
+});
+
+test('every baked box script passes bash -n', (t) => {
+  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+  for (const f of BOX_SCRIPTS) {
+    const r = bash(['-n', `infra/${f}`]);
+    assert.equal(r.status, 0, `bash -n infra/${f} failed:\n${r.stderr}`);
+  }
+});
+
+// Pull the resolver straight out of the committed file so this exercises the real
+// code, not a copy that could drift away from it.
+function resolverBlock(f) {
+  const src = fs.readFileSync(path.join(INFRA, f), 'utf8');
+  const start = src.indexOf('if [ -z "${GDS_SESSION:-}" ]; then');
+  const endMark = 'GDS_SESSION="${GDS_SESSION:-$HOME/.config/otb/gds-session.json}"';
+  const end = src.indexOf(endMark, start);
+  assert.ok(start !== -1 && end !== -1, `could not locate the resolver block in ${f}`);
+  return src.slice(start, end + endMark.length);
+}
+
+test('the resolver prefers the most recently written session across config dirs', (t) => {
+  const probe = bash(['-n', 'infra/box-report-version.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-'));
+  const legacy = path.join(home, '.config', 'otb');
+  const configured = path.join(home, '.config', 'cloudbongos');
+  fs.mkdirSync(legacy, { recursive: true });
+  fs.mkdirSync(configured, { recursive: true });
+  fs.writeFileSync(path.join(legacy, 'gds-session.json'), '{"token":"stale"}');
+  fs.writeFileSync(path.join(configured, 'gds-session.json'), '{"token":"fresh"}');
+  // Make the legacy copy unambiguously older than the freshly re-authed one.
+  const old = new Date(Date.now() - 60_000);
+  fs.utimesSync(path.join(legacy, 'gds-session.json'), old, old);
+
+  const block = resolverBlock('box-report-version.sh');
+  const run = (env) => spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: home, ...env } });
+
+  // 1. the freshly written session wins over the stale legacy one
+  assert.equal(run({}).stdout, path.join(configured, 'gds-session.json'));
+
+  // 2. an explicit override still beats the scan
+  assert.equal(run({ GDS_SESSION: '/explicit/path.json' }).stdout, '/explicit/path.json');
+
+  // 3. with nothing on disk it falls back to the historical path, so the caller's
+  //    "no session at ..." message still names somewhere sensible
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-empty-'));
+  const r3 = spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: empty } });
+  assert.equal(r3.stdout, path.join(empty, '.config', 'otb', 'gds-session.json'));
+
+  fs.rmSync(home, { recursive: true, force: true });
+  fs.rmSync(empty, { recursive: true, force: true });
+});
+
+// box-heartbeat.sh is the odd one out: its override variable (OTB_GDS_SESSION) is
+// NOT the variable it resolves into (SF). A first cut of the fix guarded on the
+// override but assigned to SF, so a caller that SET the override had it silently
+// dropped and fell through to the legacy default — the exact bug being fixed,
+// reintroduced through the back door. Pin all three branches.
+test('box-heartbeat.sh honors OTB_GDS_SESSION, scans, then falls back', (t) => {
+  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+
+  const src = fs.readFileSync(path.join(INFRA, 'box-heartbeat.sh'), 'utf8');
+  const start = src.indexOf('SF="${OTB_GDS_SESSION:-}"');
+  const endMark = 'SF="${SF:-$HOME/.config/otb/gds-session.json}"';
+  const end = src.indexOf(endMark, start);
+  assert.ok(start !== -1 && end !== -1, 'could not locate the SF resolver in box-heartbeat.sh');
+  const block = src.slice(start, end + endMark.length);
+
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-'));
+  const configured = path.join(home, '.config', 'cloudbongos');
+  fs.mkdirSync(configured, { recursive: true });
+  fs.writeFileSync(path.join(configured, 'gds-session.json'), '{"token":"fresh"}');
+
+  const run = (env, h = home) => spawnSync('bash',
+    ['-c', `set -euo pipefail\n${block}\nprintf '%s' "$SF"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: h, ...env } }).stdout;
+
+  assert.equal(run({ OTB_GDS_SESSION: '/explicit/override.json' }), '/explicit/override.json',
+    'the OTB_GDS_SESSION override must win — guarding on it but assigning elsewhere drops it');
+  assert.equal(run({}), path.join(configured, 'gds-session.json'));
+
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-empty-'));
+  assert.equal(run({}, empty), path.join(empty, '.config', 'otb', 'gds-session.json'));
+
+  fs.rmSync(home, { recursive: true, force: true });
+  fs.rmSync(empty, { recursive: true, force: true });
+});

package/tests/search_isolation.mjs

@@ -143,7 +143,10 @@ console.log('\nLayer C — real searchChunks against a live DB (skips if unreach
 
 let pool = null;
 try {
-  ({ pool } = require('../src/db'));
+  // task 1003207: this said `../src/db`, which has not existed since the kernel
+  // carve — so the require ALWAYS threw, pool stayed null, and Layer C skipped
+  // even against a live Postgres. It was a dead layer reporting as a skip.
+  ({ pool } = require('../src/bongos/pool'));
 } catch { pool = null; }
 
 async function dbReachable() {