@bongos/core 1.19.335 → 1.19.337

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.335",
-  "core_contract": "1.19.335",
-  "source_commit": "b5f2b884a9011be30bffe5bbd62c272a7497314a",
+  "core_version": "1.19.337",
+  "core_contract": "1.19.337",
+  "source_commit": "a1079dd09b8ae45b780cdcab81eb44696be21f01",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T00:51:04.860Z",
+  "built_at": "2026-08-25T01:01:18.995Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 325,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1490,
+    "functional_verbatim": 1483,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1837,
-  "tree_sha256": "9792847e3608bc598acfe751efe68d1e8cbb5b0ab10a19490cf2f325db36a44c",
+  "file_count": 1830,
+  "tree_sha256": "39cc259330321323f293c3d933377998d7c3cf229570269ccbf77fa1bef52857",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -287,7 +287,7 @@
     {
       "path": ".devcontainer/post-create.sh",
       "mode": "0000644",
-      "sha256": "db5db43fc7a692008eb1f70c6bec4345d6812939e9f09b302e2692621bbaece9"
+      "sha256": "69aef5fb55abc1bcd7c5f437df9bf7a38459eb52e1e4cc687b81d801f9c911ab"
     },
     {
       "path": ".dockerignore",
@@ -472,12 +472,12 @@
     {
       "path": "docs/adr/0011-terrain-id-rendering-model.md",
       "mode": "0000644",
-      "sha256": "68e9189dd2d99428b599d02011f8c88649151e9acaf9d8912c98b231eed4507e"
+      "sha256": "b3c9291fda6fd5e19601a9b79a97359682d26bb316b357f28db12dbb281d79cf"
     },
     {
       "path": "docs/adr/0012-ground-object-cell-split.md",
       "mode": "0000644",
-      "sha256": "bb26e441c48117377bbd451ea679a864bd58d5ac3a3a775cf20bc7219e5090e1"
+      "sha256": "a724bcd8c583d7f53515809da27202a7e512bad7862a8f77c8d8bd07c001792d"
     },
     {
       "path": "docs/adr/0013-paths-as-object-overlays-with-autotile-dispatch.md",
@@ -2987,7 +2987,7 @@
     {
       "path": "modules/economy/achievements.js",
       "mode": "0000644",
-      "sha256": "387c37df8b65bab755e8f006722e6665d9e5aafea29eabf868d1e2dfc4720e99"
+      "sha256": "fc270efbe9439442d2f51490a8a292313e3f66c7b5d33c28cd9e7f929f56b307"
     },
     {
       "path": "modules/economy/cost-classify.js",
@@ -3007,7 +3007,7 @@
     {
       "path": "modules/economy/credits.js",
       "mode": "0000644",
-      "sha256": "7c42fc848a1b7139d7ffa59cc3d81d89db84329b7beae9d5b8c5bc0afefc6f41"
+      "sha256": "a3d9d82cb5f19fdb8520c4df74022219886c767ae626dccf27728e07bf6d36f2"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -3019,6 +3019,11 @@
       "mode": "0000644",
       "sha256": "b8b3a4add551b32bc625dca0390afc2176dcd9e433b24d21128dd6e249e70623"
     },
+    {
+      "path": "modules/economy/policy.js",
+      "mode": "0000644",
+      "sha256": "cc953acd69f844d158c3a79ea4de3b12d652ea0247c878c6a6c33d5abf68eab3"
+    },
     {
       "path": "modules/economy/reward.js",
       "mode": "0000644",
@@ -4422,7 +4427,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "8bd43d1101599f5ff838641a9cbaa9bfd208eea4a3c7876f45ac034a8bf3b5d0"
+      "sha256": "b9762b6b76d4ee7f57a3a8c37f126eb768ff8c90e194a575dddc7704a534062d"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4722,12 +4727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c3a2cfd45a78396f4f7186492cf625a2351f4dfd78c0d82dbffc4217db97a68d"
+      "sha256": "6e1f14fea8a5dac393261b47a9563eabca0bda30f2c9a6d56f22e17f548c42aa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9896b1417474da8bf8b09e8dd188455d6d75b5e95602c7409a81ea17ee6e4cc3"
+      "sha256": "b3c8163bb92a02b01ca2ec14a46b8b1b3c25f1e6ae25001b0fea4a2303820713"
     },
     {
       "path": "public-docs/index.html",
@@ -5377,7 +5382,7 @@
     {
       "path": "scripts/gds/fitness-checks-identity.js",
       "mode": "0000644",
-      "sha256": "5d731cf4703ca47be3dfd272f4bc74f6f49471f6b027474285cca4221fac47d5"
+      "sha256": "f87265779d60ae2d642e370f7af2d1d70fa6a1354a7389835d887b0dfe3c5dfc"
     },
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
@@ -5397,7 +5402,7 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "3f32080357abdecb0f0860c5c9313f12283f01774c8367ac22c1c12d0d176411"
+      "sha256": "1732691382d3ec82f4f59b44250fce6367179a44283395dc92c78cfd67493ed2"
     },
     {
       "path": "scripts/gds/fitness.js",
@@ -5802,7 +5807,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "c96e50e533f4e20dba91c6a26ac6efd2c6ad33ffcdc856eeb46af21a17e67975"
+      "sha256": "b3d816af249491e6187676ad084a60aaa72881615f8824a0263c31505d57a149"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5949,11 +5954,6 @@
       "mode": "0000644",
       "sha256": "14825fa0500e600efcc518e7120dd4b64fdae9235509e7a39d3865f179754f5f"
     },
-    {
-      "path": "scripts/gds/seed-v3-tasks.js",
-      "mode": "0000644",
-      "sha256": "a0d8c1530cfc80f5604fb4d520d131daa2a9001f0a28f5e184dd0386034af6e0"
-    },
     {
       "path": "scripts/gds/sequence.js",
       "mode": "0000644",
@@ -6239,26 +6239,6 @@
       "mode": "0000644",
       "sha256": "5860bf9daef3dd83a5ff4d3ee5e017e3cbd465ebda0c00df4ca622d629468ec4"
     },
-    {
-      "path": "scripts/snapshots/backfill-history.mjs",
-      "mode": "0000644",
-      "sha256": "536c5dce00bb8fc04d895396dfe593cfef1317c6d5666d76a0e0586f08f08987"
-    },
-    {
-      "path": "scripts/snapshots/maybe-render-on-deploy.sh",
-      "mode": "0000644",
-      "sha256": "e8392d7dc47f583c75acdf87bdd8ba9cae19fd348dd8f559802955690938545d"
-    },
-    {
-      "path": "scripts/snapshots/render-pre-art-eras.mjs",
-      "mode": "0000644",
-      "sha256": "a5e5498067075212e7a38eda2faf1d4cdf5f98421a71bed85e46a2c0f9dc882c"
-    },
-    {
-      "path": "scripts/snapshots/render-world.mjs",
-      "mode": "0000644",
-      "sha256": "deb5f6169f53771bc119cdbaa3164112b8cf480b49c1adf0d65914b7c96ee84f"
-    },
     {
       "path": "scripts/status-mirror-sync.js",
       "mode": "0000644",
@@ -6577,7 +6557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "490504c9d10309b811026a035d5999360cbe00b8eb912bb8c4d0873c8271cff2"
+      "sha256": "8ffe1c3c3683e95f182da6cad74272574cbe1a2d94a9b959221cc71084c1b8d3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6654,11 +6634,6 @@
       "mode": "0000644",
       "sha256": "125edcec8c7d7536365b9675daa1fceb9fe072a30e2a4a68ee2911cd258a8c10"
     },
-    {
-      "path": "tests/anti_grid.mjs",
-      "mode": "0000644",
-      "sha256": "2d78ef9e446efa0aa66e716b362d72432024773b28d94f5768bcbaaf79c99dad"
-    },
     {
       "path": "tests/api_cli_flags.mjs",
       "mode": "0000644",
@@ -6824,16 +6799,6 @@
       "mode": "0000644",
       "sha256": "034114a63f2d8a431755f6cf35a7e66b1cbb3b7931bb251e3a8f235ff5057e29"
     },
-    {
-      "path": "tests/autotile_variants.mjs",
-      "mode": "0000644",
-      "sha256": "0cd3167548071272f13a3072a87d6071c46540a1fc0f810ca4584ac3f93693f6"
-    },
-    {
-      "path": "tests/autotile_xverify.mjs",
-      "mode": "0000644",
-      "sha256": "4986f25a93ef89f0312eeb1f4ff32cd82e2f8e7bcc9749143443537e734d5193"
-    },
     {
       "path": "tests/backfill_sessions.mjs",
       "mode": "0000644",
@@ -8492,7 +8457,7 @@
     {
       "path": "tests/provisioning_github_app_routes.mjs",
       "mode": "0000644",
-      "sha256": "fce4837d4882dcd980bc144a2afeaf04fbce99aa31d7d1a72a277bad0ebfae99"
+      "sha256": "dd53361cf8bd7e517e886701753d64c05c3235995785991558805f493cde529c"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
@@ -8712,7 +8677,7 @@
     {
       "path": "tests/search_isolation.mjs",
       "mode": "0000644",
-      "sha256": "4832744832280a72cc84b8c4b7a4b836612fbec733972bedaa1810124a90de8b"
+      "sha256": "21a352003eac3ef3975aecf758163bd90fb58c34daef643055b2423ea2ffdc17"
     },
     {
       "path": "tests/search_route.mjs",

package/.devcontainer/post-create.sh

@@ -102,13 +102,9 @@ echo
 
 # --- 3. Full-stack verification -----------------------------------------------
 say "4/4  Verifying the box is ready"
-# sharp: the native image dep — proves npm ci produced a working binary on this
-# arch (x64 or arm64).
-if node -e "require('sharp'); console.log('sharp', require('sharp/package.json').version)" >/dev/null 2>&1; then
-  echo "  ${green}ok${reset}  sharp loads ($(node -e "console.log(require('sharp/package.json').version)" 2>/dev/null))"
-else
-  echo "  ${yellow}!!${reset} sharp failed to load — the game/art build will break"
-fi
+# sharp was verified here as "the native image dep". Task 1003207 removed it: its
+# only consumers were the game-era snapshot renderers and an art-pipeline test,
+# all of which left this core with the game. Nothing native remains to prove.
 # The five art libs must import in the venv.
 if python3 -c "import PIL, numpy, scipy, sklearn, certifi" >/dev/null 2>&1; then
   echo "  ${green}ok${reset}  art libs import (Pillow, numpy, scipy, scikit-learn, certifi)"

package/docs/adr/0011-terrain-id-rendering-model.md

@@ -94,7 +94,8 @@ chooses the foam variant at the boundary. One less hand-tuned terrain
 in the map.
 
 A Python↔JS cross-verification smoke test
-([`tests/autotile_xverify.mjs`](../../tests/autotile_xverify.mjs) plus
+(`tests/autotile_xverify.mjs` — deleted by task 1003207 with the rest of the
+game-era art pipeline; named here as the historical record, not a live file — plus
 its emitter [`art/pipeline/autotile_xverify.py`](../../art/pipeline/autotile_xverify.py))
 asserts that all 256 blob47 inputs and all 16 path16 inputs map to the
 same tile index in both implementations. Wired into

package/docs/adr/0012-ground-object-cell-split.md

@@ -113,7 +113,8 @@ server module directly to guard against drift.
 ### Cross-verify safety
 
 The Python↔JS autotile lookup table cross-verifier
-([`tests/autotile_xverify.mjs`](../../tests/autotile_xverify.mjs))
+(`tests/autotile_xverify.mjs`, deleted by task 1003207 with the game-era art
+pipeline — named here as the historical record, not a live file)
 tests `selectBlob47` / `selectPath16` directly — unchanged by this
 ADR. Picker behavior change is captured in the new
 [`tests/terrain_picker.mjs`](../../tests/terrain_picker.mjs), which

package/modules/economy/achievements.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { SUBTRACTOR_THRESHOLD } = require('./policy');
+
 // Achievement evaluation — runs inside existing DB transactions so unlocks
 // are atomic with the action that triggered them.
 //
@@ -318,10 +320,9 @@ async function eligible_breaking100c(client, builderId) {
 
 async function eligible_subtractor(client, builderId) {
   // Mirror credits.awardNetNegativeBonus: subtractor unlocks at SUBTRACTOR_THRESHOLD
-  // net-negative ship bonuses. Lazy-require the threshold (credits.js requires
-  // this module, so a top-level require would be circular — same lazy pattern
-  // renderProgressText uses for ./streak).
-  const { SUBTRACTOR_THRESHOLD } = require('./credits');
+  // net-negative ship bonuses. The threshold used to be lazy-required from
+  // credits.js to dodge a circular import; task 1003207 moved it to ./policy.js,
+  // which both files read, so the cycle is gone rather than deferred.
   const r = await client.query(
     `SELECT COUNT(*)::int AS n FROM credit_log
       WHERE builder_id = $1 AND reason = 'ship.net_negative'`,

package/modules/economy/credits.js

@@ -712,7 +712,9 @@ async function awardSessionTokenReward(client, builderId, sessionId, modelUsage,
 // ship's bonus row is inserted — and that insert lives here. Doing the unlock
 // inline keeps the read-then-unlock atomic with the insert in one transaction.
 const NET_NEGATIVE_BONUS = 1;
-const SUBTRACTOR_THRESHOLD = 3; // net-negative ships needed to unlock Subtractor
+// task 1003207: moved to ./policy.js so achievements.js can read it without a
+// lazy require back into this file (that circularity was a tracked cycle).
+const { SUBTRACTOR_THRESHOLD } = require('./policy');
 function netNegativeBonusAmount(diffStats) {
   if (!diffStats) return 0;
   const added = Number(diffStats.lines_added) || 0;

package/modules/economy/policy.js

@@ -0,0 +1,22 @@
+// modules/economy/policy.js — economy policy constants that BOTH the credit
+// writers and the achievement predicates need.
+//
+// Extracted by task 1003207 (goal 1000079) to break a genuine require cycle:
+// credits.js requires achievements.js at load, and achievements.js needed
+// SUBTRACTOR_THRESHOLD back from credits.js. The workaround was a lazy
+// require() inside the function body, with a comment explaining the circularity
+// — a cycle papered over rather than removed, and one of the five the
+// require_cycle_count ratchet was holding.
+//
+// A shared constant is the honest seam: the threshold is neither a credit-writing
+// concern nor an achievement concern, it is the POLICY both read. credits.js
+// still re-exports it, so no caller outside this module changed.
+
+'use strict';
+
+// Net-negative ships needed to unlock Subtractor. Read by credits.js when it
+// awards the bonus, and by achievements.js when it decides the badge is earned —
+// the two must agree, which is why it lives in one place.
+const SUBTRACTOR_THRESHOLD = 3;
+
+module.exports = { SUBTRACTOR_THRESHOLD };

package/modules/provisioning/routes/provisioning.js

@@ -144,7 +144,9 @@ code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rg
 // land. Deliberately contains NO backticks and NO ${...} so it survives the outer
 // template literal verbatim; the only server data it reads is the JSON config block
 // written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
-// manual "open" button rather than ever falsely erroring.
+// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
+// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
+// the founder here with the door and a way back to the checklist (task 1003236).
 const CALLBACK_SCRIPT = `
 (function(){
   var cfg=window.__CB_SETUP__||{};
@@ -153,12 +155,18 @@ const CALLBACK_SCRIPT = `
   var target='https://'+domain;
   var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
   var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
-  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot');
+  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
+  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
+     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
+     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
+  var popup=!!window.opener||window.name==='ghAppSetup';
   var finished=false,tries=0,manual=false;
   function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
   function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
   function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
-  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
+  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
+    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
+    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
   function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
   function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
   function schedule(){if(!finished)setTimeout(poll,3000);}
@@ -195,6 +203,7 @@ function callbackPage({ ok, title, body, state, domain }) {
   </div>
   <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
   <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
+  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
   <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
   <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
 </main>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.335",
+  "version": "1.19.337",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.335",
+      "version": "1.19.337",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.335",
+  "version": "1.19.337",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-identity.js

@@ -101,7 +101,6 @@ const IDENTITY_SCAN_ALLOWED = {
   // when the monolith was split, so the detector's self-carve-out moved with them.
   'scripts/gds/fitness-checks-identity.js': 2,
   'scripts/gds/package-core.js': 1,
-  'scripts/gds/seed-v3-tasks.js': 14,
   // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
   // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
   // now resolves its database from the branding pack (the migrate.sh pattern) and

package/scripts/gds/fitness-ratchets.js

@@ -143,9 +143,19 @@ function requireGraph(contentsByFile) {
   const edges = new Map();
   for (const [file, text] of contentsByFile) {
     const deps = [];
-    for (const m of text.matchAll(REQUIRE_RE)) {
-      const target = resolveRelative(file, m[2], exists);
-      if (target && target !== file) deps.push(target);
+    // Scan line by line and skip WHOLE-LINE comments. A comment that merely
+    // NAMES a require — "// re-exports every name, so no require('./db') call
+    // site had to change" — used to create a phantom edge, and during the task
+    // 1003204 carve one such header comment on twelve new files fabricated a
+    // twelve-file cycle and reddened CI. Only a `//`- or `*`-leading line is
+    // dropped, so an inline trailing comment still counts, which is the safe
+    // direction: a missed real edge would hide a cycle.
+    for (const line of text.split('\n')) {
+      if (/^\s*(\/\/|\*)/.test(line)) continue;
+      for (const m of line.matchAll(REQUIRE_RE)) {
+        const target = resolveRelative(file, m[2], exists);
+        if (target && target !== file) deps.push(target);
+      }
     }
     edges.set(file, deps);
   }

package/scripts/gds/run-unit-tests.js

@@ -49,7 +49,11 @@ const MODULE_TESTS = {
     'terrain_picker', 'local_preview',
   ],
   'art-pipeline': [
-    'anti_grid', 'autotile_variants', 'autotile_xverify', 'art_key', 'art_stage',
+    // task 1003207 deleted anti_grid / autotile_variants / autotile_xverify — the
+    // art pipeline is not a module of this core any more, so they targeted a
+    // directory that no longer exists. art_key / art_stage still gate on the
+    // module being enabled, which is what this map is for.
+    'art_key', 'art_stage',
   ],
 };
 
@@ -116,21 +120,17 @@ const INTEGRATION = new Set([
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):
-//   - autotile_variants / autotile_xverify: depend on a python-generated artifact
-//     (modules/art-pipeline/pipeline/_autotile_tables.json) / build output absent in a fresh clone,
-//     so they exit non-zero standalone. Belong in an art-pipeline gate, not here.
-//   - anti_grid: runs modules/art-pipeline/pipeline/anti_grid_eval.py, which needs numpy (absent in
-//     the Node-only CI runner) -> ModuleNotFoundError. Same python-artifact class
-//     as autotile; belongs in an art-pipeline gate (task 859 / ADR 0042 cutover).
+//   - autotile_variants / autotile_xverify / anti_grid were parked here because they
+//     needed modules/art-pipeline artifacts. Task 1003207 DELETED all three: the
+//     art pipeline left this core with the game, so they targeted a module that no
+//     longer exists and could never have gone green again. A permanently-parked
+//     test is not a gate, it is a file that looks like one.
 //
 // grader_panel was excluded here (2 "failing" assertions, idea #225) until #954
 // (V4.R16) diagnosed them as STALE — they predated #481's Narc-advisory change,
 // NOT a grader regression. Now green and back under this gate so the quality-
 // gate brain can't silently regress.
 const KNOWN_FAILING = new Set([
-  'autotile_variants',
-  'autotile_xverify',
-  'anti_grid',
   // #1002617: red in every clean environment (Linux CI and a Windows checkout
   // alike), surfaced by the unit lane's first-ever runs. Parked so the `unit`
   // check can be required (a gate that's already red gates nothing); per-test

package/src/module-api.js

@@ -1097,8 +1097,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.333 with no explicit bump. run 32794305277. (task 1002620)
 //   1.19.335 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.334 with no explicit bump. run 32795232997. (task 1002620)
+//   1.19.336 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.335 with no explicit bump. run 32795564021. (task 1002620)
+//   1.19.337 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.336 with no explicit bump. run 32795896926. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.335'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.337'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_github_app_routes.mjs

@@ -11,10 +11,13 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
-const ROOT = new URL('..', import.meta.url).pathname;
+// fileURLToPath, not .pathname: a checkout path with a space reads back percent-encoded
+// (and drive-prefixed) from .pathname on Windows, and require() cannot follow it
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
 
 // Stub the data-access fns BEFORE the route factory captures the module object.
 const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
@@ -92,6 +95,42 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   const html = await res.text();
   t('good state → 200 text/html progress page wired to auto-open', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /Setting up your instance/.test(html) && /Placing credentials/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   t('the page names the instance host', /mercury\.example\.com/.test(html));
+  // task 1003236: a same-tab return (pop-up blocked → form target=_self) must never be
+  // navigated away from the checklist. The page carries a hidden way back, and the
+  // countdown sits behind the pop-up guard.
+  t('carries a hidden "finish your remaining setup steps" link back to the wizard', /<p class="muted hidden" id="back"><a href="\/projects\?view=new">Finish your remaining setup steps/.test(html));
+  t('the auto-open countdown is reachable only past the pop-up guard', /var popup=!!window\.opener\|\|window\.name==='ghAppSetup';/.test(html) && /if\(!popup\)\{[^}]*return;\}\s*var n=4;\(function tick\(\)\{if\(n<=0\)\{location\.href=target;/.test(html) && (html.match(/location\.href=target/g) || []).length === 1);
+
+  // Run the served script itself (not a copy) against a minimal DOM, once as the
+  // wizard's pop-up and once as a same-tab return, and watch what it does to location.
+  const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
+  t('the progress page ships the client script', typeof script === 'string' && script.length > 200);
+  async function runCallback({ opener, name }) {
+    const vm = await import('node:vm');
+    const el = () => { const cls = new Set(); return { textContent: '', classList: { add: (...c) => c.forEach((x) => cls.add(x)), remove: (...c) => c.forEach((x) => cls.delete(x)), contains: (c) => cls.has(c) }, querySelector: () => el() }; };
+    const els = { steps: el(), status: el(), cta: el(), go: el(), foot: el(), back: el() };
+    els.steps.querySelector = () => el();
+    els.back.classList.add('hidden'); els.cta.classList.add('hidden');
+    const timers = [];
+    const sandbox = {
+      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com' },
+      opener, name,
+      document: { getElementById: (id) => els[id] || null },
+      location: { pathname: '/api/bongos/provisioning/github-app/callback', href: 'about:callback' },
+      fetch: async () => ({ ok: true, json: async () => ({ ok: true, ready: true, status: 'done' }) }),
+      setTimeout: (fn) => { timers.push(fn); return timers.length; },
+      encodeURIComponent,
+    };
+    sandbox.window = sandbox;
+    vm.runInNewContext(script, sandbox);
+    for (let i = 0; i < 5; i++) await new Promise((r) => setImmediate(r)); // let the poll's promise chain settle
+    for (let guard = 0; guard < 10 && timers.length; guard++) { const fn = timers.shift(); fn(); }
+    return { href: sandbox.location.href, go: els.go.textContent, backHidden: els.back.classList.contains('hidden'), foot: els.foot.textContent };
+  }
+  const popup = await runCallback({ opener: {}, name: 'ghAppSetup' });
+  t('as the wizard’s pop-up it still counts down and opens the instance', popup.href === 'https://mercury.example.com', JSON.stringify(popup));
+  const sameTab = await runCallback({ opener: null, name: '' });
+  t('as a same-tab return it stays put: door shown, way back revealed, no navigation', sameTab.href === 'about:callback' && sameTab.go === 'Open mercury.example.com →' && sameTab.backHidden === false && /checklist is waiting/.test(sameTab.foot), JSON.stringify(sameTab));
 }
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);

package/tests/search_isolation.mjs

@@ -143,7 +143,10 @@ console.log('\nLayer C — real searchChunks against a live DB (skips if unreach
 
 let pool = null;
 try {
-  ({ pool } = require('../src/db'));
+  // task 1003207: this said `../src/db`, which has not existed since the kernel
+  // carve — so the require ALWAYS threw, pool stayed null, and Layer C skipped
+  // even against a live Postgres. It was a dead layer reporting as a skip.
+  ({ pool } = require('../src/bongos/pool'));
 } catch { pool = null; }
 
 async function dbReachable() {