@bongos/core 1.19.342 → 1.19.343

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.342",
-  "core_contract": "1.19.342",
-  "source_commit": "8762dcc095daf67a6ebc7d8f67bee76335f6d718",
+  "core_version": "1.19.343",
+  "core_contract": "1.19.343",
+  "source_commit": "5c168bafbc0d541f30c65cfec7805745bebee25f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T01:51:12.583Z",
+  "built_at": "2026-08-25T01:53:23.065Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 326,
+    "docs_redacted": 327,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1487,
+    "functional_verbatim": 1489,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1835,
-  "tree_sha256": "77392f5c78b2253320505f4775d1f72a1dfe9c6c07fb3120ca3cbb91c9a8727d",
+  "file_count": 1838,
+  "tree_sha256": "dc54f604edbfff9d11a92f6ebc16d5d66a0cdb7763a5bfc8b9aae48481dea3d7",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1424,10 +1424,15 @@
       "mode": "0000644",
       "sha256": "4feacf7bc809cdff1a23a1ef5b57d5d28aa448b80bd1ad24fc70860c0fe6739f"
     },
+    {
+      "path": "docs/adr/0189-baseline-floors-and-the-freeze-detector.md",
+      "mode": "0000644",
+      "sha256": "3067e87c4a2a1d63cb7b16526314b643f1940c4333cafe36627cd9bb5a293c0c"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "4c736c015e635ed0b4e78445f35acbd8b84a14708634e5caf4a957357b1e22b9"
+      "sha256": "06421240d64adf0e3058cafd2a5ddd8281c1b7c103f532aa22e76cab10a71170"
     },
     {
       "path": "docs/api-reference.md",
@@ -4732,12 +4737,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c98fa68956d00010ef831bab66ad73939ee7b86b61a95c2512d4c98b2d284823"
+      "sha256": "eef73b9771578d1077947c10da76b7f5c489104e905467f552e1174a0f33456c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6cd5475e1b29d9ba180f44e88c824eb38291945b3122ae22ff948e481333e513"
+      "sha256": "7acbbd119d4aba33fb6ec0a9bd7d60af7695efc2c4b71ababc6532be40dd1197"
     },
     {
       "path": "public-docs/index.html",
@@ -5154,6 +5159,11 @@
       "mode": "0000644",
       "sha256": "0983e3a8b36c8e93d65ef1baa9fec9197e02425d411779752909e3656965f5c2"
     },
+    {
+      "path": "scripts/gds/baseline-staleness.js",
+      "mode": "0000644",
+      "sha256": "8a5d2b6578f1fe83e97fd112620ea643571441d8c196d74659284014df067f48"
+    },
     {
       "path": "scripts/gds/bfg-principal-token.js",
       "mode": "0000644",
@@ -5267,7 +5277,7 @@
     {
       "path": "scripts/gds/control-manifest.js",
       "mode": "0000644",
-      "sha256": "6c9538a110e45a184531e3ddd7725a8307da823411ef71f0d0b575dd3ee9571b"
+      "sha256": "270101b46772cc8e280bc5a36f66cfae578a901f07b4b5e1f959c9a566ebb5fd"
     },
     {
       "path": "scripts/gds/copy-inventory.js",
@@ -5407,12 +5417,12 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "1732691382d3ec82f4f59b44250fce6367179a44283395dc92c78cfd67493ed2"
+      "sha256": "fa16d4c62a16b7827fe82d556dd6a5de327362ba17fc54cc9d86e1d34e2a45f5"
     },
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "925006ed968209632b20677d05594158ebc27e65229d96a7d69a53baf93f6ed0"
+      "sha256": "b07c9489b073233d5e3a83bb59a7ebda0fc1a2bd0defcd3d5a69efc77ff24b86"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5782,7 +5792,7 @@
     {
       "path": "scripts/gds/redteam-patrol.js",
       "mode": "0000644",
-      "sha256": "7460ee330a6bc53176a6ab83cb1019d50fe7d872d8a5bf31486e87edc86059af"
+      "sha256": "b47919e09dae54b94a9f90c81bf535c00918dbd916f0d51c4bc29517dec9f7e9"
     },
     {
       "path": "scripts/gds/regen-instance-docs.js",
@@ -6572,7 +6582,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f26225c679194161265e5994e72566604610a0e41a4a2270579cfa6fbce3d0a2"
+      "sha256": "ebd235444356b82184e91bd8a416c9e0a401d83c550d855aace738d57c142026"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6829,6 +6839,11 @@
       "mode": "0000644",
       "sha256": "ba91d6431c1a579ec078f2aa64265d8afbf97ac635b5cb408d06b8bae93e4b71"
     },
+    {
+      "path": "tests/baseline_staleness.mjs",
+      "mode": "0000644",
+      "sha256": "44a2469b0f18c62fab6d9b3fe5a5125b8a9a351b5b1b48cb88cd812994d86b10"
+    },
     {
       "path": "tests/bfg.mjs",
       "mode": "0000644",

package/docs/adr/0189-baseline-floors-and-the-freeze-detector.md

@@ -0,0 +1,106 @@
+# 0189 — A frozen baseline must justify itself: declared floors and the freeze-forever detector
+
+- **Status:** Accepted
+- **Date:** 2026-08-24
+- **Tasks:** [#1003210](https://cloudbongos.com/builders#/task/1003210) (goal 1000079 — criterion C4 `reduction-durable`)
+- **Builds on:** [ADR 0180](<redacted>.md) (shrink-only baselines), [ADR 0188](<redacted>.md) (the weekly patrol that now files this)
+- **Related:** [ADR 0091](<redacted>.md) §2 (the boundary-forced duplication that gets the first declared floor), [ADR 0162](<redacted>.md) (findings are advisory)
+
+## 1. Context
+
+`config/fitness-baselines.json` is a shrink-only ratchet: a metric may never
+exceed its baseline, and lowering one is how debt gets paid down. It makes
+regression impossible.
+
+It also makes standing still invisible. The follow-up audit measured the file at
+*"every metric equal to baseline, 0 reduced"* — and the ratchet reported a clean
+**PASS**, because that is what it is for. The same green covers the team actively
+paying debt down and nobody having looked in a year:
+
+> A shrink-only baseline that never shrinks is indistinguishable from unmanaged debt.
+
+The ratchet has no concept of time, so it cannot tell those apart. Nothing else
+did either.
+
+## 2. Decision
+
+### 2.1 Age comes from git, never from a stored timestamp
+
+A `since:` field beside each metric would be faster and hermetic. It would also
+be the field that silently stops being updated — leaving old debt looking
+permanently fresh. That is *worse* than no check, because it produces confident
+green. Git history cannot be forgotten. Where history is unavailable (a shallow
+clone), the age is reported **UNKNOWN**, never fresh — the `main-audit.js
+--require-roster` doctrine.
+
+A metric's age is the date of the **oldest commit still carrying its current
+value**; a metric present unchanged in every commit dates to its introduction,
+which is exactly the "recorded once and never revisited" case being hunted.
+
+### 2.2 A metric may declare a FLOOR, and a floor must say why
+
+The naive check — flag anything unmoved for N weeks — fires forever on metrics
+that are *finished*. `require_cycle_count: 4` is four deliberate lazy requires
+with written rationale. `duplicate_window_count` cannot go below ~28 because that
+much duplication is forced by the module boundary (ADR 0091 §2); merging the two
+files would break ADR 0083. Nagging weekly about those is how a check becomes one
+everybody skips.
+
+So a metric may declare `floors: { name: { value, why } }`, and a metric **at its
+floor is done, not stale**. The `why` is mandatory and length-checked: a floor
+exempts a metric from the clock permanently, so it must be a written, reviewable
+claim. That is the whole point — **silence was the problem**, and this replaces
+silence with a sentence someone can disagree with.
+
+A floor exempts only *down to* the floor. `duplicate_window_count` is 59 with a
+floor of 28, so the ~31 reducible windows keep counting against the clock. A
+floor is not a blanket pardon.
+
+### 2.3 Two severities, split by whose fault it is
+
+| what | where | severity |
+|---|---|---|
+| a floor names a metric that doesn't exist; a floor has no reason; a floor the metric already dropped below | merge gate (fitness Check 26) | **hard fail** |
+| a metric above its floor unmoved for > 8 weeks | fitness **warning** + weekly patrol report | advisory |
+
+Declaration rot is hermetic, needs no git, and is caused by the diff at hand —
+that is what a merge gate is for. **Age is nobody's diff.** Failing a PR because
+ambient debt turned eight weeks old punishes whoever pushed next and gets the gate
+switched off. The audit asked for *"the repeatable, scheduled version"* of the
+review it had just done by hand, and the patrol is that: history-wide, time-based,
+filed for adjudication.
+
+Eight weeks (`BASELINE_STALE_DAYS`) is long enough that a metric anyone is
+actively working is never flagged.
+
+### 2.4 `--update-baselines` had to stop eating the file
+
+The refresh path wrote a fixed object literal — `{_comment: '<hardcoded>',
+metrics}` — so a single run silently destroyed the accumulated `_comment` that
+documents *why* each number sits where it does. Once floors live in the same file
+the stakes change: losing a floor turns a finished metric into permanent weekly
+noise **with its justification deleted from the repo**. The writer now recomputes
+only `metrics` and passes every other key through untouched.
+
+## 3. Consequences
+
+- Nothing is flagged today: the baseline file is six days old, so no metric can be
+  stale yet. This is a tripwire for the future, verified by shrinking the window
+  (a 1-day window flags four real metrics) rather than by waiting.
+- Paying a metric to its true limit now ends in a written floor rather than in the
+  metric quietly sitting at a number forever.
+- `duplicate_window_count`, `doc_stale_links`, `doc_broken_anchors`,
+  `doc_duplicate_prose`, `console_call_count` and `knip_issue_count` all carry no
+  floor, which is the correct claim: every one of them is still reducible.
+
+## 4. Alternatives rejected
+
+- **A stored `since:` per metric.** §2.1 — the field that stops being updated.
+- **Flag every unmoved baseline, no exemptions.** Weekly noise about finished
+  metrics; the check gets ignored, which is the failure it exists to prevent.
+- **A floor without a required reason.** Then a floor is just a mute-button, and
+  muting is exactly the silence this replaces.
+- **Hard-failing the merge gate on staleness.** Blocks unrelated work on ambient
+  debt age; the predictable outcome is the check being removed.
+- **Putting it only in the patrol.** A builder editing baselines would never see
+  declaration rot until the following Monday, when it is cheap to catch instantly.

package/docs/adr/README.md

@@ -262,5 +262,6 @@ This keeps the decision history honest and traceable.
 | 0186 | [**Per-project idea templates: the seam is already built; the economics are the open problem** ([task 1002932](https://cloudbongos.com/builders#/task/1002932), BV1.R156, goal 1000062 — a SPIKE, output is this ADR plus a task list, no implementation). The literal question — how does a founder define their own idea shape without a schema change or forking the scorer — is **already answered by shipped work**: R141 gave every template function an optional `registry` defaulting to the built-in one, so validation and scoring both read the declaration as data; `ideas_grades.template_key` is per-row with a format CHECK whose own comment says a project key "stays addressable"; and `provisioning_instances.settings jsonb` is an existing per-project home. **No schema change, no fork.** Decision A: a **`project-settings` kernel port**, sibling of `builder-settings`, read via `resolveOptional` so a vanilla instance with no provisioning module degrades to the built-in registry; `base-v1` stays the default and the fallback for an unresolvable key. Rejected a new `ideas_templates` table (second home for data that has one) and a config file (per-instance, but one instance hosts many projects). **Decision B is the finding that matters.** Completeness is normalised 0–100 WITHIN its template (mean of per-field ratios), while karma reads it against an absolute bar (`IDEA_FULL_PASS_BAR = 60`, `IDEA_FULL_PASS_CREDIT = 5`) — so template choice becomes a credit-minting lever: `base-v1` needs ~200 characters for 5 credits, a 1-field template with `substanceMin` 10 needs ~10, a ~20× arbitrage handed to exactly the projects this ADR empowers. Shipping A without B would make the feature a way to print credits. The fix separates the two questions one number is answering: **completeness stays relative** (it is the right signal for triage ordering and the hall meter) and **karma stops reading it**, switching to an absolute substance total the scorer already computes per field and currently discards after averaging. An interim guard (≥3 required fields, ≥120 total `substanceMin`) bounds the arbitrage without fixing it. Decision C: an optional per-field `weight` (default 1) turning the unweighted mean into a weighted one — today's behaviour is the all-weights-1 case, so it is a data addition and one arithmetic line. Decision D: the five base fields are **not** mandatory (forcing them would make "define your own" cosmetic), replaced by two constraints — a template must declare ≥1 required field, and a stored template is validated at WRITE time so a malformed one is refused there rather than discovered inside the capture path, which must never throw. **Boundary note:** goal 1000062's wall is `[ideas, hall-ui]`, so the port task (provisioning + kernel) and the karma task (economy) cannot be claimed under it.](<redacted>.md) | ideas / templates |
 | 0187 | [**The OAuth web-handshake cookies live 30 minutes, and move together** ([task 1003234](https://cloudbongos.com/builders#/task/1003234), goal 1000058). The three cookies `/auth/web/start` sets — the CSRF state, the validated return target, the repo-scope opt-in — were 10 minutes each, a hall builder's timescale; a founder's first sign-in can include a GitHub SIGNUP with email verification and came back past ten minutes to "State mismatch" with the return + repo scope gone, and the page's retry door was a bare start. Decision: one `HANDSHAKE_COOKIE_MS = 30 min` for all three (they MUST move together — a state outliving its return cookie lands on the default landing with no scope, a return outliving its state lands on State mismatch), and every OAuth error page plus the access-pending auto-walk-in rebuilds its door from whatever cookies are still valid (`recoveryStartHref`, through the same open-redirect allowlist). What did NOT change: the state is still single-use, still `httpOnly`/`sameSite=lax`/apex-scoped, the code still the bearer — only the window for a legitimate handshake grew. Rejected: lengthening only return + repos (keeps the dead end and breaks the one-lifetime invariant the other way), a server-side state store, sixty minutes. The Discord-link state cookie is a different flow and keeps 10.](<redacted>.md) | auth / security posture |
 | 0188 | [**The weekly patrol runs on CI, and a declared cadence must have something that fires it** ([task 1003209](https://cloudbongos.com/builders#/task/1003209), goal 1000079). Goal 1000076 shipped a weekly red-team patrol, a routine describing how to run it, a recipe, and a manifest row — and nothing ever ran it; the follow-up audit §7 named all three halves (no committed scheduler, no cadence for a scheduler to read, and a manifest green anyway because its wiring predicate was satisfied by the SKILL.md mentioning its own scanner). The symmetric fix — an in-process timer beside `peer-vote-tally` in `routine-timers.js` — is **wrong on correctness, not cost**: all three patrol checks read things only the REPO has (full git history, `.github/workflows/`, an auditable lockfile), and a deployed instance runs a VENDORED core out of `node_modules/@bongos/core` that has none of them, so the timer would have scanned nothing and reported clean — worse than unscheduled. The runner is therefore CI: a weekly Actions lane with `fetch-depth: 0` and a pinned, checksum-verified gitleaks (the missing binary the audit listed separately), invoking `run-routine.js redteam-weekly` so the SKILL.md's steps stay the single source of truth. `cadence:` becomes a real frontmatter field — declarative only, scheduler-agnostic. The load-bearing piece is `routine-schedule.js` (fitness Check 25), whose predicate is **relational, not existential**: it classifies the cron into the period it actually realizes and fails when that disagrees with the declared cadence — the one rot mode no substring or existence check can EVER see, since editing weekly→monthly leaves every "is it wired?" predicate green. The manifest row was re-pointed to match ("wired" now means the SCHEDULER names the routine). Finally the exit code says **a finding was LOST, not that a finding exists**: findings are advisory (ADR 0162), so filing three is a SUCCESS and red is reserved for findings that cannot be recorded — failing on findings would have gone red on run one and stayed there (the unrotated staging credential in `092e473` is a standing history hit), and an always-red weekly job is one nobody reads. Filing is credential-gated but OPTIONAL — with no session secret the patrol still runs and writes its findings to the job summary, which matters because this goal's C1 is about eliminating long-lived tokens, not adding one. Rejected: the in-process timer; teaching `routine-timers.js` generic cadence discovery (a scheduler built for nobody — its only candidate user cannot run there); failing whenever findings exist; requiring the secret; a deeper manifest predicate instead of a new check.](<redacted>.md) | security / enforcement durability |
+| 0189 | [**A frozen baseline must justify itself: declared floors and the freeze-forever detector** ([task 1003210](https://cloudbongos.com/builders#/task/1003210), goal 1000079). The shrink-only ratchet makes a quality metric unable to REGRESS and, by the same design, unable to sit still noticeably: the follow-up audit measured the whole file at "every metric equal to baseline, 0 reduced" and the ratchet reported a clean PASS, because one green covers both actively-paying-down and nobody-has-looked-in-a-year. The ratchet has no concept of time; this adds it. **Age comes from git, never a stored `since:` field** — a timestamp beside each metric would be faster and hermetic and would also be the field that silently stops being updated, leaving old debt permanently fresh-looking, which is worse than no check because it produces confident green; an unavailable history reports UNKNOWN, not fresh (the `--require-roster` doctrine). A metric's age is the date of the OLDEST commit still carrying its current value, so a baseline recorded once and never revisited dates to its introduction — exactly the case being hunted. **The half that matters is the declared floor.** The naive "flag anything unmoved for N weeks" fires forever on metrics that are FINISHED (`require_cycle_count`'s four deliberate lazy requires; the ~28 duplicate windows ADR 0091 §2 forces because a module may not import core), and a check that cries wolf weekly is one everyone learns to skip — the same alert-fatigue failure ADR 0188 §2.4 avoids. So a metric may declare `floors: {name: {value, why}}` and a metric AT its floor is done, not stale; the `why` is mandatory and length-checked, because a floor exempts a metric from the clock permanently and must therefore be a written claim someone can disagree with — **silence was the problem**, and a floor without a reason is just a mute button. A floor exempts only DOWN TO the floor, so `duplicate_window_count`'s 59-vs-28 keeps its ~31 reducible windows on the clock. **Two severities, split by whose fault it is:** declaration rot (a floor naming a dead metric, a floor with no reason, a floor the metric already dropped below) is hermetic and caused by the diff at hand, so it HARD-FAILS the merge gate; staleness is nobody's diff and would punish whoever pushed next, so it warns in fitness and is FILED weekly by the patrol — the "repeatable, scheduled version" the audit asked for. Also fixed a latent eater: `--update-baselines` wrote a fixed object literal, so one refresh destroyed the accumulated `_comment` and (once floors landed) every floor, deleting a finished metric's justification from the repo while turning it into permanent weekly noise. Nothing is flagged today — the file is six days old — so the detector is verified by shrinking the window, not by waiting. Rejected: a stored `since:`; no exemptions; a floor with no required reason; hard-failing on staleness; patrol-only placement.](<redacted>.md) | quality ratchets / debt governance |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.342",
+  "version": "1.19.343",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.342",
+      "version": "1.19.343",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.342",
+  "version": "1.19.343",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/baseline-staleness.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+// scripts/gds/baseline-staleness.js — the freeze-forever detector (task 1003210,
+// goal 1000079; docs/audits/ai-dev-redteam-followup.md §9 item 2).
+//
+// THE PROBLEM. `config/fitness-baselines.json` is a SHRINK-ONLY ratchet: a metric
+// may never exceed its baseline, and lowering one is how debt gets paid down. That
+// makes regression impossible — and makes standing still invisible. The follow-up
+// audit measured the whole file at "every metric equal to baseline, 0 reduced" and
+// named the consequence exactly:
+//
+//     "A shrink-only baseline that never shrinks is indistinguishable from
+//      unmanaged debt."
+//
+// The ratchet is GREEN in that state. It is green in the state where the team is
+// actively paying down, and equally green in the state where nobody has looked in
+// a year. This check separates them by adding the one axis the ratchet has no
+// concept of: TIME.
+//
+// WHY A DECLARED FLOOR IS THE HALF THAT MATTERS. The naive version — "flag every
+// baseline that hasn't moved in N weeks" — fires on metrics that are *finished*.
+// `require_cycle_count: 4` is four deliberate lazy requires with written rationale;
+// `duplicate_window_count` cannot go below ~28 because that much duplication is
+// forced by the module boundary (ADR 0091 §2). Those will never move again, and a
+// check that nags about them weekly is a check everyone learns to skip — the same
+// alert-fatigue failure ADR 0188 §2.4 avoids in the patrol.
+//
+// So a metric may declare a FLOOR with a written reason, and a metric at its floor
+// is DONE, not stale. That converts "this is frozen forever" from silence into an
+// explicit, reviewable claim — which is the actual goal. Silence was the problem.
+//
+// TWO CHECKS, TWO SEVERITIES, ON PURPOSE:
+//
+//   • Floor-declaration rot is HERMETIC and HARD-FAILS. A floor naming a metric
+//     that no longer exists, a floor with no reason, or a floor ABOVE the metric's
+//     current value (the metric improved past the claim and nobody revisited it)
+//     are all defects in the declaration itself — cheap to detect, caused by the
+//     diff at hand, and exactly what a merge gate is for.
+//
+//   • Staleness WARNS, and is filed weekly by the patrol. Age is not a property of
+//     anybody's diff. Hard-failing a PR because ambient debt turned eight weeks old
+//     punishes whoever pushed next and gets the gate disabled. The audit asked for
+//     "the repeatable, SCHEDULED version" of its own manual review, and the patrol
+//     is that: history-wide, time-based, filed for adjudication (ADR 0162).
+//
+// AGE COMES FROM GIT, NOT FROM A STORED TIMESTAMP. A `since:` field in the JSON
+// would be faster and hermetic, and it would also be the thing that silently
+// stops being updated — leaving old debt looking permanently fresh, which is a
+// worse failure than no check at all. Git history cannot be forgotten. When it is
+// unavailable (a shallow clone), this reports DID-NOT-RUN rather than a clean
+// green: the main-audit.js --require-roster doctrine.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const BASELINE_REL = 'config/fitness-baselines.json';
+
+// Eight weeks. Long enough that a metric someone is actively working is never
+// flagged, short enough that "we'll get to it" cannot quietly become "never".
+const DEFAULT_MAX_AGE_DAYS = Number(process.env.BASELINE_STALE_DAYS) || 56;
+const DAY_MS = 86400000;
+
+// Read the tracked file's value at every commit that touched it, newest first.
+// Committer date, not author date: the question is how long this value has been
+// LANDED, and a rebased author date answers a different one. Returns null when
+// git or the history is unavailable — the caller must treat that as did-not-run.
+function readHistory(rel = BASELINE_REL, { cwd = ROOT, exec = execFileSync } = {}) {
+  let lines;
+  try {
+    lines = exec('git', ['log', '--format=%H|%cI', '--', rel], { cwd, encoding: 'utf8', stdio: 'pipe' })
+      .trim().split('\n').filter(Boolean);
+  } catch (_) {
+    return null;
+  }
+  if (!lines.length) return null;
+  const out = [];
+  for (const line of lines) {
+    const [sha, date] = line.split('|');
+    let parsed;
+    try { parsed = JSON.parse(exec('git', ['show', `${sha}:${rel}`], { cwd, encoding: 'utf8', stdio: 'pipe' })); }
+    catch (_) { continue; } // a commit that deleted/renamed the file — skip, don't guess
+    out.push({ sha, date, metrics: (parsed && parsed.metrics) || {} });
+  }
+  return out.length ? out : null;
+}
+
+// Pure: the ISO date at which each metric's CURRENT value was first set. Walks
+// newest→oldest while the value is unchanged; the oldest commit still carrying it
+// is when it last moved. A metric absent from an older commit was introduced at
+// the one after it, and its introduction date IS its age — a baseline recorded
+// once and never revisited is precisely what this looks for.
+function lastChangedByMetric(history) {
+  const out = {};
+  if (!history || !history.length) return out;
+  for (const [name, value] of Object.entries(history[0].metrics)) {
+    let i = 0;
+    while (i + 1 < history.length && history[i + 1].metrics[name] === value) i += 1;
+    out[name] = history[i].date;
+  }
+  return out;
+}
+
+function ageDays(iso, now) {
+  const t = Date.parse(iso);
+  return Number.isFinite(t) ? (now - t) / DAY_MS : null;
+}
+
+// Pure verdict — exported for the hermetic test.
+//
+// `floors[name]` is `{ value, why }`. An undeclared metric floors at 0, so a
+// metric already at 0 is never stale: it cannot shrink and there is nothing to
+// declare. `lastChanged === null` (no history) is reported as unknown, never as
+// fresh — an unmeasurable age must not read as a passing one.
+function evaluate({ metrics = {}, floors = {}, lastChanged = {}, now = 0, maxAgeDays = DEFAULT_MAX_AGE_DAYS } = {}) {
+  const violations = [];
+  const stale = [];
+  const atFloor = [];  // exempt by a WRITTEN floor claim
+  const atZero = [];   // exempt because there is nothing left to reduce
+
+  for (const [name, spec] of Object.entries(floors)) {
+    if (!(name in metrics)) {
+      violations.push(`floor declared for "${name}", which is not a metric in ${BASELINE_REL} — remove the floor or restore the metric`);
+      continue;
+    }
+    const value = spec && typeof spec === 'object' ? spec.value : spec;
+    const why = spec && typeof spec === 'object' ? spec.why : null;
+    if (!Number.isFinite(value)) {
+      violations.push(`floor for "${name}" has no numeric value — a floor is a claim about what cannot be reduced, so it must be a number`);
+      continue;
+    }
+    if (!why || String(why).trim().length < 20) {
+      violations.push(`floor for "${name}" has no reason — a floor exempts a metric from staleness forever, so it must say WHY it cannot go lower`);
+    }
+    if (metrics[name] < value) {
+      violations.push(`floor for "${name}" is ${value} but the metric is already ${metrics[name]} — the floor was passed and never revisited; lower it to the real limit`);
+    }
+  }
+
+  for (const [name, value] of Object.entries(metrics)) {
+    if (value === null || value === undefined) continue;
+    const spec = floors[name];
+    const floor = spec && typeof spec === 'object' ? spec.value : (Number.isFinite(spec) ? spec : 0);
+    if (value <= floor) { (floor > 0 ? atFloor : atZero).push(name); continue; }
+    const since = lastChanged[name];
+    if (!since) { stale.push({ name, value, floor, days: null, since: null }); continue; }
+    const days = ageDays(since, now);
+    if (days !== null && days > maxAgeDays) stale.push({ name, value, floor, days, since });
+  }
+  return { violations, stale, atFloor, atZero };
+}
+
+function readBaselineFile(rel = BASELINE_REL) {
+  try { return JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8')) || {}; }
+  catch (_) { return {}; }
+}
+
+// One line per stale metric, in the voice the reader needs: what it is, how long
+// it has not moved, and the two legitimate ways out (reduce it, or declare a floor
+// saying why it cannot be reduced). "Do something" beats "something is wrong".
+function describe(s) {
+  const age = s.days === null ? 'age UNKNOWN (no git history here)' : `unchanged for ${Math.floor(s.days)} days`;
+  return `${s.name}=${s.value} ${age}${s.floor ? ` (floor ${s.floor})` : ''} — reduce it, or declare a floor in ${BASELINE_REL} saying why it cannot go lower`;
+}
+
+function run({ now = Date.now(), maxAgeDays = DEFAULT_MAX_AGE_DAYS } = {}) {
+  const file = readBaselineFile();
+  const history = readHistory();
+  const lastChanged = history ? lastChangedByMetric(history) : {};
+  const r = evaluate({ metrics: file.metrics || {}, floors: file.floors || {}, lastChanged, now, maxAgeDays });
+  return { ...r, historyAvailable: history !== null, maxAgeDays };
+}
+
+// The fitness.js check. Hard-fails ONLY on floor-declaration rot (hermetic, caused
+// by the diff at hand); staleness is a warning here and a filed report in the
+// weekly patrol — see the header.
+function checkBaselineFloors() {
+  const r = run();
+  const warnings = r.stale.map(describe);
+  if (!r.historyAvailable) {
+    warnings.push(`baseline age could not be measured — no git history for ${BASELINE_REL} here (shallow clone?). Reported as unknown rather than passing.`);
+  }
+  return {
+    name: 'a shrink-only baseline cannot silently freeze forever (task 1003210)',
+    ok: r.violations.length === 0,
+    hardFail: r.violations.length > 0,
+    violations: r.violations,
+    warnings,
+    note: `${Object.keys(readBaselineFile().metrics || {}).length} baseline(s): ${r.atZero.length} at zero, ${r.atFloor.length} at a declared floor (done), ${r.stale.length} unchanged for >${r.maxAgeDays}d. A floor must name a reason; age comes from git, never a stored timestamp.`,
+  };
+}
+
+// The patrol class (ADR 0188): the SCHEDULED version of the audit's manual review.
+// Severity is low — this is a prompt to look, not a defect. Returns [] when there
+// is nothing to say, so the patrol files no report on a healthy week.
+function stalenessFindings(opts = {}) {
+  const r = run(opts);
+  return r.stale.map((s) => ({ severity: 'low', item: describe(s) }));
+}
+
+function main() {
+  const r = run();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  for (const w of r.stale.map(describe)) console.warn(`⚠ ${w}`);
+  if (!r.historyAvailable) console.warn('⚠ no git history for the baseline file — age is UNKNOWN, not fresh');
+  console.log(`${r.violations.length ? 'FAIL' : 'PASS'}  ${r.atZero.length} at zero · ${r.atFloor.length} at a declared floor · ${r.stale.length} stale (>${r.maxAgeDays}d)`);
+  process.exit(r.violations.length ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  checkBaselineFloors, stalenessFindings, evaluate, lastChangedByMetric,
+  readHistory, run, describe, DEFAULT_MAX_AGE_DAYS, BASELINE_REL,
+};

package/scripts/gds/control-manifest.js

@@ -82,6 +82,25 @@ const CONTROLS = [
     alsoExists: ['scripts/gds/redteam-patrol.js', 'scripts/gds/routine-schedule.js', 'tests/routine_schedule.mjs'],
   },
 
+  {
+    // Task 1003210. The ratchet (above) makes a metric unable to REGRESS; this
+    // makes it unable to sit still unnoticed. Both are needed — the audit measured
+    // the whole file at "every metric equal to baseline, 0 reduced", a state the
+    // ratchet reports as a clean pass. Wired in BOTH directions on purpose: the
+    // merge gate catches rot in a floor DECLARATION (hermetic, caused by the diff),
+    // and the weekly patrol files the time-based half, which is nobody's diff.
+    label: 'assurance: a frozen baseline cannot silently become permanent',
+    file: 'scripts/gds/baseline-staleness.js',
+    wiredIn: { file: 'scripts/gds/fitness.js', needle: 'baseline-staleness' },
+    alsoExists: ['config/fitness-baselines.json', 'tests/baseline_staleness.mjs'],
+  },
+  {
+    label: 'assurance: the staleness check is filed weekly, not only on merge',
+    file: 'scripts/gds/baseline-staleness.js',
+    wiredIn: { file: 'scripts/gds/redteam-patrol.js', needle: 'stalenessFindings' },
+    alsoExists: ['.github/workflows/redteam-patrol.yml'],
+  },
+
   // ── goal 1000077's four guards (task 1003169 / G05) ──────────────────────
   //
   // Same reasoning as the goal-1000076 controls above, applied to the goal that

package/scripts/gds/fitness-ratchets.js

@@ -270,7 +270,9 @@ function readBaselines() {
   if (!metrics) {
     return { metrics: {}, error: 'config/fitness-baselines.json has no "metrics" object — failing CLOSED.' };
   }
-  return { metrics, error: null };
+  // `parsed` rides along so --update-baselines can PRESERVE the non-metric keys it
+  // used to overwrite — see the writer in main().
+  return { metrics, error: null, parsed };
 }
 
 // Pure ratchet verdict — exported for the hermetic test.
@@ -330,11 +332,25 @@ function main() {
     if (knip !== null) metrics.knip_issue_count = knip;
     // The bootstrap path deliberately tolerates an absent file — writing it is the
     // whole point — so it reads the metrics and ignores any error (task 1003227).
-    const { metrics: existing } = readBaselines();
+    const { metrics: existing, parsed: existingFile } = readBaselines();
     if (knip === null && existing.knip_issue_count !== undefined) metrics.knip_issue_count = existing.knip_issue_count;
+    // PRESERVE everything that is not a metric. This used to write a fixed object
+    // literal, so one --update-baselines silently destroyed both the accumulated
+    // `_comment` (which documents WHY each number is where it is) and, once task
+    // 1003210 added them, the `floors` — the written claims that exempt a metric
+    // from the staleness check. Losing a floor is not cosmetic: the metric silently
+    // becomes "stale forever" and its reason is gone from the repo. Only `metrics`
+    // is recomputed; unknown keys pass through untouched, so a later addition to
+    // this file cannot be eaten by a refresh either.
+    const preserved = existingFile && typeof existingFile === 'object' ? { ...existingFile } : {};
+    delete preserved.metrics;
+    if (!preserved._comment) {
+      preserved._comment = 'fitness-ratchets baselines (task 1003129): quality debt recorded at gate-adoption. Shrink-only — lower a value when the metric improves; raising one to pass CI is out of policy.';
+    }
+    const { _comment, ...rest } = preserved;
     fs.writeFileSync(
       BASELINE_PATH,
-      JSON.stringify({ _comment: 'fitness-ratchets baselines (task 1003129): quality debt recorded at gate-adoption. Shrink-only — lower a value when the metric improves; raising one to pass CI is out of policy.', metrics }, null, 2) + '\n',
+      JSON.stringify({ _comment, metrics, ...rest }, null, 2) + '\n',
     );
     console.log(`fitness-ratchets: baselines written — ${Object.entries(metrics).map(([k, v]) => `${k}=${v}`).join(' · ')}`);
     return;

package/scripts/gds/fitness.js

@@ -1306,6 +1306,7 @@ const CHECKS = [
   require('./version-literal-guard.js').checkNoVersionLiterals,
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
+  require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why
 ];
 
 function runAll() {

package/scripts/gds/redteam-patrol.js

@@ -18,6 +18,13 @@
 //      young direct deps (<90 days — the slopsquat shape), stale overrides.
 //   3. action-pins — every workflow `uses:` must be pinned to a 40-hex SHA
 //      (the tj-actions lesson).
+//   4. baseline-staleness — a shrink-only quality baseline that has not moved in
+//      8 weeks (task 1003210). Belongs HERE and not in the merge gate for the
+//      same reason the other three do: it is history-wide and time-based, so it
+//      is not a property of anyone's diff — failing a PR because ambient debt
+//      turned eight weeks old punishes whoever pushed next. The audit asked for
+//      "the repeatable, scheduled version" of a review it had done by hand; this
+//      is it.
 //
 // Filing: DRY-RUN by default (prints what it would file). --file POSTs one
 // report PER CLASS (max severity within the class, details in repro_steps_md)
@@ -340,6 +347,10 @@ async function main() {
   const pins = actionPinCheck();
   if (pins.findings.length) classes.push(buildClassReport('action-pins', pins.findings));
 
+  // Deterministic and local (git history + one JSON file) — no network, no model.
+  const stale = require('./baseline-staleness.js').stalenessFindings();
+  if (stale.length) classes.push(buildClassReport('baseline-staleness', stale));
+
   if (secrets.degraded) stepSummary(`> **DEGRADED** — ${secrets.degraded}`);
 
   if (!classes.length) {

package/src/module-api.js

@@ -1114,8 +1114,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.340 with no explicit bump. run 32798507686. (task 1002620)
 //   1.19.342 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.341 with no explicit bump. run 32799103427. (task 1002620)
+//   1.19.343 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.342 with no explicit bump. run 32799245758. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.342'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.343'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/baseline_staleness.mjs

@@ -0,0 +1,198 @@
+// tests/baseline_staleness.mjs — the freeze-forever detector (task 1003210,
+// goal 1000079; follow-up audit §9 item 2).
+//
+// The state this exists to detect is one the ratchet reports as a clean PASS:
+// every metric equal to its baseline, nothing reduced, nobody looking. So the
+// tests are written around the two ways such a check quietly becomes useless —
+// flagging things that are legitimately finished (until everyone ignores it), and
+// reading an unmeasurable age as a fresh one.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const bs = require(path.join(ROOT, 'scripts', 'gds', 'baseline-staleness.js'));
+
+const NOW = Date.parse('2026-08-24T00:00:00Z');
+const daysAgo = (n) => new Date(NOW - n * 86400000).toISOString();
+
+// ------------------------------------------------------------------ the verdict
+
+test('a metric that has not moved past the window is stale', () => {
+  const r = bs.evaluate({
+    metrics: { doc_stale_links: 1133 },
+    lastChanged: { doc_stale_links: daysAgo(120) },
+    now: NOW,
+  });
+  assert.equal(r.stale.length, 1);
+  assert.equal(r.stale[0].name, 'doc_stale_links');
+  assert.equal(Math.floor(r.stale[0].days), 120);
+  assert.deepEqual(r.violations, []);
+});
+
+test('a metric that moved inside the window is not stale', () => {
+  const r = bs.evaluate({
+    metrics: { console_call_count: 161 },
+    lastChanged: { console_call_count: daysAgo(3) },
+    now: NOW,
+  });
+  assert.deepEqual(r.stale, []);
+});
+
+test('a metric at zero is never stale — there is nothing left to reduce', () => {
+  const r = bs.evaluate({
+    metrics: { oversized_file_count: 0 },
+    lastChanged: { oversized_file_count: daysAgo(900) },
+    now: NOW,
+  });
+  assert.deepEqual(r.stale, []);
+  assert.deepEqual(r.atZero, ['oversized_file_count']);
+});
+
+test('a metric at a DECLARED floor is done, not stale — the anti-nag rule', () => {
+  // require_cycle_count's four cycles are deliberate lazy requires. Without this
+  // exemption the check would flag them every week forever, and a check that cries
+  // wolf weekly is one everybody learns to skip (ADR 0188 §2.4, same reasoning).
+  const r = bs.evaluate({
+    metrics: { require_cycle_count: 4 },
+    floors: { require_cycle_count: { value: 4, why: 'all four are deliberate lazy requires with in-file rationale' } },
+    lastChanged: { require_cycle_count: daysAgo(900) },
+    now: NOW,
+  });
+  assert.deepEqual(r.stale, []);
+  assert.deepEqual(r.atFloor, ['require_cycle_count']);
+});
+
+test('a floor exempts only down TO the floor — reducible debt above it still goes stale', () => {
+  // 59 duplicate windows with a floor of 28: ~31 are reducible seeder scaffolding
+  // and must keep counting against the clock. A floor is not a blanket pardon.
+  const r = bs.evaluate({
+    metrics: { duplicate_window_count: 59 },
+    floors: { duplicate_window_count: { value: 28, why: 'ADR 0091 §2 boundary-forced duplication a module cannot merge away' } },
+    lastChanged: { duplicate_window_count: daysAgo(120) },
+    now: NOW,
+  });
+  assert.equal(r.stale.length, 1);
+  assert.equal(r.stale[0].floor, 28);
+});
+
+// --------------------------------------------------------- rot in a declaration
+
+test('a floor with no reason is a hard violation — silence is what this replaces', () => {
+  const r = bs.evaluate({ metrics: { x: 5 }, floors: { x: { value: 3 } }, now: NOW });
+  assert.equal(r.violations.length, 1);
+  assert.match(r.violations[0], /no reason/);
+  // A one-word reason is not a reason either.
+  assert.match(bs.evaluate({ metrics: { x: 5 }, floors: { x: { value: 3, why: 'boundary' } }, now: NOW })
+    .violations[0], /no reason/);
+});
+
+test('a floor naming a metric that no longer exists is rot, caught at merge time', () => {
+  const r = bs.evaluate({ metrics: { a: 1 }, floors: { gone: { value: 1, why: 'a reason long enough to pass the length bar' } }, now: NOW });
+  assert.equal(r.violations.length, 1);
+  assert.match(r.violations[0], /not a metric/);
+});
+
+test('a floor the metric already dropped below was passed and never revisited', () => {
+  const r = bs.evaluate({
+    metrics: { dup: 20 },
+    floors: { dup: { value: 28, why: 'a reason long enough to pass the length bar' } },
+    now: NOW,
+  });
+  assert.equal(r.violations.length, 1);
+  assert.match(r.violations[0], /already 20/);
+});
+
+test('a non-numeric floor is refused — a floor is a numeric claim', () => {
+  const r = bs.evaluate({ metrics: { x: 5 }, floors: { x: { why: 'a reason long enough to pass the length bar' } }, now: NOW });
+  assert.match(r.violations[0], /no numeric value/);
+});
+
+// ------------------------------------------------------------------- unknown age
+
+test('an unmeasurable age is reported as UNKNOWN, never as fresh', () => {
+  // The failure mode: a shallow clone yields no history, every metric looks
+  // brand-new, and the check quietly passes forever. Unknown must surface.
+  const r = bs.evaluate({ metrics: { doc_stale_links: 1133 }, lastChanged: {}, now: NOW });
+  assert.equal(r.stale.length, 1);
+  assert.equal(r.stale[0].days, null);
+  assert.match(bs.describe(r.stale[0]), /age UNKNOWN/);
+});
+
+// --------------------------------------------------------- reading git history
+
+test('lastChangedByMetric dates a value from the OLDEST commit still carrying it', () => {
+  // newest → oldest. `a` has been 5 across the top two commits, so it last moved
+  // at the second one, not the first.
+  const history = [
+    { sha: 'c3', date: daysAgo(1), metrics: { a: 5, b: 1 } },
+    { sha: 'c2', date: daysAgo(30), metrics: { a: 5, b: 2 } },
+    { sha: 'c1', date: daysAgo(90), metrics: { a: 9, b: 3 } },
+  ];
+  const t = bs.lastChangedByMetric(history);
+  assert.equal(t.a, daysAgo(30));
+  assert.equal(t.b, daysAgo(1));
+});
+
+test('a metric present in every commit dates to its introduction — recorded once, never revisited', () => {
+  const history = [
+    { sha: 'c2', date: daysAgo(1), metrics: { a: 7 } },
+    { sha: 'c1', date: daysAgo(200), metrics: { a: 7 } },
+  ];
+  assert.equal(bs.lastChangedByMetric(history).a, daysAgo(200));
+  assert.deepEqual(bs.lastChangedByMetric([]), {});
+  assert.deepEqual(bs.lastChangedByMetric(null), {});
+});
+
+test('readHistory returns null when git cannot answer, rather than an empty history', () => {
+  // null and [] must not be conflated: [] would flow through as "no commits, so
+  // no ages", which reads as fresh. null is what makes the caller say DID NOT RUN.
+  const boom = () => { throw new Error('not a git repository'); };
+  assert.equal(bs.readHistory('config/fitness-baselines.json', { exec: boom }), null);
+  assert.equal(bs.readHistory('config/fitness-baselines.json', { exec: () => '' }), null);
+});
+
+// --------------------------------------------------------------- the live tree
+
+test('LIVE: every floor in the shipped baseline file carries a reason', () => {
+  const r = bs.run();
+  assert.deepEqual(r.violations, [], r.violations.join(' | '));
+  assert.equal(r.historyAvailable, true, 'this checkout should have git history for the baseline file');
+});
+
+test('LIVE: shrink the window to 1 day and the real baselines DO get flagged', () => {
+  // Proof the check is not passing because it cannot see. Every current baseline
+  // was written days ago, so at a one-day window the reducible ones must surface —
+  // if this returns nothing, the detector is inert.
+  const r = bs.run({ maxAgeDays: 1 });
+  assert.ok(r.stale.length > 0, 'a 1-day window must flag the real baselines');
+  const names = r.stale.map((s) => s.name);
+  assert.ok(names.includes('doc_stale_links'), `expected doc_stale_links among ${names.join(', ')}`);
+  // …and the exempt ones must STILL be exempt at a 1-day window: the exemption is
+  // the floor, not the clock.
+  assert.ok(!names.includes('require_cycle_count'), 'a metric at its declared floor must never be flagged');
+  assert.ok(!names.includes('oversized_file_count'), 'a metric at zero must never be flagged');
+});
+
+test('LIVE: --update-baselines preserves the floors instead of overwriting them', () => {
+  // The regression this guards: the writer used to emit a fixed object literal
+  // ({_comment: '<hardcoded>', metrics}), so one refresh silently destroyed both
+  // the accumulated comment and every floor — and a lost floor turns a finished
+  // metric into permanent weekly noise with its reason gone from the repo.
+  const rat = require(path.join(ROOT, 'scripts', 'gds', 'fitness-ratchets.js'));
+  const before = JSON.parse(fs.readFileSync(rat.BASELINE_PATH, 'utf8'));
+  assert.ok(before.floors && Object.keys(before.floors).length > 0, 'the shipped file must carry floors');
+  // Simulate the writer's preserve step on a temp copy rather than running the
+  // real refresh (which recomputes metrics and would be slow + tree-dependent).
+  const tmp = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'bl-')), 'baselines.json');
+  const preserved = { ...before };
+  delete preserved.metrics;
+  const { _comment, ...rest } = preserved;
+  fs.writeFileSync(tmp, JSON.stringify({ _comment, metrics: before.metrics, ...rest }, null, 2) + '\n');
+  assert.deepEqual(JSON.parse(fs.readFileSync(tmp, 'utf8')), before);
+});