@bongos/core 1.19.347 → 1.19.348

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.347",
-  "core_contract": "1.19.347",
-  "source_commit": "e27bff09b16adf42c58b54ead68924751dbc2351",
+  "core_version": "1.19.348",
+  "core_contract": "1.19.348",
+  "source_commit": "d42db56154d01be276f13e04e364e7ced8d8c400",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T02:40:24.281Z",
+  "built_at": "2026-08-25T02:48:07.802Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 328,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1497,
+    "functional_verbatim": 1499,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1847,
-  "tree_sha256": "2e117a040ff4372ef27c7c654e2e827f99f84acd347da0b416682cc5a66a1eb2",
+  "file_count": 1849,
+  "tree_sha256": "3004531bfb70cd33dbca752e2d945c4687d6ea1148f54548b6fcf921f953681f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1472,12 +1472,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "360d2e6fd65c436cc402f94fede50e2ab59ff275c1bd894c99f599576a804984"
+      "sha256": "0caaef6980475bc4abbb51df79ebe4b14b2a3ad7b97f3e2da13f08d8e1ae1b11"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "9c6c9b7271759fff6f4a76857f7d98ebef55785c474158276d28d7f6db9092d9"
+      "sha256": "d5410ce76bb98ee335363f00e483fd66539b9ac35ffb4ec8a7bd3e0af928faf0"
     },
     {
       "path": "docs/design-contract.md",
@@ -3577,7 +3577,7 @@
     {
       "path": "modules/hall-ui/public/idea.js",
       "mode": "0000644",
-      "sha256": "abda218838cb126485f717c9c1c945cdb8bff5140323ebe8c8f5aa29bbcc6150"
+      "sha256": "b742657979f37993db85efbf05d0983e8ef295dcde7b0058a826909bfa352074"
     },
     {
       "path": "modules/hall-ui/public/ideas.css",
@@ -3592,7 +3592,7 @@
     {
       "path": "modules/hall-ui/public/ideas.js",
       "mode": "0000644",
-      "sha256": "6ec39a94e314f37ebf610b6f42899b68a994974024e2cd0578e5d15d812b040f"
+      "sha256": "96796c1d7192ed2f6c4ac2ef185ade5e6001ecb828feb1b99a123a457bfdc8bf"
     },
     {
       "path": "modules/hall-ui/public/index.html",
@@ -4762,12 +4762,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ab72d709096f258ac4fb7df05ba0e32127d2e470b9bba8d724894ea883e14094"
+      "sha256": "6745e4e181b20731968d02f8e4dac7cb864acbf3fbbd6ec6054c799a41487618"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3f40232829ee5093d6b7a64808013abb68ac04fe25b38d3fa174fc5fecff11a2"
+      "sha256": "65ce6bcba41342833cd48800e028fd1e3420a4d9d7fb82c1250cfca724baa0ad"
     },
     {
       "path": "public-docs/index.html",
@@ -5279,6 +5279,11 @@
       "mode": "0000644",
       "sha256": "5aa658b099b2acda06cdb3aecfe905da7de79f2b12c844faca091ff061454017"
     },
+    {
+      "path": "scripts/gds/client-baseurl-guard.js",
+      "mode": "0000644",
+      "sha256": "8ac4c8909b75aa5e2022a967ba9ac0cbcdac60da9d75757603827b86964c825b"
+    },
     {
       "path": "scripts/gds/code.js",
       "mode": "0000644",
@@ -5342,7 +5347,7 @@
     {
       "path": "scripts/gds/deploy-divergence.js",
       "mode": "0000644",
-      "sha256": "ba2184ba713fb1accdc86a14fbd3c8802b45808e5269800644a6ef166d8b249b"
+      "sha256": "f9ade0941ad0e49cb6412936ad5d657561da0ab591508a2844a3645e25debdcb"
     },
     {
       "path": "scripts/gds/design-sync.js",
@@ -5447,7 +5452,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "b07c9489b073233d5e3a83bb59a7ebda0fc1a2bd0defcd3d5a69efc77ff24b86"
+      "sha256": "91b125de588406e6b93f8cc29d4d53891932a52744a6e92824459c734f747f16"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -6217,7 +6222,7 @@
     {
       "path": "scripts/gds/update-channel.js",
       "mode": "0000644",
-      "sha256": "065095ccdcb104ede0312375484f62b23742fa1bc446f9749505c22b71babb5d"
+      "sha256": "db54fba6065c8b662f574aa9443e686df4e5a152865342999b1f20d50ece01ed"
     },
     {
       "path": "scripts/gds/upgrade.js",
@@ -6617,7 +6622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0caf921877b91ef138e5ad71215e7a2b05a5ad837dc1fa6cb8d8d2b4ccbb63f2"
+      "sha256": "7eca632fc6880711d60fad718a743301e62e99ca990a8a4cf07767726f86f0cf"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7124,6 +7129,11 @@
       "mode": "0000644",
       "sha256": "fae365f4c0cbc41a9077cfa19387a2f016f39d14fad37cf2867230eaf9196b11"
     },
+    {
+      "path": "tests/client_baseurl_guard.mjs",
+      "mode": "0000644",
+      "sha256": "541407601a480408b725768a1a1b0ba8b71e0969f82d6f4747f862abcb62a5d0"
+    },
     {
       "path": "tests/client_bundle_route.mjs",
       "mode": "0000644",
@@ -7972,7 +7982,7 @@
     {
       "path": "tests/idea_hall_composer.mjs",
       "mode": "0000644",
-      "sha256": "1e6d0784ecb37e613561cc8ee45fa23e178ecf112d5a8f218b9795dca0e7d0fc"
+      "sha256": "dbe8f91e4f3acc566a36547ce42d30328ba9e651a622fe1f25092d49d4e3a955"
     },
     {
       "path": "tests/idea_ideate_full.mjs",
@@ -9187,7 +9197,7 @@
     {
       "path": "tests/update_channel.mjs",
       "mode": "0000644",
-      "sha256": "3b0912dcda6888b4daa2cd13bbef0cddddafc425c39a509dc4955ce77ddd720e"
+      "sha256": "9debf9ecdb02b986c882f3d29bdf4b5fe2154cb4e7639db0fd0a0336cd4bdc3b"
     },
     {
       "path": "tests/upgrade.mjs",

package/docs/copy-inventory.md

@@ -125,7 +125,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `634738746b81` | certain | A fresh box has a | `modules/hall-ui/public/harbor.js:122` |
 | `df5eb70b5a05` | certain | A higher rank. Its details are hidden until you reach the rank directly below it. | `modules/hall-ui/public/ranks.js:125` |
 | `a07c7b335a66` | certain | A protected-scope goal requires a Metic+ member. | `modules/hall-ui/public/goals-render.js:903` |
-| `5723baf26b2d` | certain | A quick idea is a thought filed fast. It is not an unfinished Full Idea — only its author can offer it up for  | `modules/hall-ui/public/idea.js:237` |
+| `5723baf26b2d` | certain | A quick idea is a thought filed fast. It is not an unfinished Full Idea — only its author can offer it up for  | `modules/hall-ui/public/idea.js:245` |
 | `6359b5afbc6b` | certain | A short path to finding your feet. Tick the steps you’ve done; the rest are tracked for you. | `modules/hall-ui/public/hall-widgets.js:60` |
 | `58f7f6f0d8bd` | certain | A small app for your menu bar (Mac) or system tray (Windows): one switch to start and stop your dev box, with  | `modules/hall-ui/public/settings.html:170` |
 | `a3185a43c230` | certain | A sound plays at each turn of your work — a gentle chime when Claude finishes, a flourish when a task ships or | `modules/hall-ui/public/settings.html:265` |
@@ -147,7 +147,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `200a83529fa6` | certain | Already acknowledged — you're all set. | `modules/hall-ui/public/primer.html:68` |
 | `d11477f287b7` | certain | An objection returns the idea to its author with your reason and the section it faults \u2014 the feedback the | `modules/hall-ui/public/government.js:741` |
 | `69f0ca4a4d84` | certain | Analytics scope | `modules/hall-ui/public/hall-render.js:995` |
-| `14bdceaac078` | certain | Answer the five questions and this spark becomes a Full Idea. | `modules/hall-ui/public/ideas.js:415` |
+| `14bdceaac078` | certain | Answer the five questions and this spark becomes a Full Idea. | `modules/hall-ui/public/ideas.js:423` |
 | `52ed0e2e3470` | certain | Any rank | `modules/hall-ui/public/task-lib.js:62` |
 | `c89833aa985a` | certain | Approval failed — try again. | `modules/hall-ui/public/pair.js:92` |
 | `0832ba017c90` | certain | Approve & re-run | `modules/hall-ui/public/gate.js:100` |
@@ -165,7 +165,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4195d0d114e4` | certain | Archons only. | `modules/hall-ui/public/sessions.js:97` |
 | `4195d0d114e4` | certain | Archons only. | `modules/hall-ui/public/watch.js:838` |
 | `5fcfdf8975cf` | certain | As configuration: | `modules/hall-ui/public/government.js:633` |
-| `01a0f29ff406` | certain | As first filed | `modules/hall-ui/public/idea.js:229` |
+| `01a0f29ff406` | certain | As first filed | `modules/hall-ui/public/idea.js:237` |
 | `688cc6dd38ee` | certain | Asked of you | `modules/hall-ui/public/collab.html:32` |
 | `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/collab.js:36` |
 | `b2656d0b2402` | certain | Asked {…} | `modules/hall-ui/public/watch.js:205` |
@@ -280,7 +280,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `dec4b11f316d` | certain | Could not load dev boxes just now. | `modules/hall-ui/public/harbor.js:288` |
 | `0f7c244312b1` | certain | Could not load government data just now. | `modules/hall-ui/public/government.js:883` |
 | `cd00bf198661` | certain | Could not load held pull requests just now. | `modules/hall-ui/public/gate.js:180` |
-| `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:444` |
+| `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:456` |
 | `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:226` |
 | `4e09b612c6b7` | certain | Could not load modules. Return to the hall and try again. | `modules/hall-ui/public/modules.js:225` |
 | `8a4b590fa1a0` | certain | Could not load requests. | `modules/hall-ui/public/collab.js:137` |
@@ -289,11 +289,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5420bb0b8475` | certain | Could not load the Board Room just now. | `modules/hall-ui/public/government.js:804` |
 | `3f82d4f29e5b` | certain | Could not load the constitution just now. | `modules/hall-ui/public/government.js:628` |
 | `8f597eabf4ac` | certain | Could not load the drachmae guide. | `modules/hall-ui/public/drachmae.js:162` |
-| `b2147cc90e36` | certain | Could not load the idea template. Reload, or file from the terminal with capture.js. | `modules/hall-ui/public/ideas.js:422` |
+| `b2147cc90e36` | certain | Could not load the idea template. Reload, or file from the terminal with capture.js. | `modules/hall-ui/public/ideas.js:438` |
 | `6264ebc9ede0` | certain | Could not load the primer. | `modules/hall-ui/public/primer.js:620` |
 | `7604af13c40e` | certain | Could not load the profile. | `modules/hall-ui/public/profile.js:330` |
-| `8b69e445592a` | certain | Could not load the question labels; showing the answers as stored. | `modules/hall-ui/public/idea.js:221` |
-| `edd5bafbe075` | certain | Could not load the queue just now. | `modules/hall-ui/public/ideas.js:379` |
+| `8b69e445592a` | certain | Could not load the question labels; showing the answers as stored. | `modules/hall-ui/public/idea.js:229` |
+| `edd5bafbe075` | certain | Could not load the queue just now. | `modules/hall-ui/public/ideas.js:387` |
 | `02bb0570996a` | certain | Could not load the ranks. | `modules/hall-ui/public/ranks.js:197` |
 | `2878778cf9f3` | certain | Could not load this page. | `modules/hall-ui/public/watch.js:884` |
 | `4b0c8d94541c` | certain | Could not load your account. Reload the page to try again. | `modules/hall-ui/public/settings.js:1270` |
@@ -353,7 +353,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `cc681021a140` | certain | Description (optional) | `modules/hall-ui/public/government.html:61` |
 | `8cac6be8afdf` | certain | Dev box app | `modules/hall-ui/public/settings.html:169` |
 | `9c37356c3a04` | certain | Dev-box costs | `modules/hall-ui/public/watch.html:86` |
-| `0a4fe7150971` | certain | Develop this idea | `modules/hall-ui/public/ideas.js:414` |
+| `0a4fe7150971` | certain | Develop this idea | `modules/hall-ui/public/ideas.js:422` |
 | `11b8266d6aab` | certain | Developing a Big Idea Spark | `modules/hall-ui/public/ideas.html:56` |
 | `457f4967541b` | certain | Device pairing | `modules/hall-ui/public/pair.html:15` |
 | `457f4967541b` | certain | Device pairing | `modules/hall-ui/public/pair.html:15` |
@@ -374,7 +374,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9c728558d6e7` | certain | Drachmae & karma | `modules/hall-ui/public/drachmae.html:15` |
 | `9d9cc4ef8557` | certain | Drachmae & karma — {{worldName}} | `modules/hall-ui/public/drachmae.html:6` |
 | `9d9cc4ef8557` | certain | Drachmae & karma — {{worldName}} | `modules/hall-ui/public/drachmae.html:6` |
-| `2f8d0404039e` | certain | Draft discarded. | `modules/hall-ui/public/ideas.js:339` |
+| `2f8d0404039e` | certain | Draft discarded. | `modules/hall-ui/public/ideas.js:347` |
 | `d59beed97d58` | certain | Drag to pan, scroll to zoom | `modules/hall-ui/public/diagrams.html:42` |
 | `67f09099c2d3` | certain | Duplicate — should be said once, in one place | `modules/hall-ui/public/copy-desk.html:95` |
 | `db7f370c0d38` | certain | Each builder’s dev box at a glance. | `modules/hall-ui/public/harbor.js:335` |
@@ -404,7 +404,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `86ef86c5c647` | certain | Fit to view | `modules/hall-ui/public/diagram-viewer.js:97` |
 | `86ef86c5c647` | certain | Fit to view | `modules/hall-ui/public/diagram-viewer.js:100` |
 | `78107a76a755` | certain | Five diagrams that show, at a glance, how work flows through {{worldName}}'s development system. | `modules/hall-ui/public/diagrams.html:42` |
-| `18ab1be9d3ad` | certain | Five questions, and a score that counts how much of each you actually answered. | `modules/hall-ui/public/ideas.js:432` |
+| `18ab1be9d3ad` | certain | Five questions, and a score that counts how much of each you actually answered. | `modules/hall-ui/public/ideas.js:448` |
 | `b9267033b1f1` | certain | Flag this copy | `modules/hall-ui/public/copy-desk.html:87` |
 | `448d00771dc8` | certain | Flagged. It is in the queue. | `modules/hall-ui/public/copy-desk.js:281` |
 | `617f13fa3fdb` | certain | Flip the switch. | `modules/hall-ui/public/hall-render.js:609` |
@@ -457,7 +457,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `298ff22576ee` | certain | How your output has changed over time — work shipped, cost and time per work, and how reviews held up. | `modules/hall-ui/public/hall-widgets.js:182` |
 | `08d3bf741a2c` | certain | I have read it | `modules/hall-ui/public/primer.html:67` |
 | `08d3bf741a2c` | certain | I have read it | `modules/hall-ui/public/primer.js:496` |
-| `a4ff1e9c34e3` | certain | Idea {…} | `modules/hall-ui/public/idea.js:244` |
+| `a4ff1e9c34e3` | certain | Idea {…} | `modules/hall-ui/public/idea.js:252` |
 | `ba82ec56f1e3` | certain | Idea — {{worldName}} | `modules/hall-ui/public/idea.html:6` |
 | `ba82ec56f1e3` | certain | Idea — {{worldName}} | `modules/hall-ui/public/idea.html:6` |
 | `e181637c5a5e` | certain | Ideas awaiting triage | `modules/hall-ui/public/builders.js:843` |
@@ -473,7 +473,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d176de7857f3` | certain | Invited. | `modules/hall-ui/public/goals-render.js:895` |
 | `2170b74c6526` | certain | Isometric map of the repository | `modules/hall-ui/public/atlas.html:39` |
 | `79791be35018` | certain | It opens this hall in your browser — click one | `modules/hall-ui/public/hall-render.js:609` |
-| `b0bcb3f844ec` | certain | Its author marked this as needing development — anyone can turn it into a Full Idea, and they keep the credit  | `modules/hall-ui/public/idea.js:235` |
+| `b0bcb3f844ec` | certain | Its author marked this as needing development — anyone can turn it into a Full Idea, and they keep the credit  | `modules/hall-ui/public/idea.js:243` |
 | `34dc2af8664f` | certain | Join a project | `modules/hall-ui/public/my-projects.html:44` |
 | `b7719e855009` | certain | Join goal | `modules/hall-ui/public/goals-render.js:758` |
 | `9f9424a5100b` | certain | Join our Discord | `modules/hall-ui/public/hall-render.js:607` |
@@ -565,7 +565,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6d6fd2314248` | certain | No cross-project activity reported yet. | `modules/hall-ui/public/profile.js:233` |
 | `6d6fd2314248` | certain | No cross-project activity reported yet. | `modules/hall-ui/public/scouting.js:29` |
 | `b1ada579483c` | certain | No custom ranks yet | `modules/hall-ui/public/government.js:303` |
-| `6e2d2e11f84a` | certain | No description. | `modules/hall-ui/public/idea.js:106` |
+| `6e2d2e11f84a` | certain | No description. | `modules/hall-ui/public/idea.js:114` |
 | `cb1a2f7e92bf` | certain | No dev boxes yet — no builder has opened one. | `modules/hall-ui/public/harbor.js:304` |
 | `36fc20a2a55e` | certain | No duplicated strings in the registry. | `modules/hall-ui/public/copy-desk.js:181` |
 | `93c00cb1423a` | certain | No goal | `modules/hall-ui/public/work.js:421` |
@@ -591,7 +591,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c72e0bdb834a` | certain | Not declared in module.json — this is who ships the module. | `modules/hall-ui/public/modules.js:49` |
 | `361b353ded5e` | certain | Not enough shipped work yet to chart. | `modules/hall-ui/public/hall-widgets.js:184` |
 | `90230572d017` | certain | Not found | `modules/hall-ui/public/task.js:304` |
-| `61250b49a90b` | certain | Not scored. | `modules/hall-ui/public/idea.js:70` |
+| `61250b49a90b` | certain | Not scored. | `modules/hall-ui/public/idea.js:78` |
 | `8d6afe6def47` | certain | Not signed in | `modules/hall-ui/public/settings.html:33` |
 | `19adac0efed1` | certain | Not yet available | `modules/hall-ui/public/not-ready.html:24` |
 | `2c19f41704b9` | certain | Not yet available — {{worldName}} | `modules/hall-ui/public/not-ready.html:6` |
@@ -602,7 +602,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:953` |
 | `2c6e0dfbd781` | certain | Nothing is waiting on you. Requests reach you by your craft — set yours in | `modules/hall-ui/public/collab.html:38` |
 | `18ce0723be0d` | certain | Nothing is waiting — no held changes need your approval. | `modules/hall-ui/public/gate.js:188` |
-| `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:357` |
+| `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:365` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:144` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/work.js:914` |
 | `42909e1460c4` | certain | Nothing to submit — every module here already ships with the core. | `modules/hall-ui/public/modules.js:166` |
@@ -769,7 +769,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6374d6172678` | certain | Shipped {…}{…}. | `modules/hall-ui/public/task.js:234` |
 | `14d32a35c15f` | certain | Show my cross-project record | `modules/hall-ui/public/settings.js:579` |
 | `dc0f9fe50a65` | certain | Show the setup guide again | `modules/hall-ui/public/index.html:55` |
-| `2af4c0f2b4b9` | certain | Showing {…} of {…}. | `modules/hall-ui/public/ideas.js:361` |
+| `2af4c0f2b4b9` | certain | Showing {…} of {…}. | `modules/hall-ui/public/ideas.js:369` |
 | `2f12d46f96ca` | certain | Sign in from the app. | `modules/hall-ui/public/hall-render.js:609` |
 | `19ab56cc3932` | certain | Sign in to filter to your goals | `modules/hall-ui/public/goals-page.js:793` |
 | `b057dfbf49c5` | certain | Sign in when Claude prompts you. | `modules/hall-ui/public/hall-render.js:609` |
@@ -926,7 +926,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c5fd76a9e03d` | certain | Won {…} | `modules/hall-ui/public/profile.js:115` |
 | `520d139df9eb` | certain | Work is complete but the version is held — no tasks are being claimed here right now. | `modules/hall-ui/public/roadmap.js:223` |
 | `52e5fe3c6075` | certain | Write a Full Idea | `modules/hall-ui/public/ideas.html:43` |
-| `7664f4373d1f` | certain | Write one | `modules/hall-ui/public/idea.js:235` |
+| `7664f4373d1f` | certain | Write one | `modules/hall-ui/public/idea.js:243` |
 | `c368b56ecf40` | certain | Xenos builders start with a focused set of pages — ship your first | `modules/hall-ui/public/not-ready.html:26` |
 | `b6b0fcb2bcee` | certain | You already have a pending request or invitation for this goal. | `modules/hall-ui/public/goals-render.js:947` |
 | `a674836fec16` | certain | You already have access ✓ | `modules/hall-ui/public/hall-render.js:355` |
@@ -1020,8 +1020,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `17ab8db79e1f` | certain | holds the worker, the code, and your local memory; the | `modules/hall-ui/public/diagrams.html:83` |
 | `7d5cbe3d81e4` | certain | how long a vote stays open | `modules/hall-ui/public/government.html:40` |
 | `dacb901c4f10` | certain | idea number | `modules/hall-ui/public/task-detail.js:458` |
-| `7df22e74c87a` | certain | idea {…} | `modules/hall-ui/public/idea.js:190` |
-| `7df22e74c87a` | certain | idea {…} | `modules/hall-ui/public/ideas.js:326` |
+| `7df22e74c87a` | certain | idea {…} | `modules/hall-ui/public/idea.js:198` |
+| `7df22e74c87a` | certain | idea {…} | `modules/hall-ui/public/ideas.js:334` |
 | `2123a62d69e3` | certain | if this stays empty. | `modules/hall-ui/public/collab.html:40` |
 | `b2b399fdd6a4` | certain | in progress | `modules/hall-ui/public/goals-render.js:188` |
 | `b2b399fdd6a4` | certain | in progress | `modules/hall-ui/public/roadmap.js:108` |
@@ -1040,7 +1040,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `754bdec368ed` | certain | lowest credits | `modules/hall-ui/public/hall-widgets.js:136` |
 | `cffba8409070` | certain | manage its visibility in Settings → Cross-project record | `modules/hall-ui/public/profile.js:200` |
 | `5c3fdd34cd02` | certain | means expressible through the real configuration — a rank-based membership plus a pass rule — with no new code | `modules/hall-ui/public/government.js:610` |
-| `0eefd625d954` | certain | merged into | `modules/hall-ui/public/idea.js:190` |
+| `0eefd625d954` | certain | merged into | `modules/hall-ui/public/idea.js:198` |
 | `70c234985d42` | certain | most recent first | `modules/hall-ui/public/hall-widgets.js:134` |
 | `7421250dc155` | certain | name, author, origin project, or licence… | `modules/hall-ui/public/modules.html:30` |
 | `f61d8fc1516d` | certain | new SSH identity | `modules/hall-ui/public/harbor.js:122` |
@@ -1084,7 +1084,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `cfc61d8cabe6` | certain | tally: {…} yes · {…} no — sitting under | `modules/hall-ui/public/government.js:786` |
 | `129ed842096b` | certain | target gone | `modules/hall-ui/public/copy-desk.js:63` |
 | `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/gate.js:123` |
-| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/idea.js:187` |
+| `4d8ee7d68974` | certain | task {…} | `modules/hall-ui/public/idea.js:195` |
 | `a41659dc2bee` | certain | tasks remaining | `modules/hall-ui/public/roadmap.js:273` |
 | `bd3402efa59e` | certain | task{…} shipped | `modules/hall-ui/public/goals-render.js:656` |
 | `ee431f143549` | certain | three tasks | `modules/hall-ui/public/not-ready.html:28` |
@@ -1147,7 +1147,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `085f93f3f775` | certain | {…} — see all standings | `modules/hall-ui/public/hall-render.js:80` |
 | `f75ee96a7511` | certain | {…} — total payout from shipped work. | `modules/hall-ui/public/profile.js:58` |
 | `2a2728a4ec4f` | certain | {…}% of tasks complete | `modules/hall-ui/public/roadmap.js:70` |
-| `c43050b62297` | certain | {…}/100 complete | `modules/hall-ui/public/idea.js:73` |
+| `c43050b62297` | certain | {…}/100 complete | `modules/hall-ui/public/idea.js:81` |
 | `499916045b19` | certain | {…}{…} asks to join | `modules/hall-ui/public/goal-inbox.js:69` |
 | `99d107c17070` | certain | · by {…} · | `modules/hall-ui/public/gate.js:138` |
 | `4188b6f8997e` | certain | · default (on) | `modules/hall-ui/public/settings.js:500` |

package/docs/copy-registry.json

@@ -1224,8 +1224,8 @@
       "text": "idea {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/idea.js:190",
-        "modules/hall-ui/public/ideas.js:326"
+        "modules/hall-ui/public/idea.js:198",
+        "modules/hall-ui/public/ideas.js:334"
       ]
     },
     {
@@ -1265,7 +1265,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/gate.js:123",
-        "modules/hall-ui/public/idea.js:187"
+        "modules/hall-ui/public/idea.js:195"
       ]
     },
     {
@@ -1752,7 +1752,7 @@
       "surface": "builders-hall",
       "text": "A quick idea is a thought filed fast. It is not an unfinished Full Idea — only its author can offer it up for development.",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 237,
+      "line": 245,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1950,7 +1950,7 @@
       "surface": "builders-hall",
       "text": "Answer the five questions and this spark becomes a Full Idea.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 415,
+      "line": 423,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -2112,7 +2112,7 @@
       "surface": "builders-hall",
       "text": "As first filed",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 229,
+      "line": 237,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3147,7 +3147,7 @@
       "surface": "builders-hall",
       "text": "Could not load idea {…}.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 444,
+      "line": 456,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3228,7 +3228,7 @@
       "surface": "builders-hall",
       "text": "Could not load the idea template. Reload, or file from the terminal with capture.js.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 422,
+      "line": 438,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3255,7 +3255,7 @@
       "surface": "builders-hall",
       "text": "Could not load the question labels; showing the answers as stored.",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 221,
+      "line": 229,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3264,7 +3264,7 @@
       "surface": "builders-hall",
       "text": "Could not load the queue just now.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 379,
+      "line": 387,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3804,7 +3804,7 @@
       "surface": "builders-hall",
       "text": "Develop this idea",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 414,
+      "line": 422,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3993,7 +3993,7 @@
       "surface": "builders-hall",
       "text": "Draft discarded.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 339,
+      "line": 347,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4263,7 +4263,7 @@
       "surface": "builders-hall",
       "text": "Five questions, and a score that counts how much of each you actually answered.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 432,
+      "line": 448,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4740,7 +4740,7 @@
       "surface": "builders-hall",
       "text": "Idea {…}",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 244,
+      "line": 252,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4884,7 +4884,7 @@
       "surface": "builders-hall",
       "text": "Its author marked this as needing development — anyone can turn it into a Full Idea, and they keep the credit for having had it.",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 235,
+      "line": 243,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5712,7 +5712,7 @@
       "surface": "builders-hall",
       "text": "No description.",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 106,
+      "line": 114,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5946,7 +5946,7 @@
       "surface": "builders-hall",
       "text": "Not scored.",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 70,
+      "line": 78,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6045,7 +6045,7 @@
       "surface": "builders-hall",
       "text": "Nothing is waiting. A spark appears here when its author offers a quick idea up for development.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 357,
+      "line": 365,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7548,7 +7548,7 @@
       "surface": "builders-hall",
       "text": "Showing {…} of {…}.",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 361,
+      "line": 369,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8961,7 +8961,7 @@
       "surface": "builders-hall",
       "text": "Write one",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 235,
+      "line": 243,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9807,7 +9807,7 @@
       "surface": "builders-hall",
       "text": "idea {…}",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 190,
+      "line": 198,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9816,7 +9816,7 @@
       "surface": "builders-hall",
       "text": "idea {…}",
       "file": "modules/hall-ui/public/ideas.js",
-      "line": 326,
+      "line": 334,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9987,7 +9987,7 @@
       "surface": "builders-hall",
       "text": "merged into",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 190,
+      "line": 198,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10383,7 +10383,7 @@
       "surface": "builders-hall",
       "text": "task {…}",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 187,
+      "line": 195,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10950,7 +10950,7 @@
       "surface": "builders-hall",
       "text": "{…}/100 complete",
       "file": "modules/hall-ui/public/idea.js",
-      "line": 73,
+      "line": 81,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/modules/hall-ui/public/idea.js

@@ -39,7 +39,15 @@
   'use strict';
 
   const API = '/api/gds';
-  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  // NO baseUrl OVERRIDE — this page calls the GENERATED namespaced methods
+  // (api.inbox.*, api.me.*), whose path templates are API-RELATIVE ('/inbox/template').
+  // baseUrl:'' means "these paths are already absolute" and passes them through
+  // unchanged, which sent every request to the SITE ROOT and 404'd — this page was
+  // dead in production from the day it shipped. Letting it default resolves them
+  // against '/api/bongos/v1' (api-prefix.js VERSIONED_API_PREFIX), where the router
+  // actually mounts. A page that DOES pass baseUrl:'' must build full paths itself
+  // via api.request('GET', `${API}/...`) as work.js/copy-desk.js do — never mix the two.
+  const api = window.BongosClient.createClient({ credentials: 'same-origin', throwOnError: false });
   const { escapeHtml, $, fmtDate } = window.OTB;
 
   const ideaId = () => {

package/modules/hall-ui/public/ideas.js

@@ -44,7 +44,15 @@
 (() => {
   'use strict';
 
-  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  // NO baseUrl OVERRIDE — this page calls the GENERATED namespaced methods
+  // (api.inbox.*, api.me.*), whose path templates are API-RELATIVE ('/inbox/template').
+  // baseUrl:'' means "these paths are already absolute" and passes them through
+  // unchanged, which sent every request to the SITE ROOT and 404'd — this page was
+  // dead in production from the day it shipped. Letting it default resolves them
+  // against '/api/bongos/v1' (api-prefix.js VERSIONED_API_PREFIX), where the router
+  // actually mounts. A page that DOES pass baseUrl:'' must build full paths itself
+  // via api.request('GET', `${API}/...`) as work.js/copy-desk.js do — never mix the two.
+  const api = window.BongosClient.createClient({ credentials: 'same-origin', throwOnError: false });
   const { escapeHtml, $, toast } = window.OTB;
 
   // One key per THING BEING WRITTEN. A new idea and a spark being developed are
@@ -417,6 +425,14 @@
   }
 
   async function main() {
+    // THE QUEUE IS LOADED FIRST, AND UNCONDITIONALLY. The composer and the spark
+    // queue are independent surfaces that happen to share a page: the queue needs
+    // no template. Loading it after the template check meant one failed fetch took
+    // BOTH down — the reported symptom was "Could not load the idea template" AND a
+    // queue stuck on "Loading…" forever, which read as two bugs and was one.
+    // A surface that does not depend on the failure must not be hostage to it.
+    loadQueue();
+
     const r = await api.inbox.getInboxTemplate({});
     if (!r.ok || !r.data || !r.data.template) {
       $('#fi-sub').textContent = 'Could not load the idea template. Reload, or file from the terminal with capture.js.';
@@ -434,10 +450,6 @@
     $('#fi-form').addEventListener('submit', file);
     $('#fi-clear').addEventListener('click', discard);
 
-    // The queue loads on every visit, develop mode or not: having just picked one
-    // up, seeing what else is waiting is the natural next thing.
-    loadQueue();
-
     if (DEVELOP_ID) {
       const d = await api.inbox.getInboxId({ id: DEVELOP_ID });
       if (!d.ok || !d.data || !d.data.idea) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.347",
+  "version": "1.19.348",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.347",
+      "version": "1.19.348",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.347",
+  "version": "1.19.348",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/client-baseurl-guard.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// scripts/gds/client-baseurl-guard.js — a web page must not send its API calls to
+// the site root (task 1003263).
+//
+// THE BUG THIS EXISTS TO STOP. The generated client (clients/bongos-client) exposes
+// two call styles, and mixing them is silent and fatal:
+//
+//   NAMESPACED   api.inbox.getInboxTemplate({})   → path template '/inbox/template',
+//                                                   API-RELATIVE, needs the API base
+//   ESCAPE HATCH api.request('GET', `${API}/me`)  → caller supplies the FULL path
+//
+// createClient documents `baseUrl: ''` as "paths are already absolute" and passes
+// them through unchanged. So a page that sets baseUrl:'' AND calls a namespaced
+// method requests '/inbox/template' — the SITE ROOT, where nothing is mounted — and
+// 404s on every call. The router mounts at '/api/bongos/v1' (api-prefix.js
+// VERSIONED_API_PREFIX), which is exactly the client's own default.
+//
+// WHY A FITNESS CHECK AND NOT A TEST. Three pages shipped this defect — ideas.js and
+// idea.js were dead in production from the day they shipped, and collab.js was caught
+// in review one commit before it would have been. Every page test stubs the client
+// method directly, so URL construction is never exercised; tests/idea_hall_composer.mjs
+// even asserted with a regex against the source text, which passes happily on a broken
+// URL. 54 green tests over pages that 404 on every call. The defect is invisible to the
+// test style this repo uses for hall pages, so it needs a guard at a different altitude.
+//
+// STATIC AND CONSERVATIVE. It flags only the unambiguous combination — an explicit
+// empty baseUrl in a createClient call, in a file that also makes a namespaced call.
+// A page using the escape hatch with baseUrl:'' is CORRECT and stays silent (work.js,
+// copy-desk.js, goal-inbox.js and most of the hall do exactly that).
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const NAME = 'a web page sends its API calls to the API, not the site root (task 1003263)';
+
+// createClient({ ... baseUrl: '' ... }) — an EXPLICIT empty base. Omitting baseUrl is
+// the correct fix and must not match; only the literal empty string is the defect.
+const EMPTY_BASEURL = /createClient\(\s*\{[^}]*baseUrl\s*:\s*(''|""|`\s*`)/;
+
+// api.<namespace>.<method>( — the generated namespaced style. `api.request(` is the
+// escape hatch and is deliberately NOT matched: with it, baseUrl:'' is correct.
+const NAMESPACED_CALL = /\bapi\s*\.\s*(?!request\b)[A-Za-z_$][\w$]*\s*\.\s*[A-Za-z_$][\w$]*\s*\(/;
+
+// Every tracked browser-served script. Server code never calls createClient this way.
+function trackedPageScripts() {
+  try {
+    const out = execFileSync('git', ['ls-files', 'modules/*/public/*.js', 'public/*.js'],
+      { cwd: REPO_ROOT, encoding: 'utf8' });
+    return out.split('\n').map((s) => s.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+function scanPages(files, read) {
+  const violations = [];
+  let scanned = 0;
+  let usingClient = 0;
+  for (const rel of files) {
+    const src = read(rel);
+    if (src == null) continue;
+    scanned += 1;
+    if (!/createClient\(/.test(src)) continue;
+    usingClient += 1;
+    if (!EMPTY_BASEURL.test(src)) continue;
+    if (!NAMESPACED_CALL.test(src)) continue; // escape-hatch page — baseUrl:'' is right
+    const m = NAMESPACED_CALL.exec(src);
+    violations.push(
+      `${rel} sets baseUrl:'' AND calls the generated client (${m[0].replace(/\s+/g, '')}…). `
+      + "Those paths are API-relative, so baseUrl:'' sends them to the site root and every "
+      + 'call 404s. Drop the baseUrl override, or switch every call to '
+      + "api.request('METHOD', `${API}/…`) with a full path.",
+    );
+  }
+  return { violations, scanned, usingClient };
+}
+
+function checkClientBaseUrl({ files, read } = {}) {
+  const list = files || trackedPageScripts();
+  if (!list.length) {
+    return {
+      name: NAME, ok: false, hardFail: true,
+      violations: ['scan defect — enumerated 0 tracked page scripts; a broken enumeration, not a clean result.'],
+      warnings: [], note: 'static scan of browser-served scripts for a root-bound API client.',
+    };
+  }
+  const reader = read || ((rel) => {
+    try { return fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'); } catch { return null; }
+  });
+  const { violations, scanned, usingClient } = scanPages(list, reader);
+  return {
+    name: NAME,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} browser-served script(s) scanned, ${usingClient} building a client: none may combine `
+      + "baseUrl:'' with a generated namespaced call (api.<ns>.<method>()) — that pairing 404s every request. "
+      + "baseUrl:'' with api.request() and a full path is the correct escape-hatch style and is not flagged.",
+  };
+}
+
+function main() {
+  const r = checkClientBaseUrl();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = { checkClientBaseUrl, scanPages, trackedPageScripts, EMPTY_BASEURL, NAMESPACED_CALL };

package/scripts/gds/deploy-divergence.js

@@ -160,6 +160,28 @@ async function fetchLive(base, timeoutMs = DEFAULT_TIMEOUT_MS) {
   }
 }
 
+// Is the automation that should have PREVENTED this divergence itself alive? (task 1003158)
+//
+// This script detects the SYMPTOM — live is behind main — and only ever at a moment a human is
+// already looking. What went unwatched is the auto-upgrade subscription itself: when it stopped,
+// nothing said so, and cloudbongos.com sat 36 releases behind for days. Reading the roster here means
+// a dead upgrader is reported in the same breath as the staleness it was supposed to prevent.
+//
+// Speaks ONLY when a subscription manifest is actually present. An ordinary core checkout has none by
+// design (ADR 0136 — it ships empty), and alarming about that every session is exactly the noise that
+// gets a real warning scrolled past. Present-but-broken, or present-and-subscribing-nothing, is the
+// signal worth having: someone meant to enroll instances here and none are being upgraded.
+function subscriptionHealth(dir = REPO_ROOT) {
+  try {
+    const uc = require('./update-channel');
+    const roster = uc.loadSubscriptions({ instanceDir: dir });
+    if (!roster.present) return null;
+    return uc.describeRoster(roster, { controlPlane: true });
+  } catch {
+    return null; // never let the health probe break the divergence check it rides along with
+  }
+}
+
 async function check({ base, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   const target = base || arg('--url') || API_BASE;
   const local = coreVersionAt(null);
@@ -173,7 +195,9 @@ async function check({ base, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   const unreleased = unreleasedSince(mainRef);
   const live = await fetchLive(target, timeoutMs);
 
-  if (live.error) return { ok: false, undetermined: true, reason: `could not read ${live.url}: ${live.error}`, target, local, onMain, unreleased };
+  const subscriptions = subscriptionHealth();
+
+  if (live.error) return { ok: false, undetermined: true, reason: `could not read ${live.url}: ${live.error}`, target, local, onMain, unreleased, subscriptions };
 
   const behind = cmpSemver(live.coreVersion, onMain) < 0;
   const ahead = cmpSemver(live.coreVersion, onMain) > 0;
@@ -181,7 +205,7 @@ async function check({ base, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
 
   return {
     ok: !behind && !hasUnreleased,
-    target, local, onMain, mainRef, unreleased, live, behind, ahead, hasUnreleased,
+    target, local, onMain, mainRef, unreleased, live, behind, ahead, hasUnreleased, subscriptions,
   };
 }
 
@@ -232,6 +256,13 @@ function report(r, { quiet = false } = {}) {
   if (r.ahead) {
     say(`  note: live (${r.live.coreVersion}) is AHEAD of ${r.mainRef} (${r.onMain}) — this checkout is stale; fetch.`);
   }
+  // The watcher's watcher: if this checkout carries a subscription roster and that roster is not
+  // healthy, the unattended upgrade is not going to close the gap above on its own.
+  if (r.subscriptions && r.subscriptions.level !== 'ok') {
+    say('');
+    say(`  ${r.subscriptions.level === 'alarm' ? '⚠ AUTO-UPGRADE' : 'note: auto-upgrade'} — ${r.subscriptions.message}`);
+    if (r.behind) say('    So the gap above will NOT close by itself.');
+  }
   say('');
   say('  Merging to main deploys nothing by design. "shipped" means "merged" —');
   say('  it does not mean users can see it.');
@@ -317,4 +348,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { check, report, line, coreVersionAt, unreleasedSince, cmpSemver };
+module.exports = { check, report, line, coreVersionAt, unreleasedSince, cmpSemver, subscriptionHealth };

package/scripts/gds/fitness.js

@@ -1307,6 +1307,7 @@ const CHECKS = [
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
   require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why
+  require('./client-baseurl-guard.js').checkClientBaseUrl, // Check 27 — task 1003263: a page must not combine baseUrl:'' with a generated namespaced call (that pairing 404s every request; three pages shipped it, two of them dead in prod)
 ];
 
 function runAll() {

package/scripts/gds/update-channel.js

@@ -32,6 +32,23 @@ const DEFAULT_CHANNEL = 'patch';
 // core template — a fresh instance subscribes nothing until the operator lists a target here.
 const SUBSCRIPTIONS_REL = path.join('config', 'update-subscriptions.json');
 
+// Why a roster came back the way it did. The routine reports this EVERY run: an upgrader whose only
+// job is keeping instances current must never be indistinguishable from one that has stopped. Before
+// task 1003158 an absent manifest, a malformed manifest and a deliberately empty roster all produced
+// the same silent `instances: []`, which is exactly how cloudbongos.com sat 36 releases behind for
+// days with nothing complaining (the same failure SHAPE as blocker 1000097 / task 1002521).
+const ROSTER_OK = 'ok';                       // at least one usable entry
+const ROSTER_ABSENT = 'manifest-absent';      // no file at all
+const ROSTER_MALFORMED = 'manifest-malformed';// file present, JSON unparseable
+const ROSTER_EMPTY = 'roster-empty';          // file parsed, nothing subscribable in it
+const ROSTER_REASONS = [ROSTER_OK, ROSTER_ABSENT, ROSTER_MALFORMED, ROSTER_EMPTY];
+
+// How many releases a subscribed instance may fall behind before "the upgrader stopped" is the only
+// remaining explanation. A successful sweep takes the HIGHEST permitted version in one jump, so a
+// healthy roster returns to 0 behind after every run — a backlog that keeps growing means no run is
+// landing. 5 leaves room for a busy publish-on-merge day between two daily sweeps without crying wolf.
+const DEFAULT_STALENESS_THRESHOLD = 5;
+
 // ---- semver (stable x.y.z, optional prerelease tag) -------------------------
 // A deliberately small parser — the repo avoids an npm-semver dependency in the CLI path (see
 // upgrade.js versionFromDep). We only need compare + the major/minor/patch fields.
@@ -143,16 +160,23 @@ function parseNpmViewVersions(stdout) {
 // this control plane keeps up to date. Never throws: a missing/malformed file ⇒ an empty roster
 // (subscribe nothing), because an unreadable manifest must not upgrade anything. Each entry is
 // normalized to { slug, dir, service, healthUrl, channel } with the channel validated + defaulted.
+//
+// Still fails CLOSED, no longer fails QUIET (task 1003158): every return carries a `reason` from
+// ROSTER_REASONS and a `dropped` count of entries that were unusable, so a caller can say WHY it is
+// about to do nothing. Pair it with describeRoster() for the line to print.
 function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SUBSCRIPTIONS_REL } = {}) {
   const abs = path.isAbsolute(file) ? file : path.join(instanceDir, file);
   let raw;
-  try { raw = fsImpl.readFileSync(abs, 'utf8'); } catch (_) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: false }; }
+  try { raw = fsImpl.readFileSync(abs, 'utf8'); } catch (_) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: false, dropped: 0, reason: ROSTER_ABSENT }; }
   let json;
-  try { json = JSON.parse(raw); } catch (e) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: true, error: `malformed JSON: ${e.message}` }; }
+  try { json = JSON.parse(raw); } catch (e) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: true, dropped: 0, error: `malformed JSON: ${e.message}`, reason: ROSTER_MALFORMED }; }
   const defaultChannel = normalizeChannel(json.defaultChannel);
   const rows = Array.isArray(json.instances) ? json.instances : [];
-  const instances = rows
-    .filter((r) => r && typeof r === 'object' && r.dir) // an entry without a dir can't be upgraded — drop it
+  // An entry without a dir can't be upgraded — drop it, but COUNT the drops. Silently discarding an
+  // operator's malformed row is how an instance believes it is enrolled while nothing ever touches it.
+  const usable = rows.filter((r) => r && typeof r === 'object' && r.dir);
+  const dropped = rows.length - usable.length;
+  const instances = usable
     .map((r) => ({
       slug: String(r.slug || r.dir),
       dir: String(r.dir),
@@ -178,7 +202,90 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
         ? Object.fromEntries(Object.entries(r.env).filter(([, v]) => typeof v === 'string'))
         : {},
     }));
-  return { defaultChannel, instances, source: abs, present: true };
+  return {
+    defaultChannel, instances, source: abs, present: true, dropped,
+    reason: instances.length ? ROSTER_OK : ROSTER_EMPTY,
+  };
+}
+
+// ---- reporting: make "nothing happened" audible -----------------------------
+
+// Turn a loadSubscriptions() result into the line a routine prints EVERY run, plus a level a caller
+// can act on ('ok' | 'warn' | 'alarm'). The judgement that matters is `controlPlane`: a fresh
+// instance subscribing nothing is the shipped default (ADR 0136 — the manifest ships empty), but a
+// CONTROL PLANE that subscribes nothing has silently stopped doing its only job, and that is an alarm.
+// A malformed manifest is an alarm everywhere — an operator wrote something and it does not parse.
+function describeRoster(roster, { controlPlane = false } = {}) {
+  const r = roster || {};
+  const reason = ROSTER_REASONS.includes(r.reason) ? r.reason : ROSTER_EMPTY;
+  const where = r.source || SUBSCRIPTIONS_REL;
+  const dropped = Number(r.dropped) || 0;
+  const n = Array.isArray(r.instances) ? r.instances.length : 0;
+
+  if (reason === ROSTER_MALFORMED) {
+    return { level: 'alarm', reason, count: n, dropped,
+      message: `update-subscriptions: MALFORMED manifest at ${where} (${r.error || 'unparseable'}) — subscribing NOTHING. No instance will be upgraded until this parses.` };
+  }
+  if (reason === ROSTER_ABSENT) {
+    return { level: controlPlane ? 'alarm' : 'warn', reason, count: n, dropped,
+      message: `update-subscriptions: no manifest at ${where} — subscribing NOTHING.${controlPlane ? ' This is a CONTROL PLANE: it is supposed to keep instances current and currently keeps none.' : ' That is the shipped default; add an instance to enroll it.'}` };
+  }
+  if (reason === ROSTER_EMPTY) {
+    return { level: controlPlane ? 'alarm' : 'warn', reason, count: n, dropped,
+      message: `update-subscriptions: manifest at ${where} lists no upgradable instance${dropped ? ` (${dropped} entr${dropped === 1 ? 'y' : 'ies'} dropped for a missing \`dir\`)` : ''} — subscribing NOTHING.${controlPlane ? ' This is a CONTROL PLANE: it is supposed to keep instances current and currently keeps none.' : ''}` };
+  }
+  // Usable entries — still surface partial loss, which is the quiet half of an enrolled-but-untouched
+  // instance: the sweep looks healthy while the operator's broken row is never upgraded.
+  if (dropped > 0) {
+    return { level: 'warn', reason, count: n, dropped,
+      message: `update-subscriptions: ${n} instance${n === 1 ? '' : 's'} subscribed, but ${dropped} entr${dropped === 1 ? 'y was' : 'ies were'} DROPPED for a missing \`dir\` in ${where} — those instances are NOT being upgraded.` };
+  }
+  return { level: 'ok', reason, count: n, dropped,
+    message: `update-subscriptions: ${n} instance${n === 1 ? '' : 's'} subscribed from ${where}.` };
+}
+
+// ---- watching the watcher ---------------------------------------------------
+
+// How far behind is this instance in releases its OWN channel is entitled to take? Not raw version
+// distance: majors, prereleases and (on the patch channel) minors are releases the subscription is
+// correctly declining, and counting them would alarm on instances that are behaving exactly as
+// configured. `behind` is therefore "stable releases this channel WOULD have taken and has not".
+//
+// This is the check that was missing (task 1003158). deploy-divergence.js detects the SYMPTOM — live
+// is behind main — at ship time, when a human is already looking. Nothing watched whether the
+// upgrader itself was still alive, so its death was only ever discovered by someone noticing stale UI
+// days later. A healthy sweep drives `behind` to 0 every run, so a persistent backlog IS the alarm.
+//
+// A `pinned` instance is never stale: channelAllows declines everything, so behind === 0 by
+// construction. That is correct — a pinned instance is not neglected, it is pinned.
+function subscriptionStaleness({ installed, channel, available, threshold = DEFAULT_STALENESS_THRESHOLD } = {}) {
+  const ch = normalizeChannel(channel);
+  const list = Array.isArray(available) ? available : [];
+  // `installed` is parsed and the channel re-normalized ONCE, not per candidate:
+  // channelAllows re-does both on every element, and this filter is the only place
+  // that calls it in a loop. Cheap either way at registry scale — hoisted because
+  // the invariant genuinely is invariant, not because the arithmetic hurts.
+  const from = parseSemver(installed);
+  const behind = (ch === 'pinned' || !from) ? 0
+    : list.filter((v) => channelAllows(installed, v, ch)).length;
+  const t = Number(threshold);
+  const limit = Number.isFinite(t) && t >= 0 ? t : DEFAULT_STALENESS_THRESHOLD;
+  return {
+    channel: ch,
+    installed: installed == null ? null : String(installed),
+    target: resolveChannelTarget({ installed, channel: ch, available: list }),
+    behind,
+    threshold: limit,
+    stale: behind > limit,
+  };
+}
+
+// The alarm line for one subscribed instance, or null when it is healthy (nothing to say).
+function describeStaleness(st, { slug = 'instance' } = {}) {
+  if (!st || !st.stale) return null;
+  return `update-subscriptions: ${slug} is ${st.behind} ${st.channel} release${st.behind === 1 ? '' : 's'} behind `
+    + `(installed ${st.installed || 'unknown'}, entitled to ${st.target}) — over the ${st.threshold} threshold. `
+    + 'A healthy sweep clears this to zero every run, so the upgrader has most likely stopped.';
 }
 
 module.exports = {
@@ -195,4 +302,13 @@ module.exports = {
   listAvailableVersions,
   parseNpmViewVersions,
   loadSubscriptions,
+  ROSTER_OK,
+  ROSTER_ABSENT,
+  ROSTER_MALFORMED,
+  ROSTER_EMPTY,
+  ROSTER_REASONS,
+  DEFAULT_STALENESS_THRESHOLD,
+  describeRoster,
+  subscriptionStaleness,
+  describeStaleness,
 };

package/src/module-api.js

@@ -1124,8 +1124,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.345 with no explicit bump. run 32801147433. (task 1002620)
 //   1.19.347 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.346 with no explicit bump. run 32802265337. (task 1002620)
+//   1.19.348 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.347 with no explicit bump. run 32802746363. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.347'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.348'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/client_baseurl_guard.mjs

@@ -0,0 +1,122 @@
+// tests/client_baseurl_guard.mjs — the guard that stops a page 404ing every call
+// (task 1003263).
+//
+// Three pages shipped the defect this guard exists to catch: ideas.js and idea.js
+// were dead in production from the day they shipped, and collab.js was caught one
+// commit before it would have joined them. So the guard itself is worth testing on
+// synthetic sources rather than only on the live tree — a scan that passes because
+// the tree happens to be clean today proves nothing about what it would REFUSE.
+//
+// Every case below is an in-memory file: no fixtures on disk, no dependence on the
+// current state of modules/hall-ui/public/.
+//
+// Run:  node tests/client_baseurl_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { checkClientBaseUrl, scanPages } = require('../scripts/gds/client-baseurl-guard.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const from = (map) => ({
+  files: Object.keys(map),
+  read: (rel) => (rel in map ? map[rel] : null),
+});
+
+// --- THE DEFECT ------------------------------------------------------------
+
+test('the exact shipped defect is refused: baseUrl:\'\' plus a namespaced call', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/bad.js':
+      "const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin' });\n"
+      + 'const r = await api.inbox.getInboxTemplate({});\n',
+  })));
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /bad\.js/);
+  assert.match(violations[0], /site root/, 'the message says WHY it is wrong, not just that it is');
+  assert.match(violations[0], /Drop the baseUrl override/, 'and what to do about it');
+});
+
+test('double-quoted and backtick empty bases are the same defect', () => {
+  for (const empty of ['""', '``']) {
+    const { violations } = scanPages(...Object.values(from({
+      'public/p.js': `const api = createClient({ baseUrl: ${empty} });\napi.me.getMe({});\n`,
+    })));
+    assert.equal(violations.length, 1, `baseUrl: ${empty} must be caught`);
+  }
+});
+
+// --- WHAT IT MUST NOT FLAG -------------------------------------------------
+// A guard that fires on correct code gets suppressed, and then it protects nothing.
+
+test("the escape-hatch style is CORRECT with baseUrl:'' — never flagged", () => {
+  // work.js, copy-desk.js and most of the hall do exactly this: empty base, but
+  // every path written out in full. Flagging it would be a false positive on the
+  // majority of the hall.
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/work.js':
+      "const API = '/api/bongos';\n"
+      + "const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin' });\n"
+      + "const res = await api.request('GET', `${API}/tasks`);\n",
+  })));
+  assert.deepEqual(violations, []);
+});
+
+test('the fix itself passes — omitting baseUrl with namespaced calls is correct', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/ideas.js':
+      "const api = window.BongosClient.createClient({ credentials: 'same-origin', throwOnError: false });\n"
+      + 'await api.inbox.getInboxTemplate({});\n',
+  })));
+  assert.deepEqual(violations, [], 'the shipped fix must not trip the guard that motivated it');
+});
+
+test('a non-empty baseUrl is a deliberate choice, not the defect', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'public/ext.js':
+      "const api = createClient({ baseUrl: 'https://other.example/api/bongos/v1' });\n"
+      + 'api.me.getMe({});\n',
+  })));
+  assert.deepEqual(violations, []);
+});
+
+test('a page that builds no client at all is ignored', () => {
+  const { violations, usingClient } = scanPages(...Object.values(from({
+    'public/static.js': "document.querySelector('#x').textContent = 'hi';\n",
+  })));
+  assert.deepEqual(violations, []);
+  assert.equal(usingClient, 0);
+});
+
+// --- THE SCAN MUST NOT SILENTLY SUCCEED ------------------------------------
+
+test('an empty enumeration is a hard FAIL, not a clean pass', () => {
+  // The failure mode that makes a guard worthless: git ls-files returns nothing,
+  // zero files are scanned, and the check reports green forever.
+  const r = checkClientBaseUrl({ files: [], read: () => null });
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations[0], /scan defect/);
+});
+
+test('an unreadable file is skipped without being counted as scanned', () => {
+  const { scanned } = scanPages(['gone.js'], () => null);
+  assert.equal(scanned, 0);
+});
+
+test('the check reports hardFail so CI actually stops', () => {
+  const r = checkClientBaseUrl(from({
+    'public/bad.js': "createClient({ baseUrl: '' });\napi.inbox.postInbox({});\n",
+  }));
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true, 'a page dead in prod is not a warning');
+});
+
+console.log(`\nclient_baseurl_guard: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/idea_hall_composer.mjs

@@ -112,6 +112,17 @@ await test('the page gets both the FORM and the METER from the server', () => {
   assert.match(IDEAS_JS, /getInboxTemplate/, 'the form is rendered from GET /inbox/template');
   assert.match(IDEAS_JS, /postInboxScore/, 'the meter is filled from POST /inbox/score');
   assert.match(IDEAS_JS, /postInbox\b/, 'and it files through POST /inbox');
+
+  // ...AND THOSE CALLS MUST REACH THE API. The three assertions above are regexes
+  // over the SOURCE TEXT, so they passed for months while the page 404'd on every
+  // one of them: baseUrl:'' told the client the API-relative templates were already
+  // absolute, and each request went to the site root. Naming a method proves the
+  // call is written, never that it is addressed — task 1003263.
+  assert.doesNotMatch(
+    IDEAS_JS,
+    /createClient\(\s*\{[^}]*baseUrl\s*:\s*(''|"")/,
+    "baseUrl:'' sends the generated client's API-relative paths to the site root",
+  );
 });
 
 await test('the page does not print a pass bar — that rule lives in economy', () => {

package/tests/update_channel.mjs

@@ -8,6 +8,8 @@
 //   4. parseNpmViewVersions — the array / bare-string / empty shapes npm view emits.
 //   5. listAvailableVersions — ok + fail-soft with an injected runner.
 //   6. loadSubscriptions — missing/malformed → empty; channel default + validate; env kept; dropless.
+//   7. describeRoster — an empty roster REPORTS WHY, and is an alarm on a control plane (task 1003158).
+//   8. subscriptionStaleness — releases the channel was entitled to and did not take = "the upgrader stopped".
 //
 // DB-free + network-free (every external is injected). Run:  node tests/update_channel.mjs
 
@@ -182,6 +184,129 @@ t('loadSubscriptions: an entry without a dir is dropped (cannot be upgraded)', (
   assert.equal(r.instances[0].slug, 'real');
 });
 
+// ---- describeRoster: fails closed, no longer fails quiet (task 1003158) ----
+//
+// The regression these pin: before this, a missing manifest, a malformed manifest and a deliberately
+// empty roster were INDISTINGUISHABLE — all three returned a bare `instances: []` and the routine
+// shrugged. cloudbongos.com sat 36 releases behind for days because "nothing happened" looked
+// identical to "nothing needed to happen". Every empty roster must now say WHY, every run.
+
+t('loadSubscriptions: missing file reports reason manifest-absent (not just an empty list)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'otb-subs-none2-'));
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.deepEqual(r.instances, []);
+  assert.equal(r.reason, uc.ROSTER_ABSENT);
+  assert.equal(r.dropped, 0);
+});
+
+t('loadSubscriptions: malformed JSON reports reason manifest-malformed + keeps the error', () => {
+  const dir = scratchWith('{ not valid');
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.equal(r.reason, uc.ROSTER_MALFORMED);
+  assert.match(r.error, /malformed JSON/);
+});
+
+t('loadSubscriptions: parsed-but-unsubscribable reports roster-empty and COUNTS the drops', () => {
+  const dir = scratchWith({ instances: [{ slug: 'ghost' }, { slug: 'alsoghost' }] });
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.deepEqual(r.instances, []);
+  assert.equal(r.reason, uc.ROSTER_EMPTY);
+  assert.equal(r.dropped, 2);
+});
+
+t('loadSubscriptions: a usable roster reports ok', () => {
+  const dir = scratchWith({ instances: [{ slug: 'cb', dir: '/srv/cb' }] });
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.equal(r.reason, uc.ROSTER_OK);
+  assert.equal(r.dropped, 0);
+});
+
+t('describeRoster: an empty roster on a CONTROL PLANE is an alarm, not a shrug', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'otb-subs-cp-'));
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }), { controlPlane: true });
+  assert.equal(d.level, 'alarm');
+  assert.match(d.message, /CONTROL PLANE/);
+  assert.match(d.message, /subscribing NOTHING/);
+});
+
+t('describeRoster: the same empty roster on a plain instance is only a warn (shipped default)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'otb-subs-plain-'));
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }));
+  assert.equal(d.level, 'warn');
+  assert.match(d.message, /shipped default/);
+});
+
+t('describeRoster: a malformed manifest is an alarm everywhere', () => {
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: scratchWith('{ nope') }));
+  assert.equal(d.level, 'alarm');
+  assert.match(d.message, /MALFORMED/);
+});
+
+t('describeRoster: partial loss is surfaced — a healthy-looking sweep that silently skips a row', () => {
+  const dir = scratchWith({ instances: [{ slug: 'cb', dir: '/srv/cb' }, { slug: 'ghost' }] });
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }));
+  assert.equal(d.level, 'warn');
+  assert.equal(d.dropped, 1);
+  assert.match(d.message, /DROPPED/);
+});
+
+t('describeRoster: a clean roster is ok and says how many it holds', () => {
+  const dir = scratchWith({ instances: [{ slug: 'cb', dir: '/srv/cb' }] });
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }), { controlPlane: true });
+  assert.equal(d.level, 'ok');
+  assert.equal(d.count, 1);
+});
+
+// ---- subscriptionStaleness: watching the watcher ---------------------------
+
+const RELEASES = Array.from({ length: 41 }, (_, i) => `1.19.${250 + i}`); // 1.19.250 … 1.19.290
+
+t('subscriptionStaleness: reproduces the incident — 1.19.254 on patch is 36 releases behind, stale', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.254', channel: 'patch', available: RELEASES });
+  assert.equal(st.behind, 36);
+  assert.equal(st.target, '1.19.290');
+  assert.equal(st.stale, true);
+});
+
+t('subscriptionStaleness: a swept instance is 0 behind and not stale', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.290', channel: 'patch', available: RELEASES });
+  assert.equal(st.behind, 0);
+  assert.equal(st.target, null);
+  assert.equal(st.stale, false);
+});
+
+t('subscriptionStaleness: a busy publish-on-merge day under the threshold does NOT cry wolf', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.287', channel: 'patch', available: RELEASES });
+  assert.equal(st.behind, 3);
+  assert.equal(st.stale, false);
+});
+
+t('subscriptionStaleness: a pinned instance is never stale (declining is not neglect)', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.254', channel: 'pinned', available: RELEASES });
+  assert.equal(st.behind, 0);
+  assert.equal(st.stale, false);
+});
+
+t('subscriptionStaleness: counts only what the CHANNEL may take — minors/majors are not a backlog', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.254', channel: 'patch', available: ['1.20.0', '1.20.7', '2.0.0'] });
+  assert.equal(st.behind, 0);
+  assert.equal(st.stale, false);
+  // the same list on the minor channel IS a backlog
+  assert.equal(uc.subscriptionStaleness({ installed: '1.19.254', channel: 'minor', available: ['1.20.0', '1.20.7', '2.0.0'] }).behind, 2);
+});
+
+t('subscriptionStaleness: threshold is overridable; a bad threshold falls back to the default', () => {
+  assert.equal(uc.subscriptionStaleness({ installed: '1.19.287', channel: 'patch', available: RELEASES, threshold: 1 }).stale, true);
+  assert.equal(uc.subscriptionStaleness({ installed: '1.19.287', channel: 'patch', available: RELEASES, threshold: 'nonsense' }).threshold, uc.DEFAULT_STALENESS_THRESHOLD);
+});
+
+t('describeStaleness: silent when healthy, explicit about "the upgrader stopped" when not', () => {
+  assert.equal(uc.describeStaleness(uc.subscriptionStaleness({ installed: '1.19.290', channel: 'patch', available: RELEASES })), null);
+  const msg = uc.describeStaleness(uc.subscriptionStaleness({ installed: '1.19.254', channel: 'patch', available: RELEASES }), { slug: 'cloudbongos.com' });
+  assert.match(msg, /cloudbongos\.com is 36 patch releases behind/);
+  assert.match(msg, /upgrader has most likely stopped/);
+});
+
 console.log(`\nupdate_channel: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);