@bongos/core 1.19.382 → 1.19.384

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.382",
+  "version": "1.19.384",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.382",
+      "version": "1.19.384",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.382",
+  "version": "1.19.384",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/adr-namespace.js

@@ -0,0 +1,273 @@
+#!/usr/bin/env node
+'use strict';
+// adr-namespace.js — ADR numbering discipline (task 1003164). The ADR half of the guard
+// `migration-namespace.js` already gives migrations. Pure helpers over file lists + index
+// text, plus the fitness check that reads the tree.
+//
+// PROBLEM. An ADR number is a CITATION TARGET. ADRs cite each other by number, prose and
+// task notes cite them by number, and `docs/adr/README.md` is the index every agent is
+// told to consult. Two files can carry the same number and NOTHING notices: the filenames
+// differ (`0181-ship-requires-an-assurance.md` vs
+// `0181-teardown-state-gate-and-address-retention.md`), so there is no path collision, no
+// merge conflict, and git adds both cleanly. README.md auto-merges too, ending up with two
+// `| 0181 |` rows. Unit, fitness, docs-entropy and the grader all passed; it was found on
+// 2026-08-22 only because a human read `ls docs/adr/`. By then task 1000900's
+// close-rationale had already cited "ADR 0180", which the collision had made point at an
+// unrelated document — a citation that is wrong forever.
+//
+// THE ASYMMETRY THIS CLOSES. Migrations have exactly this protection already: a re-used
+// migration number silently SKIPS a migration, so `stemCollisions()` hard-fails CI. ADRs
+// got `next-number.js` — which computes the next free number at claim time, on a
+// possibly-stale tree, best-effort — and then nothing enforced it afterwards. Same shared,
+// monotonic, human-allocated number line; one guarded, one not. A stale claim card, two
+// builders claiming the same day, or a branch that sits long enough all reproduce it.
+//
+// WHY GRANDFATHER RATHER THAN RENUMBER. When this landed the live tree already held TWENTY
+// colliding numbers, not the one the bug report found. Renumbering nineteen pairs would
+// break every existing citation to them — which is the very harm this check exists to
+// prevent — and README.md states the rule outright: a number, once assigned, is never
+// reused. So the existing pairs are frozen into LEGACY_DUPLICATE_ADRS by their EXACT
+// filenames (the shape migration-namespace.js uses for its own grandfathering, and for
+// RENAMED_MODULE_PREFIXES). Frozen by exact filename, not by number, is the load-bearing
+// part: a THIRD file joining a legacy number still fails, and so does a rename of either
+// half. The list can only shrink. See ADR 0195.
+//
+// The index half is checked by LINK TARGET, not by number, because a number rule alone
+// cannot express the grandfathered pairs: the invariant is that every ADR file has exactly
+// one row and every row points at a file that exists. That catches the dangling row AND
+// the duplicated row AND the file nobody indexed — the last of which is how a collision
+// actually hides, since the second file of a colliding pair is the one that never gets a
+// row.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { CORE_ROOT } = require('./fitness-lib.js');
+
+// ---- parsing ---------------------------------------------------------------
+
+// `NNNN-kebab-title.md` — the naming rule in docs/adr/README.md §File naming.
+const ADR_RE = /^(\d{4})-(.+)\.md$/;
+
+// Parse an ADR basename into { number, num, slug, ok }. `number` is the 4-digit STRING
+// (the citation form, zero-padded); `num` is the integer for ordering/allocation. A
+// non-ADR name (README.md, a draft) returns { ok: false }.
+function parseAdrName(basename) {
+  const m = ADR_RE.exec(String(basename == null ? '' : basename));
+  if (!m) return { number: null, num: null, slug: null, ok: false };
+  return { number: m[1], num: parseInt(m[1], 10), slug: m[2], ok: true };
+}
+
+// The 4-digit number string of an ADR basename, or null if it is not an ADR.
+function adrNumberOf(basename) {
+  const p = parseAdrName(basename);
+  return p.ok ? p.number : null;
+}
+
+// ---- grandfathered collisions ---------------------------------------------
+
+// Numbers already shared by two files when this check landed (task 1003164, 2026-08-27).
+// Frozen by EXACT filename: a third file on one of these numbers, or a rename of either
+// half, is still a hard failure. This list may shrink (if a pair is ever consolidated) and
+// must never grow — a new collision is the bug the check exists to catch.
+const LEGACY_DUPLICATE_ADRS = Object.freeze({
+  '0008': Object.freeze(['0008-family-based-tile-generation.md', '0008-google-chat-oauth-user-auth.md']),
+  '0024': Object.freeze(['0024-cloneable-repo-local-first-memory.md', '0024-multi-agent-system-architecture.md']),
+  '0025': Object.freeze(['0025-offsite-backup-vendor-digitalocean-spaces.md', '0025-structured-criterion-task-link.md']),
+  '0044': Object.freeze(['0044-mediterranean-palette-replacement.md', '0044-per-box-live-game-preview.md']),
+  '0057': Object.freeze(['0057-container-cost-ledger.md', '0057-discord-archon-approval-channels.md']),
+  '0072': Object.freeze(['0072-bongos-app-mac-signed-first-windows-deferred.md', '0072-dev-box-code-staleness-visibility.md']),
+  '0073': Object.freeze(['0073-builder-needs-signal-and-byok-gemini-key.md', '0073-secrets-scan-exclude-uri-detector.md']),
+  '0082': Object.freeze(['0082-productized-key-storage-provisioning.md', '0082-server-side-merge-conflict-auto-resolution.md']),
+  '0087': Object.freeze(['0087-bongos-app-architecture-and-handoff-contract.md', '0087-compete-on-governance-not-tooling-cursor.md']),
+  '0095': Object.freeze(['0095-borrowed-memory-and-retrieval-concepts.md', '0095-cross-agent-context-management.md']),
+  '0097': Object.freeze(['0097-one-active-claim-per-session-and-worktree-binding.md', '0097-retroactive-reward-backfill.md']),
+  '0103': Object.freeze(['0103-core-first-extraction-cloud-bongos-trunk.md', '0103-gdsv4-bongos-consolidation.md']),
+  '0144': Object.freeze(['0144-devbox-rehome-onto-cloudbongos-plane.md', '0144-federated-single-logout-backchannel.md']),
+  '0145': Object.freeze(['0145-devbox-app-branding-driven-module.md', '0145-free-hosted-project-tier-isolation-and-domain-separation.md']),
+  '0152': Object.freeze(['0152-landing-gate-served-by-the-core-app.md', '0152-metic-task-abandonment.md']),
+  '0167': Object.freeze(['0167-gate-trust-link-agpl-default.md', '0167-module-catalog-source-vs-provenance.md']),
+  '0172': Object.freeze(['0172-editable-rank-roles-substrate-axis.md', '0172-per-craft-compensation-ideator-credit-lane.md']),
+  '0184': Object.freeze(['0184-a-task-visual-inherits-its-summary-audience.md', '0184-ship-requires-an-assurance.md']),
+  '0187': Object.freeze(['0187-collab-four-decisions.md', '0187-oauth-handshake-cookie-lifetime.md']),
+  '0192': Object.freeze(['0192-a-category-orients-and-authorises-nothing.md', '0192-platform-visibility-member-door.md']),
+});
+
+// Is this exact set of files the frozen legacy pair for that number? Set-equality, so
+// adding a third file or renaming either half stops being grandfathered.
+function isGrandfathered(number, files) {
+  const legacy = LEGACY_DUPLICATE_ADRS[number];
+  if (!legacy) return false;
+  if (files.length !== legacy.length) return false;
+  const a = [...files].sort();
+  const b = [...legacy].sort();
+  return a.every((f, i) => f === b[i]);
+}
+
+// ---- collision detector ----------------------------------------------------
+
+// Given ADR basenames, return [{ number, files[] }] for every number claimed by more than
+// one file, EXCLUDING the frozen legacy pairs. The direct analogue of
+// migration-namespace.js stemCollisions().
+function numberCollisions(basenames) {
+  const byNumber = new Map();
+  for (const name of basenames || []) {
+    const p = parseAdrName(name);
+    if (!p.ok) continue;
+    if (!byNumber.has(p.number)) byNumber.set(p.number, new Set());
+    byNumber.get(p.number).add(name);
+  }
+  const out = [];
+  for (const [number, set] of byNumber) {
+    const files = [...set].sort();
+    if (files.length > 1 && !isGrandfathered(number, files)) out.push({ number, files });
+  }
+  return out.sort((a, b) => a.number.localeCompare(b.number));
+}
+
+// The next free ADR number (integer): max + 1, 1 on an empty tree. Mirrors next-number.js
+// nextFree so a caller can allocate without reaching for git.
+function nextAdrNumber(basenames) {
+  let max = 0;
+  for (const name of basenames || []) {
+    const p = parseAdrName(name);
+    if (p.ok && p.num > max) max = p.num;
+  }
+  return max + 1;
+}
+
+// ---- index (docs/adr/README.md) --------------------------------------------
+
+// An index row: `| NNNN | [Title](NNNN-slug.md) | topic |`. The leading cell may carry a
+// disambiguating suffix (`0008-a`) for a grandfathered pair, so the number is read from
+// the leading cell and the row's OWN file from the link target that starts with it — row
+// prose cites other ADRs by link too, and only the own-number target is the row's subject.
+const INDEX_ROW_RE = /^\|\s*(\d{4})(?:-[a-z])?\s*\|/;
+const INDEX_LINK_RE = /\]\((\d{4}-[^)]*\.md)\)/g;
+
+// Parse README text into [{ number, target, targets, lineNo, ok }]. `target` is the row's
+// own ADR filename, or null when the row names none (or names more than one of its own
+// number, which is ambiguous and reported as a violation).
+function parseIndexRows(readmeText) {
+  const rows = [];
+  const lines = String(readmeText == null ? '' : readmeText).split('\n');
+  lines.forEach((line, i) => {
+    const m = INDEX_ROW_RE.exec(line);
+    if (!m) return;
+    const number = m[1];
+    INDEX_LINK_RE.lastIndex = 0;
+    const own = [...line.matchAll(INDEX_LINK_RE)].map((x) => x[1]).filter((t) => t.startsWith(number + '-'));
+    rows.push({ number, target: own.length === 1 ? own[0] : null, targets: own, lineNo: i + 1, ok: own.length === 1 });
+  });
+  return rows;
+}
+
+// The index invariant, checked by LINK TARGET: every ADR file has exactly one row, and
+// every row points at a file that exists. Returns violation strings.
+function indexViolations({ basenames = [], rows = [] } = {}) {
+  const violations = [];
+  const files = new Set((basenames || []).filter((n) => parseAdrName(n).ok));
+
+  const rowsByTarget = new Map();
+  for (const r of rows) {
+    if (!r.ok) {
+      violations.push(
+        `docs/adr/README.md:${r.lineNo}: the index row for ${r.number} names ${r.targets.length} link(s) to its own number `
+        + `(${r.targets.join(', ') || 'none'}) — a row must link its own ADR file exactly once so the index can be checked against the tree.`);
+      continue;
+    }
+    if (!rowsByTarget.has(r.target)) rowsByTarget.set(r.target, []);
+    rowsByTarget.get(r.target).push(r.lineNo);
+  }
+
+  for (const [target, lineNos] of [...rowsByTarget.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    if (!files.has(target)) {
+      violations.push(
+        `docs/adr/README.md:${lineNos[0]}: index row points at docs/adr/${target}, which does not exist — a dangling index row `
+        + `(the other half of the collision problem: a merge can leave a row behind after the file it named moved or was renumbered).`);
+    }
+    if (lineNos.length > 1) {
+      violations.push(
+        `docs/adr/README.md: ${target} has ${lineNos.length} index rows (lines ${lineNos.join(', ')}) — exactly one row per ADR; `
+        + 'a duplicated row is what an auto-merged index leaves behind.');
+    }
+  }
+
+  for (const f of [...files].sort()) {
+    if (!rowsByTarget.has(f)) {
+      violations.push(
+        `docs/adr/${f} has no row in docs/adr/README.md — every ADR is indexed. (This is how a number collision hides: the `
+        + 'second file of a colliding pair is the one that never gets indexed, so the tree and the index quietly disagree.)');
+    }
+  }
+
+  return violations;
+}
+
+// Rows should read in ascending number order. WARNING only, never a hard failure: the live
+// index carries legacy rows an auto-merge placed out of order, and blocking on history
+// would fail every PR for a mess nobody's diff created (the ADR 0189 split — declaration
+// rot hard-fails, inherited drift warns).
+function indexOrderWarnings(rows) {
+  const warnings = [];
+  let prev = null;
+  for (const r of rows) {
+    if (prev !== null && r.number < prev) {
+      warnings.push(`docs/adr/README.md:${r.lineNo}: row ${r.number} sits after ${prev} — the index reads in ascending order.`);
+    }
+    if (prev === null || r.number > prev) prev = r.number;
+  }
+  return warnings;
+}
+
+// ---- the fitness check -----------------------------------------------------
+
+const ADR_DIR = path.join(CORE_ROOT, 'docs', 'adr');
+
+function adrFilesIn(absDir) {
+  try { return fs.readdirSync(absDir).filter((f) => parseAdrName(f).ok).sort(); }
+  catch { return []; } // no docs/adr in a vanilla instance → nothing to check
+}
+
+// Check 31 — two ADRs may not share a number, and the index must agree with the tree.
+function checkAdrNumbering() {
+  const files = adrFilesIn(ADR_DIR);
+  const violations = [];
+
+  for (const c of numberCollisions(files)) {
+    violations.push(
+      `ADR number ${c.number} is claimed by ${c.files.length} files (${c.files.map((f) => `docs/adr/${f}`).join(', ')}) — `
+      + 'an ADR number is a citation target, so a duplicate makes every citation to it ambiguous forever. Renumber the NEWER '
+      + 'file to the next free number (node scripts/gds/next-number.js) and move its README row with it.');
+  }
+
+  let readme = null;
+  try { readme = fs.readFileSync(path.join(ADR_DIR, 'README.md'), 'utf8'); } catch { /* no index → nothing to reconcile */ }
+  const rows = readme === null ? [] : parseIndexRows(readme);
+  if (readme !== null) violations.push(...indexViolations({ basenames: files, rows }));
+  const warnings = readme === null ? [] : indexOrderWarnings(rows);
+
+  return {
+    name: 'ADR numbers unique + index agrees with the tree (task 1003164)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: `${files.length} ADR file(s), ${rows.length} index row(s), `
+      + `${Object.keys(LEGACY_DUPLICATE_ADRS).length} grandfathered duplicate number(s) (frozen by exact filename — the list may only shrink). `
+      + `Next free number: ${String(nextAdrNumber(files)).padStart(4, '0')}.`,
+  };
+}
+
+module.exports = {
+  ADR_RE,
+  LEGACY_DUPLICATE_ADRS,
+  parseAdrName,
+  adrNumberOf,
+  isGrandfathered,
+  numberCollisions,
+  nextAdrNumber,
+  parseIndexRows,
+  indexViolations,
+  indexOrderWarnings,
+  checkAdrNumbering,
+};

package/scripts/gds/fitness.js

@@ -1319,6 +1319,12 @@ const CHECKS = [
   // doc-comment gate that blocks a ship buys filler prose, not understanding.
   // Making it blocking is an owner decision and needs its own ADR.
   require('./doc-comment-coverage.js').checkDocCommentCoverage,
+  // Check 31 — task 1003164: two ADRs may not share a number, and docs/adr/README.md
+  // must agree with the tree. The ADR half of the guard Check 11b already gives
+  // migrations: same shared, monotonic, human-allocated number line, and until this
+  // landed only one of the two was enforced. An ADR number is a citation target, so a
+  // duplicate is wrong forever (ADR 0195).
+  require('./adr-namespace.js').checkAdrNumbering,
 ];
 
 function runAll() {
@@ -1364,6 +1370,7 @@ module.exports = {
   checkKernelImportsNoDomain,
   checkModuleMigrationsAdditive,
   checkMigrationNamespacing, // Check 11b — ADR 0108 §5 cross-repo migration filenames
+  checkAdrNumbering: require('./adr-namespace.js').checkAdrNumbering, // Check 31 — task 1003164 / ADR 0195: ADR numbers unique + index agrees with the tree
   checkDesignContract,
   checkKernelPromptsNoHardcodedIdentity, // BV1.R76 / task 1705
   scanPromptIdentity,                    // BV1.R76 — negative-test hook

package/src/module-api.js

@@ -1204,8 +1204,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.380 with no explicit bump. run 33088290961. (task 1002620)
 //   1.19.382 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.381 with no explicit bump. run 33094545251. (task 1002620)
+//   1.19.383 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.382 with no explicit bump. run 33101389971. (task 1002620)
+//   1.19.384 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.383 with no explicit bump. run 33116184189. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.382'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.384'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fitness.mjs

@@ -354,6 +354,124 @@ test('migration-namespacing actually CATCHES a cross-source stem collision (the
   assert.equal(collisions[0].stem, '188_x');
 });
 
+// --- Check 31: ADR numbers unique + index agrees with the tree (task 1003164 / ADR 0195) ---
+//
+// The ADR half of Check 11b's guard. The fixture is the REAL collision: on 2026-08-22 two
+// branches each landed an ADR numbered 0181 under different slugs, so git saw no path
+// collision, README.md auto-merged into two rows, and every gate passed.
+
+const adrNs = require(path.join(ROOT, 'scripts', 'gds', 'adr-namespace.js'));
+
+test('ADR numbering: the live tree is clean (all 20 known duplicates grandfathered)', () => {
+  const r = fitness.checkAdrNumbering();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  assert.match(r.note, /ADR file\(s\)/, 'note reports the file + row counts');
+});
+
+test('ADR numbering actually CATCHES two ADRs sharing a number (the 0181 pair, not a no-op gate)', () => {
+  const collisions = adrNs.numberCollisions([
+    '0180-dependency-intake-and-drift-policy.md',
+    '0181-ship-requires-an-assurance.md',
+    '0181-teardown-state-gate-and-address-retention.md',
+    '0182-something-else.md',
+  ]);
+  assert.equal(collisions.length, 1, 'the shared number must be reported exactly once');
+  assert.equal(collisions[0].number, '0181');
+  assert.deepEqual(collisions[0].files, [
+    '0181-ship-requires-an-assurance.md',
+    '0181-teardown-state-gate-and-address-retention.md',
+  ], 'BOTH paths are named — the report has to say which two files to look at');
+});
+
+test('ADR numbering: a grandfathered pair passes, but a THIRD file on that number does not', () => {
+  const pair = adrNs.LEGACY_DUPLICATE_ADRS['0008'];
+  assert.equal(pair.length, 2, 'fixture: 0008 is a known legacy pair');
+
+  // the exact frozen pair is exempt
+  assert.deepEqual(adrNs.numberCollisions([...pair]), [], 'the frozen legacy pair must pass');
+
+  // a third file joining the number is NOT — the exemption is set-equality, not "number 0008 is free"
+  const third = adrNs.numberCollisions([...pair, '0008-a-brand-new-adr.md']);
+  assert.equal(third.length, 1, 'a third file on a grandfathered number must still be flagged');
+  assert.equal(third[0].files.length, 3);
+
+  // so is a RENAME of either half — schema-migrations-style, the frozen names are the exemption
+  const renamed = adrNs.numberCollisions([pair[0].replace('.md', '-v2.md'), pair[1]]);
+  assert.equal(renamed.length, 1, 'renaming half of a grandfathered pair un-grandfathers it');
+});
+
+test('ADR numbering: the index must have one row per file, pointing at a file that exists', () => {
+  const files = ['0001-a.md', '0002-b.md'];
+  const row = (n, slug) => `| ${n} | [Title](${n}-${slug}.md) | topic |`;
+
+  // clean: one row per file, every row resolves
+  const clean = adrNs.indexViolations({
+    basenames: files,
+    rows: adrNs.parseIndexRows([row('0001', 'a'), row('0002', 'b')].join('\n')),
+  });
+  assert.deepEqual(clean, [], 'a matching index must pass: ' + clean.join('; '));
+
+  // DANGLING row — a row for a number with no file (the other half of the collision problem:
+  // the 2026-08-22 renumber had to reposition a row by hand)
+  const dangling = adrNs.indexViolations({
+    basenames: files,
+    rows: adrNs.parseIndexRows([row('0001', 'a'), row('0002', 'b'), row('0003', 'ghost')].join('\n')),
+  });
+  assert.equal(dangling.length, 1, 'exactly one violation for the dangling row');
+  assert.match(dangling[0], /does not exist/, 'the message names the missing file');
+  assert.match(dangling[0], /0003-ghost\.md/);
+
+  // DUPLICATED row — what an auto-merged index leaves behind (the live 0116/0117 case)
+  const dupe = adrNs.indexViolations({
+    basenames: files,
+    rows: adrNs.parseIndexRows([row('0001', 'a'), row('0002', 'b'), row('0002', 'b')].join('\n')),
+  });
+  assert.equal(dupe.length, 1);
+  assert.match(dupe[0], /has 2 index rows/, 'the message counts the rows and names their lines');
+
+  // UNINDEXED file — how a collision hides: the second file of a colliding pair is the one
+  // that never gets a row, so `ls docs/adr/` and the index quietly disagree
+  const missing = adrNs.indexViolations({
+    basenames: [...files, '0003-unindexed.md'],
+    rows: adrNs.parseIndexRows([row('0001', 'a'), row('0002', 'b')].join('\n')),
+  });
+  assert.equal(missing.length, 1);
+  assert.match(missing[0], /has no row in docs\/adr\/README\.md/);
+});
+
+test('ADR numbering: a row is read by its OWN-number link, so citing other ADRs in the prose is fine', () => {
+  // Index rows routinely cite sibling ADRs inside the title cell. Only the link whose
+  // filename starts with the row's own number is the row's subject.
+  const rows = adrNs.parseIndexRows(
+    '| 0100 | [Two-repo model, superseding [0099](0099-old.md) and see [0101](0101-next.md)](0100-two-repo.md) | topic |',
+  );
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].target, '0100-two-repo.md', 'the own-number link is the row subject');
+  assert.deepEqual(
+    adrNs.indexViolations({ basenames: ['0100-two-repo.md'], rows }),
+    [], 'citing other ADRs in a row must not be read as extra rows',
+  );
+});
+
+test('ADR numbering: out-of-order rows WARN and never hard-fail (inherited drift, not a PR author\'s doing)', () => {
+  const row = (n) => `| ${n} | [T](${n}-s.md) | topic |`;
+  assert.deepEqual(adrNs.indexOrderWarnings(adrNs.parseIndexRows([row('0001'), row('0002')].join('\n'))), []);
+
+  const warns = adrNs.indexOrderWarnings(adrNs.parseIndexRows([row('0001'), row('0003'), row('0002')].join('\n')));
+  assert.equal(warns.length, 1, 'the backwards row is reported');
+  assert.match(warns[0], /ascending order/);
+
+  // and ordering contributes to `warnings`, never to `violations`
+  const live = fitness.checkAdrNumbering();
+  assert.equal(live.hardFail, false, 'the live index is out of order in places and must still pass');
+});
+
+test('ADR numbering: nextAdrNumber allocates above the highest number on disk', () => {
+  assert.equal(adrNs.nextAdrNumber(['0001-a.md', '0181-b.md', '0181-c.md']), 182, 'max + 1, duplicates included');
+  assert.equal(adrNs.nextAdrNumber([]), 1, 'an empty tree starts at 1');
+  assert.equal(adrNs.nextAdrNumber(['README.md', 'notes.txt']), 1, 'non-ADR files do not count');
+});
+
 // --- goal scope map imports PROTECTED_GLOBS (BV1.R54 / task 1508, ADR 0086 §7) ---
 
 test('scope map import check: the live module-scope-map.js passes', () => {