@bongos/core 1.19.44 → 1.19.45

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.44",
-  "core_contract": "1.19.44",
-  "source_commit": "8977d1fd08e8b805bc0322ba60414afb27f6af9a",
+  "core_version": "1.19.45",
+  "core_contract": "1.19.45",
+  "source_commit": "290f271a1fb465184f1e30a82938dbb9fc0edd7f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T17:35:45.947Z",
+  "built_at": "2026-08-11T17:49:40.375Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 290,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1213,
+    "functional_verbatim": 1214,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1524,
-  "tree_sha256": "e598e5acc03b2b1f6de9186840fddf8d59bebc82acbc22c8a4915485c52f14da",
+  "file_count": 1525,
+  "tree_sha256": "0722aab68f68291e412986ff75bc5c9e53914d42248afd4dd8f3fddef07c1d82",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1402,12 +1402,12 @@
     {
       "path": "docs/onboarding/diagrams/03-drachmae-karma.mmd",
       "mode": "0000644",
-      "sha256": "3cdfcee86d62a16c1a406dab7720eebf3eacc0fb603dc214e5520b2d826ffe97"
+      "sha256": "2e43c5910ed036657a32faa1ec1af7f5bb1bfcbc5f743a276b44b3b8b8157e4e"
     },
     {
       "path": "docs/onboarding/diagrams/04-architecture.mmd",
       "mode": "0000644",
-      "sha256": "2b8f478a8435088ed836044c4817c1e7ebaf0bc7c19998f19f40e5325594fbc0"
+      "sha256": "4af79f61f5b1871e9c2ffaa4cee703f681516f2720782b4db05b797993e0a293"
     },
     {
       "path": "docs/onboarding/diagrams/05-versioning.mmd",
@@ -1422,7 +1422,7 @@
     {
       "path": "docs/onboarding/diagrams/assertions.json",
       "mode": "0000644",
-      "sha256": "d7a8120a3a2ad20f1be87da516a3f475b03b2a1f961499f7cbb8d77a1a621886"
+      "sha256": "2716fcbc113ef046610023ff9bfefa57fe6564ead685cc3cf507f3d893ff0cd5"
     },
     {
       "path": "docs/onboarding/diagrams/puppeteer-config.json",
@@ -4032,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "04a8db8a6fe00295eda2dfc32a50ee78e14010f0ea4edc2519ea81be19d0768a"
+      "sha256": "b2fc08b1d386c093629982f52a456c2b79c9f3824a22a696ed6fdb37a9073def"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "dd4b705a9876034077010b79006d60c356cb50b4cb1e3bfe3bc3585c55d3bb7d"
+      "sha256": "d955953100c62b9b03bec90b70122f0a35d18bed91e60af2ae78f0573509a852"
     },
     {
       "path": "public-docs/index.html",
@@ -4667,7 +4667,7 @@
     {
       "path": "scripts/gds/diagram-facts.js",
       "mode": "0000644",
-      "sha256": "8c6d81c0495d05833bf5cb3d0be8ff6a29fabc24231206391f36b0c85f36b121"
+      "sha256": "fe57f283f06985234123a46b5ae055f4ecd9df26834cb99e58228a5cb649e0aa"
     },
     {
       "path": "scripts/gds/discipline-modes.json",
@@ -5657,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c29bd1491d2a2ebb5dd7f27f3be44aa3052bab88caa02e5825c7e74560b9b261"
+      "sha256": "ef3fa14314f284d7e93062ddc0b9ee7a046885bb13b20e41f62c7ef66eb29a24"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6259,6 +6259,11 @@
       "mode": "0000644",
       "sha256": "c8547f65d1cff189f88afa528489f11585385f7a5cee868ed2fb7e474b47b614"
     },
+    {
+      "path": "tests/diagram_facts_offset.mjs",
+      "mode": "0000644",
+      "sha256": "36a3bad951c6bfb4ee7b9230a5e6114095bb3b94f1f0019ec5c61c5168dee537"
+    },
     {
       "path": "tests/diff_derived_signals.mjs",
       "mode": "0000644",

package/docs/onboarding/diagrams/03-drachmae-karma.mmd

@@ -1,13 +1,13 @@
 ---
-title: Drachmae & karma — where each comes from, where each goes  (AUTO-GENERATED from live facts — do not hand-edit; see scripts/gds/gen-diagrams.js)
+title: Credits & karma — where each comes from, where each goes  (AUTO-GENERATED from live facts — do not hand-edit; see scripts/gds/gen-diagrams.js)
 ---
 flowchart LR
-    subgraph CURRENCY["DRACHMAE  (the builder reward — equity / reputation, a stake, not a spendable currency)"]
+    subgraph CURRENCY["CREDITS  (the builder reward — equity / reputation, a stake, not a spendable currency)"]
         direction TB
         D_TOKEN["Ship a SESSION — the main reward\nround(true_cost_usd × 1.20) cents — cost-plus on real token spend\n(LIVE: priced server-side from token counts; ADR 0054, idempotent per session)"]
-        D_SHIP["Confirm a TASK\ncredits_reward × kind multiplier (0.8–1.5×)\n+ 25% idea-promotion bonus to the capturer\n(LIVE: ADR 0023)"]
+        D_SHIP["SHIP a TASK — books when the code lands on main, not at confirm\ncredits_reward × kind multiplier (0.8–1.5×)\n+ 25% idea-promotion bonus to the capturer\n(LIVE: ADR 0023; pay-on-land ADR 0120; withheld entirely on a cost-plus-only instance, ADR 0146)"]
         D_ACH["Unlock an achievement\nachievements.credit_bonus (LIVE: 9 seeded)\n+ small net-negative-ship bonus"]
-        D_BOUNTY["Red-team / security bounty\ndrachmae payout by severity\n(rate card LIVE: R65 #284 — src/bongos/security.js + shown on /builders;\nawarding still PLANNED: R67 #286 + vulnerability_reports R63 #282)"]
+        D_BOUNTY["Red-team / security bounty\ncredits payout by severity\n(rate card LIVE: R65 #284 — src/bongos/security.js + shown on /builders;\nawarding still PLANNED: R67 #286 + vulnerability_reports R63 #282)"]
 
         D_BAL["builders.total_credits\n(running balance per builder)"]
 
@@ -16,7 +16,7 @@ flowchart LR
         D_ACH --> D_BAL
         D_BOUNTY -.PLANNED.-> D_BAL
 
-        D_SPEND["Spent on: nothing yet.\nDrachmae are EQUITY / reputation — a stake, not a\nspendable currency. They persist losslessly across exit (migration 025)."]
+        D_SPEND["Spent on: nothing yet.\nCredits are EQUITY / reputation — a stake, not a\nspendable currency. They persist losslessly across exit (migration 025)."]
         D_BAL --> D_SPEND
     end
 
@@ -32,6 +32,6 @@ flowchart LR
         K_BAL --> K_SURF
     end
 
-    note1["Drachmae measure OUTPUT (work shipped) — most of it now a cost-plus reward on real token spend.\nKarma measures PEER TRUST (how others rate your work); it does NOT gate rank promotions.\nBoth are reputation; neither is a spendable currency today.\nSeparately, an Archon can set a per-builder monthly budget cap to limit SPEND — but builders are uncapped by default (src/bongos/cost.js)."]
+    note1["Credits measure OUTPUT (work shipped) — most of it now a cost-plus reward on real token spend.\nKarma measures PEER TRUST (how others rate your work); it does NOT gate rank promotions.\nBoth are reputation; neither is a spendable currency today.\nSeparately, an Archon can set a per-builder monthly budget cap to limit SPEND — but builders are uncapped by default (src/bongos/cost.js)."]
     CURRENCY --- note1
     KARMA --- note1

package/docs/onboarding/diagrams/04-architecture.mmd

@@ -13,25 +13,26 @@ flowchart TB
         CODE["the code — git clone + per-builder worktrees (.claude/worktrees/*)\nfor sub-Metic builders it lives ONLY here · CLAUDE.md is DESCRIPTIVE only"]
         LOCAL["local ~/.claude memory\nMAP = MEMORY.md — a one-line index loaded EVERY session\n(a guard + auto-tidy keep it light; ADR 0074)\n+ drawer of full notes, loaded only on demand"]
         ORIGIN["credential-less git origin\n(NO GitHub push secret on the box — by design)"]
-        BOXTOK["box-scoped GDS token\n(deny-by-default: bootstrap endpoints only;\nrejected for branch upload → re-auth first — LIVE)"]
+        BOXTOK["box-scoped Bongos token\n(deny-by-default: bootstrap endpoints only;\nrejected for branch upload → re-auth first — LIVE)"]
         PREVIEW["sandbox preview server on :3000\n→ a per-builder sandbox URL (LIVE)"]
         SWITCH["on / off + browser terminal\n(desktop app LIVE · ttyd-over-tunnel LIVE)"]
     end
 
-    subgraph SERVER["THE SERVER — amazonprimea.com (the authority AND production)"]
-        API["/api/gds/* (same Node process as the game)"]
+    subgraph SERVER["THE INSTANCE SERVER — localhost:3000 (the authority AND production)"]
+        API["/api/bongos/* (same Node process as the app)"]
+        CORE["@bongos/core — the build platform, VENDORED as a pinned dependency\n(ADR 0108: central updates are a version-pin bump via `bongos upgrade`, not a merge)"]
         DB["Postgres — tasks · claims · versions · builders.rank\ncredit_log · grades · idea_inbox · builder_memory\n(KING for work-state + permissions; CLAUDE.md only describes it)"]
         RANK["auth.requireRank — checked per request, NO caching\n(ADR 0016: a demotion takes effect on the next request)"]
-        SRVMEM["server-side builder_memory store\nLIVE: per-builder · isolated · Archon-audited forensic read\nyour memory follows you across machines & worktrees\n/recall fetches only the relevant subset (ADR 0060)\n(R54 / R55 / R56 / R57 — all shipped)"]
+        SRVMEM["server-side builder_memory store\nLIVE: per-builder · isolated · forensic read at Metic+ (ADR 0157)\nyour memory follows you across machines & worktrees\n/recall fetches only the relevant subset (ADR 0060)\n(R54 / R55 / R56 / R57 — all shipped)"]
         PUSHTOK["server-held push credential\n(GitHub App, short-lived tokens — the box never holds it)"]
+        DEPLOY["auto-pull deploy (ADR 0129)\na timer pulls THIS instance repo every ~2 min →\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]
     end
 
-    subgraph GH["GITHUB — the code repository (github.com/lars589/amazonprimea)"]
-        MAIN["branch-protected main\n(no direct push; PR + required checks only)"]
-        ACTIONS["GitHub Actions — deploy-prod.yml"]
+    subgraph GH["GITHUB — the instance's own repo (github.com/lars589/cloud-bongos)"]
+        MAIN["branch-protected main\n(no direct push; PR + required checks only)\nholds config + the pinned @bongos/core — NOT the platform source"]
     end
 
-    GAME["the live game — amazonprimea.com\n(same server · same Node process as /api/gds/*)"]
+    LIVEAPP["the live app — localhost:3000\n(same server · same Node process as /api/bongos/*)"]
 
     APP -->|"1 · toggle box on / open terminal"| SWITCH
     SWITCH --> WORKER
@@ -39,13 +40,14 @@ flowchart TB
     WORKER -->|"3 · re-auth in browser"| API
     WORKER -->|"4 · upload branch as a git bundle"| API
     API -->|"5 · push + open PR + auto-merge (LIVE)"| MAIN
-    MAIN -->|"6 · merge triggers deploy (LIVE)"| ACTIONS
-    ACTIONS -->|"7 · deploy (no droplet key on any box)"| GAME
+    MAIN -->|"6 · the instance auto-pulls its own main"| DEPLOY
+    DEPLOY -->|"7 · migrate · regenerate docs · restart"| LIVEAPP
+    CORE --- API
     PUSHTOK -.-> API
     ORIGIN -. "direct push blocked" .-> MAIN
     API -. "claim / ship / cost" .-> WORKER
     LOCAL -->|"sync on ship (push)"| SRVMEM
     SRVMEM -->|"pull on session start"| LOCAL
 
-    NEXT["The whole box → production path is LIVE and hardware-verified end-to-end (1027 · 1028)."]
-    GAME --- NEXT
+    NEXT["The whole box → production path is LIVE: a credential-less box uploads its branch, the server merges it, and the instance auto-pulls + redeploys — hardware-verified end-to-end (1027 · 1028)."]
+    LIVEAPP --- NEXT

package/docs/onboarding/diagrams/assertions.json

@@ -107,7 +107,7 @@
   },
   "architecture": {
     "diagram": "04-architecture",
-    "_comment": "Pieces of 04-architecture gated on a backing GDS task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 859 (CI deploy), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). Supersedes the old server_repo_memory + dev_box slices.",
+    "_comment": "Pieces of 04-architecture gated on a backing GDS task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
     "live_tasks": [
       {
         "id": 273,
@@ -123,7 +123,7 @@
       },
       {
         "id": 276,
-        "label": "R57 — per-builder isolation + Archon audited forensic read"
+        "label": "R57 — per-builder isolation + forensic read at Metic+ (ADR 0157)"
       },
       {
         "id": 904,
@@ -145,10 +145,6 @@
         "id": 1025,
         "label": "server-mediated branch publish (box uploads bundle, server pushes)"
       },
-      {
-        "id": 859,
-        "label": "CI self-deploy (Actions deploys main to the droplet)"
-      },
       {
         "id": 1027,
         "label": "hardware-verify the box-to-prod flow end-to-end"

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.44",
+  "version": "1.19.45",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.44",
+      "version": "1.19.45",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.44",
+  "version": "1.19.45",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/diagram-facts.js

@@ -149,9 +149,11 @@ async function liveVersions() {
 // the two diagrams reference (authenticated, since /tasks/:id is not public) and
 // the count of seeded achievements (for 03's "N seeded" label).
 //
-// The task ids below are the LIVE GDS ids (verified 2026-05-30), NOT the seed
-// refs — the V3 renumber (migration 021) made seed-ref R##s diverge from live
-// ids in a couple of places. In particular the bounty-AWARDING gate is the
+// The task ids below are the ORIGIN instance's live GDS ids (verified
+// 2026-05-30), NOT the seed refs — the V3 renumber (migration 021) made
+// seed-ref R##s diverge from live ids in a couple of places (so a source_ref
+// lookup would be unreliable). On an instance that imported the origin backlog
+// under new ids they resolve through the IMPORT_ID_OFFSETS probe below. In particular the bounty-AWARDING gate is the
 // "auto-confirmation flow that awards drachmae" task (#286 / live ref R67), not
 // the security-ADR-stub task that the old hand-authored .mmd loosely called
 // "R68" (#287). Each entry documents the piece it drives.
@@ -242,31 +244,56 @@ function repoSlug(repo) {
   return 'the project repo';
 }
 
+// An instance that IMPORTED the origin backlog renumbers the origin tasks by a
+// uniform offset (the reference import renumbered +1000000: origin 276 → live
+// 1000276), so the origin ids above 404 there and every conceptual regen
+// silently degraded to the null sentinel (task 1002667). Probe each id at these
+// offsets, origin-first; the first offset that resolves LOCKS for the rest of
+// the bundle — a uniform renumber can't mix offsets, and locking means a
+// coincidental id collision on a foreign instance degrades to the sentinel
+// instead of blending statuses from two different task sets.
+const IMPORT_ID_OFFSETS = [0, 1_000_000];
+
 // Fetch live status for each conceptual task id. Authenticated (allow-unauth so
 // a 401 returns a sentinel instead of exiting the whole process via cli-lib's
-// guidance path). Returns null on ANY failure (no session, network, non-200) so
-// the generator can SKIP regenerating 03/04 rather than emit wrong data.
-async function conceptualFacts({ repo, migs }) {
+// guidance path). Ids resolve through the IMPORT_ID_OFFSETS probe but the
+// returned map stays keyed by the ORIGIN ids, so the templates, assertions.json,
+// and the drift checker all keep one stable key set. Returns null on ANY failure
+// (no session, network, non-200) so the generator can SKIP regenerating 03/04
+// rather than emit wrong data.
+async function conceptualFacts({ repo, migs, api }) {
   // Reuse the caller's migrations read when provided (gatherFacts already reads
   // them once); only fall back to a fresh read for standalone callers.
   migs = migs || readMigrations(repo);
-  const { cliClient } = require('./cli-lib');
-  // allow-unauth so a 401 returns a sentinel instead of exiting the whole
-  // process via cli-lib's guidance path (see the loop's degrade-to-null below).
-  const api = await cliClient({ allowUnauthenticated: true });
+  if (!api) {
+    const { cliClient } = require('./cli-lib');
+    // allow-unauth so a 401 returns a sentinel instead of exiting the whole
+    // process via cli-lib's guidance path (see the loop's degrade-to-null below).
+    api = await cliClient({ allowUnauthenticated: true });
+  }
   // 03's pieces + 04-architecture's memory chain + its dev-box/ship-flow pieces
   // share one fetch + one taskStatus map; any unreachable id degrades the WHOLE
   // conceptual bundle (so 03 + 04 skip together rather than emit partial data).
   const ALL_TASK_IDS = { ...CONCEPTUAL_TASK_IDS, ...DEV_BOX_TASK_IDS };
   const ids = Object.keys(ALL_TASK_IDS).map(Number);
   const status = {};
+  let lockedOffset = null;
   for (const id of ids) {
     let s = null;
-    try {
-      const r = await api.tasks.getTasksId({ id });
-      if (r.ok) s = (r.data.task || r.data).status || null;
-    } catch (_) {
-      s = null;
+    const offsets = lockedOffset === null ? IMPORT_ID_OFFSETS : [lockedOffset];
+    for (const off of offsets) {
+      try {
+        const r = await api.tasks.getTasksId({ id: id + off });
+        if (r.ok) {
+          // A 200 means this id exists at this offset — accept it and stop
+          // probing (a missing status field still degrades below).
+          s = (r.data.task || r.data).status || null;
+          if (s !== null) lockedOffset = off;
+          break;
+        }
+      } catch (_) {
+        s = null;
+      }
     }
     if (s === null) {
       // Any unreachable id degrades the whole conceptual bundle — partial data
@@ -315,5 +342,6 @@ module.exports = {
   conceptualFacts,
   CONCEPTUAL_TASK_IDS,
   DEV_BOX_TASK_IDS,
+  IMPORT_ID_OFFSETS,
   gatherFacts,
 };

package/src/module-api.js

@@ -515,8 +515,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.42 with no explicit bump. run 31517196176. (task 1002620)
 //   1.19.44 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.43 with no explicit bump. run 31518312009. (task 1002620)
+//   1.19.45 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.44 with no explicit bump. run 31519500533. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.44'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.45'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/diagram_facts_offset.mjs

@@ -0,0 +1,71 @@
+// tests/diagram_facts_offset.mjs — conceptualFacts import-offset probe (task 1002667).
+//
+// The conceptual onboarding diagrams (03/04) gate each piece on an ORIGIN
+// task id. An instance that imported the origin backlog renumbers those tasks
+// by a uniform offset (+1000000 on the reference import), so the ids must
+// resolve through the IMPORT_ID_OFFSETS probe — keyed BACK to the origin ids —
+// or every conceptual regen silently degrades to null and 03/04 never update.
+//
+// Run:  node --test tests/diagram_facts_offset.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO = path.join(__dirname, '..');
+const facts = require(path.join(REPO, 'scripts/gds/diagram-facts.js'));
+
+const ORIGIN_IDS = Object.keys({
+  ...facts.CONCEPTUAL_TASK_IDS,
+  ...facts.DEV_BOX_TASK_IDS,
+}).map(Number);
+
+// Mock API: resolves any id present in `rows` ({id → status}); 404s the rest.
+const mockApi = (rows) => ({
+  tasks: {
+    getTasksId: async ({ id }) => {
+      if (id in rows) return { ok: true, data: { task: { id: String(id), status: rows[id] } } };
+      return { ok: false, status: 404, data: { error: 'not found' } };
+    },
+  },
+});
+
+test('origin instance: ids resolve directly, map keyed by origin ids', async () => {
+  const rows = Object.fromEntries(ORIGIN_IDS.map((id) => [id, 'shipped']));
+  const c = await facts.conceptualFacts({ repo: REPO, migs: [], api: mockApi(rows) });
+  assert.ok(c, 'bundle resolved, not degraded');
+  for (const id of ORIGIN_IDS) assert.equal(c.taskStatus[id], 'shipped');
+});
+
+test('imported instance (+1000000): ids resolve at the offset, map still keyed by origin ids', async () => {
+  const rows = Object.fromEntries(ORIGIN_IDS.map((id) => [id + 1_000_000, 'shipped']));
+  const c = await facts.conceptualFacts({ repo: REPO, migs: [], api: mockApi(rows) });
+  assert.ok(c, 'bundle resolved through the offset probe');
+  for (const id of ORIGIN_IDS) {
+    assert.equal(c.taskStatus[id], 'shipped', `origin id ${id} keyed in the returned map`);
+    assert.ok(!(id + 1_000_000 in c.taskStatus), 'no offset-id keys leak into the map');
+  }
+});
+
+test('offset locks on first hit: a coincidental origin-id row cannot blend task sets', async () => {
+  // Everything lives at +1000000, but one LATER id also exists bare with a
+  // conflicting status. Once the first id locks the offset, the bare row must
+  // be ignored — the +1000000 row's status wins.
+  const rows = Object.fromEntries(ORIGIN_IDS.map((id) => [id + 1_000_000, 'shipped']));
+  const later = ORIGIN_IDS[ORIGIN_IDS.length - 1];
+  rows[later] = 'backlog';
+  const c = await facts.conceptualFacts({ repo: REPO, migs: [], api: mockApi(rows) });
+  assert.ok(c, 'bundle resolved');
+  assert.equal(c.taskStatus[later], 'shipped', 'locked offset wins over the coincidental bare id');
+});
+
+test('unresolvable id degrades the whole bundle to null (unchanged sentinel contract)', async () => {
+  const rows = Object.fromEntries(ORIGIN_IDS.map((id) => [id + 1_000_000, 'shipped']));
+  delete rows[ORIGIN_IDS[0] + 1_000_000];
+  const c = await facts.conceptualFacts({ repo: REPO, migs: [], api: mockApi(rows) });
+  assert.equal(c, null);
+});