@bongos/core 1.19.500 → 1.19.502

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.500",
-  "core_contract": "1.19.500",
-  "source_commit": "a32255a73df577c87bedc922b521fc7374a0eb0b",
+  "core_version": "1.19.502",
+  "core_contract": "1.19.502",
+  "source_commit": "0028d2b0b8159fb3da54835fd45eeb3ae98f7916",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T15:26:23.313Z",
+  "built_at": "2026-09-03T16:16:35.542Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 425,
+    "docs_redacted": 426,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 1942,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2391,
-  "tree_sha256": "07f04a18dbb583be232b10b4742281dc87feb4a4659b4517acf7e02138fa6d88",
+  "file_count": 2392,
+  "tree_sha256": "ad1558679b2605e11cf647772ee24f67c5bd59c0e1d98bcdf81d7a795c456654",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -317,7 +317,7 @@
     {
       "path": ".gitattributes",
       "mode": "0000644",
-      "sha256": "106e3a8a087cf1a9dd932513115d16c387cfeebea0e22ed269a672f95efdac1e"
+      "sha256": "3848ed851a03fd11f8dae94c1e94b802c4aa625efaa7f4aff27438a1fdfb67ac"
     },
     {
       "path": "CLAUDE.md",
@@ -877,7 +877,7 @@
     {
       "path": "docs/adr/0082-server-side-merge-conflict-auto-resolution.md",
       "mode": "0000644",
-      "sha256": "ce00626058783ba42629d88da8d03ef868d4743d4b01ed87b6348d20fcbca395"
+      "sha256": "7da7140202139c123e832f527167c96de18eb498ae21243cd30cea6b133c8f90"
     },
     {
       "path": "docs/adr/0083-modular-architecture-strangler-build-plan.md",
@@ -1677,12 +1677,17 @@
     {
       "path": "docs/adr/0234-idea-routing-capture-time-promotion-landing-matrix-homeless-inbox.md",
       "mode": "0000644",
-      "sha256": "de04b3e3a03f66dd92003dc256c1839a4c8bcc213fb26103b60baf940046502e"
+      "sha256": "417d1faffdc644b6dbad3d27fc58fac7d87609550060d0cd4edb0bad702d6b4c"
+    },
+    {
+      "path": "docs/adr/0235-a-fix-category-is-kindbug-under-a-goal-no-column-required.md",
+      "mode": "0000644",
+      "sha256": "f3573d82c77dc2b7d006f4ee8051b9b5a247669d2ac4c046c2de7c282d4e65ff"
     },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "f86a0fd77bda20522e0907c607b3ef9724f092194760563c92254855b681404d"
+      "sha256": "43d782f6ca3f187f280e13466830ceceaf6ba74da2cc669e8b7dd6ece166d657"
     },
     {
       "path": "docs/api-reference.md",
@@ -2567,7 +2572,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "39d9876101cffec994b779de1ea393541ed9542bc509a4927db1e3012b3b2771"
+      "sha256": "bccd3e96df6a344e806052af69493507b4ccab78ab3149aa10f7373d8546fb97"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7212,12 +7217,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ddc63051177f7e290a4d7ff897edbe1299ea563749a431df4c8c9c82b84ecb29"
+      "sha256": "5911d20e472c017d950ca2154d1c0e86e7479e07c9efb4a02eecea0534aae58c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2540d87863daa2bf32507482a181ac806097ce0600a04aa5d706b8f9457899c7"
+      "sha256": "2220826fc5bb64636838a79c72229e973109a28639174748ca7e2fb505192f97"
     },
     {
       "path": "public-docs/index.html",
@@ -7732,7 +7737,7 @@
     {
       "path": "scripts/gds/git-merge-regen.js",
       "mode": "0000644",
-      "sha256": "75130de4a880fc7d76f5a8d79ed65750238df94847c1ccfdc974188f9300a1e6"
+      "sha256": "f9a391ac6f32b2d5ca939b48186b6d9cb7aa171554652a5b5afbc4a408aae203"
     },
     {
       "path": "scripts/gds/go-live.js",
@@ -8887,7 +8892,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bf718372363571b9b3dcafc59cf249690636b5150983bca93114af00adf0643a"
+      "sha256": "636b358e8be667bd38743b42009ee1101b0c330584fc647f71424c03fe166c71"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9877,7 +9882,7 @@
     {
       "path": "tests/git_merge_regen.mjs",
       "mode": "0000644",
-      "sha256": "3c718cdd83f7c997a89bcf55120ad641a2c8ed4bea7cbbf5aa253792f867a467"
+      "sha256": "2d3574914c1f9c843396f498a8e68c2fd8ec2a5bc574c98f64dc2505aa1ccba8"
     },
     {
       "path": "tests/github_push_ancestry.mjs",

package/.gitattributes

@@ -74,6 +74,16 @@ src/bongos/CLAUDE.md          merge=otb-regen
 src/bongos/routes/CLAUDE.md   merge=otb-regen
 scripts/gds/CLAUDE.md      merge=otb-regen
 
+# docs/copy-registry.json + docs/copy-inventory.md (task 1003543): the copy
+# registry's committed pair (scripts/gds/copy-inventory.js) — fully generated from
+# a tree scan, nothing hand-authored in either, so two branches that each touch
+# hall/status/landing copy regenerate them differently and conflict like ordinary
+# files. Same otb-regen shape as docs/session-log-index.md above (whole-file
+# rebuild, all three merge sides ignored); REGENERABLE in git-merge-regen.js
+# carries the matching rule.
+docs/copy-registry.json    merge=otb-regen
+docs/copy-inventory.md     merge=otb-regen
+
 # Append-only index tables (task 1385 / ADR 0082). docs/adr/README.md is a
 # hand-maintained ADR index whose ONLY recurring conflict is two branches each
 # appending a new row — there is no generator to regen it from, so `otb-regen`

package/docs/adr/0082-server-side-merge-conflict-auto-resolution.md

@@ -48,6 +48,10 @@ The PR's required checks (unit / trufflehog / audit / gate-review) re-run on the
 - `docs/adr/README.md` itself now carries `merge=union`, so this ADR's own index row — and every future one — stops conflicting.
 - The generated-artifact set is defined once (`REGENERABLE` in `git-merge-regen.js`, mirrored by `.gitattributes` and the `fitness.js` freshness gate); adding a future generated file means adding it in those places together.
 
+## Addendum (task 1003543, 2026-09-03) — the copy registry joined the whole-file set
+
+Two hall PRs in one session (526 for task 1003069, 531 for task 1003157) both ran `scripts/gds/copy-inventory.js` and sat `confirmed` with GitHub `mergeable=CONFLICTING` for 20+ minutes: `docs/copy-inventory.md` + `docs/copy-registry.json` carried no `.gitattributes` entry and no `REGENERABLE` rule, so they conflicted as ordinary text/JSON and the server resolver could not heal them (`resolveBranchConflicts` *did* run — its log line fired for both PRs — but the `otb-regen` driver refused the unregistered paths and the merge came back non-zero, which the resolver correctly reported as `unresolvable_conflict`; the reconciler dispatch was never the gap). Both files are, like `docs/repo-map.md` and `docs/session-log-index.md`, 100% generated from a tree scan with nothing hand-authored in either — `copy-inventory.js`'s own header says so ("Deterministic on a given tree — regenerate and commit rather than hand-editing"), so they needed the whole-file `otb-regen` shape, not `union`. The fix: `docs/copy-registry.json merge=otb-regen` + `docs/copy-inventory.md merge=otb-regen` in `.gitattributes`, both added to `REGENERABLE` in `git-merge-regen.js` with a regeneration rule that calls `copy-inventory.js`'s `buildRegistry()`/`renderReport()` directly (ignoring all three merge sides, same as the repo-map heal). No change was needed to `conflict-resolve.js`, `publish-reconciler.js`, or `ship-preflight-steps.js` — none of the three keeps its own copy of the generated-file list; all three read `REGENERABLE` (or, for the resolver, register the driver that reads it), so the new pair is covered everywhere the existing four already were.
+
 ## Alternatives considered
 
 - **Lower deploy/merge access to `thetes`** (the owner's first instinct) — rejected: reopens the Builder 25 hole for zero benefit here (the stranded session was already Archon; rank was never the blocker).

package/docs/adr/0234-idea-routing-capture-time-promotion-landing-matrix-homeless-inbox.md

@@ -155,13 +155,15 @@ as `#ideas` has always given that person, which is the actual "nothing lands unv
 survived.
 
 The companion interview decision — **"Discord `#ideas` files with HINTS only (`suggested_goal_id`),
-never routes"** — is recorded here as the design intent, but **is not yet built**: R12 (task 1003068,
-"Discord `#ideas` carries routing hints") is still `status='ready'`, not shipped. Today,
-`modules/discord/discord-inbound.js`'s `#ideas` capture carries no goal hint at all; every `#ideas`
-filing lands exactly as it did before this goal, an ordinary homeless `idea_inbox` row. When R12 ships,
-its hint must land as `suggested_goal_id` only (never `goal_id`) — consistent with every other
-"classifier guess, not a route" vector this ADR documents — or it would silently convert `#ideas` into
-a second bypass of the kind idea 1000771 already named once.
+never routes"** — is what R12 (task 1003068, "Discord `#ideas` carries routing hints") shipped, correcting
+this ADR's earlier divergence note (which read `status='ready'` at the time it was written).
+`modules/discord/discord-inbound.js`'s `#ideas` capture now sets `suggested_goal_id` (a classifier guess
+via `suggestGoalForCapture`) and `suggested_version` (defaulting to the most-recently-started open
+version even when no goal matches) on the filed idea row — both READ-ONLY hints for a human triaging via
+`/idea-triage` (R13) — and never sets `goalId`, the only field that would make `captureIdea` actually
+route. Every `#ideas` filing still lands in `idea_inbox` exactly as the pre-routing path did, now
+carrying a hint rather than none, consistent with every other "classifier guess, not a route" vector
+this ADR documents — the second bypass idea 1000771 named did not reopen.
 
 ## Consequences
 

package/docs/adr/0235-a-fix-category-is-kindbug-under-a-goal-no-column-required.md

@@ -0,0 +1,131 @@
+# 0235 — A fix category is `kind='bug'` under a goal, not a new column
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1003215](https://cloudbongos.com/builders#/task/1003215) (this decision — the structural half
+  of idea 1000828), [#1003214](https://cloudbongos.com/builders#/task/1003214) (the advisory's first quiet
+  case), [#1003157](https://cloudbongos.com/builders#/task/1003157) (extended the same exemption to the
+  criterion-link advisory and the goal detail view)
+- **Goal:** [#1000071](https://cloudbongos.com/builders#/goal/1000071) — Idea routing
+- **Related:** [ADR 0086](<redacted>.md) (the real work hierarchy this decision keeps
+  intact), [ADR 0183](<redacted>.md) (why a container that never finishes is dangerous
+  now), [ADR 0192 "a category orients and authorises nothing"](<redacted>.md)
+  (the precedent this decision is *not* — see §2)
+
+## 1. The problem
+
+A fix for something that should already work needs a home. Filing it with no
+`goal_id` lands it in the version's catch-all — no scope wall, no owner reviewing
+it (the `no_goal`/`catch_all` gap `goal-advisory.js` already flags for everything
+else). Filing it under a real goal used to trip a second, unrelated nudge: every
+goal-bound task with no done-when criterion link reads as unattributed work
+(task 1003157). Neither nudge is wrong for a *feature* — but a bug fix is not
+delivering toward one of a goal's stated outcomes; it is restoring one. Idea
+1000828 named this a missing **first-class grouping**: "a fix for something that
+should already work," living *under* an existing goal, without a new goal being
+born for it.
+
+## 2. Why this is not a stored category, and not [ADR 0192](<redacted>.md)
+
+The obvious-looking answer — add a `category` (or `bucket`) column to `tasks` —
+is the wrong shape for two reasons specific to *this* system's schema, not taste:
+
+1. **`tasks` stores no category at all, by decision.** [ADR 0192 "a category
+   orients and authorises nothing"](<redacted>.md)
+   already answered a structurally identical question for *goals* — a human label
+   from an owner-named set, advisory only, gating nothing — and its own text is
+   explicit that "a task stores no category… it inherits its goal's through
+   `tasks.goal_id`; a stored copy would be a second answer to one question." A
+   `tasks.fix_category` boolean would be exactly that second answer: `kind='bug'`
+   already exists, is already required (`migrations/006_pms_v2.sql`,
+   `NOT NULL DEFAULT 'unclassified'`), and already means "this is a fix." Adding
+   a column to restate it is duplication, not a new fact.
+2. **This decision is a *narrower*, more binding one than [ADR 0192](<redacted>.md)'s.**
+   Its category is purely a label a human reads — nothing may branch on it.
+   "A bug fix needs no criterion link" and "a bug fix in the catch-all is quiet"
+   are the OPPOSITE: two decision surfaces (`goal-advisory.js`) DO branch on
+   `kind='bug'`, on purpose, because the alternative — nagging every bug fix to
+   either name a criterion it doesn't serve or justify a goal it doesn't need —
+   is the noise idea 1000828 asked to remove. So this ADR does not extend ADR
+   0192's "orients, never authorises" rule to `kind`; `kind` already carries real
+   weight elsewhere in this codebase (`task-classifier.js`'s heuristic
+   classifier decides it from title/description, and `<redacted>`
+   calibrates a task's estimate by it), and this decision adds one more narrow,
+   named case to that existing list rather than inventing a second category axis
+   beside it.
+
+## 3. Why not a global "Bugs" goal either
+
+Idea 1000828's own reasoning is the load-bearing part, and it survives unchanged
+here: a goal carries `scope_modules`, the [ADR 0086](<redacted>.md)
+§3 scope wall — a bugs goal spanning every module makes that wall either
+everything or nothing, which is not a wall. And a goal carries done-when criteria
+and can be marked `achieved`; a bug container never finishes, so making it a goal
+manufactures a goal that can never legitimately reach `achieved` — polluting the
+exact signal [ADR 0183](<redacted>.md)'s auto-satisfy now
+depends on to cascade a goal to `achieved` the moment every linked task ships. A
+category *under* an existing goal keeps that goal's wall, keeps the "things that
+should work in THIS area" context, and never claims to be finishable on its own.
+
+## 4. Decision
+
+**A fix category is `kind='bug'` on a task that carries a real `goal_id` — no
+schema change, no new column, no new goal type.** The goal is *finishable* as
+before; the fix category is a lens over its existing `kind` field, exactly the
+way [ADR 0192](<redacted>.md)'s goal category
+is a lens over `goals.category_id`, just enforced more strictly because two real
+gates read it.
+
+**As-built** (task 1003214 first, task 1003157 completing it — both already
+shipped on `main` before this ADR was written):
+
+- `adviseGoal()` in [`modules/lifecycle/goal-advisory.js`](../../modules/lifecycle/goal-advisory.js)
+  is the single place all three exemptions live, in one pure, DB-free function:
+  a `kind='bug'` task is silent for `no_goal` (no goal at all — a fix needs no
+  home to be filed correctly), `catch_all` (a fix sitting in the version's
+  catch-all bucket is already where it belongs), and `no_criterion_link` (a real
+  goal's criteria named, but a bug fix delivers no criterion and needs none). The
+  function's own doc comment states the rule this ADR records: *"a fix is the
+  goal's 'fix category', not a delivery against one of its stated outcomes."*
+- `countTasksWithoutCriterionLink()` in
+  [`modules/lifecycle/db-deps-criteria.js`](../../modules/lifecycle/db-deps-criteria.js),
+  surfaced on `GET /goals/:id` and rendered on the hall's goal detail view
+  (`modules/hall-ui/public/goals-render.js`), excludes `kind='bug'` from its
+  count for the identical reason — an intentionally unlinked fix must not read as
+  a standing defect on the goal's own page.
+- **No hall/status change was needed for grouping.** Verified against the live
+  code, not assumed: every task card in a goal's To-do list already renders its
+  `kind` as a visible tag (`goals-render.js`, `task__tag`), and the goal detail
+  view's Filters disclosure already offers a `Kind` lens with `bug` as a value
+  (`goals-page.js`, `f-goal-kind`) — so "the hall groups bugs by kind" was
+  already true before this task, via the *same* general-purpose kind facility
+  every other kind uses. Building a bug-specific grouping widget beside it would
+  be the second-hierarchy mistake [ADR 0192](<redacted>.md)
+  §2 already named once for goal categories.
+
+## 5. What was deliberately not built
+
+- **No `tasks.category` / `tasks.fix_category` column, no enum, no CHECK
+  constraint.** `kind` already answers the question.
+- **No global "Bugs" goal**, and no goal-creation shortcut that manufactures one
+  — §3 above is why that door stays shut.
+- **No bug-specific grouping UI.** The kind tag + Kind filter already exist and
+  already work for `bug` the same as every other kind; a second, bug-only lens
+  beside a general one would duplicate it for no reader benefit.
+
+## 6. Consequences
+
+- Idea 1000820 and idea 1000788 (the `node_modules/pino` worktree-resolution
+  bugs cited as this decision's first real customers) now have somewhere to file
+  that advances a goal without inventing one — the mechanism task 1003215 asked
+  for was already load-bearing on `main` by the time this ADR was written; this
+  document is what makes the decision citable rather than three commit messages.
+- The exemption is enforced in exactly one function (`adviseGoal`) and one query
+  (`countTasksWithoutCriterionLink`); a third surface that starts branching on
+  `kind='bug'` for a similar reason should extend those, not invent a fourth
+  definition of "what counts as a fix."
+- If a future need ever wants `kind='bug'` to carry MORE weight than an advisory
+  exemption — a claim-time gate, a reward multiplier, a dependency rule — that is
+  a new, explicit decision needing its own ADR, the same posture
+  [ADR 0192](<redacted>.md) §5 holds for goal
+  categories. This ADR does not pre-authorise that.

package/docs/adr/README.md

@@ -322,5 +322,6 @@ This keeps the decision history honest and traceable.
 
 | 0233 | [**A copy proposal is a task carrying a patch, and the applier is the only writer** ([task 1003114](https://cloudbongos.com/builders#/task/1003114) · goal 1000074, criterion `artist-edits-land-as-tasks`). Goal 1000074 asks for two things that pull against each other in its own text: the artist must change copy WITHOUT an engineer, and there must be NO LIVE CMS because every copy change is a claimed, graded, shipped task. R02 shipped the half that needs no reconciliation (the flag) and [ADR 0178](<redacted>.md) §3 pinned the absence of any column that could hold replacement text, naming this task as the one that would have to keep it true. Decisions: (1) the shape is **borrowed from the design half, not invented** — ADR 0081 already has a tool authoring and an `adapter.export()` landing the output as a committed diff under a claim inside a path guard, so the artist is the tool, the copy desk is where they author, and the proposal is the export. (2) A proposal is a **TASK carrying a fenced `copy-proposal` patch**, never a row: the ledger is where a proposal belongs anyway, nothing renders a task description as product copy, a reviewer can read the change without running anything, and `copy-desk` gains NO migration (the obvious-but-wrong R03 is a `copy_desk_proposals` table, which is the forbidden column with extra steps). The module gains `consumes: ["lifecycle"]` and calls `createTask` through the port — it can put a request INTO the ledger and nothing can pull copy OUT of it. (3) `scripts/gds/copy-apply.js` **re-derives the position** rather than trusting the patch, which required teaching R01s extractor to record a source SPAN and deliberately dropping it from the committed registry: an offset goes stale the moment anything above it changes, while the id is designed to survive exactly that movement, so the span is recomputed at the moment of the edit by the same code that decided the string was copy. (4) The **placeholder arithmetic** is what makes a patch mechanical rather than a note for an engineer — the applier puts the sources own `${expr}` back, k-th hole to k-th expression, so an artist may MOVE a value within a sentence but never add or drop one, checked at proposal time and again against the real source. (5) Every ambiguity is a **named refusal** (`target_gone`, `ambiguous_target`, `no_exact_span`, `placeholder_mismatch`, `path_outside_surface` — the design adapters path guard, derived from R01s own SURFACES), because a wrong edit is worse than no edit; after writing, the applier regenerates the registry and checks that what it wrote is what the inventory now reads. (6) Proposing is **open to every rank** (an artist is a craft, not a rank) and lands at `backlog`, so a proposal is a request that passes ordinary triage. Rejected: a proposals table, a column beside the flag, trusting the patchs line number, an escape-aware index map to buy spans for nine strings, auto-closing the flag a proposal answers.](<redacted>.md) | copy-desk / the artist loop |
 | 0234 | [**Idea routing: capture-time promotion, the landing matrix, and the homeless-only inbox** ([task 1003064](https://cloudbongos.com/builders#/task/1003064) · goal 1000071, "Idea routing"). Idea 1000771 named the failure: Discord `#bugs` created tasks DIRECTLY against a hardcoded, already-shipped version — no `captured_by`, no lineage, so the ideator-credit lane had nothing to pay against — while every other open idea sat waiting for a human triage pass that dropped its promotion into a version catch-all, because nothing in capture ever named a goal. Records what R01/R02/R05/R07/R13 shipped. `captureIdea` (`modules/ideas/inbox.js`) stays the ONE capture chokepoint — routing is one optional `goalId` argument, never a second creation door — and when the matrix routes, `routeIdeaToGoal` writes the idea row, the task (via the `lifecycle.createTask` port) and an `ideas_task_lineage` row (`origin='route'`) in ONE transaction, so a route can never mint attribution-free work the way `#bugs` did. `modules/ideas/routing.js`'s `decideLanding` is PURE and fail-closed: a bug from a Metic+ filer hard-lands `ready`, a sub-Metic bug or any other kind with a goal soft-lands `backlog`, a Full Idea or `criterion-proposal`/`decision` never routes, no goal named stays the pre-routing inbox path. `authorizeRoutedLanding` is the BINDING gate underneath the matrix's decision — a goal reaching protected scope raises the task's rank floor to Metic and REFUSES a sub-Metic filer outright, while membership is deliberately NOT required (reporting isn't authoring). `core_222`'s `suggested_goal_id` is an advisory hint only — the real home is `tasks.goal_id`, set by construction — and `/idea-triage` (`scripts/gds/triage.js`) now sends `goal_id` on promotion, so the inbox is homeless-only. Divergence recorded: R11 (Discord `#bugs`) hard-lands a linked Metic+ builder's bug immediately through the SAME shared matrix rather than the spec's "always soft-land, pending queue" design, because a local copy of the rank split would only drift from the one definition; and R12 (Discord `#ideas` hints) is NOT YET SHIPPED, so `#ideas` carries no goal hint today despite the interview decision that it should, hint-only, never route.](<redacted>.md) | ideas / lifecycle |
+| 0235 | [**A fix category is `kind='bug'` under a goal, not a new column** ([task 1003215](https://cloudbongos.com/builders#/task/1003215) · goal 1000071, "Idea routing" — the structural half of idea 1000828; task 1003214 shipped the advisory's first quiet case, task 1003157 extended it). A fix for something that should already work needs a home under an existing goal WITHOUT a new goal being born and WITHOUT a stored column restating what `tasks.kind` already says. Not a global "Bugs" goal either: a goal spanning every module makes the [ADR 0086](<redacted>.md) scope wall either everything or nothing, and a goal that can never reach `achieved` (a bug container never finishes) pollutes the exact signal [ADR 0183](<redacted>.md)'s auto-satisfy depends on. Not [ADR 0192 "a category orients and authorises nothing"](<redacted>.md) either, despite the structural resemblance: that decision forbids any gate from branching on a goal's category, while THIS decision is two decision surfaces deliberately branching on `kind='bug'` — `adviseGoal()` (`modules/lifecycle/goal-advisory.js`) goes silent for a bug under all three of its reasons (`no_goal`, `catch_all`, `no_criterion_link` — "a fix is the goal's 'fix category', not a delivery against one of its stated outcomes," its own doc comment) and `countTasksWithoutCriterionLink()` (`modules/lifecycle/db-deps-criteria.js`, surfaced on the hall's goal detail view) excludes `kind='bug'` from its count for the same reason. No hall/status change was needed for GROUPING bugs under a goal: every task card already renders its `kind` as a visible tag and the goal detail view's Filters already offer a `Kind` lens with `bug` as a value — verified against the live code, not built new. Rejected: a `tasks.category`/`fix_category` column or enum, a global cross-module "Bugs" goal, a bug-specific grouping widget beside the general-purpose kind facility that already works.](<redacted>.md) | ideas / lifecycle |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/module-api-changelog.md

@@ -1437,5 +1437,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.498 with no explicit bump. run 33769500709. (task 1002620)
   1.19.500 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.499 with no explicit bump. run 33772499045. (task 1002620)
+  1.19.501 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.500 with no explicit bump. run 33774087943. (task 1002620)
+  1.19.502 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.501 with no explicit bump. run 33777587058. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.500",
+  "version": "1.19.502",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.500",
+      "version": "1.19.502",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.500",
+  "version": "1.19.502",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/git-merge-regen.js

@@ -28,6 +28,7 @@ const { spawnSync } = require('node:child_process');
 const G = require('./gen-repo-map');
 const FM = require('./gen-file-map');
 const SI = require('./gen-session-index');
+const CI = require('./copy-inventory');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
@@ -36,10 +37,18 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // hand-written prose with one generated block; docs/file-map.md is hand-written
 // prose with TWO generated section blocks (ADR 0066). (task 1385: session-log-index
 // joined so a confirmed PR that only conflicts on it self-heals like the rest.)
+// docs/copy-inventory.md + docs/copy-registry.json (task 1003543) are the copy
+// registry's own pair — like repo-map.md, `copy-inventory.js` writes them
+// wholesale from a tree scan with nothing hand-authored in either, so any two
+// branches that both touch hall/status/landing copy regenerate them differently
+// and conflict on ordinary text; they join the whole-file group for the same
+// reason session-log-index.md did.
 const REGENERABLE = new Set([
   'docs/repo-map.md',
   'docs/file-map.md',
   'docs/session-log-index.md',
+  'docs/copy-inventory.md',
+  'docs/copy-registry.json',
   ...G.NESTED_DIRS.map((d) => `${d}/CLAUDE.md`),
 ]);
 
@@ -86,6 +95,17 @@ function regenerateResolved(relpath, { base = '', ours = '', theirs = '' } = {})
     return { content: SI.renderIndex(SI.collectEntries()), ok: true };
   }
 
+  // docs/copy-registry.json / docs/copy-inventory.md: both artifacts of one scan
+  // (copy-inventory.js), fully generated — ignore all three sides, rebuild from
+  // the merged tree. Reuse buildRegistry() rather than shelling out to write() so
+  // this stays in-process like the repo-map/session-index heals above.
+  if (relpath === 'docs/copy-registry.json') {
+    return { content: `${JSON.stringify(CI.buildRegistry(), null, 2)}\n`, ok: true };
+  }
+  if (relpath === 'docs/copy-inventory.md') {
+    return { content: CI.renderReport(CI.buildRegistry()), ok: true };
+  }
+
   const model = G.buildModel();
 
   // docs/repo-map.md is fully generated — ignore all three sides, rebuild it.

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.500'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.502'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/git_merge_regen.mjs

@@ -14,6 +14,14 @@
 //      markers remain) so a human resolves it — the heal never clobbers real edits.
 //   4. The merge-driver entrypoint writes %A + exits 0 (heal) / 1 (real conflict).
 //   5. A non-generated path is never touched (not in REGENERABLE).
+//   6. END-TO-END: a real `git merge` invokes the driver via .gitattributes.
+//   7. .gitattributes' merge=otb-regen lines and REGENERABLE agree (task 1003543).
+//   8. docs/copy-registry.json + docs/copy-inventory.md (task 1003543) — the copy
+//      registry's own pair — regenerate clean from the merged tree, same as
+//      repo-map.md, ignoring the conflicted sides.
+//   9. END-TO-END for docs/copy-registry.json: two branches that each regenerate
+//      it differently merge without conflict markers via the real .gitattributes +
+//      git-config wiring, and the result equals a fresh regeneration.
 //
 // Run:  node tests/git_merge_regen.mjs
 
@@ -30,6 +38,7 @@ const here = path.dirname(fileURLToPath(import.meta.url));
 const repo = path.resolve(here, '..');
 const regen = require('../scripts/gds/git-merge-regen.js');
 const G = require('../scripts/gds/gen-repo-map.js');
+const CI = require('../scripts/gds/copy-inventory.js');
 
 const MARKERS = /^(<{7}|={7}|>{7})/m;
 
@@ -148,4 +157,82 @@ function withBlockBody(src, body) {
   }
 }
 
+// ── 7) .gitattributes' merge=otb-regen lines and REGENERABLE agree (task 1003543) ─
+// The whole scheme is two hand-maintained lists naming the same files (one in
+// .gitattributes, one in REGENERABLE) — nothing checked that they still matched, so
+// docs/copy-inventory.md + docs/copy-registry.json could be (and were) added to
+// neither and merge like ordinary text. This pins the two lists as one set.
+{
+  const attrsText = fs.readFileSync(path.join(repo, '.gitattributes'), 'utf8');
+  const otbRegenPaths = [...attrsText.matchAll(/^(\S+)\s+merge=otb-regen\s*$/gm)].map((m) => m[1]);
+  assert.ok(otbRegenPaths.length > 0, 'expected at least one merge=otb-regen line in .gitattributes');
+  for (const p of otbRegenPaths) {
+    assert.ok(regen.REGENERABLE.has(p), `.gitattributes declares merge=otb-regen for ${p} but REGENERABLE (git-merge-regen.js) does not know it`);
+  }
+  for (const p of regen.REGENERABLE) {
+    assert.ok(otbRegenPaths.includes(p), `REGENERABLE (git-merge-regen.js) knows ${p} but .gitattributes has no merge=otb-regen line for it`);
+  }
+}
+
+// ── 8) docs/copy-registry.json + docs/copy-inventory.md regenerate clean ────────
+// (task 1003543 — the copy registry's own pair, from copy-inventory.js. Both
+// artifacts of one scan, fully generated — like docs/repo-map.md, all three
+// conflicted sides are ignored and the merged tree is rebuilt from scratch.)
+{
+  const freshReg = CI.buildRegistry();
+  const freshJson = `${JSON.stringify(freshReg, null, 2)}\n`;
+  const freshMd = CI.renderReport(freshReg);
+
+  const rJson = regen.regenerateResolved('docs/copy-registry.json', {
+    base: '{}\n', ours: '<<<<<<< ours\n{"a":1}\n=======\n{"b":2}\n>>>>>>> theirs\n', theirs: 'nonsense\n',
+  });
+  assert.equal(rJson.ok, true, 'copy-registry.json heal must succeed');
+  assert.ok(!MARKERS.test(rJson.content), 'copy-registry.json heal must leave no conflict markers');
+  assert.equal(rJson.content, freshJson, 'copy-registry.json heal must equal a fresh regeneration');
+
+  const rMd = regen.regenerateResolved('docs/copy-inventory.md', {
+    base: '# base\n', ours: '<<<<<<< ours\n# a\n=======\n# b\n>>>>>>> theirs\n', theirs: 'nonsense\n',
+  });
+  assert.equal(rMd.ok, true, 'copy-inventory.md heal must succeed');
+  assert.ok(!MARKERS.test(rMd.content), 'copy-inventory.md heal must leave no conflict markers');
+  assert.equal(rMd.content, freshMd, 'copy-inventory.md heal must equal a fresh regeneration');
+}
+
+// ── 9) END-TO-END: two branches that both regenerate docs/copy-registry.json ────
+// differently merge clean via the real .gitattributes + git-config wiring — the
+// exact PR 526/531 shape from task 1003543 (two hall PRs both ran copy-inventory.js
+// concurrently and conflicted as ordinary JSON/markdown). Mirrors test 6 above.
+{
+  const driver = path.join(repo, 'scripts/gds/git-merge-regen.js');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-gitmerge-copyreg-'));
+  const g = (...a) => {
+    const r = spawnSync('git', a, { cwd: tmp, encoding: 'utf8' });
+    return { status: r.status, out: `${r.stdout || ''}${r.stderr || ''}` };
+  };
+  const writeReg = (s) => fs.writeFileSync(path.join(tmp, 'docs', 'copy-registry.json'), s);
+  try {
+    g('init', '-q');
+    g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
+    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/copy-registry.json merge=otb-regen\n');
+    fs.mkdirSync(path.join(tmp, 'docs'));
+    writeReg('{"schema":0}\n'); g('add', '-A'); g('commit', '-qm', 'base');
+    g('checkout', '-qb', 'feature');
+    writeReg('{"schema":0,"feature":true}\n'); g('add', '-A'); g('commit', '-qm', 'feat');
+    g('checkout', '-q', 'master');
+    if (g('rev-parse', '--verify', 'master').status !== 0) g('checkout', '-q', 'main');
+    writeReg('{"schema":0,"master":true}\n'); g('add', '-A'); g('commit', '-qm', 'mast');
+    const merge = g('merge', '--no-edit', 'feature');
+    assert.equal(merge.status, 0, `real git merge must auto-resolve via the driver; got ${merge.status} :: ${merge.out}`);
+    const unmerged = g('diff', '--name-only', '--diff-filter=U').out.trim();
+    assert.equal(unmerged, '', `no file may be left unmerged; got: ${unmerged}`);
+    const healed = fs.readFileSync(path.join(tmp, 'docs', 'copy-registry.json'), 'utf8');
+    assert.ok(!MARKERS.test(healed), 'merged copy-registry.json must have no conflict markers');
+    assert.equal(healed, `${JSON.stringify(CI.buildRegistry(), null, 2)}\n`,
+      'merged copy-registry.json must equal a fresh regeneration from the (real) merged tree');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
 console.log('git_merge_regen: all assertions passed');