@bongos/core 1.19.51 → 1.19.53

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.51",
-  "core_contract": "1.19.51",
-  "source_commit": "fe0b1449ce7c972b972778e74945261c35565c48",
+  "core_version": "1.19.53",
+  "core_contract": "1.19.53",
+  "source_commit": "47298870569c3fc932d5b2f0cb2d484ce07c506a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:53:46.990Z",
+  "built_at": "2026-08-11T19:17:46.981Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1217,
+    "functional_verbatim": 1219,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1529,
-  "tree_sha256": "c3aec243f4a401c529edd9c426192e56b1264abfa615e29045ac5cf054e33d57",
+  "file_count": 1531,
+  "tree_sha256": "32b317228ddd8735e031c7475020fc3ea23d32069a4660b906853faadf0af1e0",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a5b9642b383c8c415158e091785ff40f28490d8341b4010f4c051b1a68942daf"
+      "sha256": "5c89524ec76f5f5df365a188541d50aa31167ae7920124baf562fb32ad30632c"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1312,7 +1312,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "612c7a81756f61f2c18d4b35540379cf63f32a4caa9e8d84a64b247d497ad7a3"
+      "sha256": "0076d08133c342fa905fa90682e606eefa02747d5b11aea9f0bdb3563b293f76"
     },
     {
       "path": "docs/architecture.md",
@@ -2229,6 +2229,11 @@
       "mode": "0000644",
       "sha256": "5d970696a87e6f663f9fda83a268dbe99ced00ac02fb805d91114f54d4a8fece"
     },
+    {
+      "path": "migrations/core_219_grade_attempts_attempted_at_idx.sql",
+      "mode": "0000644",
+      "sha256": "80ff025953285762f9fdfc8de813db3471ade4d02cb6db5a65f72fa13797a0fc"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -2502,7 +2507,7 @@
     {
       "path": "modules/dev-box/app/src/gds-client.js",
       "mode": "0000644",
-      "sha256": "845f51622803363dbc1229c325c4d6148087c756812e7e8e049ced7aa479f168"
+      "sha256": "323f5e71b7836dd1fb6c7710e1b2159dec6382df89a7c5d001b7e7cccd5aa46d"
     },
     {
       "path": "modules/dev-box/app/src/main.js",
@@ -3317,7 +3322,7 @@
     {
       "path": "modules/hall-ui/public/watch.js",
       "mode": "0000644",
-      "sha256": "31dc79e6aaf72260cae3b46eb0fbb356e4e2bb01e3a2cbce3c420dad5221f25e"
+      "sha256": "e8821ce2c96b637e703879ea3e4840622f2f1846bf8d726d05c455f9bcfbf13e"
     },
     {
       "path": "modules/hall-ui/public/work.css",
@@ -3387,7 +3392,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "8e67cd1325da44cf95d5d8c34427222e555e0458bb17f23f33c1055b1ae7e211"
+      "sha256": "89febe6a0002d2277a61b14cc08c4076d1ab6c738fdea8f8a4a1348e330c0b9e"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3422,7 +3427,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "7d1be0defe08ca1905b04b646b988f9be3baae519ca2393166ce91f5a31e0c5d"
+      "sha256": "5c0d0da5d6a8bcfb920bc432558066840e649cbc624e064dc4e55a926a3d8bb4"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -4037,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "43bd308850fdf28f3fa803c778af55a4a86e72edb62ccd8dc2d3297da95efbe2"
+      "sha256": "cd3aa458c21647143fdfaab782c7022dc3e7eed2ae0d227f201b4c4de80503ec"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a402f396d0bfd5b10f24685a15ac36f9022c182db018787fbdd96b296e26c5db"
+      "sha256": "7b005ce2936c09e1dd97ea8891db02f41fc77844c87c52c8d2ff876264715d5e"
     },
     {
       "path": "public-docs/index.html",
@@ -5612,7 +5617,7 @@
     {
       "path": "src/bongos/routes/public.js",
       "mode": "0000644",
-      "sha256": "fd3dd30a194cd4638e7ef6fe34d17c1e94183926543f3c662b8cb9ec2b4a6e97"
+      "sha256": "fbfc3422f111e6d3f1429cefec78741d4a919c89985bc9d69f0a7a8e070c52b5"
     },
     {
       "path": "src/bongos/routes/security.js",
@@ -5632,7 +5637,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "25c52c06c03af400c94f04f2cda1aaab0c5e5486a084005b9a4e224f345a4871"
+      "sha256": "2f88796346b1c3a6dc49e25766b223fbf2d99e34b38b9a0f1e64a6fb9a59856d"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -5662,7 +5667,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3c2f62e446506de3fa855989e8606aad486566e37eed47b61c3a18b835a404f4"
+      "sha256": "b3774e26aaaae064f271b354d54d01003130d9d7cada57c8202b6da60db95d0c"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6247,7 +6252,7 @@
     {
       "path": "tests/devbox_downloads.mjs",
       "mode": "0000644",
-      "sha256": "91950e7477f9fff30e361bc32def211e1cb3792fa098e9c839d5db1e1ba21d6a"
+      "sha256": "897fe6b114c612e132e6fa0b3c68f43b865c684c7653e73cf42db894a7e4dc94"
     },
     {
       "path": "tests/devbox_icons.mjs",
@@ -6264,6 +6269,11 @@
       "mode": "0000644",
       "sha256": "ac0a024d96ef40af52af8b94570447ad5f1556467b68380c1b45fd3419139ad6"
     },
+    {
+      "path": "tests/devbox_update_path.mjs",
+      "mode": "0000644",
+      "sha256": "b58e87eeca17053709a8e2bdcefd032060358cc85314d28bf816a92d465fdae8"
+    },
     {
       "path": "tests/device_flow_start.mjs",
       "mode": "0000644",
@@ -6622,7 +6632,7 @@
     {
       "path": "tests/grade_attempts.mjs",
       "mode": "0000644",
-      "sha256": "2fe60fa9d070ba6946509413561ae5a273d902ed3b24ff113bb089fd9d9097f1"
+      "sha256": "68792cfc57d211958190732e5c20051ff66c4b4d2ee3e39431db66e9dbfceae0"
     },
     {
       "path": "tests/grade_attribution.mjs",

package/clients/bongos-client/index.d.ts

@@ -77,7 +77,7 @@ export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetPublicBlockersIdResponse { blocker: unknown }
 export interface GetPublicBountyTableResponse { table: unknown; currency: unknown }
-export interface GetPublicGradesResponse { window_days: unknown; rolling: unknown; trend: unknown; threshold: unknown; grader_version: unknown }
+export interface GetPublicGradesResponse { window_days: unknown; rolling: unknown; trend: unknown; attempts: unknown; threshold: unknown; grader_version: unknown }
 export interface GetPublicIdeasIdResponse { idea: unknown }
 export interface GetPublicLeaderboardResponse { leaderboard: unknown; page: PageInfo }
 export interface GetPublicProgressResponse { progress: unknown }

package/docs/api/openapi.json

@@ -13070,6 +13070,7 @@
           "window_days": {},
           "rolling": {},
           "trend": {},
+          "attempts": {},
           "threshold": {},
           "grader_version": {}
         },
@@ -13077,6 +13078,7 @@
           "window_days",
           "rolling",
           "trend",
+          "attempts",
           "threshold",
           "grader_version"
         ]

package/migrations/core_219_grade_attempts_attempted_at_idx.sql

@@ -0,0 +1,7 @@
+-- lifecycle_003_grade_attempts_attempted_at_idx.sql — task 1002661 (panel finding).
+--
+-- gradeAttemptStats windows grade_attempts on attempted_at, but migration 064
+-- only indexed task_id — every /public/grades call would seq-scan an
+-- append-only table that grows on every grader run. Index the window column.
+CREATE INDEX IF NOT EXISTS idx_grade_attempts_attempted_at
+  ON grade_attempts (attempted_at DESC);

package/modules/dev-box/app/src/gds-client.js

@@ -82,8 +82,12 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
     claimableTasks: () => unwrap(gen('').request('GET', '/api/gds/tasks/claimable')),
     claimTask: (taskId) => unwrap(gen('').request('POST', '/api/gds/claims', { body: { task_id: taskId } })),
     boxScope: () => unwrap(gen('').request('GET', '/api/gds/box/scope')),
-    // update check (public static asset at the origin root, not under /api/gds)
-    latestRelease: () => unwrap(gen('').request('GET', '/downloads/devbox/latest.json')),
+    // update check (public route at the origin root, not under /api/gds).
+    // task 1002649: polls the EXTENSIONLESS /version twin, NOT latest.json — a
+    // front proxy with a file-matcher can eat *.json paths before Node (the
+    // live instance's pre-ADR-0152 vhost 404'd latest.json empty while this
+    // endpoint worked), and the updater only needs { version, assets } anyway.
+    latestRelease: () => unwrap(gen('').request('GET', '/downloads/devbox/version')),
   };
 }
 

package/modules/hall-ui/public/watch.js

@@ -644,11 +644,21 @@
     const rolling = data.rolling || {};
     const n = num(rolling.n);
     const passRate = n > 0 ? num(rolling.n_passed) / n : null;
+    // task 1002661: grade_attempts remediation reader — attempts per graded
+    // task and, of tasks that failed a round, the share that ended passed.
+    const at = data.attempts || null;
+    const meanAttempts = at && at.graded_tasks > 0
+      ? Math.round((at.total_attempts / at.graded_tasks) * 10) / 10
+      : null;
     stats.innerHTML = statCards([
       { num: (rolling.avg_score ?? '—') === '—' ? '—' : escapeHtml(String(rolling.avg_score)), label: 'Avg score' },
       { num: fmtPct(passRate), label: 'Pass rate' },
       { num: fmtInt(n), label: 'Sample size' },
       { num: data.threshold !== undefined && data.threshold !== null ? escapeHtml(String(data.threshold)) : '—', label: 'Threshold' },
+      ...(at ? [
+        { num: meanAttempts === null ? '—' : escapeHtml(String(meanAttempts)), label: 'Attempts/task' },
+        { num: at.remediation_rate === null ? '—' : fmtPct(at.remediation_rate), label: 'Remediation' },
+      ] : []),
     ]);
 
     const trend = Array.isArray(data.trend) ? data.trend.slice(-14) : [];

package/modules/lifecycle/db.js

@@ -5309,6 +5309,56 @@ async function countGradeAttempts(taskId, queryFn) {
   return rows[0] ? rows[0].n : 0;
 }
 
+// gradeAttemptStats — the grade_attempts READER (task 1002661). The table has
+// been written on every grade since 6D.6 and read by nothing, leaving
+// remediation rate structurally unmeasurable. Windowed per-task rollup:
+// remediation_rate = of the tasks that FAILED at least one attempt, the share
+// whose latest attempt passed (null when no task failed — no denominator).
+// waived_zero_issue_passes counts the ADR 0164 implausible_pass_waived audit
+// markers in the same window, so the views can tell "waived on panel
+// evidence" from "never evaluated" at a glance.
+async function gradeAttemptStats(days = 7, queryFn) {
+  const q = queryFn || ((text, params) => pool.query(text, params));
+  const d = Number.isFinite(Number(days)) && Number(days) > 0 ? Math.min(Number(days), 90) : 7;
+  const [{ rows }, waived] = await Promise.all([q(
+    `SELECT
+        COALESCE(SUM(n), 0)::int                              AS total_attempts,
+        COUNT(*)::int                                         AS graded_tasks,
+        COUNT(*) FILTER (WHERE n > 1)::int                    AS retried_tasks,
+        COUNT(*) FILTER (WHERE had_fail)::int                 AS tasks_with_fail,
+        COUNT(*) FILTER (WHERE had_fail AND last_passed)::int AS remediated_tasks
+       FROM (
+         SELECT task_id,
+                COUNT(*) AS n,
+                BOOL_OR(NOT passed) AS had_fail,
+                (ARRAY_AGG(passed ORDER BY attempted_at DESC))[1] AS last_passed
+           FROM grade_attempts
+          WHERE attempted_at > now() - ($1 * interval '1 day')
+          GROUP BY task_id
+       ) t`,
+    [d]
+  ), q(
+    `SELECT COUNT(*)::int AS n
+       FROM task_grades
+      WHERE graded_at > now() - ($1 * interval '1 day')
+        AND signals->'server_guard'->>'implausible_pass_waived' IS NOT NULL`,
+    [d]
+  )]);
+  const s = rows[0] || {};
+  const tasksWithFail = Number(s.tasks_with_fail) || 0;
+  const remediated = Number(s.remediated_tasks) || 0;
+  return {
+    window_days: d,
+    total_attempts: Number(s.total_attempts) || 0,
+    graded_tasks: Number(s.graded_tasks) || 0,
+    retried_tasks: Number(s.retried_tasks) || 0,
+    tasks_with_fail: tasksWithFail,
+    remediated_tasks: remediated,
+    remediation_rate: tasksWithFail > 0 ? Math.round((remediated / tasksWithFail) * 100) / 100 : null,
+    waived_zero_issue_passes: (waived.rows[0] && Number(waived.rows[0].n)) || 0,
+  };
+}
+
 // ---- security_docs: Archon-only sensitive security documents (task 991) -----
 //
 // The DATED security engagement reports (exploit detail) live in the DB, NOT in
@@ -5561,6 +5611,7 @@ module.exports = {
   decideOverrideRequest,
   logGradeAttempt,
   countGradeAttempts,
+  gradeAttemptStats, // task 1002661: the grade_attempts remediation-rate reader
   acquireMergeLease,
   releaseMergeLease,
   mergeLeaseStatus,

package/modules/lifecycle/lifecycle.js

@@ -41,6 +41,7 @@ module.exports = {
   recentShippedTasks: (...a) => db.recentShippedTasks(...a),
   estimationDriftSummary: (...a) => db.estimationDriftSummary(...a),
   rollingAvgGrade: (...a) => db.rollingAvgGrade(...a),
+  gradeAttemptStats: (...a) => db.gradeAttemptStats(...a), // task 1002661: remediation-rate reader
   gradeTrendByDay: (...a) => db.gradeTrendByDay(...a),
   // me.js (the profile reader): per-builder claims + estimation + grade reads.
   getActiveClaimsForBuilder: (...a) => db.getActiveClaimsForBuilder(...a),

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.51",
+  "version": "1.19.53",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.51",
+      "version": "1.19.53",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.51",
+  "version": "1.19.53",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/routes/public.js

@@ -293,9 +293,12 @@ module.exports = function buildPublicRouter() {
     const rawDays = parseInt(req.query.days, 10);
     const days = Number.isFinite(rawDays) && rawDays > 0 && rawDays <= 90 ? rawDays : 7;
     const trendDays = days >= 30 ? days : 30;
-    const [rolling, trend] = await Promise.all([
+    const [rolling, trend, attempts] = await Promise.all([
       lc().rollingAvgGrade(days),
       lc().gradeTrendByDay(trendDays),
+      // task 1002661: grade_attempts remediation reader. Best-effort — a
+      // mid-migration instance without the table must not break the tile.
+      lc().gradeAttemptStats(days).catch(() => null),
     ]);
     // Rubric meta via the `grade` kernel PORT (BV1.R73). resolveOptional → null
     // when grading is disabled, so the tile still renders (threshold/version null)
@@ -307,6 +310,7 @@ module.exports = function buildPublicRouter() {
       window_days: days,
       rolling,
       trend,
+      attempts, // task 1002661: attempt counts + remediation rate (null pre-migration)
       threshold: rubric ? rubric.threshold : null, // single source of truth — grader-rubric.json
       grader_version: rubric ? rubric.version : null,
     });

package/src/bongos/serve-internal.js

@@ -359,6 +359,38 @@ function isBuildersHost(req) {
 // Call this ONCE, right after app setup (trust proxy etc.) and BEFORE any
 // entrypoint-specific tail (the game static + themed 404 in server.js; the plain
 // 404 in platform-server.js).
+// The Dev Box download/manifest mini-router (#904, ADR 0045), extracted so the
+// ACTUAL route handlers are hermetically testable (tests/devbox_update_path.mjs
+// mounts them on a throwaway app — the docs_openapi_route pattern) instead of
+// only their pure builder. task 1002649: the manifest is served under BOTH
+// /latest.json and an extensionless /latest twin — a front proxy with a
+// file-matcher can eat *.json paths before Node (the live pre-ADR-0152 vhost
+// 404'd latest.json empty while extensionless siblings worked), so every
+// manifest consumer has a path that survives that class. Registration order
+// matters: the literal routes must precede the `:target` catch-all.
+function mountDevboxDownloads(app, devboxDownloads) {
+  const manifest = (_req, res) => {
+    // Short TTL: a release bump (config change + deploy) is visible within a
+    // minute, same posture as the hall's HTML.
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(devboxDownloads.latestJson());
+  };
+  app.get('/downloads/devbox/latest.json', manifest);
+  app.get('/downloads/devbox/latest', manifest);
+  // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
+  // /settings courtesy line reads.
+  app.get('/downloads/devbox/version', (_req, res) => {
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(devboxDownloads.versionJson());
+  });
+  app.get('/downloads/devbox/:target', (req, res) => {
+    const url = devboxDownloads.redirectFor(req.params.target);
+    if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
+    res.set('Cache-Control', 'public, max-age=60');
+    res.redirect(302, url);
+  });
+}
+
 function mountInternalSurfaces(app) {
   // Prometheus instrumentation (task #1680, V4.R28a). The counting middleware
   // mounts FIRST so it wraps every surface registered below (and, since
@@ -477,26 +509,7 @@ function mountInternalSurfaces(app) {
   // /builders/downloads/* and 404).
   const devboxCfg = tryLoadInstanceConfig('devbox-app.json');
   if (devboxCfg) {
-    const devboxDownloads = buildDevboxDownloads(devboxCfg);
-    app.get('/downloads/devbox/latest.json', (_req, res) => {
-      // Short TTL: a release bump (config change + deploy) is visible within a
-      // minute, same posture as the hall's HTML.
-      res.set('Cache-Control', 'public, max-age=60');
-      res.json(devboxDownloads.latestJson());
-    });
-    // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
-    // /settings courtesy line reads. MUST be registered before the `:target` route
-    // below, or Express would treat "version" as a download target and 404 it.
-    app.get('/downloads/devbox/version', (_req, res) => {
-      res.set('Cache-Control', 'public, max-age=60');
-      res.json(devboxDownloads.versionJson());
-    });
-    app.get('/downloads/devbox/:target', (req, res) => {
-      const url = devboxDownloads.redirectFor(req.params.target);
-      if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
-      res.set('Cache-Control', 'public, max-age=60');
-      res.redirect(302, url);
-    });
+    mountDevboxDownloads(app, buildDevboxDownloads(devboxCfg));
   }
 
   // Standalone `bongos` CLI downloads + the one-line installer (task 1248,
@@ -979,4 +992,4 @@ function mountInternalSurfaces(app) {
   return app;
 }
 
-module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };
+module.exports = { mountInternalSurfaces, mountDevboxDownloads, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };

package/src/module-api.js

@@ -529,8 +529,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.49 with no explicit bump. run 31524280584. (task 1002620)
 //   1.19.51 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.50 with no explicit bump. run 31525032273. (task 1002620)
+//   1.19.52 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.51 with no explicit bump. run 31526131183. (task 1002620)
+//   1.19.53 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.52 with no explicit bump. run 31527057565. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.51'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.53'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/devbox_downloads.mjs

@@ -119,5 +119,22 @@ t('config/devbox-app.json parses, resolves every target, and aliases point at re
   }
 });
 
+console.log('update manifest (task 1002649 — the payload the devbox-app updater reads):');
+
+t('committed config yields a NON-EMPTY manifest — version + at least one asset in both shapes', () => {
+  // The live symptom behind task 1002649 was latest.json arriving as an empty
+  // body. The route is a pure function of this committed config, so pin here
+  // that the manifest can never be empty at the source.
+  const d = buildDevboxDownloads(committedConfig);
+  for (const shape of [d.latestJson(), d.versionJson()]) {
+    assert.match(shape.version, /^\d+\.\d+\.\d+$/, 'manifest carries a semver version');
+    assert.ok(Object.keys(shape.assets).length >= 1, 'manifest carries at least one asset');
+  }
+});
+
+// The client-path pin (extensionless /version, never .json) lives in
+// tests/devbox_update_path.mjs — NOT here — so it still runs on the neutral
+// core checkout where this file topology-skips (task 1002649).
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/devbox_update_path.mjs

@@ -0,0 +1,84 @@
+// tests/devbox_update_path.mjs — the devbox-app update-check path pin (task 1002649).
+//
+// Deliberately SEPARATE from tests/devbox_downloads.mjs: that file topology-
+// skips wherever config/devbox-app.json is absent (this neutral core checkout),
+// but this pin reads only the app client's SOURCE, so it must run everywhere —
+// including this repo's `unit` lane.
+//
+// Why the pin exists: a front proxy with a file-matcher can eat *.json paths
+// before they reach Node — the live pre-ADR-0152 vhost 404'd
+// /downloads/devbox/latest.json with an empty body while the extensionless
+// /downloads/devbox/version twin worked, silently breaking the app's update
+// check. The updater only needs { version, assets }, which /version carries.
+//
+// Run:  node --test tests/devbox_update_path.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const src = readFileSync(new URL('../modules/dev-box/app/src/gds-client.js', import.meta.url), 'utf8');
+
+test('latestRelease polls the extensionless /downloads/devbox/version, never a .json path', () => {
+  const line = src.split('\n').find((l) => l.includes('latestRelease:'));
+  assert.ok(line, 'gds-client exposes latestRelease');
+  assert.ok(line.includes("'/downloads/devbox/version'"), 'latestRelease polls /downloads/devbox/version');
+  assert.ok(!line.includes('latest.json'), 'latestRelease must not poll a .json-suffixed path');
+});
+
+// ---- The ACTUAL route handlers, over loopback (the docs_openapi_route ----
+// pattern). This is the layer the repo owns: the Express routes must serve a
+// NON-EMPTY manifest on all three paths and redirect targets. (The infra layer
+// above Node — the host's front proxy — cannot be pinned from a unit test;
+// that is blocker 1000105. These pins guarantee that when a request reaches
+// Node, the manifest is never empty.)
+const CFG = {
+  releases_repo: 'owner/devbox-releases',
+  version: '9.9.9',
+  assets: { 'win-x64': 'Setup-9.9.9-x64.exe', 'mac-arm64': 'App-9.9.9-arm64.dmg' },
+  aliases: { windows: 'win-x64', mac: 'mac-arm64' },
+};
+
+async function withDevboxServer(fn) {
+  const express = require('express');
+  const { mountDevboxDownloads } = require('../src/bongos/serve-internal.js');
+  const { buildDevboxDownloads } = require('../src/devbox-downloads.js');
+  const app = express();
+  mountDevboxDownloads(app, buildDevboxDownloads(CFG));
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try {
+    await fn(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+test('latest.json and the extensionless /latest twin both serve the full non-empty manifest', async () => {
+  await withDevboxServer(async (base) => {
+    for (const p of ['/downloads/devbox/latest.json', '/downloads/devbox/latest']) {
+      const r = await fetch(base + p);
+      assert.equal(r.status, 200, `${p} must 200`);
+      assert.match(r.headers.get('content-type') || '', /application\/json/, `${p} content-type`);
+      const j = await r.json();
+      assert.equal(j.version, '9.9.9');
+      assert.ok(Object.keys(j.assets).length >= 1, `${p} manifest must carry assets — the task-1002649 empty-body class`);
+      assert.equal(j.assets['win-x64'].file, 'Setup-9.9.9-x64.exe');
+      assert.match(j.assets['win-x64'].url, /\/releases\/download\/v9\.9\.9\//);
+    }
+  });
+});
+
+test('/version serves the flat update-check payload; a target redirects 302', async () => {
+  await withDevboxServer(async (base) => {
+    const v = await fetch(base + '/downloads/devbox/version');
+    assert.equal(v.status, 200);
+    const j = await v.json();
+    assert.equal(j.version, '9.9.9');
+    assert.equal(typeof j.assets['win-x64'], 'string', 'flat {target: url} shape');
+    const r = await fetch(base + '/downloads/devbox/windows', { redirect: 'manual' });
+    assert.equal(r.status, 302);
+    assert.match(r.headers.get('location') || '', /Setup-9\.9\.9-x64\.exe$/);
+  });
+});

package/tests/grade_attempts.mjs

@@ -68,6 +68,51 @@ await test('countGradeAttempts returns the count (0 when none)', async () => {
   assert.equal(await db.countGradeAttempts(999, () => Promise.resolve({ rows: [] })), 0);
 });
 
+// ---- task 1002661: gradeAttemptStats — the remediation-rate reader ----
+
+function statsQueryFn({ agg, waived }) {
+  return (text, params) => {
+    if (/FROM grade_attempts/.test(text)) return Promise.resolve({ rows: [{ ...agg, _params: params }] });
+    if (/implausible_pass_waived/.test(text)) return Promise.resolve({ rows: [{ n: waived }] });
+    return Promise.reject(new Error(`unexpected SQL: ${text.slice(0, 60)}`));
+  };
+}
+
+await test('gradeAttemptStats maps the rollup + computes remediation rate', async () => {
+  const s = await db.gradeAttemptStats(7, statsQueryFn({
+    agg: { total_attempts: 14, graded_tasks: 10, retried_tasks: 3, tasks_with_fail: 4, remediated_tasks: 3 },
+    waived: 2,
+  }));
+  assert.equal(s.window_days, 7);
+  assert.equal(s.total_attempts, 14);
+  assert.equal(s.graded_tasks, 10);
+  assert.equal(s.retried_tasks, 3);
+  assert.equal(s.tasks_with_fail, 4);
+  assert.equal(s.remediated_tasks, 3);
+  assert.equal(s.remediation_rate, 0.75, '3 of 4 failed-at-least-once tasks ended passed');
+  assert.equal(s.waived_zero_issue_passes, 2, 'ADR 0164 waived markers counted in-window');
+});
+
+await test('gradeAttemptStats: no failed tasks → remediation_rate null (no denominator)', async () => {
+  const s = await db.gradeAttemptStats(7, statsQueryFn({
+    agg: { total_attempts: 5, graded_tasks: 5, retried_tasks: 0, tasks_with_fail: 0, remediated_tasks: 0 },
+    waived: 0,
+  }));
+  assert.equal(s.remediation_rate, null);
+});
+
+await test('gradeAttemptStats clamps the window (bad input → 7, oversize → 90)', async () => {
+  const seen = [];
+  const qf = (text, params) => {
+    seen.push(params[0]);
+    if (/FROM grade_attempts/.test(text)) return Promise.resolve({ rows: [{}] });
+    return Promise.resolve({ rows: [{ n: 0 }] });
+  };
+  await db.gradeAttemptStats('junk', qf);
+  await db.gradeAttemptStats(500, qf);
+  assert.deepEqual(seen, [7, 7, 90, 90], 'both queries share the clamped window');
+});
+
 console.log('');
 console.log(`Grade-attempts (6D.6) tests: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);