@bongos/core 1.19.510 → 1.19.511

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.510",
-  "core_contract": "1.19.510",
-  "source_commit": "bf4b829a050e1e59d80f4669559d33aff1ca021e",
+  "core_version": "1.19.511",
+  "core_contract": "1.19.511",
+  "source_commit": "3a3d1626dee489511d9d444d6cd3c78620a5fffd",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:34:17.437Z",
+  "built_at": "2026-09-03T18:50:51.590Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 428,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2403,
-  "tree_sha256": "50673e10faee37607acac515c28140b876d8838c656e49115440b31f3d2ae42a",
+  "tree_sha256": "61291b79de3b99190857d7ed49c124e41ac765c57c9ad792cf8cfa1e62f002cb",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1672,7 +1672,7 @@
     {
       "path": "docs/adr/0233-a-copy-proposal-is-a-task-carrying-a-patch.md",
       "mode": "0000644",
-      "sha256": "69db7f69b30eb87a8b8e921ea664344faf7b953c7a85ce9d788282a0e181dbd1"
+      "sha256": "ab2970017b4776ee7d0be1ee22933d86123f57b8935a1f1bb0844e5f367fae07"
     },
     {
       "path": "docs/adr/0234-idea-routing-capture-time-promotion-landing-matrix-homeless-inbox.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8a8c8b3fa575b33ef7221af26b78a3cbe649f3cbf6b23e398da4d44e2a826096"
+      "sha256": "2e35f3f9c7c2c961b5c8274d20202664564cb33d59b046ef4d2e190c15c05afe"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3697,7 +3697,7 @@
     {
       "path": "modules/copy-desk/proposals.js",
       "mode": "0000644",
-      "sha256": "b05aefb7fb7f965b92389986b6e53991823abb8c1e8a03e88637ef3d065100c0"
+      "sha256": "de674674cf2f80fb36569cad67be4f1ba3a94e938b690b8f1d0c96446df346bf"
     },
     {
       "path": "modules/copy-desk/registry.js",
@@ -3707,7 +3707,7 @@
     {
       "path": "modules/copy-desk/routes/copy-desk.js",
       "mode": "0000644",
-      "sha256": "1d371bc5e850f12a1e261eb1d4409cb4462943ad0020ae629a3858d2f7063235"
+      "sha256": "7231f021bb49bd78cb247a6d8e8a0f6e9256ade52f2f9bb1438b54b6ddf400f8"
     },
     {
       "path": "modules/copy-desk/tests/copy_flags.mjs",
@@ -3722,7 +3722,7 @@
     {
       "path": "modules/copy-desk/tests/copy_proposals.mjs",
       "mode": "0000644",
-      "sha256": "86b7f54494e94407745e46290263ed4463fdb10e5d320276bcb199667ca52097"
+      "sha256": "e435042dea0436e0f4fa7f2a95b16b8647ff0723290741e26776e76c9d1c6973"
     },
     {
       "path": "modules/copy-desk/tests/copy_queue.mjs",
@@ -5237,7 +5237,7 @@
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
-      "sha256": "b9e3c44a7f68ec728bb6a59122dd43f87d64931b776bab3cbbba9aad2be78f28"
+      "sha256": "1a281a4233b3805550a05ed6bd38b163ab18db658d48675f055b90d2ba722a16"
     },
     {
       "path": "modules/lifecycle/criterion-suggest.js",
@@ -6237,7 +6237,7 @@
     {
       "path": "modules/public-landing/public/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "40013b1065a87cbe6c5916bf20c4971ce8bac5811d22993a70b322cf9baf2d36"
+      "sha256": "bb2fa6d0a1c87aeb3e08038faf1d3ae0f06a1a41f9fe6d83f357146bc7e73045"
     },
     {
       "path": "modules/public-landing/public/assets/verro-medallion.png",
@@ -7242,12 +7242,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "473153ee377e541a11f94f2b68604221d7cc56b75ce228745a71c094a6db32be"
+      "sha256": "0c5b45784b5275f6c58d456a275a390b6ef111efbcc1fb7653750120a8a84981"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "24b60ab686b6e4edfefbbaecd284c9916d5090f8754a6020cba487a66e9c1441"
+      "sha256": "2605b735d7f5d07c4eb993212d4901e7043138693d4d2bb56492f9fb18c0baf0"
     },
     {
       "path": "public-docs/index.html",
@@ -7532,7 +7532,7 @@
     {
       "path": "scripts/gds/copy-apply.js",
       "mode": "0000644",
-      "sha256": "4b99eabcfcb8c6c472a2161427fc22a43b3208b5fbfc1ffe097e8f1926a44216"
+      "sha256": "05326c8016794742acc10a95ae0f1c7b630581231a7f0f86aef449a8c17c2c40"
     },
     {
       "path": "scripts/gds/copy-inventory.js",
@@ -7762,7 +7762,7 @@
     {
       "path": "scripts/gds/git-merge-regen.js",
       "mode": "0000644",
-      "sha256": "f9a391ac6f32b2d5ca939b48186b6d9cb7aa171554652a5b5afbc4a408aae203"
+      "sha256": "f6f9c93faeb589d07105027655e42bd842d8d766119812b16bd534d58aa50816"
     },
     {
       "path": "scripts/gds/go-live.js",
@@ -8917,7 +8917,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "27eb92e570f6572c875f3c0ab7cffee29fca5c49395167fe4ed7a1d8e466a32e"
+      "sha256": "ac752bde3af7292c3b4a1857045652f7d3badf0d1bbdf02cf3fd47f2ac8c40fc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9512,7 +9512,7 @@
     {
       "path": "tests/conflict_resolve.mjs",
       "mode": "0000644",
-      "sha256": "69f4e40c66e49e4d2c58f1f41ec1c515b2cb44891e40b6192ed898484d10671d"
+      "sha256": "7ad7be450b9350e7888f075944888ddf2a0e2d57a23568f410a9ff17bd340dec"
     },
     {
       "path": "tests/connections_api.mjs",
@@ -9907,7 +9907,7 @@
     {
       "path": "tests/git_merge_regen.mjs",
       "mode": "0000644",
-      "sha256": "2d3574914c1f9c843396f498a8e68c2fd8ec2a5bc574c98f64dc2505aa1ccba8"
+      "sha256": "f4e7ab5eec2d13404080c408c0a70819c4b398b38fa61474b9c4cc57069d119b"
     },
     {
       "path": "tests/github_push_ancestry.mjs",
@@ -11112,7 +11112,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "2cdad6b12240d3556614aa0e77874f41651e59884f1b07bd9af664334eb90c20"
+      "sha256": "712e02763f7e9f3e6f4acc17a5a757a4aee11e9234909dcf50923b85679e09e6"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",

package/docs/adr/0233-a-copy-proposal-is-a-task-carrying-a-patch.md

@@ -114,7 +114,12 @@ afterwards buys a port widening and a failure mode for a string.
 So the bare call, `node scripts/gds/copy-apply.js`, acts on **the task the caller is holding**.
 Holding no claim is a named refusal that says to claim it first. The command may only run under a
 claim — that is the whole feature — and a claim already names a task, so the constraint and the
-ergonomics are the same fact. `--task <id>` remains for someone holding several.
+ergonomics are the same fact. `--task <id>` remains for someone holding several — and it is *checked*
+against the same claim list the bare call reads, refusing `claim_not_held` for a task the caller does
+not hold. It shipped unchecked (task 1003493 fixed it): a rule stated in this ADR, in the module's
+`CLAUDE.md` and in the script's own header, enforced on one of its two paths, is the kind of claim
+that rots. The one path with no claim to prove is `--patch-file`, a local JSON patch used by the
+tests, which lands nothing a proposal task authorised.
 
 ### 7. Proposing is open to every rank, and lands in `backlog`
 
@@ -130,7 +135,16 @@ before anyone can claim it. Landing it `ready` would let anyone with an opinion
 ## Consequences
 
 - **The write surface of `copy-desk` is now three verbs, not two**, and `tests/copy_no_cms.mjs` says so
-  in a diff a reviewer can see — which is exactly what R02 built that list for.
+  in a diff a reviewer can see — which is exactly what R02 built that list for. To be exact about what
+  that test proves (task 1003493): it pins that no route **in this module** can write a rendered
+  string, which is narrower than "no route can write a rendered string to production directly". That
+  is the right scope for the feature — the module is the write surface this ADR adds — but the wider
+  claim is not something a module-scoped test can carry, and reading it as if it were is how a
+  no-CMS guarantee quietly becomes an assumption.
+- **A proposal lands only in the version being BUILT.** `proposals.resolveTargetVersion` returns the
+  `building` version or `null`, and the route refuses `no_open_version` — there is deliberately no
+  "first version in the list" fallback (task 1003493), because that row can be a shipped version, and
+  a proposal landing on sealed history is worse than a proposal that was not accepted.
 - **`scripts/gds/copy-apply.js` is the only thing in this feature that writes a surface file**, it is a
   command rather than a route, and the test asserts no file in the module's request path imports it.
   Naming it is fine and required: the task tells its claimer the exact line to run.

package/docs/module-api-changelog.md

@@ -1457,5 +1457,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.508 with no explicit bump. run 33790542026. (task 1002620)
   1.19.510 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.509 with no explicit bump. run 33791237400. (task 1002620)
+  1.19.511 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.510 with no explicit bump. run 33792868990. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/copy-desk/proposals.js

@@ -260,8 +260,21 @@ function proposalSourceRef(patch) {
   return `copy-proposal-${patch.string_id}-${hash.toString(36)}`;
 }
 
+// Which version a proposal's task lands in — the version currently BEING BUILT,
+// and nothing else (task 1003493). There is deliberately no fallback: the route
+// used to take `versions[0]` when nothing was building, which is whatever row
+// the query ordered first and may be a shipped version — sealed history that
+// cannot take new tasks. A proposal that lands on a closed version is worse than
+// one that was not accepted, so the caller's answer here is a refusal, not a
+// guess. Pure, so the rule is pinned in copy_proposals.mjs rather than only
+// reachable through a live route.
+function resolveTargetVersion(versions) {
+  return (versions || []).find((v) => v && v.status === 'building') || null;
+}
+
 module.exports = {
   PROPOSAL_SCHEMA,
+  resolveTargetVersion,
   FENCE,
   PLACEHOLDER,
   MIN_WHY_CHARS,

package/modules/copy-desk/routes/copy-desk.js

@@ -391,9 +391,16 @@ module.exports = function buildCopyDeskRouter() {
       // how every other unattributed create-vector picks. `createTask` then
       // defaults the goal to that version's catch-all, so a copy change is
       // ordinary work on the board rather than a special case.
+      // No `|| versions[0]` fallback (task 1003493) — see resolveTargetVersion:
+      // with nothing building, the first row back is whatever the query ordered
+      // first, possibly a shipped version, which is sealed history.
       const versions = await lifecycle.listVersions();
-      const building = (versions || []).find((v) => v.status === 'building') || (versions || [])[0];
-      if (!building) return res.fail('no_open_version', 503);
+      const building = proposals.resolveTargetVersion(versions);
+      if (!building) {
+        return res.fail('no_open_version', 503, {
+          what_this_means: 'No version is currently being built, so there is nowhere for a copy change to land. Nothing was recorded.',
+        });
+      }
 
       const sourceRef = proposals.proposalSourceRef(patch);
       const existing = lifecycle.findTaskBySourceRef

package/modules/copy-desk/tests/copy_proposals.mjs

@@ -275,5 +275,46 @@ await test('the applier re-checks the placeholder arithmetic against the real so
   assert.equal(r.code, 'placeholder_mismatch');
 });
 
+// --- task 1003493: the two rules the grader found stated but not enforced ----
+
+await test('--task proves the claim it names instead of standing in for one', () => {
+  const held = [{ task_id: '1003114' }, { task_id: 1003493 }];
+
+  const wrong = applier.claimGateFor(1003112, held);
+  assert.equal(wrong.ok, false);
+  assert.equal(wrong.code, 'claim_not_held');
+  assert.deepEqual(wrong.detail.held, ['1003114', '1003493'], 'the refusal names the claims you DO hold');
+  assert.ok(/claim.js 1003112/.test(wrong.detail.what_this_means), 'and the line that fixes it');
+
+  // A held claim passes, and an id given as a number matches a claim stored as
+  // a string — the ids arrive as both, and a type mismatch here would refuse
+  // the legitimate call, which is the failure mode that gets a check removed.
+  assert.equal(applier.claimGateFor(1003493, held).ok, true);
+  assert.equal(applier.claimGateFor('1003114', held).ok, true);
+
+  // Holding nothing at all cannot pass, whatever id is named.
+  assert.equal(applier.claimGateFor(1003114, []).ok, false);
+  assert.equal(applier.claimGateFor(1003114, undefined).ok, false);
+});
+
+await test('a proposal refuses rather than landing on an arbitrary version', () => {
+  const shipped = { id: 'BONGOS-V0', status: 'shipped' };
+  const building = { id: 'BONGOS-V1', status: 'building' };
+  const planning = { id: 'BONGOS-V2', status: 'planning' };
+
+  // The version being built wins wherever it sits in the list.
+  assert.equal(proposals.resolveTargetVersion([shipped, building, planning]).id, 'BONGOS-V1');
+  assert.equal(proposals.resolveTargetVersion([building]).id, 'BONGOS-V1');
+
+  // With nothing building there is NO fallback — not the first row, not a
+  // shipped version, not a planning one. null is what makes the route's
+  // no_open_version refusal reachable.
+  assert.equal(proposals.resolveTargetVersion([shipped, planning]), null);
+  assert.equal(proposals.resolveTargetVersion([shipped]), null);
+  assert.equal(proposals.resolveTargetVersion([]), null);
+  assert.equal(proposals.resolveTargetVersion(null), null);
+  assert.equal(proposals.resolveTargetVersion([null, undefined]), null);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/modules/lifecycle/conflict-resolve.js

@@ -138,11 +138,13 @@ async function hasConflictMarkers(gitIn) {
 // resolveBranchConflicts — attempt to auto-resolve a generated-file / append-index
 // merge conflict on `branch` against origin/main, server-side. Returns a structured
 // result (never throws for the expected outcomes; throws only on misconfiguration):
-//   { resolved: true,  head_sha, branch }                         — merged + pushed
+//   { resolved: true,  head_sha, branch, regenerated }            — merged + pushed
 //   { resolved: false, skipped: '<why>' [, conflicted: [...] ] }  — left as-is
 // skipped reasons: disabled | unconfigured | already_up_to_date | clone_failed |
 //   fetch_failed | checkout_failed | markers_remain | push_failed |
-//   unresolvable_conflict (with conflicted[]).
+//   unresolvable_conflict (with conflicted[]) | generator_failed | commit_failed.
+// `regenerated` says whether step 7b had to commit post-merge generator drift on top
+// of the merge (task 1003546) — head_sha is that commit when it did.
 async function resolveBranchConflicts({ branch } = {}, deps = {}) {
   // Kill-switch: deps.disabled wins for tests; otherwise the env flag (matches the
   // publish-reconciler's PUBLISH_RECONCILER_DISABLED idiom).
@@ -163,6 +165,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
   const exec = deps.exec || defaultExec;
   const repoRoot = deps.repoRoot || REPO_ROOT;
   const register = deps.registerMergeDriver || registerMergeDriver;
+  const runGenerators = deps.runGenerators || defaultRunGenerators;
   const tmp = (deps.mkdtemp || (() => fs.mkdtempSync(path.join(os.tmpdir(), 'otb-resolve-'))))();
   const work = path.join(tmp, 'work');
   const git = (args, opts) => exec(['-C', work, ...args], opts);
@@ -225,6 +228,49 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     //    not our case (mergeIfGreen reported a conflict), so report a no-op.
     const after = (await git(['rev-parse', 'HEAD'])).stdout.trim();
     if (after === before) return { resolved: false, skipped: 'already_up_to_date' };
+    let head = after;
+
+    // 7b. REGENERATE ON THE MERGED TREE — the step that makes step 6 trustworthy
+    //     (task 1003546). The `otb-regen` driver is invoked BY git, DURING the merge,
+    //     and every artifact it rebuilds is produced by SCANNING THE WORKING TREE
+    //     (copy-inventory.js, gen-repo-map.js, gen-file-map.js). At driver time that
+    //     tree is still the PRE-merge (ours) tree, so the driver writes an artifact
+    //     describing the branch, git then completes the merge underneath it, and the
+    //     result is a clean merge — exit 0, no unmerged paths, no markers — carrying a
+    //     generated file that matches NEITHER side nor the merged tree. Nothing
+    //     downstream can catch it: it is only detectable by regenerating again.
+    //
+    //     Measured on the real repo (task 1003546): two branches each shifting lines
+    //     in modules/hall-ui/public/task-detail.js merge clean, and the merge commit's
+    //     docs/copy-registry.json is byte-identical to ours — the other side's line
+    //     numbers are silently DISCARDED (`"line": 464` where the merged tree says
+    //     466). That is the PR #536 / task 1003544 strand exactly. Task 1003543 had
+    //     given these files the driver, which converted the loud CONFLICT they used to
+    //     throw into this silent staleness — strictly harder to see.
+    //
+    //     A line-numbered or aggregate-carrying artifact cannot be resolved from the
+    //     three merge sides by construction; the only correct value is a fresh scan of
+    //     the FINAL tree. So we rebuild here, after the merge commit exists, and
+    //     commit any drift on top. Ordinary case is a no-op (the driver's guess was
+    //     right, or nothing generated moved) and we push the merge alone.
+    const gen = await runGenerators({ work });
+    if (gen && gen.code !== 0) {
+      // A generator hard-error / a missing hand-written note (gen-file-map exit 2).
+      // We cannot certify the merged tree, and pushing an uncertifiable one is what
+      // stranded #536 — leave it, exactly the module's "any failure is a no-op for
+      // the strand" posture. The reconciler's attempt cap still escalates to a human.
+      return { resolved: false, skipped: 'generator_failed' };
+    }
+    const drift = (await git(['status', '--porcelain'])).stdout.trim();
+    if (drift) {
+      await git(['add', '-A']);
+      const c = await git([
+        'commit', '-m',
+        'chore(gds): regenerate generated artifacts from the merged tree (conflict-resolve self-heal, task 1003546)',
+      ]);
+      if (c.code !== 0) return { resolved: false, skipped: 'commit_failed' };
+      head = (await git(['rev-parse', 'HEAD'])).stdout.trim();
+    }
 
     // 8. Belt-and-braces: a clean `git merge` already implies no unmerged paths and
     //    no markers, but assert both before we push anything.
@@ -238,7 +284,7 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     const p = await git(['push', authUrl, `HEAD:refs/heads/${branch}`]);
     if (p.code !== 0) return { resolved: false, skipped: 'push_failed' };
 
-    return { resolved: true, head_sha: after, branch };
+    return { resolved: true, head_sha: head, branch, regenerated: Boolean(drift) };
   } finally {
     try {
       (deps.rmtmp || ((d) => fs.rmSync(d, { recursive: true, force: true })))(tmp);
@@ -255,6 +301,16 @@ const GENERATOR_SCRIPTS = [
   'scripts/gds/gen-repo-map.js',
   'scripts/gds/gen-file-map.js',
   'scripts/gds/gen-session-index.js',
+  // task 1003546: copy-inventory.js writes docs/copy-registry.json +
+  // docs/copy-inventory.md, and its rows carry a `line` per copy string — so ANY
+  // merge that shifts lines in a scanned UI file re-stales it and `unit`
+  // (tests/copy_inventory.mjs) goes red on the merge ref. Its absence here did not
+  // merely fail to heal that: with the other three producing no diff, the caller
+  // returns `no_regen_diff`, whose documented meaning is "a REAL check failure, not
+  // staleness" — so copy-registry staleness was MISDIAGNOSED as a genuine failure,
+  // burned the attempt cap, and announceStrand flagged the task needs_rebase
+  // (PR #536 / task 1003544).
+  'scripts/gds/copy-inventory.js',
 ];
 
 // Run the CLONE's generator scripts in WRITE mode against the merged working tree.

package/modules/public-landing/public/assets/cosmos.css

@@ -1501,7 +1501,9 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-new #wizSignin:hover{background:color-mix(in srgb,var(--ink) 88%,var(--bg));}
 /* the error alert: the error ink between two hairlines, no plate */
 #view-new .alert{background:none;border:0;border-top:1px solid var(--err);border-bottom:1px solid var(--err);border-radius:0;padding:12px 0;font-weight:400;}
-@media (max-width:900px){
+/* one fold for the whole wizard: 840 is where the page's bands and ledger stack
+   (cosmos's createSplit collapse), so the rail folds with them, not before them */
+@media (max-width:840px){
   #view-new .steps{grid-template-columns:repeat(3,1fr);gap:18px 10px;margin-bottom:30px;}
   #view-new .steps .snum{font-size:18px;}
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.510",
+  "version": "1.19.511",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.510",
+      "version": "1.19.511",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.510",
+  "version": "1.19.511",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-apply.js

@@ -32,7 +32,7 @@
 //
 // Run:  node scripts/gds/copy-apply.js                    (the task you are HOLDING — the normal call)
 //       node scripts/gds/copy-apply.js --dry-run          (say what would change, write nothing)
-//       node scripts/gds/copy-apply.js --task 1234        (a named task, when you hold more than one)
+//       node scripts/gds/copy-apply.js --task 1234        (a claim you hold, when you hold more than one)
 //       node scripts/gds/copy-apply.js --patch-file p.json  (a local patch — used by the tests)
 //
 // WHY THE BARE FORM DEFAULTS TO YOUR CLAIM rather than taking an id. The task a
@@ -43,6 +43,13 @@
 // task. So the bare call reads the claim, and holding no claim is a refusal that
 // says to go and claim the task — the methodology's own rule, enforced by the
 // command instead of restated in its output.
+//
+// --task DOES NOT OPT OUT OF THAT (task 1003493). It selects which of your
+// claims to act under when you hold several; it is checked against the same
+// /me claim list the bare call reads, and refuses `claim_not_held` for a task
+// you do not hold. The one path that never touches a task is --patch-file,
+// which reads a local JSON patch and is the tests' entry point — it lands
+// nothing a proposal task authorised, so there is no claim for it to prove.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -208,13 +215,50 @@ function refuse(result) {
   return 2;
 }
 
+// Every claim this session holds. One reader, so the bare call and --task are
+// answered from the same source of truth — the shape of bug where a rule is
+// enforced on one path and merely stated on the other (task 1003493).
+async function activeClaims() {
+  const me = await apiCall('GET', '/api/gds/me');
+  if (!me.ok) return { ok: false, code: 'no_session', detail: { status: me.status, run: 'node scripts/gds/setup.js' } };
+  return { ok: true, claims: me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []) };
+}
+
+// --task <id> names a task; this proves the caller actually HOLDS it. Without
+// this the header's "may only be run under a claim" was true of the bare call
+// and false of the named one — a rule stated three times in prose (here, ADR
+// 0233, modules/copy-desk/CLAUDE.md) and enforced on one of two paths. The
+// refusal names the claims you do hold, because the usual cause is a typo'd id.
+// Pure so the gate is testable without a session: given the id asked for and
+// the claims held, either accept or produce the named refusal.
+function claimGateFor(taskId, claims) {
+  const wanted = String(taskId);
+  const held = (claims || []).map((c) => String(c.task_id));
+  if (held.includes(wanted)) return { ok: true, taskId: wanted };
+  return {
+    ok: false,
+    code: 'claim_not_held',
+    detail: {
+      task: wanted,
+      held,
+      what_this_means: `A copy change lands under a claim like every other change, and you do not hold one on #${wanted}. Claim it first (node scripts/gds/claim.js ${wanted}), then run this again.`,
+    },
+  };
+}
+
+async function claimOnTask(taskId) {
+  const held = await activeClaims();
+  if (!held.ok) return held;
+  return claimGateFor(taskId, held.claims);
+}
+
 // The task this session is holding. Returns a named refusal rather than an id
 // when there is nothing to act under — "claim it first" is the correct answer,
 // not an inconvenience to route around.
 async function claimedTaskId() {
-  const me = await apiCall('GET', '/api/gds/me');
-  if (!me.ok) return { ok: false, code: 'no_session', detail: { status: me.status, run: 'node scripts/gds/setup.js' } };
-  const claims = me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []);
+  const held = await activeClaims();
+  if (!held.ok) return held;
+  const claims = held.claims;
   if (!claims.length) {
     return {
       ok: false,
@@ -271,6 +315,11 @@ async function main() {
     if (!held.ok) return cliExit(refuse(held));
     taskId = held.taskId;
     console.log(`copy-apply: the task you are holding — #${taskId}`);
+  } else if (taskId) {
+    // --task picks WHICH claim to act under; it never substitutes for holding one.
+    const held = await claimOnTask(taskId);
+    if (!held.ok) return cliExit(refuse(held));
+    taskId = held.taskId;
   }
 
   const loaded = await loadPatch({ taskId, patchFile });
@@ -335,4 +384,5 @@ module.exports = {
   locateOccurrence,
   reinjectInterpolations,
   applyPatchToSource,
+  claimGateFor,
 };

package/scripts/gds/git-merge-regen.js

@@ -20,6 +20,24 @@
 // parts of nested docs; it succeeds ONLY if no conflict markers remain. A genuine
 // hand-written conflict falls through to a normal git conflict — it never invents a
 // resolution or clobbers a real edit.
+//
+// ⚠ THE DRIVER'S OUTPUT IS PROVISIONAL FOR ANY TREE-SCANNING ARTIFACT (task 1003546).
+// Every rule below that rebuilds by SCANNING THE WORKING TREE — copy-inventory.js's
+// registry pair, gen-repo-map's map + nested blocks, gen-file-map's sections — is
+// invoked BY git, DURING the merge, when that tree is still the PRE-merge (ours)
+// tree. So the driver writes an artifact describing the branch, git completes the
+// merge underneath it, and the merge lands CLEAN (exit 0, no unmerged paths, no
+// markers) carrying content that matches neither side nor the merged tree. Measured:
+// two branches each shifting lines in one scanned UI file merge clean and the merge
+// commit's docs/copy-registry.json is byte-identical to ours, silently dropping the
+// other side's line numbers (PR #536 / task 1003544).
+// It is still worth running — it clears the markers so the merge completes at all —
+// but it is NOT the authority. Whoever OWNS the merge must regenerate afterwards, on
+// the final tree, and commit the drift: the server does it in conflict-resolve.js
+// step 7b, and a post-merge `resolveInWorktree` call (ship-preflight-steps.js) is
+// correct for the same reason — by then git has written every cleanly-merged path.
+// Do NOT add a rule here and assume the merge is thereby correct; a line-numbered or
+// aggregate-carrying artifact cannot be resolved from the three merge sides at all.
 
 const fs = require('node:fs');
 const os = require('node:os');

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.510'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.511'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/conflict_resolve.mjs

@@ -52,9 +52,21 @@ function mkExec(scn = {}) {
     if (cmd === 'checkout') return ret(scn.checkout ?? 0);
     if (cmd === 'rev-parse') {
       revCount += 1;
-      const sha = revCount === 1 ? (scn.before ?? 'aaaaaaa') : (scn.after ?? 'bbbbbbb');
-      return { code: 0, stdout: `${sha}\n`, stderr: '' };
+      // 1st = the pre-merge tip, 2nd = the merge commit, 3rd = the post-merge
+      // regeneration commit (task 1003546 step 7b), when there was drift to commit.
+      if (revCount === 1) return { code: 0, stdout: `${scn.before ?? 'aaaaaaa'}\n`, stderr: '' };
+      if (revCount === 2) return { code: 0, stdout: `${scn.after ?? 'bbbbbbb'}\n`, stderr: '' };
+      return { code: 0, stdout: `${scn.regenSha ?? scn.after ?? 'bbbbbbb'}\n`, stderr: '' };
     }
+    if (cmd === 'status') {
+      // --porcelain after step 7b's regeneration: a non-empty body = the merged tree
+      // disagreed with the generated artifacts the merge produced. Default OFF so the
+      // pre-1003546 cases keep asserting the plain merge-and-push path.
+      const drift = scn.drift ?? false;
+      return { code: 0, stdout: drift ? ' M docs/copy-registry.json\n' : '', stderr: '' };
+    }
+    if (cmd === 'add') return ret(0);
+    if (cmd === 'commit') return ret(scn.commit ?? 0);
     if (cmd === 'merge' && a[1] === '--abort') return ret(0);
     if (cmd === 'merge') {
       if (scn.merge === 'conflict') { mergeOutcome = 'conflict'; return { code: 1, stdout: 'CONFLICT (content)', stderr: '' }; }
@@ -79,8 +91,13 @@ function mkExec(scn = {}) {
 function mkDeps(scn = {}, over = {}) {
   const reg = [];
   const exec = mkExec(scn);
+  const genCalls = [];
   return {
     exec,
+    // task 1003546: resolveBranchConflicts regenerates on the MERGED tree before it
+    // pushes, so it takes the same runGenerators seam refreshStaleGenerated does.
+    // Stubbed for every case — the real one would spawn node against a fake clone.
+    runGenerators: over.runGenerators || (async (opts) => { genCalls.push(opts); return { code: scn.genCode ?? 0 }; }),
     githubPush: {
       isConfigured: () => (over.configured === undefined ? true : over.configured),
       isSafeBranch: (b) => (over.safeBranch === undefined ? (typeof b === 'string' && b.length > 0 && !b.startsWith('-')) : over.safeBranch),
@@ -94,6 +111,7 @@ function mkDeps(scn = {}, over = {}) {
     rmtmp: () => {},
     _exec: exec,
     _reg: reg,
+    _gen: genCalls,
   };
 }
 
@@ -377,7 +395,11 @@ test('1915 defaultRunGenerators strips *_INSTANCE_ROOT from the child env and pi
       const leaked = Object.keys(call.opts.env || {}).filter((k) => /_INSTANCE_ROOT$/.test(k));
       assert.deepEqual(leaked, [], 'no *_INSTANCE_ROOT key survives into the generator child env');
       assert.ok(call.opts.env.PATH, 'benign env (PATH) is preserved so node still resolves');
-      assert.ok(String(call.argv[0]).startsWith('/tmp/clone-xyz'), 'the generator script path is under the clone');
+      // Separator-normalised: defaultRunGenerators builds this with path.join, which
+      // emits backslashes on win32 — the bare startsWith made this assertion fail on
+      // every Windows builder for a reason unrelated to what it tests (task 1003546).
+      assert.ok(String(call.argv[0]).replace(/\\/g, '/').startsWith('/tmp/clone-xyz'),
+        'the generator script path is under the clone');
     }
   } finally {
     if (prev.g === undefined) delete process.env.GDS_INSTANCE_ROOT; else process.env.GDS_INSTANCE_ROOT = prev.g;
@@ -455,8 +477,100 @@ test('1915 defaultRunGenerators reports the worst child exit code (0 all-clean;
   assert.equal(badGen.code, 2, 'a single failing generator surfaces its non-zero code');
 });
 
+// ── task 1003546: the merged tree is regenerated BEFORE the push ────────────────
+// The `otb-regen` driver runs DURING the merge and rebuilds by scanning the working
+// tree, which at that moment is still the PRE-merge tree. So a merge can come out
+// clean — exit 0, no unmerged paths, no markers — carrying a generated artifact that
+// describes neither side nor the merged tree, and nothing downstream can see it.
+// resolveBranchConflicts must therefore regenerate on the FINAL tree and commit the
+// drift before pushing (PR #536 / task 1003544: the registry kept the branch's line
+// numbers and `unit` stayed red through the heal).
+
+test('1003546 clean merge → generators run on the merged tree, drift committed, head_sha is the regen commit', async () => {
+  const deps = mkDeps({ merge: 'clean', before: 'oldsha1', after: 'mergesha', drift: true, regenSha: 'regensha' });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr1' }, deps);
+  assert.equal(r.resolved, true);
+  assert.equal(deps._gen.length, 1, 'generators ran exactly once against the merged tree');
+  assert.ok(ran(deps._exec, 'commit'), 'post-merge generator drift is committed');
+  assert.equal(r.regenerated, true, 'the result reports that a regeneration was needed');
+  assert.equal(r.head_sha, 'regensha', 'head_sha is the regen commit, not the bare merge commit');
+});
+
+test('1003546 the regeneration happens AFTER the merge and its commit BEFORE the push (ordering is the whole point)', async () => {
+  const order = [];
+  const deps = mkDeps({ merge: 'clean', drift: true });
+  const baseExec = deps.exec;
+  deps.exec = async (args) => {
+    const a = args[0] === '-C' ? args.slice(2) : args;
+    if (['merge', 'commit', 'push'].includes(a[0])) order.push(a[0]);
+    return baseExec(args);
+  };
+  deps.runGenerators = async () => { order.push('__generators__'); return { code: 0 }; };
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr2' }, deps);
+  assert.equal(r.resolved, true);
+  assert.deepEqual(order, ['merge', '__generators__', 'commit', 'push'],
+    'a pre-merge regeneration (or a push before the regen commit) is exactly the bug');
+});
+
+test('1003546 no post-merge drift → the merge alone is pushed, nothing extra committed', async () => {
+  const deps = mkDeps({ merge: 'clean', after: 'mergesha', drift: false });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr3' }, deps);
+  assert.equal(r.resolved, true);
+  assert.equal(r.regenerated, false);
+  assert.equal(r.head_sha, 'mergesha', 'the merge commit is the head when regen is a no-op');
+  assert.ok(!ran(deps._exec, 'commit'), 'nothing is committed when the merge was already correct');
+  assert.ok(ran(deps._exec, 'push'), 'the resolved branch still lands');
+});
+
+test('1003546 a failing generator never pushes an uncertifiable merged tree', async () => {
+  const deps = mkDeps({ merge: 'clean', drift: true, genCode: 2 });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr4' }, deps);
+  assert.equal(r.resolved, false);
+  assert.equal(r.skipped, 'generator_failed');
+  assert.ok(!ran(deps._exec, 'push'), 'a tree we cannot certify is left for a human, never pushed');
+});
+
+test('1003546 a failing post-merge commit is reported, not pushed', async () => {
+  const deps = mkDeps({ merge: 'clean', drift: true, commit: 1 });
+  const r = await cr.resolveBranchConflicts({ branch: 'claude/wt-cr5' }, deps);
+  assert.equal(r.resolved, false);
+  assert.equal(r.skipped, 'commit_failed');
+  assert.ok(!ran(deps._exec, 'push'), 'no push without the regeneration commit');
+});
+
+// THE INVARIANT THAT WOULD HAVE CAUGHT #536 ON DAY ONE. Two hand-maintained lists
+// name the same artifacts: REGENERABLE (what the merge driver claims to heal) and
+// GENERATOR_SCRIPTS (what the server actually re-runs). copy-inventory.js was added
+// to the first and not the second, so the copy registry was "covered" by the driver
+// and regenerated by nobody. Pin them as one set, via each artifact's PRODUCER.
+test('1003546 every REGENERABLE artifact has a producer, and every producer is in GENERATOR_SCRIPTS', async () => {
+  const regen = require('../scripts/gds/git-merge-regen.js');
+  const G = require('../scripts/gds/gen-repo-map.js');
+  const CI = require('../scripts/gds/copy-inventory.js');
+
+  // Derived from each generator's own exports where it publishes them, so this map
+  // cannot silently drift from the generator it names.
+  const PRODUCED_BY = new Map([
+    ['docs/repo-map.md', 'scripts/gds/gen-repo-map.js'],
+    ['docs/file-map.md', 'scripts/gds/gen-file-map.js'],
+    ['docs/session-log-index.md', 'scripts/gds/gen-session-index.js'],
+    [CI.REGISTRY_REL, 'scripts/gds/copy-inventory.js'],
+    [CI.REPORT_REL, 'scripts/gds/copy-inventory.js'],
+    ...G.NESTED_DIRS.map((d) => [`${d}/CLAUDE.md`, 'scripts/gds/gen-repo-map.js']),
+  ]);
+
+  for (const p of regen.REGENERABLE) {
+    const producer = PRODUCED_BY.get(p);
+    assert.ok(producer, `REGENERABLE knows ${p} but this test has no producer for it — name the generator that writes it`);
+    assert.ok(
+      cr.GENERATOR_SCRIPTS.includes(producer),
+      `${p} is healed by the merge driver but ${producer} is not in GENERATOR_SCRIPTS, so the server never re-runs it on the merged tree (the task 1003544 strand)`
+    );
+  }
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
-  console.log(`\nconflict-resolve (task 1385 + 1915) tests: ${passed} passed, ${failed} failed`);
+  console.log(`\nconflict-resolve (task 1385 + 1915 + 1003546) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }, 100);

package/tests/git_merge_regen.mjs

@@ -22,6 +22,12 @@
 //   9. END-TO-END for docs/copy-registry.json: two branches that each regenerate
 //      it differently merge without conflict markers via the real .gitattributes +
 //      git-config wiring, and the result equals a fresh regeneration.
+//  10. REGRESSION (task 1003546) — the driver runs MID-merge, so a tree-scanning
+//      artifact heals to the PRE-merge tree: two branches shifting line numbers in
+//      the same scanned UI file merge CLEAN and leave the registry STALE. Pins why
+//      the merge's OWNER must regenerate afterwards (conflict-resolve.js step 7b).
+//      Needs a real clone (the driver's __dirname must BE the merging tree), so it
+//      skips where the environment cannot host that.
 //
 // Run:  node tests/git_merge_regen.mjs
 
@@ -135,7 +141,15 @@ function withBlockBody(src, body) {
   try {
     g('init', '-q');
     g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
-    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    // The fixture repo carries none of the repo's eol rules, so on a Windows box
+    // with the usual global core.autocrlf=true git would check the merge result out
+    // as CRLF while the generators render LF — a byte comparison below would fail on
+    // line endings alone. Pin it so the fixture is platform-neutral (task 1003546).
+    g('config', 'core.autocrlf', 'false');
+    // Forward slashes: `git config` strips backslashes from the value, so a win32
+    // path.join() driver path reaches node with its separators gone and the driver
+    // never loads — this fixture was silently dead on Windows (task 1003546).
+    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/repo-map.md merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeMap('base\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -213,7 +227,15 @@ function withBlockBody(src, body) {
   try {
     g('init', '-q');
     g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
-    g('config', 'merge.otb-regen.driver', `node ${driver} %O %A %B %P`);
+    // The fixture repo carries none of the repo's eol rules, so on a Windows box
+    // with the usual global core.autocrlf=true git would check the merge result out
+    // as CRLF while the generators render LF — a byte comparison below would fail on
+    // line endings alone. Pin it so the fixture is platform-neutral (task 1003546).
+    g('config', 'core.autocrlf', 'false');
+    // Forward slashes: `git config` strips backslashes from the value, so a win32
+    // path.join() driver path reaches node with its separators gone and the driver
+    // never loads — this fixture was silently dead on Windows (task 1003546).
+    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/copy-registry.json merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeReg('{"schema":0}\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -235,4 +257,108 @@ function withBlockBody(src, body) {
   }
 }
 
+// ── 10) REGRESSION (task 1003546): the driver runs MID-merge, so a tree-scanning ──
+// artifact heals to the PRE-merge tree and the merge lands clean but STALE.
+//
+// Cases 8 + 9 prove the copy-registry rule regenerates and that a real merge comes
+// out marker-free — but their fixture repos contain no scanned SOURCE, so the scan
+// returns the same bytes whichever tree it reads and they are blind to WHEN it runs.
+// This case supplies the missing half: two branches that each shift line numbers in
+// the SAME scanned UI file, in a real clone where the driver's own `__dirname` is
+// the merging tree. The merge exits 0 with no unmerged paths and no markers — and
+// keeps OUR registry verbatim, silently discarding the other side's line numbers.
+// Measured before the fix: `"line": 464` where the merged tree says 466; that is the
+// PR #536 / task 1003544 strand, and the reason conflict-resolve.js regenerates
+// AFTER the merge (step 7b) instead of trusting the driver.
+//
+// It SKIPS rather than fails where the environment cannot host the fixture (no local
+// clone, the scanned file moved, or a base whose registry is already stale) — a
+// characterization test must never red for a reason it cannot attribute.
+{
+  const SCANNED = 'modules/hall-ui/public/task-detail.js';
+  const REGEN_PATHS = ['docs/copy-registry.json', 'docs/copy-inventory.md'];
+  // Short clone path: a deep temp dir blows Windows' MAX_PATH on the clone's
+  // .git/objects/info/commit-graphs entries.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-regen-e2e-'));
+  const work = path.join(root, 'w');
+  const g = (...a) => spawnSync('git', a, { cwd: work, encoding: 'utf8' });
+  const gen = (...a) => spawnSync('node', [path.join(work, 'scripts/gds/copy-inventory.js'), ...a],
+    { cwd: work, encoding: 'utf8' });
+  // "Does regeneration change tracked CONTENT?" — `git diff` applies .gitattributes
+  // (`*.json text eol=lf`), so it ignores the worktree line endings that make a raw
+  // byte comparison stale on a Windows checkout.
+  const regenDirty = () => { gen(); return g('diff', '--quiet', '--', ...REGEN_PATHS).status !== 0; };
+  const scannedFile = () => path.join(work, SCANNED);
+
+  let skip = null;
+  try {
+    if (spawnSync('git', ['clone', '--local', '-q', repo, work], { encoding: 'utf8' }).status !== 0) {
+      skip = 'the repo could not be locally cloned';
+    }
+    if (!skip) {
+      g('config', 'user.email', 't@t');
+      g('config', 'user.name', 't');
+      g('config', 'core.autocrlf', 'false');
+      g('config', 'merge.otb-regen.name', 'regen');
+      g('config', 'merge.otb-regen.driver',
+        `node ${path.join(work, 'scripts/gds/git-merge-regen.js').replace(/\\/g, '/')} %O %A %B %P`);
+
+      if (!fs.existsSync(scannedFile())) skip = `${SCANNED} is gone — repoint this fixture at another scanned surface`;
+      else if (fs.readFileSync(scannedFile(), 'utf8').split('\n').length < 420) skip = `${SCANNED} is too short for two distant edits`;
+    }
+    if (!skip && regenDirty()) {
+      skip = 'the committed copy registry is already stale at this base — nothing could be attributed to the merge';
+    }
+
+    if (!skip) {
+      g('checkout', '--', ...REGEN_PATHS);
+      const pad = (atLine, tag) => {
+        const lines = fs.readFileSync(scannedFile(), 'utf8').split('\n');
+        lines.splice(atLine, 0, `// pad ${tag}`, `// pad ${tag}`);
+        fs.writeFileSync(scannedFile(), lines.join('\n'));
+      };
+
+      // Base is HEAD itself — never a branch NAME, which does not exist in a CI
+      // detached checkout.
+      const base = g('rev-parse', 'HEAD').stdout.trim();
+      g('checkout', '-q', '-B', 'fixture-ours', base);
+      pad(10, 'OURS');
+      gen();
+      g('add', '-A'); g('commit', '-qm', 'ours: shift copy lines near the top + regen');
+
+      g('checkout', '-q', '-B', 'fixture-theirs', base);
+      pad(400, 'THEIRS');
+      gen();
+      g('add', '-A'); g('commit', '-qm', 'theirs: shift copy lines far below + regen');
+
+      g('checkout', '-q', 'fixture-ours');
+      const m = g('merge', '--no-edit', 'fixture-theirs');
+
+      // 1. The merge lands CLEAN — the driver did clear the textual conflict.
+      assert.equal(m.status, 0, `the driver must resolve the registry conflict; got ${m.status} :: ${m.stdout}${m.stderr}`);
+      assert.equal(g('diff', '--name-only', '--diff-filter=U').stdout.trim(), '', 'no path may be left unmerged');
+      const healed = fs.readFileSync(path.join(work, 'docs', 'copy-registry.json'), 'utf8');
+      assert.ok(!MARKERS.test(healed), 'the merged registry must carry no conflict markers');
+
+      // 2. THE HAZARD: it kept OURS verbatim, because the scan ran before the merge.
+      assert.equal(
+        g('diff', '--quiet', 'HEAD^1', 'HEAD', '--', 'docs/copy-registry.json').status, 0,
+        'expected the merge to keep ours byte-for-byte (the mid-merge scan)'
+      );
+      assert.equal(regenDirty(), true,
+        'expected the merged tree to be STALE — the driver cannot see the merged tree, which is WHY '
+        + 'conflict-resolve.js regenerates after the merge (step 7b). If this assertion now fails, git has '
+        + 'begun running merge drivers against the merged tree: re-read step 7b, it may be simplifiable.');
+
+      // 3. THE CURE step 7b relies on: a post-merge regeneration is sufficient.
+      g('add', '-A'); g('commit', '-qm', 'regenerate from the merged tree');
+      assert.equal(regenDirty(), false, 'a post-merge regeneration must leave the registry fresh');
+    } else {
+      console.log(`git_merge_regen: case 10 SKIPPED — ${skip}`);
+    }
+  } finally {
+    try { fs.rmSync(root, { recursive: true, force: true }); } catch (_) { /* best effort */ }
+  }
+}
+
 console.log('git_merge_regen: all assertions passed');

package/tests/projects_hub.mjs

@@ -1995,6 +1995,19 @@ test('the wizard takes the world by scope: no card ground, the six-step strip as
   assert.doesNotMatch(block, /#[0-9a-f]{3,8}\b/i, 'every colour is a token');
 });
 
+/* ── one fold for the whole wizard (task 1003538, a task 1003346 follow-up). The rail folded
+   at the sheet's 900 while the wizard's fields, choice bands and review ledger folded at the
+   page's 840 (cosmos's createSplit collapse), so between the two the rail was already three-up
+   beside full-width bands. Both sheets now name the same width. ── */
+test('the wizard folds at one width: the rail\'s media rule sits at 840px with the bands, and no 900px rule is left in the #view-new block (task 1003538)', () => {
+  const at = COSMOS.indexOf('THE CREATE WIZARD, IN THE WORLD');
+  assert.ok(at > -1, 'the #view-new block exists in cosmos.css');
+  const block = COSMOS.slice(at);
+  assert.match(block, /@media \(max-width:840px\)\{\s*#view-new \.steps\{grid-template-columns:repeat\(3,1fr\);/, 'the rail folds to three columns at 840, the width the bands fold at');
+  assert.doesNotMatch(block, /@media \(max-width:900px\)/, 'no 900px rule is left in the wizard block');
+  assert.match(STYLE, /@media \(max-width:840px\)\{[\s\S]*?\.review\{grid-template-columns:1fr;/, 'the page\'s own wizard block still folds its bands and ledger at that same 840');
+});
+
 test('the wizard\'s own structures wear the world: hairline fields, cells of one band, the review as a ledger, the human steps as a numbered ledger, the standup strip as the rail (task 1003346)', () => {
   const at = STYLE.indexOf('the create wizard (task 1002763');
   assert.ok(at > -1, 'the wizard block is still the page\'s own');