@bongos/core 1.19.578 → 1.19.580

package/modules/platform-identity/application-echo.js

@@ -88,6 +88,55 @@ async function listRecentApplications(githubId, { pool = defaultPool } = {}) {
   return rows;
 }
 
+// applicationBacksProfileRead — "did THIS account apply to THIS project, inside
+// the window?" The gate under POST /sso/applicant-profile (task 1002972, D7),
+// and the exact analogue of membershipBacksRollup: a boolean, nothing more.
+//
+// WHY IT HAS TO EXIST, and it is the whole security argument for that route.
+// Client credentials say WHICH PROJECT is calling; they say NOTHING about who
+// the github_id in the body is (ADR 0205, security report 1000027 — the lesson
+// /sso/membership/check-in and /sso/activity/rollup both had to learn). Without
+// this check, any registered project holding only its own secret could walk the
+// github_id space and pull an applicant view for every account on the platform,
+// PRIVATE ONES INCLUDED — D7's private branch would become a bulk disclosure
+// oracle, which is strictly worse than the rollup hole it mirrors. The echo is
+// the right witness precisely because the HUB writes it, in its own join relay
+// (routes/my-projects.js), only after the project answered the relayed
+// application with a success. A client cannot assert itself into this table.
+//
+// THIS IS THE ONE CROSS-ACCOUNT READ OF THIS TABLE, and it is deliberately the
+// narrowest possible one — the caller must already name both the account and the
+// project, and gets back a yes/no. It cannot enumerate: there is no listing by
+// client_id here, so a project learns nothing about who applied that it was not
+// already told when the application arrived at its own door. (The header's
+// "own-scope only" line describes listRecentApplications, which is still the
+// only surface that returns a LIST.)
+//
+// THE WINDOW IS THE SAME 30 DAYS, and reusing it is load-bearing rather than
+// tidy: the echo is what makes an applicant view readable, so when the echo
+// stops matching, the view stops being readable. A queue row older than the
+// window renders no record — which is the correct answer, because the platform
+// stopped vouching for the connection between that row and that account.
+//
+// Fail-closed: a non-numeric principal, an empty client, and no row are the same
+// false. Never authority (ADR 0016) — a true here buys the caller a DESCRIPTION,
+// and admission still reads status='invited' alone.
+async function applicationBacksProfileRead({ githubId, clientId }, { pool = defaultPool } = {}) {
+  if (!isNumericGithubId(githubId)) return false;
+  const client = String(clientId || '');
+  if (!client) return false;
+  const { rows } = await pool.query(
+    `SELECT 1
+       FROM platform_identity_application_echoes
+      WHERE github_id = $1::bigint
+        AND client_id = $2
+        AND applied_at > now() - make_interval(days => $3::int)
+      LIMIT 1`,
+    [String(githubId), client, APPLICATION_ECHO_WINDOW_DAYS],
+  );
+  return rows.length > 0;
+}
+
 // forgetApplication — drop this account's echo for one project. Called when the
 // account LEAVES the project: the echo means "I asked to join and have not yet",
 // and someone who joined and left has neither. Without it, leaving RESURRECTS the
@@ -111,5 +160,6 @@ module.exports = {
   APPLICATION_ECHO_WINDOW_DAYS,
   recordApplication,
   listRecentApplications,
+  applicationBacksProfileRead,
   forgetApplication,
 };

package/modules/platform-identity/recruiter-sliver.js

@@ -159,6 +159,22 @@ function projectSliver(account, activity) {
 // shape, and for a hidden account DO NOT ISSUE the activity read at all. Not
 // merely dropping the fields after fetching them is the point — the cheapest way
 // for a future edit to leak a number is for the number to already be in hand.
+//
+// EXPORTED as `sliverShapeFor` for ONE other caller — ./applicant-profile.js,
+// the D7 rule (task 1002972) — and the export carries a contract worth stating,
+// because it is the half of this file that does NOT decide consent:
+//
+//   THIS FUNCTION APPLIES NO CONSENT PREDICATE. It takes a row somebody else
+//   already decided may be disclosed, and answers only "what SHAPE of sliver
+//   does this row get" — the `hide_stats` rule and the whitelist. The two entry
+//   points below reach it through readSliverAccount, whose WHERE carries
+//   recruiterSliverVisibleSql; a caller that does not go through them owes the
+//   floor itself.
+//
+// It is shared rather than copied for the reason D7 exists: an applicant view
+// that built its own five-key object would be a SECOND pre-accept projection,
+// free to drift from this one field by field, and the whitelist proof over this
+// file would not cover it. One projection, two consent gates above it.
 async function sliverFor(account, { pool }) {
   if (!account) return null;
   if (account.hide_stats) return projectSliver(account, null);
@@ -194,4 +210,7 @@ module.exports = {
   ACTIVE_WINDOW_DAYS,
   getRecruiterSliver,
   getRecruiterSliverByHandle,
+  // The SHAPE without the consent gate — see the contract on sliverFor above.
+  // One caller: ./applicant-profile.js, which supplies its own floor.
+  sliverShapeFor: sliverFor,
 };

package/modules/platform-identity/routes/sso.js

@@ -23,6 +23,61 @@ const canonicalProfile = require('../canonical-profile');
 const inviteSuggestions = require('../invite-suggestions');
 const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
+// The D7 applicant-profile read (task 1002972) and the echo that gates it.
+const applicantProfile = require('../applicant-profile');
+const applicationEcho = require('../application-echo');
+
+// Per-IP cap for POST /sso/applicant-profile — DEFENCE IN DEPTH behind the echo
+// gate, not the gate itself (task 1002972 grade advisory). The echo already
+// closes the enumeration oracle: a caller can only read someone who applied to
+// it, which it already knows about. What a ceiling adds is a bound on the cost
+// of GUESSING — an attacker holding a stolen client secret, or simply a buggy
+// instance, cannot walk the github_id space at line rate against the hub's
+// database. The route's siblings (/sso/membership/check-in, /sso/activity/rollup)
+// carry none; this one is a READ of another person's profile, which is why it
+// gets the treatment GET /access-requests/status was retrofitted with.
+//
+// Vendored rather than shared: `accountExistenceReadRateLimit` is a per-IP budget
+// deliberately SHARED between core's admission-status and the onboarding probe so
+// the two cannot be alternated. This is a different audience — a federated
+// instance's server, not a browser — and folding it into that budget would let a
+// busy legitimate project exhaust the door a stranger uses to check their own
+// admission. `perIpSlidingWindow` is not on the doorway, so this mirrors
+// public-profile.js's vendored window instead.
+//
+// Sized for server-to-server: a reviewer render resolves at most 25 applicants
+// (MAX_LIVE_PROFILE_READS), so 300/60s leaves a busy project ample headroom while
+// still bounding a scripted walk.
+const APPLICANT_READ_WINDOW_MS = 60 * 1000;
+const APPLICANT_READ_LIMIT = 300;
+const applicantReadBuckets = new Map(); // ip -> timestamp[]
+
+const applicantSweep = setInterval(() => {
+  const cutoff = Date.now() - APPLICANT_READ_WINDOW_MS;
+  for (const [k, arr] of applicantReadBuckets) {
+    while (arr.length && arr[0] < cutoff) arr.shift();
+    if (arr.length === 0) applicantReadBuckets.delete(k);
+  }
+}, 5 * 60 * 1000);
+if (typeof applicantSweep.unref === 'function') applicantSweep.unref();
+
+function applicantReadRateLimit(req, res, next) {
+  const now = Date.now();
+  const key = req.ip || req.socket?.remoteAddress || 'unknown';
+  let bucket = applicantReadBuckets.get(key);
+  if (!bucket) { bucket = []; applicantReadBuckets.set(key, bucket); }
+  const cutoff = now - APPLICANT_READ_WINDOW_MS;
+  while (bucket.length && bucket[0] < cutoff) bucket.shift();
+  if (bucket.length >= APPLICANT_READ_LIMIT) {
+    const retryAfter = Math.max(1, Math.ceil((bucket[0] + APPLICANT_READ_WINDOW_MS - now) / 1000));
+    res.set('Retry-After', String(retryAfter));
+    res.set('X-RateLimit-Scope', 'applicant-profile-read');
+    res.set('X-RateLimit-Limit', String(APPLICANT_READ_LIMIT));
+    return res.fail('rate_limited', 429, { scope: 'applicant-profile-read', retry_after_seconds: retryAfter });
+  }
+  bucket.push(now);
+  return next();
+}
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('platform-identity');
 
@@ -549,5 +604,76 @@ module.exports = function ssoRoutes() {
     }
   });
 
+  // POST /sso/applicant-profile — a federated instance resolves ONE applicant's
+  // profile view for its own reviewer queue, LIVE at render (privacy spec D7,
+  // task 1002972). Server-to-server, client_id+client_secret auth, like the two
+  // routes above. Answers { profile: null | { view:'public', … } | { view:
+  // 'sliver', … } } — the D7 rule, decided entirely inside
+  // ../applicant-profile.js.
+  //
+  // WHY A POST FOR A READ. The same reason /sso/activity/rollup is one: the
+  // credentials are in the body, and a client_secret in a query string lands in
+  // access logs and proxy history. Nothing is written.
+  //
+  // THE ECHO IS THE GATE, AND IT IS THE WHOLE SECURITY ARGUMENT (ADR 0205,
+  // security report 1000027). Client credentials prove WHICH PROJECT is calling
+  // and nothing about WHO the github_id is, so authenticating the caller is not
+  // enough: without a per-subject witness this route is a bulk disclosure oracle
+  // over every account on the platform, private ones included, readable by any
+  // registered project holding only its own secret. applicationBacksProfileRead
+  // demands a HUB-WRITTEN echo for exactly (this account, this client) inside
+  // the 30-day window — a row only the hub's own join relay creates, and only
+  // after the project accepted the relayed application. A project may therefore
+  // read the profile of someone who applied TO IT, and of nobody else.
+  //
+  // 404, never 403, when the echo is absent — the /scouting/:handle posture. A
+  // 403 would confirm that the github_id names a real account, which is the
+  // disclosure the whole rule exists to withhold. An account that exists but
+  // discloses nothing (provisional, terms never accepted) answers the SAME
+  // { profile: null } as one that consented but is simply not readable, so the
+  // caller cannot tell those apart either (ADR 0171 D4).
+  //
+  // NOT AUTHORITY (ADR 0016). The answer is descriptive; the project's own
+  // admission gate reads status='invited' and never this.
+  //
+  // rank: public — authenticated by client_id + client_secret, not a builder rank.
+  // The limiter runs BEFORE the client lookup, so a refused probe costs no DB
+  // work — the accountExistenceReadRateLimit posture.
+  router.post('/sso/applicant-profile', applicantReadRateLimit, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      client_id: { required: true, type: 'string', maxLength: 200 },
+      client_secret: { required: true, type: 'string', maxLength: 512 },
+      github_id: { required: true },
+    })) return;
+    const b = req.body || {};
+    try {
+      const client = await pi.getClient(b.client_id, { pool });
+      if (!client || client.status !== 'active' || !pi.clientSecretValid(client, b.client_secret)) {
+        return res.fail('invalid_client', 401);
+      }
+      // Rejected before the bigint column, like every sibling route here.
+      if (!pi.isNumericGithubId(b.github_id)) {
+        return res.fail('invalid_github_id', 400);
+      }
+      // The witness FIRST — no disclosable data is read until the caller has
+      // proved this person applied to it. The client_id is the AUTHENTICATED
+      // one, never the body's, for the reason every route here takes it that way.
+      const applied = await applicationEcho.applicationBacksProfileRead(
+        { githubId: b.github_id, clientId: client.client_id }, { pool },
+      );
+      if (!applied) return res.fail('no_application', 404);
+      const profile = await applicantProfile.getApplicantProfileView(b.github_id, { pool });
+      // The rollup half is live-derived and hide must beat any cache (ADR 0171
+      // D5) — and D7's "live at review time" says the same thing louder: a
+      // cached applicant view is a snapshot, which is the one thing the rule
+      // forbids.
+      res.set('Cache-Control', 'no-store');
+      res.json({ profile });
+    } catch (err) {
+      log.error('[platform-identity] /sso/applicant-profile', err);
+      res.fail('applicant_profile_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/public-landing/public/projects.html

@@ -825,7 +825,7 @@ summary{min-height:24px;padding:3px 0;}
         <div id="mDoor"><p class="finePrint">Reading the project’s settings…</p></div>
         <details class="finePrint" id="mDoorWhat">
           <summary>What each choice changes</summary>
-          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
+          <p><b>Public</b> — the project is on the map under its name, and anyone who finds it can join. <b>Private</b> — it is on the map under its name, but nobody joins on their own: people ask, and you decide. <b>Stealth</b> — the map shows only that something is there; its name, and everything else about it, stay yours, and nobody can ask to join. Switching to Stealth is itself visible: someone comparing the map before and after can tell which project went quiet. Whichever you pick, a project reaches the map only once it has a name and a description. This is separate from “Who can see it” above — that one is the door on the project’s own pages. Changing it restarts the project to pick it up.</p>
         </details>
       </div>
 
@@ -6589,7 +6589,7 @@ summary{min-height:24px;padding:3px 0;}
   var DOOR_OPTIONS = {
     public: { label: 'Public', blurb: 'The project is on the map under its name, and anyone who finds it can join.' },
     private: { label: 'Private', blurb: 'On the map under its name, but nobody joins on their own — people ask, and you decide.' },
-    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join.' }
+    stealth: { label: 'Stealth', blurb: 'The map shows only that something is there. Its name, and everything else about it, stay yours — and nobody can ask to join. Switching to Stealth is itself visible: someone comparing the map before and after can tell which project went quiet.' }
   };
   var mDoorSettings = null;  /* the platform row's last answer: { value, options } */
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.578",
+  "version": "1.19.580",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.578",
+      "version": "1.19.580",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.578",
+  "version": "1.19.580",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/auth-admission.js

@@ -394,9 +394,70 @@ async function safeSyncRankRole(builder) {
 }
 
 
+// readApplicantProfileFromHub(githubId) — the reviewer queue's LIVE read of one
+// applicant's profile view from the hub (privacy spec D7, task 1002972). The
+// project side of POST /sso/applicant-profile.
+//
+// WHY IT LIVES IN THE KERNEL AND NOT IN THE onboarding MODULE THAT USES IT. The
+// call is authenticated with this instance's HUB CLIENT SECRET, and
+// loadIdpConfig is deliberately not on the doorway — putting it there would hand
+// every module the credential that speaks for this whole project. So the secret
+// stays in core beside the two other hub calls that hold it
+// (reportMembershipCheckIn, reportActivityRollup) and the module reaches a
+// NARROW port instead: one github_id in, one already-bounded view out.
+//
+// RESOLVED FRESH ON EVERY CALL — no cache, no memo, no store. That is D7's
+// "evaluated LIVE at review time, never a snapshot" (spec C2), and the reason a
+// hub outage answers null rather than a stale-but-helpful last-known value: an
+// applicant who hid their stats an hour ago must not have them rendered from
+// this instance's memory. The hub already sends Cache-Control: no-store; this
+// end simply keeps nothing.
+//
+// FAILS SOFT TO null, ALWAYS. A self-hosted instance with no hub (idp unset), a
+// hub that is down, a 404 for an applicant this project has no echo for, a
+// non-JSON body — every one of them is the same null, and the queue renders "no
+// record" beside a row that still shows its login, note and vouch pill. A
+// reviewer losing the profile block is a degraded queue; a queue that fails to
+// load because the hub is slow is a broken one, and admission does not depend on
+// any of this (ADR 0016).
+//
+// BOUNDED IN TIME, which is what makes the paragraph above true rather than
+// aspirational (task 1003681, grader finding). This is the only hub call that
+// FANS OUT: the other two fire at most once per sign-in or per ship, while this
+// one runs up to MAX_LIVE_PROFILE_READS (25) times concurrently inside the
+// Promise.all that GET /access-requests awaits. Unbounded, one unresponsive hub
+// holds the whole reviewer queue open for as long as the socket lives — the
+// exact "broken one" this comment disclaims. The timeout converts that into the
+// null this function already promises on every other failure.
+const APPLICANT_PROFILE_TIMEOUT_MS = 5000;
+
+async function readApplicantProfileFromHub(githubId) {
+  const idp = loadIdpConfig();
+  if (!idp || githubId == null) return null;
+  try {
+    const r = await fetch(`${idp.origin}/api/gds/sso/applicant-profile`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+      signal: AbortSignal.timeout(APPLICANT_PROFILE_TIMEOUT_MS),
+      body: JSON.stringify({
+        client_id: idp.clientId,
+        client_secret: idp.clientSecret,
+        github_id: githubId,
+      }),
+    });
+    if (!r.ok) return null;
+    const body = await r.json().catch(() => null);
+    return (body && body.profile) || null;
+  } catch (err) {
+    log.info('[auth] hub applicant-profile read failed (non-blocking):', err.message);
+    return null;
+  }
+}
+
 module.exports = {
   firstAdminLogin,
   firstTimeAdmissionBlocked,
+  readApplicantProfileFromHub,
   // Re-exported, not defined here (task 1003579 moved it to project-door.js with
   // the two knobs it composes against). auth.js, the doorway's api.joinabilityMode
   // and four test files import it by this path, and the read-back it answers —

package/src/bongos/auth.js

@@ -55,7 +55,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, joinabilityMode, maybeSeatFirstAdmin, membershipKind, openEnrollmentEnabled, readApplicantProfileFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -787,6 +787,7 @@ module.exports = {
   idpConfigured,
   openEnrollmentEnabled,
   joinabilityMode,
+  readApplicantProfileFromHub,
   firstTimeAdmissionBlocked,
   webAdmissionStatus,
   firstAdminLogin,

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.578'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.580'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -273,6 +273,16 @@ module.exports = {
   //     the other two had closed. Optional `{ publishable }` for a caller that
   //     holds a publish verdict — see src/bongos/project-door.js.
   projectJoinDoor: (opts) => require('./bongos/project-door').effectiveJoinDoor(opts),
+  // readApplicantProfileFromHub(githubId) — the reviewer queue's LIVE per-render
+  //     read of one applicant's hub profile view (privacy spec D7, task
+  //     1002972). Published as a NARROW port on purpose: the underlying call is
+  //     authenticated with this instance's hub client secret, and loadIdpConfig
+  //     stays off the doorway so no module ever holds the credential that speaks
+  //     for the whole project. A module passes one github_id and gets one
+  //     already-bounded view (or null) — it can neither widen the request nor
+  //     re-address it. Fails soft to null on every error, so a hub outage costs
+  //     the profile block and never the queue.
+  get readApplicantProfileFromHub() { return require('./bongos/auth').readApplicantProfileFromHub; },
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/adr_renumber_integrity.mjs

@@ -0,0 +1,84 @@
+// tests/adr_renumber_integrity.mjs — a renumbered ADR must move ALL of itself
+// (task 1003681, from a grader finding).
+//
+// Renumbering an ADR is not one edit, it is four, and `fitness.js` only checks
+// two of them (numbers are unique, and the index has one row per file). This
+// pins the other two, plus the class of stale reference that caused the finding.
+//
+// THE INCIDENT. Task 1002972's branch authored ADR 0241 while main landed a
+// DIFFERENT 0241; the collision failed fitness and stranded the PR for four
+// days. Renumbering the never-landed one to 0260 moved its filename, its
+// heading and its index row's link — but left its own session log still saying
+// "ADR 0241" in prose, twice. Because 0241 is a REAL, DIFFERENT, ALREADY-LANDED
+// ADR, that is worse than a dangling link: a reader follows it and arrives,
+// with no error, at the wrong decision. `docs-entropy.js` cannot see this — it
+// resolves LINKS, and these were bare prose references to a number that does
+// resolve, just to something else.
+//
+// What each check would have caught:
+//   • heading vs filename — a rename that forgot the `# ADR NNNN` line
+//   • index row number vs its own link target — a row renumbered IN PLACE
+//     (which is also how the row ended up sorted between 0240 and 0241)
+//   • the session log's references — the finding itself, as a regression pin
+//
+// Run:  node --test --test-reporter=tap tests/adr_renumber_integrity.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ADR_DIR = path.join(ROOT, 'docs', 'adr');
+
+const adrFiles = fs
+  .readdirSync(ADR_DIR)
+  .filter((f) => f.endsWith('.md') && /^\d{4}-/.test(f))
+  .sort();
+
+test('every ADR file’s heading carries its own number — a rename must move the heading too', () => {
+  assert.ok(adrFiles.length > 200, 'the ADR corpus should be substantial; a tiny count means the glob broke');
+  const wrong = [];
+  for (const f of adrFiles) {
+    const fileNum = /^(\d{4})-/.exec(f)[1];
+    const first = fs.readFileSync(path.join(ADR_DIR, f), 'utf8').split(/\r?\n/)[0];
+    // both conventions ship in this corpus: "# ADR 0259 — …" and "# 0001 — …"
+    const heading = /^#\s*(?:ADR\s*)?(\d{4})\b/.exec(first);
+    if (!heading) { wrong.push(`${f} :: heading carries no number (${first.slice(0, 60)})`); continue; }
+    if (heading[1] !== fileNum) wrong.push(`${f} :: heading says ${heading[1]}`);
+  }
+  assert.deepEqual(wrong, [], 'an ADR whose heading and filename disagree is a half-finished renumber');
+});
+
+test('every index row’s number matches the file it links — a row renumbered in place is caught here', () => {
+  const readme = fs.readFileSync(path.join(ADR_DIR, 'README.md'), 'utf8');
+  const rows = readme.split(/\r?\n/).filter((l) => /^\|\s*\d{4}\s*\|/.test(l));
+  assert.ok(rows.length > 200, 'the index should carry a row per ADR');
+  const wrong = [];
+  for (const row of rows) {
+    const rowNum = /^\|\s*(\d{4})\s*\|/.exec(row)[1];
+    // A row's summary CITES many other ADRs, so the first `](NNNN-….md)` is
+    // usually a citation. The row's OWN target is the one closing its
+    // `[**Title**](…)` cell — i.e. the last link before the trailing category
+    // cell. Matching the first one instead reports ~60 false mismatches.
+    const link = /\]\((\d{4})-[^)]*\.md\)\s*\|[^|]*\|\s*$/.exec(row);
+    if (!link) continue; // a handful of legacy rows link elsewhere or not at all
+    if (link[1] !== rowNum) wrong.push(`row ${rowNum} links ${link[1]}-…`);
+  }
+  assert.deepEqual(wrong, [], 'a row whose number and link disagree sends every citation to the wrong ADR');
+});
+
+test('the ADR that was renumbered out of a collision leaves no reference to its old number (task 1003681)', () => {
+  // The regression itself. 0241 is a real, different, landed ADR — so a stale
+  // reference here resolves silently to the wrong decision rather than 404ing,
+  // which is exactly why no link checker flagged it.
+  const log = path.join(ROOT, 'docs', 'session-logs', '2026-09-03-goal-1000045-applicant-profile-d7.md');
+  const src = fs.readFileSync(log, 'utf8');
+  assert.doesNotMatch(src, /ADR 0241\b/, 'this task’s ADR moved to 0260; 0241 now names the artist-gate decision');
+  assert.match(src, /ADR 0260\b/, 'the log must cite the decision it actually produced');
+  assert.ok(
+    fs.existsSync(path.join(ADR_DIR, '0260-the-application-is-the-consent-and-the-echo-is-the-gate.md')),
+    'and that ADR must exist under the number the log now cites',
+  );
+});