@bongos/core 1.19.620 → 1.19.622

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.620",
-  "core_contract": "1.19.620",
-  "source_commit": "7e8c8d38a15a24575258eda58829e9120d9ed55f",
+  "core_version": "1.19.622",
+  "core_contract": "1.19.622",
+  "source_commit": "d7fca718550089ea07dc0180b88bcf356c86e06f",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T06:53:24.739Z",
+  "built_at": "2026-09-09T07:05:49.899Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 464,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2086,
+    "functional_verbatim": 2087,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2574,
-  "tree_sha256": "8c5d0cef512909da1de5dd90510ca13a74737c8d3b80ec2d8e0a7fc5e1d9451d",
+  "file_count": 2575,
+  "tree_sha256": "b42f3efc74c1736882f7545a20d0ab217990c61535f00a1c38b916f8ee92f029",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -377,7 +377,7 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "7486f9978e473b0adf09f8bfcbe2a029eb2833636ae3bd55fc307ccb3e773963"
+      "sha256": "65fb7649709e966a90f431d57b8855bd39951684a754320c4a797da9e3ccac13"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
@@ -407,7 +407,7 @@
     {
       "path": "clients/bongos-client/package.json",
       "mode": "0000644",
-      "sha256": "ca32245dc6322f0399058b91f07fe12709fe7b97485fd5d8f5f37cb42f730aae"
+      "sha256": "d299252221daca415cf982b61fe5e3d9c3707c672a7d47adc052a9ee8166223f"
     },
     {
       "path": "config/branding.neutral.json",
@@ -1172,7 +1172,7 @@
     {
       "path": "docs/adr/0134-private-first-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "ce1345a7de47416745964de31ec0d72cdf37f29fc1d41337b24d0e705710b0d7"
+      "sha256": "87b5f5038221e8244c3f98e6f9bc6bf64b23cf8cc758327dd5a58c9b31196fb2"
     },
     {
       "path": "docs/adr/0135-module-upstream-submission-interim-queue.md",
@@ -1812,7 +1812,7 @@
     {
       "path": "docs/adr/0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md",
       "mode": "0000644",
-      "sha256": "43bf2232da3353ab49bfd956a73d09c5045e5fa155e0004d0855a50587c299cd"
+      "sha256": "e701aa98eddf2a0bde803fecfaf681502db33e67765f6a355e883cd3c714cd08"
     },
     {
       "path": "docs/adr/0259-a-projects-departure-from-the-public-list-is-public.md",
@@ -1872,7 +1872,7 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "d660b4bc0bc3306f5fcf583118ca9149ba3deafe82dfe3894fe0b1c11b60cc2f"
+      "sha256": "6b90114abfa5e891a8f2ea16c547c960c982030d6228d43c2a833840123a3f69"
     },
     {
       "path": "docs/api-reference.md",
@@ -2757,7 +2757,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6b3c53cfb31b4bf6963f740bb386c24059ef370af8927b0ececde09e062fff33"
+      "sha256": "502e05437441903b3c3a5388f43bfc60e1c910005a6ac0ff7ff07e5d2199a3e1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2947,7 +2947,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "3c6613920881220ec4a076b4608ed57557d645c43dee3fbb4086ad4adb81f593"
+      "sha256": "87851cddc742fb4c62de1cde8b0443a6b6fd800e753e715ed8d2ab838557d4b8"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -5597,7 +5597,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "15c9efea1fb5a8187fe5bae756777ebeb1a214e47e0434d7a8adeb156bd1e093"
+      "sha256": "65558689ccfcea8f71b98cd51eaf1fb45d39267f7e6f6cf8fc35814da2752a34"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -7662,12 +7662,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "401ae455c8e67d7bf4d622ef7e93fce203948868ae3b07de9770e6d90607249f"
+      "sha256": "f56943090b50301c55cc7bb459c1d2b805aaaee4dc57953071c80268ea3bcac0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f6c0e1047dcef4fe6e429e149606d521e0d196ff748bcdeb6de6e1c63d2a60ab"
+      "sha256": "0bf4bc86183612ce855831f54233cec5ff5f2f9cbf56925dcc63d28a50338636"
     },
     {
       "path": "public-docs/index.html",
@@ -7872,7 +7872,7 @@
     {
       "path": "scripts/gds/build-cli-package.js",
       "mode": "0000644",
-      "sha256": "de1cdede17761775722509b1e1edb4bb43fbbf336450556f22119b18b93e43d3"
+      "sha256": "e24710d5546428beba9400831d69eb3101e76bfdb1083916bf12411839e16735"
     },
     {
       "path": "scripts/gds/bump-version.js",
@@ -8157,7 +8157,7 @@
     {
       "path": "scripts/gds/gen-api-client.js",
       "mode": "0000644",
-      "sha256": "e9a6c6498f41b51dbcc17a3538d997b220f671beb433ae65ebc5365727a444ec"
+      "sha256": "d363c76caf379a051faea40a2497db8bbba18effd68e9cd9922e9445638c57c5"
     },
     {
       "path": "scripts/gds/gen-api-docs.js",
@@ -8922,7 +8922,7 @@
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
-      "sha256": "061a477c618ca76aba4f3abfb2d22ad89ceb0bee46bac65b139ad8ee2f30413a"
+      "sha256": "d0adb1267fc2d75482a37ba252ebffce15cdd32ef2af178579668776a8dfa3a4"
     },
     {
       "path": "scripts/gds/status.js",
@@ -9397,7 +9397,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d2b45162be47422810ab7a05c42c9926520df6c1c5ab7e7274386c5a25eb07a3"
+      "sha256": "aa73b7f2356cde88eb58d423517adc364cf6fb7e8c9fd5dc177ae4d73b83e3e2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10159,6 +10159,11 @@
       "mode": "0000644",
       "sha256": "1ab482fea7d56cccd811c760e21bf564c7952cd5c11d5831faa500b6c2eaa331"
     },
+    {
+      "path": "tests/cross_discipline_priority_direction.mjs",
+      "mode": "0000644",
+      "sha256": "d7e67ada5978b56e271439233c4c8cd7bcb2abfada593c4591dee4904a8a6233"
+    },
     {
       "path": "tests/currency_label.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -7,14 +7,26 @@ by hand; it regenerates when the spec changes, so it can never drift from the ro
 - API version: **v1** (served at `/api/bongos/v1`)
 - 360 operations across 55 resource groups
 
-## Install
+## Use it from your project
+
+**This is not an npm package** — it is not published, and nothing depends on it as one
+(task 1003742). Consume it by VENDORING the build you need, which is what every consumer
+in this repo already does:
 
 ```bash
-npm install @bongos/client   # internal registry / workspace path
+# ESM / bundler:  cp clients/bongos-client/index.mjs  <your project>/vendor/
+# CommonJS:       cp clients/bongos-client/index.cjs  <your project>/vendor/
+# Browser global: cp clients/bongos-client/bongos-client.global.js <your project>/public/
 ```
 
+Copy `index.d.ts` alongside it for types. Re-copy after `gen-api-client.js` runs, so the
+client cannot drift from the routes.
+
 ## Use
 
+The examples import by package name, which resolves in a workspace. A VENDORED copy is
+imported by its path instead — `from './vendor/index.mjs'` — everything below is identical.
+
 ```js
 import { createClient, ApiError } from '@bongos/client';
 

package/clients/bongos-client/package.json

@@ -25,8 +25,5 @@
     "README.md"
   ],
   "license": "AGPL-3.0-or-later",
-  "publishConfig": {
-    "access": "restricted"
-  },
   "sideEffects": false
 }

package/docs/adr/0134-private-first-npm-distribution.md

@@ -1,6 +1,6 @@
 # 0134 — Private-first npm distribution for the core + client (paid scoped, then public at launch)
 
-- **Status:** Accepted — publish path + private-by-default config built in task 2089; the real publish is a gated owner step.
+- **Status:** Accepted for the CORE; the **client half is superseded** by [task 1003742](https://cloudbongos.com/builders#/task/1003742) (2026-09-09) — see the note under Decision. Publish path + private-by-default config built in task 2089; the real publish is a gated owner step.
 - **Date:** 2026-07-07
 - **Deciders:** example-owner (owner/Archon), Claude. Owner asked to have the npm/CLI onboarding commands ready but kept private pre-launch, choosing paid private npm over the free GitHub Packages option.
 - **Task:** [#2089](https://example.com/builders#/task/2089) (publish path + private config) · [#2092](https://example.com/builders#/task/2092) (the `@cloudbongos` → `@bongos` scope rename + first real publish) · **Goal:** 35 (project-creation flow), criterion 165.
@@ -18,6 +18,25 @@ One npm rule forces the shape: **unscoped packages are always public — only *s
 
 Publish **`@bongos/core`** and **`@bongos/client`** as **scoped, private** npm packages during pre-launch, on the owner's **paid** `bongos` npm org — the **canonical** brand org.
 
+> **SUPERSEDED for the client (2026-09-09, [task 1003742](https://cloudbongos.com/builders#/task/1003742)).** `@bongos/client`
+> is no longer an npm package at all, and the reason is worth keeping so it does not come back.
+>
+> It was published **once** — 2026-07-07, version 0.0.2 — and never updated, while the API it is
+> *generated from* moved 500+ core versions. In that time it had **zero consumers**: a sweep of every
+> `package.json` across the core and every instance repo (hermeslines-marketing, cloudbongos-instance,
+> mercury, charter, demo) found no dependency on it; the only matches were its own manifest. Everyone
+> who needs the generated client **vendors a copy** — `modules/dev-box/app/src/vendor/bongos-client.cjs`,
+> and `build-cli-package.js` into `@cloudbongos/cli`, which as a *public* package could not have
+> depended on a private one anyway ([ADR 0258](<redacted>.md)).
+> A stale generated client that nobody installs is worse than none: the only thing it could do is
+> mislead someone into pinning a client 500 versions behind the routes.
+>
+> The owner removed it from the registry. The **generated artifact stays** and still regenerates
+> ([ADR 0118](<redacted>.md)) — `clients/bongos-client/` and
+> `gen-api-client.js` earn their place. What is retired is only the claim that it is a package: the
+> generator no longer emits a `publishConfig`, and its README now documents vendoring instead of
+> `npm install`. **This ADR's core half is unaffected.**
+
 > **Scope correction (task 2092).** The publish path first shipped (task 2089) under the `@cloudbongos` scope, matching the name the repo already used. But when publishing, the paid org turned out to be **`bongos`** (the canonical brand the owner put on Teams), while `cloudbongos` — one of the ~10 defensive orgs — was left on the free tier. Since a private scoped publish requires the scope to match a *paid* org, and `@bongos` is the intended canonical brand anyway, we **renamed the core + client package identity `@cloudbongos/*` → `@bongos/*`** (a consistent rename across the build + vendored-install flow, verified by the test suite) rather than pay for a second org. Existing vendored consumers keep their pinned `@cloudbongos/core` tarball; only new scaffolds use `@bongos`.
 
 - **Private by default in code, not just by flag.** The synthesized core `package.json` (`buildPackageJson`) and the generated client `package.json` (`gen-api-client.js`) both carry `publishConfig: { access: "restricted" }`. `package-core.js --publish` additionally passes `--access restricted` on the CLI — belt-and-suspenders so a stray config edit can't silently make the pre-launch artifact public.

package/docs/adr/0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md

@@ -120,9 +120,11 @@ benefit. It gains one when ADR 0099's mirror lands.
 - **Publishing is the owner's action, not a builder's.** It is the owner's npm account, and a
   public package name cannot be un-taken. The build stops at a packed tarball and hands over one
   `npm publish --access public`.
-- `@bongos/client` stays private and is **vendored** as a single file rather than declared as a
-  dependency — a public package that depended on a private one would be uninstallable for
-  everyone.
+- `@bongos/client` is **vendored** as a single file rather than declared as a dependency — a public
+  package that depended on a private one would be uninstallable for everyone. (It was private then;
+  since [task 1003742](https://cloudbongos.com/builders#/task/1003742) it is not published at all,
+  which makes the vendoring not merely preferable but the only option. Vendoring was the right call
+  either way, and this package is one of the two reasons the client had no consumers to lose.)
 - Task 1002025 is superseded and should be closed against this ADR rather than done.
 - **The journey above is instance-dependent, and 0.1.1 shipped assuming it was not**
   ([task 1003730](https://cloudbongos.com/builders#/task/1003730)). `bongos shell` is the answer

package/docs/adr/README.md

@@ -208,7 +208,7 @@ This keeps the decision history honest and traceable.
 | 0131 | [Rank-scoped skill visibility — feasibility spike (task [#1650](https://example.com/builders#/task/1650)). Wanted: a session lists only the skills the builder's rank can use, via a SessionStart hook filtering the skill menu — pure UX declutter (the server rank gate + each skill's early self-check still enforce). Finding: Claude Code hooks CANNOT filter/hide/rewrite the skill listing — SessionStart offers only `additionalContext` (inject text) + `reloadSkills` (add-only), no hook subtracts a skill, and hooks can't mutate settings at runtime. A HARD menu hide needs a pre-launch step (the launcher that already fetches rank) writing per-builder `skillOverrides:"off"` into `.claude/settings.local.json` before `claude` starts (misses plugin skills; workspace-trust-gated). Recommendation: don't build the heavy launcher change for a cosmetic gain; if some declutter is wanted now, use the existing hook's `additionalContext` as a soft nudge; keep the server gate + self-checks. Owner to decide.](<redacted>.md) | dx / skills |
 | 0132 | [Migrate the co-hosting fleet to the control plane over an SSH DB tunnel (task [#2071](https://example.com/builders#/task/2071), BONGOS-V1, goal 26; extends ADR 0130, completes 2065 / blocker 64). Stripping the co-hosting box's tokens proved NOT a switch-flip: it runs FIVE token-consuming timers (the 4 `box.js` dev-box lifecycle sweeps + `provision-intent-runner`), each reading its queue from the box's LOCAL `example` Postgres (firewalled to localhost) — so a control-plane runner can't reach the queues, and ADR 0130 moved only box-step execution, not queue reading. Also `box.js` was never migrated. Decision: a persistent SSH tunnel (control-plane `127.0.0.1:5433` → co-hosting `127.0.0.1:5432`, `infra/cohost-db-tunnel.service`) + all five runners re-homed as `cohost-*` control-plane variants reading the example queues via `DATABASE_URL` through the tunnel (no public Postgres exposure), calling DO/CF with the control-plane tokens; provisioning remote-execs box steps per ADR 0130. DB auth: a scram password on the EXISTING `lars` role (identical privileges the runners already use; reachable only via `127.0.0.1`), stored only in chmod-600 `/etc/cloudbongos/cohost-fleet.env`. `box.js` unchanged (pure DO/CF API + Discord/DNS-hook execs, all on the control plane). `cohost-provision-intent-runner.*` supersedes 2065's `provision-intent-runner-cloudbongos.*`. Rejected: exposing Postgres over the VPC (opens a TCP surface + `pg_hba`/cred work; droplets not guaranteed same-VPC); a token-signing broker on the co-hosting box (leaves tokens' blast radius there — opposite of the goal); moving the queue tables to the cloudbongos DB (the OTB web tier can't reach it either — firewall symmetry). Units ship additive + not-enabled, self-healed install-only. Activation (SSH trust · DB password · tunnel · enable `cohost-*` + disable co-hosting timers same window · verify via drift-reconcile · bake · owner token rotate+strip · drop rollback DB) is a sequenced operator-op.](<redacted>.md) | infra / Cloud Bongos |
 | 0133 | [One-click GitHub sign-in for onboarding via the GitHub App Manifest flow (task [#2080](https://example.com/builders#/task/2080), BONGOS-V1, goal 35 / criterion 165). The last onboarding friction was wiring GitHub sign-in — the owner had to hand-create an OAuth App + paste a client secret, unscriptable because GitHub has NO create-OAuth-App API. Decision: use GitHub's App **Manifest** flow. The signed-in owner clicks one pre-filled link; GitHub creates the App and returns a temporary `code`; the control-plane runner (`provision.js`, sole token-holder) exchanges it for `client_id`/`client_secret`, writes them to `/etc/<slug>/web.env` (the `oauth-secret.js` path), restarts, and verifies `/healthz` auth_configured — the secret never touches the browser, chat, or web tier. Spans the trust boundary: web tier mints a one-time `state` + stores a `provisioning_oauth_manifests` row + a PUBLIC callback stores GitHub's code (`state` is the auth); the control-plane runner drains `code_received` rows on its existing timer tick (gated on instance=active). Sign-in code unchanged — a GitHub App's user token hits the same `GET /user`; GitHub ignores the extra `scope` for Apps. Back-compat: existing OAuth-app instances untouched; manifest is the new default, manual path kept as fallback. All three onboarding surfaces (hall wizard one-click button, `bongos onboard`, `/new-project`) updated in lockstep.](<redacted>.md) | onboarding / auth |
-| 0134 | [Private-first npm distribution for the core + client (task [#2089](https://example.com/builders#/task/2089), BONGOS-V1, goal 35 / criterion 165; refines [#2025](https://example.com/builders#/task/2025), builds on ADR 0108). Owner wants the npm/CLI onboarding commands ready but private pre-launch, choosing paid private npm over free GitHub Packages. npm rule forces the shape: unscoped names are always public, only SCOPED packages can be private (paid plan) — so the private form stays scoped `@bongos/core` + `@bongos/client` (zero rename; org already owned). Decision: publish both as scoped PRIVATE packages now via `publishConfig:{access:"restricted"}` baked into the synthesized core `package.json` (`package-core.js buildPackageJson`) + the generated client `package.json` (`gen-api-client.js`); `package-core.js --publish` dry-runs by default, real publish needs `--publish --live` + owner `npm login` (tooling holds no token). Consumers auth via env-fed `.npmrc` `_authToken=<redacted> Vendored-tarball install (task 2053) stays the working default; provision/init registry auto-pull is a follow-up. Going public at launch is one flag (`npm access public`) or task 2025's unscoped vanity `cloudbongos` — 2025 becomes the go-public step, not superseded. The daily `bongos` command is name-independent throughout. Runbook: docs/recipes/private-npm-distribution.md.](<redacted>.md) | distribution / npm |
+| 0134 | [Private-first npm distribution for the core + client (task [#2089](https://example.com/builders#/task/2089), BONGOS-V1, goal 35 / criterion 165; refines [#2025](https://example.com/builders#/task/2025), builds on ADR 0108). Owner wants the npm/CLI onboarding commands ready but private pre-launch, choosing paid private npm over free GitHub Packages. npm rule forces the shape: unscoped names are always public, only SCOPED packages can be private (paid plan) — so the private form stays scoped `@bongos/core` + `@bongos/client` (zero rename; org already owned). Decision: publish both as scoped PRIVATE packages now via `publishConfig:{access:"restricted"}` baked into the synthesized core `package.json` (`package-core.js buildPackageJson`) + the generated client `package.json` (`gen-api-client.js`); `package-core.js --publish` dry-runs by default, real publish needs `--publish --live` + owner `npm login` (tooling holds no token). Consumers auth via env-fed `.npmrc` `_authToken=<redacted> Vendored-tarball install (task 2053) stays the working default; provision/init registry auto-pull is a follow-up. Going public at launch is one flag (`npm access public`) or task 2025's unscoped vanity `cloudbongos` — 2025 becomes the go-public step, not superseded. The daily `bongos` command is name-independent throughout. Runbook: docs/recipes/private-npm-distribution.md. **CLIENT HALF SUPERSEDED** ([task 1003742](https://cloudbongos.com/builders#/task/1003742), 2026-09-09): `@bongos/client` is not an npm package at all — published once at 0.0.2 on 2026-07-07, never updated while the API moved 500+ core versions, and ZERO consumers the whole time (no package.json in the core or any instance repo ever declared it; every consumer vendors a copy, and `@cloudbongos/cli` could not have depended on a private package anyway). Removed from the registry; the generator no longer emits a `publishConfig` and its README documents vendoring. The generated artifact stays (ADR 0118). Core half unaffected.](<redacted>.md) | distribution / npm |
 | 0135 | [Module upstream submission: the review queue lives in the submitting instance's own DB, interim (task [#1770](https://example.com/builders#/task/1770), BONGOS-V1, builds on ADR 0107). ADR 0107 §1 says `bongos module submit` files a packaged module into a rank-gated review queue "on the core" — but the extracted core (`github.com/example-owner/cloud-bongos`) is a private GIT REPO, not a running service (no HTTP API), and per ADR 0100 §3 each project runs its OWN GDS DB, so there is no shared cross-repo queue to file into; R85 (the forcing-function second consumer) was also abandoned. Decision: the queue is a table (`module_submissions`, migration `<redacted>.sql`) in THIS instance's own Bongos DB. `bongos module submit <key>` and the hall's submit button both call the SAME route, `POST /modules/:key/submit` (metic+archon), which re-runs the ADR 0107 §4 pre-check against its OWN on-disk copy (authoritative — a local CLI pass is a courtesy) and refuses without a sign-off; `GET /modules/submissions` lists the queue for task 1771 (core-side review & accept, still backlog) to read from. Rejected: a live call to a not-yet-built core endpoint (guesses at 1771's contract); a GitHub Issue/PR against the private core repo (loses the structured queue, no standing credential); a dry-run-only local-file client mirroring do-api.js (a worse queue than a DB table this instance already operates). Forward-compatible: when a real core endpoint exists, filing becomes a network hop with no change to the CLI/UI contract.](<redacted>.md) | modules / upstreaming |
 | 0136 | [Update-channel subscription policy (task [#2150](https://example.com/builders#/task/2150), BONGOS-V1, goal 26; completes the update-consumption workstream on ADR 0100 §2 + ADR 0134 + task 2149). Answers "how do projects subscribe to regular @bongos/core updates?" with the owner-chosen policy: **patch-only by default, health-gated with auto-rollback, opt-in, autonomy-gated.** Per-instance `update_channel` = `pinned` (never) / `patch` (higher z within x.y — DEFAULT) / `minor` (higher y within the major); a MAJOR is never automatic, prereleases never auto-targeted — the pure math is `scripts/gds/update-channel.js` (`resolveChannelTarget`), unit-tested in `tests/update_channel.mjs`. The registry (npm view, ADR 0134) is the "what's newest" source. A new `mode:deterministic` instance-wide routine `core-update-subscription` reads the opt-in roster `config/update-subscriptions.json` (ships EMPTY) and runs `bongos upgrade --to <v> --registry` per subscribed instance with auto-rollback ON (task 2149). Triple-gated: autonomy flag OFF by default (ADR 0115) + empty roster + health-gated. Upstream auto-publish (whether main merges auto-publish a patch) is deliberately SPLIT to its own follow-up task, so goal 26 closes on the consumption half; the subscription just consumes whatever the owner publishes. Scope is local same-host instances; multi-host fleet orchestration is the deferred fleet-control-plane epic (task 1948). Rejected: a `provisioning_instances` DB column (presumes the still-unbuilt fleet-registry schema; a config manifest is migration-free + ADR-0115-shaped), minor-by-default (less conservative), deciding auto-publish here (orthogonal, would block consumption).](<redacted>.md) | distribution / updates |
 | 0137 | [Upstream publish policy: `@bongos/core` patches are published MANUALLY (owner-gated), NOT auto-published on merge (task [#2158](https://example.com/builders#/task/2158), BONGOS-V1, goal 26; the SUPPLY half split out of ADR 0136 §5 / task 2150, builds on ADR 0134). Owner chose manual over auto. Decision: the owner runs `package-core.js --publish --live` to cut a release (optional `core-v<version>` git tag as the auditable marker — triggers no CI); `CORE_VERSION` (src/module-api.js) is bumped by hand in-task with a changelog line (provenance stays in git, not a release-tool side effect); NO npm write-token at rest (preserves ADR 0134 tokenless tooling — owner auths at publish time; only the read token exists); the no-leak/mirror-redact gate is already fail-closed inside `package-core.js`, so `--publish` cannot upload a leaking artifact. The ADR 0136 subscription consumes whatever is published; freshness is owner-paced by design. Rejected: auto-publish-on-merge (needs a standing npm write-token as a CI secret — reverses the tokenless posture for little gain at low, deliberate release volume). Revisit as a tag-triggered CI publish when the managed-fleet epic (task 1948) makes the manual step a real bottleneck. Ritual: docs/recipes/private-npm-distribution.md "Cutting a core release".](<redacted>.md) | distribution / npm |

package/docs/module-api-changelog.md

@@ -1689,5 +1689,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.618 with no explicit bump. run 34320024204. (task 1002620)
   1.19.620 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.619 with no explicit bump. run 34321089991. (task 1002620)
+  1.19.621 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.620 with no explicit bump. run 34321546662. (task 1002620)
+  1.19.622 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.621 with no explicit bump. run 34322091367. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/private-npm-distribution.md

@@ -1,8 +1,10 @@
-# Recipe — private-first npm distribution (core + client)
+# Recipe — private-first npm distribution (the core)
 
 > **This is one leg of three.** For the whole path from a change on core `main` to a live instance — and for when publishing to npm is *not* what moves an instance — start at [the core release pipeline](core-release-pipeline.md).
 >
-> Implements [ADR 0134](../adr/<redacted>.md). Pre-launch, `@bongos/core` and `@bongos/client` publish as **private, scoped** npm packages on the owner's paid `bongos` npm org (the canonical brand); at launch they flip to public. The daily command is `bongos` regardless of package name.
+> Implements [ADR 0134](../adr/<redacted>.md), **core half only**. Pre-launch, `@bongos/core` publishes as a **private, scoped** npm package on the owner's paid `bongos` npm org (the canonical brand); at launch it flips to public. The daily command is `bongos` regardless of package name.
+>
+> **`@bongos/client` is no longer part of this.** It was published once (2026-07-07, 0.0.2), never updated while the API moved 500+ core versions, and had **zero** consumers the whole time — every consumer vendors a copy instead. The owner removed it from npm on 2026-09-09; ADR 0134's client half is superseded ([task 1003742](https://cloudbongos.com/builders#/task/1003742)). The generated client still exists and still regenerates — it is simply not a package.
 >
 > **Why private must be scoped:** on npm, *unscoped* names are always public — only *scoped* names (`@bongos/…`) can be private, and only on a paid plan. So the packages publish under the `@bongos` scope, which maps to the paid `bongos` org.
 
@@ -11,9 +13,10 @@
 | Package | What it is | Built by |
 |---|---|---|
 | `@bongos/core` | the platform an instance installs + the `bongos` CLI (`bin`) | `bongos package-core` (`scripts/gds/package-core.js`) — synthesizes the package.json + a pruned lockfile, redacts, and packs a `.tgz` |
-| `@bongos/client` | the generated typed API client | `node scripts/gds/gen-api-client.js` (regenerates `clients/bongos-client/`) |
 
-Both carry `publishConfig: { access: "restricted" }`, so **publishing them is private by default** — no public leak if a flag is forgotten.
+`@bongos/core` carries `publishConfig: { access: "restricted" }`, so **publishing it is private by default** — no public leak if a flag is forgotten.
+
+The generated typed client (`node scripts/gds/gen-api-client.js` → `clients/bongos-client/`) is deliberately **not** in this table: it is not published, carries no `publishConfig`, and is consumed by vendoring. See its own README.
 
 ## One-time owner setup (only the owner can do these)
 
@@ -80,9 +83,10 @@ Then, with `NPM_TOKEN` set in the environment:
 
 ```sh
 npm install -g @bongos/core   # global → the `bongos` command, then `bongos init`
-npm install @bongos/client    # in a project that calls the API
 ```
 
+(A project that calls the API vendors the generated client instead — it is not installable.)
+
 Without a valid token + org membership the install 404s — that is the private gate working.
 
 ## Provisioning: registry pull vs vendored tarball (task 2090)
@@ -104,7 +108,6 @@ Pick either — both keep the daily `bongos` command working:
 - **Flip the same scoped packages public** (simplest):
   ```sh
   npm access public @bongos/core
-  npm access public @bongos/client
   ```
   (Or change `publishConfig.access` to `"public"` and republish.) Public installs need no token; the paid seats can be dropped.
 - **Also publish the unscoped vanity name** for `npm install -g cloudbongos` — that is [task 2025](https://example.com/builders#/task/2025) (rename in `package-core.js`/`upgrade.js` + docs), done at launch.

package/modules/lifecycle/db-tasks.js

@@ -855,11 +855,22 @@ function taskTouchesProtectedPath(task) {
 // and rank them.
 //
 // Ranking key (most relevant first):
-//   1. priority DESC          — a P5 in another lane still beats a P1
+//   1. priority ASC, unset last — 1 is the MOST urgent. This is the DB's own
+//      convention: CHECK (priority BETWEEN 1 AND 5), and every version-progress
+//      view weights work as 6 - COALESCE(priority, 5), so a lower number earns
+//      more weight. It is the same order the SQL feeds use — `priority ASC
+//      NULLS LAST` in the optimizer, `priority NULLS LAST` in listTasks and the
+//      goal rollup. A task with no priority set ranks after an explicit P5,
+//      never ahead of a P1.
 //   2. credits-per-minute DESC — best bang-for-effort among equal priority
 //   3. est_minutes ASC         — shorter wins the tiebreak (easier to try)
 //   4. id ASC                  — stable final tiebreak
 //
+// scripts/gds/start.js keeps a hand-copied mirror of this function (it is a
+// pure HTTP client and cannot import this module). The two are a documented
+// mirror pair: tests/cross_discipline_priority_direction.mjs executes BOTH and
+// fails if either drifts. Change one, change the other.
+//
 // 'unclassified' tasks are excluded: they're un-triaged, not a real lane to
 // recommend exploring. If preferred_disciplines is empty (no preference), the
 // builder already sees everything in the main list, so there is nothing
@@ -876,13 +887,22 @@ function rankCrossDisciplineRecommendations(claimable, preferredDisciplines, lim
     const mins = Number(t.est_minutes_calibrated ?? t.est_minutes) || 0;
     return mins > 0 ? credits / mins : 0;
   };
+  // `ASC NULLS LAST` expressed in JS: an absent, blank or non-numeric priority
+  // sorts AFTER every explicit 1..5. Deliberately not `Number(t.priority) || 0`
+  // — that maps NULL to 0, which under an ascending sort is more urgent than a
+  // P1. Infinity is the only value that keeps unset work at the back.
+  const prio = (t) => {
+    if (t.priority === null || t.priority === undefined || t.priority === '') return Infinity;
+    const n = Number(t.priority);
+    return Number.isFinite(n) ? n : Infinity;
+  };
   const outside = rows.filter(
     (t) => t.discipline && t.discipline !== 'unclassified' && !prefSet.has(t.discipline)
   );
   outside.sort((a, b) => {
-    const pa = Number(a.priority) || 0;
-    const pb = Number(b.priority) || 0;
-    if (pb !== pa) return pb - pa; // higher priority first
+    const pa = prio(a);
+    const pb = prio(b);
+    if (pa !== pb) return pa - pb; // lower number = more urgent; unset last
     const ca = cpm(a);
     const cb = cpm(b);
     if (cb !== ca) return cb - ca; // higher credits/min first

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.620",
+  "version": "1.19.622",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.620",
+      "version": "1.19.622",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.620",
+  "version": "1.19.622",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/build-cli-package.js

@@ -87,11 +87,12 @@ const FILES = [
   'src/bongos/api-prefix.js',
 
   // The generated typed API client (ADR 0118), which cli-lib.js reaches by a dynamic
-  // `import()` of this exact path. Vendored as a single file rather than depended on: it is
-  // published as `@bongos/client`, which is PRIVATE, so a public package that declared it as a
-  // dependency would be uninstallable for everyone. index.mjs is self-contained and imports
-  // nothing; the sibling package.json is deliberately NOT shipped (it carries
-  // publishConfig.access=restricted and a nested manifest only confuses packing).
+  // `import()` of this exact path. Vendored as a single file rather than depended on: it is not
+  // published to npm at all (task 1003742 — it was private, had zero consumers, and was removed),
+  // so there is nothing to declare a dependency ON. Vendoring was already the right call while it
+  // was merely private, since a public package cannot depend on a private one. index.mjs is
+  // self-contained and imports nothing; the sibling package.json is deliberately NOT shipped —
+  // a nested manifest only confuses packing.
   'clients/bongos-client/index.mjs',
 
   // Neutral branding defaults, so the CLI has sane strings with no instance checkout present.

package/scripts/gds/gen-api-client.js

@@ -10,8 +10,9 @@
 //
 // Design (mirrors gen-api-docs.js / ADR 0063): deterministic (stable sort, no
 // clock), zero runtime deps, --check gate. The client itself has ZERO deps — it
-// uses the platform `fetch` (Node 18+ / browsers), so `npm i @bongos/client`
-// pulls nothing transitive.
+// uses the platform `fetch` (Node 18+ / browsers), so vendoring it pulls nothing
+// transitive. It is NOT published to npm (task 1003742) — consumers copy the build
+// they need; see the generated README.
 //
 // Usage:
 //   node scripts/gds/gen-api-client.js          # (re)generate the client package
@@ -372,10 +373,17 @@ function renderPackageJson(spec) {
     },
     files: ['index.mjs', 'index.cjs', 'index.d.ts', 'bongos-client.global.js', 'README.md'],
     license: 'AGPL-3.0-or-later',
-    // Pre-launch: publish PRIVATE (task 2089 / ADR 0134). Scoped + access:"restricted"
-    // = only paid-org members can install. Flip to "public" (or `npm access public
-    // @bongos/client`) at launch, alongside the core.
-    publishConfig: { access: 'restricted' },
+    // NO publishConfig — this client is NOT an npm package (task 1003742).
+    //
+    // It was published once, 2026-07-07 at 0.0.2, under ADR 0134's private-first plan, and never
+    // updated while the API it is generated FROM moved 500+ core versions. It had zero consumers
+    // the whole time: nothing across the core or any instance repo ever declared it as a
+    // dependency — every consumer VENDORS a copy instead (modules/dev-box/app/src/vendor/, and
+    // build-cli-package.js into @cloudbongos/cli, which could not depend on it anyway). The owner
+    // removed it from the registry on 2026-09-09.
+    //
+    // The manifest itself stays: `main`/`types`/`exports` are what make the vendored copy and a
+    // workspace link resolve. Declaring a publish posture is the part that was fiction.
     sideEffects: false,
   }, null, 2) + '\n';
 }
@@ -427,14 +435,26 @@ function renderReadme(spec, ops) {
     `- API version: **${spec['x-api-version'] || 'v1'}** (served at \`${base}\`)`,
     `- ${ops.length} operations across ${new Set(ops.map((o) => o.tag)).size} resource groups`,
     ``,
-    `## Install`,
+    `## Use it from your project`,
+    ``,
+    `**This is not an npm package** — it is not published, and nothing depends on it as one`,
+    `(task 1003742). Consume it by VENDORING the build you need, which is what every consumer`,
+    `in this repo already does:`,
     ``,
     '```bash',
-    `npm install @bongos/client   # internal registry / workspace path`,
+    `# ESM / bundler:  cp clients/bongos-client/index.mjs  <your project>/vendor/`,
+    `# CommonJS:       cp clients/bongos-client/index.cjs  <your project>/vendor/`,
+    `# Browser global: cp clients/bongos-client/bongos-client.global.js <your project>/public/`,
     '```',
     ``,
+    `Copy \`index.d.ts\` alongside it for types. Re-copy after \`gen-api-client.js\` runs, so the`,
+    `client cannot drift from the routes.`,
+    ``,
     `## Use`,
     ``,
+    `The examples import by package name, which resolves in a workspace. A VENDORED copy is`,
+    `imported by its path instead — \`from './vendor/index.mjs'\` — everything below is identical.`,
+    ``,
     '```js',
     `import { createClient, ApiError } from '@bongos/client';`,
     ``,

package/scripts/gds/start.js

@@ -45,9 +45,9 @@
 //
 // Below the main list, a "You might enjoy" section surfaces up to 3 claimable
 // tasks OUTSIDE the builder's disciplines, ranked by relevance. The ranking
-// mirrors db.rankCrossDisciplineRecommendations (the canonical server-side
-// home for this logic — kept in sync deliberately; start.js is a pure HTTP
-// client and cannot import the server db module).
+// mirrors rankCrossDisciplineRecommendations in modules/lifecycle/db-tasks.js
+// (the canonical server-side home for this logic — kept in sync deliberately;
+// start.js is a pure HTTP client and cannot import the server db module).
 //
 //
 // Returns JSON if --json is passed (for the slash command to parse cleanly).
@@ -470,12 +470,19 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
 }
 
 // Cross-discipline recommendations — mirror of
-// db.rankCrossDisciplineRecommendations (src/bongos/db.js). Given the full
-// claimable list and the builder's preferred_disciplines, return up to `limit`
-// tasks whose discipline is OUTSIDE the builder's preferences, ranked:
-//   priority DESC, credits/min DESC, est_minutes ASC, id ASC.
+// rankCrossDisciplineRecommendations in modules/lifecycle/db-tasks.js (the
+// canonical copy; it moved there from src/bongos/db.js in the twelve-unit
+// carve). Given the full claimable list and the builder's
+// preferred_disciplines, return up to `limit` tasks whose discipline is OUTSIDE
+// the builder's preferences, ranked:
+//   priority ASC (unset last), credits/min DESC, est_minutes ASC, id ASC.
+// Priority 1 is the MOST urgent — the DB's own convention (CHECK (priority
+// BETWEEN 1 AND 5), weighted 6 - COALESCE(priority, 5)); an unset priority
+// sorts after an explicit P5, never ahead of a P1.
 // 'unclassified' tasks are excluded (un-triaged, not a real lane). Empty
 // preferences → [] (everything is already in the main list; nothing outside).
+// This copy and the canonical one are pinned together by
+// tests/cross_discipline_priority_direction.mjs — change one, change the other.
 function rankCrossDisciplineRecommendations(claimable, preferredDisciplines, limit = 3) {
   const rows = Array.isArray(claimable) ? claimable : [];
   const prefs = Array.isArray(preferredDisciplines) ? preferredDisciplines : [];
@@ -486,13 +493,21 @@ function rankCrossDisciplineRecommendations(claimable, preferredDisciplines, lim
     const mins = Number(t.est_minutes_calibrated ?? t.est_minutes) || 0;
     return mins > 0 ? credits / mins : 0;
   };
+  // `ASC NULLS LAST` in JS — an absent/blank/non-numeric priority sorts after
+  // every explicit 1..5. Not `Number(t.priority) || 0`: that maps NULL to 0,
+  // which under an ascending sort outranks a P1.
+  const prio = (t) => {
+    if (t.priority === null || t.priority === undefined || t.priority === '') return Infinity;
+    const n = Number(t.priority);
+    return Number.isFinite(n) ? n : Infinity;
+  };
   const outside = rows.filter(
     (t) => t.discipline && t.discipline !== 'unclassified' && !prefSet.has(t.discipline)
   );
   outside.sort((a, b) => {
-    const pa = Number(a.priority) || 0;
-    const pb = Number(b.priority) || 0;
-    if (pb !== pa) return pb - pa;
+    const pa = prio(a);
+    const pb = prio(b);
+    if (pa !== pb) return pa - pb;
     const ca = cpm(a);
     const cb = cpm(b);
     if (cb !== ca) return cb - ca;
@@ -973,7 +988,9 @@ async function main() {
 // Only auto-run when invoked directly (`node start.js …`); a `require()` (the
 // unit test) imports the pure render helpers without executing the fetch flow —
 // the claim.js precedent. The owed-rebase warning helpers (ADR 0120 part 5) are
-// exported so they can be unit-tested without a live server.
+// exported so they can be unit-tested without a live server, and so is
+// rankCrossDisciplineRecommendations — the mirror test executes THIS copy
+// alongside the canonical one rather than pattern-matching the source.
 if (require.main === module) {
   main().catch((err) => {
     console.error('fatal:', err);
@@ -982,6 +999,7 @@ if (require.main === module) {
 }
 
 module.exports = {
+  rankCrossDisciplineRecommendations,
   rebaseWarningModel,
   rebaseWarningMarkdown,
   rebaseWarningWidget,

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.620'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.622'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cross_discipline_priority_direction.mjs

@@ -0,0 +1,196 @@
+// tests/cross_discipline_priority_direction.mjs — priority sorts ONE way
+// (task 1003756).
+//
+// tasks.priority is 1..5 with 1 the MOST urgent. The DB says so in two places
+// that cannot drift (the CHECK constraint and the 6 - COALESCE(priority, 5)
+// weighting every version-progress view uses), and every SQL feed orders
+// `priority ASC NULLS LAST`. rankCrossDisciplineRecommendations used to sort
+// the other way and its header comment asserted the inverse as the global rule,
+// so re-ranking a task moved it the wrong direction in /builder-start's
+// "You might enjoy" section.
+//
+// The function has TWO hand-copied implementations — the canonical one in
+// modules/lifecycle/db-tasks.js and a mirror in scripts/gds/start.js, which is
+// a pure HTTP client and cannot import the server module. This test EXECUTES
+// both against the same fixtures and asserts they agree, so the pair cannot
+// drift apart again.
+//
+// Run:  node tests/cross_discipline_priority_direction.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const CANONICAL = require(path.join(ROOT, 'modules/lifecycle/db-tasks.js'))
+  .rankCrossDisciplineRecommendations;
+const MIRROR = require(path.join(ROOT, 'scripts/gds/start.js'))
+  .rankCrossDisciplineRecommendations;
+
+// Both copies, run over the same input. Every behavioural assertion below goes
+// through this so a fix applied to only one file fails the suite.
+const IMPLS = [['db-tasks.js (canonical)', CANONICAL], ['start.js (mirror)', MIRROR]];
+const bothRank = (rows, prefs, limit) => IMPLS.map(([name, fn]) => [name, fn(rows, prefs, limit)]);
+const eachImpl = (rows, prefs, limit, check) => {
+  for (const [name, out] of bothRank(rows, prefs, limit)) check(out, name);
+};
+
+// A claimable row. discipline defaults OUTSIDE the caller's prefs (['engineer'])
+// so the partition step never eats the fixture; credits/minutes are equal by
+// default so priority is the only live sort key unless a test says otherwise.
+const row = (id, priority, extra = {}) => ({
+  id, priority, discipline: 'design', credits_reward: 10, est_minutes: 10, ...extra,
+});
+const PREFS = ['engineer'];
+const ids = (out) => out.map((t) => t.id);
+
+const { test, summary } = makeRunner();
+
+// ---- the direction itself ---------------------------------------------------
+
+await test('P1 outranks P5 — 1 is the most urgent, in BOTH copies', () => {
+  // Input deliberately in the wrong order so a no-op sort cannot pass.
+  const rows = [row('p5', 5), row('p3', 3), row('p1', 1)];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['p1', 'p3', 'p5'],
+      `${name}: ascending — the DB weights work 6 - COALESCE(priority, 5), so P1 earns the most`);
+  });
+});
+
+await test('the limit keeps the MOST urgent, not the least', () => {
+  const rows = [row('p5', 5), row('p4', 4), row('p1', 1), row('p2', 2)];
+  eachImpl(rows, PREFS, 2, (out, name) => {
+    assert.deepEqual(ids(out), ['p1', 'p2'],
+      `${name}: slicing after a backwards sort would surface the two LEAST urgent tasks`);
+  });
+});
+
+// ---- the NULL mapping -------------------------------------------------------
+// The old code read priority as `Number(t.priority) || 0`. Under the old DESC
+// sort that put unset work last by accident; under the corrected ASC sort the
+// same expression would rank it 0 — ahead of every P1. These pin the explicit
+// handling that replaced it.
+
+await test('an unset priority sorts LAST, not first (the || 0 trap)', () => {
+  for (const blank of [null, undefined, '']) {
+    const rows = [row('blank', blank), row('p1', 1), row('p5', 5)];
+    eachImpl(rows, PREFS, 10, (out, name) => {
+      assert.deepEqual(ids(out), ['p1', 'p5', 'blank'],
+        `${name}: priority=${JSON.stringify(blank)} must rank after an explicit P5`);
+    });
+  }
+});
+
+await test('a non-numeric priority is treated as unset, not as 0', () => {
+  const rows = [row('junk', 'urgent'), row('p5', 5)];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['p5', 'junk'], `${name}: NaN must not outrank a real priority`);
+  });
+});
+
+await test('a numeric string priority still sorts as its number', () => {
+  const rows = [row('five', '5'), row('one', '1')];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['one', 'five'], `${name}: the API can hand back stringified integers`);
+  });
+});
+
+// ---- the rest of the ranking key, so fixing direction did not disturb it ----
+
+await test('credits-per-minute DESC breaks a priority tie', () => {
+  const rows = [
+    row('cheap', 2, { credits_reward: 10, est_minutes: 100 }),
+    row('rich', 2, { credits_reward: 100, est_minutes: 10 }),
+  ];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['rich', 'cheap'], `${name}: best bang-for-effort first`);
+  });
+});
+
+await test('shorter est_minutes, then id, break the remaining ties', () => {
+  const rows = [
+    row('long', 2, { credits_reward: 10, est_minutes: 10 }),
+    row('short', 2, { credits_reward: 5, est_minutes: 5 }),
+  ];
+  // Equal credits/min (1.0), so est_minutes decides.
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['short', 'long'], `${name}: shorter is easier to try`);
+  });
+  const tied = [row(9, 2), row(3, 2)];
+  eachImpl(tied, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), [3, 9], `${name}: id ASC is the stable final tiebreak`);
+  });
+});
+
+await test('partitioning is unchanged: outside-prefs only, no unclassified, empty prefs → []', () => {
+  const rows = [
+    row('mine', 1, { discipline: 'engineer' }),
+    row('untriaged', 1, { discipline: 'unclassified' }),
+    row('theirs', 4, { discipline: 'design' }),
+  ];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['theirs'], `${name}: only lanes outside the builder's prefs`);
+  });
+  eachImpl(rows, [], 10, (out, name) => {
+    assert.deepEqual(out, [], `${name}: no stated preference → nothing is "outside"`);
+  });
+});
+
+await test('the two copies agree row-for-row on a mixed corpus', () => {
+  const disciplines = ['design', 'ops', 'research', 'engineer', 'unclassified'];
+  const priorities = [1, 2, 3, 4, 5, null, undefined, '', '2', 'junk'];
+  const rows = [];
+  for (let i = 0; i < 60; i++) {
+    rows.push(row(i, priorities[i % priorities.length], {
+      discipline: disciplines[i % disciplines.length],
+      credits_reward: (i % 7) * 5,
+      est_minutes: (i % 4) * 15,
+    }));
+  }
+  const [[, fromCanonical], [, fromMirror]] = bothRank(rows, ['engineer'], 25);
+  assert.ok(fromCanonical.length > 5, 'fixture must actually exercise the ranking');
+  assert.deepEqual(ids(fromMirror), ids(fromCanonical),
+    'start.js is a hand-copied mirror — it must produce the identical order');
+});
+
+// ---- the convention this direction is anchored to ---------------------------
+// If someone ever inverts the DB's meaning of priority, these fail and force the
+// behavioural assertions above to be reconsidered rather than silently re-flipped.
+
+await test('the DB still says 1 is most urgent (CHECK + the 6 - COALESCE weighting)', () => {
+  const schema = read('migrations/003_pms.sql');
+  assert.match(schema, /priority\s+integer\s+CHECK \(priority BETWEEN 1 AND 5\)/,
+    'priority is a 1..5 integer');
+  assert.match(schema, /6 - COALESCE\(t\.priority, 5\)/,
+    'progress weighting subtracts from 6, so a LOWER priority number earns MORE weight');
+  assert.match(read('src/bongos/optimizer.js'), /priority ASC NULLS LAST/,
+    'the optimizer — the closest analogue to this recommender — orders ascending');
+});
+
+await test('neither copy claims priority DESC, and the mirror pointer resolves', () => {
+  const canonicalSrc = read('modules/lifecycle/db-tasks.js');
+  const mirrorSrc = read('scripts/gds/start.js');
+  for (const [name, src] of [['db-tasks.js', canonicalSrc], ['start.js', mirrorSrc]]) {
+    assert.ok(!/priority DESC/.test(src), `${name}: no comment may assert priority DESC`);
+  }
+  // The canonical home moved out of src/bongos/db.js in the twelve-unit carve;
+  // start.js pointed at the old address long after the function had left it.
+  assert.ok(
+    !/rankCrossDisciplineRecommendations \(src\/bongos\/db\.js\)/.test(mirrorSrc)
+      && !/db\.rankCrossDisciplineRecommendations/.test(mirrorSrc),
+    'start.js must name modules/lifecycle/db-tasks.js as the canonical home'
+  );
+  assert.match(mirrorSrc, /modules\/lifecycle\/db-tasks\.js/,
+    'the mirror names where the canonical copy actually lives');
+  assert.ok(
+    !/rankCrossDisciplineRecommendations/.test(read('src/bongos/db.js')),
+    'src/bongos/db.js really does not define it — the old pointer was dangling'
+  );
+});
+
+summary();