@bongos/core 1.19.693 → 1.19.694

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.693",
-  "core_contract": "1.19.693",
-  "source_commit": "64897221c9ad47833068dacf7644c0261cbc526b",
+  "core_version": "1.19.694",
+  "core_contract": "1.19.694",
+  "source_commit": "7cd0b705f047458dfa2038bd842adee75333a643",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T01:48:28.390Z",
+  "built_at": "2026-09-13T01:54:36.629Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2628,
-  "tree_sha256": "8d4afe14f879514c8da9a3f8309944b8d40be680675f2a22a0d6a70d69cb64a8",
+  "tree_sha256": "0ab80bfe776899e5734f702ca69263e38455dae234ba01b3d422d6ef131e6c49",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1387,7 +1387,7 @@
     {
       "path": "docs/adr/0177-goal-membership-kind.md",
       "mode": "0000644",
-      "sha256": "922dc12e699d3631907292e0a5550806ac88a160394c65c8223f65e58a46bc6f"
+      "sha256": "d1005ba9359abceca6481a5e25b39579169fe7f63a87769f4cfd450419755343"
     },
     {
       "path": "docs/adr/0178-the-copy-desk-flag-and-queue.md",
@@ -1467,7 +1467,7 @@
     {
       "path": "docs/adr/0191-majority-and-the-author-who-may-not-decide-alone.md",
       "mode": "0000644",
-      "sha256": "0ae7f6a69d9006c54210cea4f6a846445a6181f148bcb4de979011b46cca5188"
+      "sha256": "ffdf5efeddb55e4e4378a67e2d06fe3038074b9c0afc90ef8e69214a381c3e58"
     },
     {
       "path": "docs/adr/0192-a-category-orients-and-authorises-nothing.md",
@@ -1762,7 +1762,7 @@
     {
       "path": "docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md",
       "mode": "0000644",
-      "sha256": "da4549c19609d1f549e6f5a57b530c330765f1778f0a9b09a15a208f4575f986"
+      "sha256": "13b4d7c6e33ad7e2be2b57ac7805bc4ae5dcdf34f9063aa799ef456f59d50e6a"
     },
     {
       "path": "docs/adr/0251-a-suggestion-of-who-to-invite-is-a-recruiting-surface-and-owes-the-opt-out.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f7893e7defc9a2b255d4c3377037279fbc74ddd0900ca84eb23a9ff8d5fc8c5d"
+      "sha256": "578d0d708917e956889cfbd990258b1cda804052474f07087d9af589f387425e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "37f563e1f70d64e638bb3ea45f7808f53a0f5a405c81f78ff9f818f75122f19f"
+      "sha256": "929bc69d15f44bc6648df7b2f3a9e22d72501486ae2abb9b0491cfcfabbd6683"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "059bbd9276dad23f7d647e3a93d5886abaaf7415c6056cffce375153bce2d8f7"
+      "sha256": "cc0356495a5cf8f4822c0e6efff4b17ef7a1dcd69da2f724a5089b99be71aea7"
     },
     {
       "path": "public-docs/index.html",
@@ -8187,7 +8187,7 @@
     {
       "path": "scripts/gds/docs-entropy.js",
       "mode": "0000644",
-      "sha256": "a4357b36e7e005895021f55db27f83d40e7fded3534ed9ee3d50162945e2cea7"
+      "sha256": "06608b947a6593f7e7385eee68ab011015480418254373cab8e3d557643857c1"
     },
     {
       "path": "scripts/gds/doctor.js",
@@ -8417,7 +8417,7 @@
     {
       "path": "scripts/gds/linkify-refs.js",
       "mode": "0000644",
-      "sha256": "7f24e01984e5f010eaad1f572d9e29cc1c62747bd15ff73c202d3febcd23cf2a"
+      "sha256": "1eecbbc7a090450f01129335b710f984b5eac1c20271247f03f7cc98e62c697e"
     },
     {
       "path": "scripts/gds/lint-infra-exec.js",
@@ -9552,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bfab1f6315f23c5d1d0ec1e97b4c90ac8f2fa0ce632c39ac15473209076df0fb"
+      "sha256": "60f2d47936df6dee6b06ea525d1a6d397d563ed6ee3e052b566936b6e5515af8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11527,7 +11527,7 @@
     {
       "path": "tests/linkify_refs.mjs",
       "mode": "0000644",
-      "sha256": "4a78d21f4f27443bc923bd4b4b114198702e6ccb4e4cd3c2df61c906f405c4c2"
+      "sha256": "ba5164ec77b5541b22b50ed7611dfbbe61731f62b3dfbb678f7de4f77282e918"
     },
     {
       "path": "tests/live_channel.mjs",
@@ -12822,7 +12822,7 @@
     {
       "path": "tests/stop_refcheck.mjs",
       "mode": "0000644",
-      "sha256": "a95e75e1cd3fe6cb6d48a8a082a8d2339eaae8589e5091fe83d88e6f106cc717"
+      "sha256": "8489e33aa194a414d591e76a0e5d40b5131cab61172771b467469ecb9b9203ba"
     },
     {
       "path": "tests/strand_watch.mjs",

package/docs/adr/0177-goal-membership-kind.md

@@ -101,7 +101,7 @@ that does NOT carry over.**
 
 **Decision 3′ — this rename keeps a compatibility window, and the sender writes BOTH
 spellings.** This is a deliberate, named divergence from decision 3 above *and* from the
-sequence task #1003090 itself prescribed ("the API field renamed with no alias"); the
+sequence task [#1003090](/builders#/task/1003090) itself prescribed ("the API field renamed with no alias"); the
 task wrote that sequence before anyone had looked at who calls the endpoint. Decision 3
 holds wherever every caller ships in one release, which is why it stays the default — and
 it does not hold here. The goal-membership rename could ship without an alias because every
@@ -120,7 +120,7 @@ gates *per instance*). So:
 - the trigger therefore maps **values as well as columns**, in both directions, which
   `core_220`'s did not have to.
 
-**And a trap both triggers share, found by the grader on #1003090.** The INSERT branch has
+**And a trap both triggers share, found by the grader on [#1003090](/builders#/task/1003090).** The INSERT branch has
 to tell "the caller wrote the new column" from "the column's DEFAULT filled it" — and it
 cannot, if the new column has a DEFAULT: **Postgres materializes a column default into
 `NEW` before any BEFORE ROW trigger fires.** With a default in place, an old-release

package/docs/adr/0191-majority-and-the-author-who-may-not-decide-alone.md

@@ -21,7 +21,7 @@ single click.** Two independent facts made that invisible:
    *no ballot at all* — so the Board Room showed nine sittings and no way to vote
    on any of them. From the owner's seat the feature genuinely did not exist.
 2. **Nobody else had been told.** The Discord announcer was the only summons, and
-   it is best-effort by construction. That half is fixed separately in #1003271.
+   it is best-effort by construction. That half is fixed separately in [#1003271](/builders#/task/1003271).
 
 The lesson worth keeping: **a rule enforced by removing the control is
 indistinguishable from a broken feature.** The anti-self rule was correct in
@@ -100,7 +100,7 @@ both sides.
 
 ## 4. The clock is a consequence of majority, not an independent fix
 
-#1003271 was originally scoped to add a sitting clock, because nine items with
+[#1003271](/builders#/task/1003271) was originally scoped to add a sitting clock, because nine items with
 `window_minutes: null` could never lapse. **Implementing that would have destroyed
 the very ideas it was meant to unstick**, and the reason is one line — `tallyOutcome`:
 
@@ -123,7 +123,7 @@ Under majority on a four-member board, **three affirmative votes are needed for
 anything to pass.** That is a real bar, and on a quiet board the honest outcome of
 an idea nobody engages with is now *returned* rather than silently ratified. That
 is the point of the owner's choice — but it means a generous window and a working
-summons (#1003271) are load-bearing, not cosmetic. A majority board with no
+summons ([#1003271](/builders#/task/1003271)) are load-bearing, not cosmetic. A majority board with no
 summons would return everything.
 
 **A solo instance still cannot ratify its own ideas.** One member who is also the
@@ -138,5 +138,5 @@ wider, not a bootstrap exception.
 
 Voting stays hall-only. ADR 0175 §8's argument is untouched by anything here: an
 objection must carry a reason and name the section it faults, and a reaction cannot
-express that. The owner re-affirmed this on 2026-08-25 when asked directly. #1003271
+express that. The owner re-affirmed this on 2026-08-25 when asked directly. [#1003271](/builders#/task/1003271)
 improves the *notification* and leaves the ballot where it is.

package/docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md

@@ -2,7 +2,7 @@
 
 - **Status:** Accepted
 - **Date:** 2026-09-06
-- **Tasks:** [#1003589](https://cloudbongos.com/builders#/task/1003589) (this decision), seeded by the planning session [#1003586](https://cloudbongos.com/builders#/task/1003586). The implementation is BV1.R03–R30 under the same goal.
+- **Tasks:** [#1003589](https://cloudbongos.com/builders#/task/1003589) (this decision), seeded by the planning session `#1003586`. The implementation is BV1.R03–R30 under the same goal.
 - **Goal:** [#1000086](https://cloudbongos.com/builders#/goal/1000086) — Strict versioning: a goal cannot outlive its tasks, and a version's goal set is closed.
 - **Builds on:** [ADR 0086](<redacted>.md) (Project → Version → Goal → Criteria → Task — the hierarchy this decision finally closes at the top), [ADR 0015](<redacted>.md) (deps are load-bearing, the rank prefix is decorative), [ADR 0183](<redacted>.md) (a criterion satisfies itself when its tasks ship).
 - **Amends:** [ADR 0157](<redacted>.md) — for one key, `version.create`. See §6.

package/docs/module-api-changelog.md

@@ -1845,5 +1845,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.691 with no explicit bump. run 34730821372. (task 1002620)
   1.19.693 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.692 with no explicit bump. run 34731402927. (task 1002620)
+  1.19.694 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.693 with no explicit bump. run 34731674808. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.693",
+  "version": "1.19.694",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.693",
+      "version": "1.19.694",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.693",
+  "version": "1.19.694",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/docs-entropy.js

@@ -160,6 +160,16 @@ function parseFile(absPath) {
       const href = m[2].trim();
       // Skip external URLs, mailto, and obvious non-paths (e.g. ellipsis placeholders)
       if (/^(https?:|mailto:|ftp:)/.test(href)) continue;
+      // The hall deep-link resolver in its ROOT-RELATIVE form (task 1003542). The
+      // absolute form is already skipped above as external; linkify-refs.js emits
+      // this one whenever the instance origin is absent or loopback — which is now
+      // the normal case on a core checkout, since writing http://localhost:3000 into
+      // a committed doc is the worse bug. It is an APP ROUTE, not a file path, so
+      // counting it as a stale link is a false positive: 28 of them appeared the
+      // moment the linkifier could see this instance's 7-digit ids.
+      // Deliberately NOT a blanket `^/` skip — a genuinely wrong root-relative file
+      // link should still be reported as rot.
+      if (/^\/builders#/.test(href)) continue;
       if (/^\.{2,}$/.test(href)) continue; // skip ... or .. used as placeholders
       links.push({ href, line: lineNo });
     }

package/scripts/gds/linkify-refs.js

@@ -57,12 +57,45 @@ const path = require('node:path');
 // `https://amazonprimea.com`). When branding is unreadable the base is the
 // root-relative '/builders#/…' — never a hardcoded founder host. Reading branding is
 // a sync file read (no network), safe at module scope for this token-free CI gate.
+// A LOOPBACK origin is treated exactly like an unreadable one — root-relative,
+// never written out (task 1003542; the committed-doc half of task 1002975).
+//
+// The header above promises a per-dev localhost override "must never leak into a
+// committed doc link", and the API_BASE half of that holds. But the BRANDING half
+// did not: config/branding.neutral.json — the neutral core's own default, used by
+// every checkout with no instance branding — sets buildersOrigin to
+// http://localhost:3000. So `--apply` on a core checkout rewrote bare refs into
+// http://localhost:3000/builders#/task/N and committed them.
+//
+// That was survivable only while the gate was blind: it matched \d{1,5} and this
+// instance's ids are 7 digits, so --apply found nothing to rewrite. Widening the
+// width in this task ARMS it — the first honest run wanted to rewrite 33 refs
+// across 10 committed docs, ADRs included. Hence this guard lands with the widening
+// rather than after it.
+//
+// Root-relative is the right fallback, not a guess: it is what the catch below
+// already returns, and it resolves correctly on whatever host actually serves the
+// hall — which is more than a baked absolute origin can promise.
+function isLoopbackOrigin(origin) {
+  try {
+    // URL keeps an IPv6 literal in its brackets ('[::1]'), so strip them before
+    // comparing — a caught-by-its-own-test detail, not a hypothetical.
+    const host = new URL(origin).hostname.replace(/^\[|\]$/g, '');
+    return host === 'localhost' || host === '::1' || host === '0.0.0.0'
+      || host.endsWith('.localhost')
+      || /^127\./.test(host); // the whole 127.0.0.0/8 loopback block, not just .0.1
+  } catch (_) {
+    return false; // not a parseable absolute URL → not a loopback origin
+  }
+}
+
 function resolverHallRoot() {
   try {
     const d = (require('../../src/branding').branding().domains) || {};
     const origin = (typeof d.buildersOrigin === 'string' && d.buildersOrigin.trim())
       || (typeof d.publicOrigin === 'string' && d.publicOrigin.trim())
       || '';
+    if (!origin || isLoopbackOrigin(origin)) return '/builders#';
     return `${String(origin).replace(/\/+$/, '')}/builders#`;
   } catch (_) {
     return '/builders#';
@@ -94,8 +127,24 @@ function discoverDocs() {
     }
   };
   for (const root of ['CLAUDE.md', 'README.md', 'docs']) walk(root);
+  // The skip marker matched only the literal "GENERATED FILE" — and NO generator in
+  // this repo writes that (task 1003542). gen-api-docs.js heads both of its outputs
+  // with "GENERATED by scripts/gds/gen-api-docs.js", so docs/api-reference.md and
+  // docs/routes-permissions.md were being linkified despite the rule above: their
+  // rewrites survive exactly until the next regen, and meanwhile ship-check reports
+  // api-docs STALE. Two gates fighting over one file, each correctly.
+  //
+  // Latent until now for the same reason as the loopback leak: the matcher was too
+  // narrow to rewrite anything, so nothing was ever written into a generated file.
+  // Widening it in this task is what surfaced this.
+  //
+  // NOTE docs/copy-inventory.md heads with "**Generated** by" — bolded, so not
+  // contiguous and still unmatched here. Left alone deliberately: it carries no bare
+  // refs today, and inventing a looser pattern risks skipping a hand-authored doc
+  // that merely mentions being generated. Fix its marker at the generator if it ever
+  // grows one.
   return out.filter((rel) =>
-    !/GENERATED FILE/i.test(fs.readFileSync(path.resolve(process.cwd(), rel), 'utf8').slice(0, 200))
+    !/GENERATED (?:FILE|by)\b/i.test(fs.readFileSync(path.resolve(process.cwd(), rel), 'utf8').slice(0, 200))
   );
 }
 
@@ -131,7 +180,27 @@ const LIST_GLUE_RE = /^[\s,–—-]*(?:and|&|\+|or|to|through)?[\s,–—-]*$/i;
 // '/builders#/…', so the mislink-cleanup path still recognizes a link a PRIOR run
 // committed under a DIFFERENT host — the legacy `amazonprimea.com` links, a
 // co-tenant's, or this instance's own — not only the current RESOLVER_BASE host.
-const RESOLVER_LINK_RE = /\[#(\d{1,5})\]\((?:https?:\/\/[^/)\s]+)?\/builders#\/task\/(\d{1,5})\)/g;
+// How many digits a bare "#NNN" may carry — ONE source of truth, because the
+// width had drifted out of date in five places at once (task 1003542).
+//
+// It was {1,5}, a PRE-IMPORT id width. This instance renumbered imported tasks
+// +1,000,000, so every live id is SEVEN digits — and both enforcement points
+// silently stopped enforcing: `linkify-refs.js --check` (the CI gate) passed
+// trivially on a doc containing a bare #1003365, and .claude/hooks/stop-refcheck.js
+// fast-path-exited before it even fetched the allow-list. A guard that matches
+// nothing reports clean, which is indistinguishable from a guard that works.
+//
+// 7 keeps the property {1,5} was chosen for — not over-matching PR-shaped numbers.
+// GitHub PR numbers on this repo are 3 digits, well inside the old range, so the
+// bound was never what separated them; classifyKind's `PR #NNN` left-context test
+// is, and it is untouched here.
+//
+// Exported as the SOURCE STRING, not a RegExp: a /g/ regex carries lastIndex
+// between calls, so a shared instance would skip matches depending on who scanned
+// last. Each site builds its own.
+const REF_DIGITS = '\\d{1,7}';
+
+const RESOLVER_LINK_RE = new RegExp(`\\[#(${REF_DIGITS})\\]\\((?:https?:\\/\\/[^/)\\s]+)?\\/builders#\\/task\\/(${REF_DIGITS})\\)`, 'g');
 
 // Classify a ref by its left context (+ list-glue carry). Returns one of
 // 'github' | 'idea' | 'blocker' | 'entity' | null (null = candidate task ref).
@@ -194,7 +263,7 @@ function unlinkEntitySegment(segment, leftContext, stats) {
 // {tasks, ideas, blockers} Sets. Returns the transformed segment; mutates `stats`.
 function linkifySegment(segment, ids, leftContext, stats) {
   let out = '';
-  const re = /#(\d{1,5})/g;
+  const re = new RegExp(`#(${REF_DIGITS})`, 'g');
   let m;
   let last = 0;
   let prevEnd = 0;        // index in `segment` just past the previous match
@@ -303,7 +372,7 @@ function upgradeLineCodeSpans(line, ids, stats) {
   let prevEnd = 0;
   let hadPrev = false;
   let prevKind = null; // only 'idea' | 'blocker' carry here
-  const re = /`#(\d{1,5})`/g;
+  const re = new RegExp('`#(' + REF_DIGITS + ')`', 'g');
   let m;
   while ((m = re.exec(line)) !== null) {
     const num = m[1];
@@ -496,4 +565,12 @@ module.exports = {
   linkifyText, linkifySegment, unlinkEntitySegment, upgradeLineCodeSpans,
   classifyKind, normalizeIdSets, discoverDocs,
   RESOLVER_BASE, RESOLVER_BASE_IDEA, RESOLVER_BASE_BLOCKER,
+  // task 1003542: the bare-ref digit width, exported so the OTHER enforcement
+  // point (.claude/hooks/stop-refcheck.js) reads it here instead of keeping its
+  // own copy — the drift that let 7-digit ids past both guards at once.
+  REF_DIGITS,
+  // task 1003542: the loopback test behind the resolver base. Exported because
+  // RESOLVER_BASE is computed once at module load, so the DECISION is the only
+  // part a unit test can reach without re-requiring under a mocked branding.
+  isLoopbackOrigin,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.693'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.694'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/linkify_refs.mjs

@@ -13,7 +13,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { linkifyText, RESOLVER_BASE, RESOLVER_BASE_IDEA, RESOLVER_BASE_BLOCKER, discoverDocs } =
+const { linkifyText, RESOLVER_BASE, RESOLVER_BASE_IDEA, RESOLVER_BASE_BLOCKER, discoverDocs, isLoopbackOrigin } =
   require('../scripts/gds/linkify-refs.js');
 
 let passed = 0;
@@ -31,6 +31,44 @@ t('a bare task ref is linkified', () => {
   assert.equal(run('shipped in #475 today'), `shipped in ${link(475)} today`);
 });
 
+// task 1003542: every live id on this instance is SEVEN digits — imported tasks were
+// renumbered +1,000,000 — but the matcher was \d{1,5}, a PRE-IMPORT width. So the
+// --check CI gate passed trivially on a doc containing a bare #1003365: it matched
+// nothing and reported clean, which looks exactly like a gate that works.
+t('a bare SEVEN-digit task ref is linkified — the width every live id here has', () => {
+  const ids = new Set([1003365]);
+  assert.equal(run('the fix landed in #1003365.', ids), `the fix landed in ${link(1003365)}.`);
+});
+
+t('an EIGHT-digit number is still left bare — widening did not become "match anything"', () => {
+  // The bound still exists: a long bare number in prose must not be rewritten into
+  // a resolver link just because it is long.
+  assert.equal(run('the run took 10033650 ms', new Set([1003365])), 'the run took 10033650 ms');
+});
+
+// task 1003542: --apply WRITES these links into committed markdown, so the resolver
+// base must never be a dev origin. config/branding.neutral.json — the neutral core's
+// own default — sets buildersOrigin to http://localhost:3000, so before this guard a
+// core checkout rewrote refs into http://localhost:3000/builders#/task/N. It only
+// stayed hidden because the matcher was too narrow to rewrite anything here; widening
+// it in this task is what made the leak reachable.
+t('a loopback origin is refused as a resolver base (root-relative instead)', () => {
+  for (const o of ['http://localhost:3000', 'https://127.0.0.1:8443', 'http://0.0.0.0:80',
+    'http://[::1]:3000', 'http://app.localhost:3000']) {
+    assert.equal(isLoopbackOrigin(o), true, `${o} must not be written into a committed doc`);
+  }
+});
+
+t('a real instance origin is still used as the resolver base', () => {
+  for (const o of ['https://cloudbongos.com', 'https://hermeslines-marketing.cloudbongos.com']) {
+    assert.equal(isLoopbackOrigin(o), false, `${o} is a real host and must survive`);
+  }
+  // Not a parseable absolute URL — the caller already handles '' / root-relative,
+  // and this must not throw on the way past.
+  assert.equal(isLoopbackOrigin('/builders#'), false);
+  assert.equal(isLoopbackOrigin(''), false);
+});
+
 t('a parenthesized task ref is linkified (these are task refs here, not PRs)', () => {
   assert.equal(run('R01-followup (#308, 2026-05-13)'), `R01-followup (${link(308)}, 2026-05-13)`);
 });

package/tests/stop_refcheck.mjs

@@ -45,11 +45,30 @@ function t(name, fn) {
 
 // 286/526/870 are "real task ids" for this test; 5/84 stand in for ids that may
 // also be a blocker/migration number (entity classification ignores id membership).
-const IDS = new Set([5, 84, 170, 286, 526, 870]);
+const IDS = new Set([5, 84, 170, 286, 526, 870, 1003365]);
 const ev = (s) => evaluate(s, IDS);
 
+// task 1003542: 1003365 is the SEVEN-digit shape every live id on this instance
+// has, after imported tasks were renumbered +1,000,000. Both enforcement points
+// matched only \d{1,5} — a PRE-IMPORT width — so this hook fast-path-exited on
+// REF_RE before it even fetched the allow-list, and the turn-end nudge could
+// never fire for a real id. A guard that matches nothing reports clean, which is
+// indistinguishable from a guard that works, so the width needs a case of its own.
+
 // ---- blocks (a bare ref that would 404 in chat) ----------------------------
 
+t('a bare SEVEN-digit task ref blocks — the width every live id on this instance has', () => {
+  const r = ev('the fix for that landed in #1003365.');
+  assert.equal(r.block, true, 'a 7-digit bare ref must be caught, not fast-path-skipped');
+  assert.ok(r.refs.includes('#1003365'), 'and must be surfaced by its full 7 digits');
+});
+
+t('an EIGHT-digit number is still left alone — widening did not become "match anything"', () => {
+  // The upper bound still exists. Nothing on this instance is 8 digits, and a long
+  // bare number in prose (a timestamp, an amount) must not start blocking turns.
+  assert.equal(ev('the run took 10033650 ms').block, false);
+});
+
 t('a bare task ref blocks', () => {
   const r = ev('So the only genuine C9 code remaining is landing #286.');
   assert.equal(r.block, true);