@bongos/core 1.19.731 → 1.19.733

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.731",
-  "core_contract": "1.19.731",
-  "source_commit": "242d39240bacfa3d1d4c88f6a78ae22248c4cbdd",
+  "core_version": "1.19.733",
+  "core_contract": "1.19.733",
+  "source_commit": "1cf8536fa296cc05a9c0fc2a1cff4667ab628843",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:35:28.869Z",
+  "built_at": "2026-09-13T15:46:24.724Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2101,
+    "functional_verbatim": 2104,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2602,
-  "tree_sha256": "1117799d57ae5cfa87178217b7fec728cc0de76ee02b0caba9abc559f2ecd9fa",
+  "file_count": 2605,
+  "tree_sha256": "df29652d8de78cc03652254e561648215caacb4e49b7c6a73a7eb502d9c2e049",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2482,7 +2482,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a4d5bc973b439bfbf41bd0b7d59b0cdffde6b0b4c18c6b4d1d73731a92736c84"
+      "sha256": "05bbf0c615af2c986b0bad8963870a0420b3f0dee092bbbcbcaf9794c1f607a1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/onboarding/diagrams/04-architecture.mmd",
       "mode": "0000644",
-      "sha256": "4af79f61f5b1871e9c2ffaa4cee703f681516f2720782b4db05b797993e0a293"
+      "sha256": "ee949090b1df91be015dabbcaa175bd2f81f3089714cf5f712ad2b0b053f4714"
     },
     {
       "path": "docs/onboarding/diagrams/05-versioning.mmd",
@@ -4404,6 +4404,11 @@
       "mode": "0000644",
       "sha256": "b651b73c65b0da33284430b430638dbc39b34db43846a05ab431deaabcc44b3b"
     },
+    {
+      "path": "modules/grading/dead-feature-claim.js",
+      "mode": "0000644",
+      "sha256": "907d02d33fd6e593d4bfcc0d9a00a9622ceaf49dd88b0f81b29ff4718d63a3d5"
+    },
     {
       "path": "modules/grading/generated-provenance.js",
       "mode": "0000644",
@@ -4432,7 +4437,7 @@
     {
       "path": "modules/grading/grader-score.js",
       "mode": "0000644",
-      "sha256": "387d518becd0cce38ecb15cb525084bcabfef04c138d6cae3eabaf3d928ddb5d"
+      "sha256": "e361b57dd292492abf8d40ad8935dab8ad619717b9c439d70808b9325d2fcb5e"
     },
     {
       "path": "modules/grading/grader-subagent.js",
@@ -4487,7 +4492,7 @@
     {
       "path": "modules/grading/grader-workers/worker-verdict.js",
       "mode": "0000644",
-      "sha256": "9c3abb069cfdee124b4fd5c521fe1c11b44177f7af941c9ab7bbb2a4a3718bab"
+      "sha256": "52b04b281ddde638cf5a46172ad9d05d7caa8ba57a2d01c2b907b82b8524d4d2"
     },
     {
       "path": "modules/grading/grader.js",
@@ -7512,12 +7517,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7027beb6f7d395889a8876a1f54a1c2c69b992f4a78b0d1a53441b748d018669"
+      "sha256": "d991c248b006d2066c11468c5749e58951463ecab027b50991ff4ca28279f294"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5e1af6b1b0101a246e04b20ce6b36a756a3839dc9f2e436d2e524b6a331165ff"
+      "sha256": "ed94a0e7dc7bdd1e48ebd1f9521b9aeb93a8e0289e9928393cf49461fd46dafa"
     },
     {
       "path": "public-docs/index.html",
@@ -7907,7 +7912,7 @@
     {
       "path": "scripts/gds/diagram-facts.js",
       "mode": "0000644",
-      "sha256": "2aba736613cacecbc81b40b813db619eaa83871a8c2aad213ab73869347c7f56"
+      "sha256": "3ba594a6d475bb94be7edf5277cd60d5537bf1ab66f92f9d47eeb5138c56341f"
     },
     {
       "path": "scripts/gds/discipline-modes.json",
@@ -8057,7 +8062,7 @@
     {
       "path": "scripts/gds/gen-diagrams.js",
       "mode": "0000644",
-      "sha256": "70b673fa4d4216eadefd7a7fad6e6e7fcffa3b2ac408c8f1c0f38c7a3500183c"
+      "sha256": "7cb78cd9796df68b6d7e1e4677cd778690f60583ba3ddc2fc23048f2ff75e4ba"
     },
     {
       "path": "scripts/gds/gen-file-map.js",
@@ -9317,7 +9322,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "39823a07155b3f5a8b13d2a6362985aab8ac0831d46ac25778e7893708d4fd5b"
+      "sha256": "83f3cb9f3f8992a2b8accb6b66190e82095bfcbe1ca2fb9bb40a471a194b380a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10174,6 +10179,11 @@
       "mode": "0000644",
       "sha256": "07d2825c812a10cd1d39182883652dec15d360d3645dd38023a00a0593d36ddc"
     },
+    {
+      "path": "tests/dead_feature_claim.mjs",
+      "mode": "0000644",
+      "sha256": "af5f2cbeb241470d4a819a8531aeb4069cbb4fe913bc479f3542661c39ce5ba7"
+    },
     {
       "path": "tests/dependencies_migration.mjs",
       "mode": "0000644",
@@ -10249,6 +10259,11 @@
       "mode": "0000644",
       "sha256": "36a3bad951c6bfb4ee7b9230a5e6114095bb3b94f1f0019ec5c61c5168dee537"
     },
+    {
+      "path": "tests/diagram_repo_slug.mjs",
+      "mode": "0000644",
+      "sha256": "5132322b103e6ea5a3a04b1509eba987e4988cd749751b17b5d31d813ec508d5"
+    },
     {
       "path": "tests/diff_derived_signals.mjs",
       "mode": "0000644",
@@ -10882,7 +10897,7 @@
     {
       "path": "tests/grade_server_authoritative.mjs",
       "mode": "0000644",
-      "sha256": "9482e5e458023b691f8e5971e232c6492d5e3e2772e927e1f6639f95808c8149"
+      "sha256": "f27ea217e74d880296db9f78aa8ed3b97d1a4a7a71496015af5f5d3e3ad69f05"
     },
     {
       "path": "tests/grade_unavailable_display.mjs",

package/docs/module-api-changelog.md

@@ -1936,5 +1936,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.729 with no explicit bump. run 34765502139. (task 1002620)
   1.19.731 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.730 with no explicit bump. run 34766029928. (task 1002620)
+  1.19.732 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.731 with no explicit bump. run 34766314699. (task 1002620)
+  1.19.733 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.732 with no explicit bump. run 34766569496. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/onboarding/diagrams/04-architecture.mmd

@@ -28,7 +28,7 @@ flowchart TB
         DEPLOY["auto-pull deploy (ADR 0129)\na timer pulls THIS instance repo every ~2 min →\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]
     end
 
-    subgraph GH["GITHUB — the instance's own repo (github.com/lars589/cloud-bongos)"]
+    subgraph GH["GITHUB — the instance's own repo"]
         MAIN["branch-protected main\n(no direct push; PR + required checks only)\nholds config + the pinned @bongos/core — NOT the platform source"]
     end
 

package/modules/grading/dead-feature-claim.js

@@ -0,0 +1,121 @@
+// modules/grading/dead-feature-claim.js — does a panel finding say, in its own
+// words, that the shipped code does not run at all? (task 1002665)
+//
+// WHY. On the task 1002648 ship the Quality worker found that the new PATCH
+// needs_migration path threw at runtime — a TASK_SETTER_COLUMNS allowlist gap —
+// and wrote "the feature is entirely non-operational". It then filed that at
+// severity `nit`, the grade PASSed, and the dead feature merged to main. The
+// finding TEXT was right; the SEVERITY was miscalibrated, and severity is the
+// only channel a reader's attention follows.
+//
+// Two things had to be true for that to merge, and this module addresses the
+// first. (1) Nothing re-read the finding's own claim against its own severity.
+// (2) Severity has no vote in the gate at all: `passed` in grader-score.js is
+// `bothPass && !lowConfidence && …`, computed from the rubric SCORES — a major
+// or blocker issue does not by itself stop a passing grade. So a severity floor
+// alone would not have gated this ship, which is why grader-score.js pairs this
+// classifier with a server-side guard rather than relying on the raised severity
+// to do the work. The row that asked for this proposed the floor on its own; the
+// floor on its own is decoration.
+//
+// SCOPE, deliberately narrow. This matches only ABSOLUTE claims about the
+// submitted change: always-throws, never-runs, non-operational. It does NOT
+// match conditional defects ("would throw on a null id") — those are ordinary
+// findings the scores already judge — and it does not match the word
+// "unreachable", which the originating row suggested: a reviewer writes "the old
+// branch is now unreachable" to PRAISE a dead-code deletion, and that reading is
+// at least as common as the damning one. A false positive here costs a builder a
+// manual-confirm round, so the phrase list stays at claims that have no innocent
+// reading, and the suppressors below drop the two framings that do.
+
+'use strict';
+
+// Absolute claims of runtime-deadness. Each must be unambiguous ON ITS OWN — if
+// a phrase has an innocent reading in ordinary review prose, it does not belong
+// here, it belongs in the scores.
+const DEAD_CLAIM_PATTERNS = [
+  /\bnon-?operational\b/i,
+  /\b(?:always|unconditionally) throws?\b/i,
+  /\bthrows? (?:at runtime|on every (?:call|invocation|request))\b/i,
+  /\bnever (?:executes|runs|fires|gets called)\b/i,
+  /\b(?:can|will) never (?:run|execute|be (?:called|reached))\b/i,
+  /\bdoes ?n[o']?t work at all\b/i,
+  /\b(?:completely|entirely|totally) (?:broken|dead|inoperable)\b/i,
+  /\bdead on arrival\b/i,
+];
+
+// A claim about code the change REMOVED or FIXED, or a hypothetical, is the
+// opposite of a dead-feature report — it is the reviewer describing what the
+// diff cured. These read within a short window BEFORE the matched phrase,
+// because that is where the framing sits in English ("this used to always
+// throw", "no longer non-operational", "would always throw if the id were null").
+const SUPPRESSORS = [
+  /\bused to\b/i,
+  /\bno longer\b/i,
+  /\bpreviously\b/i,
+  /\bbefore this (?:change|diff|fix|patch)\b/i,
+  /\bwas\b/i,
+  /\bwould\b/i,
+  /\bif\b/i,
+  /\bprevents?\b/i,
+  /\bavoids?\b/i,
+  /\bfix(?:e[sd])?\b/i,
+];
+
+// How far back a suppressor counts. One clause, not one paragraph: read too far
+// and an unrelated "fixed" earlier in a multi-sentence summary silences a real
+// claim; read too little and "this would always throw" trips.
+const SUPPRESSOR_WINDOW = 40;
+
+// Does `text` assert that the submitted code does not run at all? Returns the
+// matched phrase (truthy, and useful in the audit trail) or null. Pure.
+function deadFeatureClaim(text) {
+  const s = typeof text === 'string' ? text : '';
+  if (!s) return null;
+  for (const re of DEAD_CLAIM_PATTERNS) {
+    const m = re.exec(s);
+    if (!m) continue;
+    const before = s.slice(Math.max(0, m.index - SUPPRESSOR_WINDOW), m.index);
+    if (SUPPRESSORS.some((sup) => sup.test(before))) continue;
+    return m[0];
+  }
+  return null;
+}
+
+// The same question asked of one issues[] entry. Only `summary` carries the
+// worker's prose — `severity`/`file` are enumerated fields — so this reads that
+// and nothing else, which keeps a file PATH containing an unlucky word (say,
+// `always-throws.test.js`) from raising a severity.
+function issueClaimsRuntimeDead(issue) {
+  if (!issue || typeof issue !== 'object') return null;
+  return deadFeatureClaim(issue.summary);
+}
+
+// Severities in ascending order of gravity; anything at or above `major` needs no
+// floor, and an unrecognised severity is treated as below it (fail-closed: an
+// unknown label must not buy an exemption).
+const AT_LEAST_MAJOR = new Set(['major', 'blocker']);
+
+// Raise a runtime-dead finding to `major`, preserving what the worker reported.
+// Returns a NEW array when anything changed, the input array otherwise, so a
+// caller can cheaply tell whether the floor fired.
+function applyDeadFeatureFloor(issues) {
+  if (!Array.isArray(issues)) return issues;
+  let changed = false;
+  const out = issues.map((it) => {
+    const claim = issueClaimsRuntimeDead(it);
+    if (!claim) return it;
+    if (AT_LEAST_MAJOR.has(String(it.severity || '').toLowerCase())) return it;
+    changed = true;
+    return {
+      ...it,
+      severity: 'major',
+      severity_reported: it.severity,
+      severity_floor: 'runtime_dead',
+      severity_floor_claim: claim,
+    };
+  });
+  return changed ? out : issues;
+}
+
+module.exports = { deadFeatureClaim, issueClaimsRuntimeDead, applyDeadFeatureFloor };

package/modules/grading/grader-score.js

@@ -14,6 +14,7 @@ const fs = require('node:fs');
 const { DEFAULT_GRADER_MODEL, FALLTHROUGH_CONFIDENCE, LOW_CONFIDENCE, THRESHOLD, VERSION, permissionPathCheck, routeRankCheck } = require('./grader-config.js');
 const { TRIVIAL_MAX_FILES, TRIVIAL_MAX_LINES, clamp, median, r1 } = require('./grader-model.js');
 const { extractJson } = require('./grader-prompt.js');
+const { issueClaimsRuntimeDead } = require('./dead-feature-claim.js');
 
 function isNum(n) {
   return Number.isFinite(n);
@@ -480,6 +481,35 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
     implausiblePassWaived = 'panel_evidence';
   }
 
+  // --- Guard 2b: a finding that says the change does not run (task 1002665) ---
+  // On the task 1002648 ship the Quality worker wrote that the new code path was
+  // "entirely non-operational", filed it at `nit`, and the grade PASSed — the
+  // dead feature merged to main and was caught only because the builder happened
+  // to read the finding prose. Severity alone cannot fix that, because severity
+  // has no vote here: `passed` is computed from the rubric SCORES, so a major or
+  // blocker issue does not stop a passing grade by itself. This is the vote.
+  //
+  // Re-derived server-side from the submitted summaries rather than trusting the
+  // client's `severity_floor` marker — same posture as Guard 1, and the worker's
+  // floor is the honest-panel half of the same rule.
+  //
+  // It downgrades to CONCERNS, not fail: the classifier reads a model's prose, so
+  // a false positive should cost a human glance through manual-confirm rather
+  // than a hard FAIL and a paid re-grade. That is still enough to close the hole
+  // — 1002648 merged automatically, and a concerns verdict does not.
+  const deadClaims = (base.issues || [])
+    .map((it) => ({ it, claim: issueClaimsRuntimeDead(it) }))
+    .filter((x) => x.claim);
+  if (clientPassed && deadClaims.length) {
+    const { it, claim } = deadClaims[0];
+    const where = it.file ? ` in ${it.file}` : '';
+    guardsTripped.push({ guard: 'runtime_dead_finding', severity: 'major',
+      summary: `a ${it.severity_reported || it.severity || '?'}-severity finding${where} asserts the change does not run ("${claim}") — a passing grade over a self-reported dead feature must be human-confirmed` });
+    extraIssues.push({ severity: 'major', file: it.file || '(grade)', worker: 'server-runtime-dead', summary:
+      `[server runtime-dead] the panel's own words say this does not run ("${claim}"); severity was reported as ${it.severity_reported || it.severity || '?'}` });
+    if (downgradeTo !== 'fail') downgradeTo = 'concerns';
+  }
+
   // --- Guard 3: bound the credit/achievement signals (SR-18) ---
   // The net-negative "Subtractor" bonus + shipper badges key off client-supplied
   // signals.diff_stats + committed_files the server can't re-derive. We can't
@@ -517,7 +547,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       signals: {
         ...(base.signals || {}),
         server_guard: {
-          applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'],
+          applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'runtime_dead_finding', 'forged_net_negative'],
           ok: true,
           tripped: [],
           // task 1002658 / ADR 0164: the audit trail records WHY a zero-issue
@@ -556,7 +586,7 @@ function serverSideGuards(gradeResult, { committedFiles, builderRank, diffStats,
       // body already ran; this is the authoritative post-hoc adjustment).
       confidence: forwardedConfidence,
       server_guard: {
-        applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'forged_net_negative'],
+        applied: ['route_rank', 'permission_path', 'permission_path_unprovable', 'implausible_pass', 'runtime_dead_finding', 'forged_net_negative'],
         ok: guardsTripped.length === 0,
         downgraded_to: downgradeTo,
         client_passed: clientPassed,

package/modules/grading/grader-workers/worker-verdict.js

@@ -9,6 +9,8 @@
 // (the audit's explicit warning). Behavior-neutral: the objects produced here
 // are identical (same keys, same order, same values) to the inlined copies.
 
+const { applyDeadFeatureFloor } = require('../dead-feature-claim.js');
+
 // The { verdict:'fail', scores:{}, confidence:0, ... } shape every error
 // short-circuit returns. `issues` defaults to [] (the subprocess_error and
 // parse_error paths) and is the parsed issues array on the schema_error path
@@ -19,13 +21,21 @@ function failResult({ notesMd, error, issues = [] }) {
 
 // The three identical extractions every worker does after the parse guard:
 // confidence (null-tolerant), the bounded issues array, and the subagent notes.
+//
+// The issues array also passes the runtime-dead floor (task 1002665): a worker
+// that writes "the feature is entirely non-operational" and files it at `nit`
+// has contradicted itself, and on the task 1002648 ship that contradiction is
+// what let a dead feature merge. Raising it HERE, at the one place all four
+// workers parse their own output, means the worker's own downstream logic —
+// applySeverityGatePolicy below, which asks whether a fail is backed by a
+// major/blocker — sees the corrected severity rather than the reported one.
 function parseCommon(parsed) {
   const conf = parsed.confidence == null
     ? null
     : Number.isFinite(Number(parsed.confidence)) ? Number(parsed.confidence) : null;
-  const issues = Array.isArray(parsed.issues)
+  const issues = applyDeadFeatureFloor(Array.isArray(parsed.issues)
     ? parsed.issues.filter((i) => i && typeof i === 'object').slice(0, 50)
-    : [];
+    : []);
   const notesFromSubagent = typeof parsed.notes_md === 'string' ? parsed.notes_md : '';
   return { conf, issues, notesFromSubagent };
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.731",
+  "version": "1.19.733",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.731",
+      "version": "1.19.733",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.731",
+  "version": "1.19.733",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/diagram-facts.js

@@ -20,7 +20,6 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { execFileSync } = require('node:child_process');
 
 // --- comment stripping (so rank/status literals in prose don't read as wiring) ---
 // Line-based on purpose: a regex block-comment strip over concatenated files can
@@ -232,25 +231,36 @@ function seededAchievementCount(migs) {
   return ids.size;
 }
 
-// Repo slug ("host/owner/repo") for 04's REPO node — derived from the git
-// `origin` remote so no builder identity is hardcoded in implementation code
-// (CLAUDE.md V3.R12 rule + scripts/gds/audit-authorship.sh). Falls back to a
-// neutral placeholder if origin can't be read.
-function repoSlug(repo) {
-  try {
-    const url = execFileSync('git', ['-C', repo, 'remote', 'get-url', 'origin'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-    // git@github.com:owner/repo.git  OR  https://github.com/owner/repo(.git)
-    const m =
-      url.match(/[:/]([^/:]+\/[^/]+?)(?:\.git)?$/) ||
-      url.match(/github\.com[:/](.+?)(?:\.git)?$/);
-    if (m) return `github.com/${m[1].replace(/^github\.com\//, '')}`;
-  } catch (_) {
-    /* no remote / not a repo — fall through */
-  }
-  return 'the project repo';
+// Repo slug ("github.com/owner/repo") for 04's REPO node.
+//
+// Sourced from the BRANDING CONTRACT (`repo: { owner, name }`), never from the
+// git `origin` remote. Reading git was the original design (task #357) and it
+// did satisfy the rule it was written for — keep builder identity out of
+// implementation code (audit-authorship.sh) — but it only moved the identity
+// from the source into the GENERATED file, which is committed AND published.
+// The portable core carries no branding.json, so `origin` there is always some
+// real person's fork and every regeneration wrote that login into
+// docs/onboarding/diagrams/04-architecture.mmd and shipped it in the core
+// package. That is task 1003911: the one leak the task 1003869 sweep could not
+// hold, because a generator puts it back the moment anyone regenerates.
+//
+// Branding fails to neutral by construction, which is the whole point: an unset
+// `repo` yields the placeholder, so the portable core renders a placeholder and
+// a host instance that declares its own repo renders its own. Every other
+// identity string in these diagrams already follows exactly this rule — see
+// `brand()` in gen-diagrams.js, whose header states it for the currency, the
+// world/product name and the public host.
+function repoSlug() {
+  let b = {};
+  try { b = require('../../src/branding').branding() || {}; } catch (_) { /* fail-to-neutral */ }
+  const r = (b && b.repo) || {};
+  const owner = typeof r.owner === 'string' ? r.owner.trim() : '';
+  const name = typeof r.name === 'string' ? r.name.trim() : '';
+  // Both halves or neither — a half-filled pack must not render "owner/".
+  // null, not a placeholder string: the CALLER owns the prose, so a neutral
+  // instance can drop the clause entirely instead of rendering a parenthetical
+  // that restates the label it sits inside.
+  return owner && name ? `github.com/${owner}/${name}` : null;
 }
 
 // An instance that IMPORTED the origin backlog renumbers the origin tasks by a
@@ -315,7 +325,7 @@ async function conceptualFacts({ repo, migs, api }) {
     taskStatus: status,
     taskLabels: { ...ALL_TASK_IDS },
     achievementsSeeded: seededAchievementCount(migs),
-    repoSlug: repoSlug(repo),
+    repoSlug: repoSlug(),
   };
 }
 

package/scripts/gds/gen-diagrams.js

@@ -444,7 +444,7 @@ function architectureMmd(f) {
     '        DEPLOY["auto-pull deploy (ADR 0129)\\na timer pulls THIS instance repo every ~2 min →\\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]',
     '    end',
     '',
-    `    subgraph GH["GITHUB — the instance's own repo (${c.repoSlug})"]`,
+    `    subgraph GH["GITHUB — the instance's own repo${c.repoSlug ? ` (${c.repoSlug})` : ''}"]`,
     '        MAIN["branch-protected main\\n(no direct push; PR + required checks only)\\nholds config + the pinned @bongos/core — NOT the platform source"]',
     '    end',
     '',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.731'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.733'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/dead_feature_claim.mjs

@@ -0,0 +1,176 @@
+// tests/dead_feature_claim.mjs — the runtime-dead severity floor (task 1002665).
+//
+// Evidence: on the task 1002648 ship the Quality worker found that the new PATCH
+// needs_migration path threw at runtime, wrote "the feature is entirely
+// non-operational", filed it at severity `nit`, and the grade PASSed. The dead
+// feature merged to main; it was caught only because the builder read the prose.
+//
+// Two halves are proved here. The FLOOR raises such a finding to `major` so the
+// worker's own logic and every reader see the severity its own words imply. The
+// CLASSIFIER is deliberately narrow, and most of these cases exist to prove what
+// it does NOT match — a false positive costs a builder a manual-confirm round,
+// so conditional defects, praise for deleted code, and the ambiguous word
+// "unreachable" all have to stay out.
+//
+// Run:  node tests/dead_feature_claim.mjs
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { deadFeatureClaim, issueClaimsRuntimeDead, applyDeadFeatureFloor } = require('../modules/grading/dead-feature-claim.js');
+const { parseCommon, applySeverityGatePolicy } = require('../modules/grading/grader-workers/worker-verdict.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+function eq(actual, expected, msg) {
+  if (actual !== expected) throw new Error(`${msg || 'mismatch'}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+function truthy(v, msg) { if (!v) throw new Error(msg || `expected truthy, got ${JSON.stringify(v)}`); }
+function falsy(v, msg) { if (v) throw new Error(msg || `expected falsy, got ${JSON.stringify(v)}`); }
+
+// ---- the claim classifier: what it MUST catch ----------------------------
+
+test('the exact 1002648 wording is a dead-feature claim', () => {
+  truthy(deadFeatureClaim('TASK_SETTER_COLUMNS lacks needs_migration, so the feature is entirely non-operational'));
+});
+
+test('non-operational, with or without the hyphen', () => {
+  truthy(deadFeatureClaim('this path is nonoperational'));
+  truthy(deadFeatureClaim('this path is non-operational'));
+});
+
+test('always-throws and never-runs claims', () => {
+  truthy(deadFeatureClaim('the new helper always throws because the key is absent'));
+  truthy(deadFeatureClaim('this branch never executes'));
+  truthy(deadFeatureClaim('the handler can never run — nothing dispatches to it'));
+  truthy(deadFeatureClaim('the route throws at runtime on the first call'));
+});
+
+test('completely/entirely broken and dead on arrival', () => {
+  truthy(deadFeatureClaim('the migration is completely broken'));
+  truthy(deadFeatureClaim('this endpoint is dead on arrival'));
+});
+
+test('the claim is returned, not just a boolean, so the audit trail can quote it', () => {
+  eq(deadFeatureClaim('the feature is entirely non-operational'), 'non-operational');
+});
+
+// ---- the claim classifier: what it MUST NOT catch ------------------------
+
+test('a CONDITIONAL defect is not a dead-feature claim — the scores judge those', () => {
+  falsy(deadFeatureClaim('this would always throw if the id were null'));
+  falsy(deadFeatureClaim('if the cache is cold the loader never runs'));
+});
+
+test('praise for what the diff REMOVED is not a dead-feature claim', () => {
+  falsy(deadFeatureClaim('the old branch used to always throw; this fixes it'));
+  falsy(deadFeatureClaim('this path is no longer non-operational'));
+  falsy(deadFeatureClaim('previously the handler never executed'));
+  falsy(deadFeatureClaim('before this change the route was completely broken'));
+});
+
+test('"unreachable" is NOT matched — a reviewer writes it to praise a dead-code deletion', () => {
+  falsy(deadFeatureClaim('the old fallback is now unreachable and was deleted'));
+  falsy(deadFeatureClaim('this line is unreachable'));
+});
+
+test('empty and non-string input are safe', () => {
+  falsy(deadFeatureClaim(''));
+  falsy(deadFeatureClaim(null));
+  falsy(deadFeatureClaim(undefined));
+  falsy(deadFeatureClaim({ summary: 'always throws' }));
+});
+
+// ---- issueClaimsRuntimeDead reads the SUMMARY only -----------------------
+
+test('only the summary is read — a file path with an unlucky name never raises a severity', () => {
+  falsy(issueClaimsRuntimeDead({ severity: 'nit', file: 'tests/always-throws.test.js', summary: 'rename this' }));
+  truthy(issueClaimsRuntimeDead({ severity: 'nit', file: 'x.js', summary: 'the setter always throws' }));
+});
+
+test('a malformed issue entry is not a claim', () => {
+  falsy(issueClaimsRuntimeDead(null));
+  falsy(issueClaimsRuntimeDead('always throws'));
+});
+
+// ---- the floor -----------------------------------------------------------
+
+test('a nit that asserts the feature is dead is raised to major', () => {
+  const out = applyDeadFeatureFloor([{ severity: 'nit', file: 'db.js', summary: 'the feature is entirely non-operational' }]);
+  eq(out[0].severity, 'major');
+  eq(out[0].severity_reported, 'nit', 'what the worker actually said is preserved');
+  eq(out[0].severity_floor, 'runtime_dead');
+  eq(out[0].severity_floor_claim, 'non-operational');
+});
+
+test('minor is raised too; major and blocker are left exactly as reported', () => {
+  const out = applyDeadFeatureFloor([
+    { severity: 'minor', summary: 'always throws' },
+    { severity: 'major', summary: 'always throws' },
+    { severity: 'blocker', summary: 'always throws' },
+  ]);
+  eq(out[0].severity, 'major');
+  eq(out[0].severity_floor, 'runtime_dead');
+  eq(out[1].severity_floor, undefined, 'an already-major finding is not re-stamped');
+  eq(out[2].severity, 'blocker', 'a blocker is never lowered to major');
+});
+
+test('an UNKNOWN severity is raised — an unrecognised label must not buy an exemption', () => {
+  const out = applyDeadFeatureFloor([{ severity: 'trivial', summary: 'always throws' }]);
+  eq(out[0].severity, 'major');
+  eq(out[0].severity_reported, 'trivial');
+});
+
+test('findings with no dead-feature claim pass through untouched, same array', () => {
+  const input = [{ severity: 'nit', summary: 'comment style' }];
+  eq(applyDeadFeatureFloor(input), input, 'the input array itself is returned when nothing changed');
+});
+
+test('the floor does not mutate the caller\'s objects', () => {
+  const it = { severity: 'nit', summary: 'always throws' };
+  applyDeadFeatureFloor([it]);
+  eq(it.severity, 'nit', 'the original entry is untouched');
+});
+
+test('a non-array is returned as-is rather than throwing', () => {
+  eq(applyDeadFeatureFloor(null), null);
+  eq(applyDeadFeatureFloor(undefined), undefined);
+});
+
+// ---- the wiring: every worker parses through parseCommon -----------------
+//
+// parseCommon is the one place all four workers turn their own JSON into issues,
+// so the floor belongs there. Without this test the floor could be unwired from
+// parseCommon and every unit above would still pass.
+
+test('parseCommon applies the floor, so all four workers get it', () => {
+  const { issues } = parseCommon({ issues: [{ severity: 'nit', file: 'db.js', summary: 'the feature is entirely non-operational' }] });
+  eq(issues[0].severity, 'major');
+  eq(issues[0].severity_floor, 'runtime_dead');
+});
+
+test('parseCommon still bounds and filters issues[] exactly as before', () => {
+  const { issues } = parseCommon({ issues: [null, 'junk', { severity: 'nit', summary: 'fine' }] });
+  eq(issues.length, 1, 'non-object entries are dropped');
+  eq(parseCommon({ issues: Array.from({ length: 80 }, () => ({ severity: 'nit', summary: 'x' })) }).issues.length, 50,
+    'the 50-entry bound is unchanged');
+  eq(parseCommon({ issues: 'not an array' }).issues.length, 0);
+});
+
+test('the raised severity reaches the worker\'s own severity gate: a dead-feature fail is no longer downgraded', () => {
+  const { issues } = parseCommon({ issues: [{ severity: 'nit', file: 'db.js', summary: 'the new setter always throws' }] });
+  const result = applySeverityGatePolicy(
+    { verdict: 'fail', scores: { code_quality: 4 }, issues, notes_md: '' },
+    { threshold: 6 }
+  );
+  eq(result.verdict, 'fail', 'a fail backed by a floor-raised finding stays a fail');
+  eq(result.policy_downgrade, undefined);
+});
+
+console.log('');
+console.log(`dead_feature_claim: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/diagram_repo_slug.mjs

@@ -0,0 +1,142 @@
+// tests/diagram_repo_slug.mjs
+//
+// Task 1003911 — the onboarding architecture diagram must not carry the live
+// instance's GitHub owner into published output.
+//
+// The bug: diagram-facts.repoSlug() derived the slug from the git `origin`
+// remote. That satisfied the rule it was written for (no builder identity
+// hardcoded in implementation code — audit-authorship.sh) but only moved the
+// identity from the SOURCE into the GENERATED file, which is committed and
+// shipped in the core package. Because it is a generator, hand-sweeping the
+// .mmd achieved nothing: the next regeneration put the owner login straight
+// back, which is how it survived the task 1003869 sweep and failed the leak
+// scan on landed main.
+//
+// The fix routes the slug through the branding contract (`repo: {owner,name}`),
+// which fails to neutral by construction — the same rule the currency, the
+// world/product name and the public host already follow.
+//
+// NOTE ON METHOD: this file never writes a real owner login down. It reads the
+// live `origin` at run time and asserts the output does not contain it. That is
+// the self-leak invariant mirror-redact.js holds about itself, and the trap this
+// sweep fell into twice — a test that pins "X must not leak" by spelling X out
+// puts X back into the very tree it is guarding.
+//
+// Run:  node tests/diagram_repo_slug.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const REPO = process.cwd();
+
+// branding() memoizes on first call, so each pack needs its own process.
+function slugWith(pack) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'repo-slug-'));
+  const file = path.join(tmp, 'branding.json');
+  fs.writeFileSync(file, JSON.stringify(pack));
+  try {
+    const out = execFileSync(
+      process.execPath,
+      ['-e', 'process.stdout.write(JSON.stringify(require("./scripts/gds/diagram-facts.js").repoSlug()))'],
+      { cwd: REPO, encoding: 'utf8', env: { ...process.env, BONGOS_BRANDING_FILE: file } },
+    );
+    return JSON.parse(out);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+// The live owner, read at run time and never written down. If there is no
+// origin remote (a CI checkout without one), the guards that need it skip.
+function liveOwner() {
+  try {
+    const url = execFileSync('git', ['-C', REPO, 'remote', 'get-url', 'origin'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    const m = url.match(/[:/]([^/:]+)\/[^/]+?(?:\.git)?$/);
+    return m ? m[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+// ---- the branding contract drives it, and fails to neutral ----
+
+test('an unset repo yields null, so the caller can drop the clause entirely', () => {
+  assert.equal(slugWith({ repo: { owner: '', name: '' } }), null);
+});
+
+test('a pack with no repo key at all is still neutral, not a crash', () => {
+  assert.equal(slugWith({}), null);
+});
+
+test('a declared repo renders that instance own slug', () => {
+  assert.equal(slugWith({ repo: { owner: 'octocat', name: 'hello-world' } }), 'github.com/octocat/hello-world');
+});
+
+test('a half-filled pack renders nothing, never a dangling owner/', () => {
+  assert.equal(slugWith({ repo: { owner: 'octocat', name: '' } }), null);
+  assert.equal(slugWith({ repo: { owner: '', name: 'hello-world' } }), null);
+});
+
+test('whitespace is not a declaration', () => {
+  assert.equal(slugWith({ repo: { owner: '   ', name: '  ' } }), null);
+});
+
+// ---- the regression guard: reverting to git-derivation must FAIL here ----
+//
+// Every assertion above passes if repoSlug() goes back to reading `origin`,
+// because those packs are neutral and a git fallback would only fire when the
+// pack is empty. This is the one that catches it.
+
+test('a neutral pack does NOT fall back to the git origin owner', () => {
+  const owner = liveOwner();
+  if (!owner) return; // no remote in this checkout; nothing to leak
+  const got = slugWith({ repo: { owner: '', name: '' } });
+  assert.equal(got, null, 'neutral branding must render no slug at all');
+  assert.doesNotMatch(String(got), new RegExp(owner, 'i'), 'the git origin owner reached the diagram facts');
+});
+
+test('a declared repo wins over the git origin, it is not merely a fallback', () => {
+  const owner = liveOwner();
+  if (!owner) return;
+  const got = slugWith({ repo: { owner: 'octocat', name: 'hello-world' } });
+  assert.equal(got, 'github.com/octocat/hello-world');
+  assert.doesNotMatch(got, new RegExp(owner, 'i'));
+});
+
+// ---- the committed artifact, which is what actually ships ----
+
+test('the committed 04-architecture.mmd carries no owner login', () => {
+  const owner = liveOwner();
+  if (!owner) return;
+  const mmd = path.join(REPO, 'docs/onboarding/diagrams/04-architecture.mmd');
+  if (!fs.existsSync(mmd)) return;
+  const text = fs.readFileSync(mmd, 'utf8');
+  assert.doesNotMatch(
+    text,
+    new RegExp(owner, 'i'),
+    'the published diagram names the live owner — regenerate it after fixing the generator',
+  );
+});
+
+console.log(`\ndiagram_repo_slug: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/grade_server_authoritative.mjs

@@ -478,6 +478,63 @@ await test('applyGrade on a server-downgraded (passed=false) grade awards no cre
   assert.ok(!queries.some((q) => /INSERT INTO credit_log/.test(q.sql)), 'no credit_log insert');
 });
 
+// ========================================================================
+// Guard 2b — a finding whose own words say the change does not run (task 1002665).
+//
+// The 1002648 regression, reconstructed: the Quality worker wrote "the feature is
+// entirely non-operational", filed it at `nit`, the rubric scores were high, and
+// the grade PASSed straight to a merge. Note WHY a severity floor alone could not
+// have stopped it — `passed` is computed from the scores, so even at `major` the
+// grade still passes. This guard is the vote severity never had.
+// ========================================================================
+
+await test('a nit-severity finding that says the change does not run downgrades a PASS', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'src/bongos/db.js', summary: 'TASK_SETTER_COLUMNS lacks needs_migration, so the feature is entirely non-operational' }] }),
+    { committedFiles: ['src/bongos/db.js'], builderRank: 'metic', diffStats: { files_changed: 2, lines_added: 40, lines_removed: 3 } }
+  );
+  assert.equal(g.passed, false, 'the 1002648 grade must no longer pass');
+  assert.equal(g.signals.server_guard.downgraded_to, 'concerns',
+    'a prose heuristic downgrades to manual-confirm, not a hard FAIL');
+  assert.ok(g.signals.server_guard.tripped.some((t) => t.guard === 'runtime_dead_finding'),
+    'the guard names itself in the audit trail');
+  assert.ok(g.issues.some((i) => i.worker === 'server-runtime-dead'),
+    'the finding is surfaced so the builder sees why');
+});
+
+await test('high rubric scores do NOT rescue it — that is the hole severity alone left open', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ ff: 10, cq: 10, issues: [{ severity: 'nit', file: 'x.js', summary: 'the new handler always throws' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 20, lines_removed: 0 } }
+  );
+  assert.equal(g.passed, false, 'a 10/10 grade over a self-reported dead feature must still stop');
+});
+
+await test('an ordinary conditional finding is untouched — no false block', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'x.js', summary: 'this would throw if the id were null' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 20, lines_removed: 0 } }
+  );
+  assert.equal(g.passed, true, 'a conditional defect is ordinary review prose, not a dead-feature claim');
+  assert.equal(g.signals.server_guard.ok, true);
+});
+
+await test('praise for deleted dead code is untouched — no false block', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ issues: [{ severity: 'nit', file: 'x.js', summary: 'the old fallback used to always throw; this removes it' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 5, lines_removed: 30 } }
+  );
+  assert.equal(g.passed, true, 'describing what the diff CURED must not be read as a dead feature');
+});
+
+await test('a grade that was ALREADY failing is not resurrected by the guard', () => {
+  const g = grader.serverSideGuards(
+    clientGrade({ ff: 2, cq: 2, issues: [{ severity: 'nit', file: 'x.js', summary: 'always throws' }] }),
+    { committedFiles: ['x.js'], builderRank: 'metic', diffStats: { files_changed: 1, lines_added: 20, lines_removed: 0 } }
+  );
+  assert.equal(g.passed, false);
+});
+
 // ------------------------------------------------------------------------
 process.on('exit', () => {
   console.log(`\ngrade_server_authoritative: ${passed} passed, ${failed} failed`);