@bongos/core 1.19.753 → 1.19.755

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.753",
-  "core_contract": "1.19.753",
-  "source_commit": "80dc32c8218722e226e51da2ebb020cec6d9d0c2",
+  "core_version": "1.19.755",
+  "core_contract": "1.19.755",
+  "source_commit": "1cc8ad5ec0be2921b0e5cf12464689c86b5c36a6",
   "source_ref": "HEAD",
-  "built_at": "2026-09-15T23:33:23.711Z",
+  "built_at": "2026-09-16T02:11:51.276Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 482,
+    "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2110,
+    "functional_verbatim": 2112,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2617,
-  "tree_sha256": "878000807a14e178ce864325e1330e8c14b05bd4799fab37d3cecde128cde500",
+  "file_count": 2620,
+  "tree_sha256": "4960c3809b0d1bd4756c52793ef2167cfc1b70844cd2250f3e35723cd275bc50",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1939,10 +1939,15 @@
       "mode": "0000644",
       "sha256": "df40904ac989d54ea6bea561649a35a98ec7dc1ba96ea65395cb314ffe2059a9"
     },
+    {
+      "path": "docs/adr/0287-a-backlog-task-that-nothing-gates-promotes-itself.md",
+      "mode": "0000644",
+      "sha256": "3990568d9257c263d629527bd4bfb143cbf211c5a61544bf8db527c9e3c11249"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "e7f895a2f6dc062acd2afcf2c477ab8e60f1cbc93a836d8759a47d204a55a450"
+      "sha256": "6e19a62c805b92eda9a318fe7d67cac22927a80d4ad6bdd681256f0cd06281cd"
     },
     {
       "path": "docs/api-reference.md",
@@ -2507,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ccb51e74c6ede2d1dc04f3877491a2b2a8c266494c9624b710fd3af463ac49b8"
+      "sha256": "744adc56bff99972f3104823c66db347b9aaef9aee42d06f12bff8da8e559a7d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5467,7 +5472,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "df48a62844d96e93bfa1e3c20031b4c4fbb1efda3e943b1374c3015cc1df9951"
+      "sha256": "2ec7c2bec4ef96b5ded094c69104fc30e53b7659cb2b2444ed4491df3f3836dc"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5627,7 +5632,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "9f3e3ae52f9fa49a1f5638d92a4b985d0c23fe0433d917d017aa78876c41ca43"
+      "sha256": "dce7913d2635c40ce9557e7cb554aa152dbbe4c40e88676faa3f5e5b34bc26ae"
     },
     {
       "path": "modules/lifecycle/rot.js",
@@ -7562,12 +7567,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cf5907822b5a511411433a626f4f1651d58505115c4a5ba39a391195e120e2ad"
+      "sha256": "d2721993cfbc4a656aab1c93434a55dd7a440a3bb63048893ed6b43c2b1bbeec"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "159c9db7924dccba4d3a83a4139e958190bc1eab91e974b696846d5418ad0c20"
+      "sha256": "23815bafaed5c20104d344967253d871d91b0df5524e5fba825119a316a0784a"
     },
     {
       "path": "public-docs/index.html",
@@ -9337,7 +9342,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "61b13299ffdd7f036d5bc3d364135bd8ca4d3470223001b8ff6cc45d858d6107"
+      "sha256": "9edf07966de8d137ba6d987557bb4a9fefeedd19e640f10302dbfd340e0343f9"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9367,7 +9372,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a15e5c285579017bee5b7b08b63efc00124fa10e2e562dafadf6b2b456f0820c"
+      "sha256": "690fb3d76f0d06fcc41490f58b4a273c42ecfd65c8e9a2acb7cff0e85885f5a4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11614,6 +11619,11 @@
       "mode": "0000644",
       "sha256": "40c396fda3a618bf9fa2d2ae3d8d30b50e62c4210199d70b5e29cb82a046d037"
     },
+    {
+      "path": "tests/module_asset_subdomain.mjs",
+      "mode": "0000644",
+      "sha256": "420e17095b054f87be386913077966d456ae687b030b476e1bc33b15ae35ed9f"
+    },
     {
       "path": "tests/module_catalog.mjs",
       "mode": "0000644",
@@ -11994,6 +12004,11 @@
       "mode": "0000644",
       "sha256": "5444df365780c33d61ca9a18de08ed89ed2ff74d8af198d51edbaed19d6010c2"
     },
+    {
+      "path": "tests/promotion_sweep.mjs",
+      "mode": "0000644",
+      "sha256": "43246276a75ec8e7d01610b4f6c6988434144338804614b37b062c7a43a8beca"
+    },
     {
       "path": "tests/prose_edits.mjs",
       "mode": "0000644",

package/docs/adr/0287-a-backlog-task-that-nothing-gates-promotes-itself.md

@@ -0,0 +1,35 @@
+# 0287 — A backlog task that nothing gates promotes itself
+
+**Status:** accepted · 2026-09-15 · [task 1003932](https://cloudbongos.com/builders#/task/1003932) (owner decision, same session)
+
+## Context
+
+Auto-promotion has been reactive-only since [migration 163](../../migrations/163_polymorphic_dependencies.sql). All three paths are `AFTER UPDATE` triggers that fire at the **dependency** end of an edge — a task ships, a criterion is satisfied, a goal is achieved — and then re-check `task_is_fully_unblocked` for that node's dependents.
+
+Two states are unreachable by any of them, and neither is rare:
+
+1. **No gating edge at all.** `createTask` inserts at `status='backlog'`. A task with no edges is nobody's dependent, so no trigger ever evaluates it.
+2. **An edge added after the dependency shipped.** The ship event already happened; creating the edge later re-evaluates nothing.
+
+Measured on the live database, 2026-09-15: **155 backlog tasks were promotable and parked** — 33 of 41 in goal 1000106 alone, the rest spread over ten other goals. 117 more were correctly waiting on unfinished work. The owner's framing was blunt: *"nothing should be owner held backlog, are things not auto promoting?"*
+
+This is the same failure `runCriterionSweep` was built for on the criterion axis ([ADR 0183](0183-criteria-close-themselves.md)): a reactive rule cannot drain rows whose event has already passed, and nothing will ever fire for them again.
+
+## Decision
+
+**A backlog task with no unmet dependency and no open blocker becomes `ready` on its own**, via a `runPromotionSweep` on the publish-reconciler tick, beside the criterion sweep it copies.
+
+The owner chose the widest rule: the sweep covers **spikes** (which migration 163 excluded on purpose) and the cascade's **artist-review** tasks (which `cascade.js` files at `backlog` deliberately). One rule, no carve-outs. Promoting only makes a task claimable; it compels nobody to take it, and `/builder-sequence` still halts on a `judgement_kind` spike.
+
+**It ships disarmed.** The sweep reports what it would promote until `BONGOS_PROMOTION_SWEEP_ARMED=1`. The owner asked to see the list before ~155 rows change status at once, and a mass status change with no preview is exactly the kind of thing that is easy to do and tedious to unpick.
+
+**The open-blocker guard lives in the sweep's own SQL**, not in `task_is_fully_unblocked`. [Migration 176](../../migrations/176_promotion_respects_open_blockers.sql) folded that clause into the predicate for V4.R15; [migration 178](../../migrations/178_reward_gate_auto_assign_revert_autopromote.sql) then replaced the body with one it described as "byte-identical to the 163 body" and dropped it. Production was verified during this task: the live predicate has no blocker clause, and one task already sits at `ready` carrying an open blocker. Restoring it is [task 1003934](https://cloudbongos.com/builders#/task/1003934). A sweep that promotes in bulk must not inherit a single point of failure that has already been reverted once, so it re-checks, and keeps re-checking even after 1003934 lands.
+
+## Consequences
+
+- **`backlog` stops being a resting state.** It becomes the brief gap between filing and being claimable. `/backlog-review` — "the state a human must say go on" — loses most of its purpose; it is not deleted here, but the next session to touch it should expect little left to walk.
+- **The claimable feed grows by roughly 155 rows once armed**, across eleven goals. Nothing is force-assigned; the queue simply stops lying about what is available.
+- **The `UPDATE` repeats the `WHERE`** rather than trusting the ids the `SELECT` returned, so a row that stops qualifying between the two statements is not promoted.
+- **Idempotent**: it reads only `status='backlog'` rows, and an empty candidate set issues no write at all.
+- Rejected — **promoting at creation time** (`createTask` inserting `ready` when a task has no edges): it would break `cascade.js`'s tested invariant that a cascade-filed review lands at `backlog`, and it fixes nothing already parked. A sweep handles both the backlog drain and the self-heal, which is why the criterion axis chose one too.
+- Rejected — **scoping the first run to one goal**: it proves the mechanism on 37 rows while leaving the same defect live in ten other goals, and needs a second task to finish.

package/docs/adr/README.md

@@ -378,3 +378,4 @@ This keeps the decision history honest and traceable.
 | 0284 | [**The control plane carries no metrics stack** ([task 1003876](https://cloudbongos.com/builders#/task/1003876) · goal 1000106). Supersedes ADR 0127. Grafana (187 MB, the box's largest process) + Prometheus (110 MB, 2.5 GB data) were removed from the `s-1vcpu-2gb` control plane every provisioned project shares; they scraped none of those projects and nothing in the core read them. Owner chose remove over move-to-own-droplet. The `/metrics` exporter stays in every instance, so a scraper can return from a box that is not the control plane. Leftovers (DNS record, co-hosting-box socat forwarders, instance `infra/` copies) filed as a follow-up.](0284-the-control-plane-carries-no-metrics-stack.md) | infra / Cloud Bongos |
 | 0285 | [**A shared box holds about twelve projects per GB, and memory is the wall** ([task 1003877](https://cloudbongos.com/builders#/task/1003877) · goal 1000106, a spike measured read-only on the live control plane at the owner's call). A project costs ~80 MB warm (70 MB Node + one busy Postgres backend); idle projects look like ~25 MB only because swap holds their cold pages, and swap is not capacity. Fixed base ~750 MB on a control plane. Ceiling per tier `floor((usable − fixed) / 80)`: 15 on today's `s-1vcpu-2gb` (11 live), 39 on `s-2vcpu-4gb`; resize at 12. RAM binds first, Postgres connections (pool default 10 × N vs 97) second; CPU, ports, units, disk and the backup window do not bind. Keep the three shapes, add placement ("standalone until the box is full, then the next box"); a shared slot costs box price ÷ ceiling ($0.62–0.80/mo), `dedicated` 8–40× that.](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) | infra / Cloud Bongos |
 | 0286 | [**A gated project's manifest tells a stranger how to sign in, and nothing else** ([task 1003652](https://cloudbongos.com/builders#/task/1003652) · goal 1000106, from idea 1000845; closes ADR 0192's deferred item). `GET /instance` stays exempt from the member door, but on a gated project a caller with no live session gets `{ schema, name, brand: { identity.productName, project }, auth (incl. idp), admission }` — no modules, ranks, repo coordinates, dev-box flag or branding strings. Members get the full manifest; a failed lookup answers as a stranger; gated responses are `private, no-store` + `Vary: Cookie, Authorization`. Schema id stays `instance-manifest/v1` (a subset; `bongos login` refuses any other). Owner's call: sign-in basics only.](0286-a-gated-project-s-manifest-tells-a-stranger-how-to-sign-in-and-nothing-else.md) | security / Cloud Bongos |
+| 0287 | [**A backlog task that nothing gates promotes itself** ([task 1003932](https://cloudbongos.com/builders#/task/1003932), owner decision 2026-09-15). Every promotion path in migration 163 is an `AFTER UPDATE` trigger at the DEPENDENCY end of an edge, so two states are unreachable by all of them: a task with no gating edge is nobody's dependent and is never evaluated, and an edge added AFTER its dependency shipped missed the only event that would have fired. Measured live: **155 backlog tasks promotable and parked**, 33 of 41 in one goal. Same failure `runCriterionSweep` exists for on the criterion axis (ADR 0183) — a reactive rule cannot drain rows whose event has passed. **Decision: `runPromotionSweep` joins the publish-reconciler tick** and promotes any backlog task with no unmet dependency and no open blocker. The owner chose the widest rule — spikes (excluded by 163 on purpose) and cascade-filed artist reviews included, no carve-outs; promoting only makes a task claimable, it compels nobody. **It ships DISARMED**, reporting what it would promote until `BONGOS_PROMOTION_SWEEP_ARMED=1`, because ~155 rows changing status at once deserves a preview. The **open-blocker guard is re-checked in the sweep's own SQL**: migration 176 folded that clause into `task_is_fully_unblocked` and migration 178 dropped it while claiming to restore "the 163 body" — verified against production, where one task already sits at `ready` with an open blocker (its fix is task 1003934). A bulk promoter must not inherit a single point of failure that has been reverted once. Consequence the owner accepted: **`backlog` stops being a resting state** and `/backlog-review` loses most of its purpose. Rejected: promoting at creation (breaks `cascade.js`'s tested backlog invariant and fixes nothing already parked); scoping the first run to one goal (leaves the defect live in ten others).](0287-a-backlog-task-that-nothing-gates-promotes-itself.md) | lifecycle / work tracking |

package/docs/module-api-changelog.md

@@ -1980,5 +1980,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.751 with no explicit bump. run 35034524356. (task 1002620)
   1.19.753 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.752 with no explicit bump. run 35036151976. (task 1002620)
+  1.19.754 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.753 with no explicit bump. run 35039836268. (task 1002620)
+  1.19.755 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.754 with no explicit bump. run 35047010813. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -1037,6 +1037,66 @@ async function updateTaskStatus(id, status) {
   await pool.query(`UPDATE tasks SET status = $2 WHERE id = $1`, [id, status]);
 }
 
+// The UNSCOPED half of auto-promotion (task 1003932) — the backlog drain that
+// `runCriterionSweep` already is for criteria.
+//
+// Every promotion path migration 163 defines is an AFTER UPDATE trigger at the
+// DEPENDENCY end of an edge: a task ships, a criterion is satisfied, a goal is
+// achieved. Two states are therefore unreachable by any trigger, and neither is
+// rare: a task with NO gating edge is nobody's dependent, so nothing ever
+// evaluates it; and an edge added AFTER its dependency shipped missed the only
+// event that would have. Measured on the live DB 2026-09-15: 155 backlog tasks
+// project-wide were promotable and parked, 33 of 41 in one goal alone.
+//
+// TWO GUARDS, BOTH IN SQL, and the second is not redundant. `task_blockers` is
+// re-checked here rather than trusted to `task_is_fully_unblocked`, because
+// migration 176 folded that clause into the predicate and migration 178 replaced
+// the body with one it called "byte-identical to the 163 body" — dropping it.
+// Verified against production: the live predicate has no blocker clause (its own
+// fix is task 1003934). A sweep that promotes in bulk must not inherit a single
+// point of failure that has already been reverted once.
+//
+// The UPDATE repeats the WHERE rather than trusting the ids it just read, so a
+// row that stops qualifying between the two statements is not promoted anyway.
+const PROMOTABLE_BACKLOG_WHERE = `
+   WHERE t.status = 'backlog'
+     AND task_is_fully_unblocked(t.id)
+     AND NOT EXISTS (
+           SELECT 1
+             FROM task_blockers tb
+             JOIN blockers b ON b.id = tb.blocker_id
+            WHERE tb.task_id = t.id
+              AND b.status = 'open')`;
+
+// Runaway guard, not an expected limit (the runSweep precedent).
+const PROMOTION_SWEEP_LIMIT = 500;
+
+async function promoteUnblockedBacklogTasks(exec, { armed = false, limit = PROMOTION_SWEEP_LIMIT } = {}) {
+  const client = exec || pool;
+  const { rows: candidates } = await client.query(
+    `SELECT t.id, t.title, t.goal_id
+       FROM tasks t
+     ${PROMOTABLE_BACKLOG_WHERE}
+      ORDER BY t.id
+      LIMIT $1`,
+    [limit]
+  );
+  // Disarmed is the DEFAULT: this sweep can move hundreds of rows at once, so it
+  // reports first and promotes only once explicitly armed.
+  if (!armed || candidates.length === 0) return { armed, candidates, promoted: [] };
+  const { rows: promoted } = await client.query(
+    `UPDATE tasks t
+        SET status = 'ready',
+            promoted_at = COALESCE(t.promoted_at, now()),
+            updated_at = now()
+     ${PROMOTABLE_BACKLOG_WHERE}
+        AND t.id = ANY($1::bigint[])
+    RETURNING t.id, t.title, t.goal_id`,
+    [candidates.map((r) => r.id)]
+  );
+  return { armed, candidates, promoted };
+}
+
 // The cascade-filed ARTIST REVIEW rows that are still open (ADR 0241, task
 // 1003575) — the state the deploy gate reads. Narrow projection on purpose: the
 // caller needs an id and a filing date to name what holds a deploy and to apply
@@ -1111,6 +1171,7 @@ module.exports = {
   listClaimableTasks,
   listOpenArtistReviews,
   listTasks,
+  promoteUnblockedBacklogTasks,
   rankCrossDisciplineRecommendations,
   rewardGateAssignment,
   rewardGateError,

package/modules/lifecycle/publish-reconciler.js

@@ -886,6 +886,42 @@ async function runCriterionSweep(deps = {}) {
   }
 }
 
+// runPromotionSweep — the backlog drain (task 1003932). Same shape and same
+// reason as runCriterionSweep above: the three migration-163 promotion triggers
+// only fire at the DEPENDENCY end of an edge, so a backlog task with no edges is
+// never evaluated by anything and a late-added edge missed its only event.
+//
+// DISARMED BY DEFAULT. It can move hundreds of rows in one tick (155 were
+// promotable on 2026-09-15), so it reports what it WOULD promote until
+// BONGOS_PROMOTION_SWEEP_ARMED=1 says otherwise. Pure DB like runCostSweep — no
+// push credential — so it runs on hosts where getPublishStatus 503s.
+async function runPromotionSweep(deps = {}) {
+  const { logFn, errFn } = loggers(deps);
+  // Injected deps.tasksDb is the test seam; the sibling module is production.
+  const tasksDb = (deps.tasksDb && typeof deps.tasksDb.promoteUnblockedBacklogTasks === 'function')
+    ? deps.tasksDb
+    : require('./db-tasks.js');
+  const exec = deps.pool || seams.pool;
+  const armed = typeof deps.promotionArmed === 'boolean'
+    ? deps.promotionArmed
+    : process.env.BONGOS_PROMOTION_SWEEP_ARMED === '1';
+  try {
+    const out = await tasksDb.promoteUnblockedBacklogTasks(exec, { armed });
+    for (const t of out.promoted) {
+      logFn(`[publish-reconciler] task ${t.id} backlog→ready — every dependency is done and no blocker is open`);
+    }
+    if (!out.armed && out.candidates.length) {
+      const ids = out.candidates.map((t) => t.id).join(', ');
+      logFn(`[publish-reconciler] promotion sweep (report-only): ${out.candidates.length} task(s) would promote — ${ids}`);
+      logFn('[publish-reconciler] set BONGOS_PROMOTION_SWEEP_ARMED=1 to let it promote them');
+    }
+    return out;
+  } catch (e) {
+    errFn(`[publish-reconciler] promotion sweep (non-blocking): ${e && e.message}`);
+    return { skipped: 'error', error: e && e.message };
+  }
+}
+
 // Start the periodic sweep. Idempotent (a second call is a no-op). Kill-switched
 // by PUBLISH_RECONCILER_DISABLED=1 (purely additive bookkeeping, so it's ON by
 // default whenever a push credential is configured; the route's getPublishStatus
@@ -905,6 +941,7 @@ function start(deps = {}) {
     runSweep(deps).catch(crashHandler('sweep'));
     runCostSweep(deps).catch(crashHandler('cost sweep'));
     runCriterionSweep(deps).catch(crashHandler('criterion sweep'));
+    runPromotionSweep(deps).catch(crashHandler('promotion sweep'));
   };
 
   firstTimer = setTimeout(tick, FIRST_SWEEP_DELAY_MS);
@@ -941,6 +978,7 @@ module.exports = {
   stop,
   runSweep,
   runCostSweep,
+  runPromotionSweep,
   runCriterionSweep,
   couldBeStaleGenerated,
   describeTarget,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.753",
+  "version": "1.19.755",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.753",
+      "version": "1.19.755",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.753",
+  "version": "1.19.755",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -826,6 +826,20 @@ function mountInternalSurfaces(app) {
   app.use((req, res, next) => {
     if (!isBuildersHost(req)) return next();
     if (req.path.startsWith('/api/') || req.path === '/healthz') return next();
+    // Module browser assets are addressed at the ROOT on every host — the URL the
+    // loader's hallWidgetScripts projection emits is an absolute /modules/<key>/…
+    // and injectModuleHallWidgets puts that same tag in the hall index on BOTH
+    // hosts (task 1002848). Without this line the shim rewrites it to
+    // /builders/modules/… before the MODULE_ASSET_RE handler below can match, so
+    // the tag is injected on the subdomain and the asset 404s there — injection
+    // works on both hosts, serving works only on the apex. The handler keeps all
+    // its own defences (the isModuleEnabled gate, the traversal check); this only
+    // lets the request reach it.
+    //
+    // The general hazard: ANY apex-rooted route registered BELOW this shim is
+    // eaten the same way. Today that is this one and the /docs family (idea 529
+    // → task 1002861); /downloads/* dodges it by being registered ABOVE instead.
+    if (req.path.startsWith('/modules/')) return next();
     if (req.path === '/builders' || req.path.startsWith('/builders/')) return next();
     // Prefix with /builders so the handlers below match. req.url carries the
     // query string; preserve it. '/' → '/builders/', '/watch' → '/builders/watch'.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.753'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.755'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module_asset_subdomain.mjs

@@ -0,0 +1,155 @@
+// tests/module_asset_subdomain.mjs — module browser assets must route identically
+// on the apex and on builders.<apex> (task 1002848).
+//
+// THE BUG. A module-contributed hall widget's <script src="/modules/<key>/public/
+// hall-widget.js"> is injected into the hall index on BOTH hosts by
+// injectModuleHallWidgets, but only SERVED on the apex. The builders-subdomain
+// rewrite shim in serve-internal.js runs as app.use middleware, ahead of the
+// MODULE_ASSET_RE route, and rewrites every path on that host onto the /builders/*
+// tree — exempting only /api/, /healthz and paths already under /builders. So
+// /modules/demo/public/hall-widget.js became /builders/modules/... , stopped
+// matching ^/modules/, and fell through to a 404.
+//
+// WHY THIS TEST HAS TO EXIST. The seam is a live no-op today: no module ships a
+// hall-widget.js, so nothing on either host currently requests one, and a
+// regression here would be completely invisible until the first module that does
+// ship one — at which point it would look like a bug in that module. The test
+// therefore drives a module asset that DOES exist (hall-ui's own public/ dir) and
+// asserts the two hosts agree, which is the property the fix is really about.
+//
+// serve-internal is DB-free (the pg pool connects lazily), so we mount it on a
+// throwaway express app and hit it over loopback — same pattern as
+// tests/docs_openapi_route.mjs.
+//
+// USE node:http, NOT fetch. `Host` is a forbidden header name in the fetch spec,
+// so `fetch(url, { headers: { host } })` SILENTLY drops the override and sends the
+// real one (127.0.0.1:<port>). A host-routing test written with fetch therefore
+// compares the apex against itself, passes, and keeps passing with the fix
+// reverted — which is exactly what the first draft of this file did until the
+// mutation probe caught it. node:http honours an explicit Host in options.headers.
+//
+// Run:  node --test tests/module_asset_subdomain.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+
+// Any host starting with "builders." is the subdomain; anything else is the apex.
+const APEX = 'example.com';
+const SUBDOMAIN = 'builders.example.com';
+
+// A file the hall-ui module really ships, so a 200 proves the request reached the
+// MODULE_ASSET_RE handler AND the handler found bytes — not merely that it matched.
+const REAL_ASSET = '/modules/hall-ui/public/atlas.css';
+
+async function withServer(fn) {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  try {
+    await fn(server.address().port);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+// One loopback request with a REAL Host header. Never follows redirects — a 301 is
+// itself a routing decision we want to see.
+function get(port, path, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body, headers: res.headers }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// The harness is only meaningful if the Host header actually reaches the app, and
+// the fetch trap above proves that is not self-evident. Assert it directly, so a
+// future change that breaks host propagation fails HERE with a clear reason rather
+// than turning every test below into a silent apex-vs-apex tautology.
+test('the harness really varies the Host — without this the rest is vacuous', async () => {
+  await withServer(async (port) => {
+    const { isBuildersHost } = require('../src/bongos/serve-internal.js');
+    assert.equal(isBuildersHost({ headers: { host: SUBDOMAIN } }), true);
+    assert.equal(isBuildersHost({ headers: { host: APEX } }), false);
+    // and end-to-end: both hosts 301 /builders/, but to DIFFERENT places — the apex
+    // sends you to the subdomain, the subdomain strips the redundant prefix. Equal
+    // targets would mean the Host never reached the app.
+    const sub = await get(port, '/builders/', SUBDOMAIN);
+    const apex = await get(port, '/builders/', APEX);
+    assert.notEqual(sub.headers.location, apex.headers.location,
+      'the two hosts must route differently, or the Host header is being dropped');
+  });
+});
+
+test('a real module asset serves on the apex AND on builders.<apex>', async () => {
+  await withServer(async (port) => {
+    const apex = await get(port, REAL_ASSET, APEX);
+    const sub = await get(port, REAL_ASSET, SUBDOMAIN);
+    assert.equal(apex.status, 200, 'precondition: the asset serves on the apex');
+    assert.equal(sub.status, 200,
+      'the subdomain must serve it too — the rewrite shim used to turn this into /builders/modules/... and 404');
+  });
+});
+
+test('the two hosts return the same body, not just the same status', async () => {
+  await withServer(async (port) => {
+    const apex = await get(port, REAL_ASSET, APEX);
+    const sub = await get(port, REAL_ASSET, SUBDOMAIN);
+    assert.ok(apex.body.length > 0, 'precondition: the asset is not empty');
+    assert.equal(sub.body, apex.body, 'the subdomain must serve the same bytes, not a rewritten page');
+  });
+});
+
+test('an unknown module 404s on BOTH hosts — the exemption grants no new reach', async () => {
+  await withServer(async (port) => {
+    const p = '/modules/no-such-module/public/x.css';
+    assert.equal((await get(port, p, APEX)).status, 404);
+    assert.equal((await get(port, p, SUBDOMAIN)).status, 404,
+      'the shim exemption must not turn an unknown module into anything but a 404');
+  });
+});
+
+test('a missing file inside a REAL module 404s on both hosts', async () => {
+  await withServer(async (port) => {
+    const p = '/modules/hall-ui/public/definitely-not-here.css';
+    assert.equal((await get(port, p, APEX)).status, 404);
+    assert.equal((await get(port, p, SUBDOMAIN)).status, 404);
+  });
+});
+
+test('path traversal out of the module dir is refused on the subdomain too', async () => {
+  await withServer(async (port) => {
+    // The handler normalizes and rejects a rel path escaping modules/<key>/public.
+    // Worth pinning on the SUBDOMAIN specifically: that request now reaches the
+    // handler where it previously never did, so this is newly-exercised ground.
+    for (const p of ['/modules/hall-ui/public/../../../package.json',
+                     '/modules/hall-ui/public/..%2f..%2f..%2fpackage.json']) {
+      const r = await get(port, p, SUBDOMAIN);
+      assert.notEqual(r.status, 200, `traversal must not serve a file outside the module dir (${p})`);
+      assert.ok(!/"name":\s*"@bongos/.test(r.body), 'package.json bytes must never appear in the body');
+    }
+  });
+});
+
+test('the exemption is scoped to /modules/ — a lookalike path is still rewritten', async () => {
+  await withServer(async (port) => {
+    // If the exemption had been written as a bare `includes('modules')` or without
+    // the trailing slash, this path would escape the shim too.
+    const r = await get(port, '/moduleslike', SUBDOMAIN);
+    assert.notEqual(r.status, 200,
+      'a path merely starting with "modules" but outside /modules/ is not a module asset');
+  });
+});

package/tests/promotion_sweep.mjs

@@ -0,0 +1,210 @@
+// tests/promotion_sweep.mjs
+//
+// The backlog promotion sweep (task 1003932) — the UNSCOPED half of
+// auto-promotion, the exact shape runCriterionSweep already has for criteria.
+//
+// Why it exists: every promotion path in migration 163 is an AFTER UPDATE
+// trigger at the DEPENDENCY end of an edge (a task ships, a criterion is
+// satisfied, a goal is achieved). A task with NO gating edge is nobody's
+// dependent, so no trigger ever evaluates it and it cannot leave 'backlog' —
+// measured 2026-09-15: 33 of 41 backlog tasks in goal 1000106, and 155
+// project-wide. A task whose edge was added AFTER its dependency shipped is
+// stuck the same way: the ship event already happened.
+//
+// HOW THESE TESTS PROVE A GUARD, and where that proof stops. CI runs a DB-free
+// unit gate (scripts/gds/run-unit-tests.js excludes anything needing Postgres,
+// and no workflow provides a Postgres service), so a fixture-in-a-real-database
+// test would run nowhere. Instead the fake pool below answers the way the
+// database would GIVEN THE GUARDS THE STATEMENT ACTUALLY CARRIES: a blocked row
+// is withheld only because the SQL contains the blocker clause. Drop the clause
+// and that row starts coming back, and the "is NOT promoted" cases go red.
+//
+// The residual gap, stated rather than papered over: a guard NEUTERED while
+// keeping its wording (`AND b.status = 'open' AND FALSE`) still reads as present
+// here. Closing that needs Postgres. What stands in for it is a live read-only
+// verification recorded in the task's ship notes — against production, the
+// sweep's own candidate query returned 155 rows, of which 0 carried an open
+// blocker and 0 were not fully unblocked, while 2 backlog rows were excluded by
+// the blocker clause alone.
+//
+// Run:  node tests/promotion_sweep.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const dbTasks = require('../modules/lifecycle/db-tasks.js');
+const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try {
+    await fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+// The two shapes that are stuck today, plus one row per guard the sweep must
+// respect. `why` is the reason the row must NOT be promoted.
+const QUALIFIES = [
+  { id: 1003930, title: 'no dependency edges at all', goal_id: 1000106 },
+  { id: 1002348, title: 'edge added after the dependency shipped', goal_id: 1000106 },
+];
+const EXCLUDED = [
+  { id: 2000001, title: 'a dependency has not shipped', goal_id: 1000106, why: 'unmetDep' },
+  { id: 2000002, title: 'carries an open blocker', goal_id: 1000106, why: 'openBlocker' },
+  { id: 2000003, title: 'already out of backlog', goal_id: 1000106, why: 'notBacklog' },
+];
+const FIXTURE = [...QUALIFIES, ...EXCLUDED];
+
+// Answer as the database would, given the guards this statement carries.
+function admittedBy(sql, rows) {
+  const backlogGuard = /status\s*=\s*'backlog'/i.test(sql);
+  const depGuard = /task_is_fully_unblocked\s*\(/i.test(sql);
+  const blockerGuard = /task_blockers/i.test(sql) && /b\.status\s*=\s*'open'/i.test(sql);
+  return rows.filter((r) => {
+    if (r.why === 'notBacklog' && backlogGuard) return false;
+    if (r.why === 'unmetDep' && depGuard) return false;
+    if (r.why === 'openBlocker' && blockerGuard) return false;
+    return true;
+  });
+}
+
+function mkPool({ rows = FIXTURE } = {}) {
+  const calls = [];
+  return {
+    calls,
+    async query(sql, params) {
+      const text = String(sql);
+      calls.push({ sql: text, params });
+      if (/^\s*UPDATE/i.test(text)) {
+        // The UPDATE re-checks the guards AND narrows to the ids it was handed.
+        const ids = Array.isArray(params && params[0]) ? params[0] : null;
+        const scoped = ids ? rows.filter((r) => ids.includes(r.id)) : rows;
+        return { rows: admittedBy(text, scoped) };
+      }
+      return { rows: admittedBy(text, rows) };
+    },
+  };
+}
+
+const updatesIn = (pool) => pool.calls.filter((c) => /^\s*UPDATE/i.test(c.sql));
+const idsOf = (rows) => rows.map((r) => r.id);
+
+// ---------- what gets promoted, and what does not ----------
+
+await test('report-only by default: it names candidates and writes NOTHING', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, {});
+  assert.equal(out.armed, false, 'default is report-only — arming is explicit');
+  assert.deepEqual(idsOf(out.candidates), idsOf(QUALIFIES));
+  assert.deepEqual(out.promoted, [], 'nothing is promoted while disarmed');
+  assert.equal(updatesIn(pool).length, 0, 'a disarmed sweep must never issue an UPDATE');
+});
+
+await test('armed: it promotes exactly the qualifying rows', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.equal(out.armed, true);
+  assert.deepEqual(idsOf(out.promoted), idsOf(QUALIFIES));
+  const update = updatesIn(pool)[0];
+  assert.ok(update, 'an armed sweep issues the UPDATE');
+  assert.match(update.sql, /status\s*=\s*'ready'/i, "it moves the task to 'ready'");
+  assert.match(update.sql, /promoted_at\s*=\s*COALESCE\(/i,
+    'and stamps promoted_at without overwriting an existing one (mirrors the 163 triggers)');
+});
+
+await test('a task whose dependency has not shipped is NOT promoted', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.candidates).includes(2000001), 'never a candidate');
+  assert.ok(!idsOf(out.promoted).includes(2000001), 'and never promoted');
+});
+
+await test('a task carrying an open blocker is NOT promoted', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.candidates).includes(2000002), 'never a candidate');
+  assert.ok(!idsOf(out.promoted).includes(2000002), 'and never promoted');
+});
+
+await test('a task already out of backlog is NOT touched', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.promoted).includes(2000003));
+});
+
+await test('the UPDATE re-checks the guards rather than trusting the ids it read', async () => {
+  const pool = mkPool();
+  await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  const update = updatesIn(pool)[0].sql;
+  assert.match(update, /status\s*=\s*'backlog'/i, 'backlog-only, restated in the write');
+  assert.match(update, /task_is_fully_unblocked\s*\(/i, 'dependency doneness, restated');
+  assert.match(update, /task_blockers/i, 'open-blocker guard, restated');
+  assert.match(update, /id = ANY\(/i, 'and narrowed to the candidates it just read');
+});
+
+await test('the guards are in the read as well as the write', async () => {
+  const pool = mkPool();
+  await dbTasks.promoteUnblockedBacklogTasks(pool, {});
+  const select = pool.calls.find((c) => /^\s*SELECT/i.test(c.sql)).sql;
+  assert.match(select, /status\s*=\s*'backlog'/i);
+  assert.match(select, /task_is_fully_unblocked\s*\(/i);
+  // The shared predicate LOST its blocker clause when migration 178 replaced
+  // migration 176's body (verified against production, task 1003934), so the
+  // sweep carries its own rather than inheriting a single point of failure that
+  // has already been reverted once.
+  assert.match(select, /task_blockers/i);
+  assert.match(select, /b\.status\s*=\s*'open'/i);
+});
+
+await test('nothing to do: no candidates means no UPDATE, even armed', async () => {
+  const pool = mkPool({ rows: EXCLUDED });
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.deepEqual(out.candidates, [], 'every fixture row is excluded by a guard');
+  assert.deepEqual(out.promoted, []);
+  assert.equal(updatesIn(pool).length, 0,
+    'an empty candidate set must not issue a write (the idempotent second run)');
+});
+
+// ---------- the sweep + its wiring ----------
+
+await test('runPromotionSweep reports through the injected logger and never throws', async () => {
+  const lines = [];
+  const out = await reconciler.runPromotionSweep({
+    pool: mkPool(),
+    promotionArmed: false,
+    log: (m) => lines.push(m),
+    error: (m) => lines.push(`ERR ${m}`),
+  });
+  assert.equal(out.armed, false);
+  assert.match(lines.join('\n'), /1003930/, 'it names the tasks it would promote');
+  assert.ok(!lines.some((l) => l.startsWith('ERR')), 'a clean run logs no error');
+});
+
+await test('a throwing pool is reported, not propagated (a sweep can never crash the tick)', async () => {
+  const errs = [];
+  const boom = { query: async () => { throw new Error('db exploded'); } };
+  const out = await reconciler.runPromotionSweep({ pool: boom, log: () => {}, error: (m) => errs.push(m) });
+  assert.equal(out.skipped, 'error', 'the failure is returned, not thrown');
+  assert.match(errs.join('\n'), /db exploded/, 'and it says what happened');
+});
+
+await test('the sweep runs on the tick, fire-and-forget like its siblings', async () => {
+  const src = readFileSync(new URL('../modules/lifecycle/publish-reconciler.js', import.meta.url), 'utf8')
+    .replace(/\r\n/g, '\n');
+  assert.match(src, /runPromotionSweep\(deps\)\.catch\(/, 'wired into tick() the way runCriterionSweep is');
+});
+
+// ---------- Summary ----------
+
+console.log('');
+console.log(`promotion-sweep tests: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exitCode = 1;