@bongos/core 1.19.756 → 1.19.758

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.756",
-  "core_contract": "1.19.756",
-  "source_commit": "701a77495faed74b1cad4941c564f5a8a1a99158",
+  "core_version": "1.19.758",
+  "core_contract": "1.19.758",
+  "source_commit": "aa7bf913cb3802be5885fed7612f2c25cafc981a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T02:21:20.653Z",
+  "built_at": "2026-09-16T02:42:51.087Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2114,
+    "functional_verbatim": 2115,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2622,
-  "tree_sha256": "0124e1a9cd241c6125c6a7a1351be80d37c9a40ba36c2f2def3ccb768417105c",
+  "file_count": 2623,
+  "tree_sha256": "b18088e92ce27eda1c8bfe22e09c23c33beb4923285dc789628b56a2bfcb6d69",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cbc6427898e270a22852c496e1405b927c41e295a1a8808fb260b4f83f6f6429"
+      "sha256": "3b2e92dec077e82fd9d65127264fa203ed0eb8eb94e42c91559fa7eca4e85c90"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5472,7 +5472,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "2ec7c2bec4ef96b5ded094c69104fc30e53b7659cb2b2444ed4491df3f3836dc"
+      "sha256": "381e3bf734537972e33bc7ca3f23097f3f264f42bf33d29cb0c5378b01459c68"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -7567,12 +7567,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cc3fcdaac4eeb204e96790fe0203978514bb550acc078a68d5577cd02d229f7c"
+      "sha256": "68833951b804e0bd61f70df18a54d9bb6b3c2d2115f6e58f19f2a113e0ab706a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0e01d62b067f43577be10f62f417f36dbdcbadc0ba03d290ba902b9447d9ac34"
+      "sha256": "9e46060372527f559bca75e71439f4c40e326868bc51274a71a258c8c167e693"
     },
     {
       "path": "public-docs/index.html",
@@ -9202,7 +9202,7 @@
     {
       "path": "src/bongos/optimizer.js",
       "mode": "0000644",
-      "sha256": "f1feab040af1d5c5b7cf8a59ea870a04d4305e12d82ba4db7237ab3597a81831"
+      "sha256": "eaa5ba49269f8188222b0c979ea60e05f1e6ddc1a0ba8064f735a3f8ac25e0ce"
     },
     {
       "path": "src/bongos/path-match.js",
@@ -9352,7 +9352,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "9edf07966de8d137ba6d987557bb4a9fefeedd19e640f10302dbfd340e0343f9"
+      "sha256": "f4bba033b2052b61d026682b0a06dd3044d77138e1978ad601060fbebbfdc34d"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9382,7 +9382,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a4071a82922c3333e62a1657f6ce674b19831dbf0152ab3c6c270904193d3f2c"
+      "sha256": "dda37ee6d5df39a520822ad072de3addc0a4cb335e48e82d9fc2f768ee68dfad"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10012,7 +10012,7 @@
     {
       "path": "tests/claimable_blocker_status.mjs",
       "mode": "0000644",
-      "sha256": "6bb10ab7ee346bbe673055e46e9fc53865540157c48c203e57c11ad51ba44336"
+      "sha256": "1aae622cb425a287309bc68f5537d754ff9e31b2c4cd8506c7ec72288da69220"
     },
     {
       "path": "tests/claims_bind_session.mjs",
@@ -10882,7 +10882,7 @@
     {
       "path": "tests/government_parity.mjs",
       "mode": "0000644",
-      "sha256": "0c619508691d41f41b0fbbb1d6939ba9ac7fde2ef4ec08ae7622bfa70bfbf624"
+      "sha256": "0d2df586d3ee58990b611799334e21f59ad69292285a787e776c16ef11c64625"
     },
     {
       "path": "tests/government_principals.mjs",
@@ -12654,6 +12654,11 @@
       "mode": "0000644",
       "sha256": "2396f97cac08f5fd752a73f3728a0ae90807fe7af7fbb5da2340c4436d280f0f"
     },
+    {
+      "path": "tests/single_host_apex_routes.mjs",
+      "mode": "0000644",
+      "sha256": "d6869d2749e06a2c67c280e1800ea5e84eb042542507c684aaf01b3b8d4da12f"
+    },
     {
       "path": "tests/single_host_hall.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1986,5 +1986,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.754 with no explicit bump. run 35047010813. (task 1002620)
   1.19.756 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.755 with no explicit bump. run 35047623582. (task 1002620)
+  1.19.757 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.756 with no explicit bump. run 35048307666. (task 1002620)
+  1.19.758 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.757 with no explicit bump. run 35049006030. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -766,14 +766,48 @@ async function listTasks({ versionId, status, kind, discipline, goalId, createdB
 // it just stops the query's LOCKING from referencing the view relations.
 // If the view bodies change in a future migration, change these in lockstep
 // (or fold back to the views once per-view DDL contention is a solved problem).
+// THE BLOCKER GUARD, spelled ONCE (task 1003913).
+//
+// A task is hidden from the queue only while a blocker on it is still OPEN — not
+// forever because a link row exists. Nothing ever deletes a `task_blockers` row,
+// so the older `NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)`
+// meant that a task which had EVER been blocked vanished from /builder-start the
+// moment its blocker resolved — workable by id, unfindable in the feed, and
+// permanent.
+//
+// Migration core_239 fixed exactly this in the `claimable_tasks` VIEW and the two
+// queries below were missed, because the predicate existed in three spellings and
+// only one of them was a migration.
+//
+// BOTH queries below interpolate this constant — the feed and the session-fit
+// projection, which is the whole point of it being one. The first cut of this fix
+// declared the constant and then hand-copied the clause into SESSION_FIT_SQL
+// anyway, recreating the two-spellings bug inside the file written to remove it.
+// The grader caught it; tests/claimable_blocker_status.mjs now COUNTS the
+// interpolations instead of merely checking that the constant exists.
+//
+// src/bongos/optimizer.js keeps its OWN copy of this text: it inlines the view
+// bodies on purpose (a lock incident, task 2181) and cannot require a module file
+// across the ADR 0083 boundary. It deduplicates within itself the same way.
+//
+// THE LEFT JOIN IS LOAD-BEARING. A legacy markdown-anchor link carries
+// `blocker_ref` with no `blockers` row at all; an inner join would drop it from the
+// NOT EXISTS and silently UNHIDE it. `b.id IS NULL` keeps an unresolvable link
+// blocking, which is the fail-closed arm.
+const OPEN_BLOCKER_GUARD = `
+     AND NOT EXISTS (
+       SELECT 1
+         FROM task_blockers tb
+         LEFT JOIN blockers b ON b.id = tb.blocker_id
+        WHERE tb.task_id = t.id
+          AND (b.id IS NULL OR b.status = 'open')
+     )`;
+
 const CLAIMABLE_SQL = `
   SELECT t.*, pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
     FROM tasks t
    WHERE t.status = 'ready'
-     AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
-     AND NOT EXISTS (
-       SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id
-     )
+     AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'${OPEN_BLOCKER_GUARD}
      AND NOT EXISTS (
        SELECT 1 FROM claims c
          JOIN tasks t2 ON t2.id = c.task_id
@@ -783,8 +817,7 @@ const CLAIMABLE_SQL = `
 const SESSION_FIT_SQL = `
   SELECT t.id,
     CASE
-      WHEN t.automation_tag = 'overnight-safe' AND COALESCE(t.manual_degree, 5) <= 2
-           AND NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)
+      WHEN t.automation_tag = 'overnight-safe' AND COALESCE(t.manual_degree, 5) <= 2${OPEN_BLOCKER_GUARD}
         THEN ARRAY['autonomous','check-in','active']
       WHEN t.automation_tag = 'live-only' OR COALESCE(t.manual_degree, 5) >= 4
         THEN ARRAY['active']

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.756",
+  "version": "1.19.758",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.756",
+      "version": "1.19.758",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.756",
+  "version": "1.19.758",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/optimizer.js

@@ -34,6 +34,24 @@ const { pool } = require('./pool');
 // claimTask / claimTasksBatch will actually allow.
 const { touchesOverlap } = require('./path-match');
 
+// The blocker guard, once (task 1003913). Same predicate as migration core_239
+// and as db-tasks.js's OPEN_BLOCKER_GUARD, deliberately duplicated ACROSS those
+// files — this is core, db-tasks.js is a module, and core may not require module
+// code (ADR 0083). Within THIS file there is no such excuse, so the two inlined
+// view bodies below interpolate one constant.
+//
+// The LEFT JOIN is load-bearing: a legacy markdown-anchor link carries
+// blocker_ref with no blockers row, and an inner join would drop it from the
+// NOT EXISTS and silently unhide it. b.id IS NULL is the fail-closed arm.
+const OPEN_BLOCKER_GUARD = `
+            AND NOT EXISTS (
+              SELECT 1
+                FROM task_blockers tb
+                LEFT JOIN blockers b ON b.id = tb.blocker_id
+               WHERE tb.task_id = t.id
+                 AND (b.id IS NULL OR b.status = 'open')
+            )`;
+
 const VALID_MODES = ['active', 'check-in', 'autonomous'];
 const DEFAULT_MAX_PARALLEL = 3;
 
@@ -58,6 +76,13 @@ async function optimizeSession({ builderId, mode, timeBudgetMin, maxParallel })
   // backend queued an ACCESS EXCLUSIVE DDL on the views and parked every view
   // SELECT behind it. Plan-identical (Postgres inlines simple views); change in
   // lockstep with the views / listClaimableTasks if a migration alters them.
+  //
+  // THAT LOCKSTEP FAILED ONCE, WHICH IS WHY A TEST NOW HOLDS IT (task 1003913).
+  // Migration core_239 added the blocker-STATUS guard to claimable_tasks and both
+  // bodies below kept the old "any link row hides it forever" form, so a task
+  // whose blocker had been resolved stayed invisible here. A comment asking the
+  // next editor to remember is not enforcement: tests/claimable_blocker_status.mjs
+  // now asserts this file, db-tasks.js and the migration carry the same predicate.
   const { rows } = await pool.query(
     `SELECT ct.*, sf.fits_session_modes, sf.credits_per_minute
        FROM (
@@ -65,7 +90,7 @@ async function optimizeSession({ builderId, mode, timeBudgetMin, maxParallel })
            FROM tasks t
           WHERE t.status = 'ready'
             AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
-            AND NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)
+${OPEN_BLOCKER_GUARD}
             AND NOT EXISTS (
               SELECT 1 FROM claims c
                 JOIN tasks t2 ON t2.id = c.task_id
@@ -76,8 +101,7 @@ async function optimizeSession({ builderId, mode, timeBudgetMin, maxParallel })
        JOIN (
          SELECT t.id,
            CASE
-             WHEN t.automation_tag = 'overnight-safe' AND COALESCE(t.manual_degree, 5) <= 2
-                  AND NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)
+             WHEN t.automation_tag = 'overnight-safe' AND COALESCE(t.manual_degree, 5) <= 2${OPEN_BLOCKER_GUARD}
                THEN ARRAY['autonomous','check-in','active']
              WHEN t.automation_tag = 'live-only' OR COALESCE(t.manual_degree, 5) >= 4
                THEN ARRAY['active']

package/src/bongos/serve-internal.js

@@ -492,6 +492,35 @@ function isBuildersHost(req) {
   return cfg !== '' && host === cfg;
 }
 
+// Is this instance served entirely from ONE host — publicOrigin and buildersOrigin
+// the same name (task 1002861)? Then "the builders host" and "the apex" are the same
+// request, isBuildersHost() is true for everything, and the builders rewrite shim has
+// no separate subdomain to root the hall at. Surfaces that only ever live on the apex
+// must therefore be handed through it rather than rewritten under /builders.
+//
+// Compares HOSTS, not origin strings: http vs https, a port, or a trailing slash are
+// all routing-irrelevant here and would each give a false negative on a string compare.
+// Empty on either side is NOT single-host — an unconfigured origin must not silently
+// widen what the shim lets past.
+function singleHostInstance() {
+  let pub = '';
+  try {
+    const po = (branding().domains || {}).publicOrigin || '';
+    pub = po ? new URL(po).host.toLowerCase().split(':')[0] : '';
+  } catch { return false; }
+  const hall = configuredBuildersHost();
+  return pub !== '' && hall !== '' && pub === hall;
+}
+
+// Paths that exist ONLY on the apex and are registered BELOW the builders rewrite
+// shim. Kept as one named predicate so the shim and its audit stay in one place: a
+// future apex-only surface added below the shim belongs here the day it is mounted.
+// `/modules/*` is deliberately absent — it serves on EVERY host and the shim exempts
+// it unconditionally, which is a different rule, not an entry in this list.
+function isApexOnlyPath(p) {
+  return p === '/docs' || p.startsWith('/docs/');
+}
+
 // Mount the internal web surfaces onto `app`, in the exact order server.js used.
 // Call this ONCE, right after app setup (trust proxy etc.) and BEFORE any
 // entrypoint-specific tail (the game static + themed 404 in server.js; the plain
@@ -837,9 +866,34 @@ function mountInternalSurfaces(app) {
     // lets the request reach it.
     //
     // The general hazard: ANY apex-rooted route registered BELOW this shim is
-    // eaten the same way. Today that is this one and the /docs family (idea 529
-    // → task 1002861); /downloads/* dodges it by being registered ABOVE instead.
+    // eaten the same way. The audit for task 1002861 walked every registration
+    // below this point: the complete set is this one and the /docs family
+    // immediately after it. Everything else down there is already /builders-scoped
+    // and passes through untouched, and /downloads/* dodges the problem entirely
+    // by being registered ABOVE the shim (see the note at its own mount).
     if (req.path.startsWith('/modules/')) return next();
+    // /docs is APEX-ONLY, which makes it the opposite case to /modules above, and
+    // the exemption has to be narrower because of it (task 1002861).
+    //
+    // On a SINGLE-HOST instance — publicOrigin === buildersOrigin, e.g. a
+    // demo.<apex> standalone, or any instance whose free-plan TLS can't cover a
+    // two-level builders.<sub>.<apex> — isBuildersHost() is true for the apex
+    // itself (task 1001971 taught it the configured buildersOrigin). So this shim
+    // fires on every apex request and rewrote /docs to /builders/docs, which no
+    // handler matches: GET /docs 404'd at the edge while loopback /docs returned
+    // 200, because a loopback Host matches neither origin. That asymmetry is the
+    // whole bug, and it is why it read as an edge/proxy fault for so long.
+    //
+    // Deliberately NOT a blanket exemption. On a TWO-host instance the builders
+    // subdomain is not supposed to serve /docs at all — the handler's own comment
+    // says the module hosts skip it — and today the only thing actually enforcing
+    // that is this shim, since isModuleSurfaceHost excludes the builders host by
+    // construction (the hall is partitioned out of webSurfaces). Exempting /docs
+    // unconditionally would therefore START serving it on builders.<apex>: a
+    // behaviour change nobody asked for, smuggled in under a 404 fix. Gating on
+    // singleHostInstance() fixes the standalone and leaves two-host routing
+    // byte-identical.
+    if (singleHostInstance() && isApexOnlyPath(req.path)) return next();
     if (req.path === '/builders' || req.path.startsWith('/builders/')) return next();
     // Prefix with /builders so the handlers below match. req.url carries the
     // query string; preserve it. '/' → '/builders/', '/watch' → '/builders/watch'.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.756'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.758'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claimable_blocker_status.mjs

@@ -95,4 +95,110 @@ await test('the feed and the claim path enforce the SAME rule', () => {
     'the by-id claim path checks blocker STATUS, and the view must not be laxer or stricter');
 });
 
+/* ───────────────────────────────────────────────────────────────────────────
+   Task 1003913 — the migration was never the only copy.
+
+   core_239 fixed claimable_tasks and the feed did not move, because the same
+   predicate is written in FOUR more places that no migration touches:
+   CLAIMABLE_SQL and SESSION_FIT_SQL in modules/lifecycle/db-tasks.js, and the
+   two view bodies src/bongos/optimizer.js inlines on purpose (a lock incident,
+   task 2181). Everything above this line passed throughout that bug — the file
+   asserted the migration and then asked db-claims.js one question. So the gap
+   was never the rigour of the assertions, it was their REACH.
+
+   COMMENTS ARE STRIPPED BEFORE SCANNING. db-tasks.js documents the old broken
+   form in prose so the next reader knows what was wrong; a raw-text scan would
+   read that as the bug and red CI on a correct file. (Exactly the defect filed
+   as task 1003832 against government_require_permission.mjs.)
+   ─────────────────────────────────────────────────────────────────────────── */
+
+// Strip // line comments and /* */ blocks, then flatten whitespace, so every
+// assertion below is about code that actually runs.
+const code = (...p) => read(...p)
+  .replace(/\/\*[\s\S]*?\*\//g, ' ')
+  .replace(/^\s*\/\/.*$/gm, ' ')
+  .replace(/\s+/g, ' ');
+
+// The bug, as a pattern: a task_blockers existence check that never looks at the
+// blocker. This is the exact clause core_239 replaced.
+//
+// THE OPTIONAL SPACES AFTER '(' AND BEFORE ')' ARE NOT COSMETIC. The migration
+// writes the clause across lines, so normalising collapses it to "( SELECT"; the
+// JS copies write it on one line as "(SELECT". A pattern pinned to the
+// migration's spacing matched neither JS copy, so this tripwire passed for the
+// whole life of the bug it exists to catch, and only the COUNT assertion below
+// failed when the fix was reverted. Caught by mutating db-tasks.js:791 rather
+// than by reading it.
+const UNGUARDED = /NOT EXISTS \(\s?SELECT 1 FROM task_blockers tb WHERE tb\.task_id = t\.id\s?\)/;
+// The fix, as a pattern.
+const GUARDED = /FROM task_blockers tb LEFT JOIN blockers b ON b\.id = tb\.blocker_id WHERE tb\.task_id = t\.id AND \(b\.id IS NULL OR b\.status = 'open'\)/g;
+
+const RUNTIME = [
+  ['modules', 'lifecycle', 'db-tasks.js'],
+  ['src', 'bongos', 'optimizer.js'],
+];
+
+await test('no RUNNING query still carries the unguarded clause', () => {
+  // The tripwire that would have caught core_239's miss on the day it landed.
+  for (const f of RUNTIME) {
+    assert.doesNotMatch(code(...f), UNGUARDED,
+      `${f.join('/')} hides a task because a link row EXISTS, not because its blocker is open — ` +
+      'the bug core_239 fixed in the view and this copy kept');
+  }
+});
+
+await test('each file declares the guard ONCE and every query it serves USES it', () => {
+  // The assertion this file needed and did not have. Round 1 of this task
+  // declared OPEN_BLOCKER_GUARD in db-tasks.js, interpolated it into
+  // CLAIMABLE_SQL, and then hand-copied the same clause into SESSION_FIT_SQL —
+  // two spellings of one predicate, inside the file written to remove exactly
+  // that. The old check was assert.match on /\$\{OPEN_BLOCKER_GUARD\}/, which is
+  // non-global and therefore satisfied by ONE use. Counting is the whole point.
+  for (const f of RUNTIME) {
+    const src = code(...f);
+    const decls = (src.match(/const OPEN_BLOCKER_GUARD = /g) || []).length;
+    const uses = (src.match(/\$\{OPEN_BLOCKER_GUARD\}/g) || []).length;
+    assert.equal(decls, 1, `${f.join('/')} must declare the guard exactly once`);
+    assert.equal(uses, 2, `${f.join('/')} serves two queries and both must interpolate the guard, not re-type it`);
+  }
+});
+
+await test('the declared guard is core_239-s predicate, verbatim', () => {
+  // One declaration per file, so the files agree with the migration iff each
+  // DECLARATION does. optimizer.js cannot import db-tasks.js across the ADR 0083
+  // boundary, so nothing but this comparison holds the three together.
+  const fromMigration = (body.match(GUARDED) || [])[0];
+  assert.ok(fromMigration, 'core_239 still carries the predicate this pins everything else to');
+  for (const f of RUNTIME) {
+    const decl = (code(...f).match(/const OPEN_BLOCKER_GUARD = `[^`]*`/) || [])[0];
+    assert.ok(decl, `${f.join('/')} declares the guard as a template literal`);
+    assert.ok(decl.includes(fromMigration),
+      `${f.join('/')}'s guard must be core_239's predicate verbatim — a paraphrase is how the next one drifts`);
+  }
+});
+
+await test('the guard actually reaches both composed statements', () => {
+  // Counting interpolations proves the constant is referenced twice; this proves
+  // what those references EXPAND to, which is what Postgres receives.
+  for (const f of RUNTIME) {
+    const raw = read(...f);
+    const gm = raw.match(/const OPEN_BLOCKER_GUARD = `([\s\S]*?)`;/);
+    assert.ok(gm, `${f.join('/')} declares the guard`);
+    const expanded = raw.split('\${OPEN_BLOCKER_GUARD}').join(gm[1]).replace(/\s+/g, ' ');
+    const hits = (expanded.match(GUARDED) || []).length;
+    assert.equal(hits, 3, `${f.join('/')}: one declaration plus two expanded uses`);
+  }
+});
+
+await test('the promotion sweep keeps its own, deliberately different, guard', () => {
+  // PROMOTABLE_BACKLOG_WHERE uses an INNER join + b.status = 'open' on purpose:
+  // it promotes backlog->ready and an unresolvable legacy link must not block
+  // that. Asserted so the sweep above does not "tidy" it into the LEFT form and
+  // quietly change which tasks get promoted.
+  const raw = code('modules', 'lifecycle', 'db-tasks.js');
+  assert.match(raw, /PROMOTABLE_BACKLOG_WHERE/);
+  assert.match(raw, /FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id WHERE tb\.task_id = t\.id AND b\.status = 'open'/,
+    'the sweep resolves the blocker too — it just answers the legacy-link case differently');
+});
+
 summary();

package/tests/government_parity.mjs

@@ -237,6 +237,166 @@ test('B0: every guards note that names a concrete route names one that EXISTS',
     `guards notes point at routes that do not exist — fix the note (or the route), never ignore it:\n  ${dangling.join('\n  ')}`);
 });
 
+// ═══ B0b — a guards note naming a PAGE GATE names a live one, for its own atom ══
+//
+// task 1002878, from idea 1000625 (and independently from the BV1.R107 ship grade's
+// hacker worker). B0 above pins a note that names a ROUTE. A note that names a page
+// GATE was checked by nothing at all, and the `guards` field is the route-to-atom map
+// every migration is instructed to read as authoritative.
+//
+// WHAT WENT WRONG ONCE. page.view.builder's note read 'authenticated hall pages
+// (requireNonXenosPage / requireBuilderPage)'. Those two gates never admitted the same
+// people: requireBuilderPage enforces page.view.public (floor xenos), requireNonXenosPage
+// enforced page.view.builder (floor thetes). Migrating requireBuilderPage onto
+// page.view.builder on the strength of that note would have locked every Xenos out of
+// Work, Settings, pair, atlas, goals, roadmap and task-detail. R107 caught it by hand and
+// used the right atom, so no lockout ever shipped — but the note stayed wrong, and the
+// next reader had no reason to distrust it.
+//
+// This check would have failed on that note the day it was written: requireBuilderPage
+// enforces page.view.public, not page.view.builder, so the pair disagrees mechanically.
+//
+// IT ALSO CATCHES THE STALE HALF. Task 1003450 has since deleted requireNonXenosPage
+// along with /not-ready. A note still naming a gate that no longer exists reads as
+// authoritative and resolves to nothing; an unknown gate name is therefore a failure
+// here, not a skip — failing open is how the first version of this problem survived.
+//
+// PARSED FROM SOURCE, NOT IMPORTED. PAGE_GATES is internal to auth.js's page-gate
+// dispatcher and deliberately unexported. Exporting it so a test could read it would
+// widen the surface of a PROTECTED file (src/bongos/auth.js, group authz) for a test's
+// convenience — the same trade tests/government_protected_surfaces.mjs declines for
+// HARD_FLOOR_GLOBS, and for the same reason.
+// PURE, and split out from the live assertion deliberately. Today's catalog is CORRECT
+// (task 1003450 fixed the one bad note), so a check that only asserts "no problems
+// against the real tree" passes without ever executing the branches that find one — a
+// capture-group swap could make it vacuous forever and nothing would say so. The module's
+// own precedent for a load-bearing invariant is government_ownership_scope.mjs F5–F8,
+// which loads a MUTATED copy to prove each assert actually fires; these two functions are
+// what let this do the same, in the negative tests below.
+function parsePageGates(src) {
+  const block = src.match(/const PAGE_GATES = Object\.freeze\(\{([\s\S]*?)\n\}\);/);
+  if (!block) return null; // caller decides whether an absent table is fatal
+  const out = new Map();
+  // Each entry's own object literal is bounded by [^}]* so the scan cannot run past a
+  // gate that lacks a `permission` key and silently adopt the NEXT gate's. `permission`
+  // is then found ANYWHERE inside that literal rather than assumed to come first —
+  // requireProjectCuratePage already carries a second key, and key order in an object
+  // literal is not a contract anyone maintains.
+  for (const m of block[1].matchAll(/(require[A-Za-z]*Page):\s*Object\.freeze\(\{([^}]*)\}\)/g)) {
+    const perm = m[2].match(/permission:\s*'([^']+)'/);
+    if (perm) out.set(m[1], perm[1]);
+  }
+  return out;
+}
+
+// Any require*Page identifier mentioned anywhere in a guards note, prose included —
+// which is the whole point, since B0's route regex only ever looked at the leading
+// `METHOD /path` and prose went entirely unchecked.
+const PAGE_GATE_RE = /\b(require[A-Za-z]*Page)\b/g;
+
+// The comparison itself. Returns every disagreement plus how many notes participated,
+// so the caller can tell "nothing is wrong" from "nothing was looked at".
+function guardGateProblems(gates, permissions) {
+  const problems = [];
+  let named = 0;
+  for (const p of permissions) {
+    for (const [, gate] of String(p.guards || '').matchAll(PAGE_GATE_RE)) {
+      named += 1;
+      if (!gates.has(gate)) {
+        problems.push(`${p.key}: names '${gate}', which is not a gate in PAGE_GATES — `
+          + 'either the gate was deleted and the note was left behind, or the name is a typo.');
+        continue;
+      }
+      if (gates.get(gate) !== p.key) {
+        problems.push(`${p.key}: names '${gate}', but that gate enforces '${gates.get(gate)}'. `
+          + 'A guards note is the route-to-atom map a migration reads as authoritative, so a '
+          + 'gate listed against the wrong atom is an instruction to gate the wrong audience.');
+      }
+    }
+  }
+  return { problems, named };
+}
+
+test('B0b: a guards note naming a page gate names a live one, for its own atom', () => {
+  const gates = parsePageGates(fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8'));
+  assert.ok(gates, 'could not find the PAGE_GATES table in src/bongos/auth.js — if it '
+    + 'moved or changed shape, teach this test the new one rather than deleting it: it is '
+    + 'the only thing checking that a guards note names a gate that agrees with it.');
+  assert.ok(gates.size >= 4,
+    `fixture sanity: parsed ${gates.size} page gate(s) out of auth.js's PAGE_GATES, and the `
+    + 'table has held at least four since task 1003450 removed the two dead ones. A parse '
+    + 'returning few or none makes every assertion below vacuous.');
+
+  const { problems, named } = guardGateProblems(gates, FLOORED);
+  assert.ok(named >= 1,
+    'fixture sanity: no guards note named a page gate at all. One does today '
+    + '(page.view.government → requireGovernmentPage), so either the note was removed — in '
+    + 'which case delete this floor deliberately — or PAGE_GATE_RE has stopped matching and '
+    + 'this test is now checking nothing.');
+  assert.deepEqual(problems, [],
+    `guards notes disagree with the page gates they name:\n  ${problems.join('\n  ')}`);
+});
+
+// ── B0b negative fixtures — proof the check above can actually FAIL ───────────────
+// The real catalog is correct, so B0b passing proves only that it found no problem, not
+// that it can find one. These replay the HISTORICAL defect verbatim against a synthetic
+// pair, which is the repeatable form of the throwaway probe that was run by hand.
+
+const GATES_FIXTURE = new Map([
+  ['requireBuilderPage', 'page.view.public'],
+  ['requireGovernmentPage', 'page.view.government'],
+]);
+
+test('B0b catches the original defect: a gate listed against the WRONG atom', () => {
+  // page.view.builder's note as it actually stood — requireBuilderPage enforces
+  // page.view.public, so migrating on the strength of it would have locked every Xenos
+  // out of Work, Settings, pair, atlas, goals, roadmap and task-detail.
+  const { problems, named } = guardGateProblems(GATES_FIXTURE, [
+    { key: 'page.view.builder', guards: 'authenticated hall pages (requireBuilderPage)' },
+  ]);
+  assert.equal(named, 1);
+  assert.equal(problems.length, 1);
+  assert.match(problems[0], /names 'requireBuilderPage', but that gate enforces 'page\.view\.public'/);
+});
+
+test('B0b catches a note left pointing at a DELETED gate', () => {
+  // requireNonXenosPage went with /not-ready in task 1003450. A note outliving its gate
+  // reads as authoritative and resolves to nothing, so an unknown name must FAIL here
+  // rather than skip — failing open is how the original problem survived unnoticed.
+  const { problems } = guardGateProblems(GATES_FIXTURE, [
+    { key: 'page.view.builder', guards: 'authenticated hall pages (requireNonXenosPage)' },
+  ]);
+  assert.equal(problems.length, 1);
+  assert.match(problems[0], /names 'requireNonXenosPage', which is not a gate in PAGE_GATES/);
+});
+
+test('B0b stays silent on a note whose gate agrees with it, and on notes naming none', () => {
+  // The permissive half, asserted as deliberately as the strict ones: a correct note and
+  // a prose-only note must BOTH pass, or the check would just be noise someone disables.
+  const { problems, named } = guardGateProblems(GATES_FIXTURE, [
+    { key: 'page.view.government', guards: 'the government pages — /watch (requireGovernmentPage)' },
+    { key: 'page.view.builder', guards: 'nothing in the core today — seeded and attachable' },
+  ]);
+  assert.deepEqual(problems, []);
+  assert.equal(named, 1, 'only the note naming a gate participates');
+});
+
+test('parsePageGates reads permission wherever it sits, and never borrows a sibling gate\'s', () => {
+  // The nit the grade raised: the old inner regex assumed `permission` came first in a
+  // gate's literal. It does today; key order is not a contract. A gate with no permission
+  // key at all must be DROPPED, never silently given the next gate's.
+  const gates = parsePageGates([
+    'const PAGE_GATES = Object.freeze({',
+    "  requireSecondKeyPage: Object.freeze({ deniedTo: '/builders', permission: 'a.b' }),",
+    "  requireNoPermissionPage: Object.freeze({ deniedTo: '/builders' }),",
+    "  requireNormalPage: Object.freeze({ permission: 'c.d', deniedTo: '/builders' }),",
+    '});',
+  ].join('\n'));
+  assert.equal(gates.get('requireSecondKeyPage'), 'a.b', 'permission declared second still reads');
+  assert.equal(gates.has('requireNoPermissionPage'), false, 'a gate with no permission is dropped');
+  assert.equal(gates.get('requireNormalPage'), 'c.d', 'and it did not inherit a sibling\'s');
+});
+
 // ONE-DIRECTIONAL, and deliberately so. A floor STRICTER than the route middleware
 // is legitimate and common: the wall lives in the handler (task.confirm.grade_bypass
 // on an any-builder POST /tasks/:id/confirm; goal.manage.own's owner|manager check;

package/tests/single_host_apex_routes.mjs

@@ -0,0 +1,170 @@
+// tests/single_host_apex_routes.mjs — apex-only routes must survive the builders
+// rewrite shim on a SINGLE-HOST instance (task 1002861).
+//
+// THE BUG. On a single-host standalone (publicOrigin === buildersOrigin, e.g.
+// demo.cloudbongos.com, or any instance whose free-plan TLS cannot cover a
+// two-level builders.<sub>.<apex>) GET /docs returned 404 at the public edge while
+// loopback /docs returned 200 and the files plainly shipped. Since task 1001971
+// isBuildersHost() also returns true when the request host equals the CONFIGURED
+// buildersOrigin — which on a single-host instance is the apex — so the builders
+// rewrite shim fired on every apex request and rewrote /docs to /builders/docs,
+// which no handler matches. A loopback Host matches neither origin, so loopback
+// skipped the shim entirely: that asymmetry is why this read as an edge/proxy
+// fault for months rather than an application routing bug.
+//
+// WHAT THIS PINS, AND WHY IT NEEDS TWO PROCESSES. The fix is deliberately NARROW:
+// the shim hands apex-only paths through only when the instance is single-host. On
+// a TWO-host instance the builders subdomain still must not serve /docs, and today
+// this shim is the only thing enforcing that (isModuleSurfaceHost excludes the
+// builders host by construction, since the hall is partitioned out of webSurfaces).
+// A blanket exemption would quietly START serving /docs on builders.<apex>. Both
+// shapes are therefore asserted, and the instance shape is read from branding at
+// require time, so each shape needs its own process with its own env.
+//
+// Uses node:http, NOT fetch: `Host` is a forbidden header name in the fetch spec,
+// so fetch silently drops the override and every request goes to 127.0.0.1 —
+// which makes a host-routing test pass vacuously and keep passing with the fix
+// reverted (learning 1000264, found the hard way in task 1002848).
+//
+// Run:  node --test tests/single_host_apex_routes.mjs
+
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// Boot serve-internal in a child process so branding() picks up this shape's env.
+// Prints "PORT <n>" and stays up until killed.
+// `express` is required BARE on purpose: a worktree has no node_modules of its own
+// and resolves by walking up to the main checkout, so an absolute path built from
+// ROOT would miss. cwd is ROOT below, which is what that walk-up starts from.
+const SERVER_SRC = `
+  const express = require('express');
+  const { mountInternalSurfaces } = require(${JSON.stringify(path.join(ROOT, 'src/bongos/serve-internal.js'))});
+  const app = express();
+  mountInternalSurfaces(app);
+  const s = app.listen(0, () => console.log('PORT ' + s.address().port));
+`;
+
+const servers = [];
+
+function startServer(env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ['-e', SERVER_SRC], {
+      cwd: ROOT,
+      env: { ...process.env, ...env },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    servers.push(child);
+    let out = '';
+    let err = '';
+    const timer = setTimeout(() => reject(new Error(`server did not start; stderr: ${err}`)), 30000);
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (c) => { err += c; });
+    child.stdout.on('data', (c) => {
+      out += c;
+      const m = out.match(/PORT (\d+)/);
+      if (m) { clearTimeout(timer); resolve(Number(m[1])); }
+    });
+    child.on('error', (e) => { clearTimeout(timer); reject(e); });
+    child.on('exit', (code) => {
+      if (!/PORT \d+/.test(out)) { clearTimeout(timer); reject(new Error(`server exited ${code}: ${err}`)); }
+    });
+  });
+}
+
+after(() => { for (const c of servers) { try { c.kill(); } catch { /* already gone */ } } });
+
+function get(port, p, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body, headers: res.headers }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const SINGLE = { BONGOS_PUBLIC_ORIGIN: 'https://demo.example.com', BONGOS_BUILDERS_ORIGIN: 'https://demo.example.com' };
+const TWO = { BONGOS_PUBLIC_ORIGIN: 'https://example.com', BONGOS_BUILDERS_ORIGIN: 'https://builders.example.com' };
+
+let singlePort;
+let twoPort;
+
+test('boot both instance shapes', async () => {
+  [singlePort, twoPort] = await Promise.all([startServer(SINGLE), startServer(TWO)]);
+  assert.ok(singlePort > 0 && twoPort > 0);
+});
+
+// The harness is only meaningful if the Host header actually reaches the app.
+// Assert that first — otherwise every case below is an apex-vs-apex tautology.
+test('the harness really varies the Host', async () => {
+  const a = await get(twoPort, '/builders/', 'example.com');
+  const b = await get(twoPort, '/builders/', 'builders.example.com');
+  assert.notEqual(a.headers.location, b.headers.location,
+    'the two hosts must route differently, or the Host header is being dropped');
+});
+
+// ---- single-host: the bug ------------------------------------------------
+
+test('SINGLE-HOST: /docs serves on the apex (it used to 404 — the shim ate it)', async () => {
+  const r = await get(singlePort, '/docs', 'demo.example.com');
+  assert.equal(r.status, 200);
+  assert.ok(/redoc|openapi/i.test(r.body), 'the body is the API docs page, not some other handler');
+});
+
+test('SINGLE-HOST: the rest of the /docs family serves too', async () => {
+  for (const p of ['/docs/openapi.json', '/docs/redoc.standalone.js']) {
+    const r = await get(singlePort, p, 'demo.example.com');
+    assert.equal(r.status, 200, `${p} must serve on a single-host apex`);
+  }
+});
+
+test('SINGLE-HOST: /docs/openapi.json is still the spec, not a rewritten page', async () => {
+  const r = await get(singlePort, '/docs/openapi.json', 'demo.example.com');
+  const spec = JSON.parse(r.body);
+  assert.ok(spec.openapi.startsWith('3.'), 'a real OpenAPI document');
+});
+
+test('SINGLE-HOST: the hall still works — the exemption did not disable the shim', async () => {
+  // The whole point of the shim on this host is that / serves the hall. If the
+  // exemption were written too broadly it would stop rewriting everything.
+  const r = await get(singlePort, '/', 'demo.example.com');
+  assert.ok(r.status === 200 || r.status === 301 || r.status === 302,
+    `the hall root must still resolve (got ${r.status})`);
+});
+
+test('SINGLE-HOST: a /docs lookalike is NOT exempt', async () => {
+  // '/docsomething' must not escape the shim — it is neither /docs nor under /docs/.
+  const r = await get(singlePort, '/docsomething', 'demo.example.com');
+  assert.notEqual(r.status, 200, 'only /docs and /docs/* are apex-only exemptions');
+});
+
+// ---- two-host: unchanged -------------------------------------------------
+
+test('TWO-HOST: /docs serves on the apex, as it always did', async () => {
+  const r = await get(twoPort, '/docs', 'example.com');
+  assert.equal(r.status, 200);
+});
+
+test('TWO-HOST: /docs still does NOT serve on builders.<apex> — no smuggled change', async () => {
+  const r = await get(twoPort, '/docs', 'builders.example.com');
+  assert.equal(r.status, 404,
+    'a blanket exemption would have started serving /docs here; the fix is gated on single-host');
+});
+
+test('TWO-HOST: module assets still serve on BOTH hosts (task 1002848 stays fixed)', async () => {
+  // /modules/ is exempt unconditionally — a different rule from the apex-only list,
+  // and this pins that the two rules did not get conflated.
+  const p = '/modules/hall-ui/public/atlas.css';
+  assert.equal((await get(twoPort, p, 'example.com')).status, 200);
+  assert.equal((await get(twoPort, p, 'builders.example.com')).status, 200);
+});