@bongos/core 1.19.769 → 1.19.771

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.769",
-  "core_contract": "1.19.769",
-  "source_commit": "5552e7252b67cc3192446a9c48ca2cd4faf10368",
+  "core_version": "1.19.771",
+  "core_contract": "1.19.771",
+  "source_commit": "a9e56ee098e0b0c508d92a0f880f18caaf3438da",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T14:54:06.807Z",
+  "built_at": "2026-09-16T15:34:56.672Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2125,
+    "functional_verbatim": 2129,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2633,
-  "tree_sha256": "8c9135931a565436af92fb7fc38953f0bf6b9ca8c6b608b91e9751c88dd62fe0",
+  "file_count": 2637,
+  "tree_sha256": "7e50ea161f2670ff73a230e867e9d1239db16e738ec828b2d86f163c9e44a000",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2502,7 +2502,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "9369c319c356283bdce655d126e78f339c9a329ecefc02d17c2997c45e583475"
+      "sha256": "d74253fcf1963030a0906afaed5ee3069601829fa3de71743ba21dd07ceaca10"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ffaeae011cd55895b3c16a2ee903e0593aa42a22cfceb3307c5228452c737948"
+      "sha256": "6a9f97eefb85c4f420e127512fd07bc00212ebc1fc5f4411f8d2af9253c69641"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3697,7 +3697,7 @@
     {
       "path": "modules/builder-settings/interaction-prefs.js",
       "mode": "0000644",
-      "sha256": "22368cf35709440fb21edf90c9d61ea1f604f386439586745e057f4f4e4b2b88"
+      "sha256": "5405744db59cb4372b818cc207cb6f6e53a760935ddec0ef8811532ce9874b8b"
     },
     {
       "path": "modules/builder-settings/model-alloc-prefs.js",
@@ -4457,7 +4457,7 @@
     {
       "path": "modules/grading/generated-provenance.js",
       "mode": "0000644",
-      "sha256": "b76be7ce89c0b627d4fe14ac031af6d6b7793c25eeef7defb59aa1335f2de982"
+      "sha256": "4bec6214b843daaa61118566e9c4ead8918322303df811f753369fb68c093ed3"
     },
     {
       "path": "modules/grading/grader-config.js",
@@ -7577,12 +7577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "17b6a246e7e14d3949244aff29ed7e63dc5bc5d65a7aeff2a463f8283fa5b4cc"
+      "sha256": "12fe4a7e4e34e534096d540489201021b891700e349dfd55553951e242852665"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "df0b9ff8dceb4cafd08db0a28bcbe92b1cbee04fefe4f811574257af0929901c"
+      "sha256": "2d44d17619572c24cfa4b5758cc3a698b4846bccf935182c979d16934029a9b9"
     },
     {
       "path": "public-docs/index.html",
@@ -8017,7 +8017,7 @@
     {
       "path": "scripts/gds/exec-path-guard.js",
       "mode": "0000644",
-      "sha256": "6250c525e105540d33006b9c7e0335b9045186f7a73b714b359322a2e1ac3394"
+      "sha256": "176e26885f96247bbeec1b04d3a668bbc2fac2d944fc1f1028781241a45d613c"
     },
     {
       "path": "scripts/gds/feedback-latest.js",
@@ -8082,7 +8082,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "4856485e5bb5bb03e47cd6953659c25214411d0b63287f6ab2faa4c34e1e27bc"
+      "sha256": "cf15baceafba3863ffde95d6ee01107faa9d86ae0081d579307c9f49dcf0fdbd"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8149,6 +8149,11 @@
       "mode": "0000644",
       "sha256": "4910f973c926493f1323f9be4a9593ed1596f920dbf9d7f34abce4ff61f1ecad"
     },
+    {
+      "path": "scripts/gds/gen-interaction-posture.js",
+      "mode": "0000644",
+      "sha256": "86c57a2c8e595a2c7283a720ce32192fb3fa1539fa6be152c8349543b1dbb94f"
+    },
     {
       "path": "scripts/gds/gen-repo-map.js",
       "mode": "0000644",
@@ -8924,6 +8929,11 @@
       "mode": "0000644",
       "sha256": "072c493cc549e16c6045abf5bf74a8cfe0004b45844c6f4fe9e846d55d88bf34"
     },
+    {
+      "path": "scripts/gds/stray-unit-sweep.sh",
+      "mode": "0000644",
+      "sha256": "7bc5a6193130085d7faebfb6a71a16b89aa09747f30fdfd612d7cf4c7a1778ff"
+    },
     {
       "path": "scripts/gds/surface.js",
       "mode": "0000644",
@@ -9407,7 +9417,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3237d6ea069eae19ed9baf41a528984e21010defcfc5a0d96d34fd8eeca2fb4a"
+      "sha256": "c14e336beea666e10221a3e524c1db662aa136207564eb3b6742f74d6c12e1c8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11022,7 +11032,7 @@
     {
       "path": "tests/grader_generated_provenance.mjs",
       "mode": "0000644",
-      "sha256": "9c41daaad5111afb380b878cb0d3374d014bbadf5c2dc1e06b8f319712024fc4"
+      "sha256": "1823c173f811d52d93b63201d0ebb0d85f2b1e42a569e6331580ef097f5c05cc"
     },
     {
       "path": "tests/grader_panel.mjs",
@@ -11167,12 +11177,12 @@
     {
       "path": "tests/help_requests.mjs",
       "mode": "0000644",
-      "sha256": "8a4b380ebe8ad5667f20f4f0c21f8870262340e6d0f2aabca36d0737fdc81d1e"
+      "sha256": "e1e1075e2f8ba4b52acba29804e5fd62443b823cfd15d4c50f0a93fcea0d13bd"
     },
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",
-      "sha256": "2c5ffa3ed447fdbbbc1b44e553f493bf05ab2848b154836defe3fe40e1909592"
+      "sha256": "2527e761e86d289bfaf1f0c5bc416762b02c0784f0307fd0f445da656d8db549"
     },
     {
       "path": "tests/hierarchy-config.mjs",
@@ -11384,6 +11394,11 @@
       "mode": "0000644",
       "sha256": "a7e2b9453ea73689e098894b15de8c693b3fa07704b34cb3539f14f0e67ca36c"
     },
+    {
+      "path": "tests/interaction_posture.mjs",
+      "mode": "0000644",
+      "sha256": "b5f865163bd89c12f53d6596bee596146fb81d8f0b152e84ee2ce03b1f12774a"
+    },
     {
       "path": "tests/interaction_prefs.mjs",
       "mode": "0000644",
@@ -12784,6 +12799,11 @@
       "mode": "0000644",
       "sha256": "905b7b9147fa35f74c2c5f4118175ebf96fa36107379207a7a2c59afc5a2967d"
     },
+    {
+      "path": "tests/sql_column_lines.mjs",
+      "mode": "0000644",
+      "sha256": "c68bf3aa9cd886de435293f0a536df8153fcc99187c48097de12c5482b1ee430"
+    },
     {
       "path": "tests/sso_checkin_identity_spoof.mjs",
       "mode": "0000644",
@@ -12907,7 +12927,7 @@
     {
       "path": "tests/task_recommendations.mjs",
       "mode": "0000644",
-      "sha256": "cfce8e24b5844b1720399cc467e89ca457d74dfbf0783ef2a733d433f0443bd8"
+      "sha256": "1c5d35d58371cbde290a3e71e023febeebf350b54031d458c2ebe58f25962aa4"
     },
     {
       "path": "tests/task_visual_route_gate.mjs",

package/docs/file-map.md

@@ -188,6 +188,7 @@
 │       ├── backfill-cost.js     ← read art ledger → POST /api/gds/cost (idempotent)
 │       ├── smoke-write.sh       ← write-path smoke (create→claim→ship round-trip)
 │       ├── backup-dropin-sweep.sh ← (task 1003930) control-plane sweep: retires the temporary task-1003925 backup drop-in from each project whose pinned core carries the fix (1.19.750+), proving one backup succeeds without it first; survey by default, `--apply` to act; re-run after each pin moves
+│       ├── stray-unit-sweep.sh  ← (task 1003939) control-plane sweep: the ledger's torn-down slugs that still have a service/backup unit loaded or on disk (a torn-down project holding memory outside the ADR 0285 count); survey by default, `--apply` disables, removes, reloads, reset-failed's; DB/dumps/checkout/Caddy left alone
 │       ├── smoke-gds.js         ← public-surface + 401-check smoke test (asserts /api/pms/* now 404s — removed in V3.R01-followup #308)
 │       ├── box.js               ← (#598/ADR 0031) per-builder dev box lifecycle CLI: provision·park·wake·deprovision·sweep-idle·sweep-dormant·status (dry-run default, --apply to act; rank-gated)
 │       ├── smoke-box.sh         ← (#598) hermetic box-lifecycle smoke (no DB/DO/network): runs tests/boxes.mjs + tests/cf_tunnel.mjs (#771 named tunnel) + route-rank + module-load

package/docs/module-api-changelog.md

@@ -2012,5 +2012,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.767 with no explicit bump. run 35110800163. (task 1002620)
   1.19.769 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.768 with no explicit bump. run 35111616379. (task 1002620)
+  1.19.770 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.769 with no explicit bump. run 35113578542. (task 1002620)
+  1.19.771 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.770 with no explicit bump. run 35116254725. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/builder-settings/interaction-prefs.js

@@ -68,11 +68,11 @@ const FIELDS = {
     values: {
       new: {
         label: 'New to local tooling (default)',
-        contract: 'Toolchain familiarity: new — walk local tooling (package managers, ports, env vars, shells) through step by step rather than naming a command and moving on. Where a supported UI path exists, give that before the terminal one.',
+        contract: 'Toolchain familiarity: new — walk local tooling (package managers, ports, env vars, shells) through step by step rather than naming a command and moving on. Where a supported UI path exists, give that before the terminal one, and prefer a supported path over a bespoke technical fix they would then have to maintain.',
       },
       comfortable: {
         label: 'Comfortable with local tooling',
-        contract: 'Toolchain familiarity: comfortable — no need to walk through local toolchains (Homebrew, ports, env vars) step by step.',
+        contract: 'Toolchain familiarity: comfortable — no need to walk through local toolchains (Homebrew, ports, env vars) step by step. Still prefer a supported path over a bespoke technical fix unless it genuinely cannot do the job.',
       },
     },
   },

package/modules/grading/generated-provenance.js

@@ -71,6 +71,15 @@ const GENERATORS = [
     verify: '--check',
     owns: [{ file: 'docs/file-map.md', scope: 'fence', marker: 'BEGIN GENERATED FILE-MAP' }],
   },
+  {
+    // task 1002515: the CLAUDE.md §2 fallback posture, generated from the interaction
+    // knob's own defaults. Note CLAUDE.md now carries TWO fences owned by two different
+    // generators — the roster is per-region, not per-file, so each is verified by the
+    // script that actually owns it and everything outside both is graded normally.
+    script: 'gen-interaction-posture.js',
+    verify: '--check',
+    owns: [{ file: 'CLAUDE.md', scope: 'fence', marker: 'BEGIN GENERATED INTERACTION POSTURE' }],
+  },
   {
     script: 'gen-api-docs.js',
     verify: '--check',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.769",
+  "version": "1.19.771",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.769",
+      "version": "1.19.771",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.769",
+  "version": "1.19.771",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/exec-path-guard.js

@@ -76,7 +76,7 @@ const EXEMPTIONS = [
        + 'If that refusal is ever removed this exemption dies with it.',
   },
   {
-    at: 'modules/grading/generated-provenance.js:156',
+    at: 'modules/grading/generated-provenance.js:165',
     why: '`dir` defaults to path.join(__dirname, ..., \'scripts\', \'gds\') — the SERVER\'s own tree — '
        + 'and `script` comes from the module-level GENERATORS table, which holds string literals '
        + 'only. The `scriptDir` seam exists so the unit test never spawns a process and is never '
@@ -84,8 +84,8 @@ const EXEMPTIONS = [
        + 'trusted generator against a suspect tree, which is the inverse of the B50 shape.',
   },
   {
-    at: 'modules/grading/generated-provenance.js:223',
-    why: 'The async twin of the call at :156 — same `dir` default, same literal GENERATORS table, '
+    at: 'modules/grading/generated-provenance.js:232',
+    why: 'The async twin of the call at :165 — same `dir` default, same literal GENERATORS table, '
        + 'same test-only `scriptDir` seam. Listed separately rather than folded in because an '
        + 'exemption is keyed to a line: if one of the two calls changes shape, only that one '
        + 're-opens for review.',

package/scripts/gds/fitness.js

@@ -179,6 +179,16 @@ function checkGeneratedArtifactsFresh() {
   } catch {
     violations.push('The tracked CLAUDE.md §13 recent-sessions snippet is STALE — run `node scripts/gds/gen-session-index.js` and commit (ADR 0062 §8 / ADR 0110). NB docs/session-log-index.md itself is gitignored + deploy-regenerated, not gated here.');
   }
+  try {
+    // task 1002515 (criterion `accessibility-fluency-profile`, clause 2): the CLAUDE.md §2
+    // fallback posture is generated from the interaction knob's own defaults, so the kernel
+    // and modules/builder-settings/interaction-prefs.js cannot drift into two copies of one
+    // rule — which is what they were. Fully tracked (unlike the ADR 0110 pair above), so a
+    // plain --check is the right gate.
+    execFileSync(process.execPath, [path.join(__dirname, 'gen-interaction-posture.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('The CLAUDE.md §2 interaction-posture block is STALE — it is generated from modules/builder-settings/interaction-prefs.js. Run `node scripts/gds/gen-interaction-posture.js` and commit (task 1002515).');
+  }
   try {
     execFileSync(process.execPath, [path.join(__dirname, 'gen-file-map.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
   } catch {
@@ -192,7 +202,7 @@ function checkGeneratedArtifactsFresh() {
   }
   // NB the role packs' responsibility blocks are generated too, but their freshness
   // is asserted by role-pack-guard.js — one check owns "the packs are correct".
-  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus docs/file-map.md skills/scheduled-tasks sections and docs/api/openapi.json + api-reference.md (API). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
+  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus the CLAUDE.md §2 interaction-posture block (the knob defaults), docs/file-map.md skills/scheduled-tasks sections and docs/api/openapi.json + api-reference.md (API). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
 }
 
 // ---- deterministic cron routine boundary (System 4 / ADR 0078) -------------

package/scripts/gds/gen-interaction-posture.js

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+'use strict';
+// gen-interaction-posture.js — the CLAUDE.md §2 communication posture, generated
+// (task 1002515; clauses 2/3/7 of criterion `accessibility-fluency-profile`).
+//
+// WHY. Until this generator, the posture existed TWICE: as hand-written prose in the
+// always-loaded root CLAUDE.md §2, and as the injectable contract fragments in
+// modules/builder-settings/interaction-prefs.js. Two copies of one rule is a drift
+// machine — task 1002514 changed the knob's defaults and §2 did not move, which is
+// exactly the failure clause 2 of the criterion names. Prose that a human keeps in
+// sync with code is prose that will eventually lie.
+//
+// THE FIX, and why a generator rather than a deletion. The obvious move is to delete
+// §2's prose and let the injected profile carry everything. It cannot: the injector
+// (.claude/hooks/conductor.js) relays a profile resolved SERVER-SIDE, so a session
+// with no Bongos session — a fresh clone, an offline checkout, a box that cannot
+// reach the API — receives NOTHING, and deleting the prose would leave exactly the
+// reader the criterion is about with no posture at all. So §2 keeps a fallback, and
+// the fallback is GENERATED from the knob's own defaults: one source of truth, a
+// bounded copy in the kernel, and a CI gate (scripts/gds/fitness.js) that fails the
+// build the moment they disagree.
+//
+// The emitted text is the contract fragments VERBATIM — the same strings a session
+// is handed. Nothing is paraphrased here, because a paraphrase is a second copy
+// wearing a generator's clothes.
+//
+// Zero-dependency and deterministic (no timestamps, no disk scan) — so `--check` is a
+// clean idempotent CI gate, the gen-session-index.js / gen-repo-map.js pattern
+// (ADR 0062 §8, ADR 0063).
+//
+// Usage:
+//   node scripts/gds/gen-interaction-posture.js          # rewrite the CLAUDE.md §2 block
+//   node scripts/gds/gen-interaction-posture.js --check   # write nothing; exit 2 if the block would change
+//   node scripts/gds/gen-interaction-posture.js --print   # print the rendered block (debug)
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
+const { sameContent } = require('./gen-freshness'); // eol-insensitive freshness (CRLF checkouts)
+
+// The SOURCE is core content (the knob ships with Cloud Bongos); the TARGET is the
+// INSTANCE's own always-loaded kernel. Requiring the lib relative to __dirname keeps
+// the source pinned to the core even on a standalone instance where the core lives in
+// node_modules/@bongos/core, while resolveInstanceRoot() puts the block in the host's
+// CLAUDE.md rather than the vendored core's (the task-1002314 trap).
+const prefs = require('../../modules/builder-settings/interaction-prefs.js');
+
+const CLAUDE_PATH = path.join(resolveInstanceRoot(), 'CLAUDE.md');
+
+const BEGIN = '<!-- BEGIN GENERATED INTERACTION POSTURE (scripts/gds/gen-interaction-posture.js — do not hand-edit) -->';
+const END = '<!-- END GENERATED INTERACTION POSTURE -->';
+
+// The fallback posture = every DEFAULT field value's contract fragment, verbatim.
+// A field whose default carries no fragment contributes nothing — the same rule
+// contractFor() applies, so the block can never claim a posture a session is not
+// actually given (today that exemption is `machinery: show`, which means "behave as
+// you otherwise would" and so has no text to state).
+function renderBlock() {
+  const eff = prefs.effectiveProfile({});
+  const bullets = [];
+  for (const field of prefs.FIELD_KEYS) {
+    const fragment = prefs.FIELDS[field].values[eff[field]].contract;
+    if (fragment) bullets.push(`> - ${fragment}`);
+  }
+  return [
+    BEGIN,
+    '**When no profile is injected** (no Bongos session — a fresh clone, an offline checkout), fall back to the knob’s own defaults. Generated from [`modules/builder-settings/interaction-prefs.js`](modules/builder-settings/interaction-prefs.js), so this can never drift from what a session is actually handed:',
+    '',
+    ...bullets,
+    END,
+  ].join('\n');
+}
+
+// Splice the block between its markers. Markers ABSENT → leave the file untouched and
+// say so: an instance whose CLAUDE.md predates this generator (or one that deliberately
+// authored its own §2) must not have a block injected into it at an arbitrary offset.
+function injectBlock(existing, block) {
+  const b = existing.indexOf(BEGIN);
+  const e = existing.indexOf(END);
+  if (b === -1 || e === -1 || e < b) return existing;
+  return existing.slice(0, b) + block + existing.slice(e + END.length);
+}
+
+function computeWrite() {
+  if (!fs.existsSync(CLAUDE_PATH)) return null;
+  const current = fs.readFileSync(CLAUDE_PATH, 'utf8');
+  if (current.indexOf(BEGIN) === -1) return { missingMarkers: true };
+  const next = injectBlock(current, renderBlock());
+  if (sameContent(current, next)) return null;
+  return { full: CLAUDE_PATH, content: next, rel: 'CLAUDE.md' };
+}
+
+function main() {
+  if (process.argv.includes('--print')) {
+    process.stdout.write(renderBlock() + '\n');
+    return;
+  }
+  const write = computeWrite();
+  if (write && write.missingMarkers) {
+    console.error('gen-interaction-posture: WARN CLAUDE.md has no posture markers — skipping injection.');
+    return;
+  }
+  if (process.argv.includes('--check')) {
+    if (write) {
+      console.error('gen-interaction-posture --check: STALE — would update CLAUDE.md');
+      console.error('  run: node scripts/gds/gen-interaction-posture.js  (and commit CLAUDE.md)');
+      process.exit(2);
+    }
+    console.log('gen-interaction-posture --check: up to date.');
+    return;
+  }
+  if (!write) {
+    console.log('gen-interaction-posture: CLAUDE.md posture block already current — no changes.');
+    return;
+  }
+  fs.writeFileSync(write.full, write.content);
+  console.log('gen-interaction-posture: wrote CLAUDE.md');
+}
+
+if (require.main === module) main();
+
+module.exports = { renderBlock, injectBlock, computeWrite, BEGIN, END };

package/scripts/gds/stray-unit-sweep.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# scripts/gds/stray-unit-sweep.sh — find (and with --apply, stop + remove) a project's systemd
+# units that are still on the control plane although its provisioning row is torn down
+# (task 1003939, an ADR 0285 follow-up).
+#
+# WHY. On 2026-09-16 `demo.service` was RUNNING and enabled while the demo row read torn_down:
+# a torn-down project holding ~80 MB on a box whose ceiling is 15 projects, outside the count
+# the ledger keeps. The live MemAvailable floor (task 1003927) covers placement, but the memory
+# is still gone and the unit still restarts on boot. The teardown leg is the fix going forward
+# (task 1003940 added reset-failed); this is the BACKSTOP that finds what an older teardown
+# left behind, from the ledger's own list of torn-down rows, and names it so the ship note can.
+#
+# Run on the control plane as a sudoer:
+#   bash scripts/gds/stray-unit-sweep.sh            # survey only — read-only
+#   bash scripts/gds/stray-unit-sweep.sh --apply    # disable --now, remove the unit files, reload, reset-failed
+#
+# Left in place on purpose, even with --apply: the project's database, its dumps under
+# /var/backups/gds, any checkout, and its Caddy block — data is precious, and the address is
+# task 1002897's to reclaim.
+set -uo pipefail
+
+APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
+DB="${PGDATABASE:-cloudbongos}"
+ETC=/etc/systemd/system
+
+# The torn-down slugs, from the ledger, read as the instance user (peer auth — the runner's
+# own identity; nothing here needs a superuser).
+slugs=$(sudo -n -u lars psql -d "$DB" -tAc "select slug from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+
+found=(); cleared=()
+echo "== torn-down rows that still have systemd units =="
+for slug in $slugs; do
+  # The slug grammar provisioning.isValidSlug enforces; anything else never reaches a command.
+  [[ "$slug" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || continue
+  units="$slug.service $slug-db-backup.service $slug-db-backup.timer"
+  loaded=$(systemctl list-units --all --no-legend $units 2>/dev/null | awk '{print ($1 == "●") ? $2 : $1}' | tr '\n' ' ')
+  files=$(for u in $units; do [ -e "$ETC/$u" ] && printf '%s ' "$u"; done)
+  [ -z "$loaded" ] && [ -z "$files" ] && continue
+  state=$(systemctl is-active "$slug.service" 2>/dev/null || true)
+  printf '  %-24s service=%-9s loaded=[%s] files=[%s]\n' "$slug" "$state" "${loaded% }" "${files% }"
+  found+=("$slug")
+  [ "$APPLY" = 1 ] || continue
+  sudo -n systemctl disable --now "$slug.service" 2>/dev/null || true
+  sudo -n systemctl disable --now "$slug-db-backup.timer" 2>/dev/null || true
+  sudo -n rm -f "$ETC/$slug.service" "$ETC/$slug-db-backup.service" "$ETC/$slug-db-backup.timer"
+  sudo -n systemctl daemon-reload
+  sudo -n systemctl reset-failed "$slug.service" "$slug-db-backup.service" 2>/dev/null || true
+  cleared+=("$slug")
+done
+
+echo "== summary =="
+echo "  stray   (${#found[@]}): ${found[*]:-none}"
+if [ "$APPLY" = 1 ]; then echo "  cleared (${#cleared[@]}): ${cleared[*]:-none}";
+else echo "  (survey only — re-run with --apply to disable, remove and reset-failed them)"; fi
+echo "  MemAvailable: $(awk '/MemAvailable/ {print int($2/1024) " MB"}' /proc/meminfo)"

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.769'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.771'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader_generated_provenance.mjs

@@ -89,13 +89,35 @@ test('an ordinary diff implicates no generator (a normal ship pays nothing)', ()
   assert.deepEqual(prov.generatorsInDiff(null), []);
 });
 
-test('the session-log ship shape implicates exactly gen-session-index.js', () => {
+test('the session-log ship shape implicates gen-session-index.js, and every other owner of that file', () => {
   // This IS the reproducing diff: a new session log + the regenerated §13 block.
+  //
+  // Since task 1002515, CLAUDE.md carries TWO fences owned by two generators (§13's
+  // session snippet and §2's interaction posture), so a diff touching CLAUDE.md
+  // implicates both. That is matching at FILE granularity, and it is deliberate: the
+  // roster has only the changed file NAMES to work from, never the hunks, so it cannot
+  // tell which fence moved. The result is still sound — every claim it makes ("this
+  // region is generator output") is true whether or not that region changed in this
+  // diff, and it is proved by actually running each generator's own freshness check.
+  // What it must never do is claim a region a generator does NOT own, which is what
+  // the per-generator `owned` list below pins.
   const g = prov.generatorsInDiff(['docs/session-logs/2026-08-20-x.md', 'CLAUDE.md']);
-  assert.equal(g.length, 1);
-  assert.equal(g[0].script, 'gen-session-index.js');
-  assert.equal(g[0].verify, '--check-block');
-  assert.deepEqual(g[0].owned.map((o) => o.file), ['CLAUDE.md']);
+  const sessionIndex = g.find((x) => x.script === 'gen-session-index.js');
+  assert.ok(sessionIndex, 'the session-log ship must still implicate its own generator');
+  assert.equal(sessionIndex.verify, '--check-block');
+  assert.deepEqual(sessionIndex.owned.map((o) => o.file), ['CLAUDE.md']);
+  // Every implicated generator must own CLAUDE.md — the diff names nothing else generated.
+  assert.deepEqual(
+    [...new Set(g.flatMap((x) => x.owned.map((o) => o.file)))],
+    ['CLAUDE.md'],
+    'no generator may be implicated for a file this diff did not touch',
+  );
+  // Each fence is verified by the script that actually owns it, never by the other.
+  const markers = g.map((x) => `${x.script}:${x.owned[0].marker}`).sort();
+  assert.deepEqual(markers, [
+    'gen-interaction-posture.js:BEGIN GENERATED INTERACTION POSTURE',
+    'gen-session-index.js:BEGIN GENERATED SESSION-LOG SNIPPET',
+  ]);
 });
 
 test('a docs-only regeneration implicates gen-api-docs.js for each doc it owns that changed', () => {
@@ -125,10 +147,19 @@ test('a PASSING generator check marks its regions verified', () => {
     changedFiles: ['CLAUDE.md', 'docs/session-logs/x.md'],
     run: (script, flag) => { calls.push(`${script} ${flag}`); },
   });
-  assert.deepEqual(calls, ['gen-session-index.js --check-block'], 'runs the generator ONE time, with its own flag');
-  assert.deepEqual(m.verified.map((v) => v.file), ['CLAUDE.md']);
+  // Each implicated generator runs ONCE, with its OWN flag — never another's.
+  assert.deepEqual(calls.sort(), [
+    'gen-interaction-posture.js --check',
+    'gen-session-index.js --check-block',
+  ], 'each generator runs exactly once, with its own flag');
+  assert.deepEqual(m.verified.map((v) => v.file), ['CLAUDE.md', 'CLAUDE.md'], 'one entry per owned REGION, not per file');
+  assert.deepEqual(m.verified.map((v) => v.marker).sort(), [
+    'BEGIN GENERATED INTERACTION POSTURE',
+    'BEGIN GENERATED SESSION-LOG SNIPPET',
+  ]);
   assert.deepEqual(m.unverified, []);
-  assert.deepEqual(m.checked, [{ script: 'gen-session-index.js', verify: '--check-block', ok: true }]);
+  assert.deepEqual(m.checked.map((c) => c.script).sort(), ['gen-interaction-posture.js', 'gen-session-index.js']);
+  assert.ok(m.checked.every((c) => c.ok === true));
 });
 
 test('a FAILING generator check marks its regions UNVERIFIED — suspicion stays where evidence is absent', () => {
@@ -137,9 +168,24 @@ test('a FAILING generator check marks its regions UNVERIFIED — suspicion stays
     run: () => { throw new Error('exit 2'); },
   });
   assert.deepEqual(m.verified, []);
-  assert.equal(m.unverified.length, 1);
-  assert.equal(m.unverified[0].file, 'CLAUDE.md');
-  assert.match(m.unverified[0].reason, /did not pass/);
+  assert.ok(m.unverified.length >= 1);
+  assert.ok(m.unverified.every((u) => u.file === 'CLAUDE.md'));
+  assert.ok(m.unverified.every((u) => /did not pass/.test(u.reason)));
+});
+
+// task 1002515 made CLAUDE.md the first file owned by TWO generators (§13's session
+// snippet and §2's interaction posture). The property that matters is that a co-owned
+// file is judged per REGION: one fence going stale must not vouch for the other, and
+// must not strip the verdict from the one that is genuinely fresh.
+test('a co-owned file keeps its two fences judged separately', () => {
+  const m = prov.verifyGeneratedProvenance({
+    changedFiles: ['CLAUDE.md'],
+    run: (script) => { if (script === 'gen-interaction-posture.js') throw new Error('stale'); },
+  });
+  assert.deepEqual(m.verified.map((v) => v.marker), ['BEGIN GENERATED SESSION-LOG SNIPPET'],
+    'the fresh fence keeps its claim');
+  assert.deepEqual(m.unverified.map((v) => v.marker), ['BEGIN GENERATED INTERACTION POSTURE'],
+    'the stale fence gets none — and the file is not blanket-exempted by its sibling');
 });
 
 test('a clean diff runs NO generator at all', () => {
@@ -154,7 +200,7 @@ test('one generator failing does not taint another that passed', () => {
     changedFiles: ['CLAUDE.md', 'docs/api/openapi.json'],
     run: (script) => { if (script === 'gen-api-docs.js') throw new Error('stale'); },
   });
-  assert.deepEqual(m.verified.map((v) => v.file), ['CLAUDE.md']);
+  assert.deepEqual([...new Set(m.verified.map((v) => v.file))], ['CLAUDE.md']);
   assert.deepEqual(m.unverified.map((v) => v.file), ['docs/api/openapi.json']);
 });
 
@@ -208,8 +254,8 @@ test('the async verifier is what the grade path uses, and it does not block', as
     changedFiles: ['CLAUDE.md', 'docs/api/openapi.json'],
     run: async (script, flag) => { calls.push(`${script} ${flag}`); },
   });
-  assert.deepEqual(calls, ['gen-session-index.js --check-block', 'gen-api-docs.js --check']);
-  assert.deepEqual(m.verified.map((v) => v.file).sort(), ['CLAUDE.md', 'docs/api/openapi.json']);
+  assert.deepEqual(calls.sort(), ['gen-api-docs.js --check', 'gen-interaction-posture.js --check', 'gen-session-index.js --check-block']);
+  assert.deepEqual([...new Set(m.verified.map((v) => v.file))].sort(), ['CLAUDE.md', 'docs/api/openapi.json']);
 });
 
 test('the async verifier runs NOTHING for a diff with no generated file', async () => {
@@ -225,8 +271,8 @@ test('the async verifier marks a rejecting check unverified, and never rejects i
     run: async () => { throw new Error('exit 2'); },
   });
   assert.deepEqual(m.verified, []);
-  assert.equal(m.unverified.length, 1);
-  assert.match(m.unverified[0].reason, /did not pass/);
+  assert.ok(m.unverified.length >= 1);
+  assert.ok(m.unverified.every((u) => /did not pass/.test(u.reason)));
 });
 
 test('both spawns are TIMEOUT-bounded — a generator lives in the tree being graded', () => {
@@ -252,7 +298,7 @@ test('verifyGeneratedProvenance never throws — it degrades to no claim', () =>
   assert.ok(m, 'returns a manifest rather than throwing');
   // A throwing check is a FAILED check, so the region is unverified, not exempt.
   assert.deepEqual(m.verified, []);
-  assert.equal(m.unverified.length, 1);
+  assert.ok(m.unverified.length >= 1, 'every owned region of the file is unverified, none exempt');
 });
 
 test('the shared worker prompt renders a manifest carried on the bundle, and spawns nothing', () => {

package/tests/help_requests.mjs

@@ -10,6 +10,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+import { sqlColumnLines } from './helpers.mjs';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
@@ -127,10 +128,7 @@ test('sub-speciality is deliberately NOT modelled yet', () => {
   // "speciality" anywhere outside a `--` comment and flagged the migration's own
   // COMMENT ON TABLE, which says it is deliberately not modelled. Same
   // over-broad-source-assertion reflex as learning 1000196.
-  const body = sql.slice(sql.indexOf('CREATE TABLE'), sql.indexOf(');'));
-  const columns = body.split('\n')
-    .map((l) => l.replace(/--.*$/, '').trim())
-    .filter((l) => l && !/^(CONSTRAINT|CHECK|\))/.test(l));
+  const columns = sqlColumnLines(sql);
   assert.ok(!columns.some((l) => /special/i.test(l)), `no speciality column: ${columns.filter((l) => /special/i.test(l))}`);
 });
 

package/tests/helpers.mjs

@@ -385,3 +385,39 @@ export function parseInto(host, html) {
     return null;
   });
 }
+
+// The COLUMN LINES of a CREATE TABLE, with SQL line comments removed (task 1003759).
+//
+// Two tests assert "this table has no such column" and must read the COLUMN LIST,
+// not the file: a migration routinely EXPLAINS in a comment that some column is
+// deliberately not modelled, and matching that prose as a violation of the rule it
+// states is the over-broad-source-assertion reflex of learning 1000196.
+//
+// Both had the same strip, and the same bug: `l.replace(/--.*$/, '')`. In JS `.`
+// does not match `\r`, and `$` without the `m` flag matches ONLY end-of-string —
+// so on a CRLF checkout (every Windows clone) the trailing `\r` sits between `.*`
+// and `$`, the match fails, and the comment is NOT stripped. The comment line then
+// reaches the column scan and trips the very assertion it was written to explain.
+//
+// tests/task_recommendations.mjs failed exactly that way on Windows and nowhere
+// else, so CI never saw it and it sat in the local failure baseline being read as
+// environmental noise. tests/help_requests.mjs carried the identical strip and
+// passed only by luck — no comment inside its CREATE TABLE body happened to
+// contain its scanned word.
+//
+// Dropping the `$` is the whole fix: `.*` still stops at the `\r`, the match now
+// succeeds, and the existing `.trim()` removes what is left.
+export function sqlColumnLines(sql) {
+  const text = String(sql || '');
+  const start = text.indexOf('CREATE TABLE');
+  if (start === -1) return [];
+  // End on `\n);` rather than the first `);` — a bare `);` can appear inside a
+  // comment or an earlier statement, which would cut the body short.
+  const endAt = text.indexOf('\n);', start);
+  const body = text.slice(start, endAt === -1 ? undefined : endAt);
+  return body.split('\n')
+    .map((l) => l.replace(/--.*/, '').trim())
+    // CREATE TABLE is dropped too: the slice starts at the header line, so a table
+    // whose NAME contained a scanned word would otherwise read as a column.
+    .filter((l) => l && !/^(CREATE TABLE|CONSTRAINT|CHECK|\))/.test(l));
+}

package/tests/interaction_posture.mjs

@@ -0,0 +1,100 @@
+// tests/interaction_posture.mjs — the generated CLAUDE.md §2 posture block (task 1002515;
+// clauses 2/3/7 of criterion `accessibility-fluency-profile`).
+//
+// THE BUG THIS PINS. The communication posture lived in two places at once: prose in the
+// always-loaded root CLAUDE.md §2, and the injectable fragments in
+// modules/builder-settings/interaction-prefs.js. Task 1002514 changed the knob and §2 did
+// not move — a drift that no check could see, because nothing tied the two together.
+//
+// WHAT IS ACTUALLY ASSERTED, and why it is not just "the generator ran". A freshness gate
+// alone is worthless if the renderer can quietly produce nothing: an empty block matches an
+// empty block, `--check` passes, and the kernel silently loses the posture it exists to
+// carry. So the shape of the block is pinned (a bullet per injecting default, none for the
+// one that carries no text), the text is pinned as VERBATIM (a paraphrase is a second copy
+// wearing a generator's clothes), and the committed CLAUDE.md is pinned against a freshly
+// rendered block so a hand-edit fails here and not only in CI.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const gen = require('../scripts/gds/gen-interaction-posture.js');
+const prefs = require('../modules/builder-settings/interaction-prefs.js');
+// Never `===` on raw file bytes here: the generator renders LF, and a default Windows
+// clone checks CLAUDE.md out as CRLF, so a byte comparison would fail on one OS and pass
+// on the other. gen-freshness.js exists for exactly this (and its header says so).
+const { sameContent } = require('../scripts/gds/gen-freshness.js');
+
+test('the block carries one bullet per DEFAULT value that injects, and none for one that does not', () => {
+  const block = gen.renderBlock();
+  const bullets = block.split('\n').filter((l) => l.startsWith('> - '));
+  const eff = prefs.effectiveProfile({});
+  const injecting = prefs.FIELD_KEYS.filter((f) => prefs.FIELDS[f].values[eff[f]].contract);
+
+  assert.ok(injecting.length >= 3, `the accessible default must inject a posture; got ${injecting.length} field(s)`);
+  assert.equal(bullets.length, injecting.length, 'one bullet per injecting default — no more, no fewer');
+  // The silent default is deliberate (`machinery: show` means "behave as you otherwise
+  // would"), and the block must not invent text for it.
+  assert.ok(prefs.FIELD_KEYS.length > injecting.length, 'the silent default still exists — this test would pass vacuously if it did not');
+});
+
+test('every bullet is the contract fragment VERBATIM — the block paraphrases nothing', () => {
+  const block = gen.renderBlock();
+  const eff = prefs.effectiveProfile({});
+  for (const field of prefs.FIELD_KEYS) {
+    const fragment = prefs.FIELDS[field].values[eff[field]].contract;
+    if (!fragment) continue;
+    assert.ok(block.includes(fragment), `${field}: the block must carry the fragment a session is handed, not a restatement`);
+  }
+});
+
+// Clause 7: "bias toward the supported path over a bespoke technical fix" was encoded in no
+// rule, hook, rubric line or check. It now rides the toolchain knob, so it is injected into
+// every session AND scaled — a newcomer is told why (they would have to maintain it), an
+// expert is told the exception (unless the supported path cannot do the job).
+test('the supported-path bias reaches BOTH toolchain profiles, not just the newcomer', () => {
+  const beginner = prefs.contractFor({});
+  const expert = prefs.contractFor({ interaction: { toolchain_familiarity: 'comfortable' } });
+  assert.match(beginner, /prefer a supported path over a bespoke technical fix/);
+  assert.match(expert, /prefer a supported path over a bespoke technical fix/);
+  assert.ok(gen.renderBlock().includes('supported path over a bespoke technical fix'),
+    'the fallback the kernel carries must state it too — a session with no profile is the reader this clause is about');
+});
+
+test('the committed CLAUDE.md §2 block matches a freshly rendered one', () => {
+  const claude = readFileSync(join(REPO_ROOT, 'CLAUDE.md'), 'utf8');
+  const b = claude.indexOf(gen.BEGIN);
+  const e = claude.indexOf(gen.END);
+  assert.ok(b !== -1 && e > b, 'CLAUDE.md §2 must carry the posture markers');
+  assert.ok(sameContent(claude.slice(b, e + gen.END.length), gen.renderBlock()),
+    'CLAUDE.md §2 is STALE or hand-edited — run `node scripts/gds/gen-interaction-posture.js`');
+});
+
+test('CLAUDE.md expresses the posture through the knob instead of restating it', () => {
+  const claude = readFileSync(join(REPO_ROOT, 'CLAUDE.md'), 'utf8');
+  const b = claude.indexOf(gen.BEGIN);
+  const e = claude.indexOf(gen.END);
+  const handWritten = claude.slice(0, b) + claude.slice(e + gen.END.length);
+  // Clause 2: the kernel must NAME the knob (it named only the wandering one before)...
+  assert.match(handWritten, /interaction profile/i, 'the kernel must reference the knob');
+  assert.match(handWritten, /interaction-prefs\.js|\/settings#interaction/, 'and say where it lives');
+  // ...and must not carry a hand-written second copy of the posture beside the generated one.
+  assert.doesNotMatch(handWritten, /Don't assume software-engineering vocabulary/,
+    'the old §2 prose copy is what drifted — it must not come back outside the generated block');
+});
+
+test('injectBlock replaces only between the markers, and leaves a marker-less file alone', () => {
+  const framed = `head\n${gen.BEGIN}\nold\n${gen.END}\ntail`;
+  const out = gen.injectBlock(framed, `${gen.BEGIN}\nnew\n${gen.END}`);
+  assert.equal(out, `head\n${gen.BEGIN}\nnew\n${gen.END}\ntail`);
+  assert.ok(!out.includes('old'));
+
+  // An instance that authored its own §2 must never have a block spliced in at an arbitrary
+  // offset — the generator declines rather than guessing where it belongs.
+  const bare = '# Some other instance CLAUDE.md\n\nno markers here\n';
+  assert.equal(gen.injectBlock(bare, 'anything'), bare);
+});

package/tests/sql_column_lines.mjs

@@ -0,0 +1,87 @@
+// tests/sql_column_lines.mjs — the CRLF-safe SQL column extractor (task 1003759).
+//
+// THE BUG IT REPLACES. Two tests assert "this table has no such column", and both
+// read the COLUMN LIST rather than the file, because a migration routinely EXPLAINS
+// in a comment that some column is deliberately not modelled — matching that prose
+// as a violation of the rule it states is the over-broad-source-assertion reflex of
+// learning 1000196.
+//
+// Both stripped comments with `l.replace(/--.*$/, '')`, and that is wrong on a CRLF
+// checkout. In JS `.` does not match `\r`, and `$` without the `m` flag matches ONLY
+// end-of-string, so the trailing `\r` sits between `.*` and `$`, the match fails,
+// and the comment survives into the column scan.
+//
+// tests/task_recommendations.mjs failed exactly that way — on Windows only, so CI
+// never saw it and it sat in the local failure baseline being read as environmental
+// noise for weeks. tests/help_requests.mjs had the identical strip and passed purely
+// by luck: no comment inside its CREATE TABLE body happened to contain its scanned
+// word. A guard that works by accident is the thing this file exists to stop.
+//
+// Run:  node --test tests/sql_column_lines.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { sqlColumnLines } from './helpers.mjs';
+
+// The shape that broke: a comment INSIDE the table body naming the very word a
+// caller scans for. Written with explicit \r\n — the whole point is the line ending.
+const CRLF = [
+  'CREATE TABLE lifecycle_task_recommendations (',
+  '  id BIGSERIAL PRIMARY KEY,',
+  "  -- There is NO 'accepted'. Accepting a recommendation is CLAIMING THE TASK,",
+  '  -- so "accepted" would be a second, weaker record of holding work.',
+  '  status TEXT NOT NULL DEFAULT \'open\',',
+  '  CONSTRAINT one_open_pair UNIQUE (from_builder_id, to_builder_id)',
+  ');',
+].join('\r\n');
+
+const LF = CRLF.replace(/\r\n/g, '\n');
+
+test('CRLF: a comment naming the scanned word is stripped, not returned as a column', () => {
+  const cols = sqlColumnLines(CRLF);
+  assert.ok(!cols.some((l) => /accepted/i.test(l)),
+    `comments must not reach the column list, got: ${JSON.stringify(cols)}`);
+});
+
+test('CRLF and LF produce identical column lists — the platform must not matter', () => {
+  assert.deepEqual(sqlColumnLines(CRLF), sqlColumnLines(LF));
+});
+
+test('the real columns survive on both line endings', () => {
+  for (const [label, sql] of [['CRLF', CRLF], ['LF', LF]]) {
+    const cols = sqlColumnLines(sql);
+    assert.ok(cols.some((l) => l.startsWith('id ')), `${label}: id column kept`);
+    assert.ok(cols.some((l) => l.startsWith('status ')), `${label}: status column kept`);
+  }
+});
+
+test('CONSTRAINT / CHECK lines and the closing paren are filtered out', () => {
+  const cols = sqlColumnLines(CRLF);
+  assert.ok(!cols.some((l) => /^CONSTRAINT/.test(l)), 'constraints are not columns');
+  assert.ok(!cols.some((l) => /^\)/.test(l)), 'the closing paren is not a column');
+});
+
+test('a trailing comment on a real column line is stripped, the column kept', () => {
+  const sql = 'CREATE TABLE t (\r\n  id BIGINT, -- accepted is not modelled here\r\n);';
+  const cols = sqlColumnLines(sql);
+  assert.deepEqual(cols, ['id BIGINT,']);
+});
+
+test('the body ends at the closing \\n); — a bare ); inside a comment does not cut it short', () => {
+  // `indexOf(');')` would stop at the comment and hide every column after it.
+  const sql = [
+    'CREATE TABLE t (',
+    '  -- see fn(a); for why',
+    '  keeper TEXT,',
+    ');',
+  ].join('\r\n');
+  assert.ok(sqlColumnLines(sql).some((l) => l.startsWith('keeper')),
+    'a column after a comment containing "};" must still be seen');
+});
+
+test('no CREATE TABLE, empty, and non-string inputs are safe', () => {
+  assert.deepEqual(sqlColumnLines('ALTER TABLE t ADD COLUMN x INT;'), []);
+  assert.deepEqual(sqlColumnLines(''), []);
+  assert.deepEqual(sqlColumnLines(null), []);
+  assert.deepEqual(sqlColumnLines(undefined), []);
+});

package/tests/task_recommendations.mjs

@@ -18,6 +18,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+import { sqlColumnLines } from './helpers.mjs';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
@@ -79,10 +80,7 @@ test('the schema has NO accepted status — accepting is claiming, which lives e
 });
 
 test('the schema carries no transfer column', () => {
-  const body = SQL.slice(SQL.indexOf('CREATE TABLE'), SQL.indexOf('\n);'));
-  const columns = body.split('\n')
-    .map((l) => l.replace(/--.*$/, '').trim())
-    .filter((l) => l && !/^(CONSTRAINT|CHECK|\))/.test(l));
+  const columns = sqlColumnLines(SQL);
   const suspect = columns.filter((l) => /transferred|claimed_by|assigned_to|accepted/i.test(l));
   assert.deepEqual(suspect, [], `no transfer-shaped column: ${suspect}`);
 });