@bongos/core 1.19.817 → 1.19.818

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.817",
-  "core_contract": "1.19.817",
-  "source_commit": "2cd2ebaa97da0505de1aa9f67f9c0448f99fb48d",
+  "core_version": "1.19.818",
+  "core_contract": "1.19.818",
+  "source_commit": "7f98428f5e6532100482d729716d92638bee2eb5",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T08:31:54.468Z",
+  "built_at": "2026-09-17T08:43:53.963Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 489,
+    "docs_redacted": 490,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2217,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2732,
-  "tree_sha256": "0b07201d08f28e66901393208deb86879c60a66d8729e32a7dd7da80ffdd7aef",
+  "file_count": 2733,
+  "tree_sha256": "35b8712820d4287686e4a01a9a497c386fd32f24a5109b691a39892d4aeaa964",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1974,10 +1974,15 @@
       "mode": "0000644",
       "sha256": "4e6d5268c58e905c86acc1bbd4c66778e3695ecd37cbc1c9e0f1448cd67f26a9"
     },
+    {
+      "path": "docs/adr/0298-the-reader-lens-is-advisory-and-waits-on-a-voice-guide.md",
+      "mode": "0000644",
+      "sha256": "8fcac086f276e57b59ba635cdf34600bf78bfb69d80177d43065dfc6776b0611"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "9e305c448d390efbfd7f4b5521284a8dc452d43a106d4686a0176433e2d1a3a7"
+      "sha256": "14c4e2e04bba4a0438375364a88e41eca44983ab0fb2c3ecd13bf0190f0ad151"
     },
     {
       "path": "docs/api-reference.md",
@@ -2542,7 +2547,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7311b40a7f58f9a8e6467a1e97a51154c728ba9e91c1486cd06bd5b1b388371d"
+      "sha256": "0b561d6587c66805edf357a97265aa313ab4cf1610e23c63efbb30fc0f1fdf78"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5497,7 +5502,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "0f7c3c6b75216ddca36d49e9a112fce98de2e4123e9756879ba51b44b77c0f06"
+      "sha256": "acc9cf557aabc3fe10efc8c7272162cf288428e8077a24f5df06648e30881337"
     },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
@@ -5917,7 +5922,7 @@
     {
       "path": "modules/lifecycle/tests/cascade.mjs",
       "mode": "0000644",
-      "sha256": "84deb32ae65e5b6ea1dca1e3a1a8ea6ed3d0ba113cae9dfe13a04893e47fed3d"
+      "sha256": "0734ad734ac5ef05c86fa81493c12fed08ffe421781d9ceeebe413c876bf9cf1"
     },
     {
       "path": "modules/lifecycle/version-autoclose.js",
@@ -7797,12 +7802,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "73cd517987ad21a5984113cb38b81cd9221d3247574a773a5f8d1f47a9908921"
+      "sha256": "c314948249345b2ef9e9c43e7dc32287f3901882cbc0c4d51a475d568ed0fb76"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1243bf07a179e236a3e11fd4d64c5c4545609883f59448022ac9d36901d9eaca"
+      "sha256": "8be1abd0cb53633278698edda8b8b78edf57224e89eb3b08806ede49014dab6d"
     },
     {
       "path": "public-docs/index.html",
@@ -8512,7 +8517,7 @@
     {
       "path": "scripts/gds/linkify-refs.js",
       "mode": "0000644",
-      "sha256": "40b8eff40117c1e62025c83afa1a3cfb91919935701b13b29b0b335c3f2ef323"
+      "sha256": "16e9c92e2466f92de1339eac911193807678c4c7d2c6b837ecd1195c102ebf56"
     },
     {
       "path": "scripts/gds/lint-infra-exec.js",
@@ -8827,7 +8832,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "c7ea33433208b0835808028fb81853509d97331b919a70314e1a02718e8ca0c0"
+      "sha256": "be80f6ea38abdbc71f5f718b51db9a54b931745859e885ea1a97ff9465a81596"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -9692,7 +9697,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "36b08b101d2abb1c85207dedcc0ff4f6893496731afb19b10e6c4680c1c303c4"
+      "sha256": "d26e3a559beac4c6431a5cf5476c7a0976798ec8b9174814c06f7d64fd1f6f91"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11867,7 +11872,7 @@
     {
       "path": "tests/linkify_refs.mjs",
       "mode": "0000644",
-      "sha256": "f4e905823f8c3b7f540d3dbc6a9873198a26e022810b21194b2ae45ef9437954"
+      "sha256": "d072512abdd464716a6880a528da08bc3abb06fd7c69d59d075a699c665229a8"
     },
     {
       "path": "tests/live_channel.mjs",

package/docs/adr/0298-the-reader-lens-is-advisory-and-waits-on-a-voice-guide.md

@@ -0,0 +1,121 @@
+# ADR 0298 — The grader gets a reader lens: advisory, scoped to copy-bearing diffs, and it waits on a written voice
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1003937](https://cloudbongos.com/builders#/task/1003937) (goal 1000095 — Working area 6, the artist experience)
+
+**Related:** [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md) (the artist holds a deploy, never a ship) · [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) (a cascade is a row, not a runner edit) · [ADR 0024](0024-multi-agent-system-architecture.md) (the panel) · [ADR 0233](0233-a-copy-proposal-is-a-task-carrying-a-patch.md) (there is no live CMS)
+
+## Context
+
+Every artist review the cascade files opens with the same instruction:
+
+> STEP 1 — REVIEW THE GRADER, not only the work. Read how the grader judged task N's copy
+> and visuals, and coach it: where was it right, and where did it miss what an artist would
+> catch? … this step is the one that compounds.
+
+It cannot be followed, and [task 1003937](https://cloudbongos.com/builders#/task/1003937)
+established why across four reviews worked on 2026-09-15 — 1003621 (of
+[task 1003583](https://cloudbongos.com/builders#/task/1003583)), 1003831 (of
+[task 1003761](https://cloudbongos.com/builders#/task/1003761)), 1003833 (of
+[task 1003828](https://cloudbongos.com/builders#/task/1003828)) and 1003836 (of
+[task 1003829](https://cloudbongos.com/builders#/task/1003829)). The grade itself reads back
+fine; `GET /tasks/:id?include=grade` returns scores, verdict, rubric and per-worker notes. The
+problem is what comes back. `modules/grading/grader-rubric.json` v4.0 runs four lenses:
+
+| worker | judges |
+|---|---|
+| `narc` | semantic completion — description vs diff |
+| `quality` | code quality (idiom, dead code, tests) + economy |
+| `hacker` | security red-team |
+| `efficiency` | runtime cost, hot paths |
+
+None of them reads a sentence for whether it is true, clear, in the project's voice, or worth
+a person's attention. There is no axis an artist can coach. All four graded tasks passed, and
+all four deserved to pass on the axes that were measured — the gate is not too lenient, it is
+not pointed at this.
+
+**One partial mechanism already exists, and its limit is the shape of the gap.**
+`modules/grading/grader-prompt.js` injects the craft's written responsibility into the panel
+prompt — *"No slop in the appearance and text of the project; the story, emotion and ideology
+of the project are communicated effectively; project purpose and gravitas are upheld"* — but
+only when `task.discipline === 'artist'`. All four graded tasks were engineer ships. So the
+unjudged case is exactly **copy shipped by someone whose craft is not the copy**, which is
+most of it.
+
+## Decision
+
+A fifth panel worker — the **reader** — scoring a copy/voice axis. Three things were open;
+the owner settled all three on 2026-09-17.
+
+### 1. It runs on copy-bearing diffs only, not on every ship
+
+The panel already runs four subagents per ship. A fifth on every ship is a standing spend
+increase on the large majority of ships that change no visible string.
+
+The predicate is not new work: `hasCopyOrVisualWork(task)` in `modules/lifecycle/cascade.js`
+already decides, for the artist-review cascade, whether a shipped task put copy or visuals in
+front of a person — `source === 'copy-proposal'`, `discipline === 'artist'`, or a
+`module_key` in the explicit `COPY_VISUAL_MODULES` set. **The reader lens keys off the same
+predicate.** One definition of "this ship is copy-bearing", used by both the after-the-fact
+review and the at-ship lens, so the two can never disagree about what they cover. Widening
+that set widens both at once, deliberately.
+
+Where the predicate says no, the panel is exactly what it is today and costs exactly what it
+costs today.
+
+### 2. It is advisory — findings, never a verdict
+
+The reader records `issues[]` and a `copy_score`. It **cannot** verdict `fail`, and it cannot
+drag the panel to `concerns`.
+
+This is not caution, it is [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md)
+applied as written. That ADR settled that an artist's judgement may hold a **deploy**, decided
+per project, and never a **builder's ship** — after ADR 0162 retired review gates for stranding
+graded-PASS work. A reader worker that could verdict `fail` would put an artist-shaped
+judgement back on the ship path, which is the precise thing 0241 removed. Gating it would
+require amending 0241 first, and nothing here justifies that.
+
+Advisory is also what makes STEP 1 answerable: the artist's review reads the reader's findings
+and coaches *them*, which is a real conversation with a real counterpart, rather than coaching
+four lenses that were never looking.
+
+### 3. It waits on a written voice, and does not ship before one exists
+
+A copy lens needs a standard to judge against or it is a second model's taste wearing a
+score. The instance's voice is, today, almost entirely unwritten:
+
+| source | what it actually carries |
+|---|---|
+| `DESIGN.md` | one hard copy rule — no em/en dash in visible copy, no emoji |
+| `config/branding.neutral.json` | a tagline and a handful of fixed strings |
+| `docs/copy-registry.json` | which 1,860 strings exist — not what good is |
+| `src/role-responsibilities.js` | one sentence, and it only reaches artist-discipline ships |
+
+So the build order is fixed: **voice guide first, reader second.** The reader worker is not
+started until the guide is written, and the guide is the artist's own work, not an agent's
+draft of it. A lens built against the four rows above would be recording opinions and calling
+them findings, and that residue would be worse than the silence it replaced — a score nobody
+can appeal to a standard is harder to remove than a missing score.
+
+### 4. Until the reader exists, the cascade brief says something an artist can do
+
+STEP 1 stays — the instinct behind it is right and this ADR is the proof that it compounds —
+but it stops asking for coaching that has no recipient. In the interim it asks the artist to
+record *where the grade missed what an artist would catch*, naming that the record is the
+evidence this lens is being built from. That is followable today, it produces exactly the
+corpus the voice guide needs, and it converts back into true coaching the moment the reader
+lands.
+
+## Consequences
+
+- `modules/lifecycle/cascade.js` — STEP 1 rewritten to an instruction that can be carried out,
+  pointing at this ADR. No change to the predicate, the trigger, the anti-recursion guard, or
+  the fact that the review blocks nothing.
+- Two follow-up tasks are filed at `backlog`, in order, with the dependency edge wired:
+  [task 1003976](https://cloudbongos.com/builders#/task/1003976) — the **voice guide** (artist) —
+  then [task 1003977](https://cloudbongos.com/builders#/task/1003977) — the **reader worker**
+  (engineer, `depends_on` 1003976, so it cannot reach `ready` until the guide ships).
+  Neither is started by this ADR.
+- The rubric, the active panel, and every existing worker are untouched. No ship's cost or
+  verdict changes as of this decision.
+- If the voice guide is never written, the reader is never built, and STEP 1 is still honest —
+  which is the outcome this ADR is careful to leave standing rather than forcing.

package/docs/adr/README.md

@@ -389,3 +389,4 @@ This keeps the decision history honest and traceable.
 | 0295 | [**The registry is the witness the publish lane cannot be** ([task 1003916](https://cloudbongos.com/builders#/task/1003916), goal 1000090). On 2026-09-13 eight publish runs failed over three hours and NOTHING reported it; it was found by a person idly reading the npm version list. Task 1003914 fixed the lossiness and left the silence, which is structural: a failed run is one red row nobody watches, `main` self-heals on the next merge and **erases the evidence**, and the lane's own verdict step writes to a job summary no one reads. Same shape as the nightly upgrade sweep that died reporting `failed=0`. **Decision: a separate reader compares what the lane ANNOUNCED (release commits) against what the registry HOLDS**; the difference is a phantom. The publisher infers from git because OIDC trusted publishing carries no read credential — **that never bound a reader**, and since task 1003872 the package is public, so an anonymous read needs none. Keeping witness and publisher separate IS the point. Daily not hourly (billable minutes, against a failure measured in hours), cadence pinned to the cron by `routine-schedule.js`; deliberately NOT on the session-start path (a third-party call behind a hook timeout). Healthy days are SILENT in Discord — findings to stdout, the all-clear to stderr — because a channel of reassurances stops being read. Two false-alarm sources, each guarded: a closed incident is permanent history (a 3-day window, by TIME not commit count, which a release burst would outrun), and **npm acknowledges a publish before its listing shows it** — found by RUNNING the check, which flagged 1.19.794 fifteen minutes after a publish whose log ended `published @bongos/core@1.19.794` and whose per-version endpoint answered 200; hence a 30-minute grace period plus per-version confirmation, with the listing only ever nominating suspects. A failed read throws rather than reading as "nothing missing". Proven by replaying the REAL outage from git + the live registry, not a synthetic failure. Does NOT detect a lane that stopped being triggered.](0295-the-registry-is-the-witness-the-lane-cannot-be.md) | release / observability |
 | 0296 | [**A role speciality is data over three existing surfaces, not a fourth mechanism** ([task 1003855](https://cloudbongos.com/builders#/task/1003855), goal 1000095). A craft says HOW you work; nothing said what you work ON. A speciality is a named bundle of knowledge, skills and an interaction contract sitting under a craft — an ideator with an Economics speciality. **Decision: it is DATA, not an ADR 0083 code module** — a subject-matter expert authors one, and requiring them to ship a package puts the mechanism out of reach of exactly the person it exists for. It layers over three surfaces that already exist (discipline-modes.json, the `behavior_prefs.interaction` contract path, the manifest contribution seam); only the knowledge bundle is new. The contract **rides the existing GET /me -> Conductor injection path rather than adding a second one**, and is CRAFT-SCOPED: the hook injects only the contract matching the claim in hand (which needed `t.discipline` on the active-claims read), and with no claim there is no craft and **nothing is injected** — silence beats guessing which expertise applies. Training is two-fold per the owner's 2026-09-17 ruling: documents they supplied, plus learnings captured from sessions worked in it (pointing at existing `learnings` rows, never a second corpus). The corpus is **inventoried, never inlined** — a document may run to 100k chars — so `speciality_documents` joins the recall ingester, because otherwise the contract's "search it with /recall" is a lie whose failure is silent. **`sellable` is recorded with no storefront behind it**: ADR 0107 defers the marketplace and explicitly rejected building one, so the flag captures the owner's decision when they make it and grants nothing — a deliberate partial implementation, recorded rather than silently made. Index scoping errs toward UNDER-sharing: only a public speciality's documents are corpus-wide, because `project` names a set the index cannot express.](0296-a-role-speciality-is-data-over-three-existing-surfaces.md) | roles / modules |
 | 0297 | [**A task’s creator may retire it, and that is the ownership axis’s first route** ([task 1002443](https://cloudbongos.com/builders#/task/1002443), goal 1000095 — owner request 2026-07-25: *"the creator of that task should be able to abandon that task directly inside of the UI"*). Attribution itself shipped earlier and elsewhere (`core_227`, [task 1003278](https://cloudbongos.com/builders#/task/1003278)); what had not moved is that **retiring a task was a rank power and nothing else** — `task.abandon` floors at `metic` (ADR 0152), so a sub-Metic builder could file a task and then could not withdraw their own proposal. The model already had the vocabulary and had never used it: ADR 0151 §3 defines an **ownership axis** where a `scope:'own'` key authorizes nothing until a handler supplies the row's owner, R100 made `requirePermission` refuse such a key outright so `.own` can never degrade into `.any`, and it recorded that **zero call sites passed one**. This is that axis’s first real consumer. **Decision: two authorities, only one rank-shaped** — `task.abandon` (metic, any task) OR new `task.abandon.own` (xenos, a task you created, while it is still backlog/ready/blocked). Route becomes `requireBuilder` + an in-handler decision (the `POST /goals/:id/members` shape), pin `metic+archon`→`any-builder` so it now catches an accidental **tightening** as loudly as a gate removal. **The two facts resolve in two places on purpose:** the RANK fact is request-scoped and resolves before the transaction (uncached, ADR 0016); the OWNER fact is a column that can change under us, so `created_by` joins `abandonTask`’s existing `FOR UPDATE` SELECT and a new optional `authorize` callback decides under that lock. Reading `created_by` in the route would be a TOCTOU window; resolving permissions inside the transaction would hold a row lock across a second pool acquire. The decision is a PURE module (`abandon-authz.js`, the `goal-route-authz.js` precedent) so every branch is pinned DB-free and the hall hint and server verdict provably read one rule. **A creator’s window stops at the grader** — completed/confirmed stay cross-owner, because past the grader a retire is a ledger correction, not an author changing their mind; nothing is subtracted from `task.abandon`, pinned by a test. `counterpart: ['task.abandon']` is declared not derived, verb `act` not `manage` — `manage` would silently dominate every future narrower `task.*.own` key (the verb-blind escalation task 1003195 closed). **A null creator belongs to nobody and that is load-bearing:** ~1,357 pre-`core_227` tasks plus seed/restock/discord vectors are unattributed, so the owner comparison is the government resolver’s own — injected, never re-implemented, since a duplicated ownership comparison is how one quietly widens — and one slip would open every historical task to a xenos grant at once. Fail-closed throughout: a missing `government` port, a throwing resolver, and anything but an explicit `{ok:true}` all deny, and `authorize` runs BEFORE the idempotent already-abandoned return and the shipped/active-claim guards so an unauthorized caller cannot probe a row through a 200. No guard removed. Does NOT widen edit/promote/dependency (still Metic), does not touch `task.merge`, and does not backfill attribution — the control simply does not appear on tasks predating `core_227`.](0297-a-tasks-creator-may-retire-it.md) | authority / lifecycle / ownership |
+| 0298 | [**The grader gets a reader lens: advisory, scoped to copy-bearing diffs, and it waits on a written voice** ([task 1003937](https://cloudbongos.com/builders#/task/1003937), goal 1000095 — Working area 6; owner decision 2026-09-17). Every artist review the cascade files opened with *“REVIEW THE GRADER … coach it”*, and it could not be followed: the v4 panel runs narc, quality, hacker and efficiency — completion, code quality, security, runtime cost — and not one of them reads a sentence for whether it is true, clear, in the project’s voice or worth a person’s attention. Four consecutive reviews hit the same wall and all four graded ships deservedly PASSED on the axes that were measured; the gate is not lenient, it is not pointed at this. `grader-prompt.js` already injects the craft’s written responsibility, but only when `discipline === ‘artist’`, so the unjudged case is copy shipped by someone whose craft is not the copy. **Decision: a fifth ADVISORY `reader` worker, on three settled terms.** It runs only where `modules/lifecycle/cascade.js`’s existing `hasCopyOrVisualWork` says the ship is copy-bearing — the same predicate the after-the-fact review uses, so the two can never disagree about coverage, and every other ship costs exactly what it costs today. It records `issues[]` and a `copy_score` and can never verdict `fail` or drag the panel to `concerns`, because [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md) put the artist’s judgement on the DEPLOY and off the ship path; gating would need that ADR amended first. And it is NOT BUILT until the instance writes a voice guide — today the whole written standard is one dash rule in `DESIGN.md`, a tagline, a registry of which 1,860 strings exist, and one responsibility sentence, so a lens built now would record taste and call it a finding. Until the reader exists, STEP 1 asks the artist to WRITE DOWN what the grade could not see rather than to coach a lens that is not listening — followable today, and the corpus both the guide and the lens get written from. Nothing in the rubric, the active panel or any existing worker changes.](0298-the-reader-lens-is-advisory-and-waits-on-a-voice-guide.md) | grading / the artist’s loop / voice |

package/docs/module-api-changelog.md

@@ -2107,6 +2107,8 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.816 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.815 with no explicit bump. run 35198566737. (task 1002620)
   1.19.817 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.816 with no explicit bump. run 35200117750. (task 1002620)
+        landed since 1.19.816 with no explicit bump. run 35200401779. (task 1002620)
+  1.19.818 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.817 with no explicit bump. run 35201213516. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/cascade.js

@@ -131,18 +131,31 @@ function hasCopyOrVisualWork(task) {
   return false;
 }
 
-// The two-step artist review body. STEP 1 coaches the grader (the artist trains
-// the grading system, not only the artefact); STEP 2 remakes the copy/visuals
-// with both routes explicitly offered — R04's brief, verbatim in intent.
+// The two-step artist review body. STEP 1 records where the grade was blind;
+// STEP 2 remakes the copy/visuals with both routes explicitly offered — R04's
+// brief, verbatim in intent.
+//
+// STEP 1 used to say "coach the grader", and for as long as that was the wording
+// it asked for something no artist could do (task 1003937, ADR 0298). The panel's
+// four lenses — narc, quality, hacker, efficiency — read completion, code quality,
+// security and runtime cost; not one of them reads a sentence, so there was no
+// counterpart to coach and four consecutive reviews found the same wall. The
+// ADR's decision is a fifth ADVISORY 'reader' lens, scoped to copy-bearing diffs
+// by this file's own hasCopyOrVisualWork, built only after the instance writes a
+// voice guide to judge against. Until it exists the step asks for the RECORD
+// instead of the coaching: followable today, and it is the corpus both the guide
+// and the lens will be written from. When the reader lands, this reverts to
+// coaching a lens that is actually listening — and the wording is the signal for
+// which of those two worlds we are in, so do not restore the old sentence early.
 function artistReviewBody(task) {
   return [
     `This is an ARTIST REVIEW, generated automatically because task ${task.id} put copy or visuals in front of a person. It is a REQUEST, not a gate — it blocks nothing that shipped, and triage may dismiss it.`,
     '',
-    `STEP 1 — REVIEW THE GRADER, not only the work. Read how the grader judged task ${task.id}'s copy and visuals, and coach it: where was it right, and where did it miss what an artist would catch — slop, an off-voice line, a claim that does not land, a visual that reads as generated? The artist trains the grading system, not just the artefact, so this step is the one that compounds.`,
+    `STEP 1 — READ THE GRADE, AND WRITE DOWN WHAT IT COULD NOT SEE. Pull how the grader judged task ${task.id} (GET /tasks/${task.id}?include=grade), then record what an artist would have caught and no lens did: slop, an off-voice line, a claim that does not land, a visual that reads as generated. Do not expect to find a copy verdict to argue with — the panel's four lenses read completion, code quality, security and runtime cost, and none of them reads a sentence (ADR 0298). Your record IS the compounding part: it is the evidence the advisory 'reader' lens is being built from, and the corpus the voice guide it waits on will be written against.`,
     '',
     'STEP 2 — REMAKE OR TWEAK the copy/visuals if they need it. Your choice of route, both offered on purpose: OUTSIDE the AI chat (edit the surface directly and land it through the copy desk or the normal pipeline), or WITH it (draft in chat, then land). Either way it lands as a claimed, graded, shipped task like everything else — there is no live CMS (goal 1000074\'s hard rule).',
     '',
-    'If the copy and visuals are fine and the grader judged them well, DISMISS this in triage. That is a real, expected outcome — not a failure.',
+    'If the copy and visuals are fine and there was nothing the grade missed, DISMISS this in triage. That is a real, expected outcome — not a failure.',
   ].join('\n');
 }
 

package/modules/lifecycle/tests/cascade.mjs

@@ -212,7 +212,17 @@ await test('a copy/visual ship generates the two-step artist review', () => {
   assert.equal(spec.status, 'backlog', 'a request that triage may dismiss — not claimable, not nagging');
   assert.match(spec.title, /7001/);
   // Both steps, and both routes of step 2, are in the body.
-  assert.match(spec.description, /STEP 1 — REVIEW THE GRADER/);
+  //
+  // STEP 1's label tracks ADR 0298 (task 1003937). It used to read
+  // "REVIEW THE GRADER … coach it", which asked for something no artist could
+  // do: the panel's four lenses read completion, code quality, security and
+  // runtime cost, so there was no copy verdict to coach. Until the advisory
+  // reader worker ships (task 1003977, itself gated on the voice guide in
+  // task 1003976) the step asks for the RECORD instead — hence the pin on the
+  // new label AND on the ADR reference, which is what stops a well-meaning
+  // copy-edit from restoring the unfollowable version without reading why.
+  assert.match(spec.description, /STEP 1 — READ THE GRADE, AND WRITE DOWN WHAT IT COULD NOT SEE/);
+  assert.match(spec.description, /ADR 0298/, 'the step names the decision that shaped it');
   assert.match(spec.description, /STEP 2 — REMAKE OR TWEAK/);
   assert.match(spec.description, /OUTSIDE the AI chat/);
   assert.match(spec.description, /WITH it/);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.817",
+  "version": "1.19.818",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.817",
+      "version": "1.19.818",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.817",
+  "version": "1.19.818",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/linkify-refs.js

@@ -115,6 +115,14 @@ const { API_BASE } = require('./cli-lib');
 // the root CLAUDE.md/README.md plus all of docs/** (session-logs included). A
 // "GENERATED FILE" marker means the bare refs reappear on the next regen, so
 // the generator — not its output — is where those get fixed; skip them here.
+// PATHS COME BACK POSIX-STYLE, on every platform (task 1003935). path.join gives
+// OS-native separators, so on Windows this used to return 'docs\\adr\\0001-….md'.
+// Three things read these paths and only one of them tolerates that: fs accepts
+// either separator on Windows, but the --check report PRINTS them (so CI output
+// differed by platform for identical content) and the test that pins recursion
+// into docs/ compares against 'docs/' — which is how a permanently-red case hid
+// for months in a file no lane ran. Normalising here, at the one boundary that
+// produces them, is cheaper than teaching every consumer to be separator-aware.
 function discoverDocs() {
   const out = [];
   const walk = (rel) => {
@@ -123,7 +131,7 @@ function discoverDocs() {
     if (fs.statSync(abs).isDirectory()) {
       for (const name of fs.readdirSync(abs).sort()) walk(path.join(rel, name));
     } else if (rel.endsWith('.md')) {
-      out.push(rel);
+      out.push(rel.split(path.sep).join('/'));
     }
   };
   for (const root of ['CLAUDE.md', 'README.md', 'docs']) walk(root);

package/scripts/gds/run-unit-tests.js

@@ -131,7 +131,14 @@ const INTEGRATION = new Set([
   // the --integration lane never saw them either, because it runs only this set. A
   // test that cannot fail in either lane is a file that looks like a gate.
   'handle_machinery', 'hub_profile_leak', 'profile_fields',
-  'linkify_refs', 'memory_isolation',
+  // task 1003935: 'linkify_refs' was swept in with the three above without the
+  // no-DB check they were being fixed for. It touches no Postgres at all — pure
+  // string work plus a filesystem walk — so the DB-free lane skipped it and the
+  // --integration lane, which runs only this set, never had a reason to. It ran in
+  // NEITHER lane, which is the exact failure the comment above describes, and it
+  // is why one permanently-red Windows case sat unnoticed. It is now in the unit
+  // gate, where it is the only coverage linkifyText has.
+  'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent',
   // task 1003145: whether the PLANNER uses the migration 225 index for the recall
   // freshness probe. The DB-free sibling (recall_corpus_health) pins the query

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.817'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.818'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/linkify_refs.mjs

@@ -290,6 +290,23 @@ t('a known idea link is never unwrapped by the past-mislink pass', () => {
   assert.equal(runIds(s, ids), s);
 });
 
+// task 1003935: the separator contract, stated rather than assumed.
+//
+// discoverDocs builds with path.join, so on Windows it returned
+// 'docs\\adr\\0001-….md' and the recursion assertion below — which compares against
+// 'docs/' — was permanently red. Nobody saw it: this file was in run-unit-tests'
+// INTEGRATION exclusion set while touching no database, so it ran in neither lane
+// (fixed in the same task). The assertion was right and the walker was wrong to
+// hand it OS-native paths, so the fix is here at the boundary; this test exists so
+// the next reader does not have to rediscover which of the two was at fault.
+t('discoverDocs returns POSIX-style paths on every platform (task 1003935)', () => {
+  const docs = discoverDocs();
+  const native = docs.filter((d) => d.includes('\\'));
+  assert.equal(native.length, 0,
+    `paths must not carry OS-native separators; got ${JSON.stringify(native.slice(0, 3))}`);
+  assert.ok(docs.some((d) => d.includes('/')), 'and nested paths must still be nested');
+});
+
 t('discoverDocs finds CLAUDE.md, recurses docs/ subdirs (only .md), skips the generated ideas file', () => {
   const docs = discoverDocs();
   assert.ok(docs.includes('CLAUDE.md'), 'includes CLAUDE.md');