@bongos/core 1.19.818 → 1.19.820

package/scripts/gds/backfill-session-types.js

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/gds/backfill-session-types.js — classify the sessions that predate the
+// classifier (task 1003975, from idea 1001033).
+//
+// WHAT THIS IS, and what it is NOT. It writes ONE column, `session_records.session_type`,
+// and only where that column is NULL. It moves no money, books no reward, touches
+// no `task_ids` and creates no attribution. That separation is deliberate and it
+// is the lesson this module already paid for once: the attribution sweep had to be
+// windowed because it ran on the same tick as a payout and would have minted a mass
+// retroactive payment nobody authorised (see the warning in modules/sessions/CLAUDE.md).
+// A sweep that both labels and pays is the wrong shape whatever its intent, so this
+// one cannot pay even in principle — db.setSessionType writes that column alone.
+//
+// WHY IT IS NEEDED. The upload path classifies every session from now on, but the
+// corpus is ~4,600 rows old and none of them carry a verdict. Without this pass the
+// ledger's new filter would only ever see today's sessions, which is exactly the
+// half of the corpus nobody needs help reading.
+//
+// SAFETY. DRY-RUN BY DEFAULT: with no flags it classifies in memory, prints the
+// distribution it WOULD write, and writes nothing. `--apply` performs the UPDATEs.
+// Idempotent by construction: the verdict is a pure function of the row's own
+// stored digest, so a re-run lands on the same answer, and a row that already has
+// a type is never revisited (the query selects `WHERE session_type IS NULL`).
+// `--limit N` bounds one pass so the first apply can be small and checked.
+//
+// Run:  node scripts/gds/backfill-session-types.js [--limit N]
+//       node scripts/gds/backfill-session-types.js --apply
+
+const { classifySession, SESSION_TYPES } = require('../../modules/sessions/session-type');
+const db = require('../../modules/sessions/db');
+const { arg, hasFlag } = require('./cli-lib');
+
+const BATCH = 500;
+
+async function main() {
+  const apply = hasFlag('--apply');
+  const limitArg = Number(arg('--limit'));
+  const cap = Number.isFinite(limitArg) && limitArg > 0 ? Math.trunc(limitArg) : Infinity;
+
+  const tally = Object.fromEntries(SESSION_TYPES.map((t) => [t, 0]));
+  let scanned = 0;
+  let written = 0;
+
+  // Paged rather than one big SELECT: `detail` is a jsonb per row and the corpus
+  // is the largest table this module owns, so pulling it whole would hold the
+  // entire transcript corpus in memory at once for no gain.
+  for (;;) {
+    const room = Math.min(BATCH, cap - scanned);
+    if (room <= 0) break;
+    const rows = await db.unclassifiedSessions(room);
+    if (rows.length === 0) break;
+    for (const row of rows) {
+      const type = classifySession({ detail: row.detail, metrics: row.metrics });
+      tally[type] = (tally[type] || 0) + 1;
+      scanned++;
+      if (apply) written += await db.setSessionType(row.id, type);
+    }
+    // A dry run never writes, so the same unclassified page comes back forever.
+    // One page is enough to show the shape; say so rather than looping.
+    if (!apply) break;
+  }
+
+  console.log(`\nsession-type backfill — ${apply ? 'APPLIED' : 'DRY RUN (no writes)'}`);
+  console.log(`  rows classified     ${scanned}`);
+  if (apply) console.log(`  rows written        ${written}`);
+  console.log(`  distribution:`);
+  for (const t of SESSION_TYPES) {
+    const n = tally[t] || 0;
+    const pct = scanned ? ` (${Math.round((n / scanned) * 100)}%)` : '';
+    console.log(`    ${t.padEnd(14)} ${String(n).padStart(6)}${pct}`);
+  }
+
+  if (apply) {
+    console.log(`\n  corpus now:`);
+    for (const r of await db.sessionTypeCounts()) {
+      console.log(`    ${String(r.type).padEnd(14)} ${String(r.n).padStart(6)}`);
+    }
+  } else if (scanned > 0) {
+    console.log(`\n  dry run reads one page of ${BATCH}; re-run with --apply to write and walk the whole corpus.`);
+  }
+}
+
+main()
+  .then(() => process.exit(0))
+  .catch((err) => { console.error(err); process.exit(1); });

package/scripts/gds/bug-attachment-audit.js

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+// scripts/gds/bug-attachment-audit.js — do the images our task descriptions
+// promise actually exist? (task 1003918)
+//
+// WHY THIS EXISTS. A re-hosted #bugs screenshot is the one artefact in this
+// system that cannot be regenerated: the Discord CDN URL it was copied from is
+// signed and expires in about a day, so our copy IS the image. They live on disk
+// under var/bug-attachments — outside Postgres, outside git — and nothing
+// noticed when all five this instance had ever stored disappeared in the
+// 2026-07-05 droplet move. The loss surfaced on 2026-09-14, two months later,
+// because somebody happened to open an old bug task and saw a broken image.
+//
+// So: read the descriptions, extract every attachment link they promise, and ask
+// the disk whether it can keep that promise. A count of broken promises is the
+// thing that should have been non-zero and visible in July.
+//
+// Usage:
+//   node scripts/gds/bug-attachment-audit.js          # human report; exit 1 if any are missing
+//   node scripts/gds/bug-attachment-audit.js --json   # { described, present, missing: [...] }
+//   node scripts/gds/bug-attachment-audit.js --line   # one line, or nothing; always exit 0
+//
+// Read-only. It never writes, never deletes, and never touches Discord.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// The link shape the bot embeds in a description. Deliberately matched against
+// the SERVE ROUTE's path rather than any filename found on disk: what matters is
+// what a reader will click, and a file nothing links to is not a broken promise.
+const LINK_RE = /\/api\/(?:gds|bongos)\/bug-attachments\/(bug-[a-z0-9]{1,40}-[0-9a-f]{16}\.(?:png|jpg|gif|webp))/gi;
+
+// PURE — every attachment name a body of text promises, deduped, in first-seen
+// order. Exported so the extraction is testable without a database or a disk.
+function describedAttachments(text) {
+  const out = [];
+  const seen = new Set();
+  for (const m of String(text || '').matchAll(LINK_RE)) {
+    const name = m[1];
+    if (!seen.has(name)) { seen.add(name); out.push(name); }
+  }
+  return out;
+}
+
+// PURE — split the promised names into kept and broken, given an existence test.
+// `rows` are { id, title, description }; the result names the TASK for each
+// missing file, because "three files are gone" is not actionable and "the image
+// in task N is gone" is.
+function auditRows(rows, exists) {
+  const described = [];
+  const missing = [];
+  for (const row of rows || []) {
+    for (const name of describedAttachments(row && row.description)) {
+      described.push({ name, taskId: row.id });
+      if (!exists(name)) missing.push({ name, taskId: row.id, title: row.title || '' });
+    }
+  }
+  return { described, missing, present: described.length - missing.length };
+}
+
+// EVERY status, explicitly, and paged. Two ways to get a comfortable zero here,
+// both of which I hit while building this:
+//
+//   - GET /tasks omits abandoned rows unless you ask for them. The five files this
+//     audit exists for are described in tasks that are now abandoned or shipped, so
+//     the obvious query returned '0 linked, 0 missing' — indistinguishable from
+//     'nothing is broken'.
+//   - the route clamps `limit`, so one page is not the table.
+//
+// A probe whose failure mode is a clean bill of health is worse than no probe, so
+// the status list is spelled out rather than defaulted.
+// 'claimed' is not one — claimTask sets status='active' (db-claims.js). Listing it
+// only bought a no-op query, and a comment promising EVERY status should be right.
+const TASK_STATUSES = ['backlog', 'ready', 'active', 'completed', 'confirmed', 'shipped', 'abandoned'];
+
+async function fetchRows() {
+  const { cliClient } = require('./cli-lib');
+  const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
+  const api = await cliClient();
+  const byId = new Map();
+  for (const status of TASK_STATUSES) {
+    let offset = 0;
+    for (let page = 0; page < 100; page++) {
+      const q = buildTaskPageQuery({ kind: 'bug', status, limit: TASK_LIST_MAX_LIMIT, offset });
+      const r = await api.tasks.getTasks({ query: q });
+      if (!r || !r.ok) throw new Error(`could not list ${status} tasks (${r && r.status})`);
+      const rows = (r.data && r.data.tasks) || [];
+      for (const t of rows) byId.set(String(t.id), t);
+      // A short page is the end. Compare against the limit the route HONOURED.
+      if (rows.length < q.limit) break;
+      offset += q.limit;
+    }
+  }
+  return [...byId.values()];
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const dir = require('../../modules/discord/bug-attachments.js').attachmentsDir();
+  let rows;
+  try {
+    rows = await fetchRows();
+  } catch (e) {
+    if (argv.includes('--line')) process.exit(0); // a probe never blocks a session
+    console.error(`bug-attachment-audit: undetermined — ${e.message || e}`);
+    process.exit(2);
+  }
+  // Through the serve route's OWN resolver, not a bare path.join. The name pattern
+  // already excludes slashes and dots, and a test pins that '../../etc/passwd' is
+  // never extracted — but the route that actually opens these files defends itself
+  // with a resolved-path prefix check, and a probe that reads the same store should
+  // not hold itself to a weaker rule than the thing it audits.
+  const { resolveSafe } = require('../../modules/discord/bug-attachments.js');
+  const r = auditRows(rows, (name) => {
+    const p = resolveSafe(name);
+    return Boolean(p) && fs.existsSync(p);
+  });
+
+  if (argv.includes('--json')) {
+    console.log(JSON.stringify({ dir, described: r.described.length, present: r.present, missing: r.missing }, null, 2));
+    return;
+  }
+  if (argv.includes('--line')) {
+    if (r.missing.length) {
+      console.log(`Bug attachments: ${r.missing.length} of ${r.described.length} linked screenshot(s) are MISSING from ${dir} `
+        + '— every task describing one renders a broken image. These cannot be re-fetched (the Discord URL has expired).');
+    }
+    return;
+  }
+  console.log(`  Bug attachments: ${r.described.length} linked, ${r.present} present, ${r.missing.length} missing`);
+  console.log(`  Store: ${dir}`);
+  for (const m of r.missing) console.log(`    missing  ${m.name}  (task ${m.taskId})`);
+  if (r.missing.length) {
+    console.log('  These cannot be re-fetched — the Discord CDN URL they were copied from has expired.');
+    console.log('  Restore from a nightly attachments archive: /var/backups/gds/<db>-attachments-*.tar.gz');
+    process.exit(1);
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = { describedAttachments, auditRows, LINK_RE };

package/scripts/gds/capture.js

@@ -282,6 +282,25 @@ async function main() {
   const noPrompt = hasFlag('--no-prompt', args);
   const goalArg = arg('--goal', args);
 
+  // A BAD --kind used to reach the server and come back a 400 (task 1003694).
+  // That is not merely late, it is invisible where it matters: a SCHEDULED routine
+  // filing its findings gets the 400 into a log nobody reads, the audit work still
+  // runs, and only the step that turns a finding into a durable row fails — so no
+  // queue accumulates to make the absence noticeable. dep-audit-nightly filed with
+  // `--kind security`, which is not a kind, and had therefore NEVER filed anything.
+  //
+  // Refusing here makes the same typo surface at authoring time, on the machine of
+  // whoever wrote the command, with the valid list in the message.
+  if (kindFromArg !== null) {
+    const { VALID_KINDS } = require('../../modules/ideas/inbox.js');
+    if (!VALID_KINDS.includes(kindFromArg)) {
+      console.error(`--kind "${kindFromArg}" is not a valid kind. The server would refuse this with a 400.`);
+      console.error(`Valid kinds: ${VALID_KINDS.join(', ')}`);
+      console.error('Adding a new kind is a schema change (the idea_inbox CHECK constraint) and needs its own migration + ADR.');
+      process.exit(2);
+    }
+  }
+
   if (parseGoalArg(goalArg).kind === 'invalid') {
     console.error(`--goal must be a positive goal id, or the literal "none" to file homeless (got "${goalArg}").`);
     process.exit(2);

package/scripts/gds/db-backup-nightly.sh

@@ -170,6 +170,42 @@ if [ "$BYTES" -gt "$WARN_BYTES" ]; then
   echo "[$(date -u +%FT%TZ)] gds-db-backup: WARN latest dump is ${BYTES} bytes (> ${WARN_BYTES} threshold) — review what grew; is it a regenerable table excludable like search_chunks?" >&2
 fi
 
+# ---- bug attachments (task 1003918) -----------------------------------------
+
+# The DB dump above is not the whole state. Re-hosted #bugs screenshots live on
+# disk under var/bug-attachments, outside Postgres and outside git, and they are
+# the one artefact here that CANNOT be regenerated: the Discord CDN URL they were
+# copied from is signed and expires in about a day, so our copy IS the image.
+#
+# Nothing backed them up. All five this instance ever stored are gone — the
+# 2026-07-05 droplet move carried the database and not var/ — and every task
+# description embedding one now renders a broken image in the hall.
+#
+# Tarred beside the dump, same timestamp, same retention, so a restore drill that
+# picks a date gets the database and the images that go with it. Best-effort by
+# design: a missing or empty attachments dir is the ordinary case on a fresh
+# instance and must never fail a night of database backup.
+ATTACH_DIR="${BUG_ATTACHMENTS_DIR:-$REPO_ROOT/var/bug-attachments}"
+ATTACH_OUT="${BACKUP_DIR}/${DB_NAME}-attachments-${TS}.tar.gz"
+ATTACH_GLOB="${DB_NAME}-attachments-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D}Z.tar.gz"
+
+if [ -d "$ATTACH_DIR" ]; then
+  ATTACH_COUNT=$(find "$ATTACH_DIR" -maxdepth 1 -type f | wc -l)
+  if [ "$ATTACH_COUNT" -gt 0 ]; then
+    if tar -czf "$ATTACH_OUT.partial" -C "$ATTACH_DIR" . 2>/dev/null; then
+      mv "$ATTACH_OUT.partial" "$ATTACH_OUT"
+      echo "[$(date -u +%FT%TZ)] gds-db-backup: wrote ${ATTACH_OUT} (${ATTACH_COUNT} attachment(s))"
+    else
+      rm -f "$ATTACH_OUT.partial"
+      echo "[$(date -u +%FT%TZ)] gds-db-backup: WARN could not archive ${ATTACH_DIR} — database dump is unaffected" >&2
+    fi
+  else
+    echo "[$(date -u +%FT%TZ)] gds-db-backup: no bug attachments to archive"
+  fi
+else
+  echo "[$(date -u +%FT%TZ)] gds-db-backup: no bug-attachment dir at ${ATTACH_DIR} — nothing to archive"
+fi
+
 # ---- retention prune --------------------------------------------------------
 
 # Delete dumps older than RETENTION_DAYS. -mtime +N means strictly older
@@ -177,7 +213,7 @@ fi
 # Done AFTER the new dump lands so a streak of failed runs can't erase
 # everything: we never delete on a day we didn't successfully dump.
 PRUNED=$(find "$BACKUP_DIR" -maxdepth 1 -type f \
-    -name "$DUMP_GLOB" \
+    \( -name "$DUMP_GLOB" -o -name "$ATTACH_GLOB" \) \
     -mtime +"${RETENTION_DAYS}" \
     -print -delete | wc -l)
 

package/scripts/gds/fitness.js

@@ -200,9 +200,19 @@ function checkGeneratedArtifactsFresh() {
   } catch {
     violations.push('docs/api/openapi.json + docs/api-reference.md + docs/routes-permissions.md are STALE (or the spec is not valid OpenAPI 3.1) — run `node scripts/gds/gen-api-docs.js` and commit (task 1918).');
   }
+  try {
+    // task 1003556: the copy registry's rows carry LINE NUMBERS, so editing any scanned
+    // UI file stales it. It was covered only by ship-check's OPTIONAL step, which a
+    // builder has to remember to run — so the first signal was CI failing on the PR's
+    // MERGE ref, where the shift is hardest to attribute. Gated here so a local fitness
+    // run says so first.
+    execFileSync(process.execPath, [path.join(__dirname, 'copy-inventory.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('docs/copy-registry.json + docs/copy-inventory.md are STALE — every row carries a line number, so editing any scanned UI file shifts them. Run `node scripts/gds/copy-inventory.js` and commit (task 1003556).');
+  }
   // NB the role packs' responsibility blocks are generated too, but their freshness
   // is asserted by role-pack-guard.js — one check owns "the packs are correct".
-  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus the CLAUDE.md §2 interaction-posture block (the knob defaults), docs/file-map.md skills/scheduled-tasks sections and docs/api/openapi.json + api-reference.md (API). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
+  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus the CLAUDE.md §2 interaction-posture block (the knob defaults), docs/file-map.md skills/scheduled-tasks sections, docs/api/openapi.json + api-reference.md (API) and docs/copy-registry.json + copy-inventory.md (the reader-facing copy, task 1003556). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
 }
 
 // ---- deterministic cron routine boundary (System 4 / ADR 0078) -------------
@@ -1223,6 +1233,7 @@ const CHECKS = [
   // crashes later, so a start-up refusal would trade an outage risk for a cosmetic
   // one (ADR 0289). Rationale + the seam→consumer table live in that file.
   require('./seam-wiring-guard.js').checkSeamWiring,
+  require('./home-isolation-guard.js').checkHomeIsolation, // Check 34 — task 1003763: a test that sets HOME for a child without USERPROFILE isolates NOTHING on win32, so it silently stops testing what its comment says. Three tasks fixed this one site at a time. Rationale in that file.
   require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
 ];
 

package/scripts/gds/home-isolation-guard.js

@@ -0,0 +1,126 @@
+'use strict';
+
+// scripts/gds/home-isolation-guard.js — setting HOME for a child process isolates
+// nothing on Windows (task 1003763).
+//
+// THE DEFECT, three times now. os.homedir() reads USERPROFILE on win32 and never
+// consults HOME, so `env: { ...process.env, HOME: tmp }` leaves the child looking at
+// the DEVELOPER'S REAL home — and therefore their real CLI session.
+//
+//   tests/cli_sessions.mjs  (task 1003760) — DESTROYED the developer's live session.
+//   tests/cli_surface.mjs   (task 1003941) — guidance printers took the authenticated
+//                                            branch, so the test failed for a false
+//                                            reason on any signed-in Windows box.
+//   tests/cli_package.mjs   (task 1003763) — an unauthenticated-path assertion could
+//                                            pass because the machine was signed in.
+//
+// The last two are the dangerous shape: a test that isolates nothing does not
+// announce itself, it just quietly stops testing what its comment says it tests.
+//
+// WHY A GUARD AND NOT THREE FIXES. Three sites, three separate tasks, each found by
+// accident. tests/memory_pull.mjs, tests/redteam_patrol.mjs and
+// tests/setup_device_flow_fallback.mjs already do it correctly, so the convention
+// exists and is simply easy to miss — which is the definition of something CI should
+// hold rather than a reviewer.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const TESTS_DIR = path.join(REPO_ROOT, 'tests');
+
+// WHAT COUNTS AS A SPAWN ENV. Only a literal that SPREADS process.env and assigns
+// HOME — that is the shape every real defect had. Two narrowings, both learned by
+// getting this wrong on the first run against the tree:
+//
+//   - COMMENTS ARE STRIPPED. All three fixed files now explain the bug by QUOTING
+//     the broken line, so a raw text scan reports the very files that fixed it.
+//   - A HELPER'S CALL SITE IS NOT A SPAWN ENV. tests/setup_smoke.mjs passes
+//     `{ HOME: fakeHome }` to its own runSetup(), which adds USERPROFILE itself.
+//     Requiring `...process.env` in the same literal distinguishes 'building a
+//     child's environment' from 'passing an option to a function', and flags the
+//     helper rather than each of its callers — which is where the fix belongs.
+const HOME_ASSIGN_RE = /(^|[{,\s])HOME\s*:/;
+const USERPROFILE_RE = /(^|[{,\s])USERPROFILE\s*:/;
+const PROCESS_ENV_RE = /\.\.\.process\.env/;
+
+// Strip line and block comments so prose ABOUT the bug is not read as the bug.
+// Errs toward keeping text (a guard should fail loud, not quiet): only the two
+// unambiguous comment forms are removed.
+function stripComments(src) {
+  return String(src || '')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/(^|[^:])\/\/.*$/gm, '$1');
+}
+
+// Files where HOME is the SUBJECT rather than an isolation mechanism, named in task
+// 1003763. An allowlist entry is a claim that the file means something else by HOME,
+// so each one says which.
+const ALLOW = new Map([
+  ['scrubber_corpus.mjs', "HOME:'/root' is literal corpus DATA — a string the scrubber is asked to redact, not an env handed to a child"],
+  ['lib_sh_resolution.mjs', 'exercises POSIX shell HOME resolution; HOME is the thing under test, and a win32 variable would change the subject'],
+  ['home_isolation_guard.mjs', "this guard's OWN tests carry the broken shape as fixture strings — it must not report its own corpus, the same way category-advisory-guard.js had to stop matching its own filename"],
+]);
+
+// PURE — the lines that build a child env with HOME and no USERPROFILE. Exported so
+// the matching is testable without the tree: a scanner whose pattern silently stops
+// matching reports a clean repo, which is the failure mode this whole file is about.
+function offendingLines(src) {
+  const lines = stripComments(src).split('\n');
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!HOME_ASSIGN_RE.test(lines[i])) continue;
+    // A literal can wrap: read a small window either side for its companions.
+    const window = lines.slice(Math.max(0, i - 4), i + 5).join('\n');
+    if (!PROCESS_ENV_RE.test(window)) continue;   // an option object, not a child env
+    if (USERPROFILE_RE.test(window)) continue;    // already isolated properly
+    out.push({ line: i + 1, text: lines[i].trim() });
+  }
+  return out;
+}
+function checkHomeIsolation() {
+  const name = 'a child env that sets HOME also sets USERPROFILE (task 1003763)';
+  let names = [];
+  try {
+    names = fs.readdirSync(TESTS_DIR).filter((f) => f.endsWith('.mjs'));
+  } catch (e) {
+    return { name, ok: true, hardFail: false, violations: [], warnings: [`tests/ unreadable: ${e.message}`], note: 'skipped.' };
+  }
+  // The scan must not pass by finding nothing.
+  if (names.length === 0) {
+    return {
+      name, ok: false, hardFail: true,
+      violations: ['no tests/*.mjs found at all — that is a broken scan, not a clean one'],
+      warnings: [], note: 'the scan produced an empty file set.',
+    };
+  }
+
+  const violations = [];
+  let scanned = 0;
+  let sitesSeen = 0;
+  for (const n of names) {
+    const src = fs.readFileSync(path.join(TESTS_DIR, n), 'utf8');
+    scanned += 1;
+    const hits = offendingLines(src);
+    if (HOME_ASSIGN_RE.test(stripComments(src)) && PROCESS_ENV_RE.test(stripComments(src))) sitesSeen += 1;
+    if (ALLOW.has(n)) continue;
+    for (const h of hits) {
+      violations.push(`tests/${n}:${h.line} sets HOME for a child without USERPROFILE — \`${h.text.slice(0, 90)}\`. `
+        + 'On Windows os.homedir() reads USERPROFILE and ignores HOME, so this isolates NOTHING: the child sees the '
+        + 'developer\'s real home and real session, and an unauthenticated-path assertion can pass because the machine '
+        + 'happens to be signed in. Set USERPROFILE (and HOMEDRIVE/HOMEPATH) to the same directory.');
+    }
+  }
+
+  return {
+    name,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} test file(s) scanned, ${sitesSeen} of them build a child env with HOME; ${ALLOW.size} allowlisted where HOME is the subject rather than the isolation. `
+      + 'Three separate tasks (1003760, 1003941, 1003763) fixed this one site at a time before it was worth a check.',
+  };
+}
+
+module.exports = { checkHomeIsolation, offendingLines, stripComments, ALLOW, HOME_ASSIGN_RE, USERPROFILE_RE, PROCESS_ENV_RE };

package/scripts/gds/ship-merge.js

@@ -27,7 +27,7 @@ const {
 } = require('./ship-land.js');
 const { runSmoke } = require('./ship-grade.js');
 const { dbOnlyIgnoredNotice } = require('./ship-honesty.js');
-const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
+const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateCopyInventory, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
 const { REPO_ROOT } = require('./ship-state.js');
 
 // zeroCommitVerdict — dbOnly is deliberately consulted ONLY at zero commits
@@ -119,6 +119,10 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
   regenerateSessionIndex();
   // Refresh the generated file-map sections (skills + scheduled-tasks) on the same beat (ADR 0066 / task 1276).
   regenerateFileMap();
+  // Refresh the copy registry + inventory on the same beat (task 1003556). Its rows
+  // carry line numbers, so ANY edit to a scanned UI file staled it — and nothing in
+  // the ship path regenerated it, so the PR was born stale and CI said so.
+  regenerateCopyInventory();
   // Refresh the generated OpenAPI spec + API reference from the shipped route tree (task 1918).
   regenerateApiDocs();
   // ...then the typed client FROM that spec (+ the devbox vendored copy) on the same beat (task 2051).

package/scripts/gds/ship-regen.js

@@ -235,6 +235,34 @@ function regenerateFileMap() {
   return 'committed-nofatal';
 }
 
+// docs/copy-registry.json + docs/copy-inventory.md — the reader-facing copy the UI
+// actually renders (task 1003556).
+//
+// WHY IT HAS TO RUN HERE. Every row in the registry carries a `line`, so editing ANY
+// scanned UI file shifts line numbers and makes tests/copy_inventory.mjs red — on the
+// PR's MERGE ref, not on the branch, which is the worst place to find out. Nothing in
+// the ship path regenerated it (grep for copy-inventory across ship.js, ship-regen.js
+// and ship-preflight-steps.js used to return zero hits) and fitness did not cover the
+// pair either, so the builder got no local signal at all and learned from CI.
+//
+// Task 1003546 fixed the SERVER-side merge heals for the same artifact. Those repair a
+// strand after it happens; this is the prevention, so the PR is not born stale.
+function regenerateCopyInventory() {
+  console.log('  regenerating the copy registry + inventory from the shipped tree...');
+  shellOk(`"${process.execPath}" ${JSON.stringify(path.join(__dirname, 'copy-inventory.js'))}`);
+  const dirty = gitOk('git status --porcelain docs/copy-registry.json docs/copy-inventory.md');
+  if (!dirty) {
+    console.log('  copy registry already current — nothing to commit');
+    return 'current';
+  }
+  shellOk('git add docs/copy-registry.json docs/copy-inventory.md');
+  if (shellOk('git commit -m "chore(copy): auto-regenerate the copy registry + inventory (task 1003556)"')) {
+    console.log('  committed auto-regenerated copy registry');
+    return 'committed';
+  }
+  return 'committed-nofatal';
+}
+
 // ---------- merge serialization lock (#462 C4; extended in #269 C6) ----------
 //
 // autoMerge() mutates the SHARED main worktree (REPO_ROOT). Two concurrent
@@ -313,6 +341,7 @@ module.exports = {
   regenerateApiClient,
   regenerateApiDocs,
   regenerateDiagrams,
+  regenerateCopyInventory,
   regenerateFileMap,
   regenerateRepoMap,
   regenerateSessionIndex,

package/scripts/gds/skill-preflight.js

@@ -120,13 +120,36 @@ const CAPABILITIES = {
   },
 };
 
+// EVERY read of a SKILL.md goes through here (task 1003754).
+//
+// These files are CRLF in a Windows checkout — .gitattributes pins *.js, *.json,
+// *.sh and *.sql, but Markdown falls through `* text=auto`. Every regex below is
+// anchored on \n, starting with the frontmatter fence /^---\n/, so on Windows the
+// frontmatter simply did not match and parseRequires returned `declared: false`
+// for EVERY skill.
+//
+// That is worse than one red test. Fitness check G03 compares what a skill's fenced
+// commands imply against what it declares — and with nothing parsed as declared, the
+// check reported '53 skill(s) scanned; 0 declare a machine contract' and had nothing
+// to compare. The guard against a skill's ops commands outrunning its declaration
+// was inert on any Windows box.
+//
+// Normalising once at the boundary is deliberately not 'make each regex CRLF-aware':
+// there are six of them and the next one added would forget.
+function readSkillMd(p) {
+  return String(fs.readFileSync(p, 'utf8')).replace(/\r\n/g, '\n');
+}
+
 // ---- the declaration ------------------------------------------------------
 // Read `requires:` out of a skill's YAML frontmatter. Accepts the inline form
 // (`requires: [gh, main-checkout]`) and the dash-list form. Returns
 // { requires, declared, error }: `declared` distinguishes "declared nothing"
 // from "declared an empty list", which the fitness check needs to tell apart.
 function parseRequires(md) {
-  const m = /^---\n([\s\S]*?)\n---/.exec(String(md || ''));
+  // Normalised here too, not only in readSkillMd: this is exported and a caller may
+  // hand it raw file text (the fitness check's injected `read` does exactly that).
+  const src = String(md || '').replace(/\r\n/g, '\n');
+  const m = /^---\n([\s\S]*?)\n---/.exec(src);
   if (!m) return { requires: [], declared: false, error: null };
   const fm = m[1];
   const inline = /^requires:[ \t]*\[(.*?)\][ \t]*$/m.exec(fm);
@@ -176,7 +199,8 @@ function fencedCode(md) {
 }
 
 function inferRequired(md) {
-  const code = fencedCode(md);
+  // Same reason as parseRequires: the SIGNALS below are ^-anchored per line.
+  const code = fencedCode(String(md || '').replace(/\r\n/g, '\n'));
   const out = new Set();
   for (const [rx, cap] of SIGNALS) if (rx.test(code)) out.add(cap);
   return [...out].sort();
@@ -224,7 +248,7 @@ function preflightSkill(name, caps = CAPABILITIES) {
     return { ok: false, requires: [], missing: [{ name: 'skill', why: `"${name}" is not a skill name — it must be a single directory name under .claude/skills/.` }], unknown: [], checked: [] };
   }
   let md;
-  try { md = fs.readFileSync(p, 'utf8'); } catch {
+  try { md = readSkillMd(p); } catch {
     return { ok: false, missing: [{ name: 'skill', why: `no skill named "${name}" at .claude/skills/${name}/SKILL.md` }], unknown: [], checked: [] };
   }
   const { requires, error } = parseRequires(md);
@@ -263,7 +287,7 @@ function checkOpsSkillsDeclareMachine({ dir = SKILLS_DIR, read = null, names: in
     };
   }
   const readOne = read || ((n) => {
-    try { return fs.readFileSync(path.join(dir, n, 'SKILL.md'), 'utf8'); } catch { return null; }
+    try { return readSkillMd(path.join(dir, n, 'SKILL.md')); } catch { return null; }
   });
 
   let declaring = 0;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.818'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.820'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');