@bongos/core 1.19.821 → 1.19.822

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.821",
-  "core_contract": "1.19.821",
-  "source_commit": "8010be7b18c8402b4992ca02d3ea6486e3864b8d",
+  "core_version": "1.19.822",
+  "core_contract": "1.19.822",
+  "source_commit": "5a9c009cff17c2a500ff23f5d0de66a1b7f00477",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T10:54:28.375Z",
+  "built_at": "2026-09-17T11:05:47.254Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 490,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2227,
+    "functional_verbatim": 2228,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2743,
-  "tree_sha256": "b45cfd41d39a01485663e30b259328725d4eb07530cb520214df9811d2842e0b",
+  "file_count": 2744,
+  "tree_sha256": "acbc13ab96c308bd0c0aa200c9dd1f6af1013ed6771c70730a797f7a1fb4a697",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2547,7 +2547,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9d562958c91d14116733518e2934b1a78b980adc6a19c652cfe47eb85c3693bf"
+      "sha256": "9182a3b88e6092a231f59db4220628cb8579244c8289350406f07187c959e644"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5612,7 +5612,7 @@
     {
       "path": "modules/lifecycle/dead-deps.js",
       "mode": "0000644",
-      "sha256": "c9f7aa89a4b1e9a201189608ff8ebc4910ee6ca19be33ce681f2d32cedb0b39d"
+      "sha256": "4738131a48e85dd7bf0644ddd3686c85d0d1d0da55ee623b1834d048c614b91c"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -7812,12 +7812,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bd6442d6f7a4122841efdb7ed6d796e43f9df2bb4a65677d19d586af19cb0650"
+      "sha256": "d13165aac1aea3612a3c5af1b5b14267acdde35f2a8d99482310c7a749f9761c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8185455c292222a25c1928dc9ef4959bc09783fb71fc231e89dca09793239e44"
+      "sha256": "0f9f0baab592f70e890e2a39e61dcf21c5170841f97b8c82cb16703c2a959756"
     },
     {
       "path": "public-docs/index.html",
@@ -7947,7 +7947,7 @@
     {
       "path": "scripts/gds/audit-deps.js",
       "mode": "0000644",
-      "sha256": "891aadcbea8ef257f68f20f140fa988c45ac06d4caa19802136c372d403db7ba"
+      "sha256": "ff7ccdf15ae2c215d3330e957d6a36adc7d48f5d9bd5042b5d61bb228b878073"
     },
     {
       "path": "scripts/gds/audit-exports.js",
@@ -9722,7 +9722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "363876fc33b090bf88ca7b767b82778feb63ee9bb607c00e4a37a2aae0b5416f"
+      "sha256": "782160b1ae7c1483c92337a589f92d8099a8bbee37005ea744c78bd4fcb5803c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12494,6 +12494,11 @@
       "mode": "0000644",
       "sha256": "a36acb19e59db1f9eb885ab6497a43d1c8ce0ba6198b0f5cc98f33bf08837fdf"
     },
+    {
+      "path": "tests/prose_gated_deps.mjs",
+      "mode": "0000644",
+      "sha256": "5d85d13a0cf1feb3c0aa809841126f4f9e9effe66fc57b5064b612627ce4916f"
+    },
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2116,5 +2116,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.819 with no explicit bump. run 35209838815. (task 1002620)
   1.19.821 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.820 with no explicit bump. run 35212866365. (task 1002620)
+  1.19.822 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.821 with no explicit bump. run 35213847140. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/dead-deps.js

@@ -198,7 +198,148 @@ function findStrandedTasks(tasks) {
   return out;
 }
 
+// ---- PROSE-DECLARED GATES (task 1003857) -----------------------------------
+//
+// Everything above reads the STRUCTURED graph — blocked_by edges. A gate written
+// in a task's DESCRIPTION is entirely unpoliced, and they go stale the same way:
+// task 1002839 (ready) names "existing open task 1001380" as a precondition, and
+// 1001380 was abandoned on 2026-08-18, superseded by ADR 0089. A builder opening
+// 1002839 is told to coordinate with a task that does not exist, and told it is open.
+//
+// ADVISORY, NEVER A GATE. A prose match is weaker evidence than an edge: the text
+// may be history ("this replaces task N"), a citation, or simply wrong. It reports
+// candidates for a human to read and must never refuse a claim — that is the
+// difference between this and DEAD_DEP_STATUSES above, and it is deliberate.
+//
+// PRECISION COMES FROM THE VERB, NOT THE ID. Matching "any abandoned id in the
+// body" is the mistake that made the sibling supersession scan unusable (idea
+// 1000807: ~44 hits, nearly all citations). So an id counts only when a GATE PHRASE
+// governs it within a short window — needs / depends on / blocked by / gated on /
+// requires / after / prereq — and the window is small enough that a paragraph
+// mentioning a gate and, separately, an id does not join them up.
+// TWO PHRASINGS, because the live evidence has both — and the second is the one the
+// filing task's own example actually uses.
+//
+//   A GATE: 'needs task N', 'blocked by N', 'depends on N'.
+//   A LIVENESS ASSERTION: 'existing OPEN task N', 'task N is ready to claim'.
+//
+// Task 1002839 — the live instance the task names — reads "and existing open task
+// 1001380 covers overlapping ground". That is not a dependency; it is a claim that
+// 1001380 is OPEN, and 1001380 was abandoned on 2026-08-18. A gate-only matcher
+// missed it, which I found by measuring rather than by reading the spec: the first
+// version returned it only because a 'needs' in the PREVIOUS clause leaked across a
+// semicolon, and tightening that correctly dropped it.
+//
+// Both shapes send a builder to a task that is not there, which is the harm. Only
+// the liveness one also states something false on its face.
+const GATE_PHRASE_RE = /\b(?:needs?|depends?\s+on|dependent\s+on|blocked\s+by|blocks?|gated\s+on|gates?|requires?|required\s+by|prereq(?:uisite)?s?|precondition|waits?\s+on|waiting\s+on|after)\b/i;
+
+// 'open task N', 'existing open task N', 'still-open task N', 'the open task N'.
+// Anchored to the id's immediate left so a paragraph that says 'open' somewhere does
+// not qualify every id in it.
+const LIVENESS_BEFORE_RE = /\b(?:still[-\s]+)?open\s+(?:task\s+)?#?$/i;
+// 'task N is ready to claim', 'task N is still open', 'task N remains open'.
+const LIVENESS_AFTER_RE = /^\s*(?:\([^)]{0,80}\)\s*)?(?:is|remains|stays)\s+(?:still\s+)?(?:open|ready\s+to\s+claim|unclaimed|in\s+flight)\b/i;
+
+// How far after a gate phrase an id still counts as governed by it. Sized to span
+// 'needs the existing open task 1001380 to land first', not a whole paragraph.
+const GATE_WINDOW = 80;
+
+// A task id in prose. Two forms, and the second is the trap.
+//
+//   LIVE form   — 6-7 digits: 'existing open task 1001380'.
+//   SHORT form  — the PRE-OFFSET ref this project used before the import, written as
+//                 `#528` or 'task 528'. Task 1000528's own gate is written that way,
+//                 and it is the case that motivated the original row — so a live-id
+//                 match misses precisely the instance this exists to find.
+//
+// The short form is only recognised with an explicit `task ` / `#` prefix. A bare
+// 3-digit number in prose is a count, a line number or a year far more often than it
+// is a task, and this runs over every description on the board.
+const ID_RE = /(?:\btask\s+|#)(\d{1,5})\b|(?:\btask\s+|#)?(\d{6,7})\b/g;
+
+// The id spaces to probe, newest first. Same precedent as diagram-facts.js: the import
+// shifted every id by 1,000,000, so a pre-offset ref resolves by adding the offset.
+const IMPORT_ID_OFFSETS = [0, 1_000_000];
+
+// PURE — every id a single textual ref could mean, most likely first. A short ref
+// yields the offset candidate too; a live-width ref is already resolved.
+function idCandidates(raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0) return [];
+  // A ref already in the LIVE width is resolved - probing an offset on it would invent
+  // a second id that is not what the text says (1001380 + 1e6 = 2001380, a row nobody
+  // wrote). The offset probe exists for the SHORT pre-offset form only.
+  if (String(n).length >= 6) return [String(n)];
+  const out = [];
+  for (const off of IMPORT_ID_OFFSETS) {
+    const cand = String(n + off);
+    // Only offer a candidate that could BE an id: the live space is 6-7 digits.
+    if (cand.length >= 6 && cand.length <= 7 && !out.includes(cand)) out.push(cand);
+  }
+  return out;
+}
+
+// Ids that share the integer space but are NOT tasks. Measured, not guessed: the
+// first run of this over the live board returned two hits and one was task 1002844's
+// 'Source: idea 1000454' — an idea citation, whose id happens to look like a task's.
+// Reporting it would have sent a human to look up a task that does not exist, which
+// is the very failure this detector exists to stop.
+const OTHER_ENTITY_RE = /\b(?:idea|blocker|report|learning|claim|builder|goal|version|PR|pull\s+request)\s+#?$/i;
+
+// PURE — the ids this text appears to declare a GATE on. Exported so the rule is
+// testable without a DB: the risk here is a matcher that quietly matches nothing (a
+// clean report) or everything (a report nobody reads).
+function proseGatedIds(text) {
+  const src = String(text || '');
+  const out = new Set();
+  for (const m of src.matchAll(ID_RE)) {
+    const rawId = m[1] || m[2];
+    const before = src.slice(Math.max(0, m.index - GATE_WINDOW), m.index);
+    // An id belonging to another entity is not a task gate, whatever governs it.
+    if (OTHER_ENTITY_RE.test(before)) continue;
+    // The window stops at a SENTENCE BOUNDARY. Also measured: the same false
+    // positive had 'needs' in the preceding sentence ('…the first thing that task
+    // needs. Source: idea 1000454'), so a fixed-width window let a verb govern across
+    // a full stop. A gate and its id belong to one sentence.
+    // A liveness assertion binds TIGHTLY to the id on either side, so it needs no
+    // window and no sentence rule.
+    const after = src.slice(m.index + m[0].length, m.index + m[0].length + 60);
+    if (LIVENESS_BEFORE_RE.test(before) || LIVENESS_AFTER_RE.test(after)) { for (const c of idCandidates(rawId)) out.add(c); continue; }
+    // A GATE may be a few words back, but the window stops at a SENTENCE BOUNDARY:
+    // measured, a fixed-width window let 'needs' govern across a full stop and a
+    // semicolon into an unrelated clause.
+    const lastStop = Math.max(before.lastIndexOf('. '), before.lastIndexOf('\n'), before.lastIndexOf('; '));
+    const governing = lastStop === -1 ? before : before.slice(lastStop + 1);
+    // Only the text BEFORE the id, so 'task 1001380 needs review' is not read as a
+    // gate ON 1001380 — the verb has to govern the id, not follow it.
+    if (GATE_PHRASE_RE.test(governing)) for (const c of idCandidates(rawId)) out.add(c);
+  }
+  return out;
+}
+
+// PURE — live tasks whose PROSE names a dead task as a gate. `tasks` are rows with
+// { id, status, description }; `statusById` answers what an id's status is.
+// Deliberately mirrors findStrandedTasks' shape so audit-deps can print one answer
+// to "what is stranded" rather than two.
+function findProseGatedTasks(tasks, statusById) {
+  const out = [];
+  for (const t of Array.isArray(tasks) ? tasks : []) {
+    if (!t || !LIVE_STATUSES.has(String(t.status))) continue;
+    const dead = [];
+    for (const id of proseGatedIds(t.description)) {
+      if (String(id) === String(t.id)) continue; // a task citing itself is not a gate
+      const st = statusById(id);
+      if (st && DEAD_DEP_STATUSES.has(String(st))) dead.push({ id: String(id), status: String(st) });
+    }
+    if (dead.length) out.push({ task_id: t.id, status: t.status, title: t.title, prose_dead_deps: dead.sort((a, b) => Number(a.id) - Number(b.id)) });
+  }
+  return out;
+}
+
 module.exports = {
   DEAD_DEP_STATUSES, LIVE_STATUSES,
   absorbedInto, depRefusalRow, splitDeadDeps, deadDepHint, findStrandedTasks,
+  proseGatedIds, findProseGatedTasks, idCandidates, GATE_PHRASE_RE, GATE_WINDOW, OTHER_ENTITY_RE,
+  LIVENESS_BEFORE_RE, LIVENESS_AFTER_RE, IMPORT_ID_OFFSETS,
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.821",
+  "version": "1.19.822",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.821",
+      "version": "1.19.822",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.821",
+  "version": "1.19.822",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/audit-deps.js

@@ -17,14 +17,15 @@
 // gate's notion of "overlap".
 //
 //   node scripts/gds/audit-deps.js [--version GDS-V3] [--min high|medium|low] [--json]
-//   node scripts/gds/audit-deps.js --stranded [--json]   # the INVERSE: dead edges (task 1003153)
+//   node scripts/gds/audit-deps.js --stranded [--json]   # the INVERSE: dead edges (task 1003153),
+//                                                      # plus prose-declared gates naming a dead task (task 1003857, advisory)
 
 const { touchesOverlap } = require('../../src/bongos/path-match.js');
 const { cliClient } = require('./cli-lib');
 const { resolveDefaultVersion } = require('./version-select.js');
 // task 1003153 — the DEAD-edge detector core, shared with the claim refusal so
 // "abandoned dependency" means one thing across the CLI, the route and this audit.
-const { findStrandedTasks } = require('../../modules/lifecycle/dead-deps.js');
+const { findStrandedTasks, findProseGatedTasks } = require('../../modules/lifecycle/dead-deps.js');
 // task 1003752 — the route's page bound + the first-page offset rule, declared once.
 const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
 
@@ -129,6 +130,16 @@ async function reportStranded({ asJson }) {
     process.exit(1);
   }
   const stranded = findStrandedTasks(all);
+  // task 1003857: the same question asked of PROSE. The structured graph above
+  // reads blocked_by edges; a gate written in a description is unpoliced, and stales
+  // identically — task 1002839 told a builder to coordinate with "existing open task
+  // 1001380", abandoned since 2026-08-18. Reported HERE rather than in a second tool
+  // so there is one answer to "what is stranded".
+  const statusById = (() => {
+    const byId = new Map(all.map((t) => [String(t.id), String(t.status)]));
+    return (id) => byId.get(String(id)) || null;
+  })();
+  const proseGated = findProseGatedTasks(all, statusById);
 
   // Context worth stating even at zero: abandoned tasks that still CARRY
   // dependents are the latent trap. They report clean only because every
@@ -139,7 +150,10 @@ async function reportStranded({ asJson }) {
   }
 
   if (asJson) {
-    console.log(JSON.stringify({ stranded, abandoned_deps_with_dependents: [...gatingAbandoned] }, null, 2));
+    console.log(JSON.stringify({ stranded, prose_gated: proseGated, abandoned_deps_with_dependents: [...gatingAbandoned] }, null, 2));
+    // ADVISORY: a prose match never changes the exit code. It is weaker evidence than
+    // an edge — the text may be history, a citation, or simply wrong — so it reports
+    // candidates for a human and must not gate a sweep or a CI leg.
     return stranded.length ? 1 : 0;
   }
   console.log(`audit-deps --stranded: ${all.length} task(s) scanned — ${stranded.length} LIVE task(s) stranded by an abandoned dependency\n`);
@@ -149,6 +163,14 @@ async function reportStranded({ asJson }) {
     console.log(`           fix: drop the edge (DELETE /dependencies {"from_kind":"task","from_id":${s.task_id},"to_kind":"task","to_id":${s.dead_deps[0].id}})`);
     console.log(`             or restore the dep (POST /tasks/${s.dead_deps[0].id}/promote)\n`);
   }
+  if (proseGated.length) {
+    console.log(`Prose-declared gates naming a dead task: ${proseGated.length} (ADVISORY — a human reads these; they never gate a claim)\n`);
+    for (const p of proseGated) {
+      console.log(`[PROSE]    #${p.task_id} [${p.status}]  ${(p.title || '').slice(0, 70)}`);
+      for (const d of p.prose_dead_deps) console.log(`           body names → #${d.id} [${d.status}]`);
+      console.log('           fix: correct the sentence (PATCH /tasks/' + p.task_id + ' {"description":…}), or promote the named task if the gate is real\n');
+    }
+  }
   if (!stranded.length) {
     console.log('Nothing stranded — no live task is gated by an abandoned dependency.');
     console.log(`Latent exposure: ${gatingAbandoned.size} abandoned task(s) still carry dependents; they read clean only`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.821'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.822'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/prose_gated_deps.mjs

@@ -0,0 +1,139 @@
+// tests/prose_gated_deps.mjs — a gate written in a task's DESCRIPTION goes stale the
+// same way an edge does, and nothing was watching (task 1003857).
+//
+// The structured detector (task 1003153) reads blocked_by edges and never touches a
+// description. Task 1002839 sat at `ready` telling a builder to coordinate with
+// "existing open task 1001380" — abandoned since 2026-08-18, superseded by ADR 0089.
+//
+// EVERY REGEX HERE WAS SIZED BY MEASUREMENT, not by reading the spec, and the cases
+// below are the measurements. The first cut over the live board (3,647 tasks) returned
+// two hits and BOTH taught something: one was an `idea` id wearing a task-shaped
+// number, and the true positive only matched because a verb leaked across a semicolon.
+// Tightening that correctly dropped the true positive too — which is how the liveness
+// phrasing was found, because the real sentence is not a dependency at all.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { proseGatedIds, findProseGatedTasks, idCandidates, LIVE_STATUSES } = require('../modules/lifecycle/dead-deps.js');
+
+const ids = (t) => [...proseGatedIds(t)];
+
+test('the LIVE sentence from task 1002839 is caught', () => {
+  // Verbatim. This is a liveness assertion, not a dependency — "existing open task N".
+  assert.deepEqual(
+    ids('this is a gate-review HARD FLOOR surface under ADR 0043 and needs owner approval even for an Archon; and existing open task 1001380 covers overlapping ground with stale touches[]'),
+    ['1001380'],
+  );
+});
+
+test('a liveness assertion AFTER the id is caught too', () => {
+  assert.deepEqual(ids('task 1001380 (Unify the grader: one multimodal engine) is ready to claim'), ['1001380']);
+  assert.deepEqual(ids('task 1001380 remains open'), ['1001380']);
+});
+
+test('an ordinary dependency phrasing is caught', () => {
+  assert.deepEqual(ids('needs task 1001380 to land first'), ['1001380']);
+  assert.deepEqual(ids('depends on #1001380'), ['1001380']);
+  assert.deepEqual(ids('blocked by 1001380'), ['1001380']);
+});
+
+test('an ANOTHER-ENTITY id is not a task gate', () => {
+  // Measured: 'Source: idea 1000454' was one of two hits on the first live run.
+  // Reporting it sends a human to look up a task that does not exist — the exact
+  // failure this detector exists to prevent.
+  assert.deepEqual(ids('the first thing that task needs. Source: idea 1000454'), []);
+  assert.deepEqual(ids('needs idea 1000454'), []);
+  assert.deepEqual(ids('blocked by blocker 1000082'), []);
+  assert.deepEqual(ids('after PR 1000454 lands'), []);
+});
+
+test('a gate verb does NOT reach across a sentence or clause boundary', () => {
+  // Measured: a fixed-width window let 'needs' govern an id in the next clause.
+  assert.deepEqual(ids('this needs owner approval; see 1001380 for history'), []);
+  assert.deepEqual(ids('this needs approval. Background in 1001380.'), []);
+});
+
+test('history and citation are not gates', () => {
+  assert.deepEqual(ids('this supersedes task 1001380'), []);
+  assert.deepEqual(ids('task 1001380 needs review'), [], 'the verb must govern the id, not follow it');
+  assert.deepEqual(ids('open questions remain; see 1001380'), []);
+});
+
+test('a bare number that is not a task id is ignored', () => {
+  assert.deepEqual(ids('needs the 2026 rollout and 4784 commits'), []);
+});
+
+// ---- OFFSET-AWARENESS (task 1003857) ---------------------------------------
+//
+// THE TRAP THE TASK NAMES, and which I walked straight into by reading only the first
+// part of the description. Task 1000528's own gate is written as a bare PRE-OFFSET
+// short-form ref (`#513`, `task 506`), not the live id — so a live-id-only matcher
+// misses the very case that motivated the original row. The import shifted every id by
+// 1,000,000; diagram-facts.js's IMPORT_ID_OFFSETS is the existing precedent for probing
+// both spaces.
+
+test('a SHORT pre-offset ref resolves to its live id', () => {
+  assert.deepEqual(ids('needs task 528 to land first'), ['1000528']);
+  assert.deepEqual(ids('blocked by #528'), ['1000528']);
+});
+
+test('a LIVE-width ref is NOT offset a second time', () => {
+  // 1001380 + 1e6 = 2001380, a row nobody ever wrote. Probing an already-resolved id
+  // invents a second candidate that the text does not say.
+  assert.deepEqual(ids('and existing open task 1001380 covers overlapping ground'), ['1001380']);
+  assert.deepEqual(idCandidates('1001380'), ['1001380']);
+  assert.deepEqual(idCandidates('528'), ['1000528']);
+});
+
+test('a short ref needs an explicit task/# prefix — a bare small number is not an id', () => {
+  // This runs over every description on the board, where a 3-digit number is a count, a
+  // line number or a year far more often than it is a task.
+  assert.deepEqual(ids('needs 3 more reviews'), []);
+  assert.deepEqual(ids('needs 528 lines changed'), []);
+  assert.deepEqual(ids('needs task 528'), ['1000528'], 'the prefix is what makes it a ref');
+});
+
+test('the offset probe still respects the gate/liveness rules', () => {
+  assert.deepEqual(ids('this supersedes task 528'), [], 'history is not a gate, at either width');
+  assert.deepEqual(ids('needs idea 454'), [], 'another entity is not a task, at either width');
+  assert.deepEqual(ids('existing open task 528 covers this'), ['1000528'], 'liveness works at short width too');
+});
+
+test('findProseGatedTasks reports only LIVE rows gated on a DEAD one', () => {
+  const statusById = (id) => ({ 1001380: 'abandoned', 1001381: 'shipped' })[id] || null;
+  const rows = [
+    { id: '1', status: 'ready', title: 'a', description: 'needs task 1001380' },
+    { id: '2', status: 'ready', title: 'b', description: 'needs task 1001381' },  // dep alive
+    { id: '3', status: 'shipped', title: 'c', description: 'needs task 1001380' }, // row not live
+  ];
+  const out = findProseGatedTasks(rows, statusById);
+  assert.equal(out.length, 1);
+  assert.equal(out[0].task_id, '1');
+  assert.deepEqual(out[0].prose_dead_deps, [{ id: '1001380', status: 'abandoned' }]);
+});
+
+test('a task citing ITSELF is not gated on itself', () => {
+  const out = findProseGatedTasks(
+    [{ id: '1001380', status: 'ready', title: 'x', description: 'needs task 1001380' }],
+    () => 'abandoned',
+  );
+  assert.deepEqual(out, []);
+});
+
+test('an unknown id is not reported — absence of a row is not death', () => {
+  const out = findProseGatedTasks(
+    [{ id: '1', status: 'ready', title: 'x', description: 'needs task 1009999' }],
+    () => null,
+  );
+  assert.deepEqual(out, [], 'a task the caller cannot see may simply be outside the page it fetched');
+});
+
+test('LIVE_STATUSES is the shared notion, not a second copy', () => {
+  // If this detector grew its own status set, the two halves of --stranded would
+  // disagree about what "live" means and nobody would notice.
+  assert.ok(LIVE_STATUSES.has('ready') && LIVE_STATUSES.has('backlog'));
+  assert.ok(!LIVE_STATUSES.has('shipped') && !LIVE_STATUSES.has('abandoned'));
+});