@bongos/core 1.19.870 → 1.19.872

package/scripts/gds/run-unit-tests.js

@@ -35,6 +35,13 @@ const PER_TEST_TIMEOUT_MS = 90_000;
 // DB-free unit file, so the `--integration` gate (task 1002221 / audit H1) gives each one a much
 // longer budget than the 90s unit cap.
 const INTEGRATION_TIMEOUT_MS = 300_000;
+// A PARKED test is expected to fail, and a failing test fails fast — it throws or
+// trips an assertion. Handing it the full run-to-completion budget only buys the
+// right to burn five billable CPU-minutes per HUNG entry on every main push, and
+// this set is re-checked on each one. A minute is ample for a verdict that is
+// expected to arrive in seconds; an entry that needs longer than that to fail is
+// itself the finding.
+const PARKED_RECHECK_TIMEOUT_MS = 60_000;
 
 // Feature-module test sets (R59 / task 1198). A test that exercises a feature
 // MODULE runs only when this instance enables that module — a vanilla Cloud
@@ -268,6 +275,79 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
   return { included, skippedDisabled };
 }
 
+// ── INTEGRATION_PARKED — the integration lane's known-failing set (task 1004034) ──
+//
+// The integration lane (task 1000862) gave these 20 their FIRST EVER run on
+// 2026-09-17 and all 20 failed. None is a regression: nothing had ever executed
+// them, in any lane, so nothing was keeping them honest. Parked by owner decision
+// so the lane can gate the tests that DO pass — a gate that is already red gates
+// nothing, the same argument task 1002617 made for the unit lane.
+//
+// WHY A SEPARATE SET, AND NOT KNOWN_FAILING. KNOWN_FAILING is paired with
+// tests/known_failing_ratchet.mjs, which re-executes each parked test and reds the
+// suite the moment one starts passing. That ratchet runs in the DB-FREE lane: an
+// integration test executed there fails for want of a database, so `still fails`
+// would be trivially true and a genuine fix would go unnoticed. Parking these there
+// would have bought the appearance of tracking and none of it.
+//
+// So the guarantee is kept where it can actually hold: `--integration-parked` runs
+// this set WITH the database and FAILS when one PASSES. Same ratchet semantics, in
+// the only environment that can tell the difference. The integration workflow runs
+// it as a blocking step, so fixing one of these reds the lane until its entry here
+// is removed.
+//
+// Triage per test, and the owner decision, are on task 1004034. The causes are
+// heterogeneous — stale post-de-branding expectations, unseeded fixtures, temp-dir
+// assumptions, a missing core tarball, DB-state collisions — so these come off this
+// list one at a time, not in a batch.
+//
+// acclaim_feed_evidence_db WAS LEFT OUT OF THE FIRST PASS, deliberately and on the
+// evidence then available: it PASSED in CI run 35291948008, and parking a test that
+// passes makes --integration-parked red the lane immediately. Two later readings
+// reversed that — it fails 2/2 alone on a freshly migrated database, and it FAILED in
+// run 35404478232, the first run after the parking landed. The single pass was the
+// anomaly. It fails on `duplicate key value violates unique constraint
+// "versions_one_planning_idx"`: the seeds create a version at status='planning', a
+// partial unique index permits exactly one, and the test adds another — so it leans on
+// the seeded state of `versions` rather than establishing its own, which is also how
+// its verdict moves between runs. needs_rebase trips the same constraint and is
+// already here. IF THE PARKED RATCHET EVER REDS NAMING THIS TEST, that is this known
+// oscillation, not a fix: the real repair is to stop it colliding — give it its own
+// version row, or roll back in a transaction the way the other DB-writing entries do.
+//
+// handle_machinery IS THE SAME DEFECT SEEN FROM THE OTHER SIDE, and it is why the
+// ratchet moved to its own job with its own database (task 1004043). It PASSES once
+// the suite has run and FAILS from a pristine one — verified by migrating an empty
+// database and running it alone. So it is correctly parked: it fails from exactly the
+// state the gate starts in. Do NOT unpark it on the strength of a green post-suite
+// reading; that reading answers a different question. Like acclaim_feed_evidence_db
+// above, the real repair is for the test to establish the state it needs instead of
+// inheriting whatever ran before it.
+//
+// THE THREE DEV-BOX TESTS ARE PARKED, NOT DELETED, and that reverses a first pass
+// of this task. The owner ruled that dev-box work can go, and boxes / box_onboard /
+// box_connect_e2e were duly deleted — but modules/dev-box/ is still present, still
+// mounted and unmodified by that change, and those files carry the only regression
+// coverage for LIVE guards: the setBoxState column allowlist (SQL injection), the
+// rank/authz floors, the spoofed X-Forwarded-Host that must never reach the served
+// connect.sh, and the authorized_keys command= / embedded-newline rejections.
+// Deleting a security regression test for code that still runs is not retirement,
+// it is removing the alarm and leaving the door. modules/dev-box/CLAUDE.md also
+// still names boxes + box_onboard as that module's required suite, and
+// scripts/gds/smoke-box.sh still invokes all three by path — deleting the files
+// turned that script into an immediate MODULE_NOT_FOUND. They come out when the
+// module does, in the change that removes it.
+const INTEGRATION_PARKED = new Set([
+  'acclaim_feed_evidence_db',
+  'bfg', 'bfg_write', 'box_connect_e2e', 'box_onboard', 'boxes',
+  'claim_gate_open_blocker', 'claim_gate_rebase',
+  'clawback_confirmed_backlog', 'consumer_layout_boot', 'copy_desk_flags_db',
+  'government_board_membership_db', 'handle_machinery', 'hub_profile_leak',
+  'idea_credit_streams_db', 'memory_isolation', 'memory_pull', 'needs_rebase',
+  'profile_fields', 'project_visibility_db', 'reward_mode_cost_plus_only',
+  'session_earnings_mirror_db', 'setup_smoke', 'status-probe',
+]);
+
 function main() {
   // Two gates from one runner (task 1002221 / audit H1):
   //   default        — the DB-free UNIT gate: every test file MINUS the integration set (+ known-
@@ -278,6 +358,44 @@ function main() {
   //                     is what promotes tests/consumer_layout_boot.mjs from "excluded + ad-hoc" to a
   //                     first-class gate a release step can invoke with one command.
   const integrationMode = process.argv.includes('--integration');
+
+  // --integration-parked — the ratchet for INTEGRATION_PARKED. Runs ONLY the parked
+  // set and inverts the verdict: a parked test that PASSES fails this run, because an
+  // allowlist that outlives the failures it documents is how a graveyard starts. Needs
+  // the same database the integration lane provides; running it DB-free would report
+  // every entry as still-failing and prove nothing.
+  if (process.argv.includes('--integration-parked')) {
+    const parked = [...INTEGRATION_PARKED].sort();
+    console.log(`run-unit-tests --integration-parked: re-checking ${parked.length} parked test(s)`);
+    const nowPassing = [];
+    for (const name of parked) {
+      const file = path.join(TESTS_DIR, `${name}.mjs`);
+      if (!fs.existsSync(file)) {
+        console.log(`  GONE  ${name} — parked but the file no longer exists; remove its entry`);
+        nowPassing.push(name);
+        continue;
+      }
+      try {
+        execFileSync(process.execPath, [file], {
+          stdio: ['ignore', 'ignore', 'ignore'],
+          timeout: PARKED_RECHECK_TIMEOUT_MS,
+          env: { ...process.env, NODE_ENV: 'test' },
+        });
+        console.log(`  PASSES  ${name} — fixed; remove it from INTEGRATION_PARKED`);
+        nowPassing.push(name);
+      } catch (_) {
+        console.log(`  still red  ${name}`);
+      }
+    }
+    if (nowPassing.length) {
+      console.error(`\nrun-unit-tests --integration-parked: ${nowPassing.length} parked test(s) no longer fail — ${nowPassing.join(', ')}.`);
+      console.error('Remove each from INTEGRATION_PARKED in scripts/gds/run-unit-tests.js so the lane starts gating it again (task 1004034).');
+      process.exit(1);
+    }
+    console.log('every parked test still fails — the list is current.');
+    process.exit(0);
+  }
+
   const perTestTimeout = integrationMode ? INTEGRATION_TIMEOUT_MS : PER_TEST_TIMEOUT_MS;
 
   const files = fs
@@ -285,7 +403,7 @@ function main() {
     .filter((f) => f.endsWith('.mjs'))
     .map((f) => f.replace(/\.mjs$/, ''))
     .filter((name) => integrationMode
-      ? (INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name))
+      ? (INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !INTEGRATION_PARKED.has(name) && !SUPPORT_MODULES.has(name))
       : (!INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name) && !MODULE_DISABLED.has(name)))
     .sort();
 
@@ -385,4 +503,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { discoverModuleTests, isCleanTeardownAbort, describeFailures, STATUS_DESCRIPTION_MAX };
+module.exports = { discoverModuleTests, isCleanTeardownAbort, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };

package/scripts/gds/sequence.js

@@ -576,6 +576,9 @@ module.exports = {
   readArgv,
   edgeIds,
   rowsOf,
+  // exported for the Autobongos supervisor (task 1003902) so the claimable feed
+  // is read one way, not copied into a second place that can drift.
+  fetchClaimableIds,
   fetchGoalTasks,
   fetchGoalTaskRows,
   declaredSurfaceExcludesMigrations,

package/scripts/gds/start.js

@@ -221,9 +221,15 @@ function cell(s) {
 // Per-column values, shared by the markdown table and the widget. Version
 // (V2 / GDS-V4) is its own column; Type is the work lane (Engineer / Artist /
 // Ideator), its own column rather than baked into the title.
-function disciplineLabel(t) {
+// task 1003936: ONE word for this axis — Role, per ADR 0174 Decision 5. The hall's
+// copy of this lives in modules/hall-ui/public/dom-utils.js (OTB.roleLabel); this
+// card is a separate runtime and cannot read it, so the word is restated here and
+// nowhere else in this file. 'ui' keeps its upper case, as the hall's does.
+const ROLE_AXIS_LABEL = 'Role';
+function roleLabel(t) {
   const d = t.discipline;
-  return d && d !== 'unclassified' ? d.charAt(0).toUpperCase() + d.slice(1) : '';
+  if (!d || d === 'unclassified') return '';
+  return d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1);
 }
 // Per-lane accent — the OTB palette (sea / terracotta / olive); mid-ramp hexes
 // that read in both light and dark. Colours the Type column so the work lane
@@ -249,11 +255,11 @@ function claimableTable(rows, rewardFromServer) {
   // and footnote what IS paid below the table (task 1002469).
   const perTask = rewardPolicy(rewardFromServer).perTaskCredit;
   const rewardHead = perTask ? 'Reward' : 'Reward (est.)';
-  const headers = ['#', 'Version', 'Type', rewardHead, 'Est.', 'What it is'];
+  const headers = ['#', 'Version', ROLE_AXIS_LABEL, rewardHead, 'Est.', 'What it is'];
   const body = rows.map((t) => [
     surface.taskRef(t.id, HALL_TASK),
     cell(t.version_id || '?'),
-    cell(disciplineLabel(t) || '—'),
+    cell(roleLabel(t) || '—'),
     `${t.credits_reward ?? 0}c`,
     estimateShort(t),
     cell(whatItIs(t)),
@@ -462,7 +468,7 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
     return `<tr class="bs-tr" role="button" tabindex="0" title="${titleAttr}" onclick="sendPrompt('${claimMsg}')" onkeydown="if(event.key==='Enter'||event.key===' '){event.preventDefault();sendPrompt('${claimMsg}')}">`
       + TD(`#${hesc(t.id)}`, 'bs-id')
       + TD(hesc(t.version_id || '?'), 'bs-nowrap')
-      + TD(`${laneDot}${hesc(disciplineLabel(t) || '—')}`, 'bs-ellip-sub')
+      + TD(`${laneDot}${hesc(roleLabel(t) || '—')}`, 'bs-ellip-sub')
       + TD(hesc((t.credits_reward ?? 0) + 'c'))
       + TD(hesc(estimateShort(t)), 'bs-sub')
       + TD(hesc(t.title || ''), 'bs-ellip')
@@ -472,7 +478,7 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
   const menu = claimable.length
     ? `<table class="bs-table">
     <colgroup><col style="width:44px;"><col style="width:52px;"><col style="width:68px;"><col style="width:48px;"><col style="width:44px;"><col></colgroup>
-    <thead><tr class="bs-thead">${TH('#')}${TH('Version')}${TH('Type')}${TH('Reward')}${TH('Est.')}${TH('What it is')}</tr></thead>
+    <thead><tr class="bs-thead">${TH('#')}${TH('Version')}${TH(ROLE_AXIS_LABEL)}${TH('Reward')}${TH('Est.')}${TH('What it is')}</tr></thead>
     <tbody>${rows}</tbody>
   </table>`
     : `<div class="bs-line">Nothing claimable right now — everything is in flight, blocked, or shipped. <a href="#" onclick="event.preventDefault();sendPrompt('Run blocker-review')" class="bs-link">See what's stuck ↗</a></div>`;
@@ -487,9 +493,9 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
   let crossLane = '';
   if (recommendations.length > 0) {
     const ids = recommendations.map((t) => '#' + t.id).join(', ');
-    crossLane = ` · <a href="#" onclick="event.preventDefault();sendPrompt('${jsq('Show me the tasks outside my disciplines: ' + ids)}')" class="bs-link">Outside your lanes: ${hesc(ids)} ↗</a>`;
+    crossLane = ` · <a href="#" onclick="event.preventDefault();sendPrompt('${jsq('Show me the tasks outside my disciplines: ' + ids)}')" class="bs-link">Outside your roles: ${hesc(ids)} ↗</a>`;
   } else if (routingByPreference) {
-    crossLane = ` · <a href="#" onclick="event.preventDefault();sendPrompt('Show me every lane, not just mine')" class="bs-link">Show all lanes ↗</a>`;
+    crossLane = ` · <a href="#" onclick="event.preventDefault();sendPrompt('Show me every role, not just mine')" class="bs-link">Show all roles ↗</a>`;
   }
 
   const summary = `builder-start: ${claimable.length} task${claimable.length === 1 ? '' : 's'} you can claim now, plus your current build status. Click a task to claim it.`;
@@ -977,10 +983,10 @@ async function main() {
   if (recommendations.length > 0) {
     const ids = recommendations.map((t) => `#${t.id}`).join(', ');
     console.log('');
-    console.log(`Outside your lanes: ${ids} — say the word to see them, or run with \`--all-disciplines\`.`);
+    console.log(`Outside your roles: ${ids} — say the word to see them, or run with \`--all-disciplines\`.`);
   } else if (routingByPreference) {
     console.log('');
-    console.log('_Showing your lanes — run with `--all-disciplines` to see every lane._');
+    console.log('_Showing your roles — run with `--all-disciplines` to see every role._');
   }
 
   // ---------- next ----------

package/src/bongos/core-update.js

@@ -0,0 +1,147 @@
+'use strict';
+
+// src/bongos/core-update.js — "is a newer @bongos/core published, and could THIS
+// instance take it?", answered by the instance itself (task 1004045).
+//
+// WHY THIS IS NOT THE PROVISIONING SNAPSHOT, which already holds the answer for
+// every project the platform hosts. `provisioning_core_version_snapshot` (task
+// 1003159) lives in the CONTROL PLANE's database, and the provisioning module is
+// not installed on a hosted project at all — probed 2026-09-18:
+// `/api/bongos/provisioning/health` answers 200 on the platform and 404 on every
+// tenant. So a banner in an owner's OWN hall cannot read it, and a self-hosted
+// instance with no control plane anywhere could not read it even in principle.
+// Asking the registry directly is the only source EVERY instance has, which is
+// what "every owner's hall" requires.
+//
+// NEVER `npm view` HERE. update-channel.js's `listAvailableVersions` shells out
+// SYNCHRONOUSLY, and ADR 0293 names exactly that as the reason the deploy route
+// does not consult the registry: it would block the event loop for every other
+// request on the process. This is a plain HTTPS GET of the abbreviated packument,
+// cached for hours, with a hard timeout — and fail-SOFT, because an instance
+// behind a firewall that cannot reach the registry must render no banner rather
+// than a wrong one.
+//
+// THE CHANNEL RULE IS NOT RESTATED HERE. `resolveChannelTarget` is the runner's
+// OWN function (scripts/gds/update-channel.js) and is imported, not copied: the
+// banner must never offer a version the runner would then refuse, and ADR 0280
+// is the record of what a second copy of this contract costs when it drifts.
+
+const https = require('node:https');
+const {
+  CORE_PKG,
+  DEFAULT_CHANNEL,
+  normalizeChannel,
+  resolveChannelTarget,
+} = require('../../scripts/gds/update-channel.js');
+
+const REGISTRY_ORIGIN = 'https://registry.npmjs.org';
+// Six hours. The core publishes many times a day, but a banner is not a deploy
+// signal — it is "you are behind", which does not become more true for being
+// re-checked every minute, and each check is an outbound request from someone
+// else's server.
+const TTL_MS = 6 * 60 * 60 * 1000;
+const FETCH_TIMEOUT_MS = 4000;
+
+/**
+ * The banner's whole decision. PURE — every input injected, no clock, no I/O.
+ *
+ * `reading` is a named state rather than a bare null so a caller cannot render
+ * "up to date" over an ANSWER WE DO NOT HAVE. previewFromSnapshot carries the
+ * same field for the same reason; the failure it prevents is a project that is
+ * months behind being told, confidently, that it is current.
+ */
+function coreUpdateVerdict({ running, available, channel } = {}) {
+  const ch = normalizeChannel(channel == null ? DEFAULT_CHANNEL : channel);
+  const versions = Array.isArray(available) ? available.filter((v) => typeof v === 'string') : [];
+  if (!running || typeof running !== 'string' || !versions.length) {
+    return { running: running || null, latest: null, behind: false, reading: 'no_answer', channel: ch };
+  }
+  // null when nothing published is both newer AND within the channel — which is
+  // the ordinary "you are current" case, not an error.
+  const latest = resolveChannelTarget({ installed: running, channel: ch, available: versions });
+  return { running, latest: latest || null, behind: !!latest, reading: 'ok', channel: ch };
+}
+
+/**
+ * Published versions of the core, from the registry. Fail-SOFT: any error, any
+ * non-200, any unparseable body ⇒ { ok:false, versions:[] }, never a throw.
+ *
+ * Asks for the ABBREVIATED packument (the `install-v1` media type): the full
+ * document for a package with ~900 releases is megabytes, and the only field
+ * this needs is the version list.
+ */
+function fetchPublishedVersions({ pkg = CORE_PKG, origin = REGISTRY_ORIGIN, timeoutMs = FETCH_TIMEOUT_MS, get = https.get } = {}) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (v) => { if (!settled) { settled = true; resolve(v); } };
+    let req;
+    try {
+      req = get(`${origin}/${pkg.replace('/', '%2f')}`, {
+        headers: { accept: 'application/vnd.npm.install-v1+json' },
+        timeout: timeoutMs,
+      }, (res) => {
+        if (res.statusCode !== 200) { res.resume(); return done({ ok: false, versions: [], error: `registry ${res.statusCode}` }); }
+        let body = '';
+        res.setEncoding('utf8');
+        res.on('data', (c) => { body += c; });
+        res.on('end', () => {
+          try {
+            const doc = JSON.parse(body);
+            const versions = Object.keys((doc && doc.versions) || {});
+            done(versions.length ? { ok: true, versions } : { ok: false, versions: [], error: 'no versions in packument' });
+          } catch (e) { done({ ok: false, versions: [], error: `unparseable packument: ${e.message}` }); }
+        });
+      });
+    } catch (e) { return done({ ok: false, versions: [], error: e.message }); }
+    if (req && req.on) {
+      req.on('error', (e) => done({ ok: false, versions: [], error: e.message }));
+      // `timeout` only fires the event; it does not abort the request.
+      req.on('timeout', () => { try { req.destroy(); } catch { /* already gone */ } done({ ok: false, versions: [], error: 'registry timeout' }); });
+    }
+  });
+}
+
+// Process-local cache. Deliberately not a table: it is a derived fact with a
+// six-hour life, and a restart re-deriving it costs one request.
+const cache = { at: 0, versions: [], ok: false, inflight: null };
+
+
+
+async function publishedVersions({ now = Date.now, ttlMs = TTL_MS, fetch = fetchPublishedVersions, store = cache } = {}) {
+  const t = now();
+  if (store.ok && t - store.at < ttlMs) return { ok: true, versions: store.versions, cached: true };
+  // IN-FLIGHT DE-DUPE. Without it, every request arriving during a cold-cache
+  // window starts its OWN registry read — the cache only collapses them once the
+  // first one has landed. Small, because the audience is archon-only and the TTL
+  // is hours, but a second outbound call to someone else's registry for a fact
+  // already being fetched is simply wrong, and the fix is one shared promise.
+  if (store.inflight) return store.inflight;
+  store.inflight = (async () => {
+    try {
+      const r = await fetch();
+      if (r.ok) { store.ok = true; store.at = t; store.versions = r.versions; }
+      return { ok: r.ok, versions: r.versions, cached: false, error: r.error };
+    } finally {
+      store.inflight = null;
+    }
+  })();
+  return store.inflight;
+}
+
+/**
+ * What the route answers — and the module's ONLY export, deliberately.
+ *
+ * Everything above is reachable through it: `get` swaps the HTTPS transport (so
+ * the real packument parsing and its failure modes are exercised, not stubbed
+ * past), `fetch` swaps the whole read, and `now`/`ttlMs`/`store` drive the cache.
+ * Exporting the internals individually instead would add eight exports that no
+ * non-test caller uses, which the dead-code ratchet counts as regression — and
+ * the fix for that is a smaller surface, never a raised baseline.
+ */
+async function readCoreUpdate({ running, channel, get, ...deps } = {}) {
+  const fetch = deps.fetch || (get ? () => fetchPublishedVersions({ get }) : fetchPublishedVersions);
+  const r = await publishedVersions({ ...deps, fetch });
+  return coreUpdateVerdict({ running, available: r.ok ? r.versions : [], channel });
+}
+
+module.exports = { readCoreUpdate };

package/src/bongos/routes/core-update.js

@@ -0,0 +1,49 @@
+'use strict';
+
+// src/bongos/routes/core-update.js — GET /api/bongos/core-update (task 1004045).
+//
+// "Is this instance behind, and what would it move to?" — the one fact the hall's
+// upgrade banner needs. It lives in the CORE, not in the provisioning module, for
+// the reason src/bongos/core-update.js opens with: a hosted project does not have
+// the provisioning module, so a banner that depended on it could never appear in
+// the hall of any project but the platform's own — which is the whole ask.
+//
+// GATED ON `core.pin.move`, the same atom as the deploy door, and for the same two
+// reasons ADR 0293 gives for gating its PREVIEW as tightly as its move:
+//   1. It names the exact core this box runs and how far behind it is, which is a
+//      vulnerability-window disclosure (ADR 0043) and must not sit on an
+//      unauthenticated surface.
+//   2. The banner it feeds offers an action. Showing it to someone who cannot
+//      press the button is a worse experience than showing nothing.
+// The gate costs its real audience nothing: an owner holds the atom on their own
+// instance by construction.
+
+const express = require('express');
+const { asyncHandler } = require('./_helpers');
+const auth = require('../auth');
+const { readCoreUpdate } = require('../core-update');
+
+module.exports = function buildCoreUpdateRouter() {
+  const router = express.Router();
+
+  router.get(
+    '/core-update',
+    auth.requireBuilder,
+    auth.requirePermission('core.pin.move'),
+    // asyncHandler(TAG, handler, opts) — the tag is the first argument, and
+    // passing the handler there instead makes `handler` undefined, so EVERY
+    // request 500s with "handler is not a function". That is exactly the bug the
+    // grader caught here, and it is invisible to any test that does not drive a
+    // real request through the assembled router; tests/core_update_banner.mjs now
+    // does, and fails if this call is mis-shaped again.
+    asyncHandler('GET /core-update', async (_req, res) => {
+      // Fail-soft on the version read, exactly as GET /version does: an instance
+      // that cannot name its own core reports `no_answer` and renders no banner.
+      let running = null;
+      try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
+      res.json({ ok: true, update: await readCoreUpdate({ running }) });
+    }, { errorCode: 'core_update_failed', message: false }),
+  );
+
+  return router;
+};

package/src/bongos/routes.js

@@ -19,6 +19,7 @@ const express = require('express');
 
 const buildHealthzRouter = require('./routes/healthz');
 const buildInstanceRouter = require('./routes/instance');
+const buildCoreUpdateRouter = require('./routes/core-update');
 const buildAuthRouter = require('./routes/auth');
 const buildGithubRouter = require('./routes/github');
 const buildMeRouter = require('./routes/me');
@@ -133,6 +134,7 @@ function buildGdsRouter() {
 
   router.use(buildHealthzRouter());
   router.use(buildInstanceRouter());
+  router.use(buildCoreUpdateRouter());
   router.use(buildAuthRouter());
   router.use(buildGithubRouter());
   router.use(buildMeRouter());

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.870'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.872'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -329,7 +329,9 @@ const GRANT_WORDS = {
   handle: /your name/,
   display_name: /your name/,
   avatar_url: /your picture/,
-  disciplines: /your disciplines/,
+  // task 1003936: the axis is named "role" to a person now; the invariant is that
+  // the toggle NAMES it in the sliver a recruiter receives, not which word it used.
+  disciplines: /your roles/,
   active_recently: /active in the last 30 days/,
 };