@bongos/core 1.19.877 → 1.19.878

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.877",
-  "core_contract": "1.19.877",
-  "source_commit": "7cc46fa08c1a00e2194ab40bddea2dce575e2d38",
+  "core_version": "1.19.878",
+  "core_contract": "1.19.878",
+  "source_commit": "2b2c4d57dea2fc815d5edf5a1fd9ddb076f49be9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T10:46:37.399Z",
+  "built_at": "2026-09-19T11:02:46.880Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 501,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2316,
+    "functional_verbatim": 2319,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2843,
-  "tree_sha256": "f1b43ea830cc3e9e55d49cdfc2da4528c9388b558fca838b1e54002de9e00f9d",
+  "file_count": 2846,
+  "tree_sha256": "5cf258930712618621a4d89ca402aef67b76d4b0212318336edb63c4a4a0502b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d7e2217a982356c43047a8f416106e885a22862d1bc125ea59545fc995f9b318"
+      "sha256": "2c1b16d4be5696489456b2c49d7fbef8b09d846d722860bd019968e20a88db02"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2707,7 +2707,7 @@
     {
       "path": "docs/recipes/autobongos-windows-host.md",
       "mode": "0000644",
-      "sha256": "94b0b2442708fec6f62fe98b41dc5131c114833b66c487a0056974265cc13db6"
+      "sha256": "72f38de74c8cbfd1d44de916d19572dc705b1039a4270d53e3a9065a50d8faf7"
     },
     {
       "path": "docs/recipes/bongos-cli-release.md",
@@ -3799,6 +3799,11 @@
       "mode": "0000644",
       "sha256": "722b9f3ddbd59fda3e92ae6c6fb0400eb3eadc343f0a3f84369d69bea72b7d65"
     },
+    {
+      "path": "modules/autonomy/digest.js",
+      "mode": "0000644",
+      "sha256": "cfe22a887e5a69cf314a318f7b410c81f91cfba65f7643605e9f3ac1ebef8022"
+    },
     {
       "path": "modules/autonomy/fence.js",
       "mode": "0000644",
@@ -7967,12 +7972,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4e8f5415cb5201d24ca7114d11e21d15b7042e7c6a846fed8cf10e35971305ad"
+      "sha256": "da57fd75ea411bf8a7ecad98041b7d38f6ce568bca460243b24b67bd2ddd60ba"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c616356037d3d48c3d6a49a28c89b8e7e38e13be5c9ea8a38899f51efc55a4b9"
+      "sha256": "ef72c5d5fd50006bbb62080ebf77339025a5979363d10c655e5db6f1b507850c"
     },
     {
       "path": "public-docs/index.html",
@@ -8129,6 +8134,11 @@
       "mode": "0000644",
       "sha256": "891e795c68d43d11958a2e68af0cfb1fcd5a1f3308c821f86ff37512326ef72d"
     },
+    {
+      "path": "scripts/gds/autobongos-digest.js",
+      "mode": "0000644",
+      "sha256": "b406f73bbc0f577a2a58ec99597fb92c7edc0d1628c0ca7729cd25b0a1270045"
+    },
     {
       "path": "scripts/gds/autobongos-loop.js",
       "mode": "0000644",
@@ -8137,7 +8147,7 @@
     {
       "path": "scripts/gds/autobongos-run.js",
       "mode": "0000644",
-      "sha256": "da0047f65186ea6d049799b62aaf60acc2ec1a3d4fe15875dadbdc493512d205"
+      "sha256": "24f0be946550a89f717278a418ebb68330fad3c7cdd45d3b79e85315564c7425"
     },
     {
       "path": "scripts/gds/autobongos-service.cmd",
@@ -8147,7 +8157,7 @@
     {
       "path": "scripts/gds/autobongos-service.ps1",
       "mode": "0000644",
-      "sha256": "60af163d90c3f30d6723678eb64d6ed259be5575230ee43adaebce9537a4fe9a"
+      "sha256": "3f3e44969809b3c22c9cf338af68695af6e835b861ac056d38408a4be1d202a7"
     },
     {
       "path": "scripts/gds/autobongos-verify.js",
@@ -8917,7 +8927,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "fef10e02d3b1d605c1b30fd553b1cf8069159d8c2cbf6b0e4b48ec32359562a9"
+      "sha256": "5fad0beb0a3d4b322918a99765cb922fcce1de4196c19cb08a0d3bc91c3d149e"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -9972,7 +9982,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7dbc21b0402be4d9acc429c0cd1f9fc5ba33ea4f7ab0650d89dd078d7ffb82bb"
+      "sha256": "f38e0d4d6eeb707065f278ed386fec6a66d502553ac99d1e683b7216c0bb6a99"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10399,6 +10409,11 @@
       "mode": "0000644",
       "sha256": "1b5b6e5010c45a77015a1d0d63d49cb3286eca91a83f45cb94d145af01aab7dc"
     },
+    {
+      "path": "tests/autonomy_digest.mjs",
+      "mode": "0000644",
+      "sha256": "633ede3096916c1d5571def211fabac9ae934f48723d182c54f2fe27c2ead105"
+    },
     {
       "path": "tests/autonomy_gate.mjs",
       "mode": "0000644",
@@ -10882,7 +10897,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "5f9ae4144ab85ee197f417003a71df1d78398ca11b6c8bd3dc96de9b4cd5e1fb"
+      "sha256": "a8fc77b7a32e4377b4b327bd485cbc17428421ef3fc871770fdaeee3e02e48f4"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",

package/docs/module-api-changelog.md

@@ -2227,6 +2227,8 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.876 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.875 with no explicit bump. run 35420916304. (task 1002620)
   1.19.877 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.876 with no explicit bump. run 35438291185. (task 1002620)
+        landed since 1.19.876 with no explicit bump. run 35438492966. (task 1002620)
+  1.19.878 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.877 with no explicit bump. run 35439004814. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/autobongos-windows-host.md

@@ -101,7 +101,32 @@ A runner can be **Allowed to work** and **Not checking in** at the same time:
 that is a machine that is off, unplugged or wedged, and it is the state worth
 noticing.
 
-The full log lives on the box at `%LOCALAPPDATA%\cloudbongos\autobongos.log`.
+### Reading the night
+
+The log answers "what happened" only if you are willing to read a log, and the
+whole premise is that you are not at the keyboard. One command gives you the
+night in five answers instead:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 digest
+```
+
+or from any checkout: `node scripts/gds/autobongos-digest.js` (add `--since 24h`
+for a rolling window, `--all` for everything, `--json` for the structured shape).
+
+It answers: **what shipped**, **what is on hold and why**, **what each worker
+decided that its task description did not determine**, **what it cost**, and
+**where both limit windows stand**.
+
+The third one is the one to actually read. A worker will not reliably stop and
+ask — given an under-specified task it makes the call and writes it into the
+file, which is what a good engineer does. So the decisions happen whether or not
+anyone sees them, and every line in that section is a sentence the task
+description should have contained. The task with the most entries is the thinnest
+spec you wrote, and the digest names it.
+
+The full log still lives on the box at `%LOCALAPPDATA%\cloudbongos\autobongos.log`
+if you want the raw rows.
 
 ## 5. Stopping it
 

package/modules/autonomy/digest.js

@@ -0,0 +1,344 @@
+'use strict';
+
+// modules/autonomy/digest.js — the night, readable afterwards (task 1003906,
+// ADR 0307). Pure: rows in, a digest out. No I/O, no clock of its own.
+//
+// THE OWNER IS NOT AT THE KEYBOARD. That is the whole premise, and it means the
+// run log — an append-only JSONL nobody will ever open — is not an answer. One
+// page has to answer five questions, and it has to answer them without anyone
+// reading a log: what shipped, what is on hold and why, what each worker decided
+// that its task description did not determine, what it cost, and where the two
+// limit windows stand.
+//
+// THE THIRD QUESTION IS THE ONE THAT COMPOUNDS, and it is worth saying why it is
+// here at all. A worker will NOT reliably stop to ask: tested on an ambiguous
+// task, it made four genuine judgement calls and wrote them straight into the
+// file, which is what a competent engineer does with an under-specified brief.
+// So the decisions happen either way. What the digest changes is whether anyone
+// finds out. And every entry is also a sentence the task description SHOULD have
+// contained — which makes this list a spec-quality signal, not just an audit
+// trail: the goals whose decisions pile up are the goals whose specs are thin,
+// and fixing those is what lowers tomorrow's halt count.
+//
+// WHAT COUNTS AS SHIPPED IS THE LEDGER'S ANSWER, never the worker's. A `worked`
+// row with `verified: false` is a task that ran and did not ship, and putting it
+// under "shipped" because a session ended would reintroduce the exact confusion
+// task 1003903 exists to end.
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const isRow = (r) => r && typeof r === 'object' && typeof r.event === 'string';
+
+// num — a number, or null for "not a number I can use".
+//
+// THE GUARD ON null IS LOAD-BEARING, and it is not defensive noise:
+// `Number(null)` is 0 and 0 is finite, so the obvious one-liner turns every
+// absent cost into a free worker and every absent duration into an instant one.
+// The same trap cost a bug in modules/autonomy/cadence.js's fingerprint, where an
+// unread claimable count became the literal string "null" for the same reason.
+// Empty string behaves identically. Both are spelled out rather than trusted to
+// Number().
+const num = (v) => {
+  if (v === null || v === undefined || v === '') return null;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+};
+
+function parseAt(row) {
+  const t = Date.parse(row && row.at);
+  return Number.isFinite(t) ? t : null;
+}
+
+// humanDuration — minutes and hours, the way a person says them.
+function humanDuration(s) {
+  const n = num(s);
+  if (n === null || n < 0) return null;
+  if (n < 90) return `${Math.round(n)}s`;
+  if (n < 5400) return `${Math.round(n / 60)}m`;
+  return `${(n / 3600).toFixed(1)}h`;
+}
+
+function usd(n) {
+  const v = num(n);
+  return v === null ? null : `$${v.toFixed(2)}`;
+}
+
+// windowsFromGauge — question five, from the gauge file's own shape.
+//
+// Reports what it can SEE and says so when it cannot. A digest that silently
+// omits a window reads as "nothing to report", and the one morning that matters
+// is the morning the gauge stopped being written.
+// STALENESS IS GAUGE.JS'S RULE, NOT A SECOND ONE. modules/autonomy/gauge.js holds
+// a window UNKNOWN when its `observed_at` is older than staleAfterS (30 minutes
+// by default), and the runner HOLDS on unknown. A digest that applied a laxer
+// test would print "41% used, resets in 2h" about a window the runner had already
+// decided it could not vouch for — two surfaces disagreeing about one file, with
+// the reader believing the one that is wrong. Same threshold, same conclusion.
+// (Grader finding, task 1003906.)
+function windowsFromGauge(gauge, nowEpochS, { staleAfterS = null } = {}) {
+  const limit = staleAfterS === null ? require('./gauge.js').DEFAULT_STALE_AFTER_S : staleAfterS;
+  const writtenAt = gauge && typeof gauge === 'object' ? num(gauge.written_at) : null;
+  const one = (key, label) => {
+    const w = gauge && typeof gauge === 'object' ? gauge[key] : null;
+    const used = w ? num(w.used_percentage) : null;
+    const resets = w ? num(w.resets_at) : null;
+    // Per-window observed_at, falling back to the file's written_at — exactly the
+    // shape gauge.js reads, because one window can go unreported while the other
+    // is carried forward.
+    const observedAt = w ? (num(w.observed_at) ?? writtenAt) : null;
+    if (used === null) return { key, label, known: false, detail: 'not reported' };
+
+    const ageS = observedAt !== null && Number.isFinite(nowEpochS) ? nowEpochS - observedAt : null;
+    if (ageS !== null && ageS > limit) {
+      return {
+        key, label, known: false, stale: true, usedPct: Math.round(used), resetsAt: resets, ageS,
+        detail: `last read ${Math.round(used)}% used ${humanDuration(ageS)} ago — older than the runner trusts, so it is holding`,
+      };
+    }
+    const ahead = resets !== null && Number.isFinite(nowEpochS) ? resets - nowEpochS : null;
+
+    // A RESET TIME IN THE PAST MEANS THE READING IS STALE, not that the window is
+    // about to turn over. The percentage was true of a window that has since
+    // rolled, so printing it as a live figure is worse than printing nothing —
+    // "41% used, resets in 0s" invites a decision about headroom that no longer
+    // exists. Say the reading is old and let the reader go look.
+    if (ahead !== null && ahead <= 0) {
+      return {
+        key, label, known: false, stale: true, usedPct: Math.round(used), resetsAt: resets, resetsInS: 0,
+        detail: `last read ${Math.round(used)}% used, but that window has since reset — the gauge is stale`,
+      };
+    }
+    return {
+      key, label, known: true, usedPct: Math.round(used),
+      resetsAt: resets, resetsInS: ahead,
+      detail: `${Math.round(used)}% used${ahead !== null ? `, resets in ${humanDuration(ahead)}` : ''}`,
+    };
+  };
+  return [one('five_hour', 'Five-hour window'), one('seven_day', 'Seven-day window')];
+}
+
+// ---------------------------------------------------------------------------
+// The digest
+// ---------------------------------------------------------------------------
+
+// buildDigest — every question answered from the rows, or explicitly unanswered.
+//
+// `rows` is the run log for the period, oldest first. `gauge` is the raw gauge
+// file (the same shape modules/autonomy/gauge.js reads). Unrecognised rows are
+// COUNTED rather than dropped: a digest that silently ignores what it does not
+// understand is how a new failure mode stays invisible for a week.
+function buildDigest(rows = [], { gauge = null, nowEpochS = null, sinceMs = null, untilMs = null, staleAfterS = null } = {}) {
+  const all = (Array.isArray(rows) ? rows : []).filter(isRow);
+  const worked = all.filter((r) => r.event === 'worked');
+
+  // 1. WHAT SHIPPED — the ledger's answer.
+  const shipped = worked.filter((r) => r.verified === true).map((r) => ({
+    taskId: String(r.task_id ?? ''), title: r.title || null, goalId: r.goal_id ?? null,
+    durationS: num(r.duration_s), costUsd: num(r.cost_usd),
+  }));
+
+  // 2. WHAT IS ON HOLD, AND WHY. Four different shapes of "did not ship", kept
+  // apart because the owner's next action differs for each.
+  const ranButDidNotShip = worked.filter((r) => r.verified !== true).map((r) => ({
+    taskId: String(r.task_id ?? ''), title: r.title || null,
+    shape: r.ledger_shape || 'unknown',
+    // THE LEDGER'S REASON FIRST, and the worker's only as a fallback. `row.reason`
+    // is verdict.reason — the WORKER's account of itself — and quoting that in the
+    // "did not ship" section is the precise inversion this whole goal exists to
+    // undo: a worker that stopped dead needing a decision reports success. The
+    // ledger's explanation ("the grade passed and the land never finished") is the
+    // one a person can act on. Older rows predate ledger_reason, so the fallback
+    // stays rather than leaving them blank.
+    reason: r.ledger_reason || r.reason || null,
+    remedy: r.ledger_remedy || null,
+    workerSaid: r.reason || null,
+    blockerId: r.blocker_id ?? null,
+    parked: !!r.task_parked,
+    claimReleased: !!r.claim_released,
+  }));
+
+  const fenced = all.filter((r) => r.event === 'fenced').map((r) => ({
+    code: r.code || 'unknown', reason: r.reason || null, taskId: r.task_id ? String(r.task_id) : null,
+  }));
+
+  // An UNWORKABLE QUEUE is not breakage, and the digest must not present it as
+  // such: the machine is healthy and there is nothing it may work on.
+  const unworkable = [];
+  for (const r of all) {
+    if (r.event !== 'nothing_claimable') continue;
+    for (const sk of (Array.isArray(r.skipped) ? r.skipped : [])) {
+      unworkable.push({ taskId: String(sk.id ?? ''), goalId: sk.goal_id ?? null, reasons: sk.reasons || [] });
+    }
+  }
+
+  const held = all.filter((r) => r.event === 'hold').map((r) => ({ reason: r.reason || null, sleepUntil: r.sleep_until ?? null }));
+
+  // 3. WHAT EACH WORKER DECIDED that its spec did not determine — grouped by task,
+  // because the SHAPE of this list is the signal. One task with six decisions is a
+  // thin spec; six tasks with one each is a normal night.
+  const decisions = [];
+  for (const r of worked) {
+    const list = Array.isArray(r.undetermined_decisions) ? r.undetermined_decisions : [];
+    if (!list.length) continue;
+    decisions.push({
+      taskId: String(r.task_id ?? ''), title: r.title || null, goalId: r.goal_id ?? null,
+      shipped: r.verified === true,
+      decisions: list.map((d) => String(d)),
+    });
+  }
+  const decisionCount = decisions.reduce((n, d) => n + d.decisions.length, 0);
+  // The thinnest spec of the night, named. A list is browsable; a name is
+  // actionable, and this one is the sentence the description should have carried.
+  const thinnestSpec = decisions.slice().sort((a, b) => b.decisions.length - a.decisions.length)[0] || null;
+
+  // 4. WHAT IT COST. Nulls are EXCLUDED and counted, never coerced to zero — a
+  // worker whose cost was not reported must not make the night look cheaper.
+  const costs = worked.map((r) => num(r.cost_usd));
+  const knownCosts = costs.filter((c) => c !== null);
+  const cost = {
+    totalUsd: knownCosts.reduce((a, b) => a + b, 0),
+    reported: knownCosts.length,
+    unreported: costs.length - knownCosts.length,
+    workerRuns: worked.length,
+    totalDurationS: worked.reduce((a, r) => a + (num(r.duration_s) || 0), 0),
+  };
+
+  // 5. THE TWO LIMIT WINDOWS.
+  const windows = windowsFromGauge(gauge, nowEpochS, { staleAfterS });
+
+  // How the runner spent the night, so "nothing shipped" can be told apart from
+  // "nothing ran".
+  const KNOWN = new Set(['worked', 'fenced', 'hold', 'nothing_claimable', 'dry_run',
+    'pick_failed', 'worktree_failed', 'claim_failed', 'verify_halt', 'cadence', 'boot_reconcile']);
+  const byEvent = {};
+  let unrecognised = 0;
+  for (const r of all) {
+    byEvent[r.event] = (byEvent[r.event] || 0) + 1;
+    if (!KNOWN.has(r.event)) unrecognised += 1;
+  }
+
+  const cadenceRows = all.filter((r) => r.event === 'cadence' && r.mode);
+  const endedProbing = cadenceRows.length ? cadenceRows[cadenceRows.length - 1].mode === 'probing' : false;
+
+  // reduce, not Math.min(...times): `--all` on a long-lived log can hold more
+  // timestamps than the engine will accept as call arguments, and a reporting CLI
+  // that throws on a big log fails exactly when the log is most worth reading.
+  const times = all.map(parseAt).filter((t) => t !== null);
+  const minAt = times.length ? times.reduce((a, b) => (b < a ? b : a)) : null;
+  const maxAt = times.length ? times.reduce((a, b) => (b > a ? b : a)) : null;
+  return {
+    period: {
+      fromMs: sinceMs ?? minAt,
+      toMs: untilMs ?? maxAt,
+      rows: all.length,
+    },
+    shipped,
+    onHold: { ranButDidNotShip, fenced, unworkable, held },
+    decisions, decisionCount, thinnestSpec,
+    cost,
+    windows,
+    runner: { byEvent, unrecognised, endedProbing, bootReconciles: byEvent.boot_reconcile || 0 },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Rendering
+// ---------------------------------------------------------------------------
+
+const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+
+// renderDigest — the five questions, in the order they are asked, as plain text a
+// person reads over coffee. Deliberately not a table: the widths are unknowable
+// and a wrapped table is worse than prose.
+//
+// EVERY SECTION PRINTS, even when empty. A digest whose quiet sections vanish
+// teaches its reader that absence means "fine", and then the one morning a
+// section is missing because the DATA is missing reads exactly the same.
+function renderDigest(d, { title = 'Autobongos — overnight' } = {}) {
+  const L = [];
+  const when = d.period.fromMs && d.period.toMs
+    ? `${new Date(d.period.fromMs).toISOString().slice(0, 16).replace('T', ' ')} → ${new Date(d.period.toMs).toISOString().slice(11, 16)} UTC`
+    : 'no runs recorded';
+  L.push(title, '='.repeat(title.length), when, '');
+
+  // 1
+  L.push(`SHIPPED — ${plural(d.shipped.length, 'task', 'tasks')}`);
+  if (!d.shipped.length) L.push('  nothing shipped.');
+  for (const s of d.shipped) {
+    L.push(`  ${s.taskId}  ${s.title || '(untitled)'}`);
+    const bits = [humanDuration(s.durationS), usd(s.costUsd)].filter(Boolean);
+    if (bits.length) L.push(`         ${bits.join(' · ')}`);
+  }
+  L.push('');
+
+  // 2
+  const holdTotal = d.onHold.ranButDidNotShip.length + d.onHold.fenced.length + d.onHold.unworkable.length + d.onHold.held.length;
+  L.push(`ON HOLD — ${plural(holdTotal, 'thing', 'things')}`);
+  if (!holdTotal) L.push('  nothing is waiting on you.');
+  for (const r of d.onHold.ranButDidNotShip) {
+    L.push(`  ${r.taskId}  ran but did not ship — ${r.shape}`);
+    if (r.reason) L.push(`         ${String(r.reason).slice(0, 160)}`);
+    if (r.remedy) L.push(`         next: ${String(r.remedy).slice(0, 160)}`);
+    // Printed only when it ADDS something. A worker that agreed with the ledger
+    // tells the reader nothing twice; one that claimed success against a ledger
+    // that says otherwise is the single most useful line on the page.
+    if (r.workerSaid && r.workerSaid !== r.reason) L.push(`         the worker said: ${String(r.workerSaid).slice(0, 160)}`);
+    if (r.blockerId) L.push(`         blocker ${r.blockerId}${r.parked ? ' (task parked, out of the queue)' : ''}`);
+  }
+  // Fenced refusals are collapsed by code: twenty identical lines say nothing the
+  // first one did not.
+  const byCode = {};
+  for (const f of d.onHold.fenced) (byCode[f.code] = byCode[f.code] || []).push(f);
+  for (const [code, list] of Object.entries(byCode)) {
+    L.push(`  fence: ${code} ×${list.length}`);
+    if (list[0].reason) L.push(`         ${String(list[0].reason).slice(0, 160)}`);
+  }
+  if (d.onHold.unworkable.length) {
+    L.push(`  queue: ${plural(d.onHold.unworkable.length, 'task', 'tasks')} in the allowlist, every one halted`);
+    L.push('         (this is not a runner failure — it has nothing it may work on)');
+    for (const u of d.onHold.unworkable.slice(0, 5)) L.push(`         ${u.taskId}: ${(u.reasons || []).join(', ') || 'halted'}`);
+  }
+  if (d.onHold.held.length) L.push(`  capacity: held ${plural(d.onHold.held.length, 'time', 'times')} — ${d.onHold.held[0].reason || 'no headroom'}`);
+  L.push('');
+
+  // 3 — the one that compounds.
+  L.push(`DECIDED FOR YOU — ${plural(d.decisionCount, 'decision', 'decisions')} across ${plural(d.decisions.length, 'task', 'tasks')}`);
+  if (!d.decisionCount) {
+    L.push('  no worker had to fill a gap in its spec.');
+  } else {
+    L.push('  Each line is a sentence the task description should have contained.');
+    for (const t of d.decisions) {
+      L.push(`  ${t.taskId}  ${t.title || '(untitled)'}${t.shipped ? '' : '  [did not ship]'}`);
+      for (const one of t.decisions) L.push(`       · ${one}`);
+    }
+    if (d.thinnestSpec && d.thinnestSpec.decisions.length > 1) {
+      L.push('');
+      L.push(`  Thinnest spec: ${d.thinnestSpec.taskId} (${d.thinnestSpec.decisions.length} decisions).`);
+      L.push('  Tightening that description is what lowers tomorrow’s halts.');
+    }
+  }
+  L.push('');
+
+  // 4
+  L.push('COST');
+  L.push(`  ${usd(d.cost.totalUsd)} across ${plural(d.cost.workerRuns, 'worker run', 'worker runs')}` +
+    (d.cost.unreported ? ` (${d.cost.unreported} did not report a cost)` : ''));
+  if (d.cost.totalDurationS) L.push(`  ${humanDuration(d.cost.totalDurationS)} of worker time`);
+  L.push('');
+
+  // 5
+  L.push('LIMITS');
+  for (const w of d.windows) L.push(`  ${w.label.padEnd(18)} ${w.detail}`);
+  L.push('');
+
+  // The footer answers "did it run at all", which none of the five questions do.
+  const events = Object.entries(d.runner.byEvent).sort((a, b) => b[1] - a[1]).map(([k, n]) => `${k} ${n}`).join(' · ');
+  L.push(`RUNNER  ${events || 'no rows'}`);
+  if (d.runner.endedProbing) L.push('  Ended the night PROBING — it hit repeated failures and slowed itself down.');
+  if (d.runner.unrecognised) L.push(`  ${plural(d.runner.unrecognised, 'row', 'rows')} of a kind this digest does not know about.`);
+  return L.join('\n');
+}
+
+module.exports = { buildDigest, renderDigest, windowsFromGauge, humanDuration };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.877",
+  "version": "1.19.878",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.877",
+      "version": "1.19.878",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.877",
+  "version": "1.19.878",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/autobongos-digest.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/gds/autobongos-digest.js — read the night without opening a log
+// (task 1003906, ADR 0307).
+//
+//   node scripts/gds/autobongos-digest.js              # since midnight, local
+//   node scripts/gds/autobongos-digest.js --since 24h  # a rolling window
+//   node scripts/gds/autobongos-digest.js --json       # the structured shape
+//   node scripts/gds/autobongos-digest.js --all        # the whole log
+//
+// The decision logic is modules/autonomy/digest.js and has no I/O; this half
+// finds the two files it reads and prints the result. Exit 0 always, including on
+// an empty night: a digest is a report, and a non-zero exit would make a cron
+// wrapper treat "nothing happened" as a failure.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const digest = require('../../modules/autonomy/digest.js');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+function arg(flag, argv) {
+  const i = argv.indexOf(flag);
+  return i >= 0 ? argv[i + 1] : null;
+}
+
+function logPath() {
+  if (process.env.AUTOBONGOS_LOG_FILE) return process.env.AUTOBONGOS_LOG_FILE;
+  try { return require('../../src/instance-config.js').configPath('autobongos-runs.jsonl'); }
+  catch (_) { return path.join(REPO_ROOT, 'autobongos-runs.jsonl'); }
+}
+
+function gaugePath() {
+  if (process.env.AUTOBONGOS_GAUGE_FILE) return process.env.AUTOBONGOS_GAUGE_FILE;
+  try { return require('../../src/instance-config.js').configPath('autobongos-gauge.json'); }
+  catch (_) { return path.join(REPO_ROOT, 'autobongos-gauge.json'); }
+}
+
+// readRows — an append-only JSONL, and a single unparseable line must not cost
+// the whole night. A JSONL written by a process that can be killed mid-write has
+// a torn last line more often than never.
+function readRows(file) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); }
+  catch (_) { return { rows: [], missing: true, skipped: 0 }; }
+  const rows = [];
+  let skipped = 0;
+  for (const line of text.split('\n')) {
+    const t = line.trim();
+    if (!t) continue;
+    try { rows.push(JSON.parse(t)); } catch (_) { skipped += 1; }
+  }
+  return { rows, missing: false, skipped };
+}
+
+function readGaugeFile(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); }
+  catch (_) { return null; }
+}
+
+// sinceMs — `--since 24h|90m|3d`, or midnight LOCAL by default.
+//
+// Local rather than UTC because the question is "what happened last night" and
+// night is a local idea; a UTC midnight cut would split an owner's evening in
+// half depending on where they live.
+function sinceMs(spec, now = new Date()) {
+  if (!spec) {
+    const d = new Date(now);
+    d.setHours(0, 0, 0, 0);
+    return d.getTime();
+  }
+  const m = /^(\d+(?:\.\d+)?)\s*([hmd])$/i.exec(String(spec).trim());
+  if (!m) return null;
+  const mult = { h: 3600e3, m: 60e3, d: 86400e3 }[m[2].toLowerCase()];
+  return now.getTime() - Number(m[1]) * mult;
+}
+
+function main(argv) {
+  const all = argv.includes('--all');
+  const asJson = argv.includes('--json');
+  const now = new Date();
+  const from = all ? null : sinceMs(arg('--since', argv), now);
+  if (!all && from === null) {
+    console.error('autobongos-digest: --since wants a span like 24h, 90m or 3d.');
+    return 2;
+  }
+
+  const lf = logPath();
+  const { rows, missing, skipped } = readRows(lf);
+  const inWindow = all ? rows : rows.filter((r) => {
+    const t = Date.parse(r && r.at);
+    return Number.isFinite(t) ? t >= from : true;   // an undated row is kept, not silently dropped
+  });
+
+  const d = digest.buildDigest(inWindow, {
+    gauge: readGaugeFile(gaugePath()),
+    nowEpochS: Math.floor(now.getTime() / 1000),
+    sinceMs: all ? null : from,
+    untilMs: now.getTime(),
+  });
+
+  if (asJson) { console.log(JSON.stringify(d, null, 2)); return 0; }
+
+  console.log('');
+  console.log(digest.renderDigest(d));
+  // Both of these are about the DIGEST's own reliability, so they sit outside the
+  // five questions rather than being folded into them.
+  if (missing) {
+    console.log('');
+    console.log(`  No run log at ${lf} — the runner has not written one here yet.`);
+  }
+  if (skipped) console.log(`  (${skipped} unreadable line(s) in the log were skipped.)`);
+  console.log('');
+  return 0;
+}
+
+if (require.main === module) {
+  process.exit(main(process.argv.slice(2)));
+}
+
+module.exports = { main, sinceMs, readRows, logPath, gaugePath };

package/scripts/gds/autobongos-run.js

@@ -381,6 +381,13 @@ async function iteration(opts, deps = {}) {
     // What the LEDGER says, kept separate from what the worker said, so the run
     // log can be read afterwards without having to trust either one alone.
     ledger_status: ledger.status, ledger_shape: ledger.shape, verified: !!ledger.verified,
+    // The LEDGER's own explanation, kept beside the worker's. `reason` above is
+    // verdict.reason — what the WORKER said happened — and it was the only reason
+    // in the row, so anything reading the log afterwards was quoting the thing
+    // being checked rather than the check. The morning digest did exactly that
+    // until the grader caught it (task 1003906).
+    ledger_reason: ledger.reason || null,
+    ledger_remedy: ledger.remedy || null,
     artifact_on_main: ledger.artifact && ledger.artifact.checked ? !!ledger.artifact.onMain : null,
     claim_released: !!ledger.released,
     blocker_id: ledger.blocker && ledger.blocker.blockerId ? ledger.blocker.blockerId : null,

package/scripts/gds/autobongos-service.ps1

@@ -3,6 +3,7 @@
 #
 #   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 install
 #   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 status
+#   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 digest
 #   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 start|stop|uninstall
 #
 # WHY TASK SCHEDULER AND NOT A REAL SERVICE. Windows services speak a protocol
@@ -29,7 +30,7 @@
 [CmdletBinding()]
 param(
   [Parameter(Position = 0)]
-  [ValidateSet('install', 'uninstall', 'start', 'stop', 'status')]
+  [ValidateSet('install', 'uninstall', 'start', 'stop', 'status', 'digest')]
   [string]$Action = 'status',
 
   # The checkout to run from. Defaults to the repo this script lives in, so the
@@ -118,6 +119,11 @@ switch ($Action) {
     Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
     Write-Host "removed '$TaskName'. The log at $LogFile is left in place."
   }
+  'digest' {
+    # The night in one page (task 1003906). On the box for convenience; the same
+    # five answers are what the Gate page and a mailed digest would carry.
+    & node (Join-Path $RepoRoot 'scripts\gds\autobongos-digest.js') @args
+  }
   'start'  { Start-ScheduledTask -TaskName $TaskName; Write-Host "started '$TaskName'" }
   'stop'   {
     Stop-ScheduledTask -TaskName $TaskName

package/scripts/gds/provision-core-upgrade.js

@@ -187,6 +187,25 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const healthUrl = `http://127.0.0.1:${inst.port}/healthz`;
   const versionUrl = `http://127.0.0.1:${inst.port}/version`;
   const sudoP = privileged ? 'sudo ' : '';
+  // WHERE THE CLI LIVES AND WHERE THE TARGET LIVES ARE DIFFERENT PLACES (task 1004053).
+  //
+  // `scripts/gds/upgrade.js` ships in the CORE checkout. A provisioned instance root holds
+  // no scripts/ directory at all — its core sits under node_modules/@bongos/core — so
+  // running the CLI with cwd = the instance root resolved nothing, and EVERY standalone
+  // upgrade died before it began:
+  //
+  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
+  //
+  // It worked only where instanceDir HAPPENED to be this checkout — the control-plane self
+  // row and a co-tenant — which is why it survived to production: the shapes that are
+  // upgraded by hand are the shapes the relative path fits. Every ACTIVE tenant is
+  // standalone, so the deploy door could not move a single one of them.
+  //
+  // upgrade.js's own header states the contract this restores: "Runs from the consumer
+  // instance root (default) or `--instance <dir>`. This script ships IN the core … against
+  // `--instance <consumer>`." So: run it where it exists, and NAME the target.
+  const runDir = REPO_ROOT;
+  const targetArg = instanceDir === REPO_ROOT ? '' : `--instance ${instanceDir}`;
   const cli = path.posix.join('scripts', 'gds', 'upgrade.js');
   const requestedBy = intent.requested_by && /^api:archon:(\d+)$/.test(intent.requested_by)
     ? intent.requested_by.replace(/^api:archon:/, '')
@@ -195,6 +214,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     `${sudoP}node ${cli}`,
     '--registry',
     `--to ${to}`,
+    targetArg,
     `--service ${inst.slug}`,
     `--health-url ${healthUrl}`,
     `--version-url ${versionUrl}`,
@@ -204,13 +224,13 @@ async function coreUpgradeInstance(inst, deps, intent) {
   ].filter(Boolean).join(' ');
 
   if (!apply) {
-    log(`  ✓ would run: ${cmd} (dry-run — nothing ran)`);
+    log(`  ✓ would run (in ${runDir}): ${cmd} (dry-run — nothing ran)`);
     log(`  ✓ would then read ${versionUrl} on the box and require it to say ${to}`);
     return { ok: true, served: null };
   }
   try {
-    log(`  [upgrade] ${cmd}`);
-    boxExec(cmd, { cwd: instanceDir });
+    log(`  [upgrade] (in ${runDir}) ${cmd}`);
+    boxExec(cmd, { cwd: runDir });
   } catch (e) {
     // upgrade.js rolls itself back on a failed health check or an unchanged served
     // version, so by the time this throws the instance is back on the core it had.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.877'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.878'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/autonomy_digest.mjs

@@ -0,0 +1,302 @@
+// tests/autonomy_digest.mjs — the night, readable afterwards (task 1003906).
+//
+// The done-when is "a night produces one digest answering all five questions
+// without anyone opening a log". So the spine of this file is one test that
+// feeds a realistic night through and asserts all five answers are present and
+// correct — because five separately-passing sections can still add up to a page
+// that does not answer the question.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { buildDigest, renderDigest, windowsFromGauge, humanDuration } = require('../modules/autonomy/digest.js');
+const cli = require('../scripts/gds/autobongos-digest.js');
+
+const T0 = Date.parse('2026-09-19T02:00:00.000Z');
+const at = (m) => new Date(T0 + m * 60000).toISOString();
+const NOW_S = Math.floor((T0 + 8 * 3600e3) / 1000);
+
+const night = () => [
+  { at: at(0), event: 'boot_reconcile', ok: true, leftover: 0 },
+  { at: at(1), event: 'worked', task_id: 111, title: 'A shipped thing', goal_id: 1000119,
+    duration_s: 2820, cost_usd: 3.41, verified: true, ledger_shape: 'shipped',
+    undetermined_decisions: ['Cached for 60s rather than 5m'] },
+  { at: at(50), event: 'worked', task_id: 222, title: 'A stranded thing', goal_id: 1000119,
+    duration_s: 5400, cost_usd: 6.8, verified: false, ledger_shape: 'unlanded',
+    reason: 'the grade passed and the land never finished', blocker_id: '1000161',
+    undetermined_decisions: ['Sorted inactive last', 'Kept the id tie-break', 'Chose ascending'] },
+  { at: at(120), event: 'fenced', code: 'grader_unavailable', reason: 'the grader is bypassed' },
+  { at: at(121), event: 'fenced', code: 'grader_unavailable', reason: 'the grader is bypassed' },
+  { at: at(122), event: 'cadence', mode: 'probing', class: 'transient', consecutive_failures: 3, wait_s: 60 },
+  { at: at(200), event: 'nothing_claimable', goals: [1000119],
+    skipped: [{ id: 333, goal_id: 1000119, reasons: ['needs_migration'] }] },
+  { at: at(201), event: 'hold', reason: 'seven-day pace: 78% used' },
+];
+const gauge = {
+  five_hour: { used_percentage: 41, resets_at: NOW_S + 3600 },
+  seven_day: { used_percentage: 78, resets_at: NOW_S + 240000 },
+};
+
+// ── the done-when, in one test ─────────────────────────────────────────────────
+
+test('one night produces one page answering all five questions', () => {
+  const text = renderDigest(buildDigest(night(), { gauge, nowEpochS: NOW_S }));
+
+  // 1. what shipped — and ONLY what the ledger agreed shipped.
+  assert.match(text, /SHIPPED — 1 task/);
+  assert.match(text, /111\s+A shipped thing/);
+  assert.doesNotMatch(text.split('ON HOLD')[0], /222/, 'a task that ran but did not ship is not "shipped"');
+
+  // 2. what is on hold, and why.
+  assert.match(text, /ON HOLD/);
+  assert.match(text, /222\s+ran but did not ship — unlanded/);
+  assert.match(text, /blocker 1000161/);
+  assert.match(text, /fence: grader_unavailable ×2/);
+  assert.match(text, /every one halted/);
+  assert.match(text, /capacity: held 1 time/);
+
+  // 3. what each worker decided that its spec did not determine.
+  assert.match(text, /DECIDED FOR YOU — 4 decisions across 2 tasks/);
+  assert.match(text, /Cached for 60s rather than 5m/);
+  assert.match(text, /sentence the task description should have contained/);
+  assert.match(text, /Thinnest spec: 222/);
+
+  // 4. what it cost.
+  assert.match(text, /COST/);
+  assert.match(text, /\$10\.21 across 2 worker runs/);
+
+  // 5. where both limit windows stand.
+  assert.match(text, /Five-hour window\s+41% used, resets in 60m/);
+  assert.match(text, /Seven-day window\s+78% used/);
+});
+
+test('every section prints even when the night was empty', () => {
+  // A digest whose quiet sections vanish teaches its reader that absence means
+  // "fine" — and then the morning a section is missing because the DATA is
+  // missing reads exactly the same.
+  const text = renderDigest(buildDigest([], { gauge, nowEpochS: NOW_S }));
+  for (const heading of ['SHIPPED', 'ON HOLD', 'DECIDED FOR YOU', 'COST', 'LIMITS', 'RUNNER']) {
+    assert.ok(text.includes(heading), `${heading} must print on an empty night`);
+  }
+  assert.match(text, /nothing shipped/);
+  assert.match(text, /nothing is waiting on you/);
+  assert.match(text, /no worker had to fill a gap/);
+});
+
+// ── the answers, individually ──────────────────────────────────────────────────
+
+test('shipped is the LEDGER’s answer, never the worker’s', () => {
+  const d = buildDigest([
+    { at: at(0), event: 'worked', task_id: 1, verified: true, ledger_shape: 'shipped' },
+    { at: at(1), event: 'worked', task_id: 2, verified: false, ledger_shape: 'still_held' },
+    { at: at(2), event: 'worked', task_id: 3, outcome: 'claims_shipped', ledger_shape: 'shipped_no_artifact', verified: false },
+  ], { nowEpochS: NOW_S });
+  assert.deepEqual(d.shipped.map((s) => s.taskId), ['1']);
+  assert.deepEqual(d.onHold.ranButDidNotShip.map((r) => r.shape), ['still_held', 'shipped_no_artifact']);
+});
+
+test('an unworkable queue is reported as a queue problem, not as breakage', () => {
+  const d = buildDigest([{ at: at(0), event: 'nothing_claimable', skipped: [{ id: 9, reasons: ['needs_migration'] }] }], { nowEpochS: NOW_S });
+  assert.equal(d.onHold.unworkable.length, 1);
+  const text = renderDigest(d);
+  assert.match(text, /this is not a runner failure/);
+});
+
+test('the decisions list groups by task and names the thinnest spec', () => {
+  // The SHAPE is the signal: one task with six decisions is a thin spec, six
+  // tasks with one each is a normal night.
+  const d = buildDigest([
+    { at: at(0), event: 'worked', task_id: 1, verified: true, undetermined_decisions: ['a'] },
+    { at: at(1), event: 'worked', task_id: 2, verified: true, undetermined_decisions: ['b', 'c', 'd'] },
+    { at: at(2), event: 'worked', task_id: 3, verified: true, undetermined_decisions: [] },
+  ], { nowEpochS: NOW_S });
+  assert.equal(d.decisionCount, 4);
+  assert.equal(d.decisions.length, 2, 'a task with no decisions is not listed');
+  assert.equal(d.thinnestSpec.taskId, '2');
+});
+
+test('a decision from a task that did NOT ship is still surfaced', () => {
+  // These are the ones that matter most: the judgement was made, the work is not
+  // in, and the call is sitting in a branch nobody has read.
+  const text = renderDigest(buildDigest([
+    { at: at(0), event: 'worked', task_id: 7, title: 'T', verified: false, ledger_shape: 'unlanded', undetermined_decisions: ['picked a default'] },
+  ], { nowEpochS: NOW_S }));
+  assert.match(text, /picked a default/);
+  assert.match(text, /\[did not ship\]/);
+});
+
+test('an unreported cost is excluded and counted, never coerced to zero', () => {
+  const d = buildDigest([
+    { at: at(0), event: 'worked', task_id: 1, verified: true, cost_usd: 2.5 },
+    { at: at(1), event: 'worked', task_id: 2, verified: true, cost_usd: null },
+    { at: at(2), event: 'worked', task_id: 3, verified: true },
+  ], { nowEpochS: NOW_S });
+  assert.equal(d.cost.totalUsd, 2.5, 'a worker whose cost was not reported must not make the night look cheaper');
+  assert.equal(d.cost.reported, 1);
+  assert.equal(d.cost.unreported, 2);
+  assert.match(renderDigest(d), /2 did not report a cost/);
+});
+
+// ── the limit windows ──────────────────────────────────────────────────────────
+
+test('a window whose reset has PASSED is reported as stale, not as headroom', () => {
+  // "41% used, resets in 0s" invites a decision about headroom that no longer
+  // exists: the percentage was true of a window that has since rolled.
+  const [five] = windowsFromGauge({ five_hour: { used_percentage: 41, resets_at: NOW_S - 60 } }, NOW_S);
+  assert.equal(five.known, false);
+  assert.equal(five.stale, true);
+  assert.match(five.detail, /has since reset/);
+});
+
+test('a window the gauge never reported says so rather than reading as zero', () => {
+  const [five, seven] = windowsFromGauge({ seven_day: { used_percentage: 12, resets_at: NOW_S + 999 } }, NOW_S);
+  assert.equal(five.known, false);
+  assert.equal(five.detail, 'not reported');
+  assert.equal(seven.known, true);
+  for (const g of [null, undefined, {}, 'nope']) {
+    assert.deepEqual(windowsFromGauge(g, NOW_S).map((w) => w.known), [false, false], JSON.stringify(g));
+  }
+});
+
+// ── the runner footer ──────────────────────────────────────────────────────────
+
+test('a night that ended probing says so — "nothing shipped" has two causes', () => {
+  const text = renderDigest(buildDigest([
+    { at: at(0), event: 'cadence', mode: 'full', class: 'quiet' },
+    { at: at(1), event: 'cadence', mode: 'probing', class: 'transient' },
+  ], { nowEpochS: NOW_S }));
+  assert.match(text, /Ended the night PROBING/);
+});
+
+test('an event this digest does not know about is counted, never dropped', () => {
+  // A digest that silently ignores what it does not understand is how a new
+  // failure mode stays invisible for a week.
+  const d = buildDigest([{ at: at(0), event: 'something_new_entirely' }], { nowEpochS: NOW_S });
+  assert.equal(d.runner.unrecognised, 1);
+  assert.equal(d.runner.byEvent.something_new_entirely, 1);
+  assert.match(renderDigest(d), /a kind this digest does not know about/);
+});
+
+test('malformed rows never take the night down', () => {
+  const d = buildDigest([null, undefined, 42, 'nope', {}, { event: 'worked', verified: true }], { nowEpochS: NOW_S });
+  assert.equal(d.shipped.length, 1);
+  assert.doesNotThrow(() => renderDigest(d));
+});
+
+// ── the CLI half ───────────────────────────────────────────────────────────────
+
+test('--since accepts a span and defaults to local midnight', () => {
+  const now = new Date('2026-09-19T14:30:00');
+  assert.equal(cli.sinceMs('24h', now), now.getTime() - 86400e3);
+  assert.equal(cli.sinceMs('90m', now), now.getTime() - 5400e3);
+  assert.equal(cli.sinceMs('3d', now), now.getTime() - 3 * 86400e3);
+  // Local midnight, because "last night" is a local idea — a UTC cut would split
+  // an owner's evening in half depending on where they live.
+  const midnight = new Date(now); midnight.setHours(0, 0, 0, 0);
+  assert.equal(cli.sinceMs(null, now), midnight.getTime());
+  assert.equal(cli.sinceMs('soon', now), null, 'an unparseable span must refuse, not guess');
+});
+
+test('a torn last line costs one row, not the night', async () => {
+  // A JSONL written by a process that can be killed mid-write has a torn last
+  // line more often than never.
+  const fs = require('node:fs'); const os = require('node:os'); const path = require('node:path');
+  const f = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'ab-digest-')), 'runs.jsonl');
+  fs.writeFileSync(f, `${JSON.stringify({ at: at(0), event: 'worked', task_id: 1, verified: true })}\n{"at":"x","event":"wor`);
+  const { rows, skipped, missing } = cli.readRows(f);
+  assert.equal(missing, false);
+  assert.equal(rows.length, 1);
+  assert.equal(skipped, 1);
+});
+
+test('a missing log is reported, not mistaken for a quiet night', async () => {
+  const { rows, missing } = cli.readRows('/definitely/not/here/runs.jsonl');
+  assert.deepEqual(rows, []);
+  assert.equal(missing, true);
+});
+
+test('humanDuration reads like a person wrote it', () => {
+  assert.equal(humanDuration(45), '45s');
+  assert.equal(humanDuration(2820), '47m');
+  assert.equal(humanDuration(10080), '2.8h');
+  assert.equal(humanDuration(null), null);
+});
+
+// ── the grader's three findings (task 1003906) ─────────────────────────────────
+
+test('the "did not ship" reason is the LEDGER’s, not the worker’s', () => {
+  // THE INVERSION THIS GOAL EXISTS TO UNDO. `row.reason` is verdict.reason — the
+  // WORKER's account of itself — and quoting it here means the digest reports the
+  // thing being checked rather than the check. A worker that stopped dead needing
+  // a decision reports success; the ledger says what actually happened.
+  const d = buildDigest([{
+    at: at(0), event: 'worked', task_id: 9, title: 'T', verified: false, ledger_shape: 'unlanded',
+    reason: 'I finished the work and shipped it',
+    ledger_reason: 'the grade passed and the land never finished',
+    ledger_remedy: '/merge-mode is the documented manual fallback',
+  }], { nowEpochS: NOW_S });
+
+  assert.equal(d.onHold.ranButDidNotShip[0].reason, 'the grade passed and the land never finished');
+  assert.equal(d.onHold.ranButDidNotShip[0].workerSaid, 'I finished the work and shipped it');
+
+  const text = renderDigest(d);
+  assert.match(text, /the grade passed and the land never finished/);
+  assert.match(text, /next: \/merge-mode/);
+  // The disagreement is the single most useful line on the page.
+  assert.match(text, /the worker said: I finished the work and shipped it/);
+});
+
+test('the worker’s account is printed only when it disagrees', () => {
+  // A worker that agreed with the ledger tells the reader nothing twice.
+  const same = 'the grade parked this';
+  const text = renderDigest(buildDigest([{
+    at: at(0), event: 'worked', task_id: 9, verified: false, ledger_shape: 'ungraded', reason: same, ledger_reason: same,
+  }], { nowEpochS: NOW_S }));
+  assert.equal((text.match(/the grade parked this/g) || []).length, 1);
+  assert.doesNotMatch(text, /the worker said:/);
+});
+
+test('a row from before ledger_reason existed still shows something', () => {
+  const d = buildDigest([{ at: at(0), event: 'worked', task_id: 9, verified: false, ledger_shape: 'unlanded', reason: 'older row' }], { nowEpochS: NOW_S });
+  assert.equal(d.onHold.ranButDidNotShip[0].reason, 'older row');
+});
+
+test('the digest calls a gauge stale on the SAME rule the runner holds on', () => {
+  // A digest that applied a laxer test would print live headroom about a window
+  // the runner had already decided it could not vouch for — two surfaces
+  // disagreeing about one file, with the reader believing the wrong one.
+  const gaugeMod = require('../modules/autonomy/gauge.js');
+  const tooOld = gaugeMod.DEFAULT_STALE_AFTER_S + 60;
+
+  const [fresh] = windowsFromGauge(
+    { five_hour: { used_percentage: 41, resets_at: NOW_S + 7200, observed_at: NOW_S - 60 } }, NOW_S);
+  assert.equal(fresh.known, true, 'a recent reading is usable');
+
+  const [stale] = windowsFromGauge(
+    { five_hour: { used_percentage: 41, resets_at: NOW_S + 7200, observed_at: NOW_S - tooOld } }, NOW_S);
+  assert.equal(stale.known, false);
+  assert.equal(stale.stale, true);
+  assert.match(stale.detail, /older than the runner trusts/);
+  assert.doesNotMatch(stale.detail, /resets in/, 'never offer headroom from a reading the runner rejected');
+});
+
+test('a window with no observed_at falls back to the file’s written_at', () => {
+  // One window can go unreported while the other is carried forward — the exact
+  // shape gauge.js reads.
+  const gaugeMod = require('../modules/autonomy/gauge.js');
+  const old = NOW_S - gaugeMod.DEFAULT_STALE_AFTER_S - 60;
+  const [w] = windowsFromGauge({ written_at: old, five_hour: { used_percentage: 41, resets_at: NOW_S + 7200 } }, NOW_S);
+  assert.equal(w.stale, true);
+});
+
+test('the period bounds survive a log too long to spread as arguments', () => {
+  // `Math.min(...times)` throws past the engine's argument cap, and a reporting
+  // CLI that dies on a big log fails exactly when the log is worth reading.
+  const many = Array.from({ length: 200000 }, (_, i) => ({ at: at(i % 1000), event: 'cadence', mode: 'full' }));
+  let d;
+  assert.doesNotThrow(() => { d = buildDigest(many, { nowEpochS: NOW_S }); });
+  assert.equal(d.period.rows, 200000);
+  assert.equal(d.period.fromMs, T0);
+});

package/tests/core_upgrade_runner.mjs

@@ -28,6 +28,8 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const R = require('../scripts/gds/provision-core-upgrade.js');
@@ -46,13 +48,19 @@ const t = async (name, fn) => {
 // instant. `apply:true` because the interesting behaviour is the applied path.
 function makeDeps({ shape = 'control-plane', served = '1.19.760', available = ['1.19.758', '1.19.760', '1.19.762'], installed = '1.19.760', queries = [] } = {}) {
   const ran = [];
-  const exec = (cmd) => {
+  // task 1004053: the CWD is half of what makes a relative CLI path resolve, and the
+  // bug that shipped was invisible to every assertion that read only the command
+  // string. Captured alongside, so a test can check the pair.
+  const ranWith = [];
+  const exec = (cmd, opts) => {
     ran.push(cmd);
+    ranWith.push({ cmd, cwd: opts && opts.cwd });
     if (/\/version/.test(cmd)) return { ok: true, stdout: served == null ? '' : JSON.stringify({ coreVersion: served }) };
     return { ok: true, stdout: '' };
   };
   return {
     ran,
+    ranWith,
     queries,
     db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
     provisioning: { recordEvent: async () => {}, clearErrorNote: async () => {} },
@@ -245,6 +253,40 @@ await t('drives upgrade.js with the registry, the health gate, the version read-
   assert.ok(cmd.includes('--commit-pin'));
 });
 
+await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that broke every standalone tenant (task 1004053)', async () => {
+  // The whole failure was a path that resolved nowhere:
+  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
+  // No assertion about FLAGS could have caught it, so this one resolves the composed
+  // cwd + relative CLI against the real filesystem, for every shape the door admits.
+  for (const shape of ['control-plane', 'standalone', 'co-tenant']) {
+    const d = makeDeps({ served: '1.19.762' });
+    await R.coreUpgradeInstance(inst({ hosting_shape: shape, slug: 'hermeslines-marketing', port: 3011 }), d, intent());
+    const call = d.ranWith.find((c) => /upgrade\.js/.test(c.cmd));
+    assert.ok(call, `${shape}: it ran the upgrade CLI`);
+    const rel = (call.cmd.match(/node (\S*scripts\/gds\/upgrade\.js)/) || [])[1];
+    assert.ok(rel, `${shape}: the command names the CLI`);
+    assert.ok(fs.existsSync(path.join(call.cwd, rel)),
+      `${shape}: ${path.join(call.cwd, rel)} must exist — this is the assertion the original bug would have failed`);
+  }
+});
+
+await t('a standalone tenant is NAMED with --instance, because the CLI no longer runs inside it', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'hermeslines-marketing', port: 3011 }), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.match(cmd, /--instance \S*hermeslines-marketing/, 'the target is named explicitly');
+  assert.ok(cmd.includes('--service hermeslines-marketing'), 'and its own unit is still the one restarted');
+});
+
+await t('the control-plane row carries NO --instance — its target IS the checkout the CLI runs in', async () => {
+  // Naming it would be harmless but wrong, and the shapes that already worked must not
+  // change behaviour on the way to fixing the one that never did.
+  const d = makeDeps({ served: '1.19.762' });
+  await R.coreUpgradeInstance(inst(), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(!cmd.includes('--instance'), 'unchanged for the platform itself');
+});
+
 await t('the health URL and the version URL are LOOPBACK — the apex is behind basic_auth and a CDN (ADR 0293 D6)', async () => {
   const d = makeDeps();
   await R.coreUpgradeInstance(inst(), d, intent());