@bongos/core 1.19.889 → 1.19.891

package/modules/grading/grader.js

@@ -110,7 +110,27 @@ function describeOutage(gating) {
 }
 
 function aggregatePanel(workerResults, meta = {}) {
-  const N = workerResults.length;
+  // task 1003977 — THE NON-GATING PARTITION, before any gate arithmetic.
+  //
+  // A non-gating worker (today: the Reader, the advisory copy lens) contributes
+  // its scores and issues to the RECORD and nothing at all to the GATE. It is
+  // removed here, once, rather than special-cased in each of the counts below —
+  // pass/concerns/fail counts, the error and outage detection, the confidence
+  // median and every branch of the verdict all read `gateResults`.
+  //
+  // Removing it from the counts is why a Reader outage cannot reach #943's
+  // "every gating worker is missing signal" branch, and why a Reader cannot
+  // nudge the confidence median that drives the server-side gate. `N` stays the
+  // GATE's denominator so the verdict strings keep meaning what they said
+  // before ("2/4 gating worker(s) failed" counts the four that can fail).
+  //
+  // ADVISORY_WORKERS below is a DIFFERENT, weaker thing: narc is advisory in
+  // that a narc-only fail downgrades to manual-confirm. A non-gating worker
+  // never reaches even that.
+  const isNonGating = (w) => w && workers.isNonGatingKind(w.kind);
+  const nonGatingResults = workerResults.filter(isNonGating);
+  const gateResults = workerResults.filter((w) => !isNonGating(w));
+  const N = gateResults.length;
 
   // Score axes — median across workers that reported each. Reuses the
   // module-level median() helper (rounded to one decimal).
@@ -124,6 +144,12 @@ function aggregatePanel(workerResults, meta = {}) {
   // Phase 2.2 (#421): Efficiency Monger reports efficiency_score. Same
   // additive treatment as security_score.
   const efficiencyScore = median(workerResults.map((w) => w.scores?.efficiency_score));
+  // task 1003977: the Reader reports copy_score. Recorded like security_score
+  // and efficiency_score before it — additive, and read from the FULL result
+  // list rather than gateResults, because the whole point is that a non-gating
+  // worker's SIGNAL lands in the record even though its verdict never reaches
+  // the gate. Null whenever no Reader ran, which is every non-copy-bearing ship.
+  const copyScore = median(workerResults.map((w) => w.scores?.copy_score));
 
   const economyPenalty =
     economy != null ? Math.max(0, (THRESHOLD - economy) / 2) : 0;
@@ -131,8 +157,8 @@ function aggregatePanel(workerResults, meta = {}) {
   const blended = ff != null && cq != null ? r1((ff + cq) / 2) : 0;
 
   // Verdict counts.
-  const passCount = workerResults.filter((w) => w.verdict === 'pass').length;
-  const concernsCount = workerResults.filter((w) => w.verdict === 'concerns').length;
+  const passCount = gateResults.filter((w) => w.verdict === 'pass').length;
+  const concernsCount = gateResults.filter((w) => w.verdict === 'concerns').length;
   // A crashed worker sets verdict='fail' as a DEFAULT in its computeVerdict()
   // subprocess_error / parse_error / schema_error early returns (see each
   // worker module) — that is MISSING SIGNAL, not a substantive finding, and
@@ -149,12 +175,12 @@ function aggregatePanel(workerResults, meta = {}) {
   const hasSubstantiveIssue = (w) =>
     (w.issues || []).some((i) => i.severity === 'blocker' || i.severity === 'major');
   const isMissingSignal = (w) => !!w.error && !hasSubstantiveIssue(w);
-  const failCount = workerResults.filter((w) => w.verdict === 'fail' && !isMissingSignal(w)).length;
+  const failCount = gateResults.filter((w) => w.verdict === 'fail' && !isMissingSignal(w)).length;
   // NOTE (#473/#589): signals.error_count counts only isMissingSignal workers — i.e. a worker that
   // errored AND surfaced no blocking issue. A worker that errored but still raised a blocker/major
   // is a real finding, so it counts in fail_count (above), NOT here. This is a deliberate semantic
   // change from the old "all w.error" meaning; keep error_count = missing-signal-only.
-  const errorCount = workerResults.filter((w) => isMissingSignal(w)).length;
+  const errorCount = gateResults.filter((w) => isMissingSignal(w)).length;
 
   // V3.R85 (#481): the Narc (functional_fidelity) is ADVISORY in the gate —
   // Lars's call 2026-05-30 after #303, where over-literal acceptance-criteria
@@ -188,8 +214,8 @@ function aggregatePanel(workerResults, meta = {}) {
   // taken out by a grader outage, so it is not evidence either way about whether the
   // panel ran. Task 1003574.
   const isDeterministic = (w) => w && w.model === 'deterministic';
-  const nonAdvisory = workerResults.filter((w) => !isAdvisory(w));
-  const gating = nonAdvisory.length ? nonAdvisory : workerResults;
+  const nonAdvisory = gateResults.filter((w) => !isAdvisory(w));
+  const gating = nonAdvisory.length ? nonAdvisory : gateResults;
   const gatingFail = gating.filter((w) => w.verdict === 'fail' && !isMissingSignal(w)).length;
   const gatingError = gating.filter((w) => isMissingSignal(w)).length;
   const gatingConcerns = gating.filter((w) => w.verdict === 'concerns').length;
@@ -228,15 +254,15 @@ function aggregatePanel(workerResults, meta = {}) {
   const gatingErrorAll = subagentGating.length > 0 && subagentGating.every((w) => isMissingSignal(w));
   // Advisory-worker outcomes — never a hard block. Uses isAdvisory so a Narc
   // that DID raise a blocker is treated as gating (in `nonAdvisory`), not here.
-  const advisoryFail = workerResults.some((w) => isAdvisory(w) && w.verdict === 'fail' && !isMissingSignal(w));
-  const advisoryConcerns = workerResults.some((w) => isAdvisory(w) && w.verdict === 'concerns');
+  const advisoryFail = gateResults.some((w) => isAdvisory(w) && w.verdict === 'fail' && !isMissingSignal(w));
+  const advisoryConcerns = gateResults.some((w) => isAdvisory(w) && w.verdict === 'concerns');
 
   // Confidence — median for pass, fallthrough for concerns, 0 for fail.
   // (Drives the server-side gate; see file header.) Computed UNROUNDED —
   // confidence sits near the 0.4 gate cap so the module-level median()
   // helper (which rounds via r1()) would risk nudging a borderline value
   // across the boundary. Inlined for that one-decimal-precision reason.
-  const confVals = workerResults
+  const confVals = gateResults
     .map((w) => w.confidence)
     .filter((n) => Number.isFinite(n))
     .slice()
@@ -360,7 +386,12 @@ function aggregatePanel(workerResults, meta = {}) {
 
   // Build display notes.
   const lines = [];
-  lines.push(`Subagent grader ${VERSION} (panel of ${N}: ${workerResults.map((w) => w.kind).join(', ')}) — ${verdict}`);
+  // N counts the GATING workers; a non-gating one is named separately so the
+  // line cannot read as an off-by-one ("panel of 4: …five kinds…").
+  const advisoryKinds = nonGatingResults.map((w) => w.kind);
+  lines.push(`Subagent grader ${VERSION} (panel of ${N}: ${gateResults.map((w) => w.kind).join(', ')}`
+    + (advisoryKinds.length ? ` · advisory, non-gating: ${advisoryKinds.join(', ')}` : '')
+    + `) — ${verdict}`);
   if (ff != null) lines.push(`  functional_fidelity (Narc):  ${ff}/10`);
   if (cq != null) lines.push(`  code_quality (Quality):      ${cq}/10`);
   if (economy != null) lines.push(`  economy (Quality, adv.):     ${economy}/10`);
@@ -421,6 +452,7 @@ function aggregatePanel(workerResults, meta = {}) {
       code_quality_effective: cqEffective,
       security_score: security,
       efficiency_score: efficiencyScore,
+      copy_score: copyScore,
     },
     signals: {
       grader_kind: 'subagent-panel',
@@ -470,6 +502,10 @@ function graderUnavailableResult({ reason, note, meta = {} } = {}) {
       code_quality_effective: null,
       security_score: null,
       efficiency_score: null,
+      // task 1003977: nulled with the rest so an outage grade's rubric_scores
+      // has the SAME SHAPE as a normal one. A key that is absent here and
+      // present there is a difference a consumer has to know about.
+      copy_score: null,
     },
     signals: {
       grader_kind: 'subagent-panel',

package/modules/lifecycle/cascade.js

@@ -135,23 +135,33 @@ function hasCopyOrVisualWork(task) {
 // STEP 2 remakes the copy/visuals with both routes explicitly offered — R04's
 // brief, verbatim in intent.
 //
-// STEP 1 used to say "coach the grader", and for as long as that was the wording
-// it asked for something no artist could do (task 1003937, ADR 0298). The panel's
-// four lenses — narc, quality, hacker, efficiency — read completion, code quality,
-// security and runtime cost; not one of them reads a sentence, so there was no
-// counterpart to coach and four consecutive reviews found the same wall. The
-// ADR's decision is a fifth ADVISORY 'reader' lens, scoped to copy-bearing diffs
-// by this file's own hasCopyOrVisualWork, built only after the instance writes a
-// voice guide to judge against. Until it exists the step asks for the RECORD
-// instead of the coaching: followable today, and it is the corpus both the guide
-// and the lens will be written from. When the reader lands, this reverts to
-// coaching a lens that is actually listening — and the wording is the signal for
-// which of those two worlds we are in, so do not restore the old sentence early.
+// STEP 1 ASKS FOR COACHING AGAIN, because there is now a lens listening.
+//
+// The history, because the wording is load-bearing: STEP 1 originally said
+// "coach the grader", which asked for something no artist could do (task
+// 1003937, ADR 0298) — the panel's four lenses read completion, code quality,
+// security and runtime cost, and not one read a sentence, so four consecutive
+// reviews found the same wall. The step was rewritten to ask for the RECORD
+// instead, and that version carried an explicit instruction not to restore the
+// coaching wording early, because the wording is the signal for which world we
+// are in.
+//
+// Task 1003977 shipped the fifth lens: an ADVISORY 'reader', scoped to
+// copy-bearing diffs by THIS FILE'S hasCopyOrVisualWork — the same predicate
+// that fires this cascade, so an artist review and the copy lens cover exactly
+// the same set by construction, and widening one widens both. The voice guide
+// it waited on is docs/voice.md (task 1003976). So there is a counterpart to
+// coach, it has a written standard to be coached against, and the record the
+// interim wording collected is what both were built from.
+//
+// What has NOT changed: the reader is non-gating and cannot hold a ship (ADR
+// 0241 keeps the artist's judgement on the deploy), so this review is still a
+// request triage may dismiss.
 function artistReviewBody(task) {
   return [
     `This is an ARTIST REVIEW, generated automatically because task ${task.id} put copy or visuals in front of a person. It is a REQUEST, not a gate — it blocks nothing that shipped, and triage may dismiss it.`,
     '',
-    `STEP 1 — READ THE GRADE, AND WRITE DOWN WHAT IT COULD NOT SEE. Pull how the grader judged task ${task.id} (GET /tasks/${task.id}?include=grade), then record what an artist would have caught and no lens did: slop, an off-voice line, a claim that does not land, a visual that reads as generated. Do not expect to find a copy verdict to argue with — the panel's four lenses read completion, code quality, security and runtime cost, and none of them reads a sentence (ADR 0298). Your record IS the compounding part: it is the evidence the advisory 'reader' lens is being built from, and the corpus the voice guide it waits on will be written against.`,
+    `STEP 1 — COACH THE READER. Pull how the grader judged task ${task.id} (GET /tasks/${task.id}?include=grade) and find the 'reader' row in signals.workers, with its copy_score in rubric_scores. That lens read the changed copy against docs/voice.md and cited rule ids. Say where it was RIGHT, where it was WRONG, and — the valuable one — what it did not see at all. A finding it filed that you disagree with is worth as much as one it missed: both are corrections to a lens that is listening, which is what this step could not ask for before task 1003977 shipped it (ADR 0298). If the miss is because no rule in docs/voice.md reaches it, that is a gap in the GUIDE — file it against the guide rather than expecting the lens to invent a rule at grade time. Two cases where there will be no reader row and that is not a fault: a ship that took the trivial-diff path (a single generalist shot, no panel), and one where the lens errored — it is advisory, so an outage is recorded and nothing is blocked.`,
     '',
     'STEP 2 — REMAKE OR TWEAK the copy/visuals if they need it. Your choice of route, both offered on purpose: OUTSIDE the AI chat (edit the surface directly and land it through the copy desk or the normal pipeline), or WITH it (draft in chat, then land). Either way it lands as a claimed, graded, shipped task like everything else — there is no live CMS (goal 1000074\'s hard rule).',
     '',

package/modules/lifecycle/tests/cascade.mjs

@@ -213,15 +213,24 @@ await test('a copy/visual ship generates the two-step artist review', () => {
   assert.match(spec.title, /7001/);
   // Both steps, and both routes of step 2, are in the body.
   //
-  // STEP 1's label tracks ADR 0298 (task 1003937). It used to read
-  // "REVIEW THE GRADER … coach it", which asked for something no artist could
-  // do: the panel's four lenses read completion, code quality, security and
-  // runtime cost, so there was no copy verdict to coach. Until the advisory
-  // reader worker ships (task 1003977, itself gated on the voice guide in
-  // task 1003976) the step asks for the RECORD instead — hence the pin on the
-  // new label AND on the ADR reference, which is what stops a well-meaning
-  // copy-edit from restoring the unfollowable version without reading why.
-  assert.match(spec.description, /STEP 1 — READ THE GRADE, AND WRITE DOWN WHAT IT COULD NOT SEE/);
+  // STEP 1's label tracks ADR 0298 (task 1003937), and it has now turned twice.
+  // It first read "REVIEW THE GRADER … coach it", which asked for something no
+  // artist could do: the panel's four lenses read completion, code quality,
+  // security and runtime cost, so there was no copy verdict to coach. It was
+  // rewritten to ask for the RECORD instead, as an explicitly INTERIM wording,
+  // pinned here so a well-meaning copy-edit could not restore the unfollowable
+  // version without reading why.
+  //
+  // Task 1003977 shipped the advisory reader lens and the voice guide it waited
+  // on (task 1003976), so the step is coaching again — and this pin moves with
+  // it. The two must turn TOGETHER: the wording is the signal for which world
+  // we are in, so a body that still said "no lens reads a sentence" after the
+  // lens landed would send every artist looking for a counterpart that is
+  // sitting right there in the grade record.
+  assert.match(spec.description, /STEP 1 — COACH THE READER/);
+  assert.match(spec.description, /docs\/voice\.md/, 'and names the written standard to coach against');
+  assert.doesNotMatch(spec.description, /none of them reads a sentence/,
+    'the interim claim is gone — it stopped being true when the reader shipped');
   assert.match(spec.description, /ADR 0298/, 'the step names the decision that shaped it');
   assert.match(spec.description, /STEP 2 — REMAKE OR TWEAK/);
   assert.match(spec.description, /OUTSIDE the AI chat/);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.889",
+  "version": "1.19.891",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.889",
+      "version": "1.19.891",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.889",
+  "version": "1.19.891",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/build-cli-package.js

@@ -67,6 +67,10 @@ const FILES = [
   'scripts/gds/start.js',
   'scripts/gds/context-pack.js', // start.js renders through this
   'scripts/gds/status.js',
+  // status.js resolves its default version at runtime instead of naming one
+  // (task 1004071) -- so the packaged CLI needs this too, or `bongos status`
+  // dies on a missing module. tests/cli_package.mjs caught exactly that.
+  'scripts/gds/version-select.js',
   'scripts/gds/task.js',
   'scripts/gds/recall.js',
   'scripts/gds/cost.js',

package/scripts/gds/ship-grade.js

@@ -12,6 +12,14 @@ const crypto = require('node:crypto');
 const { spawn } = require('node:child_process');
 const { cliClient } = require('./cli-lib');
 const grader = require('../../modules/grading/grader');
+// task 1003977: the ONE definition of "does this ship put copy in front of a
+// person". It lives in the lifecycle module and the grading module may not
+// require a sibling (ADR 0083), so this script — which is not a module and
+// already requires grading directly — is the seam where the two meet. Writing a
+// second predicate inside grading would let the at-ship reader lens and the
+// after-the-fact artist review disagree about what they cover, and widening the
+// set would then have to be done twice.
+const { hasCopyOrVisualWork } = require('../../modules/lifecycle/cascade.js');
 const { resolveBuilderModel } = require('./ship-memory-sync.js');
 const { argvOut, gitArgvOk, gitOk, shellOk } = require('./ship-git.js');
 const { GRADER_DIFF_CHAR_CAP, GRADER_TIMEOUT_MS, REPO_ROOT, noteServerReward } = require('./ship-state.js');
@@ -285,9 +293,16 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       lenses_dropped: ['hacker', 'efficiency'],
     };
   } else {
-    const panel = grader.WORKERS.DEFAULT_PANEL;
+    // task 1003977: the advisory Reader rides along on copy-bearing diffs only.
+    // Where the predicate says no, `panel` is byte-identical to DEFAULT_PANEL
+    // and the ship costs exactly what it costs today.
+    const copyBearing = hasCopyOrVisualWork(task);
+    const panel = grader.WORKERS.panelFor({ copyBearing });
     console.log(`  subagent grader ${grader.VERSION}: panel of ${panel.length} workers (${panel.join(', ')}), model=${grader.selectGraderModel({ builderModel })} (builder ${builderModel || `${grader.ASSUMED_BUILDER_MODEL} assumed`}), changed_files=${changedFiles.length}, diff_chars=${diff.length}, per-worker timeout=${GRADER_TIMEOUT_MS}ms`);
-    console.log(`  gate: every worker must return verdict='pass'; 'concerns' → manual-confirm fall-through; 'fail' blocks`);
+    console.log(`  gate: every GATING worker must return verdict='pass'; 'concerns' → manual-confirm fall-through; 'fail' blocks`);
+    console.log(copyBearing
+      ? `  copy lens: ON — this task is copy-bearing, so the advisory 'reader' reads the changed strings against docs/voice.md. It is NON-GATING: nothing it reports, and no error or timeout it hits, can stop this ship.`
+      : `  copy lens: off — not a copy-bearing task (no copy-proposal source, not artist-discipline, module not in COPY_VISUAL_MODULES), so the panel is the usual four.`);
     if (priorRound) {
       console.log(`  delta re-grade (task 1002662): prior round's findings + builder response ride along, fenced; answered findings can only re-veto with NEW evidence`);
     }
@@ -300,8 +315,19 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
       builderRank,          // SEC #863: drives the permission-path pre-pass
       builderModel,         // task 1002659: real session model → cross-model grader pick
       priorRound,           // task 1002662: delta-aware re-grade context (panel path only)
+      workers: panel,       // task 1003977: DEFAULT_PANEL, plus the advisory reader when copy-bearing
       runOpts,
     });
+    // A SKIPPED LENS IS RECORDED, NEVER SILENT. Without this a grade with no
+    // copy_score is indistinguishable from one where the copy was read and
+    // found clean — a missing score would read as a passing one. Same pattern
+    // and same reason as the trivial path's `lenses_dropped` above.
+    if (!copyBearing) {
+      result.signals = {
+        ...(result.signals || {}),
+        reader_skipped: 'not_copy_bearing',
+      };
+    }
   }
   const wallMs = Date.now() - t0;
   // Decorate signals with the local shortstat — useful in audit-trail.

package/scripts/gds/status.js

@@ -19,14 +19,24 @@
 //
 // Exit codes: 0 ok · 1 network/api error · 2 bad invocation · 3 not found.
 
-const { API_BASE, cliClient, assertInstanceMatch } = require('./cli-lib');
+const { API_BASE, cliClient, assertInstanceMatch, cliExit } = require('./cli-lib');
 const { resolveEnv } = require('../../src/instance-config');
+const { resolveDefaultVersion } = require('./version-select.js');
 
-// The active internal version; override with <PREFIX>_STATUS_DEFAULT_VERSION (or pass
-// --version). Bumped GDS-V4 → BONGOS-V1 (task 1709, ADR 0103): GDS-V4 was
-// consolidated into BONGOS-V1 (the Cloud Bongos platform version) and frozen, so
-// the bare `/status` card should default to the live version, not a sealed one.
-const DEFAULT_VERSION = resolveEnv('STATUS_DEFAULT_VERSION') || 'BONGOS-V1';
+// The active internal version is RESOLVED, never named here. Override with
+// <PREFIX>_STATUS_DEFAULT_VERSION or --version.
+//
+// WHY THERE IS NO LITERAL (task 1004071). This line used to read
+//   const DEFAULT_VERSION = resolveEnv('STATUS_DEFAULT_VERSION') || 'BONGOS-V1';
+// under a comment promising "the bare /status card should default to the live
+// version, not a sealed one" — the same fix task 1709 had already applied once,
+// for GDS-V4 → BONGOS-V1. BONGOS-V1 then sealed, nobody bumped the literal, and
+// /status served a shipped version's closing scoreboard (140/203 satisfied) as
+// the project's current status. It reads as a healthy project, which is why it
+// sat: nothing in the output says `shipped`, and /status is what a session runs
+// precisely when it does NOT already know. Bumping the literal again would only
+// re-arm the same bomb for whoever seals BONGOS-V2, so the rule is derived from
+// `versions.status` instead — the selection capture.js has always used.
 
 // Compact, status-first ordering for the "remaining: …" summaries.
 const STATUS_ORDER = ['shipped', 'confirmed', 'completed', 'claimed', 'ready', 'blocked', 'backlog'];
@@ -53,7 +63,36 @@ function parseArgs(argv) {
     else if (!criterion) criterion = a.toUpperCase();
     else return { error: `unexpected argument: ${a}` };
   }
-  return { version: version || DEFAULT_VERSION, criterion, json, widget, hook };
+  // No `versionExplicit` companion flag: `version !== null` already IS that
+  // fact, and resolveVersion returns `defaulted`/`source` for anyone who needs
+  // to act on it. A second field carrying the same truth is one that can drift.
+  return { version: version || null, criterion, json, widget, hook };
+}
+
+// Resolve which version this invocation is about. Precedence: an explicit
+// --version (or bare token) > the env override > the live BUILDING version.
+// Returns { version, defaulted, source }; version is NULL when nothing is
+// building, which the caller must treat as "stop and say so", never as a guess.
+// Deps are injectable so the precedence is unit-tested without a session.
+async function resolveVersion(opts, deps = {}) {
+  if (opts.version) return { version: opts.version, defaulted: false, source: 'flag' };
+  const env = (deps.resolveEnv || resolveEnv)('STATUS_DEFAULT_VERSION');
+  if (env) return { version: env, defaulted: true, source: 'env' };
+  const resolve = deps.resolveDefaultVersion || resolveDefaultVersion;
+  const building = await resolve();
+  if (building) return { version: building, defaulted: true, source: 'building' };
+  return { version: null, defaulted: true, source: 'none' };
+}
+
+// One line naming a version the USER did not, so a cross-version answer cannot
+// pass unnoticed. `Cn` is version-scoped and the versions number independently
+// — BONGOS-V1 C8 is `money-one-unit`, BONGOS-V2 C8 is `wa6-kernel-and-packs` —
+// so a silently-defaulted version answers a different question than the one
+// asked. Empty when the user named the version: they already know.
+function defaultedVersionNote(r) {
+  if (!r || !r.defaulted || !r.version) return '';
+  const why = r.source === 'env' ? 'from STATUS_DEFAULT_VERSION' : 'the version currently building';
+  return `(no version given — showing ${r.version}, ${why}. Pass --version to pick another.)`;
 }
 
 async function fetchProgress(version) {
@@ -325,7 +364,38 @@ async function main() {
   // apiCall/cliClient guard, so without this `bongos status` would silently print another
   // instance's progress. Skip only in --hook mode (the automated card path stays fail-open).
   if (!opts.hook) await assertInstanceMatch();
-  const data = await fetchProgress(opts.version);
+
+  // Resolve the version before anything fetches. --hook stays FAIL-OPEN like the
+  // instance check above: the automated card path must degrade, not throw, so a
+  // lookup that cannot answer emits an empty envelope rather than killing the hook.
+  //
+  // COST: one extra sequential GET /versions before the progress fetch, and it
+  // cannot be parallelised — the id IS the second call's path. It is paid only
+  // when no version was named: --version and STATUS_DEFAULT_VERSION both
+  // short-circuit it, so an instance that minds the round trip on the
+  // session-start card path sets the env var once and pays nothing. That is the
+  // deliberate trade against the alternative, which is the literal that spent
+  // months reporting a sealed version as current.
+  const picked = await resolveVersion(opts).catch(() => ({ version: null, defaulted: true, source: 'none' }));
+  if (!picked.version) {
+    if (opts.hook) {
+      process.stdout.write(JSON.stringify({
+        widgets_enabled: false, html: '', markdown: '',
+        warnings: ['status: no version is currently `building` — nothing to report.'],
+      }) + '\n');
+      return;
+    }
+    console.error('status: no version is currently `building` — cannot resolve a default.');
+    console.error('  Open one, or pass --version explicitly (e.g. --version BONGOS-V2).');
+    // cliExit, NOT process.exit: resolveVersion above just made a network round
+    // trip, and a hard exit while the request machinery is tearing down aborts
+    // natively on Windows + Node 24 (UV_HANDLE_CLOSING) — exit 127 AFTER the
+    // message prints, so a caller reads "tooling broken" instead of "no building
+    // version". The other exits in this file are pre-request or have substantial
+    // rendering between; this branch has neither. See scripts/gds/CLAUDE.md.
+    return cliExit(3);
+  }
+  const data = await fetchProgress(picked.version);
 
   // Resolve the requested criterion (if any) once — every output mode needs it.
   let c = null;
@@ -333,7 +403,10 @@ async function main() {
     const n = Number(opts.criterion.slice(1));
     c = data.criteria.find((x) => x.cnum === n);
     if (!c) {
-      console.error(`status: ${opts.version} has no criterion ${opts.criterion} (it has C1–C${data.criteria.length}).`);
+      // Name the version, not just the criterion: on a DEFAULTED version this is
+      // the reader's only clue that C13 was looked up somewhere they didn't pick.
+      console.error(`status: ${picked.version} has no criterion ${opts.criterion} (it has C1–C${data.criteria.length}).`);
+      if (picked.defaulted) console.error(`  ${defaultedVersionNote(picked)}`);
       process.exit(3);
     }
   }
@@ -356,9 +429,12 @@ async function main() {
   // else the whole version rollup).
   if (opts.json) { console.log(JSON.stringify(c || data, null, 2)); return; }
 
-  // Default human output — the existing plain-text rollup, unchanged.
-  if (c) { printOne(data, c); return; }
-  printAll(data);
+  // Default human output — the existing plain-text rollup, plus one line when
+  // the version was resolved rather than chosen (--json/--widget/--hook are
+  // machine interfaces and stay byte-identical).
+  if (c) printOne(data, c); else printAll(data);
+  const note = defaultedVersionNote(picked);
+  if (note) console.log(`  ${note}\n`);
 }
 
 if (require.main === module) {
@@ -368,4 +444,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseArgs, renderStatusWidget, renderStatusMarkdown };
+module.exports = { parseArgs, resolveVersion, defaultedVersionNote, renderStatusWidget, renderStatusMarkdown };

package/scripts/gds/version-literal-guard.js

@@ -35,13 +35,31 @@ const VERSION_LITERAL = String.raw`['"][A-Z][A-Z0-9]*-V\d+['"]`;
 const VERSION_FIELD = String.raw`version_id|versionId|suggested_version|target_version|DEFAULT_VERSION|VERSION_ID`;
 const ASSIGNED = new RegExp(`(?:${VERSION_FIELD})\\s*['"]?\\s*[:=][^,;)]*${VERSION_LITERAL}`);
 const DEFAULTED = new RegExp(`--version[^\\n]*?\\|\\|\\s*${VERSION_LITERAL}`);
+// A version field FALLING BACK to a literal through `||`. ASSIGNED cannot see
+// this shape: its `[^,;)]*` stops at the first `)`, so any call between the `=`
+// and the literal hides it — `DEFAULT_VERSION = resolveEnv('X') || 'BONGOS-V1'`
+// scanned CLEAN while `DEFAULT_VERSION = 'BONGOS-V1'` was caught (task 1004071).
+// That is the exact line that served a sealed version as /status's default for
+// months. Kept as its own narrow pattern rather than loosening ASSIGNED to
+// `[^;]*`, which would fire on any line merely mentioning a field and a literal
+// — the over-broad source assertion this repo keeps relearning (learning 1000196).
+const FALLBACK = new RegExp(`(?:${VERSION_FIELD})\\s*['"]?\\s*[:=][^;]*?\\|\\|\\s*${VERSION_LITERAL}`);
 
 // path::reason. A justified entry, one line, like every other guard here.
+//
+// A REASON MAY CITE THE CODE'S SHAPE, NEVER THE DATABASE'S CONTENTS (task
+// 1004071). status.js was exempted because "TWO versions are currently building
+// — so 'most recent building' is not a derivable answer here." True the day it
+// was written; false once CB-V1 sealed. Nothing re-checks prose, so the entry
+// outlived its justification in silence and /status went on serving a SHIPPED
+// version's closing scoreboard as the project's current status. An entry whose
+// truth depends on rows is a timer nobody set. `version_literals.mjs` now fails
+// CI on an entry that is outright DEAD; it cannot police one that is merely
+// stale, which is why that judgement has to be made here, when the entry is
+// written.
 const VERSION_LITERAL_ALLOW = new Map([
   ['scripts/gds/grade-smoke.js',
     'GOOD_TASK / BAD_TASK are in-memory fixtures handed to grader.gradeSubagent; they are never POSTed, so no version_closed can refuse them and the literal cannot rot into a failure.'],
-  ['scripts/gds/status.js',
-    'DEFAULT_VERSION is an owner-facing dashboard default with an env override, and TWO versions are currently building — so "most recent building" is not a derivable answer here. Retargeting what /status shows by default is an owner decision, not a refactor.'],
 ]);
 
 function isExempt(rel) {
@@ -67,7 +85,7 @@ function scanScripts(files, read) {
     scanned += 1;
     if (VERSION_LITERAL_ALLOW.has(rel)) continue;
     stripComments(src, rel).forEach((line, i) => {
-      if (ASSIGNED.test(line) || DEFAULTED.test(line)) {
+      if (ASSIGNED.test(line) || DEFAULTED.test(line) || FALLBACK.test(line)) {
         violations.push(
           `${rel}:${i + 1} names a version id where one should be RESOLVED: ${line.trim().slice(0, 90)}`
           + ' — a literal works until that version ships, then version_closed refuses every write and the'
@@ -119,4 +137,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { checkNoVersionLiterals, scanScripts, stripComments, isExempt, VERSION_LITERAL_ALLOW, ASSIGNED, DEFAULTED };
+module.exports = { checkNoVersionLiterals, scanScripts, stripComments, isExempt, VERSION_LITERAL_ALLOW, ASSIGNED, DEFAULTED, FALLBACK };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.889'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.891'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/extract_json.mjs

@@ -128,11 +128,19 @@ test('nothing parseable is null', () => {
 test('GRADE_SHAPE_KEYS is the exported score-key list', () => {
   // Exported so workers and grader.js agree on what "grade-shaped" means; the
   // preference test above depends on functional_fidelity being in this list.
+  //
+  // ONE ENTRY PER WORKER THAT REPORTS A SCORE. task 1003977 added copy_score
+  // with the reader: reader.js re-exports this extractJson, so a worker missing
+  // from this list silently loses the score-based disambiguation every other
+  // worker gets. Kept as an exact list rather than loosened, because that
+  // silence is the whole reason to pin it — a new worker must appear here in
+  // the same change that adds it.
   assert.deepEqual(GRADE_SHAPE_KEYS, [
     'functional_fidelity',
     'code_quality',
     'security_score',
     'efficiency_score',
+    'copy_score',
   ]);
 });