@bongos/core 1.19.916 → 1.19.918

package/modules/lifecycle/cascade.js

@@ -17,7 +17,7 @@
 // shipped task looks like THIS, file THAT task, for THAT discipline. There is no
 // condition language, no stored rules, no per-project configuration and no UI —
 // every one of those is a thing to add when a second and third cascade exist and
-// have shown what they have in common. Today `CASCADES` ships EMPTY: the
+// have shown what they have in common. `CASCADES` no longer ships empty: the
 // mechanism, its idempotency and its non-blocking property are proved by the
 // tests' own declarations, and R04 (task 1003115) writes the first production
 // entry. A mechanism whose first real rule is written by the task that needs it
@@ -169,6 +169,50 @@ function artistReviewBody(task) {
   ].join('\n');
 }
 
+// The removal proposal's body (task 1004090 / BV2.R15, ADR 0313).
+//
+// IT ASKS, IT DOES NOT TELL. Every line here is written so a reader confirms or
+// dismisses on the evidence rather than rubber-stamping a verdict — because the
+// owner chose propose-then-confirm precisely for the cases this derivation cannot
+// tell apart from a real removal. The three it CAN tell apart (a rename, a move,
+// a rewrite in place) are already excluded upstream in removal-derivation.js.
+//
+// The affected tasks and paths are named as PROSE, deliberately. A cascade files
+// one task per rule per ship keyed on (rule, ship), with no field for a target,
+// and R05's runner may not be widened to fan out (ADR 0242). Owner decision
+// 2026-09-20: the body carries them and R20 designs its own storage when it needs
+// one. So this text IS the record until then — keep it readable and keep it exact.
+function removalProposalBody(task, ctx) {
+  const found = ((ctx || {}).removals) || [];
+  const lines = [];
+  lines.push(`Shipping task ${task.id} deleted files that earlier SHIPPED work put there.`);
+  lines.push('');
+  lines.push('**This is a question, not a verdict.** Nothing has been marked removed, no');
+  lines.push('status changed and no credit moved — and none of that happens unless a person');
+  lines.push('confirms below. `shipped` is terminal and stays terminal.');
+  lines.push('');
+  lines.push('**Removed work attributed to:**');
+  for (const r of found) {
+    lines.push(`  - task ${r.taskId}${r.title ? ` — ${r.title}` : ''}`);
+    for (const path of r.paths) lines.push(`      ${path}`);
+  }
+  lines.push('');
+  if ((ctx || {}).removalTruncated) {
+    lines.push(`Note: this ship deleted ${(ctx || {}).removalDeletedCount} paths, more than the`);
+    lines.push('attribution cap, so the list above is PARTIAL. A ship that large is usually a');
+    lines.push('move or a sweep — weigh that before confirming.');
+    lines.push('');
+  }
+  lines.push('**Confirm** if that work is genuinely gone: the ideas whose descent it belongs');
+  lines.push('to will dim accordingly. **Dismiss** if this was a refactor, a move the rename');
+  lines.push('detection missed, or a deletion of something already superseded — dismissing is');
+  lines.push('what stops the sky being dimmed for a reason that is not real.');
+  lines.push('');
+  lines.push('Attribution runs through `claims.published_head_sha`, so a deletion whose origin');
+  lines.push('predates that record is silently absent rather than guessed at.');
+  return lines.join('\n');
+}
+
 // Production rules. The artist review is the first (R04); add another by
 // appending an entry, never by touching the runner (ADR 0242).
 const CASCADES = Object.freeze([
@@ -189,6 +233,25 @@ const CASCADES = Object.freeze([
     title: (t) => `Artist review: the copy and visuals that shipped in task ${t.id}`,
     body: artistReviewBody,
   }),
+  Object.freeze({
+    key: 'removal-proposed-on-ship',
+    // ENGINEER, not artist: confirming asks whether deleted code is genuinely
+    // gone or was moved, which is a question about the diff.
+    discipline: 'engineer',
+    kind: 'unclassified',
+    // The anti-recursion guard FIRST, the same order and for the same reason as
+    // the rule above — a cascade-generated task must never cascade.
+    //
+    // The candidates are resolved ONCE into ctx by runCascadesForShip, never
+    // here: a `when` is pure and synchronous by contract, and this derivation is
+    // a network read. An absent ctx therefore means "nothing was derived" and
+    // files nothing — the opposite default to the artist gate above, and
+    // deliberately so: silence about a removal must never be read as a removal.
+    when: (t, ctx) => t.source !== CASCADE_SOURCE
+      && Array.isArray((ctx || {}).removals) && (ctx || {}).removals.length > 0,
+    title: (t) => `Was this removed? Task ${t.id} deleted earlier shipped work`,
+    body: removalProposalBody,
+  }),
 ]);
 
 // THE TRIGGERS. A cascade reacts to a state transition; there are two, and this
@@ -319,7 +382,7 @@ function cascadesFor(task, rules = CASCADES, ctx = {}, trigger = TRIGGERS.ship)
     }
     if (!hit) continue;
     try {
-      matched.push({ rule, spec: cascadeTaskSpec(rule, task, trigger) });
+      matched.push({ rule, spec: cascadeTaskSpec(rule, task, trigger, ctx) });
     } catch (e) {
       errors.push(`cascade "${rule.key}": title/body threw (${e && e.message})`);
     }
@@ -329,8 +392,11 @@ function cascadesFor(task, rules = CASCADES, ctx = {}, trigger = TRIGGERS.ship)
 
 // The createTask payload for one matched rule. The attribution preamble is
 // prepended here rather than left to each rule, so no rule can forget it.
-function cascadeTaskSpec(rule, task, trigger = TRIGGERS.ship) {
-  const body = String(rule.body(task) || '').trim();
+// `ctx` reaches body() as a second argument, mirroring when(). The artist rule
+// ignores it; the removal rule needs it, because what a ship deleted is derived
+// per run and is not a property of the task row.
+function cascadeTaskSpec(rule, task, trigger = TRIGGERS.ship, ctx = {}) {
+  const body = String(rule.body(task, ctx) || '').trim();
   const preamble =
     `Filed automatically when ${trigger.happened(task)} — the "${rule.key}" cascade `
     + `(modules/lifecycle/cascade.js). Nobody typed this; it is a REQUEST, filed at backlog, `
@@ -466,6 +532,27 @@ async function runCascadesForShip(shipped, deps = {}) {
       try { ctx.artistGate = deps.artistGateMode(); }
       catch (e) { report.errors.push(`cascade: artistGateMode() threw (${e && e.message}) — policy unread`); }
     }
+    // WHAT THIS SHIP DELETED (task 1004090 / BV2.R15, ADR 0313). Resolved here
+    // rather than in the rule for the reason the rule's own comment gives: a
+    // `when` is pure and synchronous, and this is a network read.
+    //
+    // Same posture as the policy read above — a resolver that throws is REPORTED
+    // and leaves the keys unset, so a derivation outage files no proposal and
+    // costs the ship nothing. `removalCandidates` already swallows its own
+    // failures (removal-derivation.js returns a report rather than rejecting);
+    // this try/catch is the belt to that braces, because a non-blocking promise
+    // is only non-blocking until someone edits it.
+    if (typeof deps.removalCandidates === 'function') {
+      try {
+        const derived = await deps.removalCandidates(task);
+        ctx.removals = (derived && derived.removals) || [];
+        ctx.removalTruncated = Boolean(derived && derived.truncated);
+        ctx.removalDeletedCount = (derived && derived.deletedCount) || 0;
+        for (const e of (derived && derived.errors) || []) report.errors.push(e);
+      } catch (e) {
+        report.errors.push(`cascade: removalCandidates() threw (${e && e.message}) — no removal derived`);
+      }
+    }
 
     const { matched, errors } = cascadesFor(task, deps.rules || CASCADES, ctx);
     report.errors.push(...errors);
@@ -480,6 +567,7 @@ async function runCascadesForShip(shipped, deps = {}) {
 
 module.exports = {
   CASCADES,
+  removalProposalBody,
   IDEA_CASCADES,
   TRIGGERS,
   fullIdeaScopingBody,

package/modules/lifecycle/db-ship.js

@@ -761,6 +761,48 @@ async function getClaimPublishedSha(taskId) {
   return rows[0]?.published_head_sha ?? null;
 }
 
+// shippedTasksByPublishedSha — the reverse of getClaimPublishedSha: given commit
+// shas, which SHIPPED tasks published them (BV2.R15, ADR 0313).
+//
+// This is how removal attribution answers "whose work was deleted". ADR 0313
+// rejected the obvious alternative — parsing `(task NNNN)` out of commit messages —
+// because only 7 of the last 15 commits on main carry a task id: merge commits and
+// release carriers do not, and a convention that holds most of the time is not a
+// basis for something that moves credits. `published_head_sha` is written by the
+// SERVER at publish time and cannot be forgotten by an author.
+//
+// Only `shipped` rows come back, deliberately. Work that never landed cannot have
+// been removed, and a proposal naming an abandoned task would be noise a person
+// has to read and dismiss.
+//
+// INDEXED by core_252 (claims_published_head_sha_idx, partial on NOT NULL). This
+// is the first reader to go BACKWARD along that column — every prior one reads
+// forward by task_id — so before that index it planned a full scan of the
+// claims table on the ship path, on a table that grows one row per claim
+// forever.
+//
+// Returns a Map of sha -> { taskId, title }. Shas with no claim are simply absent:
+// `published_head_sha` is nullable (rows predating migrations/171, or a publish
+// that rode another branch), and ADR 0313 is explicit that an unattributable
+// deletion files NOTHING. Silence is the correct output — a wrong removal proposal
+// costs a person attention and dims a real star.
+async function shippedTasksByPublishedSha(shas) {
+  const list = [...new Set((Array.isArray(shas) ? shas : [])
+    .filter((s) => typeof s === 'string' && /^[0-9a-f]{7,40}$/i.test(s)))];
+  if (!list.length) return new Map();
+  const { rows } = await pool.query(
+    `SELECT c.published_head_sha AS sha, t.id AS task_id, t.title
+       FROM claims c
+       JOIN tasks t ON t.id = c.task_id
+      WHERE c.published_head_sha = ANY($1::text[])
+        AND t.status = 'shipped'`,
+    [list]
+  );
+  const out = new Map();
+  for (const r of rows) out.set(r.sha, { taskId: String(r.task_id), title: r.title });
+  return out;
+}
+
 // V3.R14 (#238) — onboarding observability roster.
 //
 // One row per builder, joined with the live "what are they doing right
@@ -1408,6 +1450,7 @@ module.exports = {
   getActiveClaimsForBuilderWithStale,
   getBuildersRoster,
   getClaimPublishedSha,
+  shippedTasksByPublishedSha,
   listConfirmedTasksForReconcile,
   needsRebaseTasksForBuilder,
   gatingRebaseTasksForBuilder,

package/modules/lifecycle/db.js

@@ -185,6 +185,7 @@ const {
   getActiveClaimsForBuilderWithStale,
   getBuildersRoster,
   getClaimPublishedSha,
+  shippedTasksByPublishedSha,
   listConfirmedTasksForReconcile,
   mergeTask,
   needsRebaseTasksForBuilder,
@@ -330,6 +331,7 @@ module.exports = {
   listConfirmedTasksForReconcile, // task 1134 — server-owned publish reconciler feed
   setClaimPublishedSha, // task 1547 — record the SERVER-pushed tip for per-task land proof
   getClaimPublishedSha, // task 1547 — read the published tip for the reconcile gate
+  shippedTasksByPublishedSha, // task 1004090 / BV2.R15 — the reverse read, for removal attribution
   getActiveClaimsForBuilder,
   moduleScopeForActiveClaims, // goal 1000051 / R92 — dev-box task-scoped source access (ADR 0148 §2)
   activeClaimCountForBuilder, // task 1002729 — distinguishes "no claim" from "claim with an empty goal wall"

package/modules/lifecycle/removal-derivation.js

@@ -0,0 +1,332 @@
+'use strict';
+
+// modules/lifecycle/removal-derivation.js — WHAT A SHIP DELETED, AND WHOSE WORK
+// IT WAS (task 1004090 / BV2.R15, goal 1000095; ADR 0313).
+//
+// Brightness (R20) is the live share of a descent, so something has to be able to
+// say that shipped work was later removed. Nothing recorded that: `shipped` is
+// terminal, there is no reverted status, and `tasks.merged_into_task_id` is
+// CHECK-constrained to abandoned rows. This file derives the signal.
+//
+// It produces a QUESTION, never a verdict. The rule in ./cascade.js files a task
+// at backlog; a person confirms it (R16). Nothing here changes a status, and
+// nothing here touches credits — ADR 0313 is explicit that the ledger is never
+// rewritten, because refactors, renames and file moves all look like deletions to
+// a diff and a derived-only signal would dim the sky continuously.
+//
+// ── WHY NOT THE SIGNAL THAT ALREADY EXISTS ──────────────────────────────────
+//
+// `netNegativeBonusAmount` is the nearest existing thing and is unusable, for
+// three reasons ADR 0313 sets out:
+//   • It has no TARGET. `removed > added` over a whole ship says that deletion
+//     happened, never what was deleted or whose work it was. Brightness needs the
+//     target; the boolean carries none.
+//   • It is CLIENT-SUPPLIED — it reads `signals.diff_stats` from the grade request
+//     body, and `grader-score.js` already documents defending against a forged
+//     `diff_stats`.
+//   • Brightness sits beside money. Deriving it from a forgeable, target-less
+//     counter would be wrong even where it was convenient.
+//
+// So the signal comes from the SERVER's own view of the merge instead. Landing is
+// server-mediated (ADR 0055): the server holds the authority and can ask GitHub
+// what the pull request actually changed, rather than be told by the box that
+// built it.
+
+const api = require('../../src/module-api');
+const githubPush = require('./github-push');
+
+// How many deleted paths one ship will be attributed — and therefore the HARD
+// CEILING on GitHub calls this derivation can make per ship. Each path costs one
+// commit-history request, and they run on the server's shared push credential,
+// which the publish path itself depends on: spending that budget to answer a
+// question nobody asked for would be a poor trade.
+//
+// A ship that removes more than this is a sweep — a directory move, a vendored
+// drop, a module deletion — where the proposal is least useful and the cost is
+// highest. Eight is deliberately small: a genuine "this ship removed someone's
+// feature" is a handful of files, and beyond that the truncation note tells a
+// reader to weigh the ship as a move rather than a removal.
+//
+// The cap is on the ATTRIBUTION, not the detection: the deletion count is still
+// reported honestly so the proposal can say its list is partial.
+const MAX_ATTRIBUTED_PATHS = 8;
+
+// listCommitsForPath — the shas of the commits that touched ONE path, newest
+// first. The read behind attribution: a deleted file is blamed back to the commit
+// that introduced it, and that sha is resolved through `claims.published_head_sha`.
+//
+// IT LIVES HERE RATHER THAN IN github-push.js, which is where its siblings live,
+// because that file sits ON the 1500-line ratchet ceiling — the same reason
+// `pr-assign.js` was carved out of it, and this module's CLAUDE.md says so in as
+// many words. Its only consumer is the derivation below.
+//
+// WHY THE API AND NOT `git log`. The server keeps no persistent clone — pushBundle
+// works in a temp dir off a bundle and throws it away — so there is no working tree
+// to blame in. GitHub holds the history. Same reason getPullRequestFiles reads the
+// REST files API rather than diffing locally.
+//
+// `until` bounds the walk to commits at or before the merge being examined, so a
+// LATER commit that re-added the path cannot be mistaken for the one that
+// introduced it.
+//
+// Caps at ONE page of 100. Attribution only needs to find a published tip, and a
+// path with more than 100 commits above the one that introduced it is old enough
+// that the introducing claim almost certainly predates `published_head_sha`
+// (migrations/171) — in which case the correct output is no attribution at all,
+// which is exactly what an exhausted page yields. Paging further would spend rate
+// limit to reach the same silence.
+async function listCommitsForPath({ path: filePath, until = null }, deps = {}) {
+  // resolveToken is injectable for the same reason fetchImpl and repoInfo are:
+  // this function is the one place a rate-limit response is classified, and that
+  // classification has to be testable without a live credential.
+  const token = deps.resolveToken ? await deps.resolveToken(deps) : await githubPush.resolveToken(deps);
+  if (!token) throw new Error('PUSH_UNCONFIGURED');
+  if (typeof filePath !== 'string' || !filePath) throw new Error('BAD_PATH');
+  const info = deps.repoInfo || api.repoInfo;
+  if (!info || info.error || !info.owner || !info.repo) throw new Error('NO_REPO_INFO');
+  const doFetch = deps.fetchImpl || fetch;
+  const qs = new URLSearchParams({ path: filePath, per_page: '100' });
+  if (until) qs.set('until', String(until));
+  const res = await doFetch(
+    `https://api.github.com/repos/${info.owner}/${info.repo}/commits?${qs.toString()}`,
+    { headers: githubPush.ghHeaders(token) }
+  );
+  // A path that has never existed is a 404 and an EMPTY history, not an error: the
+  // caller asks "who introduced this", and "nobody we can see" is an answer.
+  if (res.status === 404) return [];
+  // RATE LIMITING IS NOT A PER-PATH FAILURE — it is a statement about the whole
+  // credential, so it must not be retried and must not be walked past. GitHub
+  // signals it as 403 or 429 with the remaining count at zero (a 403 for any
+  // other reason keeps a non-zero remaining, or sends no header at all, and is
+  // treated as an ordinary failure). Thrown with a recognisable name so the
+  // caller can ABANDON the rest of the walk rather than spend the next seven
+  // requests learning the same thing.
+  if (res.status === 429 || res.status === 403) {
+    const remaining = res.headers && typeof res.headers.get === 'function'
+      ? res.headers.get('x-ratelimit-remaining')
+      : null;
+    if (res.status === 429 || remaining === '0') {
+      const e = new Error('RATE_LIMITED');
+      e.rateLimited = true;
+      throw e;
+    }
+  }
+  if (!res.ok) throw new Error(`STATUS_FETCH_FAILED ${res.status}`);
+  const commits = await res.json();
+  if (!Array.isArray(commits)) return [];
+  return commits.map((c) => c && c.sha).filter((sha) => typeof sha === 'string' && sha);
+}
+
+// ---------------------------------------------------------------------------
+// The pure half
+// ---------------------------------------------------------------------------
+
+// WHAT COUNTS AS REMOVED. ADR 0313 names three exclusions, and each is a status
+// the REST files API already distinguishes — which is exactly why the derivation
+// reads that API rather than counting lines:
+//
+//   • 'renamed'  — a rename or move is NOT a removal. Git's own rename detection
+//                  resolves it and the work still stands. This is the exclusion
+//                  that matters most: a directory reorganisation would otherwise
+//                  propose a removal for every file in it.
+//   • 'modified' — a rewrite in place is NOT a removal. Lines changing is how
+//                  code lives, and this is where a line-count heuristic
+//                  (`removed > added`) goes wrong.
+//   • 'added' / 'copied' / 'changed' — nothing was lost.
+//
+// Only 'removed' survives. The third ADR exclusion — a cold body is not a remnant
+// — is not expressible here: it is enforced downstream by attributing solely to
+// tasks that actually SHIPPED (see shippedTasksByPublishedSha), because an idea
+// declined at triage never ignited and nothing was built to lose.
+//
+// Pure: hand it the files array and it answers. No network, no clock, no DB.
+function deletedPathsFrom(files) {
+  if (!Array.isArray(files)) return [];
+  const out = [];
+  for (const f of files) {
+    if (!f || typeof f !== 'object') continue;
+    // `deleted` is getPullRequestFiles' own mapping of status === 'removed'.
+    // Both are read, and they must AGREE: trusting `deleted` alone would follow a
+    // caller that set it by hand, and trusting `status` alone would miss a caller
+    // that shaped the row the other way. Where only one is present, it decides.
+    const status = typeof f.status === 'string' ? f.status.toLowerCase() : null;
+    const flagged = f.deleted === true;
+    const isRemoval = status ? status === 'removed' : flagged;
+    if (!isRemoval) continue;
+    if (typeof f.path !== 'string' || !f.path) continue;
+    out.push(f.path);
+  }
+  return [...new Set(out)];
+}
+
+// Group attributed paths by the task that published them, so the proposal reads
+// as "this task lost these files" rather than a flat list a person has to sort.
+// Pure. Insertion order is preserved, which keeps the rendered body stable for a
+// given diff rather than reshuffling between runs.
+function groupByTask(attributions) {
+  const byTask = new Map();
+  for (const a of Array.isArray(attributions) ? attributions : []) {
+    if (!a || a.taskId == null) continue;
+    const key = String(a.taskId);
+    if (!byTask.has(key)) byTask.set(key, { taskId: key, title: a.title || null, paths: [] });
+    const row = byTask.get(key);
+    if (a.path && !row.paths.includes(a.path)) row.paths.push(a.path);
+  }
+  return [...byTask.values()];
+}
+
+// ---------------------------------------------------------------------------
+// The impure half — one network read per deleted path, then one DB read
+// ---------------------------------------------------------------------------
+
+// Resolve deleted paths to the shipped tasks that published them.
+//
+// For each path: ask GitHub which commits touched it up to the merge, then look
+// those shas up against `claims.published_head_sha`. The OLDEST matching commit is
+// taken as the one that introduced the file — the newest would attribute a file to
+// whoever last edited it, which is a different and wrong question.
+//
+// `shipTaskId` is excluded: a ship that deletes its OWN earlier file is a builder
+// tidying up inside one piece of work, not a removal of someone else's.
+//
+// Everything is best-effort per path. One path whose history cannot be read costs
+// that path its attribution and nothing else — the other paths still resolve, and
+// a total failure yields an empty list, which files no proposal at all.
+async function attributeDeletions({ paths, shipTaskId, until = null }, deps = {}) {
+  const listCommits = deps.listCommitsForPath || listCommitsForPath;
+  const lookup = deps.shippedTasksByPublishedSha;
+  const errors = [];
+  if (typeof lookup !== 'function') return { attributions: [], errors: ['no sha lookup provided'] };
+
+  const wanted = (Array.isArray(paths) ? paths : []).slice(0, MAX_ATTRIBUTED_PATHS);
+  const perPath = [];
+  for (const path of wanted) {
+    try {
+      // Newest first from the API; reversed so the OLDEST visible commit wins.
+      const shas = await listCommits({ path, until });
+      perPath.push({ path, shas: [...(Array.isArray(shas) ? shas : [])].reverse() });
+    } catch (e) {
+      // A rate-limit refusal ends the WALK, not just this path. Continuing would
+      // spend the remaining budget on requests already known to fail, on the same
+      // credential the publish path needs — the opposite of backing off. There is
+      // deliberately no retry and no sleep: this runs on the ship path, and
+      // waiting there to dim a star later is the wrong trade (ADR 0313).
+      if (e && e.rateLimited) {
+        errors.push('removal: GitHub rate limit reached — attribution abandoned for this ship');
+        break;
+      }
+      errors.push(`removal: history for ${path} unreadable (${e && e.message})`);
+    }
+  }
+
+  // ONE database read for every path's shas together, rather than one per path.
+  let shaToTask;
+  try {
+    shaToTask = await lookup(perPath.flatMap((p) => p.shas));
+  } catch (e) {
+    return { attributions: [], errors: [...errors, `removal: sha lookup failed (${e && e.message})`] };
+  }
+  if (!(shaToTask instanceof Map)) return { attributions: [], errors: [...errors, 'removal: sha lookup returned no map'] };
+
+  const attributions = [];
+  for (const { path, shas } of perPath) {
+    for (const sha of shas) {
+      const hit = shaToTask.get(sha);
+      if (!hit) continue;
+      if (shipTaskId != null && String(hit.taskId) === String(shipTaskId)) break;
+      attributions.push({ path, taskId: hit.taskId, title: hit.title, sha });
+      break;
+    }
+  }
+  return { attributions, errors };
+}
+
+// THE WHOLE DERIVATION, as the one call the cascade context resolver makes.
+//
+// NON-BLOCKING IS THE CONTRACT, not a nicety. This runs on the path a ship
+// already takes, and ADR 0313 says so in as many words: "a derivation that errors
+// files nothing and never fails the merge. Landing work is more important than
+// dimming a star on time." So every failure mode below returns a report rather
+// than throwing, and the caller treats an empty `removals` as "file nothing".
+async function deriveRemovalsForShip({ taskId, prNumber, until = null }, deps = {}) {
+  const empty = (errors) => ({ removals: [], deletedCount: 0, truncated: false, errors });
+  try {
+    if (prNumber == null) return empty(['removal: no pull request for this ship — nothing to read']);
+
+    const getFiles = deps.getPullRequestFiles
+      || ((args) => githubPush.getPullRequestFiles(args));
+
+    let files;
+    try {
+      files = await getFiles({ number: Number(prNumber) });
+    } catch (e) {
+      return empty([`removal: PR files unreadable (${e && e.message})`]);
+    }
+
+    const deleted = deletedPathsFrom(files);
+    if (!deleted.length) return empty([]);
+
+    const { attributions, errors } = await attributeDeletions(
+      { paths: deleted, shipTaskId: taskId, until },
+      deps
+    );
+
+    return {
+      removals: groupByTask(attributions),
+      deletedCount: deleted.length,
+      truncated: deleted.length > MAX_ATTRIBUTED_PATHS,
+      errors,
+    };
+  } catch (e) {
+    return empty([`removal: ${e && e.message}`]);
+  }
+}
+
+// removalCandidatesForTask — the whole resolver the ship listener wires, as ONE
+// testable function rather than a closure inside the listener.
+//
+// IT LIVES HERE BECAUSE THE CLOSURE VERSION SHIPPED A DEAD FEATURE. Written
+// inline in routes/lifecycle.js it read `pr.number` from findTaskPullRequest,
+// which returns `pr_number` — so `prNumber` was null on every real ship,
+// deriveRemovalsForShip short-circuited every time, and the rule could never
+// fire in production. Every test injected `removalCandidates` or
+// `getPullRequestFiles` directly, so the whole suite passed over a feature that
+// did nothing: the parts agreed with each other and none of them was wired to
+// the part that was wrong.
+//
+// A closure inside a listener registration is not reachable from a test without
+// rebuilding the router and intercepting the registration. Naming it makes the
+// field read testable, and leaves the listener a single line that cannot hide a
+// second one.
+//
+// Resolving the PR here rather than inside deriveRemovalsForShip keeps THAT
+// function free of the task->PR question, which github-push already answers.
+// A task with no findable PR derives nothing, which files nothing.
+async function removalCandidatesForTask(task, deps = {}) {
+  const empty = { removals: [], deletedCount: 0, truncated: false, errors: [] };
+  const findPr = deps.findTaskPullRequest
+    || ((args) => githubPush.findTaskPullRequest(args));
+  let prNumber = null;
+  try {
+    const pr = await findPr({ taskId: task && task.id });
+    // `pr_number`, NOT `pr.number` — findTaskPullRequest returns
+    // { branch, pr_number, pr_state, merged }. Pinned by test, because reading
+    // the wrong field here is silent: it yields null, which is a legal "no PR"
+    // answer, so the feature simply never runs and nothing ever complains.
+    prNumber = pr && pr.pr_number != null ? pr.pr_number : null;
+  } catch (_) {
+    // Never let the PR lookup cost the ship. Same contract as everything below.
+    return empty;
+  }
+  return deriveRemovalsForShip({ taskId: task && task.id, prNumber }, deps);
+}
+
+module.exports = {
+  MAX_ATTRIBUTED_PATHS,
+  removalCandidatesForTask,
+  listCommitsForPath,
+  deletedPathsFrom,
+  groupByTask,
+  attributeDeletions,
+  deriveRemovalsForShip,
+};

package/modules/lifecycle/routes/lifecycle.js

@@ -28,6 +28,7 @@ const api = require('../../../src/module-api');
 const lifecycle = require('../lifecycle');
 const db = require('../db');
 const cascade = require('../cascade');
+const removalDerivation = require('../removal-derivation');
 
 // task 1003549 — the cross-role cascade listener. `task.shipped` already exists
 // as a kernel event (emitted post-commit by the publish reconciler and the ship
@@ -78,6 +79,29 @@ function registerSeams() {
     // HOLDS a deploy can never be read differently. At 'off' the artist-review
     // rule files nothing.
     artistGateMode: () => api.artistGate.artistGateMode(),
+    // WHAT THIS SHIP DELETED (task 1004090 / BV2.R15, ADR 0313). The derivation
+    // asks GitHub what the pull request actually changed and blames the deleted
+    // paths back through `claims.published_head_sha` — the SERVER's own view of
+    // the merge, never the client-supplied `diff_stats` the net-negative bonus
+    // reads, which is target-less and already known-forgeable.
+    //
+    // Resolving the PR number here rather than inside the derivation keeps that
+    // file free of the task->PR question, which github-push already answers.
+    // A task with no findable PR derives nothing, which files nothing.
+    //
+    // Every failure is swallowed into an empty result: this runs on the ship
+    // path, and ADR 0313 is explicit that landing work matters more than dimming
+    // a star on time.
+    //
+    // The resolver itself is `removalCandidatesForTask`, NOT a closure here. It
+    // was a closure, and it read the wrong field off findTaskPullRequest
+    // (`number` for `pr_number`), which made the whole rule dead in production
+    // while every test passed — because every test injected this dep. A closure
+    // inside a listener registration is not reachable from a test; a named
+    // function is, and this line is now too small to hide a bug of its own.
+    removalCandidates: (task) => removalDerivation.removalCandidatesForTask(task, {
+      shippedTasksByPublishedSha: (shas) => db.shippedTasksByPublishedSha(shas),
+    }),
     log: api.logger ? api.logger('lifecycle') : null,
   }));
 }

package/modules/lifecycle/tests/cascade.mjs

@@ -194,15 +194,32 @@ const shippedCopy = (over = {}) => ({
   ...over,
 });
 
-await test('the artist review is the one production rule, keyed and disciplined', () => {
-  assert.equal(cascade.CASCADES.length, 1);
-  const r = cascade.CASCADES[0];
-  assert.equal(r.key, 'artist-review-on-ship');
+await test('the artist review is keyed and disciplined, and the table stays well-formed', () => {
+  // This pinned CASCADES.length === 1 until task 1004090 appended the removal
+  // proposal (BV2.R15). A count is the wrong pin for a table whose whole contract
+  // is "extend by appending an entry" (ADR 0242) — it fails on the one change it
+  // is meant to permit, and says nothing about WHICH rules are there.
+  //
+  // So it pins the rule by KEY instead, and pins the SET of keys separately below:
+  // a rule vanishing and a rule being added are different events and should fail
+  // differently.
+  const r = cascade.CASCADES.find((x) => x.key === 'artist-review-on-ship');
+  assert.ok(r, 'the artist review rule is gone from CASCADES');
   assert.equal(r.discipline, 'artist', 'the review is FOR the artist, whatever role shipped the work');
   assert.equal(r.kind, 'unclassified', 'a valid kind — not the invalid "chore" the spec used to default to');
   assert.deepEqual(cascade.validateCascades(), [], 'and the shipped table is well-formed');
 });
 
+await test('the production rule set is exactly what is declared', () => {
+  // The other half of the pin above: adding a rule is a deliberate act, so it
+  // should have to be recorded here. Duplicate keys would collide on source_ref
+  // and silently suppress one another, which validateCascades already refuses.
+  assert.deepEqual(
+    cascade.CASCADES.map((r) => r.key).sort(),
+    ['artist-review-on-ship', 'removal-proposed-on-ship'],
+  );
+});
+
 await test('a copy/visual ship generates the two-step artist review', () => {
   const { matched } = cascade.cascadesFor(shippedCopy());
   assert.equal(matched.length, 1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.916",
+  "version": "1.19.918",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.916",
+      "version": "1.19.918",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.916",
+  "version": "1.19.918",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",