@bongos/core 1.19.919 → 1.19.921

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-03-roadmap1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -151,7 +151,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/shell.js?v=2026-09-20-coreupdate1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.919",
+  "version": "1.19.921",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.919",
+      "version": "1.19.921",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.919",
+  "version": "1.19.921",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -231,9 +231,25 @@ const CLEAN_VERDICT_RE = /\b[1-9]\d* passed, 0 failed(?:, \d+ skipped)?\s*$/;
 // line so a suite that prints skips without a summary suffix is still surfaced.
 const SKIP_LINE_RE = /^\s*SKIP\b/;
 
+// node:test suites print no SKIP line at all — they report `ℹ skipped N` in their own summary
+// (task 1004112). Until this, every skip in a node:test suite was INVISIBLE to the roll-up whose
+// entire purpose is to say "a skipped case is not a passing one": the suite printed `ok`, the
+// roll-up counted nothing, and the unrun coverage vanished without a trace.
+//
+// Found while fixing this counter's own subject. Gating four unevaluable cases in
+// tests/skip_is_not_pass.mjs turned four honest FAILURES into four invisible skips — the 1003993
+// defect reappearing one layer up, in the file written to prevent it. A skip that nothing counts
+// is a pass with extra steps.
+const NODE_TEST_SKIP_RE = /^\s*(?:ℹ|#)\s*skipped\s+(\d+)\s*$/m;
+
 function countSkips(stdout) {
   if (!stdout) return 0;
-  return stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
+  const lines = stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
+  // The two formats are mutually exclusive in practice (a suite is either the project's own
+  // harness or node:test), but SUM rather than branch: a suite that grew both would otherwise
+  // report whichever we happened to check first, and under-reporting is the failure mode here.
+  const m = stdout.match(NODE_TEST_SKIP_RE);
+  return lines + (m ? Number(m[1]) : 0);
 }
 
 function isCleanTeardownAbort(stdout, stderr) {

package/scripts/gds/ship-flow.js

@@ -74,6 +74,11 @@ async function shipMain() {
   // task 1003950: set only when the empty-diff guard below classifies this ship as a
   // deliberate no-artifact close. Gates the auto-escalation at the confirm wall.
   let noArtifactClose = false;
+  // task 1004011: this ship has no committed diff, so the grade's subject is the
+  // builder's CLAIM (notes + value summary) rather than a diff. Distinct from
+  // noArtifactClose, which marks the older "reached the archon gate" case: a ship
+  // can now be no-artifact and still fully graded, which is the point.
+  let noArtifactGrade = false;
   // task 1002605 (G-18): explicit opt-in to continue past a FAILED production
   // smoke run. Without it a smoke FAIL now ABORTS before the claim resolves
   // (claim intact); with it, the resolve proceeds and the task deliberately
@@ -267,16 +272,45 @@ async function shipMain() {
       process.exit(1);
     }
     // verdict.reason === 'allow-empty': a deliberate no-artifact / DB-only ship.
-    // There is no committed diff for the subagent grader to read, so confirm
-    // directly (this is the DB-only path the old --skip-grade route served).
-    if (!skipGrade) skipGrade = true;
+    //
+    // task 1004011 (ADR 0320): this used to force `skipGrade = true` — no grade at
+    // all, then the Archon-only `task.confirm.grade_bypass` gate. Both halves were
+    // wrong. An empty diff is not an UNGRADED diff, it is a diff the grader has
+    // nothing to say about, so it should not need the key that ratifies past a
+    // FAILING grade. And something here does deserve adversarial scrutiny: not the
+    // absent diff, but the CLAIM that nothing was needed. "The premise was already
+    // fixed", "this was a pure ops verification" are assertions the ledger records
+    // and, until now, nothing checked.
+    //
+    // So the grader is no longer skipped — it is re-pointed at the notes. A pass is
+    // a REAL passing grade and confirms through the ordinary rank-open path; a fail
+    // is a real fail, and the builder fixes the evidence rather than reaching for a
+    // permission. skipGrade stays false; only an explicit --skip-grade still skips.
+    // Set only when a grade will actually run. With --skip-grade (or the server-side
+    // grader_bypass, which forces skipGrade above) the `if (!skipGrade)` gate below
+    // skips grading entirely and this flag would be inert — but an inert flag makes a
+    // reader trace two of them to see why nothing happened, and invites a later
+    // refactor to treat it as "this ship graded its notes" when it graded nothing.
+    noArtifactGrade = !skipGrade;
     // task 1003950: mark WHY the grader is being skipped. A --skip-grade ship past a
     // failing grade and a genuinely artifact-free close both reach the same archon
     // gate below, but only the second one may be escalated automatically — the first
     // has a diff the grader DID read and reject, and auto-filing a blocker for it
     // would be a builder routing their own rejected work to an override queue.
+    //
+    // Still set, and still needed: since task 1004011 this close reaches the archon
+    // gate only when the builder ALSO passed --skip-grade, or the server bypassed
+    // the grader for them. Those are the cases where the escalation split still
+    // decides which refusal is printed.
     noArtifactClose = true;
-    console.log('--allow-empty: no committed diff (no-artifact / DB-only ship) — confirming directly without the subagent grader.');
+    console.log('--allow-empty: no committed diff (no-artifact / DB-only ship).');
+    if (noArtifactGrade) {
+      console.log('  The grader is not skipped — it is re-pointed: your handoff notes and value summary are graded');
+      console.log('  against the task description, so the claim that nothing was needed is what gets checked (task 1004011).');
+    } else {
+      console.log('  The grader is skipped (--skip-grade / server bypass), so the claim is NOT checked — this close');
+      console.log('  routes to the archon confirm gate. Drop --skip-grade to have your notes graded instead.');
+    }
   }
 
   // ---- Module drift check (BV1.R53, task 1422) ----
@@ -411,10 +445,15 @@ async function shipMain() {
   if (!skipGrade) {
     const tFetch = await (await cliClient()).tasks.getTasksId({ id: taskId });
     fullTaskForGrade = tFetch.ok ? tFetch.data.task : { id: taskId, title: ac.title };
-    console.log('Starting the quality grader panel (overlaps the smoke run — task 1002660)...');
+    console.log(noArtifactGrade
+      ? 'Starting the no-artifact grader over your notes (overlaps the smoke run — task 1002660)...'
+      : 'Starting the quality grader panel (overlaps the smoke run — task 1002660)...');
     gradeCompute = computeGradeResult({
       taskId, task: fullTaskForGrade, summary,
       baseline: graderBaseline, committedFiles,
+      // task 1004011: present ⇒ grade the claim, not the (empty) diff. The notes
+      // are the evidence, so they have to travel with it.
+      noArtifact: noArtifactGrade ? { notes } : null,
     });
     gradeCompute.catch(() => {}); // an abort path must not die on an unhandled rejection
   }
@@ -613,12 +652,16 @@ async function shipMain() {
     gradePassed = true; // by builder fiat, not by grader
   } else if (passed && taskStatus === 'completed') {
     console.log('');
-    console.log('Running subagent quality grader...');
+    console.log(noArtifactGrade
+      ? 'Running the no-artifact grader (subject: your claim that nothing was needed)...'
+      : 'Running subagent quality grader...');
 
     // #513 + #536: the grader reads COMMITTED history (baseline...HEAD), not
     // the working tree. The empty-committed-diff guard now runs earlier — BEFORE
     // the claim is resolved (see above) — so by the time we reach here the diff
-    // is guaranteed non-empty on the grader path. Reuse the baseline + file list
+    // is guaranteed non-empty on the grader path, EXCEPT on the task 1004011
+    // no-artifact species, where it is guaranteed empty and the notes are the
+    // subject instead. Reuse the baseline + file list
     // computed there so we don't diff twice. #678: gradeAndRecord POSTs the
     // result and logs the panel cost — the same unit the --regrade path reuses.
     // task 1002660: the panel computation was started BEFORE the smoke gate
@@ -631,6 +674,10 @@ async function shipMain() {
       baseline: graderBaseline,
       committedFiles,
       precomputed: gradeCompute,
+      // No `noArtifact` here on purpose: `precomputed` is ALWAYS set on this path, and
+      // gradeAndRecord only falls back to computing inline when it is absent. Passing it would be
+      // unreachable by construction — defensive symmetry that reads like a live argument. The
+      // species reaches the grader through gradeCompute above, which was built with it.
     });
 
     if (!gradePost.ok) {

package/scripts/gds/ship-grade-steps.js

@@ -19,7 +19,7 @@ const { plainCardLines } = require('./plain-cards.js');
 // so the grader outage explains itself with the same `claude CLI` verdict doctor
 // gives, and the two can never drift.
 const { preflightChecks } = require('./preflight.js');
-const { computeRawDiffHash, reconstructPanelIssues, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
+const { computeRawDiffHash, reconstructPanelIssues, runNoArtifactGrader, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
 
 // ---------- Shared grade-step helpers (used by shipMain AND regradeMain) ----------
 //
@@ -168,7 +168,41 @@ function buildPriorRoundContext({ storedGrade, responseText = '', interimCommits
 // writes, so shipMain can start it before the smoke gate and overlap the
 // multi-minute panel with smoke + the claim resolve. Returns
 // { kind: 'reuse', currentHash, reusedResult } | { kind: 'fresh', currentHash, gradeResult }.
-async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null }) {
+// `runNoArtifact` / `runDiffGrader` are injection seams, defaulted to the real
+// runners. The routing decision and the diff-hash policy below are the parts worth
+// testing, and BOTH real runners spawn a model — a test that had to spawn one to
+// reach them would be slow, billable and non-deterministic, so it would not be
+// written, so they would not be covered. Both seams exist because the negative case
+// matters as much as the positive one: "an ordinary ship must NOT reach the
+// no-artifact grader" is only assertable if the ordinary path can be reached
+// without paying for a panel. Production passes neither.
+async function computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound = null, noArtifact = null, runNoArtifact = runNoArtifactGrader, runDiffGrader = runSubagentGrader }) {
+  // task 1004011: the no-artifact species. There is no diff, so every step below
+  // this is inapplicable rather than merely empty — the hash is of nothing, the
+  // reuse lookup would match any other empty-diff grade on this task, and the
+  // panel has no subject. Return early with the claim graded instead.
+  //
+  // `noArtifact` carries the notes, because they are the EVIDENCE here and this
+  // function is otherwise handed only the diff-derived inputs.
+  //
+  // `priorRound` is DELIBERATELY not threaded through. It is the delta-aware re-grade
+  // context (task 1002662): the prior round's findings, the builder's response, and
+  // the INTERIM DIFF between the previously graded HEAD and now. On a no-artifact
+  // ship there is no interim diff by construction, and --regrade refuses an empty
+  // diff anyway (task 1003950), so there is no path that reaches here with a
+  // meaningful prior round. Passing it would look like remediation context while
+  // carrying nothing that applies. Named here so the omission reads as a decision.
+  if (noArtifact) {
+    const gradeResult = await runNoArtifact({
+      task, valueSummary: summary, notes: noArtifact.notes,
+    });
+    // currentHash stays null on purpose: diff_hash is the reuse key for a grade
+    // over a diff, and storing a hash of the empty diff would let the NEXT
+    // empty-diff ship of this task reuse THIS grade — a different claim,
+    // different notes, silently inheriting a pass it never earned.
+    return { kind: 'fresh', currentHash: null, gradeResult };
+  }
+
   // Compute the fingerprint of the raw (untruncated) diff so we can compare
   // against any stored grade, independent of the display-truncation cap.
   const currentHash = computeRawDiffHash(baseline);
@@ -205,7 +239,7 @@ async function computeGradeResult({ taskId, task, summary, baseline, committedFi
     }
   }
 
-  const gradeResult = await runSubagentGrader({
+  const gradeResult = await runDiffGrader({
     task,
     valueSummary: summary,
     baseline,
@@ -225,9 +259,13 @@ async function computeGradeResult({ taskId, task, summary, baseline, committedFi
 // (a promise from computeGradeResult, task 1002660) lets the ship path hand in
 // the overlapped computation; the --regrade path passes nothing and computes
 // inline — behavior identical to the pre-split gradeAndRecord either way.
-async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null }) {
+async function gradeAndRecord({ taskId, task, summary, baseline, committedFiles, priorRound = null, precomputed = null, noArtifact = null }) {
+  // task 1004011: forwarded so the two entry points cannot diverge. The ship path
+  // hands in `precomputed` (the overlapped promise) and never reaches the inline
+  // call; anything computing inline must be able to reach the no-artifact species
+  // too, or the next caller silently grades an empty diff with the panel.
   const computed = await (precomputed
-    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound }));
+    || computeGradeResult({ taskId, task, summary, baseline, committedFiles, priorRound, noArtifact }));
 
   if (computed.kind === 'reuse') {
     const payload = { ...buildGradePayload(computed.reusedResult, committedFiles), diff_hash: computed.currentHash };

package/scripts/gds/ship-grade.js

@@ -344,6 +344,41 @@ async function runSubagentGrader({ task, valueSummary, baseline, changedFiles: p
   return result;
 }
 
+// task 1004011: the no-artifact twin of runSubagentGrader. Same station in the
+// ship, different subject — there is no diff, so the thing graded is the builder's
+// CLAIM that none was needed (modules/grading/grader-no-artifact.js, ADR 0320).
+//
+// WHY a separate runner rather than a flag on the one above: every input that one
+// assembles is diff-derived (changed files, the unified diff, the shortstat, the
+// generated-provenance check, the deterministic route-rank and permission-path
+// pre-passes over the changed files). On an empty diff each of those is an empty
+// set, and an empty set fed to a check that reports "no hits" is a check that
+// passes vacuously — the exact failure mode task 1002646's Guard 1b exists to
+// catch server-side. Threading `if (empty)` through all of them would be a wider
+// change with more places to get that wrong than a sibling that never computes
+// them at all.
+async function runNoArtifactGrader({ task, valueSummary, notes, runOpts: extraOpts = {} }) {
+  const builderModel = resolveBuilderModel();
+  const graderModel = grader.selectGraderModel({ builderModel });
+  const runOpts = {
+    timeoutMs: GRADER_TIMEOUT_MS,
+    cwd: process.cwd(), // grade from the FEATURE worktree — the Read tool is the only evidence check here
+    ...extraOpts,
+  };
+  console.log(`  subagent grader ${grader.VERSION}: NO-ARTIFACT grade (empty committed diff) — one generalist shot over the handoff notes + value summary, model=${graderModel}`);
+  console.log(`  subject: the CLAIM that nothing was needed, judged against the task description — not a diff, and not the absence of one`);
+  console.log(`  gate: unchanged — functional_fidelity>=${grader.THRESHOLD} AND code_quality>=${grader.THRESHOLD} AND confidence>=0.4, re-asked for this species (is it genuinely artifact-free / is the evidence checkable)`);
+  const t0 = Date.now();
+  const result = await grader.gradeNoArtifact({ task, valueSummary, notes, builderModel, runOpts });
+  result.signals = {
+    ...(result.signals || {}),
+    wall_ms: Date.now() - t0,
+    changed_files_count: 0,
+    graded_head_sha: gitOk('git rev-parse HEAD') || null,
+  };
+  return result;
+}
+
 function runSmoke() {
   // `cwd: REPO_ROOT` + a relative script path is robust to spaces or other
   // shell metacharacters that may appear in the absolute repo path on some
@@ -376,6 +411,7 @@ module.exports = {
   diffHash,
   reconstructPanelIssues,
   resolveBaseRef,
+  runNoArtifactGrader,
   runSmoke,
   runSmokeAsync,
   runSubagentGrader,

package/src/bongos/routes/me.js

@@ -119,7 +119,15 @@ const discordIsLinked = (builderId) =>
 // COSMETIC ONLY (ADR 0016). This decides who is OFFERED a link. The page gate
 // (auth.js PAGE_GATES) and each data route's requirePermission are the wall, and
 // they run regardless of what this says.
-const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast']);
+// `core.pin.move` (task 1004118). The core-update banner in shell.js gates on it,
+// and task 1004045 shipped that gate WITHOUT adding the atom here — so the value was
+// `undefined` for every builder, the guard always bailed, and the banner could not
+// render for anyone, on any instance. The authority was never the problem: the same
+// account that saw no banner is answered 200 by a `core.pin.move`-gated route. Only
+// this projection omitted it. Adding an atom here is the deliberate act this comment
+// already described; tests/nav_permission_atoms.mjs now fails if shell.js gates on
+// one that is missing, so the act cannot be skipped again.
+const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast', 'core.pin.move']);
 
 // navPermissionsFor(builderId) → { '<atom>': boolean } over NAV_PERMISSION_ATOMS,
 // or null when authority could not be established (government off, port missing,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.919'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.921'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_update_banner.mjs

@@ -306,3 +306,31 @@ test('the banner is asked for ONCE, not on every access settle', async () => {
   const first = b.requested.filter((r) => r.endsWith('/core-update')).length;
   assert.equal(first, 1);
 });
+
+// ── the chain, with the map the SERVER would really send (task 1004118) ───────
+//
+// Every case above hands applyAccess a permissions map written here. That is exactly
+// how task 1004045's banner shipped dead: it gated on `core.pin.move`, /me resolved
+// only NAV_PERMISSION_ATOMS, the atom was not in it, and the guard bailed for every
+// builder on every instance — while this suite stayed green throughout.
+//
+// So this case does NOT write the map. It DERIVES it from me.js's own declaration,
+// the way the server does, and grants everything in it. If the atom the banner needs
+// is not part of that projection, there is nothing here to grant and the banner
+// cannot render — which is the real bug, reproduced as a failure.
+test('the banner renders from the projection /me ACTUALLY sends, not one written by this test', async () => {
+  const meSrc = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/me.js'), 'utf8');
+  const m = meSrc.match(/NAV_PERMISSION_ATOMS = Object\.freeze\(\[([^\]]*)\]\)/);
+  assert.ok(m, 'NAV_PERMISSION_ATOMS is readable');
+  const atoms = m[1].split(',').map((x) => x.trim().replace(/^'|'$/g, '')).filter(Boolean);
+  // A builder who holds everything the projection can report — the most generous real
+  // answer the server is capable of giving.
+  const permissions = Object.fromEntries(atoms.map((a) => [a, true]));
+  const b = boot({ permissions, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.ok(
+    b.banner(),
+    'the banner did not render for a builder holding EVERY atom /me can report — so the atom it ' +
+    'gates on is outside NAV_PERMISSION_ATOMS and the feature is dead for everyone (task 1004118)',
+  );
+});

package/tests/git_merge_regen.mjs

@@ -57,6 +57,38 @@ const AC = require('../scripts/gds/gen-api-client.js'); // task 1003537 — the
 
 const MARKERS = /^(<{7}|={7}|>{7})/m;
 
+// driverConfigValue — the ONE spelling of `merge.otb-regen.driver` these fixtures install
+// (task 1004112). Three call sites built it by hand, which is how half a fix stayed half a fix.
+//
+// Two separate ways this string is mangled before node sees it, and `git config` is responsible
+// for only one — the value is a COMMAND LINE, parsed by a shell:
+//
+//   1. BACKSLASHES. `git config` strips them from the value, so a win32 path.join() path arrives
+//      as `C:Users…` — drive-relative, which node resolves against the merging repo's cwd, i.e.
+//      the scratch dir. That is the `Cannot find module 'C:\…\Temp\otb-gitmerge-*\Users…'` shape
+//      in docs/recipes/windows-builders.md. Fixed by task 1003546's forward slashes, kept here.
+//
+//   2. SPACES — NOT previously handled, and the reason this fixture reds on some Windows boxes and
+//      passes on others. Unquoted, `node C:/Users/Some Name/repo/scripts/…` splits at the space
+//      and node is handed a truncated path. Fully DETERMINISTIC for any builder whose checkout
+//      path contains a space, and invisible to every builder whose path does not — which is why
+//      windows-builders.md recorded the symptom as "seen once, then not reproducing in any of
+//      three trees" and warned against baselining it. Three trees on three space-free paths agree
+//      with each other and say nothing about a fourth.
+//      Verified both ways in a scratch repo: unquoted → merge exit 1, `Auto-merging …`,
+//      MODULE_NOT_FOUND; quoted → exit 0 and the driver heals the file.
+//
+// The quotes are the fix. The forward slashes stay, because git config still eats backslashes
+// inside them.
+function driverConfigValue(driverPath) {
+  // The quoting is only as good as what it cannot be closed by. These paths are always
+  // locally-generated os.tmpdir() fixtures, never attacker-influenced — but a helper whose whole
+  // job is "survive a hostile-looking path" should not itself break on one, and the next caller
+  // will not re-derive that the input is trusted. `"` is the one character that ends the quote.
+  const quoted = driverPath.replace(/\\/g, '/').replace(/"/g, '\\"');
+  return `node "${quoted}" %O %A %B %P`;
+}
+
 // ── 1) docs/repo-map.md regenerates clean, ignoring the conflicted sides ────────
 {
   const r = regen.regenerateResolved('docs/repo-map.md', {
@@ -215,7 +247,7 @@ function withBlockBody(src, body) {
     // Forward slashes: `git config` strips backslashes from the value, so a win32
     // path.join() driver path reaches node with its separators gone and the driver
     // never loads — this fixture was silently dead on Windows (task 1003546).
-    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
+    g('config', 'merge.otb-regen.driver', driverConfigValue(driver));
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/repo-map.md merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeMap('base\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -237,6 +269,58 @@ function withBlockBody(src, body) {
   }
 }
 
+// ── 6b) the driver config survives a path with SPACES (task 1004112) ──────────────
+//
+// Case 6 above only proves the driver loads from THIS builder's checkout path. On a path with no
+// space it passes whether or not the value is quoted — which is exactly how the quoting stayed
+// missing while three trees agreed the fixture was fine.
+//
+// So assert the property directly, on a path this box may not have: point the driver at a
+// directory whose name contains a space and run a real merge through it. The scratch repo is ours,
+// so the space is guaranteed wherever the repo itself lives.
+//
+// NB this is a bare block, like every other case in this file — written as a `function` it would
+// be defined, never called, and permanently green over nothing.
+{
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-gitmerge-spaced-'));
+  try {
+    const spaced = path.join(tmp, 'a dir with spaces');
+    fs.mkdirSync(spaced);
+    // A stand-in driver: this case is about the ARGV plumbing reaching a driver at all, not about
+    // what the real one decides. Using the real one would re-test case 6.
+    const drv = path.join(spaced, 'driver.js');
+    fs.writeFileSync(drv, 'require("fs").writeFileSync(process.argv[3], "HEALED\\n");\n');
+
+    const work = path.join(tmp, 'repo');
+    fs.mkdirSync(work);
+    const g = (...a) => spawnSync('git', a, { cwd: work, encoding: 'utf8' });
+    g('init', '-q');
+    g('config', 'user.email', 't@t'); g('config', 'user.name', 't');
+    g('config', 'core.autocrlf', 'false');
+    g('config', 'merge.otb-regen.name', 'regen');
+    g('config', 'merge.otb-regen.driver', driverConfigValue(drv));
+    fs.writeFileSync(path.join(work, '.gitattributes'), 'f.md merge=otb-regen\n');
+
+    const write = (s) => fs.writeFileSync(path.join(work, 'f.md'), s);
+    write('base\n'); g('add', '-A'); g('commit', '-qm', 'base');
+    g('checkout', '-qb', 'feature');
+    write('FEATURE\n'); g('add', '-A'); g('commit', '-qm', 'f');
+    g('checkout', '-q', 'master');
+    if (g('rev-parse', '--verify', 'master').status !== 0) g('checkout', '-q', 'main');
+    write('MASTER\n'); g('add', '-A'); g('commit', '-qm', 'm');
+
+    const merge = g('merge', '--no-edit', 'feature');
+    assert.equal(merge.status, 0,
+      'a driver path containing a space must still resolve — unquoted, the shell splits it and node '
+      + 'is handed a truncated path (MODULE_NOT_FOUND), which is deterministic for any builder whose '
+      + `checkout path has a space. got ${merge.status} :: ${merge.stdout}${merge.stderr}`);
+    assert.equal(fs.readFileSync(path.join(work, 'f.md'), 'utf8'), 'HEALED\n',
+      'the driver must have actually RUN, not merely failed to break the merge');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
 // ── 7) .gitattributes' merge=otb-regen lines and REGENERABLE agree (task 1003543) ─
 // The whole scheme is two hand-maintained lists naming the same files (one in
 // .gitattributes, one in REGENERABLE) — nothing checked that they still matched, so
@@ -320,7 +404,7 @@ function withBlockBody(src, body) {
     // Forward slashes: `git config` strips backslashes from the value, so a win32
     // path.join() driver path reaches node with its separators gone and the driver
     // never loads — this fixture was silently dead on Windows (task 1003546).
-    g('config', 'merge.otb-regen.driver', `node ${driver.replace(/\\/g, '/')} %O %A %B %P`);
+    g('config', 'merge.otb-regen.driver', driverConfigValue(driver));
     fs.writeFileSync(path.join(tmp, '.gitattributes'), 'docs/copy-registry.json merge=otb-regen\n');
     fs.mkdirSync(path.join(tmp, 'docs'));
     writeReg('{"schema":0}\n'); g('add', '-A'); g('commit', '-qm', 'base');
@@ -386,7 +470,7 @@ function withBlockBody(src, body) {
       g('config', 'core.autocrlf', 'false');
       g('config', 'merge.otb-regen.name', 'regen');
       g('config', 'merge.otb-regen.driver',
-        `node ${path.join(work, 'scripts/gds/git-merge-regen.js').replace(/\\/g, '/')} %O %A %B %P`);
+        driverConfigValue(path.join(work, 'scripts/gds/git-merge-regen.js')));
 
       if (!fs.existsSync(scannedFile())) skip = `${SCANNED} is gone — repoint this fixture at another scanned surface`;
       else if (fs.readFileSync(scannedFile(), 'utf8').split('\n').length < 420) skip = `${SCANNED} is too short for two distant edits`;