@bongos/core 1.19.944 → 1.19.946

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.944",
-  "core_contract": "1.19.944",
-  "source_commit": "9bb024296de8bc08497922c176fac32f1cbd4072",
+  "core_version": "1.19.946",
+  "core_contract": "1.19.946",
+  "source_commit": "427f912951779422ac61981f8d918086a2f0cc65",
   "source_ref": "HEAD",
-  "built_at": "2026-09-21T22:56:15.068Z",
+  "built_at": "2026-09-21T23:49:20.517Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 511,
+    "docs_redacted": 512,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2340,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2877,
-  "tree_sha256": "0ba58d1da09b858f4ba434ece27993e6d514cbb7622e15d3987343c832c6710e",
+  "file_count": 2878,
+  "tree_sha256": "3a0e9a1d401c4698c1d6c8fd6a429f0f65a2beabf547c47a910f336148776ac6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1027,7 +1027,7 @@
     {
       "path": "docs/adr/0111-instance-hosting-provisioning-module.md",
       "mode": "0000644",
-      "sha256": "a0da85222fe36f16d16b1f52a7d1e50b5aa794942cee6dfa5a69ab53300e6f6e"
+      "sha256": "d216d4cfb0f269afa00af7963b3fe16d97596a6407b26859c7fd3126c7fc518c"
     },
     {
       "path": "docs/adr/0112-private-goals-invitations-join-requests.md",
@@ -1192,7 +1192,7 @@
     {
       "path": "docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md",
       "mode": "0000644",
-      "sha256": "02a9ba781c3db1c78b7aff23a3d7feb9fcca80bd49c291891af635d88288126f"
+      "sha256": "74f14a90b88d585a4b50247a7dd54a01accc229e7f64a875c9491612e3d0dd3c"
     },
     {
       "path": "docs/adr/0146-configurable-reward-mode-cost-plus-only.md",
@@ -1917,7 +1917,7 @@
     {
       "path": "docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md",
       "mode": "0000644",
-      "sha256": "7ccc21098aaaf80df6d07d7fa31199b9283a26e522d55ee7a9e472987721d097"
+      "sha256": "4e1631b94e83af33a8ea9ebf51657e0a5fcb0b9da30a41d443e7caa8f6b3c35b"
     },
     {
       "path": "docs/adr/0286-a-gated-project-s-manifest-tells-a-stranger-how-to-sign-in-and-nothing-else.md",
@@ -2104,10 +2104,15 @@
       "mode": "0000644",
       "sha256": "6a4ad58720701e760068d5ce1761733790beef0a142aa31a08782d029cc7a390"
     },
+    {
+      "path": "docs/adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md",
+      "mode": "0000644",
+      "sha256": "8fa6ef943e3fc0855d15f83baefaabf810994b80da2ecdbbcc28d752ed0498f3"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "7c66ecbd1940f3cdd830f0fb4acf65c41178807a431bb8fab382e4b8a0dbc8ae"
+      "sha256": "eef598f074ff3e22a4748b9092eb83d04235205c34e66db6bbe76547f050843d"
     },
     {
       "path": "docs/api-reference.md",
@@ -2677,7 +2682,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "fd85af374ab5c378414a246c9575a5254fb720e1c9ba0792093c96ebdd07b1f7"
+      "sha256": "3be3dcca6eabd22bc94ad8c59edb8fcc56bc14cf46cbd6d315807b2247d5a636"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8002,12 +8007,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "915c0d9eda15ebe2198dff6cbc476e11b5ef5c286b3bcd5cb47aed9f7eba3599"
+      "sha256": "d9bcde780bfceb4b3f8c2c818db7552a5b21cd0280e123f35a81f71032234e8f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9174d7da67f1bce8d88d2e2ef0da7c656910d53c955040d3a9f74e8b0dede5f6"
+      "sha256": "289ec4343c26cd76b78320bdacd76382bfd5e4ef75670c307ff9fb400e866de3"
     },
     {
       "path": "public-docs/index.html",
@@ -8592,7 +8597,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "b05634f4916387ed35b33774e8b27176a1d3ce14c8ea6cb98485f289395afc6b"
+      "sha256": "35e377253453c975ce7a8e420d72af718a4f8ab6d3837d39fd38c1ebd5658ddc"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9122,7 +9127,7 @@
     {
       "path": "scripts/gds/scope-map-guard.js",
       "mode": "0000644",
-      "sha256": "75f0791698a36e48ec232d2285e6f80dac6d64c2a23a23a26cd54c1c05883c3b"
+      "sha256": "39554a1c45f9d4c507df8d782cf2d928adae312110ba9a057421354d5999dc69"
     },
     {
       "path": "scripts/gds/seam-wiring-guard.js",
@@ -9817,7 +9822,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "b5ee44e89d9686d1fc297dfd9952d3614edfe7f4a4cd18c264d9b4d68adb2629"
+      "sha256": "36da288c8087ebd653c0b208a02414ea55d09da53df22cb4fc3d281941756ec7"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10012,7 +10017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ff95cfa479f2e1c5d4b9598d832a43743122b621338de3f5e902289d00e379d8"
+      "sha256": "4301e3d88d415bed2d9146b4bd1749be2341355554f78e441793ebca16d9e24a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13467,7 +13472,7 @@
     {
       "path": "tests/scope_map_guard.mjs",
       "mode": "0000644",
-      "sha256": "278e334a945d151c225d849b51464a3dffc8f0bb0dcb1d39b72d12bae57efd4f"
+      "sha256": "9722a12a61597d86f033d3f3a8cd93a7e99c701da54f79c8f6ac49afdea62ad3"
     },
     {
       "path": "tests/scouting_owner_access_and_reach.mjs",

package/docs/adr/0111-instance-hosting-provisioning-module.md

@@ -1,6 +1,7 @@
 # ADR 0111 — Instance hosting + domains as a Cloud Bongos module: the `provisioning` module boundary + the self-host / managed split
 
-- **Status:** Accepted (boundary + split decided with the owner; build is task-pending — see §Consequences for the seeded tasks)
+- **Status:** Accepted, **superseded in part by [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21) — the module boundary and the enqueue-only trust boundary STAND; the DigitalOcean droplet and `co-tenant` shapes it provisions do not. Customer projects move to a managed platform; DigitalOcean hosts hubs only.
+- **Status (original):** Accepted (boundary + split decided with the owner; build is task-pending — see §Consequences for the seeded tasks)
 - **Date:** 2026-07-03
 - **Track:** internal (a portable Cloud Bongos platform capability)
 - **Task:** [#1485](https://example.com/builders#/task/1485) (BONGOS-V1, goal 26 — *Cloud Bongos productization and self-host*) — "spec the module boundary + the self-host vs managed split **before** tasking."

package/docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md

@@ -1,5 +1,6 @@
 # 0145 — A free "own-repo" hosted project tier needs domain separation + per-project isolation (not a bare cloudbongos.com subdomain)
 
+- **Status:** **Superseded in part by [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21). Three of this ADR's decisions are replaced: the free tier becomes a **capped trial**, not all-free; customer projects leave the shared box for a managed platform, so **container isolation on our own box is no longer the plan**; and **Finding 1 is closed by removing its precondition** — with no customer code on a `cloudbongos.com` subdomain there is no tenant to receive the hub session cookie, so the sign-in hardening in the build sequence below is no longer a blocking prerequisite (it remains worth doing on its own merits). The two security FINDINGS below stand as analysis and are the reason the new direction is safe.
 - **Status:** Accepted — owner decided 2026-07-15: **keep `cloudbongos.com`** (no separate domain), **container** isolation, **all-free** for now. Choosing the literal same domain makes hardening core sign-in a required prerequisite (see "Decisions" + "Required build sequence"). Build unblocked ([task 1002251](https://cloudbongos.com/builders#/task/1002251)); blocker 1000080 resolved.
 - **Date:** 2026-07-15
 - **Deciders:** Lars (owner/Archon) chose the direction after a security review; Claude ran the review + designed.

package/docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md

@@ -1,6 +1,6 @@
 # ADR 0285 — A shared box holds about twelve projects per GB, and memory is the wall
 
-- **Status:** accepted
+- **Status:** accepted; **no longer load-bearing as of [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21). The measurements below are correct and still describe the box — it simply stops holding customer projects, so the ceiling no longer gates project creation and the queued resize ([task 1003923](https://cloudbongos.com/builders#/task/1003923)) is held rather than spent.
 - **Date:** 2026-09-15
 - **Task:** [1003877](https://cloudbongos.com/builders#/task/1003877) (goal 1000106), a spike. Informs [1003923](https://cloudbongos.com/builders#/task/1003923) (the resize) and [1001949](https://cloudbongos.com/builders#/task/1001949) (managed billing).
 

package/docs/adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md

@@ -0,0 +1,96 @@
+# ADR 0323 — Hosting is three shapes, and we are not the landlord
+
+- **Status:** accepted
+- **Date:** 2026-09-21
+- **Task:** [task 1004140](https://cloudbongos.com/builders#/task/1004140) (goal 1000106 — working area 1, Project creation)
+- **Deciders:** Lars (Archon) — every numbered decision below is the owner's; Claude ran the audit and the platform comparison.
+- **Gates:** [task 1004141](https://cloudbongos.com/builders#/task/1004141) (the rename) · [task 1004142](https://cloudbongos.com/builders#/task/1004142) (the migration) · [task 1004062](https://cloudbongos.com/builders#/task/1004062) (the env manifest)
+- **Supersedes in part:** [ADR 0111](0111-instance-hosting-provisioning-module.md) · [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) · [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md)
+- **Related:** [ADR 0002](0002-digitalocean-over-hetzner.md) (why DigitalOcean) · [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) (the pull this ADR makes load-bearing for `byo-host`) · [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) (the seam whose second implementation this makes unnecessary)
+
+## Context
+
+Five active projects run as `hosting_shape='standalone'` on one `s-1vcpu-2gb` DigitalOcean droplet, beside the control plane itself. Each is a Node process and a Postgres database, about 80 MB warm; the box holds fifteen ([ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md)) at roughly $0.80 per project per month. It is the cheapest arrangement available, and standing it up cost us `scripts/gds/provision*.js` — about 4,600 lines that write systemd units, create unix accounts, render Caddy snippets, run `createdb`, install per-instance backup timers, and count memory against a ceiling.
+
+That is the cost nobody priced: we are a landlord. Every one of those legs is infrastructure we maintain so that someone else's code can run on our machine.
+
+Three further facts made the arrangement worse than its price suggested:
+
+- **Customer code sits on our hub's registrable domain.** [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 established that the hub's session cookie, scoped `.cloudbongos.com`, is sent by the browser to every `*.cloudbongos.com` host — including a tenant's. It required the sign-in hardening to land *before* any tenant went on a subdomain. Two tenants are on subdomains today, one of them not the platform owner's, and the hardening has not shipped.
+- **`dedicated` was written and never used.** A per-project droplet is 15–20× the shared cost, and no project has ever run on one.
+- **The self-host container path kept finding new floors.** [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) made supervision a seam and named three remaining blockers; two shipped, and each existed only because we were building a container host of our own.
+
+The owner's direction, settled over 2026-09-20/21, reframed the question. The platform should not host other people's applications at all: it should build on what others maintain, and let the owner keep the deployment platform they already use.
+
+## Decision
+
+### 1. Three owner-facing shapes
+
+| Shape | Meaning |
+|---|---|
+| `byo-host` | The owner runs the instance: their machine, their VPS, their own platform account. **New.** |
+| `cloud-host` | We stand it up for them on a managed platform. Rename of `standalone`. |
+| `dedicated-cloud-host` | The same path on a larger plan. Rename of `dedicated`. |
+
+`control-plane` is unchanged and stays unrequestable — it is the hub, not a product option.
+
+**`co-tenant` is retired, not renamed.** It means *a process on our box, from our checkout* — the most platform-owned shape there is, and the exact opposite of bring-your-own-host. Reusing the name would make every existing comment and ADR reference lie. One row carries it and it is `torn_down`.
+
+`dedicated-cloud-host` is a **plan size, not a second code path**. The DigitalOcean droplet and cloud-init implementation that sat behind `dedicated` becomes dead code.
+
+### 2. DigitalOcean hosts hubs only
+
+No customer project is deployed to it. The control plane stays where it is; the projects leave.
+
+This closes [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 by removing its precondition rather than by hardening the cookie: with no customer code on a `cloudbongos.com` subdomain, there is no tenant to receive the hub session. The cookie hardening remains worth doing on its own merits and is no longer load-bearing.
+
+### 3. Render is the default platform for a `cloud-host`
+
+Render's Postgres carries point-in-time recovery and automated backups on every paid tier. Roughly $14 per project per month (web service plus database).
+
+Rejected: **Fly.io**, whose managed Postgres starts around $38/mo — the compute is cheaper and the database is not. **Railway**, whose Postgres templates are explicitly unmanaged: you tune and back them up, which is precisely the responsibility this decision exists to shed.
+
+### 4. Cloudflare is the front door, not the compute
+
+DNS, TLS, and — when `byo-host` needs to reach a machine behind a router — Tunnels, for which a working client already exists at `scripts/gds/cf-tunnel.js`.
+
+**Not the hall's runtime.** Cloudflare Workers is a V8-isolate runtime, not Node; Express and `pg` would have to be rewritten. Cloudflare Containers is built for bursty workloads that sleep between requests, and the hall runs background sweeps and a live event stream that do not survive sleeping. Its Postgres would be external in either case.
+
+### 5. Bongos does not integrate with the customer's deployment platform
+
+Their application already deploys itself: Vercel and Netlify watch the repository. Bongos writes code and pushes it. There is no adapter layer, and an adapter layer would solve a problem that does not exist.
+
+This is what makes "bring your preferred platform" nearly free to support. The platform we do not talk to is the platform we do not have to add.
+
+### 6. The deployment platform is the system of record for secrets; Bongos stores names, never values
+
+A project declares its environment variables to Bongos as a **manifest** — name, purpose, environment, required or optional — so a builder writing code knows what the surface is. The values live where the running application reads them, in a store that already encrypts, audits and rotates them.
+
+Bongos holds no application secret, no platform API token, and runs no "is it set?" probe. Adding any of those makes the platform the custodian of other companies' credentials, which is the responsibility this ADR is spending its whole budget to avoid. See [task 1004062](https://cloudbongos.com/builders#/task/1004062).
+
+For `byo-host` there is no platform to ask, and the manifest is simply marked unverifiable. That keeps *Bongos holds no values* true everywhere, with no exception to reason about later.
+
+### 7. The free tier is a capped trial
+
+At ~$14 per project, an indefinite subsidised free tier is not viable. This replaces [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md)'s "all-free for now". Implementing the cap is its own task; it cannot be metered before the migration.
+
+## Consequences
+
+- **This wave is mostly a deletion.** Systemd units, per-instance unix accounts, Caddy snippets, `createdb`, backup timers and the capacity ceiling are things Render provides. Not all of `provision*.js` goes — the repository scaffold, the GitHub App manifest handshake and the core-upgrade path serve the hub and the `byo-host` scaffold too. The migration task removes what is genuinely orphaned, after the projects have moved, and not before.
+
+- **Per-project cost rises about 17×, from $0.80 to ~$14.** That is the price of not being a landlord, and it is why decision 7 exists. It also makes metering ([task 1001949](https://cloudbongos.com/builders#/task/1001949)) and the spend rollup ([task 1001621](https://cloudbongos.com/builders#/task/1001621)) real work rather than deferred work.
+
+- **[ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) stays true and stops being load-bearing.** Its measurements were correct and its ceiling still describes the box; the box just stops holding projects. The queued resize to 2 vCPU / 4 GB is therefore **not** to be spent ([task 1003923](https://cloudbongos.com/builders#/task/1003923), held).
+
+- **[ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)'s seam is not extended.** It correctly said it was "two implementations wide, not N". Render supervises its own processes, so the seam neither grows a third backend nor needs one.
+
+- **The hub becomes the single point of failure it always was, now visibly.** With projects elsewhere, everything that can be lost with the droplet is the control plane's own database — which makes offsite backups ([task 1002214](https://cloudbongos.com/builders#/task/1002214)) the highest-consequence open item in the goal.
+
+- **`byo-host` starts cheap and stays honest.** It reuses the pull that already exists ([ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md)): the owner supplies an origin and the hub reads the instance's own public manifest. Nothing is pushed to it, so it is excluded from the settings-apply and restart paths for the same reason `dedicated` was.
+
+## Alternatives considered
+
+- **Move to AWS or GCP.** Rejected. Their pricing is earned by consuming their managed services; a bare Linux instance from either is 2–3× DigitalOcean for the same memory, plus a console, an IAM model and a billing surface to learn. It adds maintenance where the goal is to remove it.
+- **Keep the shared box and fix the cookie instead.** Cheaper, and it closes the security finding. Rejected because it leaves the 4,600-line landlord runner in place and answers none of the other three questions.
+- **Build a deployment-platform adapter layer (Vercel/Netlify/Render).** Rejected as speculative pluggability, the thing [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly warned against. Their applications already deploy themselves.
+- **Bongos as the secrets store, pushing values to each platform via its API.** Rejected: it makes us the custodian of other companies' credentials for convenience that the manifest already delivers.

package/docs/adr/README.md

@@ -414,3 +414,4 @@ This keeps the decision history honest and traceable.
 | 0318 | [**Listing a file for task affinity is not claiming to own it** ([task 1004110](https://cloudbongos.com/builders#/task/1004110), goal 1000095 — BONGOS-V2). The case [ADR 0314](0314-module-protection-is-per-path-not-per-module.md) named and left open, closed by neither of the two routes it predicted. `builder-settings` derived `protected` — Archon-only to scope a goal to — on exactly one glob, `src/bongos/routes/me.js`, caught by the blanket `src/bongos/routes/` prefix. **That glob was never an ownership claim:** `MODULE_GLOBS` listed it for task AFFINITY and said in the same comment that the `GET /me` aggregator stays a thin core facade, and `isProtected()` cannot tell the two apart. **Both predicted routes were measured and rejected.** Narrowing the blanket prefix: all eighteen files under `src/bongos/routes/` are protected by that prefix AND NOTHING ELSE, so narrowing unwalls `auth.js`, `builders.js`, `backup.js` and `core-update.js` together — now pinned as a tripwire test rather than left as a caution. Moving `me.js` into `modules/builder-settings/`: the aggregator resolves TEN module ports (`lifecycle`, `reward`, `onboarding`, `government`, `specialities`, `grade`, `box`, `art` ×2, `discord`) and `builder-settings` is one of them, so hosting it inside one module means resolving nine foreign ports from the inside — the `core -> module` edge [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 forbids. Decision: **ownership follows what the file is** — `me.js` moves to `kernel`, which already owns `src/bongos/routes/security.js`. This is 0314 one step on: owning the command is not owning the authority, and **being listed next to a module is not owning it either**. **Rejected: a general affinity tier** in `MODULE_GLOBS` mirroring `isCommandPath` — the audit does not support it. Three other modules (`kernel`, `devsecops`, `methodology`) are also protected only by paths outside their own directory, but in each the foreign path genuinely IS the domain; `builder-settings` was the only module protected by a path its own source called core, so a new tier would be a new place for a hole to hide, built for a population of one. `protectedModules()` goes 9 -> 8. **The wall that matters does not move:** a sub-Metic builder touching `/me` is still refused by `checkPermissionPaths`, asserted directly rather than assumed. The sixteen still-unowned route files remain [task 1004116](https://cloudbongos.com/builders#/task/1004116), whose option (a) this de-risks.](0318-listing-a-file-for-task-affinity-is-not-owning-it.md) | permissions / module scope |
 | 0321 | [**Brightness is a payout-weighted share, and a removal's targets are rows** ([task 1004099](https://cloudbongos.com/builders#/task/1004099), goal 1000095 — BONGOS-V2). Size is an idea's total ideator payout and never falls; brightness is how much of that work is still alive, and the pair is what lets a thought whose version was torn out draw LARGE AND DARK rather than merging with one that never mattered. Two things had to be settled. **The removal facts were stored in the wrong direction**: [ADR 0319](0319-a-removal-verdict-is-a-row-beside-the-question.md) gave a confirmed removal a row carrying the verdict and `ship_task_id` — the task whose merge DELETED the files — and deliberately left out the tasks whose work was removed, saying brightness would design its own storage when it needed one. Those are different rows under different ideas, so reading one as the other dims the wrong star while looking like a working query. `<redacted>` stores `(proposal_task_id, removed_task_id, paths)` at PROPOSAL time, from the SAME derivation objects the proposal body renders as prose — one derivation, two renderings, so they cannot disagree and `removal-proposals.js` keeps its refusal to parse a body back. Proposal time and not verdict time because the attribution comes from capped, rate-limited GitHub commit-history reads that only exist while the cascade runs. NOT a runner fan-out ([ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md)): the rule still files one task; this records a side fact about it. `ON CONFLICT DO NOTHING`, never `DO UPDATE`, since a degraded second walk finds FEWER paths and must not erase a good first read — and the writer runs on the cascade's SKIPPED row too, so a re-ship repairs what a derivation outage missed. **The share is weighted by PAYOUT, not by task count**, or deleting a one-line fix dims a star as hard as deleting the feature; weighting by what each hop earned also makes 'large and dead' exact, and makes the two channels a share of ONE number rather than two unrelated measurements. Basis is paid + estimated to match size, which required `priceDescentForIdea`/`ideaSizes` to return a per-task `byTask` summing EXACTLY to `credits` — including ledger payments for tasks the descent no longer reaches, which `idea-size.js` keeps in `credits` so size cannot fall and which would otherwise make the parts sum to less than the whole. Three edges, each silent: an idea that earned nothing is `share: 1, hasWork: false`, because zero over zero is not zero and a protostar is not a remnant (the BV2.R19 distinction); an unreadable removal port gives `share: null, attributable: false`, because 'could not look' is not 'nothing was removed'; and a CONFIRMED removal naming no target dims nothing at all — brightness cannot know which idea — so `countUnattributedConfirmed()` exists to say the gap out loud instead of quietly brightening the sky. Brightness lives in `economy` beside size and reaches lifecycle through the new `lifecycle.removals` port, resolved OPTIONALLY and NOT declared in `consumes` (declaring it would turn 'lifecycle off' into 'instance will not start' — the `ideas.descent` precedent). **No credit is clawed back and nothing here writes**: ADR 0313 stands, `shipped` is terminal, only the picture changes. Rejected: parsing the proposal body (ADR 0319 already refused it — a human-facing line shape fails silently when reworded); re-deriving at verdict time; treating `ship_task_id` as the removed task; counting tasks rather than payouts; clamping the share at the top, which would hide the anomaly it claims to prevent.](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md) | ideas / economy |
 | 0322 | [**The five states are derived once, and a remnant needs evidence** ([task 1004103](https://cloudbongos.com/builders#/task/1004103), goal 1000095 — BONGOS-V2). The ideator surface draws a thought as one of five objects — star, protostar, satellite, remnant, cold body — and three surfaces are about to draw them (the room, the descent, the sky). Every fact already existed: `idea_inbox.status` (`core_195`), [ADR 0321](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md)’s `hasWork` / `share` / `attributable`, and `tasks.goal_id` + `tasks.status`. What was missing was ONE place that reads them: a state inferred in three renderers is three states, and the sky can say a thought went out while the room beside it still calls it alive, with nothing erroring. **Decision:** one pure resolver (`modules/ideas/idea-state.js`), brightness exposed on the `reward` port (ideas may not reach `credit_log` any other way — [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 — and already declares `reward` in `consumes`), and the ORDER of the tests IS the decision. **MERGED wins over everything:** a folded thought keeps its own money (`trail-size.js` is emphatic) but is no longer its own point in the sky, so letting work win draws one idea twice, beside the thought that absorbed it. **WORK beats a DISCARD:** a cold body “never ignited, so it has no size at all” is a stated PROPERTY, and testing work first makes it true by construction — triage really can discard a duplicate whose twin already routed and paid, and `updateIdea` never touches the ledger. **A REMNANT needs EVIDENCE, never the absence of an answer:** `share: 0` is a confirmed removal, `share: null` is an unreadable one, and ADR 0321 pays for that distinction upstream — so an idea with work and no readable facts is a STAR carrying `attributable: false`, because reading a falsy share as death turns one unmounted module into a sky of hollow rings. **A PROTOSTAR is the absence of WORK, not of a status:** ignition is being PAID for something, so a promoted-but-unshipped idea is still unignited, which is exactly what the nod queue exists for. **Position is a second axis** (`well` / `open-space` / `awaitingNod`) because the design says the object alone cannot carry it, and the nod is asked of EVERY task, not only the one that named the well. **`suggested_goal_id` is deliberately NOT a well** — `projection.js` records it as strictly advisory, the routing hint on a filing that did not convert, so reading it would put a thought in a nod queue with no task to promote; the binding `tasks.goal_id` now rides on both of the trail’s task joins at no extra round trip. The page reads the ledger ONCE: the state attach hands economy back the `byTask` breakdown size just computed, all of them or none (a partial map reads a missing entry as “no work” and draws a paid star as a protostar). An absent `reward` port does not empty the sky — states still resolve, flagged unattributable. Nothing writes; ADR 0313 stands. Rejected: resolving in each renderer; deriving from `share` alone (it merges a protostar with a remnant, the exact BV2.R19 distinction); treating an unreadable share as zero; status-first ordering; reading the hint as a home; a sixth object for “unknown brightness” (the vocabulary is the owner’s and is five — the uncertainty is a flag on the answer, not a new thing in the sky).](0322-a-remnant-needs-evidence-and-merged-wins.md) | ideas / economy |
+| 0323 | [**Hosting is three shapes, and we are not the landlord** ([task 1004140](https://cloudbongos.com/builders#/task/1004140), goal 1000106 — BONGOS-V2). Five projects ran as one Node process each on the control-plane droplet, about $0.80/month apiece — the cheapest arrangement available, bought with ~4,600 lines of `provision*.js` that write systemd units, create unix accounts, render Caddy snippets, `createdb`, install backup timers and count memory against a ceiling. That is the cost nobody priced: **we are a landlord.** The owner reframed the question — build on what others maintain, and let an owner keep the deployment platform they already use. **Seven decisions.** The shapes become `byo-host` (the owner runs it), `cloud-host` (we stand it up for them) and `dedicated-cloud-host` (the same path, larger plan); `co-tenant` is **retired, not renamed**, because it means *a process on our box from our checkout* — the opposite of bring-your-own-host, so reusing the name would make every existing comment lie. **DigitalOcean hosts hubs only**, which closes [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 by removing its precondition rather than hardening the cookie: with no customer code on a `cloudbongos.com` subdomain there is no tenant to receive the hub session. **Render is the default** — its Postgres carries PITR and automated backups on every paid tier; Fly's managed Postgres starts ~$38/mo and Railway's is explicitly unmanaged, which is the exact responsibility being shed. **Cloudflare is the front door, not the compute**: Workers is a V8-isolate runtime that would require rewriting Express and `pg`, and Containers is built for bursty workloads that sleep, which a hall with background sweeps and a live event stream does not survive. **No deployment-platform adapter is built at all** — their application already deploys itself from the repository, so the platform we do not talk to is the platform we do not have to add. **Secrets: the platform is the system of record and Bongos stores names, never values** — a manifest of name, purpose and environment, no application secret, no platform API token, no "is it set?" probe, because each of those makes us custodian of other companies' credentials for convenience the manifest already delivers; `byo-host` marks the manifest unverifiable rather than opening an exception. **The free tier becomes a capped trial**, since ~$14/project cannot be subsidised indefinitely. Per-project cost rises ~17×, which is the price of not being a landlord and the reason metering stops being deferred work. Mostly a DELETION: [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)'s supervision seam is not extended (Render supervises its own processes), [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) stays true and stops being load-bearing with its queued resize held rather than spent, and the hub's offsite backup becomes the highest-consequence open item. Rejected: AWS/GCP (2–3× the cost for a bare instance, plus an IAM and billing surface to learn — maintenance added where the goal is to remove it); keeping the shared box and fixing only the cookie (cheaper, closes the finding, leaves the landlord runner and answers nothing else); a Vercel/Netlify/Render adapter layer (speculative pluggability); Bongos as the secrets vault pushing values through platform APIs.](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) | hosting / provisioning / cost |

package/docs/module-api-changelog.md

@@ -2362,5 +2362,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.942 with no explicit bump. run 35661533404. (task 1002620)
   1.19.944 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.943 with no explicit bump. run 35665131778. (task 1002620)
+  1.19.945 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.944 with no explicit bump. run 35668642462. (task 1002620)
+  1.19.946 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.945 with no explicit bump. run 35669244197. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.944",
+  "version": "1.19.946",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.944",
+      "version": "1.19.946",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.944",
+  "version": "1.19.946",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1277,7 +1277,7 @@ const CHECKS = [
   // one (ADR 0289). Rationale + the seam→consumer table live in that file.
   require('./seam-wiring-guard.js').checkSeamWiring,
   require('./home-isolation-guard.js').checkHomeIsolation, // Check 34 — task 1003763: a test that sets HOME for a child without USERPROFILE isolates NOTHING on win32, so it silently stops testing what its comment says. Three tasks fixed this one site at a time. Rationale in that file.
-  require('./scope-map-guard.js').checkDevsecopsOwnsItsChecks, // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Rationale in that file.
+  ...['checkDevsecopsOwnsItsChecks', 'checkEveryModuleDirIsScoped', 'checkNoNewUnownedRoot'].map((k) => require('./scope-map-guard.js')[k]), // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Check 36 — task 1004132: the same defect one level up, a carved module whose own directory no key claims (modules/specialities/ shipped that way). Sharing the line per the ratchet convention above. Rationale in that file.
   require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
 ];
 

package/scripts/gds/scope-map-guard.js

@@ -117,4 +117,184 @@ function checkDevsecopsOwnsItsChecks() {
       + 'unless CI says otherwise (task 1003949).',
   };
 }
-module.exports = { checkDevsecopsOwnsItsChecks, siblingRequires, unownedBy, FITNESS };
+// PURE — every module directory on disk, by key. A module is a modules/<key>/ dir
+// carrying module.json (the ADR 0083 manifest), which is the same structural test
+// the loader's discoverModules() uses: a key is what has a manifest, never a
+// hand-kept roster. Exported so the scan is testable against a fixture tree —
+// an empty result here looks identical to a clean repo, which is the failure the
+// sibling check above exists to refuse.
+function moduleDirsOnDisk(modulesRoot) {
+  let entries = [];
+  try { entries = fs.readdirSync(modulesRoot, { withFileTypes: true }); } catch { return []; }
+  return entries
+    .filter((e) => e.isDirectory() && fs.existsSync(path.join(modulesRoot, e.name, 'module.json')))
+    .map((e) => e.name)
+    .sort();
+}
+
+// A carved module whose own directory no MODULE_SCOPE_MAP key claims (task 1004132).
+//
+// THE DRIFT THIS STOPS, and it is the sibling of the check above rather than a new
+// idea: modules/specialities/ shipped a full module — manifest, db slice, routes, two
+// migrations — with no key here at all. scopeSubset() therefore resolved every file in
+// it to no territory, so a goal scoped to `specialities` was refused out_of_scope for
+// touching the module it is named after. It was the ONLY on-disk module in that state,
+// which is exactly why nobody noticed: 21 of 22 were fine.
+//
+// The rule is deliberately narrow. It does NOT require every repo path to have an
+// owner — src/, scripts/ and bin/ are unowned ON PURPOSE (ADR 0086: a goal grants
+// authority BOUNDED to module territory, and POST /tasks stays Archon-only for
+// ungoverned creation), so a broader "every root is owned" check would encode the
+// opposite of the design. What must hold is narrower and absolute: if a directory
+// declares itself a module, a goal must be able to be scoped to it.
+function checkEveryModuleDirIsScoped() {
+  const name = 'every carved module owns its own directory (task 1004132)';
+  const dirs = moduleDirsOnDisk(path.join(REPO_ROOT, 'modules'));
+
+  // Same anti-vacuity rule as the check above: this repo HAS modules, so an empty
+  // scan means the manifest test broke, not that the tree is clean.
+  if (dirs.length === 0) {
+    return {
+      name,
+      ok: false,
+      hardFail: true,
+      violations: ['modules/: found NO directory carrying a module.json. That is a broken scan, '
+        + 'not a clean result — moduleDirsOnDisk() in scope-map-guard.js needs looking at.'],
+      warnings: [],
+      note: 'the scan produced an empty set, which cannot be right.',
+    };
+  }
+
+  const { MODULE_SCOPE_MAP } = require('../../src/bongos/module-scope-map.js');
+  const globsOf = (v) => (Array.isArray(v) ? v : (v && v.globs) || []);
+  const claimed = new Set();
+  for (const v of Object.values(MODULE_SCOPE_MAP)) {
+    // A key may claim another module's dir (a cross-cutting owner), so collect every
+    // modules/<key>/ glob from EVERY key rather than only from the same-named one.
+    for (const g of globsOf(v)) {
+      const m = /^modules\/([^/]+)\/$/.exec(g);
+      if (m) claimed.add(m[1]);
+    }
+  }
+
+  const unscoped = dirs.filter((k) => !claimed.has(k));
+  const violations = unscoped.map((k) => `modules/${k}/ carries a module.json but no MODULE_SCOPE_MAP `
+    + `key claims it — scopeSubset() resolves the whole module to no territory, so a goal scoped to `
+    + `'${k}' is denied out_of_scope for touching the module it is named after. Add a '${k}' key `
+    + `owning 'modules/${k}/'.`);
+
+  return {
+    name,
+    ok: unscoped.length === 0,
+    hardFail: unscoped.length > 0,
+    violations,
+    warnings: [],
+    note: `${dirs.length} carved module(s) on disk, each claimed by a MODULE_SCOPE_MAP key.`,
+  };
+}
+
+// PURE — every tracked top-level root, as `name` or `name/`. Exported so the scan
+// is testable against a fixture list rather than only against this repo.
+function trackedRoots(files) {
+  const out = new Set();
+  for (const f of files || []) {
+    if (!f) continue;
+    const i = f.indexOf('/');
+    out.add(i === -1 ? f : `${f.slice(0, i)}/`);
+  }
+  return [...out].sort();
+}
+
+// PURE — does ANY glob reach into this root? A root is "carved" the moment one
+// does; src/ and scripts/ are partially owned and that is the normal in-progress
+// state ADR 0086 §4 describes ("auto-tightens as ADR 0083 moves code into
+// modules/<key>/"). What this answers is the narrower question: is this root
+// territory the scope map has never heard of at all?
+function rootIsTouched(root, globs) {
+  return (globs || []).some((g) => g === root || g.startsWith(root) || root.startsWith(g));
+}
+
+// New unowned territory, and stale entries in the record of the old (task 1004132).
+//
+// THE GAP THIS CLOSES, and it is the one the grade round caught me leaving open.
+// I had argued that because the core is unowned BY DESIGN (ADR 0086: authority is
+// bounded to module territory, POST /tasks stays Archon-only for ungoverned
+// creation), no general check should exist. That is half right and wholly
+// insufficient: the design says WHICH roots may be unowned, it does not stop the
+// set growing. Without this, a new top-level directory lands tomorrow, no module
+// claims it, and nothing anywhere fails — the exact shape that let
+// modules/specialities/ sit unowned for its whole life.
+//
+// So the decision is recorded as DATA (UNOWNED_ROOTS in module-scope-map.js) and
+// this check enforces it in BOTH directions, the discipline
+// tests/host_topology_skips.mjs uses for its own allowlist:
+//   - a root that is neither carved nor listed  -> new territory, fail
+//   - a listed root that is now carved or gone  -> stale entry, fail
+// A one-directional check would let the list rot into a rubber stamp.
+function checkNoNewUnownedRoot(fileList) {
+  const name = 'no new unowned top-level root (task 1004132)';
+  let files = fileList;
+  if (!files) {
+    files = require('node:child_process')
+      .execFileSync('git', ['ls-files'], { cwd: REPO_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+      .trim().split('\n').filter(Boolean);
+  }
+  const roots = trackedRoots(files);
+
+  // Same anti-vacuity rule as its two siblings: this repo HAS tracked files, so an
+  // empty scan is a broken `git ls-files`, not a clean tree.
+  if (roots.length === 0) {
+    return {
+      name,
+      ok: false,
+      hardFail: true,
+      violations: ['git ls-files returned NO tracked files. That is a broken scan, not a clean '
+        + 'result — trackedRoots() in scope-map-guard.js needs looking at.'],
+      warnings: [],
+      note: 'the scan produced an empty set, which cannot be right.',
+    };
+  }
+
+  const map = require('../../src/bongos/module-scope-map.js');
+  const globs = [...map.globsForModules(map.moduleKeys()), ...map.SHARED_GLOBS];
+  const listed = map.UNOWNED_ROOTS || {};
+
+  const violations = [];
+  for (const r of roots) {
+    if (rootIsTouched(r, globs)) {
+      if (Object.prototype.hasOwnProperty.call(listed, r)) {
+        violations.push(`'${r}' is listed in UNOWNED_ROOTS but a module glob now reaches it — the `
+          + 'entry is stale. Delete it; a root leaving that list is the map tightening as intended.');
+      }
+      continue;
+    }
+    if (!Object.prototype.hasOwnProperty.call(listed, r)) {
+      violations.push(`'${r}' is tracked but NO module glob and no SHARED_GLOBS entry reaches it, and `
+        + 'it is not in UNOWNED_ROOTS. New unowned territory: no goal can ever authorize a task that '
+        + `touches it. Give it an owning module, or add it to UNOWNED_ROOTS in module-scope-map.js `
+        + 'with the reason it has none.');
+    }
+  }
+  for (const r of Object.keys(listed)) {
+    if (!roots.includes(r)) {
+      violations.push(`UNOWNED_ROOTS lists '${r}', which is not a tracked root any more — stale entry, `
+        + 'delete it so the list keeps meaning something.');
+    }
+  }
+
+  return {
+    name,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${roots.length} tracked root(s); ${Object.keys(listed).length} recorded as deliberately `
+      + 'unowned (ADR 0086 — core is Archon territory). Shrink-only: an entry may leave, not appear silently.',
+  };
+}
+
+module.exports = {
+  checkDevsecopsOwnsItsChecks, siblingRequires, unownedBy, FITNESS,
+  checkEveryModuleDirIsScoped, moduleDirsOnDisk,
+  checkNoNewUnownedRoot, trackedRoots, rootIsTouched,
+};

package/src/bongos/module-scope-map.js

@@ -145,6 +145,16 @@ const MODULE_GLOBS = {
     'modules/ideas/',
     'scripts/gds/capture.js', 'scripts/gds/triage.js', 'scripts/gds/render-ideas.js',
   ],
+  // Role sub-specialities (task 1003855, ADR 0296). Carved into modules/specialities/
+  // but never given a key here, so every file it owns — module.json, db.js, routes,
+  // its two migrations — resolved to NO module territory: a goal scoped to
+  // `specialities` was denied out_of_scope for touching the module it is named after
+  // (found by task 1004132). Every OTHER on-disk module owns its own directory; this
+  // was the only one that did not, and checkEveryModuleDirIsScoped in
+  // scripts/gds/scope-map-guard.js now fails CI if a new carve repeats it.
+  specialities: [
+    'modules/specialities/',
+  ],
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref
   // libs + builder-needs + their db slice + the `/me/*-prefs` routes + the
@@ -521,6 +531,62 @@ const SHARED_GLOBS = Object.freeze(
   SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], PROTECTED_GLOBS)),
 );
 
+// ── Roots no module glob touches, and why (task 1004132) ────────────────────────
+//
+// This is the RECORDED DECISION behind "the core is owned by nobody", not a note
+// about it. `checkNoNewUnownedRoot` in scripts/gds/scope-map-guard.js reads this
+// map and fails CI BOTH ways: a tracked root that appears here-less is new unowned
+// territory, and an entry whose root became owned (or stopped existing) is stale.
+//
+// WHY THESE ARE ALLOWED TO BE UNOWNED. Per ADR 0086 a goal grants authority
+// BOUNDED to module territory, and `POST /tasks` stays Archon-only for ungoverned
+// creation. So a path with no module owner is not homeless — it is reachable only
+// through the Archon door, which is the safety model, not a gap in it. What must
+// not happen is that set GROWING silently, which is what this freezes.
+//
+// SHRINK-ONLY, like the fitness ratchets. ADR 0086 §4 expects the map to
+// "auto-tighten as ADR 0083 moves code into modules/<key>/" — so an entry leaving
+// this list is the system working. Adding one needs a stated reason, here, in the
+// same commit that adds the root.
+//
+// A `review` reason is an HONEST placeholder, not an endorsement: it marks a root
+// that probably does have a natural owner but whose assignment is its own decision.
+// Assigning nineteen roots in one pass is the one-at-a-time churn task 1004132 was
+// filed to avoid; freezing the set and naming the arguable ones is the cheap half.
+const UNOWNED_ROOTS = Object.freeze({
+  // Generated packaging manifests — written by package-core.js, never hand-edited.
+  '.bongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
+  '.cloudbongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
+  // Container build + repo-level dotfiles. review: devsecops already owns the
+  // neighbouring .npmrc / .gitattributes / package.json, so these plausibly belong
+  // to it — but that is a scope-wall change and wants its own decision.
+  '.dockerignore': 'review: container build, plausibly devsecops',
+  'Dockerfile': 'review: container build, plausibly devsecops',
+  'docker-compose.yml': 'review: container build, plausibly devsecops',
+  'docker-entrypoint.sh': 'review: container build, plausibly devsecops',
+  '.gitignore': 'review: repo-level dotfile, plausibly devsecops',
+  '.env.local.example': 'review: repo-level dotfile, plausibly devsecops',
+  // Design tooling checked into the tree. review: plausibly ui-design.
+  '.impeccable/': 'review: design tooling, plausibly ui-design',
+  // Governance + legal. Deliberately not methodology: methodology owns docs/, and
+  // these are the project's constitutional documents rather than its handbook.
+  'LICENSE': 'project legal text',
+  'CODE_OF_CONDUCT.md': 'project governance text',
+  'CONTRIBUTING.md': 'project governance text',
+  'GOVERNANCE.md': 'project governance text',
+  // Top-level product/design statements, read by humans before any module matters.
+  'README.md': 'repo front door',
+  'DESIGN.md': 'top-level design statement',
+  'PRODUCT.md': 'top-level product statement',
+  // The core itself. bin/ is the CLI entrypoint and clients/ is the GENERATED API
+  // client (scripts/gds/gen-api-client.js); public-docs/ is the published site.
+  // These are core, and core is Archon territory by ADR 0086 — the primary case
+  // this list exists to record.
+  'bin/': 'core CLI entrypoint — Archon territory (ADR 0086)',
+  'clients/': 'generated API client (scripts/gds/gen-api-client.js)',
+  'public-docs/': 'published docs site — core',
+});
+
 // A CLI ENTRYPOINT — a single executable script under scripts/, e.g.
 // 'scripts/gds/setup.js'. Structural, not a list: it is a path test, so no roster
 // is hand-maintained here and nothing has to be kept in step with PROTECTED_GLOBS.
@@ -676,6 +742,7 @@ function moduleDriftFiles(moduleKey, files) {
 }
 
 module.exports = {
+  UNOWNED_ROOTS,
   MODULE_GLOBS,
   MODULE_SCOPE_MAP,
   SHARED_GLOBS,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.944'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.946'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/scope_map_guard.mjs

@@ -17,7 +17,11 @@ import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { checkDevsecopsOwnsItsChecks, siblingRequires } = require('../scripts/gds/scope-map-guard.js');
+const { checkDevsecopsOwnsItsChecks, siblingRequires, checkEveryModuleDirIsScoped, moduleDirsOnDisk,
+        checkNoNewUnownedRoot, trackedRoots, rootIsTouched } = require('../scripts/gds/scope-map-guard.js');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 
 test('every file fitness.js requires is owned by some MODULE_SCOPE_MAP key', () => {
   const r = checkDevsecopsOwnsItsChecks();
@@ -80,3 +84,99 @@ test('the PASS note carries the count, so the check cannot look green while doin
   const n = Number(r.note.match(/^(\d+) file/)[1]);
   assert.ok(n > 14, `expected more than the fourteen the filing task listed, saw ${n}`);
 });
+
+// ── the same defect one level up: a carved module nobody can scope to (task 1004132) ──
+//
+// modules/specialities/ shipped a whole module — manifest, db slice, routes, two
+// migrations — with no MODULE_SCOPE_MAP key, so a goal scoped to `specialities` was
+// refused out_of_scope for touching the module it is named after. 21 of the 22 modules
+// were fine, which is exactly why it went unseen.
+
+test('every carved module on disk is claimed by some MODULE_SCOPE_MAP key', () => {
+  const r = checkEveryModuleDirIsScoped();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+  assert.equal(r.hardFail, false);
+});
+
+test('specialities specifically — the module this check was written for', () => {
+  const { MODULE_SCOPE_MAP } = require('../src/bongos/module-scope-map.js');
+  const globsOf = (v) => (Array.isArray(v) ? v : (v && v.globs) || []);
+  const all = Object.values(MODULE_SCOPE_MAP).flatMap(globsOf);
+  assert.ok(all.includes('modules/specialities/'),
+    'modules/specialities/ lost its owner again — a goal scoped to specialities cannot touch it');
+});
+
+test('moduleDirsOnDisk counts a manifest, not a directory', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-modules-'));
+  fs.mkdirSync(path.join(root, 'real'));
+  fs.writeFileSync(path.join(root, 'real', 'module.json'), '{"key":"real"}');
+  fs.mkdirSync(path.join(root, 'not-a-module'));           // no manifest
+  fs.writeFileSync(path.join(root, 'stray.txt'), 'x');      // not a directory
+  assert.deepEqual(moduleDirsOnDisk(root), ['real']);
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test('the scan cannot pass vacuously — an empty modules/ is a BROKEN scan, not a clean one', () => {
+  // The failure this mirrors is the one the sibling check above documents: a scanner
+  // that matches nothing reports a healthy repo, and healthy is what broken looks like.
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-empty-'));
+  assert.deepEqual(moduleDirsOnDisk(empty), []);
+  assert.deepEqual(moduleDirsOnDisk(path.join(empty, 'does-not-exist')), [],
+    'a missing modules/ must return empty rather than throw — the check turns that into a hard fail');
+  fs.rmSync(empty, { recursive: true, force: true });
+});
+
+// ── the record of what is deliberately unowned, and that it cannot rot (task 1004132) ──
+//
+// The decision "the core is owned by nobody" is DATA (UNOWNED_ROOTS), not prose, so
+// that it can be enforced. A one-directional check would let the list become a
+// rubber stamp, so both directions are pinned here.
+
+test('the repo has no unowned root that UNOWNED_ROOTS does not account for', () => {
+  const r = checkNoNewUnownedRoot();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+});
+
+test('a NEW unowned root fails — the growth this exists to stop', () => {
+  const files = require('node:child_process')
+    .execFileSync('git', ['ls-files'], { encoding: 'utf8' }).trim().split('\n');
+  const r = checkNoNewUnownedRoot([...files, 'vendor/thing.js']);
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations.join('\n'), /'vendor\/' is tracked but NO module glob/);
+});
+
+test('a STALE entry fails too — the list may shrink, never lie', () => {
+  const files = require('node:child_process')
+    .execFileSync('git', ['ls-files'], { encoding: 'utf8' }).trim().split('\n');
+  const r = checkNoNewUnownedRoot(files.filter((f) => f !== 'LICENSE'));
+  assert.equal(r.ok, false);
+  assert.match(r.violations.join('\n'), /lists 'LICENSE', which is not a tracked root any more/);
+});
+
+test('the scan cannot pass vacuously', () => {
+  const r = checkNoNewUnownedRoot([]);
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations.join('\n'), /broken scan, not a clean result/);
+});
+
+test('trackedRoots collapses paths to roots; rootIsTouched sees a PARTIAL carve', () => {
+  assert.deepEqual(trackedRoots(['src/a/b.js', 'src/c.js', 'LICENSE', 'bin/x']),
+    ['LICENSE', 'bin/', 'src/']);
+  // src/ is partially owned (one file claimed) — that is the normal in-progress
+  // state of ADR 0083's carve, and must NOT read as unowned territory.
+  assert.equal(rootIsTouched('src/', ['src/bongos/llm-pricing.js']), true);
+  assert.equal(rootIsTouched('vendor/', ['src/bongos/llm-pricing.js']), false);
+  // A directory glob covering the whole root counts.
+  assert.equal(rootIsTouched('modules/', ['modules/ideas/']), true);
+});
+
+test('every UNOWNED_ROOTS entry carries a reason', () => {
+  const { UNOWNED_ROOTS } = require('../src/bongos/module-scope-map.js');
+  for (const [root, reason] of Object.entries(UNOWNED_ROOTS)) {
+    assert.equal(typeof reason, 'string', `${root} has no reason`);
+    assert.ok(reason.trim().length > 8,
+      `${root}'s reason is too thin to justify an unowned root: ${JSON.stringify(reason)}`);
+  }
+});