@bongos/core 1.19.945 → 1.19.946

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.945",
-  "core_contract": "1.19.945",
-  "source_commit": "069e65e6a01a57f09cf32de375376fb396a30dc4",
+  "core_version": "1.19.946",
+  "core_contract": "1.19.946",
+  "source_commit": "427f912951779422ac61981f8d918086a2f0cc65",
   "source_ref": "HEAD",
-  "built_at": "2026-09-21T23:41:12.424Z",
+  "built_at": "2026-09-21T23:49:20.517Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 512,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2878,
-  "tree_sha256": "658ce325bf77e617c3b8b44277b6b53c3a76935b9de049db21f05062abb53779",
+  "tree_sha256": "3a0e9a1d401c4698c1d6c8fd6a429f0f65a2beabf547c47a910f336148776ac6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2682,7 +2682,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b19c89c223392cbb28efd08e1b296125a846e7d9f18260b71793378992d42178"
+      "sha256": "3be3dcca6eabd22bc94ad8c59edb8fcc56bc14cf46cbd6d315807b2247d5a636"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8007,12 +8007,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "bd902078abd41ebb698133bdce5862123fa89d7740794a50721c04f9621cc9fc"
+      "sha256": "d9bcde780bfceb4b3f8c2c818db7552a5b21cd0280e123f35a81f71032234e8f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9c1945ef497e4f0068ababa55bcd863ef336446951f4cab9eecbb36788dddf05"
+      "sha256": "289ec4343c26cd76b78320bdacd76382bfd5e4ef75670c307ff9fb400e866de3"
     },
     {
       "path": "public-docs/index.html",
@@ -8597,7 +8597,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "b05634f4916387ed35b33774e8b27176a1d3ce14c8ea6cb98485f289395afc6b"
+      "sha256": "35e377253453c975ce7a8e420d72af718a4f8ab6d3837d39fd38c1ebd5658ddc"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9127,7 +9127,7 @@
     {
       "path": "scripts/gds/scope-map-guard.js",
       "mode": "0000644",
-      "sha256": "75f0791698a36e48ec232d2285e6f80dac6d64c2a23a23a26cd54c1c05883c3b"
+      "sha256": "39554a1c45f9d4c507df8d782cf2d928adae312110ba9a057421354d5999dc69"
     },
     {
       "path": "scripts/gds/seam-wiring-guard.js",
@@ -9822,7 +9822,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "b5ee44e89d9686d1fc297dfd9952d3614edfe7f4a4cd18c264d9b4d68adb2629"
+      "sha256": "36da288c8087ebd653c0b208a02414ea55d09da53df22cb4fc3d281941756ec7"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10017,7 +10017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "704e7c44feb33354f257ee42164701791d33c548c2daf07ed35bdd1d77bc7f9f"
+      "sha256": "4301e3d88d415bed2d9146b4bd1749be2341355554f78e441793ebca16d9e24a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13472,7 +13472,7 @@
     {
       "path": "tests/scope_map_guard.mjs",
       "mode": "0000644",
-      "sha256": "278e334a945d151c225d849b51464a3dffc8f0bb0dcb1d39b72d12bae57efd4f"
+      "sha256": "9722a12a61597d86f033d3f3a8cd93a7e99c701da54f79c8f6ac49afdea62ad3"
     },
     {
       "path": "tests/scouting_owner_access_and_reach.mjs",

package/docs/module-api-changelog.md

@@ -2364,5 +2364,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.943 with no explicit bump. run 35665131778. (task 1002620)
   1.19.945 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.944 with no explicit bump. run 35668642462. (task 1002620)
+  1.19.946 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.945 with no explicit bump. run 35669244197. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.945",
+  "version": "1.19.946",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.945",
+      "version": "1.19.946",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.945",
+  "version": "1.19.946",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1277,7 +1277,7 @@ const CHECKS = [
   // one (ADR 0289). Rationale + the seam→consumer table live in that file.
   require('./seam-wiring-guard.js').checkSeamWiring,
   require('./home-isolation-guard.js').checkHomeIsolation, // Check 34 — task 1003763: a test that sets HOME for a child without USERPROFILE isolates NOTHING on win32, so it silently stops testing what its comment says. Three tasks fixed this one site at a time. Rationale in that file.
-  require('./scope-map-guard.js').checkDevsecopsOwnsItsChecks, // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Rationale in that file.
+  ...['checkDevsecopsOwnsItsChecks', 'checkEveryModuleDirIsScoped', 'checkNoNewUnownedRoot'].map((k) => require('./scope-map-guard.js')[k]), // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Check 36 — task 1004132: the same defect one level up, a carved module whose own directory no key claims (modules/specialities/ shipped that way). Sharing the line per the ratchet convention above. Rationale in that file.
   require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
 ];
 

package/scripts/gds/scope-map-guard.js

@@ -117,4 +117,184 @@ function checkDevsecopsOwnsItsChecks() {
       + 'unless CI says otherwise (task 1003949).',
   };
 }
-module.exports = { checkDevsecopsOwnsItsChecks, siblingRequires, unownedBy, FITNESS };
+// PURE — every module directory on disk, by key. A module is a modules/<key>/ dir
+// carrying module.json (the ADR 0083 manifest), which is the same structural test
+// the loader's discoverModules() uses: a key is what has a manifest, never a
+// hand-kept roster. Exported so the scan is testable against a fixture tree —
+// an empty result here looks identical to a clean repo, which is the failure the
+// sibling check above exists to refuse.
+function moduleDirsOnDisk(modulesRoot) {
+  let entries = [];
+  try { entries = fs.readdirSync(modulesRoot, { withFileTypes: true }); } catch { return []; }
+  return entries
+    .filter((e) => e.isDirectory() && fs.existsSync(path.join(modulesRoot, e.name, 'module.json')))
+    .map((e) => e.name)
+    .sort();
+}
+
+// A carved module whose own directory no MODULE_SCOPE_MAP key claims (task 1004132).
+//
+// THE DRIFT THIS STOPS, and it is the sibling of the check above rather than a new
+// idea: modules/specialities/ shipped a full module — manifest, db slice, routes, two
+// migrations — with no key here at all. scopeSubset() therefore resolved every file in
+// it to no territory, so a goal scoped to `specialities` was refused out_of_scope for
+// touching the module it is named after. It was the ONLY on-disk module in that state,
+// which is exactly why nobody noticed: 21 of 22 were fine.
+//
+// The rule is deliberately narrow. It does NOT require every repo path to have an
+// owner — src/, scripts/ and bin/ are unowned ON PURPOSE (ADR 0086: a goal grants
+// authority BOUNDED to module territory, and POST /tasks stays Archon-only for
+// ungoverned creation), so a broader "every root is owned" check would encode the
+// opposite of the design. What must hold is narrower and absolute: if a directory
+// declares itself a module, a goal must be able to be scoped to it.
+function checkEveryModuleDirIsScoped() {
+  const name = 'every carved module owns its own directory (task 1004132)';
+  const dirs = moduleDirsOnDisk(path.join(REPO_ROOT, 'modules'));
+
+  // Same anti-vacuity rule as the check above: this repo HAS modules, so an empty
+  // scan means the manifest test broke, not that the tree is clean.
+  if (dirs.length === 0) {
+    return {
+      name,
+      ok: false,
+      hardFail: true,
+      violations: ['modules/: found NO directory carrying a module.json. That is a broken scan, '
+        + 'not a clean result — moduleDirsOnDisk() in scope-map-guard.js needs looking at.'],
+      warnings: [],
+      note: 'the scan produced an empty set, which cannot be right.',
+    };
+  }
+
+  const { MODULE_SCOPE_MAP } = require('../../src/bongos/module-scope-map.js');
+  const globsOf = (v) => (Array.isArray(v) ? v : (v && v.globs) || []);
+  const claimed = new Set();
+  for (const v of Object.values(MODULE_SCOPE_MAP)) {
+    // A key may claim another module's dir (a cross-cutting owner), so collect every
+    // modules/<key>/ glob from EVERY key rather than only from the same-named one.
+    for (const g of globsOf(v)) {
+      const m = /^modules\/([^/]+)\/$/.exec(g);
+      if (m) claimed.add(m[1]);
+    }
+  }
+
+  const unscoped = dirs.filter((k) => !claimed.has(k));
+  const violations = unscoped.map((k) => `modules/${k}/ carries a module.json but no MODULE_SCOPE_MAP `
+    + `key claims it — scopeSubset() resolves the whole module to no territory, so a goal scoped to `
+    + `'${k}' is denied out_of_scope for touching the module it is named after. Add a '${k}' key `
+    + `owning 'modules/${k}/'.`);
+
+  return {
+    name,
+    ok: unscoped.length === 0,
+    hardFail: unscoped.length > 0,
+    violations,
+    warnings: [],
+    note: `${dirs.length} carved module(s) on disk, each claimed by a MODULE_SCOPE_MAP key.`,
+  };
+}
+
+// PURE — every tracked top-level root, as `name` or `name/`. Exported so the scan
+// is testable against a fixture list rather than only against this repo.
+function trackedRoots(files) {
+  const out = new Set();
+  for (const f of files || []) {
+    if (!f) continue;
+    const i = f.indexOf('/');
+    out.add(i === -1 ? f : `${f.slice(0, i)}/`);
+  }
+  return [...out].sort();
+}
+
+// PURE — does ANY glob reach into this root? A root is "carved" the moment one
+// does; src/ and scripts/ are partially owned and that is the normal in-progress
+// state ADR 0086 §4 describes ("auto-tightens as ADR 0083 moves code into
+// modules/<key>/"). What this answers is the narrower question: is this root
+// territory the scope map has never heard of at all?
+function rootIsTouched(root, globs) {
+  return (globs || []).some((g) => g === root || g.startsWith(root) || root.startsWith(g));
+}
+
+// New unowned territory, and stale entries in the record of the old (task 1004132).
+//
+// THE GAP THIS CLOSES, and it is the one the grade round caught me leaving open.
+// I had argued that because the core is unowned BY DESIGN (ADR 0086: authority is
+// bounded to module territory, POST /tasks stays Archon-only for ungoverned
+// creation), no general check should exist. That is half right and wholly
+// insufficient: the design says WHICH roots may be unowned, it does not stop the
+// set growing. Without this, a new top-level directory lands tomorrow, no module
+// claims it, and nothing anywhere fails — the exact shape that let
+// modules/specialities/ sit unowned for its whole life.
+//
+// So the decision is recorded as DATA (UNOWNED_ROOTS in module-scope-map.js) and
+// this check enforces it in BOTH directions, the discipline
+// tests/host_topology_skips.mjs uses for its own allowlist:
+//   - a root that is neither carved nor listed  -> new territory, fail
+//   - a listed root that is now carved or gone  -> stale entry, fail
+// A one-directional check would let the list rot into a rubber stamp.
+function checkNoNewUnownedRoot(fileList) {
+  const name = 'no new unowned top-level root (task 1004132)';
+  let files = fileList;
+  if (!files) {
+    files = require('node:child_process')
+      .execFileSync('git', ['ls-files'], { cwd: REPO_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+      .trim().split('\n').filter(Boolean);
+  }
+  const roots = trackedRoots(files);
+
+  // Same anti-vacuity rule as its two siblings: this repo HAS tracked files, so an
+  // empty scan is a broken `git ls-files`, not a clean tree.
+  if (roots.length === 0) {
+    return {
+      name,
+      ok: false,
+      hardFail: true,
+      violations: ['git ls-files returned NO tracked files. That is a broken scan, not a clean '
+        + 'result — trackedRoots() in scope-map-guard.js needs looking at.'],
+      warnings: [],
+      note: 'the scan produced an empty set, which cannot be right.',
+    };
+  }
+
+  const map = require('../../src/bongos/module-scope-map.js');
+  const globs = [...map.globsForModules(map.moduleKeys()), ...map.SHARED_GLOBS];
+  const listed = map.UNOWNED_ROOTS || {};
+
+  const violations = [];
+  for (const r of roots) {
+    if (rootIsTouched(r, globs)) {
+      if (Object.prototype.hasOwnProperty.call(listed, r)) {
+        violations.push(`'${r}' is listed in UNOWNED_ROOTS but a module glob now reaches it — the `
+          + 'entry is stale. Delete it; a root leaving that list is the map tightening as intended.');
+      }
+      continue;
+    }
+    if (!Object.prototype.hasOwnProperty.call(listed, r)) {
+      violations.push(`'${r}' is tracked but NO module glob and no SHARED_GLOBS entry reaches it, and `
+        + 'it is not in UNOWNED_ROOTS. New unowned territory: no goal can ever authorize a task that '
+        + `touches it. Give it an owning module, or add it to UNOWNED_ROOTS in module-scope-map.js `
+        + 'with the reason it has none.');
+    }
+  }
+  for (const r of Object.keys(listed)) {
+    if (!roots.includes(r)) {
+      violations.push(`UNOWNED_ROOTS lists '${r}', which is not a tracked root any more — stale entry, `
+        + 'delete it so the list keeps meaning something.');
+    }
+  }
+
+  return {
+    name,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${roots.length} tracked root(s); ${Object.keys(listed).length} recorded as deliberately `
+      + 'unowned (ADR 0086 — core is Archon territory). Shrink-only: an entry may leave, not appear silently.',
+  };
+}
+
+module.exports = {
+  checkDevsecopsOwnsItsChecks, siblingRequires, unownedBy, FITNESS,
+  checkEveryModuleDirIsScoped, moduleDirsOnDisk,
+  checkNoNewUnownedRoot, trackedRoots, rootIsTouched,
+};

package/src/bongos/module-scope-map.js

@@ -145,6 +145,16 @@ const MODULE_GLOBS = {
     'modules/ideas/',
     'scripts/gds/capture.js', 'scripts/gds/triage.js', 'scripts/gds/render-ideas.js',
   ],
+  // Role sub-specialities (task 1003855, ADR 0296). Carved into modules/specialities/
+  // but never given a key here, so every file it owns — module.json, db.js, routes,
+  // its two migrations — resolved to NO module territory: a goal scoped to
+  // `specialities` was denied out_of_scope for touching the module it is named after
+  // (found by task 1004132). Every OTHER on-disk module owns its own directory; this
+  // was the only one that did not, and checkEveryModuleDirIsScoped in
+  // scripts/gds/scope-map-guard.js now fails CI if a new carve repeats it.
+  specialities: [
+    'modules/specialities/',
+  ],
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref
   // libs + builder-needs + their db slice + the `/me/*-prefs` routes + the
@@ -521,6 +531,62 @@ const SHARED_GLOBS = Object.freeze(
   SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], PROTECTED_GLOBS)),
 );
 
+// ── Roots no module glob touches, and why (task 1004132) ────────────────────────
+//
+// This is the RECORDED DECISION behind "the core is owned by nobody", not a note
+// about it. `checkNoNewUnownedRoot` in scripts/gds/scope-map-guard.js reads this
+// map and fails CI BOTH ways: a tracked root that appears here-less is new unowned
+// territory, and an entry whose root became owned (or stopped existing) is stale.
+//
+// WHY THESE ARE ALLOWED TO BE UNOWNED. Per ADR 0086 a goal grants authority
+// BOUNDED to module territory, and `POST /tasks` stays Archon-only for ungoverned
+// creation. So a path with no module owner is not homeless — it is reachable only
+// through the Archon door, which is the safety model, not a gap in it. What must
+// not happen is that set GROWING silently, which is what this freezes.
+//
+// SHRINK-ONLY, like the fitness ratchets. ADR 0086 §4 expects the map to
+// "auto-tighten as ADR 0083 moves code into modules/<key>/" — so an entry leaving
+// this list is the system working. Adding one needs a stated reason, here, in the
+// same commit that adds the root.
+//
+// A `review` reason is an HONEST placeholder, not an endorsement: it marks a root
+// that probably does have a natural owner but whose assignment is its own decision.
+// Assigning nineteen roots in one pass is the one-at-a-time churn task 1004132 was
+// filed to avoid; freezing the set and naming the arguable ones is the cheap half.
+const UNOWNED_ROOTS = Object.freeze({
+  // Generated packaging manifests — written by package-core.js, never hand-edited.
+  '.bongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
+  '.cloudbongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
+  // Container build + repo-level dotfiles. review: devsecops already owns the
+  // neighbouring .npmrc / .gitattributes / package.json, so these plausibly belong
+  // to it — but that is a scope-wall change and wants its own decision.
+  '.dockerignore': 'review: container build, plausibly devsecops',
+  'Dockerfile': 'review: container build, plausibly devsecops',
+  'docker-compose.yml': 'review: container build, plausibly devsecops',
+  'docker-entrypoint.sh': 'review: container build, plausibly devsecops',
+  '.gitignore': 'review: repo-level dotfile, plausibly devsecops',
+  '.env.local.example': 'review: repo-level dotfile, plausibly devsecops',
+  // Design tooling checked into the tree. review: plausibly ui-design.
+  '.impeccable/': 'review: design tooling, plausibly ui-design',
+  // Governance + legal. Deliberately not methodology: methodology owns docs/, and
+  // these are the project's constitutional documents rather than its handbook.
+  'LICENSE': 'project legal text',
+  'CODE_OF_CONDUCT.md': 'project governance text',
+  'CONTRIBUTING.md': 'project governance text',
+  'GOVERNANCE.md': 'project governance text',
+  // Top-level product/design statements, read by humans before any module matters.
+  'README.md': 'repo front door',
+  'DESIGN.md': 'top-level design statement',
+  'PRODUCT.md': 'top-level product statement',
+  // The core itself. bin/ is the CLI entrypoint and clients/ is the GENERATED API
+  // client (scripts/gds/gen-api-client.js); public-docs/ is the published site.
+  // These are core, and core is Archon territory by ADR 0086 — the primary case
+  // this list exists to record.
+  'bin/': 'core CLI entrypoint — Archon territory (ADR 0086)',
+  'clients/': 'generated API client (scripts/gds/gen-api-client.js)',
+  'public-docs/': 'published docs site — core',
+});
+
 // A CLI ENTRYPOINT — a single executable script under scripts/, e.g.
 // 'scripts/gds/setup.js'. Structural, not a list: it is a path test, so no roster
 // is hand-maintained here and nothing has to be kept in step with PROTECTED_GLOBS.
@@ -676,6 +742,7 @@ function moduleDriftFiles(moduleKey, files) {
 }
 
 module.exports = {
+  UNOWNED_ROOTS,
   MODULE_GLOBS,
   MODULE_SCOPE_MAP,
   SHARED_GLOBS,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.945'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.946'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/scope_map_guard.mjs

@@ -17,7 +17,11 @@ import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { checkDevsecopsOwnsItsChecks, siblingRequires } = require('../scripts/gds/scope-map-guard.js');
+const { checkDevsecopsOwnsItsChecks, siblingRequires, checkEveryModuleDirIsScoped, moduleDirsOnDisk,
+        checkNoNewUnownedRoot, trackedRoots, rootIsTouched } = require('../scripts/gds/scope-map-guard.js');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 
 test('every file fitness.js requires is owned by some MODULE_SCOPE_MAP key', () => {
   const r = checkDevsecopsOwnsItsChecks();
@@ -80,3 +84,99 @@ test('the PASS note carries the count, so the check cannot look green while doin
   const n = Number(r.note.match(/^(\d+) file/)[1]);
   assert.ok(n > 14, `expected more than the fourteen the filing task listed, saw ${n}`);
 });
+
+// ── the same defect one level up: a carved module nobody can scope to (task 1004132) ──
+//
+// modules/specialities/ shipped a whole module — manifest, db slice, routes, two
+// migrations — with no MODULE_SCOPE_MAP key, so a goal scoped to `specialities` was
+// refused out_of_scope for touching the module it is named after. 21 of the 22 modules
+// were fine, which is exactly why it went unseen.
+
+test('every carved module on disk is claimed by some MODULE_SCOPE_MAP key', () => {
+  const r = checkEveryModuleDirIsScoped();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+  assert.equal(r.hardFail, false);
+});
+
+test('specialities specifically — the module this check was written for', () => {
+  const { MODULE_SCOPE_MAP } = require('../src/bongos/module-scope-map.js');
+  const globsOf = (v) => (Array.isArray(v) ? v : (v && v.globs) || []);
+  const all = Object.values(MODULE_SCOPE_MAP).flatMap(globsOf);
+  assert.ok(all.includes('modules/specialities/'),
+    'modules/specialities/ lost its owner again — a goal scoped to specialities cannot touch it');
+});
+
+test('moduleDirsOnDisk counts a manifest, not a directory', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-modules-'));
+  fs.mkdirSync(path.join(root, 'real'));
+  fs.writeFileSync(path.join(root, 'real', 'module.json'), '{"key":"real"}');
+  fs.mkdirSync(path.join(root, 'not-a-module'));           // no manifest
+  fs.writeFileSync(path.join(root, 'stray.txt'), 'x');      // not a directory
+  assert.deepEqual(moduleDirsOnDisk(root), ['real']);
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test('the scan cannot pass vacuously — an empty modules/ is a BROKEN scan, not a clean one', () => {
+  // The failure this mirrors is the one the sibling check above documents: a scanner
+  // that matches nothing reports a healthy repo, and healthy is what broken looks like.
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-empty-'));
+  assert.deepEqual(moduleDirsOnDisk(empty), []);
+  assert.deepEqual(moduleDirsOnDisk(path.join(empty, 'does-not-exist')), [],
+    'a missing modules/ must return empty rather than throw — the check turns that into a hard fail');
+  fs.rmSync(empty, { recursive: true, force: true });
+});
+
+// ── the record of what is deliberately unowned, and that it cannot rot (task 1004132) ──
+//
+// The decision "the core is owned by nobody" is DATA (UNOWNED_ROOTS), not prose, so
+// that it can be enforced. A one-directional check would let the list become a
+// rubber stamp, so both directions are pinned here.
+
+test('the repo has no unowned root that UNOWNED_ROOTS does not account for', () => {
+  const r = checkNoNewUnownedRoot();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+});
+
+test('a NEW unowned root fails — the growth this exists to stop', () => {
+  const files = require('node:child_process')
+    .execFileSync('git', ['ls-files'], { encoding: 'utf8' }).trim().split('\n');
+  const r = checkNoNewUnownedRoot([...files, 'vendor/thing.js']);
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations.join('\n'), /'vendor\/' is tracked but NO module glob/);
+});
+
+test('a STALE entry fails too — the list may shrink, never lie', () => {
+  const files = require('node:child_process')
+    .execFileSync('git', ['ls-files'], { encoding: 'utf8' }).trim().split('\n');
+  const r = checkNoNewUnownedRoot(files.filter((f) => f !== 'LICENSE'));
+  assert.equal(r.ok, false);
+  assert.match(r.violations.join('\n'), /lists 'LICENSE', which is not a tracked root any more/);
+});
+
+test('the scan cannot pass vacuously', () => {
+  const r = checkNoNewUnownedRoot([]);
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations.join('\n'), /broken scan, not a clean result/);
+});
+
+test('trackedRoots collapses paths to roots; rootIsTouched sees a PARTIAL carve', () => {
+  assert.deepEqual(trackedRoots(['src/a/b.js', 'src/c.js', 'LICENSE', 'bin/x']),
+    ['LICENSE', 'bin/', 'src/']);
+  // src/ is partially owned (one file claimed) — that is the normal in-progress
+  // state of ADR 0083's carve, and must NOT read as unowned territory.
+  assert.equal(rootIsTouched('src/', ['src/bongos/llm-pricing.js']), true);
+  assert.equal(rootIsTouched('vendor/', ['src/bongos/llm-pricing.js']), false);
+  // A directory glob covering the whole root counts.
+  assert.equal(rootIsTouched('modules/', ['modules/ideas/']), true);
+});
+
+test('every UNOWNED_ROOTS entry carries a reason', () => {
+  const { UNOWNED_ROOTS } = require('../src/bongos/module-scope-map.js');
+  for (const [root, reason] of Object.entries(UNOWNED_ROOTS)) {
+    assert.equal(typeof reason, 'string', `${root} has no reason`);
+    assert.ok(reason.trim().length > 8,
+      `${root}'s reason is too thin to justify an unowned root: ${JSON.stringify(reason)}`);
+  }
+});