@bongos/core 1.19.971 → 1.19.973

package/modules/provisioning/core-upgrade.js

@@ -225,6 +225,60 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
   };
 }
 
+/**
+ * Has the box moved on from the last move this control would report? PURE (task 1004172).
+ *
+ * WHY THIS QUESTION EXISTS. On 2026-09-22 the deploy page's most prominent element was:
+ * "The move to core 1.19.921 did not land — this project was put back on 1.19.969 and is
+ * running", with no date on it. That move was attempted two days earlier, the box had
+ * since reached 1.19.969 by a different route, and the cause it named (`sudo` with no
+ * `-u`) had been fixed and released in 1.19.928. Every word of it was history rendered as
+ * the present, and the owner read it, correctly, as the page having no feedback to give.
+ *
+ * THE TEST IS THE ONE `preflight` ALREADY USES, and deliberately so: a verdict about
+ * 1.19.920 tells the owner nothing true about pressing a button that says 1.19.972, and
+ * neither does a failure about it. So a move is superseded when the box now SERVES what
+ * that move was reaching for — it got there, by whatever road — or when the move on offer
+ * is a different one entirely.
+ *
+ * NO VERSION ORDERING IS COMPUTED, here or anywhere else in this file. "Is 1.19.969 newer
+ * than 1.19.921" is a question this layer does not need to ask to answer "is this news",
+ * and not asking it is what keeps the one comparison in the system (the runner's channel
+ * resolution) the only one that can be wrong.
+ *
+ * An unknown `recommended` — the registry could not be read — leaves a failure STANDING.
+ * Not knowing what is on offer is not evidence that the box recovered, and the direction
+ * to fail in is showing an old failure, never hiding a live one.
+ */
+function lastMoveSuperseded(target, served, recommended) {
+  if (!target) return false;
+  if (served && String(served) === String(target)) return true;
+  return !!(recommended && String(recommended) !== String(target));
+}
+
+/**
+ * The cached dry-run verdict, IF it is about the move now on offer. PURE (task 1004173).
+ *
+ * Two independent staleness questions, and they have different answers:
+ *
+ *   • the VERDICT is about a target — a pass taken against 1.19.920 says nothing true
+ *     about a button that reads 1.19.972, and a stale pass is worse than no answer
+ *     because it reads as a guarantee. Withheld whole.
+ *   • the CHANGE LIST is about a RANGE, so it also depends on where the box is starting
+ *     from. Its `from` is the version that was live when the dry run ran; if the box has
+ *     moved since, the list still describes a real stretch of history but not the one
+ *     this move covers. Only the list is dropped — the verdict beside it is still true.
+ *
+ * Collapsing the two would mean either throwing away a good verdict or showing a range
+ * that starts somewhere the box no longer is.
+ */
+function preflightForOffer(pf, served, recommended) {
+  if (!pf || !recommended || pf.target !== recommended) return null;
+  const ch = pf.changes;
+  if (!ch || !ch.from || String(ch.from) === String(served || '')) return pf;
+  return { ...pf, changes: null };
+}
+
 /**
  * What the control shows BEFORE anything is pressed — step one of the two-step (D4).
  *
@@ -266,7 +320,7 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     // Withheld unless it was taken against the move now on offer: a verdict about
     // 1.19.920 tells the owner nothing true about pressing a button that says 1.19.921,
     // and a stale pass is worse than no answer because it reads as a guarantee.
-    preflight: pf && recommended && pf.target === recommended ? pf : null,
+    preflight: preflightForOffer(pf, served, recommended),
     preflight_at: pf && recommended && pf.target === recommended ? (snap.preflight_at || null) : null,
     open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null } : null,
     // THE LAST MOVE, WHATEVER BECAME OF IT (task 1004145).
@@ -284,6 +338,11 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
       target_version: lastMove.target_version || null,
       state: lastMove.state,
       at: lastMove.resolved_at || lastMove.updated_at || null,
+      // Whether this is still news about the box's CURRENT state, or history the box has
+      // already moved past (task 1004172 — lastMoveSuperseded says why at length). The
+      // CLIENT must not work this out: the page's standing rule is that it compares no
+      // versions, and this is a version question wearing a different hat.
+      superseded: lastMoveSuperseded(lastMove.target_version, served, recommended),
       // Truncated because it reaches a DOM and upgrade.js's refusals can carry a whole
       // `git status` (the dirty-tree one lists every file).
       error: lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
@@ -356,5 +415,5 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
   };
 }
 
-module.exports = { CORE_UPGRADE_FROM, lastCoreMove, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/public-landing/public/contact.html

@@ -68,6 +68,6 @@
   </section>
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a></nav></footer>
 </body>
 </html>

package/modules/public-landing/public/index.html

@@ -897,7 +897,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 
 <footer>
   <div class="footrow">
-    <p><!--apex-only:start-->A non-profit, capture-resistant commons. <!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.</p>
+    <p><!--apex-only:start-->A non-profit, capture-resistant commons. <!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).</p>
     <a href="#about">About</a>
     <a href="/docs">Docs</a>
     <a href="/privacy">Privacy</a>

package/modules/public-landing/public/privacy.html

@@ -77,6 +77,6 @@
   </section>
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a></nav></footer>
 </body>
 </html>

package/modules/public-landing/public/projects.html

@@ -1407,7 +1407,7 @@ summary{min-height:24px;padding:3px 0;}
 
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
 
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this

package/modules/public-landing/public/terms.html

@@ -81,6 +81,6 @@
   </section>
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms" aria-current="page">Terms</a><a href="/contact">Contact</a></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms" aria-current="page">Terms</a><a href="/contact">Contact</a></nav></footer>
 </body>
 </html>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.971",
+  "version": "1.19.973",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.971",
+      "version": "1.19.973",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.971",
+  "version": "1.19.973",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/api-alias-caller-scan.js

@@ -41,11 +41,22 @@
 //      gate that cannot state its own rule cannot explain itself.
 //   5. tests/ (path-excluded). Tests are what keeps the alias exercised in CI. Moving them off it
 //      would retire the alias by accident.
-//   6. docs/ (path-excluded) — a DELIBERATE SCOPE CALL, not an oversight. It is the largest
-//      remaining bucket (~320) and it is where rename-history-check's per-file floors live, so a
-//      docs pass has to separate the record of what we used to call it from instructions that
-//      still teach the old spelling. 1004064's own brief says to treat docs as out of scope and
-//      file it rather than widen the task; filed as the follow-up named in that task's session log.
+//   6. THE FROZEN RECORD UNDER docs/ (path-excluded) — narrowed from a blanket `docs/` by task
+//      1004113, which is the scope call 1004064 deferred. docs/ is not one kind of thing: part of
+//      it is the RECORD of what we used to call the thing, and part of it is live instruction that
+//      still TEACHES a reader to call the alias. A blanket exclusion left the second unpoliced
+//      forever; a blind sweep would have destroyed the first.
+//      The line is not invented here — it is the one the repo already draws twice over. The
+//      subtrees excluded (docs/adr, docs/session-logs, docs/audits) are exactly the frozen-record
+//      path list in the sibling detector gds-literal-scan.js, and — measured, not assumed — all 134 per-file
+//      floors in config/rename-history-baseline.json fall inside them (adr 116, session-logs 15,
+//      audits 3) and NONE falls outside. Rewriting a file with a floor fails the build on purpose:
+//      an ADR rewritten to today's vocabulary destroys the evidence that the words changed.
+//      docs/governance joins them on the same reading: every file in it is a dated authority sweep
+//      or a payment PROOF — an audit filed under another name. docs/recipes/failed-ship-recovery-proof.md
+//      is the one file named individually, for the same reason: it is a transcript of a recovery
+//      that happened, and rewriting the calls it records would make it misreport them.
+//      Everything else under docs/ is now COUNTED, and 1004113 swept it.
 //   7. MIGRATIONS + THE FROZEN RECORD (path-excluded). Same rule as the sibling detector: an
 //      applied migration renamed is an applied migration re-run, and a rewritten ADR destroys the
 //      evidence that the words changed.
@@ -55,6 +66,14 @@
 //      so the ratchet and the sweep agree by construction.
 //   9. CAPTURED FIXTURES (path-excluded). scripts/hall-preview/fixtures/*.json are snapshots of
 //      real API responses; rewriting one would make the fixture misreport what the server returned.
+//  10. A LINE NAMING AN AUTH URL (line-excluded, task 1004113). `/api/gds/auth/...` in prose is the
+//      SAME pinned callback reason 2 path-excludes in code, reached from the docs side: the
+//      Authorization callback URL registered in GitHub's app settings is `${publicOrigin}/api/gds/auth/web/callback`,
+//      and a recipe that teaches a builder to register anything else breaks sign-in for the
+//      instance they are standing up. Seven occurrences across four recipes turn on this, and they
+//      must not be swept to make a number fall. This is a LINE rule rather than a path rule
+//      because the files carrying them (ops-gotchas.md, local-dev.md, staging-environment.md)
+//      are otherwise ordinary live instruction that SHOULD be counted.
 //
 // Usage:
 //   node scripts/gds/api-alias-caller-scan.js            # count + the top offending files
@@ -99,8 +118,15 @@ const ALIAS_EXCLUDED_PATHS = [
   //    files are not tests (clients/bongos-client/index.mjs and its example, scripts/status-probe.mjs)
   //    and the client is exactly the kind of caller this ratchet exists to police.
   /(^|\/)tests?\//,
-  // 6. docs are a separate pass (scope call, see the header)
-  /(^|\/)docs\//,
+  // 6. the FROZEN RECORD under docs/ — narrowed from a blanket `docs/` by task 1004113. These
+  //    three subtrees mirror the frozen-record path list in gds-literal-scan.js and are where all 134
+  //    rename-history floors live; docs/governance is dated audits + payment proofs under another
+  //    name, and the one named file is a transcript of a recovery that happened.
+  /(^|\/)docs\/adr\//,
+  /(^|\/)docs\/session-logs\//,
+  /(^|\/)docs\/audits\//,
+  /(^|\/)docs\/governance\//,
+  /^docs\/recipes\/failed-ship-recovery-proof\.md$/,
   // 7. migrations + the frozen record
   /(^|\/)migrations\//,
   /(^|\/)limitations\//,
@@ -114,6 +140,15 @@ const ALIAS_EXCLUDED_TREES = /(^|\/)(node_modules|public-docs)\/|\.min\.js$|(^|\
 // A line that is ABOUT the alias rather than a caller of it. Rule 8 above.
 const ALIAS_COMMENTARY_RE = /\balias\b|\blegacy\b|\bpermanent\b|\bforever\b/i;
 
+// A line naming an AUTH url under the alias. Rule 10 above: this is the pinned OAuth callback,
+// registered outside the repo, so it is a fact about GitHub's app settings rather than a caller
+// anyone may move. Kept as a line rule because the files it appears in are otherwise countable.
+// Two shapes: the URL itself, and prose ABOUT it — a heading such as "Authorized callback URL must
+// include the full /api/gds path" names the prefix without the /auth/ segment, and sweeping it left
+// the heading contradicting the body two lines below it. Caught in review on task 1004113; the rule
+// is widened rather than the heading rewritten, because the heading is right.
+const ALIAS_PINNED_AUTH_RE = /\/api\/gds\/auth\/|\bcallback\b/i;
+
 function isExcludedPath(relPath) {
   const p = relPath.replace(/\\/g, '/');
   if (ALIAS_EXCLUDED_TREES.test(p)) return true;
@@ -127,6 +162,7 @@ function isCountedLine(line) {
   if (!line.includes(ALIAS)) return false;
   if (line.includes(CANONICAL)) return false;
   if (ALIAS_COMMENTARY_RE.test(line)) return false;
+  if (ALIAS_PINNED_AUTH_RE.test(line)) return false;
   return true;
 }
 
@@ -193,8 +229,10 @@ function main() {
   const show = process.argv.includes('--files') ? ranked : ranked.slice(0, 20);
   console.log(`in-repo /api/gds callers: ${total} across ${ranked.length} file(s) (${scanned} file(s) scanned)`);
   console.log('(the alias contract, the pinned OAuth callbacks, the uptime poller + smoke, the rename guardrails,');
-  console.log(' tests/, docs/, migrations/ and captured fixtures are excluded by construction; so is any line that');
-  console.log(' also names /api/bongos or carries the words alias / legacy / permanent / forever)');
+  console.log(' tests/, the FROZEN RECORD under docs/ (adr, session-logs, audits, governance), migrations/ and');
+  console.log(' captured fixtures are excluded by construction; so is any line that also names /api/bongos, carries');
+  console.log(' the words alias / legacy / permanent / forever, or names a pinned /api/gds/auth/ callback URL.');
+  console.log(' The REST of docs/ is counted — live instruction that still teaches the alias should shrink.)');
   console.log('');
   for (const [f, n] of show) console.log(`  ${String(n).padStart(5)}  ${f}`);
   if (show.length < ranked.length) console.log(`  … and ${ranked.length - show.length} more file(s) — pass --files for all`);

package/scripts/gds/cloudbongos-token-isolation.conf

@@ -0,0 +1,33 @@
+# /etc/systemd/system/cloudbongos.service.d/task-1004176-token-isolation.conf
+#
+# task 1004176 / ADR 0327 §5 — the web tier must not be able to read the
+# control-plane cloud tokens. Full rationale, the verification commands and the
+# trap that makes a working config look broken: docs/recipes/ops-gotchas.md,
+# "systemd". Kept there rather than repeated here so one edit cannot leave two
+# copies disagreeing.
+#
+# A drop-in, not a unit edit: cloudbongos.service was hand-written at standup and
+# is not generated from this repo, so an edit to it has no home here. A drop-in
+# is additive, survives a main-unit rewrite, and rolls back by deleting one file.
+#
+# WHAT IS DELIBERATELY ABSENT. The task originally asked for the "standard
+# sandboxing directives" and for the two tiers to run as different unix users.
+# Neither is here, and ADR 0327 §5 records why:
+#   ProtectHome=        would break the web tier outright — its checkout is
+#                       /home/lars/cloudbongos-instance, and the secret-box
+#                       master key it legitimately needs for per-builder AI keys
+#                       is ~/.config/cloudbongos/builder-secret.key.
+#   ProtectSystem=strict needs a ReadWritePaths allowlist that a live site should
+#                       not be handed blind. Worth doing deliberately, later.
+#   PrivateTmp=         unevaluated: nothing established whether the web tier and
+#                       the runners share anything through /tmp. Not guessed at.
+#   different users     would mean relocating the checkout, the config dir,
+#                       web.env and that master key. The namespace gives the same
+#                       protection for this file at a fraction of the risk.
+# NoNewPrivileges is present: no web-tier path shells out with sudo or setuid
+# (checked in src/ and modules/), and 30 days of the unit's own logs contain no
+# escalation or EPERM.
+#
+[Service]
+InaccessiblePaths=/etc/cloudbongos/box.env
+NoNewPrivileges=yes

package/scripts/gds/fitness.js

@@ -1308,6 +1308,9 @@ const CHECKS = [
   checkCoreNeverImportsModule,
   checkModulesImportOnlyApi,
   checkScopeMapImportsProtected,
+  // Check 36 — task 1002900: a carved module with no roster key walls nothing. Extracted
+  // to its own file (the role-pack-guard.js precedent) to keep fitness.js under the size ratchet.
+  () => require('./scope-roster-guard.js').checkScopeRosterCoversModules({ repoRoot: REPO_ROOT, discoveredModuleKeys }),
   checkCoreCarriesNoModuleCode,
   checkKernelImportsNoDomain,
   checkModuleMigrationsAdditive,

package/scripts/gds/provision-core-upgrade.js

@@ -41,6 +41,12 @@ const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 // changes between the request and the drain.
 const UPGRADE_SHAPES = Object.freeze(new Set(['co-tenant', 'standalone', 'control-plane']));
 
+// The strict three-number form a core version takes. Re-stated here rather than imported
+// from the web tier's core-upgrade.js: a module may not be required from scripts/ (ADR
+// 0083) and this side needs it to guard a SHELL interpolation, which is a stricter duty
+// than validating a request body.
+const CORE_VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+
 // The box's own answer to "what core am I running?" — loopback, on the instance's port.
 //
 // THE APEX CANNOT BE ASKED (ADR 0293 D6). It sits behind pre-launch basic_auth and its
@@ -432,6 +438,115 @@ function preflightUpgrade(inst, to, deps) {
   };
 }
 
+// ── WHAT THE MOVE WOULD CARRY (task 1004173) ────────────────────────────────
+//
+// The owner, 2026-09-22: "I don't actually see what would change when I hit the button."
+// The pre-flight above answers a different question — whether the machinery will let the
+// move happen — and answering it was being presented as a preview. ADR 0293 D4 promised
+// both halves in so many words: "the control shows what a bump would move — live version
+// → target, AND WHAT SITS BETWEEN THEM." Only the first half was built, so the owner was
+// asked to restart a live site to take ninety-one releases of work the page named none of.
+//
+// WHERE THE ANSWER ALREADY LIVES. Every ship writes a merge commit whose summary is
+// already prose for exactly this reader — the owner, not a developer — because ship.js
+// requires one and posts it to Discord. So this reads the merge summaries between the two
+// releases rather than inventing a changelog nobody would maintain.
+//
+// IT READS THE CONTROL PLANE'S OWN CORE CHECKOUT, ALWAYS, whichever instance is being
+// previewed. "What changed in the core between 1.19.881 and 1.19.972" is a question about
+// the CORE repository, and a tenant's instance directory is a checkout of the TENANT's
+// repo with the core vendored in from npm — no core history in it at all, and the wrong
+// history if you squint. The control plane is the machine that builds the core, so it is
+// the machine that can answer.
+const CHANGE_CAP = 20;
+const CHANGE_TEXT_MAX = 400;
+
+/**
+ * The merge summaries in a `git log --merges --format=%s%x1f%b%x1e` dump. PURE.
+ *
+ * TWO MERGE SHAPES CARRY A SUMMARY AND THE SECOND IS THE COMMON ONE. A hand-landed ship
+ * writes `Merge <branch>: <summary>`; the CI auto-merge writes `Merge pull request #N
+ * from <owner>/<branch>` with `task <id>: <summary>` in the BODY. Measured over
+ * 1.19.881→1.19.972: 114 usable summaries, of which 98 were the second shape. A parser
+ * that read subjects only would have found eleven of them and quietly called that the
+ * release.
+ *
+ * EVERYTHING ELSE IS DROPPED, and the drops are the majority: `Merge origin/main into
+ * <branch> (pre-stage freshness…)`, `Merge remote-tracking branch…`, a regen chore. Those
+ * are the mechanics of landing work, not the work, and listing them would bury the
+ * eleven sentences the owner actually wants under a hundred they do not.
+ */
+function parseChangeRecords(stdout) {
+  const out = [];
+  const seen = new Set();
+  for (const rec of String(stdout || '').split('\x1e')) {
+    const r = rec.trim();
+    if (!r) continue;
+    const i = r.indexOf('\x1f');
+    const subject = (i < 0 ? r : r.slice(0, i)).trim();
+    const body = i < 0 ? '' : r.slice(i + 1);
+    let text = null;
+    let id = null;
+    // The negative lookahead is what keeps the two housekeeping shapes out: both begin
+    // "Merge " and both would otherwise match a `<token>:` somewhere later in the line.
+    let m = /^Merge\s+(?!pull request\b|remote-tracking\b)([^\s:]+):\s*(\S.*)$/.exec(subject);
+    if (m) {
+      text = m[2];
+    } else {
+      const first = body.split('\n').map((l) => l.trim()).find(Boolean) || '';
+      m = /^task\s+(\d+):\s*(\S.*)$/.exec(first);
+      if (m) { id = m[1]; text = m[2]; }
+    }
+    if (!text) continue;
+    // It reaches a DOM, and a ship summary is occasionally a paragraph.
+    text = text.length > CHANGE_TEXT_MAX ? `${text.slice(0, CHANGE_TEXT_MAX - 1)}…` : text;
+    if (seen.has(text)) continue;   // a branch merged twice says its sentence once
+    seen.add(text);
+    out.push(id ? { id, text } : { text });
+  }
+  return out;
+}
+
+/**
+ * What landed between two core releases, as the summaries their ships wrote.
+ *
+ * Returns `{ from, to, entries, more }`, or `{ from, to, error }` — NEVER an empty
+ * `entries` for a range it could not resolve. An empty list reads as "nothing changed",
+ * which on a page whose job is to say what a restart buys is the one wrong impression it
+ * must not give, and it is exactly what a missing checkout or a shallow clone produces.
+ *
+ * Every version reaching a shell is re-checked against the strict three-number form
+ * FIRST. They arrive from an intent row whose column has the same CHECK, but a value that
+ * is interpolated into a command is checked where it is interpolated — the rule
+ * upgradeInvocation states about the slug.
+ */
+function changesBetween(fromVersion, toVersion, deps) {
+  const bad = [fromVersion, toVersion].find((v) => !CORE_VERSION_RE.test(String(v || '')));
+  if (bad !== undefined) return { from: fromVersion || null, to: toVersion || null, error: 'could not work out which releases this covers' };
+  // The CONTROL PLANE's executor and the CONTROL PLANE's checkout, never the previewed
+  // instance's: under PROVISION_REMOTE_HOST `exec` is the remote box, and a tenant's own
+  // directory holds no core history at all.
+  const exec = deps.controlExec || deps.exec;
+  const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
+  const dir = selfRoot();
+  const shaOf = (v) => {
+    const r = exec(`git -C ${dir} log --format=%H --max-count=1 -F --grep='release: core ${v} '`, { allowFail: true });
+    const sha = String((r && r.stdout) || '').trim().split('\n')[0] || '';
+    return /^[0-9a-f]{7,40}$/.test(sha) ? sha : null;
+  };
+  const from = shaOf(fromVersion);
+  const to = shaOf(toVersion);
+  if (!from || !to) {
+    return { from: fromVersion, to: toVersion, error: 'could not find those releases in the core history on this machine' };
+  }
+  const r = exec(`git -C ${dir} log --merges --format=%s%x1f%b%x1e ${from}..${to}`, { allowFail: true });
+  if (!r || r.softFailed === true || r.ok === false) {
+    return { from: fromVersion, to: toVersion, error: 'could not read the core history on this machine' };
+  }
+  const all = parseChangeRecords(r.stdout);
+  return { from: fromVersion, to: toVersion, entries: all.slice(0, CHANGE_CAP), more: Math.max(0, all.length - CHANGE_CAP) };
+}
+
 // Run a dry run for one instance and cache its verdict — the ON-DEMAND leg, drained from
 // a `core-upgrade-preflight` intent the owner's arming queues (task 1004121). The tick
 // does not do this: a verdict that is only ever produced on a background schedule is
@@ -446,6 +561,22 @@ async function preflightCoreUpgrade(inst, deps, intent) {
   }
   if (!to) return { ok: false, error: 'no target version to preview' };
   const verdict = (deps.preflightUpgrade || preflightUpgrade)(inst, to, deps);
+  // AND WHAT THE MOVE WOULD CARRY, taken in the same breath (task 1004173). It rides the
+  // verdict rather than a column of its own for the reason the verdict's own `target`
+  // exists: both answers are about ONE move, and storing them together is what makes
+  // "is this still the move on offer" a single question with a single answer. It also
+  // costs the owner no second wait — the dry run is already the thing they are waiting on.
+  //
+  // `from` is the version the box is on RIGHT NOW, read back from the snapshot the tick
+  // writes, and it is stored because the answer is only true of that starting point. The
+  // web tier withholds the list when the box has moved since, the same way it withholds a
+  // verdict taken against a superseded target.
+  let servedNow = null;
+  try {
+    const { rows } = await db.query('SELECT served_version FROM provisioning_core_version_snapshot WHERE instance_id = $1', [inst.id]);
+    servedNow = (rows[0] && rows[0].served_version) || null;
+  } catch { /* no snapshot yet — changesBetween refuses on the missing version, and says so */ }
+  verdict.changes = (deps.changesBetween || changesBetween)(servedNow, to, deps);
   await db.query(
     `INSERT INTO provisioning_core_version_snapshot (instance_id, preflight, preflight_at, observed_at)
      VALUES ($1, $2::jsonb, now(), now())
@@ -537,4 +668,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, CHANGE_CAP, parseChangeRecords, changesBetween, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/gds/run-unit-tests.js

@@ -209,15 +209,20 @@ const INTEGRATION = new Set([
 // (V4.R16) diagnosed them as STALE — they predated #481's Narc-advisory change,
 // NOT a grader regression. Now green and back under this gate so the quality-
 // gate brain can't silently regress.
-const KNOWN_FAILING = new Set([
-  // #1002617: red in every clean environment (Linux CI and a Windows checkout
-  // alike), surfaced by the unit lane's first-ever runs. Parked so the `unit`
-  // check can be required (a gate that's already red gates nothing); per-test
-  // diagnoses live in that task. Remove each here as it is fixed.
-  // PAIRING: tests/known_failing_ratchet.mjs keeps EXECUTING each parked test
-  // and fails the suite the moment one starts passing — so this set cannot rot.
-  'served_paths_shipped',
-]);
+// EMPTY, and that is the intended steady state (task 1002617 closed the last entry).
+//
+// This set existed because the unit lane's first-ever runs (task 1002610) surfaced three
+// tests red in every clean environment, and a gate that is already red gates nothing —
+// so they were parked to make `unit` requireable while each was diagnosed. platform_boot
+// and publish_manifest were fixed earlier; served_paths_shipped was the survivor, and its
+// failure turned out to be its own self-guard correctly reporting that the source scan
+// had gone blind when the OpenAPI serve moved to a root ladder (task 1002200).
+//
+// Adding an entry here is a real cost and should be rare: a parked test is invisible
+// coverage, and this one sat parked long enough that its diagnosis had to be redone.
+// PAIRING: tests/known_failing_ratchet.mjs keeps EXECUTING each parked test and fails the
+// suite the moment one starts passing — so this set cannot rot silently.
+const KNOWN_FAILING = new Set([]);
 
 // Task 1003845: on Windows + Node 24 a suite that hard-exits after serving HTTP can
 // print a clean verdict and THEN abort natively (the cliExit class in

package/scripts/gds/scope-roster-guard.js

@@ -0,0 +1,118 @@
+// scripts/gds/scope-roster-guard.js
+//
+// WHAT. The fitness check behind the module scope roster (task 1002900): every module
+// discovered at modules/<key>/module.json must have a covering key in MODULE_GLOBS
+// (src/bongos/module-scope-map.js).
+//
+// WHY IT IS A HARD FAIL, when the runtime symptom is a denial rather than a crash.
+// The roster is maintained by HAND. A module lands, nobody adds the entry, and any goal
+// scoped to that work hits an authorize-NOTHING wall: goal-scope-check.check() denies
+// with empty_scope / unknown_scope. Nothing announces it — it surfaces only when someone
+// tries to set a goal's wall and cannot, which is long after the module landed and far
+// from the edit that caused it. CI is the only place the gap is visible at the moment it
+// is created.
+//
+// It has happened three times by hand: task 1002690 (provisioning + public-landing,
+// goal 1000059), task 1002322 (platform-identity, goal 1000046) and `agents`, the
+// instance this check was filed for. Each was fixed after someone tripped over it.
+//
+// WHY SUBSET AND NOT EQUALITY. The roster legitimately carries keys with no
+// modules/<key>/ directory, for two different reasons, and equality would fail on all
+// five of them in this tree:
+//   - NON-MODULE SCOPES — `kernel`, `methodology`, `devsecops` are surfaces, not modules.
+//   - ABSENT MODULES — `art-pipeline`, `game` are rostered but not present in this
+//     instance (ADR 0108: a host may carry a different module set).
+// So the invariant is one-directional: every DISCOVERED module must be rostered; a
+// rostered key with no module is not a fault. Getting that backwards would produce a
+// check nobody can keep green, which is worse than no check.
+//
+// Extracted from fitness.js (which the size ratchet caps) following the
+// role-pack-guard.js precedent. The pure scanner is exported for tests/fitness_scope_roster.mjs.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// The machinery already existed — fitness.js's discoveredModuleKeys() feeds the
+// kernel-machinery check — but nothing cross-checked it against moduleKeys().
+// checkScopeMapImportsProtected guards HOW `protected` is derived, not WHETHER every
+// module is listed.
+
+// SCOPE: modules/ ONLY — the two named orphans, decided rather than left open.
+// Task 1002900 asked for a ruling on two files said to be covered by no glob. Both
+// answers changed when checked against origin/main on 2026-09-22:
+//   - scripts/gds/fitness.js  — NOT uncovered. The `devsecops` key matches it. The row's
+//                               claim was stale.
+//   - src/server.js           — does not exist any more.
+//   - src/platform-server.js  — genuinely uncovered, and DELIBERATELY still is.
+// This check asserts what its name says: every carved MODULE has a roster key. Widening
+// it to arbitrary src/ entrypoints is a different question about a different registry —
+// `kernel` lists individual files by hand, so "should platform-server join it" is a call
+// for whoever owns that scope, not a side effect of adding a module-coverage lint. Left
+// as a recorded decision rather than an exemption entry, because there is nothing to
+// exempt: modules/ is the stated scope and platform-server.js was never in it.
+
+const SCOPE_ROSTER_REL = 'src/bongos/module-scope-map.js';
+
+function scanScopeRosterCoverage({ discovered, rostered, globs, exists }) {
+  const missing = discovered.filter((k) => !rostered.includes(k)).sort();
+  const violations = missing.map((k) =>
+    `module '${k}' (modules/${k}/module.json) has no key in ${SCOPE_ROSTER_REL} MODULE_GLOBS — `
+    + 'any goal scoped to it will deny with empty_scope/unknown_scope');
+
+  // The mirror-image rot, reported as a WARNING rather than a failure: a roster glob that
+  // names an exact FILE which no longer exists. It cannot wall anything off, so it is a
+  // silent hole in a scope rather than a build breakage — and unlike a missing key it has
+  // no runtime symptom at all. Only exact file paths are checked; a directory glob may
+  // legitimately point at an absent optional module (see SUBSET above).
+  const warnings = [];
+  for (const [key, list] of Object.entries(globs || {})) {
+    for (const g of list || []) {
+      if (g.endsWith('/') || g.includes('*')) continue;
+      if (!exists(g)) warnings.push(`${SCOPE_ROSTER_REL}: scope '${key}' lists '${g}', which does not exist — dead entry, walls nothing`);
+    }
+  }
+  return { violations, warnings };
+}
+
+// REPO_ROOT and discoveredModuleKeys come from fitness.js, which owns module discovery
+// (it unions across MODULE_ROOTS per ADR 0108). Passed in rather than re-derived so the
+// two can never disagree about what a module is.
+function checkScopeRosterCoversModules({ repoRoot, discoveredModuleKeys }) {
+  let res;
+  try {
+    const scopeMap = require(path.join(repoRoot, SCOPE_ROSTER_REL));
+    res = scanScopeRosterCoverage({
+      discovered: discoveredModuleKeys(),
+      rostered: scopeMap.moduleKeys(),
+      globs: scopeMap.MODULE_GLOBS,
+      exists: (g) => fs.existsSync(path.join(repoRoot, g)),
+    });
+  } catch (e) {
+    // FAILS OPEN, deliberately and narrowly. This catch fires only if requiring the scope
+    // map throws — i.e. the file is syntactically broken — and that is not this check's
+    // job to report: src/bongos/module-scope-map.js has its own unit coverage, and every
+    // sibling scope check (checkScopeMapImportsProtected, the ownership checks) would red
+    // on the same input. A coverage lint that hard-fails on someone else's syntax error
+    // adds a second confusing message to a build that is already failing for the real
+    // reason. The skip is surfaced as a warning rather than swallowed.
+    return {
+      name: 'every discovered module has a scope-roster key (task 1002900)',
+      ok: true, hardFail: false, violations: [], warnings: [`skipped: ${e.message}`],
+      note: `could not load ${SCOPE_ROSTER_REL} — check skipped.`,
+    };
+  }
+  return {
+    name: 'every discovered module has a scope-roster key (task 1002900)',
+    ok: res.violations.length === 0,
+    hardFail: res.violations.length > 0,
+    violations: res.violations,
+    warnings: res.warnings,
+    note: `every modules/<key>/ carrying module.json has a MODULE_GLOBS entry, so a goal can be `
+      + `scoped to it. Subset, not equality: a rostered key with no module is legitimate `
+      + `(non-module scopes like kernel/methodology/devsecops, and modules absent from this instance).`,
+  };
+}
+
+module.exports = { checkScopeRosterCoversModules, scanScopeRosterCoverage, SCOPE_ROSTER_REL };