@bongos/core 1.19.994 → 1.19.995

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.994",
-  "core_contract": "1.19.994",
-  "source_commit": "2d0c99af93af0f1d1728f6fce1dbce057f209d4c",
+  "core_version": "1.19.995",
+  "core_contract": "1.19.995",
+  "source_commit": "5289c5d78570e086cd6f6d7ee4c154883c7adb78",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T22:40:55.441Z",
+  "built_at": "2026-09-23T23:25:13.365Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 519,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2404,
+    "functional_verbatim": 2405,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2949,
-  "tree_sha256": "4b408d832b68004c07a3d8ad8143cc76a7a5c40c651ba47878f8ae27230568c6",
+  "file_count": 2950,
+  "tree_sha256": "ca075a6b55f5c4d672bea732dad07148b251ceceabcea4a3823702e708fc28c7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2717,7 +2717,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "aff2b4b93d88dd46eb74dacd0d51c4a959d1a860b9fda1646f3bd2c842780885"
+      "sha256": "42c93e21972b2c4cf9e69574fbd72957a80d03ce51f5a86e6d28579981de11df"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5502,7 +5502,7 @@
     {
       "path": "modules/hall-ui/public/work.css",
       "mode": "0000644",
-      "sha256": "68399594a00fdffaf9833d3105d8c9e2f5872642b0f49868edae6cc526fa9021"
+      "sha256": "12b5c9aefa39b8922a5a5a8585a107779bc15678b120cf00239584e28959c604"
     },
     {
       "path": "modules/hall-ui/public/work.html",
@@ -5512,7 +5512,7 @@
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "ccf5a2bad033e97bf0a3ed1105beac415df9191afd9d5778185ef6da5caee3a9"
+      "sha256": "b645f234ad549dc245a3a4f066b841ddfa6888a619db8ce3816f8e91b3af7a17"
     },
     {
       "path": "modules/hall-ui/public/work.states.json",
@@ -8182,12 +8182,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "886b77d3e78846e2ac7160ee992c62370feca07cedeac66ae1e71c0f4723f5a7"
+      "sha256": "1b91fb64b2d18219b4433b0ef6589de4488e9d7d78db9a1af45268a1f2a51944"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c6b01ed3391c36e6a05936826c2926683568412b7d3b15d50deeeb5e970dce15"
+      "sha256": "6b994df4ca85e51d032ee640a4aa4b6dfb57d82581a840eb5de5f05a0b831ee3"
     },
     {
       "path": "public-docs/index.html",
@@ -10232,7 +10232,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bc208fde6a6f87de913925e670e21c54db09f8797b7e0a0f773b5d83d2fe200f"
+      "sha256": "34e569846f695b7f3b69061619a97ab92cda5a4262a67f6c016f31edaf984714"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14592,7 +14592,7 @@
     {
       "path": "tests/update_subscription_engine.mjs",
       "mode": "0000644",
-      "sha256": "a083174381f10d1cd19795b43580a3113c4f758e4b98da1f7c8e389429cb6a26"
+      "sha256": "636c22e03dfa436c4cb30b59bdeb2d5085cb38e027b32dfc77cc000e4fd6569c"
     },
     {
       "path": "tests/upgrade.mjs",
@@ -14729,6 +14729,11 @@
       "mode": "0000644",
       "sha256": "2dc90311d8a4f31b543ed7ef711b4d3fc8b387a241bf0bbe797ab360107eac38"
     },
+    {
+      "path": "tests/work_title_wrap.mjs",
+      "mode": "0000644",
+      "sha256": "fb42c5fd94bcbd0c968ede7da4026604ff56eed2974be81b370fde08d9fea1df"
+    },
     {
       "path": "tests/workflow_exec_paths.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2462,5 +2462,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.992 with no explicit bump. run 35920872835. (task 1002620)
   1.19.994 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.993 with no explicit bump. run 35929622479. (task 1002620)
+  1.19.995 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.994 with no explicit bump. run 35933457545. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/work.css

@@ -109,7 +109,9 @@
   color: var(--ink-faint);
   font-variant-numeric: tabular-nums; min-width: 3.2em;
 }
-.history__title { flex: 1 1 auto; color: var(--ink); min-width: 0; }
+/* work.js breaks a title after each "/" (a slash-joined run ran 44px past its column
+   at 390, task 1004209); `anywhere` is the backstop for a run with no slash at all. */
+.history__title { flex: 1 1 auto; color: var(--ink); min-width: 0; overflow-wrap: anywhere; }
 /* task 1003828 — the goal a backlog row belongs to, on its own line under the
    title. The SUB-LINE voice (the .scroll__lede tone), not a tag: a tag would read
    as one more equal chip beside version/discipline/rank, and where a task LIVES

package/modules/hall-ui/public/work.js

@@ -1050,7 +1050,7 @@
       return `
         <div class="history__row">
           <span class="history__id">#${escapeHtml(String(t.id))}</span>
-          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver}</span>
+          <span class="history__title">${escapeHtml(t.title || '(untitled)').replace(/\//g, '/<wbr>')} ${ver}</span>
           <span class="history__when" title="${escapeHtml(fmtDate(t.shipped_at))}">${escapeHtml(when)}</span>
         </div>
       `;
@@ -1115,7 +1115,7 @@
       return `
         <div class="history__row" data-task-id="${escapeHtml(String(t.id))}" title="Open task #${escapeHtml(String(t.id))}">
           <span class="history__id">#${escapeHtml(String(t.id))}</span>
-          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver} ${disciplineTag} ${rankTagHtml(t.requires_rank)}<br>${goalTag}</span>
+          <span class="history__title">${escapeHtml(t.title || '(untitled)').replace(/\//g, '/<wbr>')} ${ver} ${disciplineTag} ${rankTagHtml(t.requires_rank)}<br>${goalTag}</span>
           <span class="history__when">${window.OTB.kindIsUnset(t.kind) ? '' : escapeHtml(t.kind)}</span>
         </div>`;
     }).join('');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.994",
+  "version": "1.19.995",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.994",
+      "version": "1.19.995",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.994",
+  "version": "1.19.995",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.994'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.995'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/update_subscription_engine.mjs

@@ -35,6 +35,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
@@ -475,3 +476,293 @@ test('both commitPin successes report committed:true', () => {
   assert.equal(S.commitPin({ dir: '/srv/demo', message: 'm' }, fakeGit({ dirty: [] }).run, () => {}).committed, undefined,
     'an already-clean tree committed nothing and must not be counted as a heal');
 });
+
+// ---------------------------------------------------------------------------
+// 10. the THIRD bucket — what the lane itself generated (task 1003968)
+//
+// pinState sorted a dirty worktree two ways: "the pin" (ours to commit) and
+// "everything else" (a human's work — halt). An upgrade's OWN output is neither,
+// and every bump produces it: materializeClaude rewrites `.claude/` and
+// regenerateApiArtifacts rewrites the OpenAPI spec + typed client. So on any run
+// that did not commit that output, the lane halted on its own exhaust:
+//
+//   • pinMode `leave-dirty` — which commits NOTHING by definition — reached
+//     healDecision's `other`-first check on every sweep after its first upgrade
+//     and returned `halt` for a mode whose entire premise is that the tree may
+//     stay dirty. The `by-design` branch beneath it was unreachable.
+//   • the direct engine on a core too old for --pin-no-push, where pinFlagsFor
+//     correctly withholds every flag and leaves the same output behind.
+//
+// The fix is a provenance answer, not a wider guard: laneGeneratedPaths asks the
+// instance's OWN core what this upgrade rewrites, pinState sorts by it, and
+// commitPin stages that bucket while its refusal stays keyed on everything else.
+// ---------------------------------------------------------------------------
+
+// A resolveFrom/load pair standing in for the target instance's core, so the probe is
+// exercised without a second core on disk.
+function fakeCore({ api, willRewrite, upgradeThrows = false, materializeThrows = false } = {}) {
+  const seen = [];
+  const resolveFrom = (dir, rel) => {
+    if (rel === 'scripts/gds/upgrade.js' && api === null) return null;
+    if (rel === 'scripts/gds/claude-materialize.js' && willRewrite === null) return null;
+    return path.join(dir, 'node_modules', '@bongos', 'core', rel);
+  };
+  const load = (p) => {
+    if (p.endsWith('upgrade.js')) {
+      if (upgradeThrows) throw new Error('an older core cannot be loaded here');
+      return { API_ARTIFACT_FILES: api || {} };
+    }
+    if (materializeThrows) throw new Error('materialize blew up');
+    return { materializeWillRewrite: willRewrite === undefined ? undefined : (args) => { seen.push(args); return willRewrite; } };
+  };
+  return { resolveFrom, load, seen };
+}
+
+test('laneGeneratedPaths unions the API artifacts with what materialize WOULD rewrite', () => {
+  const core = fakeCore({
+    api: { 'gen-api-docs.js': ['docs/api/openapi.json'], 'gen-api-client.js': ['clients/bongos-client/index.mjs'] },
+    willRewrite: ['.claude/skills/builder-ship/SKILL.md', '.claude/settings.json'],
+  });
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', core).sort(), [
+    '.claude/settings.json',
+    '.claude/skills/builder-ship/SKILL.md',
+    'clients/bongos-client/index.mjs',
+    'docs/api/openapi.json',
+  ]);
+});
+
+test('laneGeneratedPaths derives coreRoot from where the module RESOLVED', () => {
+  // Not from a package-name guess: an instance may carry the core under any of its
+  // published names, and materializeWillRewrite's own default only knows the first.
+  const core = fakeCore({ api: {}, willRewrite: [] });
+  S.laneGeneratedPaths('/srv/demo', core);
+  assert.equal(core.seen.length, 1);
+  assert.equal(core.seen[0].instanceDir, '/srv/demo');
+  assert.equal(path.resolve(core.seen[0].coreRoot), path.resolve('/srv/demo/node_modules/@bongos/core'));
+});
+
+test('laneGeneratedPaths is FAIL-SOFT in every direction — an empty set, never a guessed one', () => {
+  // The direction matters. An instance this cannot interrogate keeps the OLD, stricter guard
+  // (still wedged, and visibly so), rather than gaining a looser one that commits a stranger's work.
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: null, willRewrite: null })), []);
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: {}, willRewrite: undefined })), []);
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ upgradeThrows: true, materializeThrows: true })), []);
+  // A core that exports API_ARTIFACT_FILES but whose materialize throws still contributes the
+  // half it could answer for.
+  assert.deepEqual(
+    S.laneGeneratedPaths('/srv/demo', fakeCore({ api: { g: ['docs/api/openapi.json'] }, materializeThrows: true })),
+    ['docs/api/openapi.json'],
+  );
+});
+
+test('the core still exports the two things the probe reads', () => {
+  // laneGeneratedPaths reads them BY NAME off a module it resolves at runtime, so a rename in the
+  // core degrades it silently to the empty set — the pre-fix wedge, back again and invisible.
+  // This is the cross-file contract, pinned here the way GO_LIVE_REQUIRED is.
+  const up = require('../scripts/gds/upgrade.js');
+  const mat = require('../scripts/gds/claude-materialize.js');
+  assert.equal(typeof up.API_ARTIFACT_FILES, 'object', 'upgrade.js no longer exports API_ARTIFACT_FILES');
+  assert.ok(Object.values(up.API_ARTIFACT_FILES).flat().includes('docs/api/openapi.json'));
+  assert.equal(typeof mat.materializeWillRewrite, 'function', 'claude-materialize.js no longer exports materializeWillRewrite');
+});
+
+test('pinState sorts the lane\'s own output into its own bucket, and nothing else with it', () => {
+  const g = fakeGit({ dirty: ['package.json', '.claude/settings.json', 'config/branding.json'] });
+  const st = S.pinState('/srv/demo', g.run, ['.claude/settings.json']);
+  assert.deepEqual(st.pin.map((e) => e.file), ['package.json']);
+  assert.deepEqual(st.generated.map((e) => e.file), ['.claude/settings.json']);
+  assert.deepEqual(st.other.map((e) => e.file), ['config/branding.json'], 'an owner edit is still a human\'s work');
+});
+
+test('pinState called with no generated set behaves exactly as it always did', () => {
+  // Every pre-existing caller passes two arguments; the third bucket must be opt-in.
+  const g = fakeGit({ dirty: ['package.json', '.claude/settings.json'] });
+  const st = S.pinState('/srv/demo', g.run);
+  assert.deepEqual(st.generated, []);
+  assert.deepEqual(st.other.map((e) => e.file), ['.claude/settings.json']);
+});
+
+test('healDecision: leave-dirty finally reaches by-design, because the dirt is the lane\'s own', () => {
+  const pre = S.pinState('/srv/demo', fakeGit({ dirty: ['package.json', '.claude/settings.json'] }).run, ['.claude/settings.json']);
+  assert.deepEqual(S.healDecision(pre, 'leave-dirty'), { action: 'by-design' });
+  assert.deepEqual(S.healDecision(pre, 'local-commit'), { action: 'commit', push: false });
+  assert.deepEqual(S.healDecision(pre, 'push'), { action: 'commit', push: true });
+});
+
+test('healDecision: an owner\'s edit still halts EVERY mode, leave-dirty included', () => {
+  // leave-dirty licenses the LANE's dirt, not a stranger's. That is why the order inside
+  // healDecision stays dirt-before-mode rather than being flipped.
+  const pre = S.pinState('/srv/demo', fakeGit({ dirty: ['package.json', '.claude/settings.json', 'src/thing.js'] }).run, ['.claude/settings.json']);
+  for (const mode of S.PIN_MODES) assert.deepEqual(S.healDecision(pre, mode), { action: 'halt' }, `mode ${mode}`);
+});
+
+test('preflightFlagsFor: only leave-dirty gets --force, and it gets nothing else', () => {
+  assert.deepEqual(S.preflightFlagsFor('leave-dirty'), ['--force']);
+  assert.deepEqual(S.preflightFlagsFor('local-commit'), []);
+  assert.deepEqual(S.preflightFlagsFor('push'), []);
+  assert.deepEqual(S.preflightFlagsFor(undefined), []);
+});
+
+test('preflightFlagsFor has the precedent it claims — go-live.js really does send --force', () => {
+  const body = readFileSync(path.join(ROOT, 'scripts', 'gds', 'go-live.js'), 'utf8')
+    .split('function upgradeCommand(')[1].split('\n}')[0];
+  assert.match(body, /'--force'/, 'go-live upgradeCommand() no longer sends --force — re-derive preflightFlagsFor from it');
+});
+
+test('the direct-upgrade fallback asks preflightFlagsFor rather than deciding inline', () => {
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  assert.match(src, /upArgs\.push\(\.\.\.preflightFlagsFor\(pinMode\)\)/,
+    'the clean-tree policy is a pin-mode decision and must go through the named function');
+});
+
+test('every commitPin call site in the lane also decides what the upgrade generated', () => {
+  // The sibling of the push assertion in section 8, and for the same reason: a site that inherits
+  // the `generated = []` default silently reverts to the two-bucket guard that wedged the lane.
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  const calls = [];
+  const re = /commitPin\(\{/g;
+  let m;
+  while ((m = re.exec(src)) !== null) {
+    if (src.slice(Math.max(0, m.index - 9), m.index) === 'function ') continue;
+    let depth = 0, end = m.index;
+    for (let i = src.indexOf('{', m.index); i < src.length; i++) {
+      if (src[i] === '{') depth++;
+      else if (src[i] === '}' && --depth === 0) { end = i + 1; break; }
+    }
+    calls.push(src.slice(m.index, end));
+  }
+  assert.ok(calls.length >= 3, `expected the three known pin-writing call sites, found ${calls.length}`);
+  for (const c of calls) assert.match(c, /generated(: generatedAfter)?,/, `a commitPin call site does not pass the generated set:\n${c}`);
+});
+
+// ---------------------------------------------------------------------------
+// 11. real git — the wedge, and the un-wedge
+//
+// The cases above pin each decision on its own; these drive the same three functions
+// against a real repository, because the failure was never inside one decision. It was
+// that all three agreed on a sorting which did not describe what an upgrade leaves
+// behind — and a hand-written `git status` cannot show that.
+// ---------------------------------------------------------------------------
+
+function realGit(dir, ...args) { return spawnSync('git', ['-C', dir, ...args], { encoding: 'utf8' }); }
+function put(dir, rel, body) {
+  const p = path.join(dir, rel);
+  mkdirSync(path.dirname(p), { recursive: true });
+  writeFileSync(p, body);
+}
+
+// A provisioned co-tenant mid-lane: scaffolded + committed, then ONE upgrade applied that moved
+// the pin, re-materialized `.claude/` and regenerated the API artifacts — committing none of it,
+// which is exactly what pinMode leave-dirty asks for.
+function coTenantAfterOneUpgrade() {
+  const dir = mkdtempSync(path.join(tmpdir(), 'lane-cotenant-'));
+  realGit(dir, 'init', '-q');
+  realGit(dir, 'config', 'user.email', 'lane-test@example.invalid');
+  realGit(dir, 'config', 'user.name', 'lane test');
+  realGit(dir, 'config', 'core.autocrlf', 'false');
+  put(dir, 'package.json', JSON.stringify({ dependencies: { '@bongos/core': '1.19.737' } }));
+  put(dir, 'package-lock.json', 'lock 1.19.737\n');
+  put(dir, '.claude/settings.json', '{"from":"1.19.737"}\n');
+  put(dir, '.claude/skills/builder-ship/SKILL.md', '# builder-ship (1.19.737)\n');
+  put(dir, 'docs/api/openapi.json', '{"core":"1.19.737"}\n');
+  put(dir, 'config/branding.json', '{"identity":{}}\n');
+  realGit(dir, 'add', '-A');
+  realGit(dir, 'commit', '-q', '-m', 'scaffold');
+  // …then one upgrade, with nothing committed after it.
+  put(dir, 'package.json', JSON.stringify({ dependencies: { '@bongos/core': '1.19.785' } }));
+  put(dir, 'package-lock.json', 'lock 1.19.785\n');
+  put(dir, '.claude/settings.json', '{"from":"1.19.785"}\n');
+  put(dir, '.claude/skills/builder-ship/SKILL.md', '# builder-ship (1.19.785)\n');
+  put(dir, '.claude/skills/new-in-785/SKILL.md', '# a skill this core added\n'); // untracked
+  put(dir, 'docs/api/openapi.json', '{"core":"1.19.785"}\n');
+  return dir;
+}
+
+// What laneGeneratedPaths answers for that upgrade.
+const GENERATED = [
+  '.claude/settings.json', '.claude/skills/builder-ship/SKILL.md',
+  '.claude/skills/new-in-785/SKILL.md', 'docs/api/openapi.json',
+];
+
+test('real git: the WEDGE — under the old two-way sorting every mode halts, leave-dirty included', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync); // no generated set = the pre-fix behaviour
+  assert.ok(pre.other.length, 'the upgrade\'s own output landed in the human-work bucket');
+  for (const mode of S.PIN_MODES) {
+    assert.deepEqual(S.healDecision(pre, mode), { action: 'halt' }, `mode ${mode} halted here, every sweep, forever`);
+  }
+});
+
+test('real git: the UN-WEDGE — leave-dirty takes a second sweep with no human hands', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(pre.other, [], 'nothing dirty here is a human\'s work');
+  assert.deepEqual(S.healDecision(pre, 'leave-dirty'), { action: 'by-design' });
+  // …and the sweep then hands upgrade.js the flag that lets the bump past its own clean-tree
+  // pre-flight, which the deliberately-dirty pin would otherwise refuse.
+  assert.deepEqual(S.preflightFlagsFor('leave-dirty'), ['--force']);
+});
+
+test('real git: local-commit heals the lane\'s own leftovers, tracked and untracked', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(S.healDecision(pre, 'local-commit'), { action: 'commit', push: false });
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, true, r.reason);
+  assert.equal(r.action, 'committed-local');
+  assert.equal(realGit(dir, 'status', '--porcelain').stdout, '', 'the next sweep finds a clean tree');
+  const committed = realGit(dir, 'show', '--name-only', '--format=', 'HEAD').stdout;
+  for (const f of ['package.json', 'package-lock.json', ...GENERATED]) {
+    assert.ok(committed.includes(f), `${f} rode the pin commit`);
+  }
+});
+
+test('real git: an OWNER\'s edit is still never swept into the lane\'s commit', () => {
+  const dir = coTenantAfterOneUpgrade();
+  put(dir, 'config/branding.json', '{"the owner":"was here"}\n');          // tracked
+  put(dir, '.claude/skills/my-own-skill/SKILL.md', 'hand-written\n');      // untracked
+  const st = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(st.other.map((e) => e.file).sort(), ['.claude/skills/my-own-skill/SKILL.md', 'config/branding.json']);
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, false);
+  assert.equal(r.action, 'refused');
+  assert.equal(realGit(dir, 'rev-list', '--count', 'HEAD').stdout.trim(), '1', 'nothing was committed at all');
+  assert.match(realGit(dir, 'status', '--porcelain').stdout, /config\/branding\.json/, 'and the edit is still theirs');
+});
+
+test('real git: a tree holding ONLY the lane\'s own output still commits — the pin need not be dirty', () => {
+  // The shape a rollback leaves behind: the pin restored to what is committed, the regenerated
+  // artifacts not. Answering `already-clean` here would strand them and wedge the next sweep.
+  const dir = coTenantAfterOneUpgrade();
+  realGit(dir, 'checkout', '--', 'package.json', 'package-lock.json');
+  const st = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(st.pin, []);
+  assert.ok(st.generated.length);
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, true, r.reason);
+  assert.equal(r.committed, true);
+  assert.equal(realGit(dir, 'status', '--porcelain').stdout, '');
+});
+
+test('real git: a genuinely clean tree is still a no-op', () => {
+  const dir = coTenantAfterOneUpgrade();
+  realGit(dir, 'add', '-A'); realGit(dir, 'commit', '-q', '-m', 'by hand');
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.action, 'already-clean');
+  assert.equal(r.committed, undefined);
+});
+
+test('the post-upgrade net re-probes, rather than reusing the set from before the bump', () => {
+  // A skill the NEW core adds is absent from the pre-upgrade answer, so reusing it would drop that
+  // file into `other` and wedge the lane one release later — this defect again, wearing the next
+  // version number. The heal, which runs BEFORE the bump, must keep using the pre-bump set.
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  const afterSpawn = src.split('const generatedAfter = laneGeneratedPaths(inst.dir);')[1];
+  assert.ok(afterSpawn, 'the post-upgrade re-probe is gone');
+  assert.equal((afterSpawn.match(/generated: generatedAfter,/g) || []).length, 2,
+    'both post-upgrade commitPin sites (the rollback tidy and the durability net) must use the re-probed set');
+  assert.match(afterSpawn, /pinState\(inst\.dir, spawnSync, generatedAfter\)/);
+  const beforeSpawn = src.split('const generatedAfter = laneGeneratedPaths(inst.dir);')[0];
+  assert.match(beforeSpawn, /const pre = pinState\(inst\.dir, spawnSync, generated\);/,
+    'the heal runs before the bump, so it reads the core installed THEN');
+});

package/tests/work_title_wrap.mjs

@@ -0,0 +1,38 @@
+// tests/work_title_wrap.mjs — a Work board title wraps inside its column (task 1004209).
+//
+// At 390 the backlog title "Watch redesign: … People/Operations/Security tabs" ran
+// 44px past its column: a slash-joined run offers the browser no break point. The
+// rendered check (scripts/gds/render-check.js) is what measures it; this pins the
+// two halves of the fix in source so neither is dropped by an unrelated edit.
+//
+// Run:  node tests/work_title_wrap.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const WORK_SRC = read('modules/hall-ui/public/work.js');
+const WORK_CSS = read('modules/hall-ui/public/work.css');
+
+const { test, summary } = makeRunner();
+
+await test('every history title breaks after a slash, and only after escaping', () => {
+  const sites = WORK_SRC.match(/<span class="history__title">[^\n]*/g) || [];
+  assert.equal(sites.length, 2, 'the backlog and completed rows both render a history title');
+  for (const s of sites) {
+    assert.ok(s.includes("escapeHtml(t.title || '(untitled)').replace(/\\//g, '/<wbr>')"),
+      `the <wbr> goes in AFTER escapeHtml, so a title cannot inject markup: ${s.trim()}`);
+  }
+});
+
+await test('the break-anything backstop stays on .history__title', () => {
+  const rule = WORK_CSS.match(/^\.history__title \{[^}]*\}/m);
+  assert.ok(rule, '.history__title rule present');
+  assert.match(rule[0], /overflow-wrap:\s*anywhere/, 'a run with no slash still wraps instead of running out of the column');
+  assert.match(rule[0], /min-width:\s*0/, 'a flex item needs min-width: 0 to shrink below its longest word');
+});
+
+summary();