@bongos/core 1.19.994 → 1.19.996

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.994",
-  "core_contract": "1.19.994",
-  "source_commit": "2d0c99af93af0f1d1728f6fce1dbce057f209d4c",
+  "core_version": "1.19.996",
+  "core_contract": "1.19.996",
+  "source_commit": "5929da0385a4022562ebd43a5a71d81400e45836",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T22:40:55.441Z",
+  "built_at": "2026-09-23T23:40:05.075Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 519,
+    "docs_redacted": 520,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2404,
+    "functional_verbatim": 2405,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2949,
-  "tree_sha256": "4b408d832b68004c07a3d8ad8143cc76a7a5c40c651ba47878f8ae27230568c6",
+  "file_count": 2951,
+  "tree_sha256": "cd26f1916edf3136e53591dc18c37ed45254dd805880bf4b25bc1af1c59baf93",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2717,7 +2717,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "aff2b4b93d88dd46eb74dacd0d51c4a959d1a860b9fda1646f3bd2c842780885"
+      "sha256": "950ea34b2bb315e54fc02aa22753b3370ee009ab06727238002aa3a54e78782e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2924,6 +2924,11 @@
       "mode": "0000644",
       "sha256": "f6d2bb1da53f03f54080b8e0aec9f63390d3343c32917b64225ac47ae4ba7b42"
     },
+    {
+      "path": "docs/recipes/render-pilot.md",
+      "mode": "0000644",
+      "sha256": "7b5f391285931a5f5e1bd31683702d534e9876d55ce5a0794e7d8eeec52fc2f3"
+    },
     {
       "path": "docs/recipes/reranking-a-goals-board.md",
       "mode": "0000644",
@@ -5502,7 +5507,7 @@
     {
       "path": "modules/hall-ui/public/work.css",
       "mode": "0000644",
-      "sha256": "68399594a00fdffaf9833d3105d8c9e2f5872642b0f49868edae6cc526fa9021"
+      "sha256": "12b5c9aefa39b8922a5a5a8585a107779bc15678b120cf00239584e28959c604"
     },
     {
       "path": "modules/hall-ui/public/work.html",
@@ -5512,7 +5517,7 @@
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "ccf5a2bad033e97bf0a3ed1105beac415df9191afd9d5778185ef6da5caee3a9"
+      "sha256": "b645f234ad549dc245a3a4f066b841ddfa6888a619db8ce3816f8e91b3af7a17"
     },
     {
       "path": "modules/hall-ui/public/work.states.json",
@@ -8182,12 +8187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "886b77d3e78846e2ac7160ee992c62370feca07cedeac66ae1e71c0f4723f5a7"
+      "sha256": "6d4291f9e503ac170998451d6607d15f831d39cd43aaa2443ada021e10386f13"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c6b01ed3391c36e6a05936826c2926683568412b7d3b15d50deeeb5e970dce15"
+      "sha256": "50946900cdbd241bfe7a8ac94d4b50b65a9adb622f2debdd2048354a2ead38e4"
     },
     {
       "path": "public-docs/index.html",
@@ -10232,7 +10237,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bc208fde6a6f87de913925e670e21c54db09f8797b7e0a0f773b5d83d2fe200f"
+      "sha256": "899926ec43a4f0087125deada1bf430aa5f34bd1b3f32ab65ff2ffea981431a3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14592,7 +14597,7 @@
     {
       "path": "tests/update_subscription_engine.mjs",
       "mode": "0000644",
-      "sha256": "a083174381f10d1cd19795b43580a3113c4f758e4b98da1f7c8e389429cb6a26"
+      "sha256": "636c22e03dfa436c4cb30b59bdeb2d5085cb38e027b32dfc77cc000e4fd6569c"
     },
     {
       "path": "tests/upgrade.mjs",
@@ -14729,6 +14734,11 @@
       "mode": "0000644",
       "sha256": "2dc90311d8a4f31b543ed7ef711b4d3fc8b387a241bf0bbe797ab360107eac38"
     },
+    {
+      "path": "tests/work_title_wrap.mjs",
+      "mode": "0000644",
+      "sha256": "fb42c5fd94bcbd0c968ede7da4026604ff56eed2974be81b370fde08d9fea1df"
+    },
     {
       "path": "tests/workflow_exec_paths.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2462,5 +2462,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.992 with no explicit bump. run 35920872835. (task 1002620)
   1.19.994 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.993 with no explicit bump. run 35929622479. (task 1002620)
+  1.19.995 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.994 with no explicit bump. run 35933457545. (task 1002620)
+  1.19.996 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.995 with no explicit bump. run 35934673169. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/render-pilot.md

@@ -0,0 +1,218 @@
+# Recipe — the Render pilot, on a throwaway `mercury` clone
+
+The executable half of [task 1004142](https://cloudbongos.com/builders#/task/1004142): stand one Bongos instance up on Render, end to end, and answer the questions [task 1004183](https://cloudbongos.com/builders#/task/1004183) (the standup leg) will be written against. Governed by [ADR 0327](../adr/0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md); platform choice from [ADR 0323](../adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md).
+
+**Who runs this.** Whoever holds the Render key — under ADR 0327 that is the *project owner*, and for the pilot it is the platform owner. An agent session cannot run it unless someone has put a key in front of it, and a key must never be pasted into a chat.
+
+**The API shape below was read from Render's own reference on 2026-09-23** (`api-docs.render.com`), not inferred. Where this recipe and a live response disagree, the response wins and this file is the bug.
+
+---
+
+## 0. Before you start — three things worth knowing
+
+**The pilot costs money, and the free tier cannot prove it.** Done-when clause 4 is "its database is backed up by Render rather than by our timer". Render's **free Postgres has no backups of any kind** — no logical backups, no PITR. Only paid databases are continually backed up (3 days of recovery window on Hobby, 7 on Pro). So the pilot must run a **paid** Postgres or clause 4 is unprovable. Budget `0.1c-256mb` ($6/mo) + `0.5c-512mb` web ($7/mo), prorated for the hours the pilot is up, and tear it down when finished.
+
+**The key is account-wide, not workspace-wide.** `GET /owners` returns every workspace the key's *user* can reach, including other people's teams. This is the finding that produced ADR 0327, and step 1 exists to confirm it on live responses before anything is created.
+
+**Do not touch live `mercury`.** Row 31 is a real owner's project, serving from our box today. Clone its *repo* to a scratch repo under an account we control, and stand the clone up under a scratch slug. Nothing in this recipe writes to row 31, to `willHermesLines/mercury_bongos`, or to that owner's Render account.
+
+Set up once:
+
+```bash
+export RENDER_TOKEN=...   # in your shell, not in a file, not in chat
+export R="curl -sS -H \"Authorization: Bearer $RENDER_TOKEN\" -H 'Content-Type: application/json'"
+```
+
+Base URL is `https://api.render.com/v1`; auth is `Authorization: Bearer <key>`.
+
+---
+
+## 1. The `ownerId` guard — confirm the finding BEFORE creating anything
+
+This is the pilot's most important output, because every call the standup leg later writes depends on it.
+
+```bash
+curl -sS -H "Authorization: Bearer $RENDER_TOKEN" https://api.render.com/v1/owners | jq
+```
+
+Each element is `{ owner: { id, name, email, type }, cursor }`, where `type` is `user` or `team`.
+
+**Record:** how many workspaces come back, which are not ours, and their ids. Then pick the Bongos workspace's `id` and pin it:
+
+```bash
+export RENDER_OWNER_ID=...
+```
+
+**Then prove the hazard rather than assuming it.** List a resource *without* `ownerId` and check whether another workspace's resources appear:
+
+```bash
+curl -sS -H "Authorization: Bearer $RENDER_TOKEN" 'https://api.render.com/v1/services?limit=100' \
+  | jq '[.[].service | {id, name, ownerId}] | group_by(.ownerId) | map({ownerId: .[0].ownerId, n: length})'
+```
+
+If more than one `ownerId` comes back from a key that was only ever meant for one workspace, the finding is confirmed and the guard is mandatory. **Record the actual output either way** — a negative result is just as useful and would narrow ADR 0327's §"required guard".
+
+**The rule the standup leg must implement, whatever this shows:**
+
+- Send an explicit `ownerId` on every call. It is *required* on `POST /services` and `POST /postgres`, and it is *optional* on the list calls — which is exactly where the hazard lives.
+- Assert `ownerId` on the **response**, not the request. A request you got right tells you nothing about a response that came from elsewhere.
+- Treat missing or mismatched as a hard error. Never default it, and never derive the workspace by taking the first element of `/owners`.
+
+---
+
+## 2. Clone the repo
+
+`mercury`'s instance row carries `target_ref=willHermesLines/mercury_bongos` and `onboard_mode=adopt`. Clone it to a scratch repo you own — this is the pilot's subject and it is disposable.
+
+```bash
+git clone https://github.com/willHermesLines/mercury_bongos /tmp/mercury-clone
+cd /tmp/mercury-clone && git remote remove origin
+gh repo create <you>/render-pilot --private --source=. --push
+```
+
+**Record:** whether the repo is public or private, and under which account. That feeds the open question in step 5.
+
+---
+
+## 3. Create the Postgres
+
+```bash
+curl -sS -X POST -H "Authorization: Bearer $RENDER_TOKEN" -H 'Content-Type: application/json' \
+  https://api.render.com/v1/postgres -d '{
+    "name": "render-pilot-db",
+    "ownerId": "'"$RENDER_OWNER_ID"'",
+    "plan": "basic_256mb",
+    "region": "virginia",
+    "version": "16"
+  }' | jq
+```
+
+`plan`, `ownerId`, `name` and `version` are all required. `databaseName` and `databaseUser` are generated if omitted. **`plan` must not be `free`** — see §0. Region `virginia` is the closest US region to the current droplet (`PROVISION_REGION=nyc3`).
+
+Then read the connection string:
+
+```bash
+curl -sS -H "Authorization: Bearer $RENDER_TOKEN" \
+  https://api.render.com/v1/postgres/<postgresId>/connection-info | jq
+```
+
+Returns `password`, `internalConnectionString`, `externalConnectionString`, `psqlCommand`, and optionally the pooled variants. **Assert the `ownerId` on the create response before going further.**
+
+---
+
+## 4. Create the web service
+
+Bongos reads `DATABASE_URL` first and falls back to the `PG*` family (`src/bongos/pool.js:56`), so Render's connection string wires in directly — **none of the `PGHOST`/`PGDATABASE`/`PGUSER`/`PGPASSWORD` lines `webEnvBody` writes on the box are needed here.** That is the single biggest simplification Render buys, and it is worth stating in the standup leg's comments.
+
+The env prefix is **`BONGOS`** (`config/branding.neutral.json` → `envPrefix`). The variables below are the Render translation of `webEnvBody` in `scripts/gds/provision-units.js:192` — read that function, not this list, if the two ever disagree.
+
+```bash
+curl -sS -X POST -H "Authorization: Bearer $RENDER_TOKEN" -H 'Content-Type: application/json' \
+  https://api.render.com/v1/services -d '{
+    "type": "web_service",
+    "name": "render-pilot",
+    "ownerId": "'"$RENDER_OWNER_ID"'",
+    "repo": "https://github.com/<you>/render-pilot",
+    "branch": "main",
+    "autoDeploy": "yes",
+    "serviceDetails": {
+      "runtime": "node",
+      "plan": "0.5c-512mb",
+      "region": "virginia",
+      "healthCheckPath": "/healthz",
+      "envSpecificDetails": {
+        "buildCommand": "npm ci",
+        "startCommand": "npm start"
+      }
+    },
+    "envVars": [
+      { "key": "DATABASE_URL",            "value": "<internalConnectionString>" },
+      { "key": "BONGOS_GITHUB_CLIENT_ID", "value": "" },
+      { "key": "BONGOS_GITHUB_CLIENT_SECRET", "value": "" },
+      { "key": "BONGOS_FIRST_ADMIN",      "value": "<your-github-login>" },
+      { "key": "BONGOS_PUBLIC_ORIGIN",    "value": "https://render-pilot.onrender.com" },
+      { "key": "BONGOS_BUILDERS_ORIGIN",  "value": "https://render-pilot.onrender.com" },
+      { "key": "BONGOS_STATUS_ORIGIN",    "value": "https://render-pilot.onrender.com" },
+      { "key": "BONGOS_OAUTH_ORIGIN",     "value": "https://render-pilot.onrender.com" }
+    ]
+  }' | jq
+```
+
+Notes that matter:
+
+- **`PORT` is not set by us.** Render injects it; `webEnvBody` writes it because the box allocates ports itself. One more line the standup leg drops.
+- **The four origin overrides are load-bearing, not cosmetic.** Without them `src/branding.js` stays on neutral localhost and the hall never loads (task 1972). They must be the Render hostname, and they must all four be the same host — a single-host instance has no separate `builders.`/`status.` subdomain.
+- **`BONGOS_FIRST_ADMIN` is what seats you as Archon** on first sign-in. Omit it and the instance has no owner and you can never claim it (the 2026-07-07 `demo` regression).
+- **OAuth creds start blank** and are filled after the app exists — see step 5.
+- `PGPOOL_MAX` is read bare and still applies. On `basic_256mb` the connection ceiling is low; if the app struggles to connect, set it small (the box uses `PROVISION_INSTANCE_PGPOOL_MAX`).
+- Do **not** send a `secretFiles` entry for the GitHub App PEM until you know whether the App path is in scope for the pilot; blank OAuth is enough to prove boot.
+
+---
+
+## 5. Sign-in, and the open question the pilot exists to answer
+
+Create a GitHub OAuth app (or App) whose callback is the Render hostname, then set `BONGOS_GITHUB_CLIENT_ID` / `_SECRET` via `PATCH /services/{id}/env-vars/{key}` and redeploy.
+
+**The question ADR 0327 left for this pilot:** can Render's GitHub App reach a repo under a **personal** account rather than an org, and what does that mean for a project whose repo we do not own? Record:
+
+- Which GitHub account/org the pilot repo sits under, and whether Render's GitHub App installed onto it without friction.
+- Whether a *private* repo under someone else's personal account is reachable at all.
+- What the owner has to click, since under ADR 0327 the repo and the Render account are both theirs.
+
+This is the answer that decides whether `cloud-host` standup is one API sequence or a sequence plus a human step — and therefore how much friction `cloud-host` actually removes over `byo-host`.
+
+---
+
+## 6. Migrations
+
+Run `migrate.sh` against the Render database. Prefer a Render **job** or the service's own shell over your laptop, so the run happens from inside Render's network on the `internalConnectionString`; the `externalConnectionString` works from outside but is not what production will use.
+
+Then confirm no schema lag:
+
+```bash
+curl -sS https://render-pilot.onrender.com/version | jq
+```
+
+---
+
+## 7. Custom domain (optional for the pilot, required for the model)
+
+ADR 0323 keeps **Cloudflare DNS as the front door** and drops the Caddy site block, because Render terminates TLS. Prove the chain end to end at least once:
+
+```bash
+curl -sS -X POST -H "Authorization: Bearer $RENDER_TOKEN" -H 'Content-Type: application/json' \
+  https://api.render.com/v1/services/<serviceId>/custom-domains -d '{"name": "render-pilot.cloudbongos.com"}' | jq
+```
+
+Then point the Cloudflare record at Render and confirm the response header is **no longer `via: 1.1 Caddy`** — that header is precisely how we established the live `mercury` instance is still on our box, and its absence is the cleanest proof the front door moved.
+
+---
+
+## 8. Capture the evidence — the five done-when clauses
+
+Record each in the session log, with the actual output, not a claim that it worked:
+
+| # | Clause | Evidence |
+|---|---|---|
+| 1 | Boots | `GET /healthz` → 200, and the header does **not** say `via: 1.1 Caddy` |
+| 2 | Signs in | the OAuth round trip completes and seats you as Archon |
+| 3 | Migrations run | `migrate.sh` completes; `/version` reports no schema lag |
+| 4 | **Render backs up the DB** | a backup exists in Render's dashboard/API that we did not create — this is the clause that retires `provision-units.js`'s backup service + timer, and it needs a **paid** database |
+| 5 | GitHub App reach | written answer to §5 |
+
+Plus the three the standup leg is written from: the **exact call sequence** above with real request/response shapes, the **`ownerId` guard's live behaviour** from §1, and whether the **default plan sizes** held or mercury's larger choice was right.
+
+---
+
+## 9. Tear the clone down
+
+The pilot is disposable and it is costing money. Delete the web service, delete the Postgres, delete the scratch repo, and remove the Cloudflare record if you made one.
+
+**Note the asymmetry deliberately:** you are deleting resources in *your own* account, by hand. ADR 0327 decision 3 says the platform must never hold the ability to destroy infrastructure it does not own — `provision-teardown.js` retargets to *forgetting*, not to a Render delete call ([task 1004183](https://cloudbongos.com/builders#/task/1004183)). The fact that this step is manual is the design working, not a gap in it.
+
+---
+
+## Sources
+
+- [Render API reference](https://api-docs.render.com/reference/introduction) — endpoints, required fields, plan and region enums, read 2026-09-23
+- [Render Postgres Recovery and Backups](https://render.com/docs/postgresql-backups) — free plans have no backups; paid plans get PITR with 3-day (Hobby) / 7-day (Pro) windows

package/modules/hall-ui/public/work.css

@@ -109,7 +109,9 @@
   color: var(--ink-faint);
   font-variant-numeric: tabular-nums; min-width: 3.2em;
 }
-.history__title { flex: 1 1 auto; color: var(--ink); min-width: 0; }
+/* work.js breaks a title after each "/" (a slash-joined run ran 44px past its column
+   at 390, task 1004209); `anywhere` is the backstop for a run with no slash at all. */
+.history__title { flex: 1 1 auto; color: var(--ink); min-width: 0; overflow-wrap: anywhere; }
 /* task 1003828 — the goal a backlog row belongs to, on its own line under the
    title. The SUB-LINE voice (the .scroll__lede tone), not a tag: a tag would read
    as one more equal chip beside version/discipline/rank, and where a task LIVES

package/modules/hall-ui/public/work.js

@@ -1050,7 +1050,7 @@
       return `
         <div class="history__row">
           <span class="history__id">#${escapeHtml(String(t.id))}</span>
-          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver}</span>
+          <span class="history__title">${escapeHtml(t.title || '(untitled)').replace(/\//g, '/<wbr>')} ${ver}</span>
           <span class="history__when" title="${escapeHtml(fmtDate(t.shipped_at))}">${escapeHtml(when)}</span>
         </div>
       `;
@@ -1115,7 +1115,7 @@
       return `
         <div class="history__row" data-task-id="${escapeHtml(String(t.id))}" title="Open task #${escapeHtml(String(t.id))}">
           <span class="history__id">#${escapeHtml(String(t.id))}</span>
-          <span class="history__title">${escapeHtml(t.title || '(untitled)')} ${ver} ${disciplineTag} ${rankTagHtml(t.requires_rank)}<br>${goalTag}</span>
+          <span class="history__title">${escapeHtml(t.title || '(untitled)').replace(/\//g, '/<wbr>')} ${ver} ${disciplineTag} ${rankTagHtml(t.requires_rank)}<br>${goalTag}</span>
           <span class="history__when">${window.OTB.kindIsUnset(t.kind) ? '' : escapeHtml(t.kind)}</span>
         </div>`;
     }).join('');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.994",
+  "version": "1.19.996",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.994",
+      "version": "1.19.996",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.994",
+  "version": "1.19.996",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.994'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.996'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/update_subscription_engine.mjs

@@ -35,6 +35,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
@@ -475,3 +476,293 @@ test('both commitPin successes report committed:true', () => {
   assert.equal(S.commitPin({ dir: '/srv/demo', message: 'm' }, fakeGit({ dirty: [] }).run, () => {}).committed, undefined,
     'an already-clean tree committed nothing and must not be counted as a heal');
 });
+
+// ---------------------------------------------------------------------------
+// 10. the THIRD bucket — what the lane itself generated (task 1003968)
+//
+// pinState sorted a dirty worktree two ways: "the pin" (ours to commit) and
+// "everything else" (a human's work — halt). An upgrade's OWN output is neither,
+// and every bump produces it: materializeClaude rewrites `.claude/` and
+// regenerateApiArtifacts rewrites the OpenAPI spec + typed client. So on any run
+// that did not commit that output, the lane halted on its own exhaust:
+//
+//   • pinMode `leave-dirty` — which commits NOTHING by definition — reached
+//     healDecision's `other`-first check on every sweep after its first upgrade
+//     and returned `halt` for a mode whose entire premise is that the tree may
+//     stay dirty. The `by-design` branch beneath it was unreachable.
+//   • the direct engine on a core too old for --pin-no-push, where pinFlagsFor
+//     correctly withholds every flag and leaves the same output behind.
+//
+// The fix is a provenance answer, not a wider guard: laneGeneratedPaths asks the
+// instance's OWN core what this upgrade rewrites, pinState sorts by it, and
+// commitPin stages that bucket while its refusal stays keyed on everything else.
+// ---------------------------------------------------------------------------
+
+// A resolveFrom/load pair standing in for the target instance's core, so the probe is
+// exercised without a second core on disk.
+function fakeCore({ api, willRewrite, upgradeThrows = false, materializeThrows = false } = {}) {
+  const seen = [];
+  const resolveFrom = (dir, rel) => {
+    if (rel === 'scripts/gds/upgrade.js' && api === null) return null;
+    if (rel === 'scripts/gds/claude-materialize.js' && willRewrite === null) return null;
+    return path.join(dir, 'node_modules', '@bongos', 'core', rel);
+  };
+  const load = (p) => {
+    if (p.endsWith('upgrade.js')) {
+      if (upgradeThrows) throw new Error('an older core cannot be loaded here');
+      return { API_ARTIFACT_FILES: api || {} };
+    }
+    if (materializeThrows) throw new Error('materialize blew up');
+    return { materializeWillRewrite: willRewrite === undefined ? undefined : (args) => { seen.push(args); return willRewrite; } };
+  };
+  return { resolveFrom, load, seen };
+}
+
+test('laneGeneratedPaths unions the API artifacts with what materialize WOULD rewrite', () => {
+  const core = fakeCore({
+    api: { 'gen-api-docs.js': ['docs/api/openapi.json'], 'gen-api-client.js': ['clients/bongos-client/index.mjs'] },
+    willRewrite: ['.claude/skills/builder-ship/SKILL.md', '.claude/settings.json'],
+  });
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', core).sort(), [
+    '.claude/settings.json',
+    '.claude/skills/builder-ship/SKILL.md',
+    'clients/bongos-client/index.mjs',
+    'docs/api/openapi.json',
+  ]);
+});
+
+test('laneGeneratedPaths derives coreRoot from where the module RESOLVED', () => {
+  // Not from a package-name guess: an instance may carry the core under any of its
+  // published names, and materializeWillRewrite's own default only knows the first.
+  const core = fakeCore({ api: {}, willRewrite: [] });
+  S.laneGeneratedPaths('/srv/demo', core);
+  assert.equal(core.seen.length, 1);
+  assert.equal(core.seen[0].instanceDir, '/srv/demo');
+  assert.equal(path.resolve(core.seen[0].coreRoot), path.resolve('/srv/demo/node_modules/@bongos/core'));
+});
+
+test('laneGeneratedPaths is FAIL-SOFT in every direction — an empty set, never a guessed one', () => {
+  // The direction matters. An instance this cannot interrogate keeps the OLD, stricter guard
+  // (still wedged, and visibly so), rather than gaining a looser one that commits a stranger's work.
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: null, willRewrite: null })), []);
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: {}, willRewrite: undefined })), []);
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ upgradeThrows: true, materializeThrows: true })), []);
+  // A core that exports API_ARTIFACT_FILES but whose materialize throws still contributes the
+  // half it could answer for.
+  assert.deepEqual(
+    S.laneGeneratedPaths('/srv/demo', fakeCore({ api: { g: ['docs/api/openapi.json'] }, materializeThrows: true })),
+    ['docs/api/openapi.json'],
+  );
+});
+
+test('the core still exports the two things the probe reads', () => {
+  // laneGeneratedPaths reads them BY NAME off a module it resolves at runtime, so a rename in the
+  // core degrades it silently to the empty set — the pre-fix wedge, back again and invisible.
+  // This is the cross-file contract, pinned here the way GO_LIVE_REQUIRED is.
+  const up = require('../scripts/gds/upgrade.js');
+  const mat = require('../scripts/gds/claude-materialize.js');
+  assert.equal(typeof up.API_ARTIFACT_FILES, 'object', 'upgrade.js no longer exports API_ARTIFACT_FILES');
+  assert.ok(Object.values(up.API_ARTIFACT_FILES).flat().includes('docs/api/openapi.json'));
+  assert.equal(typeof mat.materializeWillRewrite, 'function', 'claude-materialize.js no longer exports materializeWillRewrite');
+});
+
+test('pinState sorts the lane\'s own output into its own bucket, and nothing else with it', () => {
+  const g = fakeGit({ dirty: ['package.json', '.claude/settings.json', 'config/branding.json'] });
+  const st = S.pinState('/srv/demo', g.run, ['.claude/settings.json']);
+  assert.deepEqual(st.pin.map((e) => e.file), ['package.json']);
+  assert.deepEqual(st.generated.map((e) => e.file), ['.claude/settings.json']);
+  assert.deepEqual(st.other.map((e) => e.file), ['config/branding.json'], 'an owner edit is still a human\'s work');
+});
+
+test('pinState called with no generated set behaves exactly as it always did', () => {
+  // Every pre-existing caller passes two arguments; the third bucket must be opt-in.
+  const g = fakeGit({ dirty: ['package.json', '.claude/settings.json'] });
+  const st = S.pinState('/srv/demo', g.run);
+  assert.deepEqual(st.generated, []);
+  assert.deepEqual(st.other.map((e) => e.file), ['.claude/settings.json']);
+});
+
+test('healDecision: leave-dirty finally reaches by-design, because the dirt is the lane\'s own', () => {
+  const pre = S.pinState('/srv/demo', fakeGit({ dirty: ['package.json', '.claude/settings.json'] }).run, ['.claude/settings.json']);
+  assert.deepEqual(S.healDecision(pre, 'leave-dirty'), { action: 'by-design' });
+  assert.deepEqual(S.healDecision(pre, 'local-commit'), { action: 'commit', push: false });
+  assert.deepEqual(S.healDecision(pre, 'push'), { action: 'commit', push: true });
+});
+
+test('healDecision: an owner\'s edit still halts EVERY mode, leave-dirty included', () => {
+  // leave-dirty licenses the LANE's dirt, not a stranger's. That is why the order inside
+  // healDecision stays dirt-before-mode rather than being flipped.
+  const pre = S.pinState('/srv/demo', fakeGit({ dirty: ['package.json', '.claude/settings.json', 'src/thing.js'] }).run, ['.claude/settings.json']);
+  for (const mode of S.PIN_MODES) assert.deepEqual(S.healDecision(pre, mode), { action: 'halt' }, `mode ${mode}`);
+});
+
+test('preflightFlagsFor: only leave-dirty gets --force, and it gets nothing else', () => {
+  assert.deepEqual(S.preflightFlagsFor('leave-dirty'), ['--force']);
+  assert.deepEqual(S.preflightFlagsFor('local-commit'), []);
+  assert.deepEqual(S.preflightFlagsFor('push'), []);
+  assert.deepEqual(S.preflightFlagsFor(undefined), []);
+});
+
+test('preflightFlagsFor has the precedent it claims — go-live.js really does send --force', () => {
+  const body = readFileSync(path.join(ROOT, 'scripts', 'gds', 'go-live.js'), 'utf8')
+    .split('function upgradeCommand(')[1].split('\n}')[0];
+  assert.match(body, /'--force'/, 'go-live upgradeCommand() no longer sends --force — re-derive preflightFlagsFor from it');
+});
+
+test('the direct-upgrade fallback asks preflightFlagsFor rather than deciding inline', () => {
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  assert.match(src, /upArgs\.push\(\.\.\.preflightFlagsFor\(pinMode\)\)/,
+    'the clean-tree policy is a pin-mode decision and must go through the named function');
+});
+
+test('every commitPin call site in the lane also decides what the upgrade generated', () => {
+  // The sibling of the push assertion in section 8, and for the same reason: a site that inherits
+  // the `generated = []` default silently reverts to the two-bucket guard that wedged the lane.
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  const calls = [];
+  const re = /commitPin\(\{/g;
+  let m;
+  while ((m = re.exec(src)) !== null) {
+    if (src.slice(Math.max(0, m.index - 9), m.index) === 'function ') continue;
+    let depth = 0, end = m.index;
+    for (let i = src.indexOf('{', m.index); i < src.length; i++) {
+      if (src[i] === '{') depth++;
+      else if (src[i] === '}' && --depth === 0) { end = i + 1; break; }
+    }
+    calls.push(src.slice(m.index, end));
+  }
+  assert.ok(calls.length >= 3, `expected the three known pin-writing call sites, found ${calls.length}`);
+  for (const c of calls) assert.match(c, /generated(: generatedAfter)?,/, `a commitPin call site does not pass the generated set:\n${c}`);
+});
+
+// ---------------------------------------------------------------------------
+// 11. real git — the wedge, and the un-wedge
+//
+// The cases above pin each decision on its own; these drive the same three functions
+// against a real repository, because the failure was never inside one decision. It was
+// that all three agreed on a sorting which did not describe what an upgrade leaves
+// behind — and a hand-written `git status` cannot show that.
+// ---------------------------------------------------------------------------
+
+function realGit(dir, ...args) { return spawnSync('git', ['-C', dir, ...args], { encoding: 'utf8' }); }
+function put(dir, rel, body) {
+  const p = path.join(dir, rel);
+  mkdirSync(path.dirname(p), { recursive: true });
+  writeFileSync(p, body);
+}
+
+// A provisioned co-tenant mid-lane: scaffolded + committed, then ONE upgrade applied that moved
+// the pin, re-materialized `.claude/` and regenerated the API artifacts — committing none of it,
+// which is exactly what pinMode leave-dirty asks for.
+function coTenantAfterOneUpgrade() {
+  const dir = mkdtempSync(path.join(tmpdir(), 'lane-cotenant-'));
+  realGit(dir, 'init', '-q');
+  realGit(dir, 'config', 'user.email', 'lane-test@example.invalid');
+  realGit(dir, 'config', 'user.name', 'lane test');
+  realGit(dir, 'config', 'core.autocrlf', 'false');
+  put(dir, 'package.json', JSON.stringify({ dependencies: { '@bongos/core': '1.19.737' } }));
+  put(dir, 'package-lock.json', 'lock 1.19.737\n');
+  put(dir, '.claude/settings.json', '{"from":"1.19.737"}\n');
+  put(dir, '.claude/skills/builder-ship/SKILL.md', '# builder-ship (1.19.737)\n');
+  put(dir, 'docs/api/openapi.json', '{"core":"1.19.737"}\n');
+  put(dir, 'config/branding.json', '{"identity":{}}\n');
+  realGit(dir, 'add', '-A');
+  realGit(dir, 'commit', '-q', '-m', 'scaffold');
+  // …then one upgrade, with nothing committed after it.
+  put(dir, 'package.json', JSON.stringify({ dependencies: { '@bongos/core': '1.19.785' } }));
+  put(dir, 'package-lock.json', 'lock 1.19.785\n');
+  put(dir, '.claude/settings.json', '{"from":"1.19.785"}\n');
+  put(dir, '.claude/skills/builder-ship/SKILL.md', '# builder-ship (1.19.785)\n');
+  put(dir, '.claude/skills/new-in-785/SKILL.md', '# a skill this core added\n'); // untracked
+  put(dir, 'docs/api/openapi.json', '{"core":"1.19.785"}\n');
+  return dir;
+}
+
+// What laneGeneratedPaths answers for that upgrade.
+const GENERATED = [
+  '.claude/settings.json', '.claude/skills/builder-ship/SKILL.md',
+  '.claude/skills/new-in-785/SKILL.md', 'docs/api/openapi.json',
+];
+
+test('real git: the WEDGE — under the old two-way sorting every mode halts, leave-dirty included', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync); // no generated set = the pre-fix behaviour
+  assert.ok(pre.other.length, 'the upgrade\'s own output landed in the human-work bucket');
+  for (const mode of S.PIN_MODES) {
+    assert.deepEqual(S.healDecision(pre, mode), { action: 'halt' }, `mode ${mode} halted here, every sweep, forever`);
+  }
+});
+
+test('real git: the UN-WEDGE — leave-dirty takes a second sweep with no human hands', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(pre.other, [], 'nothing dirty here is a human\'s work');
+  assert.deepEqual(S.healDecision(pre, 'leave-dirty'), { action: 'by-design' });
+  // …and the sweep then hands upgrade.js the flag that lets the bump past its own clean-tree
+  // pre-flight, which the deliberately-dirty pin would otherwise refuse.
+  assert.deepEqual(S.preflightFlagsFor('leave-dirty'), ['--force']);
+});
+
+test('real git: local-commit heals the lane\'s own leftovers, tracked and untracked', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(S.healDecision(pre, 'local-commit'), { action: 'commit', push: false });
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, true, r.reason);
+  assert.equal(r.action, 'committed-local');
+  assert.equal(realGit(dir, 'status', '--porcelain').stdout, '', 'the next sweep finds a clean tree');
+  const committed = realGit(dir, 'show', '--name-only', '--format=', 'HEAD').stdout;
+  for (const f of ['package.json', 'package-lock.json', ...GENERATED]) {
+    assert.ok(committed.includes(f), `${f} rode the pin commit`);
+  }
+});
+
+test('real git: an OWNER\'s edit is still never swept into the lane\'s commit', () => {
+  const dir = coTenantAfterOneUpgrade();
+  put(dir, 'config/branding.json', '{"the owner":"was here"}\n');          // tracked
+  put(dir, '.claude/skills/my-own-skill/SKILL.md', 'hand-written\n');      // untracked
+  const st = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(st.other.map((e) => e.file).sort(), ['.claude/skills/my-own-skill/SKILL.md', 'config/branding.json']);
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, false);
+  assert.equal(r.action, 'refused');
+  assert.equal(realGit(dir, 'rev-list', '--count', 'HEAD').stdout.trim(), '1', 'nothing was committed at all');
+  assert.match(realGit(dir, 'status', '--porcelain').stdout, /config\/branding\.json/, 'and the edit is still theirs');
+});
+
+test('real git: a tree holding ONLY the lane\'s own output still commits — the pin need not be dirty', () => {
+  // The shape a rollback leaves behind: the pin restored to what is committed, the regenerated
+  // artifacts not. Answering `already-clean` here would strand them and wedge the next sweep.
+  const dir = coTenantAfterOneUpgrade();
+  realGit(dir, 'checkout', '--', 'package.json', 'package-lock.json');
+  const st = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(st.pin, []);
+  assert.ok(st.generated.length);
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, true, r.reason);
+  assert.equal(r.committed, true);
+  assert.equal(realGit(dir, 'status', '--porcelain').stdout, '');
+});
+
+test('real git: a genuinely clean tree is still a no-op', () => {
+  const dir = coTenantAfterOneUpgrade();
+  realGit(dir, 'add', '-A'); realGit(dir, 'commit', '-q', '-m', 'by hand');
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.action, 'already-clean');
+  assert.equal(r.committed, undefined);
+});
+
+test('the post-upgrade net re-probes, rather than reusing the set from before the bump', () => {
+  // A skill the NEW core adds is absent from the pre-upgrade answer, so reusing it would drop that
+  // file into `other` and wedge the lane one release later — this defect again, wearing the next
+  // version number. The heal, which runs BEFORE the bump, must keep using the pre-bump set.
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  const afterSpawn = src.split('const generatedAfter = laneGeneratedPaths(inst.dir);')[1];
+  assert.ok(afterSpawn, 'the post-upgrade re-probe is gone');
+  assert.equal((afterSpawn.match(/generated: generatedAfter,/g) || []).length, 2,
+    'both post-upgrade commitPin sites (the rollback tidy and the durability net) must use the re-probed set');
+  assert.match(afterSpawn, /pinState\(inst\.dir, spawnSync, generatedAfter\)/);
+  const beforeSpawn = src.split('const generatedAfter = laneGeneratedPaths(inst.dir);')[0];
+  assert.match(beforeSpawn, /const pre = pinState\(inst\.dir, spawnSync, generated\);/,
+    'the heal runs before the bump, so it reads the core installed THEN');
+});

package/tests/work_title_wrap.mjs

@@ -0,0 +1,38 @@
+// tests/work_title_wrap.mjs — a Work board title wraps inside its column (task 1004209).
+//
+// At 390 the backlog title "Watch redesign: … People/Operations/Security tabs" ran
+// 44px past its column: a slash-joined run offers the browser no break point. The
+// rendered check (scripts/gds/render-check.js) is what measures it; this pins the
+// two halves of the fix in source so neither is dropped by an unrelated edit.
+//
+// Run:  node tests/work_title_wrap.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const WORK_SRC = read('modules/hall-ui/public/work.js');
+const WORK_CSS = read('modules/hall-ui/public/work.css');
+
+const { test, summary } = makeRunner();
+
+await test('every history title breaks after a slash, and only after escaping', () => {
+  const sites = WORK_SRC.match(/<span class="history__title">[^\n]*/g) || [];
+  assert.equal(sites.length, 2, 'the backlog and completed rows both render a history title');
+  for (const s of sites) {
+    assert.ok(s.includes("escapeHtml(t.title || '(untitled)').replace(/\\//g, '/<wbr>')"),
+      `the <wbr> goes in AFTER escapeHtml, so a title cannot inject markup: ${s.trim()}`);
+  }
+});
+
+await test('the break-anything backstop stays on .history__title', () => {
+  const rule = WORK_CSS.match(/^\.history__title \{[^}]*\}/m);
+  assert.ok(rule, '.history__title rule present');
+  assert.match(rule[0], /overflow-wrap:\s*anywhere/, 'a run with no slash still wraps instead of running out of the column');
+  assert.match(rule[0], /min-width:\s*0/, 'a flex item needs min-width: 0 to shrink below its longest word');
+});
+
+summary();