@bongos/core 1.21.112 → 1.21.114

package/scripts/gds/pulse.js

@@ -43,9 +43,10 @@
 //     by anyone reading the log or grepping the table.
 //   - Tasks return to status='ready', no credits, just like a manual release.
 //   - Affected builders get one broadcast each via scripts/discord/post.js
-//     (Discord #ship-news — outbound moved off Google Chat per ADR 0032 /
-//     #607; scripts/chat/ is inbound-only now). Post failure is non-fatal
-//     (mirrors ship.js).
+//     (Discord #ship-feed, the builders' channel — task 1002846 keeps the
+//     owner-facing #ship-news for shipped features and fixes; outbound moved
+//     off Google Chat per ADR 0032 / #607; scripts/chat/ is inbound-only now).
+//     Post failure is non-fatal (mirrors ship.js).
 //   - Exit codes: 0 = success (including "nothing stale"); 1 = fatal error.
 
 const fs = require('node:fs');
@@ -106,11 +107,13 @@ function parseThresholdHours(args) {
 
 // Post a single broadcast about an auto-released claim. Best-effort —
 // returns { ok, error } and never throws. Mirrors the pattern in ship.js
-// (synchronous execFile via the local scripts/discord/post.js helper —
-// default channel ship_news; outbound moved off Google Chat per ADR 0032).
+// (synchronous execFile via the local scripts/discord/post.js helper, on
+// #ship-feed: a reclaim nudge is builder housekeeping, never owner news —
+// task 1002846; outbound moved off Google Chat per ADR 0032). The line opens
+// with `@name`, never `#<id>`, so the applause bot ignores it.
 function postDiscordPing(text) {
   try {
-    execFileSync('node', ['scripts/discord/post.js', text], {
+    execFileSync('node', ['scripts/discord/post.js', '--channel', 'ship_feed', text], {
       cwd: REPO_ROOT,
       stdio: 'pipe',
     });

package/scripts/gds/ship-escalation.js

@@ -35,6 +35,7 @@
 // that gets muted, and this one is aimed at the surface a person actually reads.
 
 const NO_ARTIFACT_SOURCE = 'no-artifact-close';
+const { postWithAsk } = require('./ask.js');
 
 // One blocker per task. Deliberately NOT keyed on the builder or the run: two builders
 // hitting the same stuck task should land on the same blocker, not race to file two.
@@ -85,6 +86,22 @@ function escalationBody({ taskId, title, floor, summary, notes, builder }) {
   return lines.join('\n');
 }
 
+// The card the archon answers (task 1004704): the escalation as an ask, so the
+// review queue shows one short question instead of the body above. The body
+// still carries everything; the card is what a person answers at a glance.
+function escalationAsk(taskId) {
+  return {
+    question: `Close task ${taskId} with no code to grade?`,
+    options: [
+      { key: 'close', label: 'Close it', result: 'It closes as done, without a grade.', act: 'go ahead' },
+      { key: 'return', label: 'Send it back', result: 'The claim is released and the task returns to ready.', act: 'need more' },
+    ],
+    recommend: { key: 'close', why: 'The builder says no code was needed; read their reason first.' },
+    waits_on: 'lead:release',
+    if_nobody_answers: 'The task stays at completed and its builder is not paid.',
+  };
+}
+
 // The terminating refusal. THE ONE INVARIANT: these lines must never send the builder to
 // --regrade, because --regrade on an empty diff sends them straight back to --allow-empty.
 // That mutual advice IS the bug (task 1003950). Pure + exported so a test can assert the
@@ -108,7 +125,8 @@ function noArtifactRefusalLines({ taskId, floor, escalation }) {
     // Fail-open: the close is still blocked, so the builder must not be told it worked.
     const why = escalation && escalation.reason ? ` (${escalation.reason})` : '';
     lines.push(`Could not file the escalation automatically${why}.`);
-    lines.push('File it by hand so this does not sit silently — post a blocker naming this task:');
+    lines.push('File it by hand so this does not sit silently — post a blocker naming this task,');
+    lines.push('with an ask (check the card first: node scripts/gds/ask.js check <file>):');
     lines.push('    node scripts/gds/api.js POST /blockers --body-file <path-to-json>');
   }
   lines.push('');
@@ -124,12 +142,12 @@ async function fileNoArtifactEscalation({ taskId, title, floor, summary, notes,
   const post = call || require('./cli-lib').apiCall;
   let r;
   try {
-    r = await post('POST', '/api/bongos/blockers', {
+    r = await postWithAsk((body) => post('POST', '/api/bongos/blockers', body), {
       title: escalationTitle(taskId, title),
       body_md: escalationBody({ taskId, title, floor, summary, notes, builder }),
       source: NO_ARTIFACT_SOURCE,
       source_ref: escalationSourceRef(taskId),
-    });
+    }, escalationAsk(taskId));
   } catch (err) {
     return { filed: false, reason: `POST /blockers threw: ${err && err.message}` };
   }
@@ -143,6 +161,7 @@ module.exports = {
   escalationSourceRef,
   escalationTitle,
   escalationBody,
+  escalationAsk,
   noArtifactRefusalLines,
   fileNoArtifactEscalation,
 };

package/scripts/gds/ship-finish.js

@@ -96,10 +96,11 @@ async function mergeAndDeploy({ taskId, summary, advanceToMerge, skipMerge, dbOn
     // to fire IN ADDITION to the server's, so a single ship announced FOUR
     // messages (local #ship-news + #ship-feed, then the server's #ship-news +
     // #ship-feed). Defer unconditionally so exactly one broadcast fires — from
-    // the server, after the deploy lands. (#ship-news itself is paused in
-    // chooseBroadcastTargets, so that one broadcast is the #ship-feed line —
-    // task 1749 / idea 458.) The security-sensitive fail-closed routing lives
-    // server-side in ship-broadcast.postShipBroadcast, so it is preserved.
+    // the server, after the deploy lands. (That one broadcast is the #ship-feed
+    // line, plus a plain #ship-news headline for a feature or a bug — the kind
+    // filter in chooseBroadcastTargets, task 1002846.) The security-sensitive
+    // fail-closed routing lives server-side in ship-broadcast.postShipBroadcast,
+    // so it is preserved.
     console.log('  Discord broadcast: deferred to the server — it posts #ship-feed after the deploy lands.');
   }
   return merged;

package/scripts/gds/ship-merge-gate.js

@@ -176,19 +176,31 @@ function removeProbe(repoRoot, dir) {
 // (task 1004584). It only stands down when the pre-merge base lacks the file
 // too, so a branch that DELETES fitness.js from the core is still measured
 // (and blocked as unmeasurable) rather than waved through.
-function gateApplies(repoRoot, baseSha) {
-  if (fs.existsSync(path.join(repoRoot, 'scripts', 'gds', 'fitness.js'))) return true;
-  if (!baseSha) return true;
+//
+// It asks GIT, never the disk (task 1004728). A vendored instance keeps an
+// untracked `scripts -> node_modules/@bongos/core/scripts` link in its main
+// checkout (hidden by .git/info/exclude; grading needs it), so the core's own
+// fitness.js IS on disk there. The disk check read that as "this repo carries
+// the gate", ran the core's fitness against a tree with no core in it, and
+// blocked every land on toast. What the repo carries is what it tracks.
+function tracksFitness(repoRoot, rev) {
   try {
-    execFileSync('git', ['cat-file', '-e', `${baseSha}:scripts/gds/fitness.js`], {
+    execFileSync('git', ['cat-file', '-e', `${rev}:scripts/gds/fitness.js`], {
       cwd: repoRoot, stdio: 'ignore', shell: false,
     });
-    return true; // the base had it — this merge removed it; measure (and block)
+    return true;
   } catch (_) {
-    return false; // neither side carries the gate — nothing to run
+    return false;
   }
 }
 
+function gateApplies(repoRoot, baseSha) {
+  if (tracksFitness(repoRoot, 'HEAD')) return true;
+  if (!baseSha) return true;
+  // the base had it — this merge removed it; measure (and block)
+  return tracksFitness(repoRoot, baseSha);
+}
+
 function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
   if (!gateApplies(repoRoot, baseSha)) {
     log('  fitness: this repo carries no scripts/gds/fitness.js (a vendored instance) — gate not applicable');

package/scripts/gds/tweak-halt.js

@@ -29,6 +29,7 @@ const HALT_NOTES = Object.freeze({
   ship_check_stale: 'The automatic apply stopped because the pre-ship checks named something stale it may not fix by itself.',
   grader_unavailable: 'The quality review could not run, so the automatic apply stopped. The round waits for the next try or a person.',
   grade_failed: 'The quality review did not pass the automatic apply. The round waits for a person.',
+  worker_stopped: 'The automatic apply stopped before it finished, without saying why. The round waits for the next try or a person.',
   outside_page: 'The automatic apply would have changed a file outside this page, so it stopped.',
 });
 

package/scripts/hall-preview/README.md

@@ -23,7 +23,13 @@ node scripts/hall-preview/server.js                 # neutral pack, port 4600
 | `--empty` | drain every array in every fixture — the empty-state screenshot pass |
 | `--fixture-me` | don't read your own account live — serve the checked-in `me.json` snapshot (see below) |
 
-Writes are not wired: any `POST/PATCH/DELETE` answers `501 preview_readonly`.
+Writes are not wired: any `POST/PATCH/DELETE` answers `501 preview_readonly` — except
+the canned writes in `server.js` and, since task 1004685, the five per-builder pref
+PATCHes (`/me/interaction|wandering|model-allocation|render|skill-prefs`), which
+[`pref-writes.js`](pref-writes.js) answers with the real shapers over an in-memory copy
+and lays over later reads (logged as `recorded: PATCH …`; a restart forgets them).
+`?as=nobody` on any hall page views the hall as a builder who holds no governing seat
+(the living-city prototype; session-sticky, `?as=me` clears it).
 A GET with no fixture answers 404 and logs
 `no fixture: <path>` — that log line names the exact file to add.
 
@@ -91,6 +97,40 @@ node scripts/hall-preview/refresh-fixtures.js --scrub-only
 `tests/hall_preview_scrub.mjs` fails while any committed fixture still carries a real
 identity.
 
+Two more things a run does (task 1004685). It **keeps each builder's number**: the
+committed `builders__roster.json` is joined to the live roster by builder id, so
+`builder-12` is still `builder-12` after a refresh and a new fixture lines up with the
+old ones. And it ends with a **prose pass**: every person the run met in a field is
+replaced wherever a sentence names them too (by login, display name, the first name a
+login starts with, or a nickname cut from an all-caps login), because the governor
+docket's titles and details name people outright. The pass only knows people a field
+named, so a first name nobody's field carries (a person mentioned only in prose) can
+still slip through — read the governor fixtures' diff before committing them.
+
+**No security content is ever checked in either** (task 1004685, after its security
+review). The governor docket is read at a rank floor and carries the open red-team
+reports and the owner's blockers, so every run — and `--scrub-only` — ends with
+`createSecurityRedactor` (`scrub-identity.js`): a red-team record keeps only its id,
+state, severity bucket and acts under the title "Security report — details withheld";
+a blocker keeps no body and no title that names a secret, a host step or a customer
+project; the security backlog's tasks (flagged `security_sensitive`, or in a goal of
+category `security`) keep their place but not their words; any prose naming a
+credential, host config or the code a live report points at is emptied; and a
+customer instance's own domain becomes `instance.example`.
+`tests/hall_preview_security.mjs` fails while any committed fixture is not already a
+fixed point of that pass.
+
+**The governor reads are live too.** `government/docket`, `constitution`,
+`board/items`, `board/genesis-stages`, `goals/rollups`, `blockers`, `autonomy/fence`,
+`moving`, `sessions/search`, `learnings` (rows only) and the viewer's
+`me/{interaction,wandering,model-allocation}` are in the snapshot list. `/tasks` is the
+one path read two ways: with no query it is the ready list (`tasks.json`), with
+`?status=active` it is the work being built (`tasks__status-active.json`); the server's
+`QUERY_FIXTURES` table picks between them. The government's own reads (`government/laws`,
+`leads`, `treasury`, `presets`, `counts`) are fixtures in the same shape the routes
+answer; the living city and street run on them alone (task 1004717 deleted the prototype
+overlay). A concept no table holds is not drawn: never add sample data for one.
+
 ## The evidence matrix (per page-redesign ship)
 
 Screenshot every changed page at **{light, dark} × {1280w, 390w}**, plus one

package/scripts/hall-preview/pref-writes.js

@@ -0,0 +1,140 @@
+// scripts/hall-preview/pref-writes.js — the harness's SETTINGS RECORDER (task
+// 1004685, the living-city prototype's My agents page).
+//
+// WHY. The harness has no database, so every write answers 501 or one fixed canned
+// fixture. My agents' whole job is changing your own agent settings, and a page
+// that can only ever show "not saved" cannot be reviewed by looking (the trap
+// modules/hall-ui/CLAUDE.md names). So the five per-builder pref PATCH routes are
+// answered HERE, by the same pure shapers the real routes call
+// (modules/builder-settings/routes/settings.js: validatePatch → applyPatch →
+// describeForApi), over an in-memory copy of the served builder's prefs. A 422 is
+// the real route's 422; a 200 is the body the real route would send, contract
+// text included. The recorded state is then laid over GET /me and GET /me/<slice>,
+// so a reload shows the change too.
+//
+// What it is NOT: storage. Nothing is written to disk and a restart forgets
+// everything; each recorded write is logged so the harness console shows what the
+// page sent. Only these five routes are recorded — every other write is refused
+// exactly as before.
+'use strict';
+
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const lib = (name) => require(path.join(ROOT, 'modules', 'builder-settings', name));
+const interaction = lib('interaction-prefs');
+const wandering = lib('wandering-prefs');
+const models = lib('model-alloc-prefs');
+const render = lib('render-prefs');
+const skills = lib('skill-prefs');
+
+// apiPath → the /me slice it answers for (null: the skill prefs, not on /me)
+const ROUTES = {
+  'me/interaction': 'interaction',
+  'me/wandering': 'wandering',
+  'me/model-allocation': 'model_allocation',
+  'me/render': 'render',
+  'me/skill-prefs': null,
+};
+
+function createPrefRecorder({ log = console.log } = {}) {
+  let behavior = null; // the behavior_prefs jsonb, as the routes see it
+  let skillPrefs = null; // the skill_model_prefs jsonb
+  let rank = null;
+  let instanceModels = {};
+  const touched = new Set();
+
+  // Rebuild the stored blobs from what the served /me says, once.
+  function seed(me, skillFixture) {
+    if (behavior) return;
+    const m = me || {};
+    behavior = {};
+    if (m.interaction && m.interaction.stored) behavior[interaction.RESERVED_KEY] = { ...m.interaction.stored };
+    if (m.wandering && m.wandering.override_level != null) behavior[wandering.RESERVED_KEY] = m.wandering.override_level;
+    if (m.model_allocation && m.model_allocation.override) behavior[models.RESERVED_KEY] = { ...m.model_allocation.override };
+    if (m.render && m.render.override_level) behavior[render.RESERVED_KEY] = m.render.override_level;
+    rank = (m.builder && m.builder.rank) || (m.wandering && m.wandering.rank) || null;
+    instanceModels = (m.model_allocation && m.model_allocation.instance_default) || {};
+    skillPrefs = { ...((skillFixture && skillFixture.prefs) || {}) };
+  }
+
+  function describe(slice) {
+    if (slice === 'interaction') return interaction.describeForApi(behavior);
+    if (slice === 'wandering') return wandering.describeForApi(behavior, rank);
+    if (slice === 'model_allocation') return models.describeForApi(behavior, instanceModels);
+    if (slice === 'render') return render.describeForApi(behavior);
+    return {
+      prefs: skillPrefs, effective: skills.listEffective(skillPrefs), defaults: skills.SKILL_DEFAULTS,
+      known_skills: skills.KNOWN_SKILLS, allowed_models: skills.ALLOWED_MODELS,
+    };
+  }
+
+  function handles(method, apiPath) {
+    return method === 'PATCH' && Object.prototype.hasOwnProperty.call(ROUTES, apiPath);
+  }
+
+  // → { status, body }, the real route's answer
+  function write(apiPath, body, { me, skillFixture } = {}) {
+    seed(me, skillFixture);
+    const slice = ROUTES[apiPath];
+    const b = body || {};
+    const invalid = (errors) => ({ status: 422, body: { error: { code: 'invalid_patch', message: 'invalid_patch', details: { errors } } } });
+    let v;
+    if (slice === 'interaction') {
+      v = interaction.validatePatch(b);
+      if (!v.ok) return invalid(v.errors);
+      behavior = { ...behavior, [interaction.RESERVED_KEY]: interaction.applyPatch(interaction.storedProfile(behavior), v.patch) };
+    } else if (slice === 'wandering') {
+      v = wandering.validatePatch(b, { maxLevel: wandering.maxLevelForRank(rank) });
+      if (!v.ok) return invalid(v.errors);
+      behavior = wandering.applyPatch(behavior, v.patch);
+    } else if (slice === 'model_allocation') {
+      v = models.validatePatch(b);
+      if (!v.ok) return invalid(v.errors);
+      behavior = { ...behavior, [models.RESERVED_KEY]: models.applyPatch(models.storedOverride(behavior), v.patch) };
+    } else if (slice === 'render') {
+      v = render.validatePatch(b);
+      if (!v.ok) return invalid(v.errors);
+      behavior = render.applyPatch(behavior, v.patch);
+    } else {
+      v = skills.validatePatch(b);
+      if (!v.ok) return invalid(v.errors);
+      skillPrefs = skills.applyPatch(skillPrefs, v.patch);
+    }
+    touched.add(slice === null ? 'skills' : slice);
+    log(`  recorded: PATCH ${apiPath} ${JSON.stringify(b)}`);
+    return { status: 200, body: describe(slice) };
+  }
+
+  // Lay the recorded state over a GET's payload; untouched reads pass through.
+  function overlay(apiPath, payload) {
+    if (!behavior || !payload || typeof payload !== 'object') return payload;
+    if (apiPath === 'me') {
+      const out = { ...payload };
+      // the render level is DERIVED from the interaction profile, so it moves with it
+      for (const s of ['interaction', 'wandering', 'model_allocation', 'render']) {
+        if (touched.has(s) || (s === 'render' && touched.has('interaction'))) out[s] = describe(s);
+      }
+      return out;
+    }
+    const slice = ROUTES[apiPath];
+    if (slice === undefined) return payload;
+    const key = slice === null ? 'skills' : slice;
+    return touched.has(key) || (key === 'render' && touched.has('interaction')) ? describe(slice) : payload;
+  }
+
+  return { handles, write, overlay };
+}
+
+// Read a JSON body off the raw request (the harness mounts no body parser).
+function readJsonBody(req) {
+  return new Promise((resolve) => {
+    let raw = '';
+    req.setEncoding('utf8');
+    req.on('data', (c) => { raw += c; if (raw.length > 65536) req.destroy(); });
+    req.on('end', () => { try { resolve(raw ? JSON.parse(raw) : {}); } catch (_) { resolve(null); } });
+    req.on('error', () => resolve(null));
+  });
+}
+
+module.exports = { createPrefRecorder, readJsonBody, ROUTES };

package/scripts/hall-preview/refresh-fixtures.js

@@ -12,13 +12,18 @@
 // snapshot goes through ./scrub-identity.js before it touches the disk: logins,
 // names, avatars, GitHub ids and emails become stand-ins (`builder-3` / `Builder
 // 3`), and the snapshotting account's own balance and spend become fixed values.
+// Since task 1004685 a run also (1) keeps the numbers the committed roster already
+// gives each builder, and (2) ends with a pass over the PROSE, replacing every person
+// the run met in a field wherever a sentence names them (the governor docket does).
 // Hand-edited a fixture? Re-run the same pass over the files on disk, no network:
 //   node scripts/hall-preview/refresh-fixtures.js --scrub-only
 'use strict';
 
 const fs = require('fs');
 const path = require('path');
-const { createScrubber, isOwnAccountFixture, highestStandIn, rewriteScalars } = require('./scrub-identity');
+const {
+  createScrubber, createTextScrubber, securityRedactorFor, isOwnAccountFixture, highestStandIn, rewriteScalars,
+} = require('./scrub-identity');
 
 const FIXTURES = path.join(__dirname, 'fixtures');
 
@@ -29,6 +34,16 @@ const trimList = (key, n) => (d) => (Array.isArray(d?.[key]) ? { ...d, [key]: d[
 // profile charts' pager back for the same page until "total". Pin total to
 // what the snapshot holds.
 const selfPaged = (d) => (Array.isArray(d?.rows) && d.page ? { ...d, page: { ...d.page, total: d.rows.length } } : d);
+// The living city counts learnings and dates them; it never shows a body, and the
+// bodies are long prose about the host (task 1004685). Keep the row, drop the essay.
+const trimLearnings = (d) => (Array.isArray(d?.learnings)
+  ? { ...d, learnings: d.learnings.map(({ id, title, tags, task_id, created_at }) => ({ id, title, tags, task_id, created_at })) }
+  : d);
+// The active list is read for WHERE work is moving (goal, module, discipline), not
+// for what each task says; a description is the task's own long prose.
+const trimTaskBodies = (d) => (Array.isArray(d?.tasks)
+  ? { ...d, tasks: d.tasks.map(({ description, value_summary, ...rest }) => rest) }
+  : d);
 const SNAPSHOTS = [
   ['me', 'me'],
   ['me/credits?limit=200', 'me__credits', selfPaged],
@@ -88,6 +103,40 @@ const SNAPSHOTS = [
   // draw them) no timeline. `versions` above is the AUTHENTICATED list; this is
   // the public one the page actually calls, and the two are not interchangeable.
   ['public/versions', 'public__versions'],
+
+  // THE GOVERNOR'S READS (task 1004685). The city and the street drew from
+  // hand-generated governor fixtures (tasks 1004524-1004580), so the harness only
+  // ever showed the reference design's sample council. These are the reads the
+  // pages make (city.js / street.js FEEDS), plus the ones the living city's model
+  // (modules/hall-ui/public/gov-living.js) takes: who is moving, the open blockers,
+  // the unattended-building switch, the sessions, the viewer's own agent settings.
+  ['government/docket', 'government__docket'],
+  // the counts every surface prints, in one read (task 1004716)
+  ['government/counts', 'government__counts'],
+  ['government/constitution', 'government__constitution'],
+  // the project's laws in force (task 1004706)
+  ['government/laws', 'government__laws'],
+  // who leads each building (task 1004709): the hub has seated no Lead yet
+  ['government/leads', 'government__leads'],
+  // the pots each goal draws from, the reserve, the spend cap (task 1004712)
+  ['government/treasury', 'government__treasury'],
+  // the strictness presets, and which one the laws in force amount to (task 1004715)
+  ['government/presets', 'government__presets'],
+  ['government/board/items', 'government__board__items'],
+  ['government/board/genesis-stages', 'government__board__genesis-stages'],
+  ['goals/rollups', 'goals__rollups'],
+  ['blockers?limit=100', 'blockers'],
+  ['autonomy/fence', 'autonomy__fence'],
+  ['moving', 'moving'],
+  // the work being built, with its goal; served for /tasks?status=active only
+  // (server.js QUERY_FIXTURES), since /tasks with no query is the ready list above
+  ['tasks?status=active&limit=200', 'tasks__status-active', trimTaskBodies],
+  ['sessions/search?limit=100', 'sessions__search'],
+  // what the project has learned: the city counts it, and no page reads the bodies
+  ['learnings', 'learnings', trimLearnings],
+  ['me/interaction', 'me__interaction'],
+  ['me/wandering', 'me__wandering'],
+  ['me/model-allocation', 'me__model-allocation'],
 ];
 
 // Every existing fixture's text — read so a run can number new stand-ins above the
@@ -101,13 +150,34 @@ function readFixtureTexts(dir) {
   }
 }
 
+// continuitySeed — the people the committed roster already numbers, keyed by the
+// builder id the live roster and the fixture share, so a re-run keeps builder-12 as
+// builder-12 instead of renumbering every person in the snapshot (task 1004685). No
+// roster on disk, or no live one, is an empty seed: the run numbers from scratch.
+async function continuitySeed(api, dir) {
+  let onDisk;
+  try {
+    onDisk = JSON.parse(fs.readFileSync(path.join(dir, 'builders__roster.json'), 'utf8'));
+  } catch (_) { return []; }
+  const res = await api.request('GET', '/builders/roster', {});
+  if (!res || !res.ok || !Array.isArray(res.data?.builders) || !Array.isArray(onDisk?.builders)) return [];
+  const standIn = new Map();
+  for (const b of onDisk.builders) {
+    const m = /^builder-(\d+)$/i.exec(String(b?.github_login || ''));
+    if (m && b.id != null) standIn.set(String(b.id), Number(m[1]));
+  }
+  return res.data.builders
+    .filter((b) => b && b.id != null && standIn.has(String(b.id)))
+    .map((b) => ({ login: b.github_login, name: b.display_name, n: standIn.get(String(b.id)) }));
+}
+
 // refreshFixtures — GET each snapshot, scrub the people out of it, write it. The api,
 // directory and logger are injected so tests/hall_preview_scrub.mjs drives this exact
 // writer with no network and a temp directory.
 async function refreshFixtures({ api, dir = FIXTURES, snapshots = SNAPSHOTS, log = console.log } = {}) {
   fs.mkdirSync(dir, { recursive: true });
-  const scrubber = createScrubber({ firstNumber: highestStandIn(readFixtureTexts(dir)) + 1 });
-  let wrote = 0;
+  const scrubber = createScrubber({ firstNumber: highestStandIn(readFixtureTexts(dir)) + 1, seed: await continuitySeed(api, dir) });
+  const fetched = [];
   for (const [apiPath, name, trim] of snapshots) {
     const res = await api.request('GET', `/${apiPath}`, {});
     if (!res.ok) {
@@ -116,8 +186,18 @@ async function refreshFixtures({ api, dir = FIXTURES, snapshots = SNAPSHOTS, log
     }
     // Scrubbed BEFORE the write, never after: fixtures/ is committed, so a copy of
     // the live response that touched the disk would already be one `git add` away.
-    const data = scrubber.scrub(trim ? trim(res.data) : res.data, { ownAccount: isOwnAccountFixture(name) });
-    fs.writeFileSync(path.join(dir, `${name}.json`), `${JSON.stringify(data, null, 2)}\n`);
+    fetched.push({ apiPath, name, data: scrubber.scrub(trim ? trim(res.data) : res.data, { ownAccount: isOwnAccountFixture(name) }) });
+  }
+  // Prose last (task 1004685): every snapshot's structure has taught the registry its
+  // people by now, so a name met in file 30 is still found in file 2's sentences.
+  const prose = createTextScrubber(scrubber.knownPeople());
+  const named = fetched.map((f) => ({ ...f, data: prose(f.data) }));
+  // Security content last of all (task 1004685): red-team write-ups, blocker
+  // runbooks, credentials and customer instance domains never reach the disk.
+  const secure = securityRedactorFor(named.map((f) => f.data));
+  let wrote = 0;
+  for (const { apiPath, name, data } of named) {
+    fs.writeFileSync(path.join(dir, `${name}.json`), `${JSON.stringify(secure(data), null, 2)}\n`);
     wrote += 1;
     log(`  wrote ${name}.json  (${apiPath})`);
   }
@@ -129,14 +209,28 @@ async function refreshFixtures({ api, dir = FIXTURES, snapshots = SNAPSHOTS, log
 // hand-written ones (several copied real people in by hand) and anything written
 // before the scrub existed. Only values that change are rewritten, so a fixture
 // someone formatted by hand keeps its formatting.
+// Whether two JSON values have the same keys all the way down (values may differ).
+function sameKeys(a, b) {
+  if (Array.isArray(a) || Array.isArray(b)) return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((x, i) => sameKeys(x, b[i]));
+  if (a && typeof a === 'object' && b && typeof b === 'object') {
+    const ka = Object.keys(a);
+    return ka.length === Object.keys(b).length && ka.every((k) => k in b && sameKeys(a[k], b[k]));
+  }
+  return (a && typeof a === 'object') === (b && typeof b === 'object');
+}
+
 function scrubFixturesOnDisk({ dir = FIXTURES, log = console.log } = {}) {
   const files = fs.readdirSync(dir).filter((f) => f.endsWith('.json')).sort();
   const texts = files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8'));
   const scrubber = createScrubber({ firstNumber: highestStandIn(texts) + 1 });
+  const parsed = texts.map((t) => JSON.parse(t));
+  const secure = securityRedactorFor(parsed);
   let changed = 0;
   files.forEach((file, idx) => {
-    const clean = scrubber.scrub(JSON.parse(texts[idx]), { ownAccount: isOwnAccountFixture(file.slice(0, -'.json'.length)) });
-    const next = rewriteScalars(texts[idx], clean);
+    const clean = secure(scrubber.scrub(parsed[idx], { ownAccount: isOwnAccountFixture(file.slice(0, -'.json'.length)) }));
+    // The security pass can DROP fields (a red-team record keeps an allowlist), which
+    // a scalar splice cannot express; then the file is written whole.
+    const next = sameKeys(parsed[idx], clean) ? rewriteScalars(texts[idx], clean) : `${JSON.stringify(clean, null, 2)}\n`;
     if (next === texts[idx]) return;
     fs.writeFileSync(path.join(dir, file), next);
     changed += 1;