@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/strand-watch.js

@@ -1,315 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/strand-watch.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/strand-watch.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-//
-// scripts/gds/strand-watch.js — say out loud that a ship got stuck (task 1003163).
-//
-// THE GAP. Nothing watched for a stranded ship. On 2026-08-22 a manual status sweep found
-// task 1002483 parked at `completed` for THREE DAYS carrying 651 lines of tested work on a
-// local branch, task 1002792 parked two days behind it, and task 1002459 sitting at
-// `confirmed` for FOUR DAYS with no artifact anywhere. Not one of the three had produced a
-// single signal; all were found by accident.
-//
-// WHY land-watch.js IS NOT THIS (it looks like it should be). land-watch.js renders the
-// SHIPPED banner after an async CI land (task 1687). It cannot detect a strand: it reads
-// machine-local breadcrumbs that ship.js writes only at CONFIRMED-exit — so a task parked at
-// `completed` never gets one — it DROPS a breadcrumb after 30 minutes by design, and it is
-// per-machine, so a strand on a box nobody reopens is invisible forever.
-//
-// THE SIGNAL ALREADY EXISTS. This is the part worth knowing: the publish-reconciler ALREADY
-// diagnoses the worst case and already writes it down. Task 1002459 has carried
-// `needs_rebase_reason = 'strand:land_not_proven'` since 2026-08-18 — the reconciler probed
-// it, could not prove a land, gave up, and recorded exactly that. Nobody ever read the field.
-// So this module is not a detector. It is the READOUT of a diagnosis the system performs and
-// then discards, which is why it is small.
-//
-// SHAPE COPIED FROM deploy-divergence.js, deliberately. That check was written after the
-// ten-day staleness incident (blocker 1000097 / task 1002521), is wired into SessionStart in
-// .claude/settings.json, and on 2026-08-22 it reported the stale pin in the first message of
-// the session — which is how that whole day's work started. A cheap check, on a path that
-// already runs, reporting loudly, beats a monitoring subsystem that can itself silently stop.
-// So: fail-open, bounded, and SILENT when the board is clean.
-//
-// Usage:
-//   node scripts/gds/strand-watch.js                 # human-readable report
-//   node scripts/gds/strand-watch.js --line          # ONE line, or nothing; always exit 0
-//   node scripts/gds/strand-watch.js --json          # machine shape
-//   node scripts/gds/strand-watch.js --hours N       # override the `completed` threshold
-//
-// Exit codes: 0 always on --line (fail-open). Otherwise 0 clean, 1 strands found, 2 undetermined.
-
-const { apiCall, arg, hasFlag } = require('./cli-lib');
-const tweakHold = require('../../modules/lifecycle/page-tweak-hold.js');
-
-// ---- thresholds -------------------------------------------------------------
-// Reasoned, not magic. Written down because a future reader will want to retune them.
-//
-// `confirmed` means the grade PASSED and only the land is outstanding. The publish-reconciler
-// sweeps every ~5 minutes, so one hour is twelve missed sweeps — already anomalous, while
-// still leaving room for a slow CI queue or a transient GitHub failure.
-const CONFIRMED_STALE_MS = 60 * 60 * 1000;
-// `completed` means the grade did NOT pass. A builder may legitimately be mid-recovery for
-// hours (see the /grade-recover loop), so this is deliberately generous: 12 hours means the
-// strand survived a night, which no active recovery does. The three real cases were 2–3 DAYS.
-const COMPLETED_STALE_MS = 12 * 60 * 60 * 1000;
-
-// A reconciler-recorded strand needs NO threshold. The reconciler already probed every branch
-// convention, failed to prove a land, and wrote the reason down; waiting longer cannot change
-// that verdict, and task 1002459 proves the alternative is sitting for days.
-const STRAND_REASON_PREFIX = 'strand:';
-
-const WATCHED = ['completed', 'confirmed'];
-const DEFAULT_TIMEOUT_MS = 8000;
-// Page size per watched status. A queue past this would silently lose the OLDEST strands —
-// exactly the class of quiet cap this whole check exists to abolish — so a full page is
-// reported as `truncated` rather than passed off as complete. 200 is far above any healthy
-// board (the real numbers were 1 and 2).
-const PAGE_LIMIT = 200;
-
-// ---- classification (pure — this is the unit-testable core) -----------------
-
-// Task ids are numeric and reconciler reasons come from a fixed vocabulary, so both are safe
-// to print. TITLES ARE NOT, and that omission is deliberate — see the trust-boundary note on
-// `line()` below.
-const safeId = (v) => (/^\d{1,19}$/.test(String(v)) ? String(v) : null);
-const safeReason = (v) => (typeof v === 'string' && /^[a-z0-9_:.-]{1,64}$/i.test(v) ? v : null);
-
-function humanAge(ms) {
-  if (!Number.isFinite(ms) || ms < 0) return 'unknown';
-  const h = ms / 3600000;
-  if (h < 1) return `${Math.max(1, Math.round(ms / 60000))}m`;
-  if (h < 48) return `${Math.round(h)}h`;
-  return `${Math.round(h / 24)}d`;
-}
-
-// Decide whether ONE task is a strand, and if so which shape and what fixes it. The two
-// shapes need opposite responses, which is the whole reason to distinguish them:
-//   completed -> the GRADE parked it; re-grade or fix findings (/grade-recover).
-//   confirmed -> the grade passed and the LAND is outstanding (/merge-mode is the fallback).
-// A reconciler-recorded strand is called out separately because it is terminal without a
-// human: the automated healers have already refused it.
-function classifyStrand(task, { nowMs, confirmedStaleMs = CONFIRMED_STALE_MS, completedStaleMs = COMPLETED_STALE_MS } = {}) {
-  const t = task || {};
-  const status = String(t.status || '');
-  if (!WATCHED.includes(status)) return null;
-
-  const id = safeId(t.id);
-  if (!id) return null;
-
-  const updated = Date.parse(t.updated_at || '');
-  const ageMs = Number.isFinite(updated) && Number.isFinite(nowMs) ? nowMs - updated : NaN;
-
-  const reason = safeReason(t.needs_rebase_reason);
-  const reconcilerGaveUp = status === 'confirmed'
-    && t.needs_rebase === true
-    && !!reason
-    && reason.toLowerCase().startsWith(STRAND_REASON_PREFIX);
-
-  if (reconcilerGaveUp) {
-    return {
-      id, status, ageMs, age: humanAge(ageMs), shape: 'unprovable', reason,
-      remedy: 'check whether any artifact exists at all — a confirm with no branch and nothing on main was codeless',
-    };
-  }
-
-  const limit = status === 'confirmed' ? confirmedStaleMs : completedStaleMs;
-  // An unreadable updated_at must not manufacture a strand — fail QUIET on bad data here,
-  // because this text is injected into every session and a false alarm trains people to
-  // scroll past the real one.
-  if (!Number.isFinite(ageMs) || ageMs <= limit) return null;
-
-  return status === 'confirmed'
-    ? { id, status, ageMs, age: humanAge(ageMs), shape: 'unlanded', reason: null,
-        remedy: '/merge-mode is the documented manual fallback' }
-    : { id, status, ageMs, age: humanAge(ageMs), shape: 'ungraded', reason: null,
-        remedy: '/grade-recover diagnoses which of the three shapes parked it' };
-}
-
-// Sort worst-first so a truncated line shows the most urgent: reconciler-refused, then oldest.
-const SHAPE_RANK = { unprovable: 0, unlanded: 1, ungraded: 2 };
-function rankStrands(strands) {
-  return strands.slice().sort((a, b) => {
-    const d = (SHAPE_RANK[a.shape] ?? 9) - (SHAPE_RANK[b.shape] ?? 9);
-    return d !== 0 ? d : (b.ageMs || 0) - (a.ageMs || 0);
-  });
-}
-
-// ---- the held pass (task 1004322, ADR 0341 D7) --------------------------------
-//
-// A page tweak whose grade PASSED waits at `completed` for its artist on purpose:
-// the artist approves the applied page before it lands. It is not a strand and not
-// a failed grade, and calling it one would send someone to /grade-recover a task
-// nobody should touch. The task list carries no grade, so each completed page
-// tweak's grade is read on its own (there are a handful at most; the read is
-// bounded anyway). A read that FAILS leaves the task to the ordinary
-// classification: an unknown must stay loud, never be explained away as a hold.
-const HOLD_READ_LIMIT = 25;
-
-async function heldPageTweaks(tasks, { call, withTimeout }) {
-  const candidates = tasks.filter((t) => t && t.status === 'completed' && tweakHold.isPageTweak(t) && safeId(t.id)).slice(0, HOLD_READ_LIMIT);
-  const held = new Set();
-  await Promise.all(candidates.map(async (t) => {
-    try {
-      const res = await withTimeout(call('GET', `/api/bongos/tasks/${safeId(t.id)}?include=grade`), 'page-tweak grade');
-      const body = res && (res.data || res);
-      const grade = body && body.grade;
-      if (tweakHold.isHeldForArtist(t, grade ? grade.passed : null)) held.add(String(t.id));
-    } catch { /* unknown: classified as usual */ }
-  }));
-  return held;
-}
-
-// ---- fetch ------------------------------------------------------------------
-
-async function check({ nowMs = Date.now(), timeoutMs = DEFAULT_TIMEOUT_MS, confirmedStaleMs, completedStaleMs, call = apiCall } = {}) {
-  // CONCURRENT, not sequential. This runs on the SessionStart path beside deploy-divergence,
-  // so a serial loop would double the latency the builder waits through for no reason.
-  const withTimeout = (p, label) => Promise.race([
-    p,
-    new Promise((_, rej) => setTimeout(() => rej(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs)),
-  ]).catch((e) => { throw new Error(`could not read ${label} tasks: ${e.message || e}`); });
-
-  let pages;
-  try {
-    pages = await Promise.all(WATCHED.map(async (status) => {
-      const res = await withTimeout(call('GET', `/api/bongos/tasks?status=${status}&limit=${PAGE_LIMIT}`), status);
-      const body = res && (res.data || res);
-      const tasks = body && Array.isArray(body.tasks) ? body.tasks : null;
-      if (!tasks) throw new Error(`unexpected shape from /tasks?status=${status}`);
-      return { status, tasks };
-    }));
-  } catch (e) {
-    return { undetermined: true, reason: e.message || String(e), strands: [], truncated: [] };
-  }
-
-  const strands = [];
-  const truncated = [];
-  const waiting = [];
-  const completed = (pages.find((p) => p.status === 'completed') || { tasks: [] }).tasks;
-  const held = await heldPageTweaks(completed, { call, withTimeout });
-  for (const { status, tasks } of pages) {
-    if (tasks.length >= PAGE_LIMIT) truncated.push(status);
-    for (const t of tasks) {
-      if (status === 'completed' && held.has(String(t.id))) {
-        const updated = Date.parse(t.updated_at || '');
-        const ageMs = Number.isFinite(updated) ? nowMs - updated : NaN;
-        waiting.push({ id: safeId(t.id), status, ageMs, age: humanAge(ageMs), shape: tweakHold.HOLD_STATE });
-        continue;
-      }
-      const s = classifyStrand(t, { nowMs, confirmedStaleMs, completedStaleMs });
-      if (s) strands.push(s);
-    }
-  }
-  return { undetermined: false, ok: strands.length === 0 && !truncated.length, strands: rankStrands(strands), truncated, waiting };
-}
-
-// ---- rendering --------------------------------------------------------------
-
-// ONE line for SessionStart, or null. Null IS the silence: a clean board must say nothing,
-// or the line becomes wallpaper and the real warning gets scrolled past.
-//
-// TRUST BOUNDARY — why no task titles. A task title is builder-authored free text, and this
-// string is injected into an agent's context at the start of every session. Interpolating a
-// title raw would hand anyone who can file a task a standing prompt-injection channel, which
-// is the same reasoning deploy-divergence.js applies to the /version response it reads (it
-// accepts only a strict semver for exactly this purpose). Ids and a fixed reason vocabulary
-// carry all the signal that is needed and none of the risk — the agent can GET the task.
-function line(r, { max = 3 } = {}) {
-  if (!r || r.undetermined) return null;
-  const trunc = Array.isArray(r.truncated) && r.truncated.length
-    ? ` (the ${r.truncated.join(' and ')} queue${r.truncated.length > 1 ? 's' : ''} filled a full ${PAGE_LIMIT}-row page, so older strands may be unlisted)`
-    : '';
-  if (!r.strands.length) {
-    // A full page with no strand still means coverage was capped — say so rather than imply
-    // a clean board, which is the silent-cap failure this check is against.
-    return trunc ? `Strand check could not see the whole board${trunc}. Run: node scripts/gds/strand-watch.js` : null;
-  }
-  const shown = r.strands.slice(0, max)
-    .map((s) => `task ${s.id} (${s.status}, ${s.age}${s.reason ? `, ${s.reason}` : ''})`);
-  const more = (r.strands.length > shown.length ? ` +${r.strands.length - shown.length} more` : '') + trunc;
-  const worst = r.strands[0];
-  // Lead with what the WORST shape actually means. "work is finished but not landed" is true
-  // of a confirmed strand and false of a completed one (the grade parked that, so the work may
-  // not be finished at all) — one generic sentence for both would be wrong half the time.
-  const lead = {
-    unprovable: 'the reconciler already probed this and gave up, so it will never self-heal',
-    unlanded: 'the grade passed and only the land is outstanding',
-    ungraded: 'the grade parked this; it is not waiting on a land',
-  }[worst.shape] || 'parked mid-pipeline';
-  return `Stranded ship${r.strands.length === 1 ? '' : 's'}: ${shown.join('; ')}${more}. `
-    + `Worst: ${lead} — ${worst.remedy}. `
-    // Name the skill, not just the diagnosis: 19 of the last 30 days' session logs mention a strand,
-    // and the next claim is refused REBASE_REQUIRED until one is landed or released (task 1003548).
-    + `Run /strand-fix ${worst.id} to walk it. `
-    + 'A strand produces no signal of its own; this line is the only one.';
-}
-
-function report(r) {
-  if (!r) { console.error('strand-watch: no result'); return; }
-  if (r.undetermined) { console.error(`strand-watch: undetermined — ${r.reason}`); return; }
-  console.log('');
-  console.log('  Stranded ships');
-  console.log('  ──────────────────────────────────────────────────────────');
-  if (Array.isArray(r.truncated) && r.truncated.length) {
-    console.log(`  ! coverage capped: the ${r.truncated.join(' and ')} queue(s) returned a full ${PAGE_LIMIT}-row page,`);
-    console.log('    so strands older than the cutoff are NOT listed below.');
-  }
-  // task 1004322: named, and kept apart from the strands — nobody should recover these.
-  const waiting = Array.isArray(r.waiting) ? r.waiting : [];
-  for (const w of waiting) {
-    console.log(`  task ${w.id}  waiting for the artist (${w.age}) — a page tweak whose grade passed; not a strand, leave it`);
-  }
-  if (r.ok) {
-    console.log('  ✓ none — nothing parked at completed or confirmed past its threshold.');
-    console.log('');
-    return;
-  }
-  for (const s of r.strands) {
-    console.log(`  task ${s.id}  ${s.status.padEnd(9)} ${String(s.age).padStart(4)}  ${s.shape}${s.reason ? ` (${s.reason})` : ''}`);
-    console.log(`      ${s.remedy}`);
-  }
-  console.log('');
-  console.log('  "completed" means the grade parked it. "confirmed" means it passed and the');
-  console.log('  land never finished. Neither state produces a signal on its own.');
-  console.log('');
-}
-
-async function main() {
-  const hours = Number(arg('--hours'));
-  const opts = Number.isFinite(hours) && hours > 0 ? { completedStaleMs: hours * 3600000 } : {};
-
-  // --line: the SessionStart shape. FAIL-OPEN — a strand is context for the agent, and an
-  // unreachable API is nothing at all; neither is a failure of the session this rides into.
-  // Note it sets exitCode and RETURNS rather than calling process.exit: an explicit exit here
-  // races libuv's teardown of the request socket and aborts the process on Windows/Node 24
-  // (the documented `UV_HANDLE_CLOSING` assertion — see cli-lib's cliExit note and
-  // deploy-divergence's identical comment).
-  if (hasFlag('--line')) {
-    try {
-      // SHARED ACROSS CONCURRENT SESSION STARTS (task 1003689). Four sessions opened
-      // within three seconds — one worktree per claim, the normal pattern here — used
-      // to make this same call four times and ALL of them timed out, which produces no
-      // line at all. Silence from a truth-teller is indistinguishable from 'nothing to
-      // report', so the brief was lost without a symptom. The first session to ask now
-      // answers for the rest.
-      const { cached } = require('./probe-cache.js');
-      const { value: one } = await cached('strand-watch-line', async () => line(await check(opts)));
-      if (one) console.log(one);
-    } catch { /* no session, offline, unreadable — all silence */ }
-    process.exitCode = 0;
-    return;
-  }
-
-  const r = await check(opts);
-  if (hasFlag('--json')) console.log(JSON.stringify(r, null, 2));
-  else report(r);
-  process.exitCode = r.undetermined ? 2 : (r.ok ? 0 : 1);
-}
-
-if (require.main === module) {
-  main().catch((e) => { console.error('strand-watch: failed —', e.message || e); process.exit(2); });
-}
-
-module.exports = {
-  check, line, report, classifyStrand, rankStrands, humanAge,
-  CONFIRMED_STALE_MS, COMPLETED_STALE_MS, STRAND_REASON_PREFIX, WATCHED, PAGE_LIMIT,
-};
+require('../bongos/forwarder.js').forward(module, 'strand-watch.js');

package/scripts/gds/stranded-rows.js

@@ -1,200 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/stranded-rows.js — a task whose work already landed, still sitting in
-// `ready`/`backlog` (task 1003775).
-//
-// THE FAILURE. Three tasks closed in one 2026-08-20 session needed no work at all:
-// the fix was already in main. That was 3 of 8 tasks in one sweep, and every one was
-// found by a human reading code. The cost is not the wasted claim — it is that the
-// next builder claims it, reads the code, finds nothing to do, and has to prove a
-// negative before releasing it.
-//
-// SCOPE — ONE OF THE TWO FAILURE MODES, DELIBERATELY. Idea 1000807 named two:
-//
-//   1. STRANDED ROW — the work landed under the task's OWN id, but the row never
-//      moved off `ready`. Mechanical. This file.
-//   2. SILENT SUPERSESSION — a LATER task solved the same problem under a different
-//      id. The idea's author tried commit-message scanning for this and reports it
-//      does NOT work: a broad scan and a narrowed one (826 commits) both returned
-//      ~44 open tasks that merely MENTION an id — seeded-task commits, session logs,
-//      ADRs citing planned work. Not attempted here. It needs a human or LLM read and
-//      belongs in a review cadence, not new machinery.
-//
-// THE SIGNAL, and why it is this one. A commit says which task it DID by ending a
-// line with `(task N)`. That is narrower than "mentions N", which is the distinction
-// the idea's investigation failed on: "1002792, 1002200, 1002571" in a session-log
-// body is a comma list, not a line ending in `(task N)`.
-//
-// It reads the WHOLE message, not just the subject, and that detail is load-bearing.
-// The historical case the idea names — task 1002200 — landed on a cloud-agent branch
-// whose own commit subject never named it; the `(task 1002200)` line lives in the
-// MERGE commit's body, where GitHub echoes the branch's subject. A subject-only scan
-// misses the one case this file exists for.
-//
-// MEASURED on this repo before shipping: 877 ids are named as an authoring subject
-// across 4,784 commits, and ZERO of them are open `ready`/`backlog` rows (434 of
-// those). So today's board is clean and the signal is not merely quiet — the same
-// rule catches 1002200 when its row is treated as open.
-//
-// HOUSE RULES (the truth-teller family: strand-watch.js, stale-worktrees.js).
-// Fail OPEN — a probe never blocks a session. Silent when healthy. Prints IDS AND
-// FIXED VOCABULARY ONLY: never a commit subject or a task title, both of which are
-// builder-authored text.
-//
-// Usage:
-//   node scripts/gds/stranded-rows.js            # human report; exit 1 if any found
-//   node scripts/gds/stranded-rows.js --json     # { stranded: [{ id, status, sha }] }
-//   node scripts/gds/stranded-rows.js --line     # ONE line, or nothing; always exit 0
-
+// scripts/gds/stranded-rows.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/stranded-rows.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const { execFileSync } = require('node:child_process');
-
-const MAIN_REF = 'origin/main';
-// A record separator no commit message can contain: the word is wrapped in U+0001
-// (START OF HEADING), a C0 control character git will not carry in a message body.
-//
-// Built from an explicit escape rather than written as a literal, because the control
-// bytes are INVISIBLE in a source listing - the first reviewer of this file read it as
-// `const SEP = 'COMMIT'` and correctly flagged that a body containing the word COMMIT
-// would split a record in half. It would; that is exactly why the sentinels are there,
-// and now you can see them. A test pins a body carrying the bare word.
-const SOH = String.fromCharCode(1);
-const SEP = `${SOH}COMMIT${SOH}`;
-
-// The authoring convention: a line whose END is `(task N)`. Anchored at end-of-line on
-// purpose — that is what distinguishes "this commit did task N" from "this commit
-// mentioned N", and the second is the noise that made the supersession half undoable.
-const AUTHORED_RE = /\(task (\d{6,7})\)\s*$/;
-
-// PURE — every task id a commit message claims to have DONE. Exported so the rule is
-// testable without a repo: a scanner that quietly stops matching reports a clean board,
-// which is indistinguishable from a healthy one.
-function authoredIds(message) {
-  const out = new Set();
-  for (const line of String(message || '').split('\n')) {
-    const m = AUTHORED_RE.exec(line.trim());
-    if (m) out.add(m[1]);
-  }
-  return out;
-}
-
-// PURE — id -> first sha that claimed it, over a whole `git log` payload.
-function scanLog(raw) {
-  const byId = new Map();
-  for (const block of String(raw || '').split(SEP)) {
-    if (!block.trim()) continue;
-    const nl = block.indexOf('\n');
-    const sha = (nl === -1 ? block : block.slice(0, nl)).trim();
-    const body = nl === -1 ? '' : block.slice(nl + 1);
-    for (const id of authoredIds(body)) if (!byId.has(id)) byId.set(id, sha);
-  }
-  return byId;
-}
-
-// PURE — the stranded set. `openRows` are { id, status }; `landed` is scanLog's map.
-// Kept separate from the IO so the decision is unit-testable with no git and no API.
-function strandedRows(openRows, landed) {
-  const out = [];
-  for (const row of openRows || []) {
-    const id = String(row && row.id);
-    if (!landed.has(id)) continue;
-    out.push({ id, status: String(row.status || ''), sha: landed.get(id).slice(0, 8) });
-  }
-  return out.sort((a, b) => Number(a.id) - Number(b.id));
-}
-
-function readLog(cwd) {
-  return execFileSync('git', ['log', MAIN_REF, `--pretty=${SEP}%H%n%B`], {
-    cwd, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'],
-  });
-}
-
-// Both statuses that mean "nobody has started this". A row already `active` or
-// `completed` is someone's live work, not a strand.
-const OPEN_STATUSES = ['ready', 'backlog'];
-
-// A hard stop so a paging bug cannot loop forever. Reaching it means the board grew
-// past what one scan should walk, which is a fact worth SAYING rather than silently
-// truncating — a detector that quietly stops early reports a clean board.
-const MAX_PAGES = 50;
-
-// PURE-ish — the paging walk, with `getPage` injected. Extracted and exported because
-// it was the only untested IO in this file, and off-by-one paging is exactly the kind
-// of logic that silently returns a short list (and a short list here means 'nothing is
-// stranded').
-async function pageOpenRows(getPage, { statuses = OPEN_STATUSES, pageSize = 200, maxPages = MAX_PAGES } = {}) {
-  const rows = [];
-  for (const status of statuses) {
-    let offset = 0;
-    let page = 0;
-    for (; page < maxPages; page += 1) {
-      const r = await getPage({ status, limit: pageSize, offset });
-      if (!r || !r.ok) throw new Error(`could not list ${status} tasks (${r && r.status})`);
-      const got = (r.data && r.data.tasks) || [];
-      for (const t of got) rows.push({ id: t.id, status: t.status });
-      // A SHORT page is the end of the table. Compared against the size the route
-      // actually honoured, never the size we asked for — the route clamps.
-      if (got.length < (r.limit || pageSize)) break;
-      offset += got.length;
-    }
-    if (page >= maxPages) {
-      throw new Error(`more than ${maxPages} pages of ${status} tasks — refusing to report a partial board as clean`);
-    }
-  }
-  return rows;
-}
-
-async function readOpenRows() {
-  const { cliClient } = require('./cli-lib.js');
-  const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
-  const api = await cliClient();
-  return pageOpenRows(async ({ status, limit, offset }) => {
-    const q = buildTaskPageQuery({ status, limit, offset });
-    const r = await api.tasks.getTasks({ query: q });
-    // Carry the limit the route HONOURED back to the walker, so its short-page test
-    // compares against the clamped size rather than the requested one.
-    return r && { ok: r.ok, status: r.status, data: r.data, limit: q.limit };
-  }, { pageSize: TASK_LIST_MAX_LIMIT });
-}
-
-async function scan(cwd) {
-  const landed = scanLog(readLog(cwd));
-  // The scan must not pass by finding nothing: this repo's own history is built out of
-  // these lines, so an empty map means the pattern broke.
-  if (landed.size === 0) throw new Error('no commit claims to have done any task — the pattern has drifted');
-  return { stranded: strandedRows(await readOpenRows(), landed), scanned: landed.size };
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const line = argv.includes('--line');
-  let r;
-  try {
-    r = await scan(process.cwd());
-  } catch (e) {
-    if (line) process.exit(0); // fail OPEN — a probe never blocks a session
-    console.error(`stranded-rows: undetermined — ${e.message || e}`);
-    process.exit(2);
-  }
-
-  if (argv.includes('--json')) { console.log(JSON.stringify(r, null, 2)); return; }
-  if (line) {
-    if (r.stranded.length) {
-      const ids = r.stranded.slice(0, 6).map((s) => s.id).join(', ');
-      const more = r.stranded.length > 6 ? ` +${r.stranded.length - 6} more` : '';
-      console.log(`Stranded rows: ${r.stranded.length} open task(s) whose work already landed on main (${ids}${more}). `
-        + 'Claiming one means reading the code to prove there is nothing to do. Run node scripts/gds/stranded-rows.js.');
-    }
-    return;
-  }
-  console.log(`  Stranded rows: ${r.stranded.length} (of ${r.scanned} task id(s) named as an authoring subject on main)`);
-  for (const s of r.stranded) console.log(`    task ${s.id}  [${s.status}]  landed in ${s.sha}`);
-  if (r.stranded.length) {
-    console.log('  Each of these has a commit on main claiming to have done it. Verify, then ship or abandon the row.');
-    process.exit(1);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { authoredIds, scanLog, strandedRows, pageOpenRows, AUTHORED_RE, SEP, OPEN_STATUSES, MAX_PAGES };
+require('../bongos/forwarder.js').forward(module, 'stranded-rows.js');

package/scripts/gds/stray-unit-sweep.sh

@@ -1,71 +1,8 @@
 #!/usr/bin/env bash
-# scripts/gds/stray-unit-sweep.sh — find (and with --apply, stop + remove) a project's systemd
-# units that are still on the control plane although its provisioning row is torn down
-# (task 1003939, an ADR 0285 follow-up).
-#
-# WHY. On 2026-09-16 `demo.service` was RUNNING and enabled while the demo row read torn_down:
-# a torn-down project holding ~80 MB on a box whose ceiling is 15 projects, outside the count
-# the ledger keeps. The live MemAvailable floor (task 1003927) covers placement, but the memory
-# is still gone and the unit still restarts on boot. The teardown leg is the fix going forward
-# (task 1003940 added reset-failed); this is the BACKSTOP that finds what an older teardown
-# left behind, from the ledger's own list of torn-down rows, and names it so the ship note can.
-#
-# Run on the control plane as a sudoer:
-#   bash scripts/gds/stray-unit-sweep.sh            # survey only — read-only
-#   bash scripts/gds/stray-unit-sweep.sh --apply    # disable --now, remove the unit files, reload, reset-failed
-# Run from anywhere but an instance's own vendored core, set INSTANCE_DIR to that instance.
-#
-# Left in place on purpose, even with --apply: the project's database, its dumps under
-# /var/backups/gds, any checkout, and its Caddy block — data is precious, and the address is
-# task 1002897's to reclaim.
-set -uo pipefail
-
-APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
-DB="${PGDATABASE:-cloudbongos}"
-ETC=/etc/systemd/system
-
-# The app account (task 1004135) — never a named person: PROVISION_APP_USER, else the owner
-# of the instance checkout, found the way address-park-sweep.sh finds it (three levels up
-# from an instance's vendored core; from anywhere else INSTANCE_DIR names it). A clone in an
-# operator's own home must not decide it. root is refused: it holds no Postgres role here.
-CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
-[ -n "${PROVISION_APP_USER:-}${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout (or PROVISION_APP_USER) — this sweep is not running from one"; exit 1; }
-# Owner by name: GNU stat `-c %U`, else BSD/macOS stat `-f %Su` — each refuses the other's
-# flag (task 1004170), the same lookup address-park-sweep.sh makes.
-APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null || stat -f %Su "$INSTANCE_DIR" 2>/dev/null)}"
-if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
-  echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns ${INSTANCE_DIR:-the instance checkout}"; exit 1
-fi
-
-# The torn-down slugs, from the ledger, read as the app account (peer auth — the runner's
-# own identity; nothing here needs a superuser).
-slugs=$(sudo -n -u "$APP_USER" psql -d "$DB" -tAc "select slug from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
-  || { echo "cannot read provisioning_instances from $DB as $APP_USER"; exit 1; }
-
-found=(); cleared=()
-echo "== torn-down rows that still have systemd units =="
-for slug in $slugs; do
-  # The slug grammar provisioning.isValidSlug enforces; anything else never reaches a command.
-  [[ "$slug" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || continue
-  units="$slug.service $slug-db-backup.service $slug-db-backup.timer"
-  loaded=$(systemctl list-units --all --no-legend $units 2>/dev/null | awk '{print ($1 == "●") ? $2 : $1}' | tr '\n' ' ')
-  files=$(for u in $units; do [ -e "$ETC/$u" ] && printf '%s ' "$u"; done)
-  [ -z "$loaded" ] && [ -z "$files" ] && continue
-  state=$(systemctl is-active "$slug.service" 2>/dev/null || true)
-  printf '  %-24s service=%-9s loaded=[%s] files=[%s]\n' "$slug" "$state" "${loaded% }" "${files% }"
-  found+=("$slug")
-  [ "$APPLY" = 1 ] || continue
-  sudo -n systemctl disable --now "$slug.service" 2>/dev/null || true
-  sudo -n systemctl disable --now "$slug-db-backup.timer" 2>/dev/null || true
-  sudo -n rm -f "$ETC/$slug.service" "$ETC/$slug-db-backup.service" "$ETC/$slug-db-backup.timer"
-  sudo -n systemctl daemon-reload
-  sudo -n systemctl reset-failed "$slug.service" "$slug-db-backup.service" 2>/dev/null || true
-  cleared+=("$slug")
-done
-
-echo "== summary =="
-echo "  stray   (${#found[@]}): ${found[*]:-none}"
-if [ "$APPLY" = 1 ]; then echo "  cleared (${#cleared[@]}): ${cleared[*]:-none}";
-else echo "  (survey only — re-run with --apply to disable, remove and reset-failed them)"; fi
-echo "  MemAvailable: $(awk '/MemAvailable/ {print int($2/1024) " MB"}' /proc/meminfo)"
+# scripts/gds/stray-unit-sweep.sh — @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/stray-unit-sweep.sh. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if [ -z "${BONGOS_FORWARDER_WARNED:-}" ]; then echo "[bongos] scripts/gds/stray-unit-sweep.sh has moved to scripts/bongos/stray-unit-sweep.sh. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release." >&2; fi
+export BONGOS_FORWARDER_WARNED=1
+exec bash "$(dirname "$0")/../bongos/stray-unit-sweep.sh" "$@"