@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/adopt-preflight.js

@@ -1,187 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/adopt-preflight.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/adopt-preflight.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// scripts/gds/adopt-preflight.js — the conflict PRE-FLIGHT for `bongos init --adopt`
-// (ADR 0121 §Decision 5 / task 2045). Before adopt writes anything, it reports the
-// blast radius the owner must ACCEPT:
-//   • migration-namespace collisions — a repo migration using core's reserved prefix
-//     (ADR 0108 §5, via migration-namespace.js's canonical filenameViolation).
-//   • core<->host fitness-boundary overlaps — repo dirs that shadow core's reserved
-//     src/bongos or modules/ namespaces the fitness gate scans (ADR 0062 §1).
-//   • protected-path landings — incoming files that fall on the trust-boundary hard
-//     floor (ADR 0043, via gate-review.js's canonical matchesHardFloor).
-//   • CI collisions — the repo's workflows vs core's expected unit/secret-scan/
-//     gate-review checks.
-//   • IGNORED incoming files — a pre-existing .gitignore rule that would swallow what
-//     adopt is about to commit (task 1003881). This is the check that was missing when
-//     Cloud Bongos was adopted onto a repo whose .gitignore already carried `.claude/`:
-//     the skills, hooks and settings.json were materialized onto disk and then dropped
-//     by `git add`, so the adopt commit landed 8 files with no methodology surface at
-//     all. Nothing failed, nothing was logged, and every clone of that repo has been
-//     missing its /builder-* commands since. BLOCKING, because the result is a
-//     non-functional instance that looks fine.
-// READ-ONLY: it computes findings; the accept-gate that decides whether to proceed
-// lives in init.js runAdopt. Pure check functions + a thin fs-reading orchestrator.
-
-const nodeFs = require('node:fs');
-const nodePath = require('node:path');
-const { execFileSync: nodeExecFileSync } = require('node:child_process');
-const { filenameViolation, INSTANCE_NS } = require('./migration-namespace');
-const { matchesHardFloor } = require('./gate-review');
-
-const SEV = { BLOCK: 'blocking', WARN: 'warning', INFO: 'info' };
-const CORE_EXPECTED_CHECKS = ['unit', 'secret-scan', 'gate-review']; // the merge-gate checks core adds
-
-// The files `bongos init --adopt` writes/materializes — the "incoming" set the
-// protected-path check runs against (representative globs; the .claude/ trees expand).
-const INCOMING_PATHS = [
-  'config/branding.json', 'config/modules.json', 'config/hierarchy.json',
-  'package.json', '.claude/settings.json', '.claude/hooks/', '.claude/skills/',
-];
-
-// PURE — repo migration basenames → findings. A basename destined for the INSTANCE
-// namespace that violates the namespace rule (e.g. it uses core's reserved `core_`
-// prefix) would collide with core's migrations on the stem-keyed ledger. Bare-numbered
-// files are valid instance migrations and safe.
-function checkMigrationNamespace(basenames = []) {
-  const findings = [];
-  if (!basenames.length) return findings;
-  const reserved = basenames.filter((b) => filenameViolation(INSTANCE_NS, b));
-  for (const b of reserved) {
-    findings.push({ category: 'migration-namespace', severity: SEV.BLOCK, message: `migration "${b}" uses a reserved (core_/module) prefix — it would collide with core's migration namespace (ADR 0108 §5). Renumber it as a bare instance migration.` });
-  }
-  const bare = basenames.length - reserved.length;
-  if (bare > 0) findings.push({ category: 'migration-namespace', severity: SEV.INFO, message: `${bare} existing migration(s) adopt as the INSTANCE namespace (bare-numbered); core uses the core_ prefix, so there is no stem collision (ADR 0108 §5).` });
-  return findings;
-}
-
-// PURE — repo layout → fitness-boundary findings (ADR 0062 §1). A repo that already
-// has a top-level modules/ or a src/bongos/ shadows the namespaces core's fitness gate
-// scans, so its own files there may be flagged after adoption.
-function checkFitnessBoundary({ topLevelDirs = [], hasSrcBongos = false } = {}) {
-  const findings = [];
-  if (topLevelDirs.includes('modules')) findings.push({ category: 'fitness-boundary', severity: SEV.WARN, message: 'the repo has a top-level `modules/` dir — core\'s fitness gate scans modules/** for the module-import boundary (ADR 0062 §1); your files there may be flagged.' });
-  if (hasSrcBongos) findings.push({ category: 'fitness-boundary', severity: SEV.WARN, message: 'the repo has `src/bongos/` — it shadows core\'s reserved kernel namespace scanned by the fitness gate (ADR 0062 §1).' });
-  if (!findings.length) findings.push({ category: 'fitness-boundary', severity: SEV.INFO, message: 'no overlap with core\'s reserved src/bongos or modules/ namespaces.' });
-  return findings;
-}
-
-// PURE — incoming paths → protected-path findings (ADR 0043). Which files adopt writes
-// land on the trust-boundary hard floor (via gate-review's canonical matcher)?
-function checkProtectedPaths(incoming = INCOMING_PATHS) {
-  const hits = incoming.filter((p) => matchesHardFloor(p));
-  if (!hits.length) return [{ category: 'protected-paths', severity: SEV.INFO, message: 'no incoming files land on protected paths.' }];
-  return [{ category: 'protected-paths', severity: SEV.WARN, message: `adopt materializes ${hits.length} core-governed file(s) on protected paths (ADR 0043): ${hits.join(', ')}. Additive only — but these are under the trust boundary, so treat them as core-managed.` }];
-}
-
-// PURE — the repo's CI workflows ([{ name, content }]) → CI-collision findings. Flags a
-// workflow that already references a core-reserved check name (unit / secret-scan /
-// gate-review); otherwise notes that core will add those checks alongside existing ones.
-function checkCiCollisions(workflows = []) {
-  if (!workflows.length) return [{ category: 'ci', severity: SEV.INFO, message: 'no existing CI workflows — core\'s unit/secret-scan/gate-review checks will be the only ones.' }];
-  const collisions = new Set();
-  for (const wf of workflows) {
-    for (const check of CORE_EXPECTED_CHECKS) {
-      if (new RegExp(`\\b${check.replace(/[-]/g, '\\-')}\\b`, 'i').test(wf.content || '')) collisions.add(`${wf.name} → ${check}`);
-    }
-  }
-  if (collisions.size) return [{ category: 'ci', severity: SEV.WARN, message: `existing CI workflow(s) reference core-reserved check name(s): ${[...collisions].join(', ')}. Core adds unit/secret-scan/gate-review — reconcile names so the merge gate keys on the right job.` }];
-  return [{ category: 'ci', severity: SEV.INFO, message: `${workflows.length} existing CI workflow(s); core will ADD its own unit/secret-scan/gate-review checks alongside them — confirm no required-check conflict.` }];
-}
-
-// PURE — [{ path, rule }] of incoming files a .gitignore rule would swallow → findings.
-// BLOCKING: an ignored incoming file is not a style problem, it is silent data loss at
-// `git add` time, and the instance that results is broken in a way nothing reports.
-function checkIgnoredIncoming(ignored = [], { checked = true } = {}) {
-  if (!checked) {
-    return [{ category: 'ignored-incoming', severity: SEV.INFO, message: 'could not run `git check-ignore` here (no git, or not a repo yet) — cannot confirm the incoming files are committable. Re-check after `git init` if adopt lands nothing under .claude/.' }];
-  }
-  if (!ignored.length) {
-    return [{ category: 'ignored-incoming', severity: SEV.INFO, message: 'no existing ignore rule swallows the files adopt writes — they will all reach the commit.' }];
-  }
-  const lines = ignored.map((i) => (i.rule ? `${i.path} (ignored by ${i.rule})` : i.path));
-  return [{
-    category: 'ignored-incoming',
-    severity: SEV.BLOCK,
-    message: `${ignored.length} file(s) adopt writes are IGNORED by this repo and would be silently dropped from the commit: ${lines.join('; ')}. `
-      + 'Adopt would appear to succeed and produce an instance missing that surface — a repo ignoring `.claude/` gets no /builder-* commands on any clone. '
-      + 'Fix the rule (delete it, or add a negation such as `!.claude/` after it), then re-run.',
-  }];
-}
-
-// Which of `incoming` does this repo's ignore rules match? Uses `git check-ignore -v`,
-// which reports the SOURCE RULE for each match, so the finding can name the exact line
-// the owner has to change rather than leaving them to hunt for it.
-//
-// Returns { ignored:[{path, rule}], checked:boolean }. `checked:false` means the probe
-// could not run at all (no git, not a repo) — deliberately distinct from "nothing is
-// ignored", because the two warrant different advice. execFileSync is injectable for
-// tests; git exits 1 when nothing matches, which is a normal answer and not an error.
-function probeIgnoredIncoming({ dir, incoming = INCOMING_PATHS, execFileSync = nodeExecFileSync } = {}) {
-  // Trailing slashes are ours (they mark dirs in the list); git wants plain pathnames.
-  const paths = incoming.map((p) => String(p).replace(/\/+$/, ''));
-  let out = '';
-  try {
-    out = execFileSync('git', ['check-ignore', '-v', '--stdin'], {
-      cwd: dir, input: paths.join('\n'), encoding: 'utf8', timeout: 5000,
-      stdio: ['pipe', 'pipe', 'ignore'],
-    }) || '';
-  } catch (err) {
-    // Exit 1 = "no path is ignored" (a real answer, stdout empty). Anything else means
-    // the probe itself could not run.
-    if (err && err.status === 1) return { ignored: [], checked: true };
-    return { ignored: [], checked: false };
-  }
-  const ignored = [];
-  for (const line of out.split('\n')) {
-    if (!line.trim()) continue;
-    // `<source>:<line>:<pattern>\t<pathname>`
-    const tab = line.lastIndexOf('\t');
-    if (tab === -1) continue;
-    const rule = line.slice(0, tab).trim();
-    const pathname = line.slice(tab + 1).trim();
-    ignored.push({ path: pathname, rule });
-  }
-  return { ignored, checked: true };
-}
-
-// Read the repo (migrations, src/bongos, workflows) and run every check. `stack` is the
-// adopt-detect summary (task 2043); we re-read only what the checks need. Returns
-// { findings, counts:{blocking,warning,info}, hasBlocking }.
-function preflightAdopt({ dir, stack = {}, fs = nodeFs, path = nodePath, execFileSync = nodeExecFileSync } = {}) {
-  const listFiles = (rel) => { try { return fs.readdirSync(path.join(dir, rel)).filter((f) => { try { return fs.statSync(path.join(dir, rel, f)).isFile(); } catch { return false; } }); } catch { return []; } };
-  const exists = (rel) => { try { return fs.existsSync(path.join(dir, rel)); } catch { return false; } };
-
-  // migrations across every detected migrations dir
-  const migrationBasenames = (stack.migrationsDirs || []).flatMap((d) => listFiles(d).filter((f) => /\.sql$/i.test(f)));
-
-  // github workflow contents (only when github-actions was detected)
-  const workflows = [];
-  const gh = (stack.ci || []).find((c) => c.system === 'github-actions');
-  if (gh) {
-    for (const wf of gh.workflows || []) {
-      let content = '';
-      try { content = fs.readFileSync(path.join(dir, '.github/workflows', wf), 'utf8'); } catch { content = ''; }
-      workflows.push({ name: wf, content });
-    }
-  }
-
-  const findings = [
-    ...checkMigrationNamespace(migrationBasenames),
-    ...checkFitnessBoundary({ topLevelDirs: stack.topLevelDirs || [], hasSrcBongos: exists('src/bongos') }),
-    ...checkProtectedPaths(INCOMING_PATHS),
-    ...checkCiCollisions(workflows),
-    ...(() => { const { ignored, checked } = probeIgnoredIncoming({ dir, execFileSync }); return checkIgnoredIncoming(ignored, { checked }); })(),
-  ];
-  const counts = { blocking: 0, warning: 0, info: 0 };
-  for (const f of findings) counts[f.severity === SEV.BLOCK ? 'blocking' : f.severity === SEV.WARN ? 'warning' : 'info']++;
-  return { findings, counts, hasBlocking: counts.blocking > 0 };
-}
-
-// Human-readable report lines (one per finding, severity-marked), for the owner to
-// read before accepting. Returns an array of strings.
-function formatPreflight(report) {
-  const mark = { [SEV.BLOCK]: '✗ BLOCK', [SEV.WARN]: '⚠ warn', [SEV.INFO]: '· ok' };
-  return report.findings.map((f) => `  ${mark[f.severity] || '·'}  [${f.category}] ${f.message}`);
-}
-
-module.exports = { preflightAdopt, formatPreflight, checkMigrationNamespace, checkFitnessBoundary, checkProtectedPaths, checkCiCollisions, checkIgnoredIncoming, probeIgnoredIncoming, INCOMING_PATHS, CORE_EXPECTED_CHECKS, SEV };
+require('../bongos/forwarder.js').forward(module, 'adopt-preflight.js');

package/scripts/gds/adr-namespace.js

@@ -1,273 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/adr-namespace.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/adr-namespace.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// adr-namespace.js — ADR numbering discipline (task 1003164). The ADR half of the guard
-// `migration-namespace.js` already gives migrations. Pure helpers over file lists + index
-// text, plus the fitness check that reads the tree.
-//
-// PROBLEM. An ADR number is a CITATION TARGET. ADRs cite each other by number, prose and
-// task notes cite them by number, and `docs/adr/README.md` is the index every agent is
-// told to consult. Two files can carry the same number and NOTHING notices: the filenames
-// differ (`0181-ship-requires-an-assurance.md` vs
-// `0181-teardown-state-gate-and-address-retention.md`), so there is no path collision, no
-// merge conflict, and git adds both cleanly. README.md auto-merges too, ending up with two
-// `| 0181 |` rows. Unit, fitness, docs-entropy and the grader all passed; it was found on
-// 2026-08-22 only because a human read `ls docs/adr/`. By then task 1000900's
-// close-rationale had already cited "ADR 0180", which the collision had made point at an
-// unrelated document — a citation that is wrong forever.
-//
-// THE ASYMMETRY THIS CLOSES. Migrations have exactly this protection already: a re-used
-// migration number silently SKIPS a migration, so `stemCollisions()` hard-fails CI. ADRs
-// got `next-number.js` — which computes the next free number at claim time, on a
-// possibly-stale tree, best-effort — and then nothing enforced it afterwards. Same shared,
-// monotonic, human-allocated number line; one guarded, one not. A stale claim card, two
-// builders claiming the same day, or a branch that sits long enough all reproduce it.
-//
-// WHY GRANDFATHER RATHER THAN RENUMBER. When this landed the live tree already held TWENTY
-// colliding numbers, not the one the bug report found. Renumbering nineteen pairs would
-// break every existing citation to them — which is the very harm this check exists to
-// prevent — and README.md states the rule outright: a number, once assigned, is never
-// reused. So the existing pairs are frozen into LEGACY_DUPLICATE_ADRS by their EXACT
-// filenames (the shape migration-namespace.js uses for its own grandfathering, and for
-// RENAMED_MODULE_PREFIXES). Frozen by exact filename, not by number, is the load-bearing
-// part: a THIRD file joining a legacy number still fails, and so does a rename of either
-// half. The list can only shrink. See ADR 0195.
-//
-// The index half is checked by LINK TARGET, not by number, because a number rule alone
-// cannot express the grandfathered pairs: the invariant is that every ADR file has exactly
-// one row and every row points at a file that exists. That catches the dangling row AND
-// the duplicated row AND the file nobody indexed — the last of which is how a collision
-// actually hides, since the second file of a colliding pair is the one that never gets a
-// row.
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { CORE_ROOT } = require('./fitness-lib.js');
-
-// ---- parsing ---------------------------------------------------------------
-
-// `NNNN-kebab-title.md` — the naming rule in docs/adr/README.md §File naming.
-const ADR_RE = /^(\d{4})-(.+)\.md$/;
-
-// Parse an ADR basename into { number, num, slug, ok }. `number` is the 4-digit STRING
-// (the citation form, zero-padded); `num` is the integer for ordering/allocation. A
-// non-ADR name (README.md, a draft) returns { ok: false }.
-function parseAdrName(basename) {
-  const m = ADR_RE.exec(String(basename == null ? '' : basename));
-  if (!m) return { number: null, num: null, slug: null, ok: false };
-  return { number: m[1], num: parseInt(m[1], 10), slug: m[2], ok: true };
-}
-
-// The 4-digit number string of an ADR basename, or null if it is not an ADR.
-function adrNumberOf(basename) {
-  const p = parseAdrName(basename);
-  return p.ok ? p.number : null;
-}
-
-// ---- grandfathered collisions ---------------------------------------------
-
-// Numbers already shared by two files when this check landed (task 1003164, 2026-08-27).
-// Frozen by EXACT filename: a third file on one of these numbers, or a rename of either
-// half, is still a hard failure. This list may shrink (if a pair is ever consolidated) and
-// must never grow — a new collision is the bug the check exists to catch.
-const LEGACY_DUPLICATE_ADRS = Object.freeze({
-  '0008': Object.freeze(['0008-family-based-tile-generation.md', '0008-google-chat-oauth-user-auth.md']),
-  '0024': Object.freeze(['0024-cloneable-repo-local-first-memory.md', '0024-multi-agent-system-architecture.md']),
-  '0025': Object.freeze(['0025-offsite-backup-vendor-digitalocean-spaces.md', '0025-structured-criterion-task-link.md']),
-  '0044': Object.freeze(['0044-mediterranean-palette-replacement.md', '0044-per-box-live-game-preview.md']),
-  '0057': Object.freeze(['0057-container-cost-ledger.md', '0057-discord-archon-approval-channels.md']),
-  '0072': Object.freeze(['0072-bongos-app-mac-signed-first-windows-deferred.md', '0072-dev-box-code-staleness-visibility.md']),
-  '0073': Object.freeze(['0073-builder-needs-signal-and-byok-gemini-key.md', '0073-secrets-scan-exclude-uri-detector.md']),
-  '0082': Object.freeze(['0082-productized-key-storage-provisioning.md', '0082-server-side-merge-conflict-auto-resolution.md']),
-  '0087': Object.freeze(['0087-bongos-app-architecture-and-handoff-contract.md', '0087-compete-on-governance-not-tooling-cursor.md']),
-  '0095': Object.freeze(['0095-borrowed-memory-and-retrieval-concepts.md', '0095-cross-agent-context-management.md']),
-  '0097': Object.freeze(['0097-one-active-claim-per-session-and-worktree-binding.md', '0097-retroactive-reward-backfill.md']),
-  '0103': Object.freeze(['0103-core-first-extraction-cloud-bongos-trunk.md', '0103-gdsv4-bongos-consolidation.md']),
-  '0144': Object.freeze(['0144-devbox-rehome-onto-cloudbongos-plane.md', '0144-federated-single-logout-backchannel.md']),
-  '0145': Object.freeze(['0145-devbox-app-branding-driven-module.md', '0145-free-hosted-project-tier-isolation-and-domain-separation.md']),
-  '0152': Object.freeze(['0152-landing-gate-served-by-the-core-app.md', '0152-metic-task-abandonment.md']),
-  '0167': Object.freeze(['0167-gate-trust-link-agpl-default.md', '0167-module-catalog-source-vs-provenance.md']),
-  '0172': Object.freeze(['0172-editable-rank-roles-substrate-axis.md', '0172-per-craft-compensation-ideator-credit-lane.md']),
-  '0184': Object.freeze(['0184-a-task-visual-inherits-its-summary-audience.md', '0184-ship-requires-an-assurance.md']),
-  '0187': Object.freeze(['0187-collab-four-decisions.md', '0187-oauth-handshake-cookie-lifetime.md']),
-  '0192': Object.freeze(['0192-a-category-orients-and-authorises-nothing.md', '0192-platform-visibility-member-door.md']),
-});
-
-// Is this exact set of files the frozen legacy pair for that number? Set-equality, so
-// adding a third file or renaming either half stops being grandfathered.
-function isGrandfathered(number, files) {
-  const legacy = LEGACY_DUPLICATE_ADRS[number];
-  if (!legacy) return false;
-  if (files.length !== legacy.length) return false;
-  const a = [...files].sort();
-  const b = [...legacy].sort();
-  return a.every((f, i) => f === b[i]);
-}
-
-// ---- collision detector ----------------------------------------------------
-
-// Given ADR basenames, return [{ number, files[] }] for every number claimed by more than
-// one file, EXCLUDING the frozen legacy pairs. The direct analogue of
-// migration-namespace.js stemCollisions().
-function numberCollisions(basenames) {
-  const byNumber = new Map();
-  for (const name of basenames || []) {
-    const p = parseAdrName(name);
-    if (!p.ok) continue;
-    if (!byNumber.has(p.number)) byNumber.set(p.number, new Set());
-    byNumber.get(p.number).add(name);
-  }
-  const out = [];
-  for (const [number, set] of byNumber) {
-    const files = [...set].sort();
-    if (files.length > 1 && !isGrandfathered(number, files)) out.push({ number, files });
-  }
-  return out.sort((a, b) => a.number.localeCompare(b.number));
-}
-
-// The next free ADR number (integer): max + 1, 1 on an empty tree. Mirrors next-number.js
-// nextFree so a caller can allocate without reaching for git.
-function nextAdrNumber(basenames) {
-  let max = 0;
-  for (const name of basenames || []) {
-    const p = parseAdrName(name);
-    if (p.ok && p.num > max) max = p.num;
-  }
-  return max + 1;
-}
-
-// ---- index (docs/adr/README.md) --------------------------------------------
-
-// An index row: `| NNNN | [Title](NNNN-slug.md) | topic |`. The leading cell may carry a
-// disambiguating suffix (`0008-a`) for a grandfathered pair, so the number is read from
-// the leading cell and the row's OWN file from the link target that starts with it — row
-// prose cites other ADRs by link too, and only the own-number target is the row's subject.
-const INDEX_ROW_RE = /^\|\s*(\d{4})(?:-[a-z])?\s*\|/;
-const INDEX_LINK_RE = /\]\((\d{4}-[^)]*\.md)\)/g;
-
-// Parse README text into [{ number, target, targets, lineNo, ok }]. `target` is the row's
-// own ADR filename, or null when the row names none (or names more than one of its own
-// number, which is ambiguous and reported as a violation).
-function parseIndexRows(readmeText) {
-  const rows = [];
-  const lines = String(readmeText == null ? '' : readmeText).split('\n');
-  lines.forEach((line, i) => {
-    const m = INDEX_ROW_RE.exec(line);
-    if (!m) return;
-    const number = m[1];
-    INDEX_LINK_RE.lastIndex = 0;
-    const own = [...line.matchAll(INDEX_LINK_RE)].map((x) => x[1]).filter((t) => t.startsWith(number + '-'));
-    rows.push({ number, target: own.length === 1 ? own[0] : null, targets: own, lineNo: i + 1, ok: own.length === 1 });
-  });
-  return rows;
-}
-
-// The index invariant, checked by LINK TARGET: every ADR file has exactly one row, and
-// every row points at a file that exists. Returns violation strings.
-function indexViolations({ basenames = [], rows = [] } = {}) {
-  const violations = [];
-  const files = new Set((basenames || []).filter((n) => parseAdrName(n).ok));
-
-  const rowsByTarget = new Map();
-  for (const r of rows) {
-    if (!r.ok) {
-      violations.push(
-        `docs/adr/README.md:${r.lineNo}: the index row for ${r.number} names ${r.targets.length} link(s) to its own number `
-        + `(${r.targets.join(', ') || 'none'}) — a row must link its own ADR file exactly once so the index can be checked against the tree.`);
-      continue;
-    }
-    if (!rowsByTarget.has(r.target)) rowsByTarget.set(r.target, []);
-    rowsByTarget.get(r.target).push(r.lineNo);
-  }
-
-  for (const [target, lineNos] of [...rowsByTarget.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
-    if (!files.has(target)) {
-      violations.push(
-        `docs/adr/README.md:${lineNos[0]}: index row points at docs/adr/${target}, which does not exist — a dangling index row `
-        + `(the other half of the collision problem: a merge can leave a row behind after the file it named moved or was renumbered).`);
-    }
-    if (lineNos.length > 1) {
-      violations.push(
-        `docs/adr/README.md: ${target} has ${lineNos.length} index rows (lines ${lineNos.join(', ')}) — exactly one row per ADR; `
-        + 'a duplicated row is what an auto-merged index leaves behind.');
-    }
-  }
-
-  for (const f of [...files].sort()) {
-    if (!rowsByTarget.has(f)) {
-      violations.push(
-        `docs/adr/${f} has no row in docs/adr/README.md — every ADR is indexed. (This is how a number collision hides: the `
-        + 'second file of a colliding pair is the one that never gets indexed, so the tree and the index quietly disagree.)');
-    }
-  }
-
-  return violations;
-}
-
-// Rows should read in ascending number order. WARNING only, never a hard failure: the live
-// index carries legacy rows an auto-merge placed out of order, and blocking on history
-// would fail every PR for a mess nobody's diff created (the ADR 0189 split — declaration
-// rot hard-fails, inherited drift warns).
-function indexOrderWarnings(rows) {
-  const warnings = [];
-  let prev = null;
-  for (const r of rows) {
-    if (prev !== null && r.number < prev) {
-      warnings.push(`docs/adr/README.md:${r.lineNo}: row ${r.number} sits after ${prev} — the index reads in ascending order.`);
-    }
-    if (prev === null || r.number > prev) prev = r.number;
-  }
-  return warnings;
-}
-
-// ---- the fitness check -----------------------------------------------------
-
-const ADR_DIR = path.join(CORE_ROOT, 'docs', 'adr');
-
-function adrFilesIn(absDir) {
-  try { return fs.readdirSync(absDir).filter((f) => parseAdrName(f).ok).sort(); }
-  catch { return []; } // no docs/adr in a vanilla instance → nothing to check
-}
-
-// Check 31 — two ADRs may not share a number, and the index must agree with the tree.
-function checkAdrNumbering() {
-  const files = adrFilesIn(ADR_DIR);
-  const violations = [];
-
-  for (const c of numberCollisions(files)) {
-    violations.push(
-      `ADR number ${c.number} is claimed by ${c.files.length} files (${c.files.map((f) => `docs/adr/${f}`).join(', ')}) — `
-      + 'an ADR number is a citation target, so a duplicate makes every citation to it ambiguous forever. Renumber the NEWER '
-      + 'file to the next free number (node scripts/gds/next-number.js) and move its README row with it.');
-  }
-
-  let readme = null;
-  try { readme = fs.readFileSync(path.join(ADR_DIR, 'README.md'), 'utf8'); } catch { /* no index → nothing to reconcile */ }
-  const rows = readme === null ? [] : parseIndexRows(readme);
-  if (readme !== null) violations.push(...indexViolations({ basenames: files, rows }));
-  const warnings = readme === null ? [] : indexOrderWarnings(rows);
-
-  return {
-    name: 'ADR numbers unique + index agrees with the tree (task 1003164)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings,
-    note: `${files.length} ADR file(s), ${rows.length} index row(s), `
-      + `${Object.keys(LEGACY_DUPLICATE_ADRS).length} grandfathered duplicate number(s) (frozen by exact filename — the list may only shrink). `
-      + `Next free number: ${String(nextAdrNumber(files)).padStart(4, '0')}.`,
-  };
-}
-
-module.exports = {
-  ADR_RE,
-  LEGACY_DUPLICATE_ADRS,
-  parseAdrName,
-  adrNumberOf,
-  isGrandfathered,
-  numberCollisions,
-  nextAdrNumber,
-  parseIndexRows,
-  indexViolations,
-  indexOrderWarnings,
-  checkAdrNumbering,
-};
+require('../bongos/forwarder.js').forward(module, 'adr-namespace.js');