@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/probe-cache.js

@@ -1,246 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/probe-cache.js — one answer, shared by the sessions that start together
-// (task 1003689).
-//
-// THE MEASUREMENT. SessionStart runs six hooks, three of which call the server. Start
-// four sessions within three seconds — the normal pattern for this project, one worktree
-// per claim — and ALL of them time out:
-//
-//   20:19:53  one session     med  4,797ms   timeouts 0/5
-//   20:49:59  four sessions   med 17,307ms   timeouts 5/5
-//   20:50:00                  med 18,341ms   timeouts 5/5
-//   20:50:01                  med 17,127ms   timeouts 5/5
-//   20:50:02                  med 17,350ms   timeouts 5/5
-//   21:03:46  one session     med  5,942ms   timeouts 0/5
-//
-// Identical config either side. It is contention, not the wrapper: the clean sessions are
-// wrapped too, the same collapse predates the wrapper, and run-node.sh's own cost is +15ms.
-//
-// WHAT IT COSTS. A timed-out SessionStart hook produces NO LINE. So deploy-divergence,
-// strand-watch, push-path-brief and stale-worktrees all go quiet — the truth-teller briefs
-// those hooks exist to emit. The builder gets four sessions flying blind and the only
-// symptom is a non-blocking status code. Silence is indistinguishable from "nothing to
-// report", which is exactly the shape these probes are designed to avoid.
-//
-// THE FIX, and why this one. The four sessions are asking the SAME server the SAME
-// question within three seconds. So the first to arrive answers it and the rest read that
-// answer. Not a jitter/backoff (which spends wall-clock to avoid a stampede that does not
-// need to happen), and not one merged process (which would couple four independent probes
-// into a single failure domain and is a much larger change).
-//
-// EVERY FAILURE MODE FALLS BACK TO "just run the probe". A cache that cannot be read,
-// written, parsed or locked must never be the reason a session loses its brief — that
-// would trade a timeout for a different silence.
-
+// scripts/gds/probe-cache.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/probe-cache.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const crypto = require('node:crypto');
-
-// Default freshness. The probes this serves answer questions that change on a
-// deploy or a ship — minutes, not seconds — so 60s is generous for a session brief
-// and still collapses any realistic burst of concurrent starts.
-const DEFAULT_TTL_MS = 60_000;
-
-// How long a producer may hold the lock before another process stops waiting for it.
-// Sized just over the slowest observed clean probe (~7.7s), so a genuinely slow
-// answer is still shared rather than re-raced.
-const LOCK_STALE_MS = 10_000;
-
-// Cache lives in the OS temp dir, not the repo: it is derived, per-machine, and must
-// never be committed or survive a reboot.
-//
-// PRIVATE TO THIS USER (0o700), and every record written 0o600. The path is
-// deterministic and os.tmpdir() is world-writable on a multi-user POSIX box, so without
-// this another account could plant a record that readRecord() would parse and trust
-// verbatim — a session brief is not a credential, but it IS agent-facing text, and
-// nothing here should let one user write into another's context.
-function cacheDir() {
-  const dir = path.join(os.tmpdir(), `bongos-probe-cache-${process.getuid ? process.getuid() : os.userInfo().username}`);
-  try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { /* fall through; writeRecord fails open */ }
-  return dir;
-}
-
-// THE SCOPE IS THE INSTANCE, NOT THE DIRECTORY (grade round 1). This defaulted to
-// process.cwd(), which defeated the entire fix for the exact scenario it was built for:
-// the measured failure is four sessions in FOUR DIFFERENT WORKTREES — one per claim, the
-// normal pattern here — so four cwds hashed to four keys and nothing was ever shared.
-//
-// The four-process test missed it because all four children ran from one directory. A
-// test that does not model the scenario proves the wrong thing.
-//
-// git's COMMON dir is the right identity: every worktree of one checkout reports the
-// same `.git`, and two unrelated checkouts report different ones — which is the
-// distinction that actually matters, since the probes ask one server about one repo.
-let _scopeCache;
-function defaultScope() {
-  if (_scopeCache !== undefined) return _scopeCache;
-  try {
-    const out = require('node:child_process').execFileSync('git', ['rev-parse', '--path-format=absolute', '--git-common-dir'], {
-      encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-    _scopeCache = out || process.cwd();
-  } catch {
-    // Not a git checkout, or git is unavailable: fall back to the directory. Worse
-    // sharing, never wrong sharing.
-    _scopeCache = process.cwd();
-  }
-  return _scopeCache;
-}
-
-function cachePath(key, scope = defaultScope()) {
-  const h = crypto.createHash('sha256').update(`${scope}\u0000${key}`).digest('hex').slice(0, 16);
-  return path.join(cacheDir(), `${String(key).replace(/[^a-z0-9._-]/gi, '_')}-${h}.json`);
-}
-
-// PURE — is this record still fresh? Exported so the decision is testable without a
-// clock or a disk.
-function isFresh(record, ttlMs, nowMs) {
-  if (!record || typeof record.at !== 'number') return false;
-  // A record from the FUTURE means the clock moved; treat it as stale rather than
-  // trusting it forever.
-  if (record.at > nowMs) return false;
-  return nowMs - record.at < ttlMs;
-}
-
-function readRecord(file) {
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch { return null; }
-}
-
-function writeRecord(file, value, nowMs) {
-  try {
-    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-    // Write-then-rename so a reader never sees a half-written record. The temp name
-    // carries the pid so two producers cannot collide on it.
-    const tmp = `${file}.${process.pid}.tmp`;
-    fs.writeFileSync(tmp, JSON.stringify({ at: nowMs, value }), { mode: 0o600 });
-    fs.renameSync(tmp, file);
-    return true;
-  } catch { return false; }
-}
-
-// Take the producer lock, or report who holds it. A lock is just a directory — mkdir
-// is atomic on every platform we run on, where an exclusive file open is not.
-function tryLock(file) {
-  const lock = `${file}.lock`;
-  try {
-    fs.mkdirSync(path.dirname(lock), { recursive: true, mode: 0o700 });
-    fs.mkdirSync(lock, { mode: 0o700 });
-    return { held: true, release: () => { try { fs.rmdirSync(lock); } catch { /* best effort */ } } };
-  } catch {
-    // Someone else is producing — unless their lock is stale, in which case they died
-    // and nobody would ever produce again.
-    try {
-      const age = Date.now() - fs.statSync(lock).mtimeMs;
-      if (age > LOCK_STALE_MS) {
-        fs.rmdirSync(lock);
-        return tryLock(file);
-      }
-    } catch { /* the lock vanished between the two calls: fall through */ }
-    return { held: false, release: () => {} };
-  }
-}
-
-// How long to wait for the process that holds the lock. Shorter than the 10s hook
-// timeout that this exists to stop tripping, and longer than the ~5s a clean probe
-// measured — so the common case is 'the holder answers and everyone reads it'.
-const WAIT_MS = 7_000;
-const POLL_MS = 100;
-
-// Poll for the holder's record. Returns it, or null if the wait expires or the lock
-// disappears without one (the holder died, or its write failed).
-async function waitForRecord(file, ttlMs, now) {
-  const deadline = Date.now() + WAIT_MS;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, POLL_MS));
-    const rec = readRecord(file);
-    if (isFresh(rec, ttlMs, now())) return rec;
-    // The holder is gone and left nothing: stop waiting and do the work ourselves.
-    let locked = true;
-    try { fs.statSync(`${file}.lock`); } catch { locked = false; }
-    if (!locked) {
-      // RE-READ, deliberately — and my own session log called this a redundant read,
-      // which was wrong. `rec` above was taken BEFORE the lock check; the lock
-      // vanishing between the two means the holder finished in that window, so the
-      // record it wrote is exactly what this branch is looking for. Reusing the
-      // earlier miss would discard the answer we waited for and send this caller off
-      // to repeat the probe.
-      //
-      // Down from three reads in the first cut (the ternary re-read twice more); two
-      // is the floor, because the two reads answer different questions.
-      const afterUnlock = readRecord(file);
-      return isFresh(afterUnlock, ttlMs, now()) ? afterUnlock : null;
-    }
-  }
-  return null;
-}
-
-// `producer` is async and returns the value to cache. Returns { value, from } where
-// `from` is 'cache' | 'fresh' | 'stale-while-locked' — exposed because a probe that
-// cannot tell where its answer came from cannot be debugged.
-async function cached(key, producer, opts = {}) {
-  const { ttlMs = DEFAULT_TTL_MS, now = () => Date.now(), scope = defaultScope() } = opts;
-  let file;
-  try { file = cachePath(key, scope); } catch { return { value: await producer(), from: 'fresh' }; }
-
-  const hit = readRecord(file);
-  if (isFresh(hit, ttlMs, now())) return { value: hit.value, from: 'cache' };
-
-  const lock = tryLock(file);
-  if (!lock.held) {
-    // Another session is asking right now.
-    //
-    // With something cached, prefer ITS LAST ANSWER however old: a slightly stale
-    // brief beats the timeout that produces no brief at all.
-    if (hit) return { value: hit.value, from: 'stale-while-locked' };
-    //
-    // With NOTHING cached — the cold start, which is precisely the measured failure
-    // (four fresh sessions, empty cache, all four timing out) — WAIT for the holder
-    // rather than making the same call alongside it. Falling through to the producer
-    // here is what the first cut did, and the four-process test showed it defeats the
-    // whole point: all four still ran.
-    //
-    // The wait is bounded and generous-but-shorter than the hook's own timeout: the
-    // caller has 10-15s and a clean probe measured ~5s, so waiting up to WAIT_MS for a
-    // shared answer is strictly better than adding the call that makes everyone time
-    // out. If the holder never delivers, we do the work — never return nothing.
-    const waited = await waitForRecord(file, ttlMs, now);
-    if (waited) return { value: waited.value, from: 'waited' };
-    return { value: await producer(), from: 'fresh' };
-  }
-
-  try {
-    const value = await producer();
-    writeRecord(file, value, now());
-    return { value, from: 'fresh' };
-  } finally {
-    lock.release();
-  }
-}
-
-// Drop everything. For tests and for an operator who wants a probe to ask again now.
-//
-// The first cut took a `scope` and then only deleted when it was exactly null — so
-// calling it with its own default deleted nothing while reporting success, which is
-// worse than not having it. It takes no argument now: there is one cache dir and this
-// empties it.
-function clear() {
-  try { fs.rmSync(cacheDir(), { recursive: true, force: true }); } catch { /* nothing cached */ }
-}
-
-if (require.main === module) {
-  // `node scripts/gds/probe-cache.js --clear` — ask everything again on the next start.
-  if (process.argv.includes('--clear')) {
-    const dir = cacheDir();
-    clear();
-    console.log(`probe-cache: cleared ${dir}`);
-  } else {
-    console.log(`probe-cache: ${cacheDir()} (ttl ${DEFAULT_TTL_MS}ms) — --clear to empty it`);
-  }
-}
-
-module.exports = { cached, isFresh, cachePath, cacheDir, clear, defaultScope, DEFAULT_TTL_MS, LOCK_STALE_MS, WAIT_MS };
+require('../bongos/forwarder.js').forward(module, 'probe-cache.js');

package/scripts/gds/prove-strict-versioning.js

@@ -1,284 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/prove-strict-versioning.js — does strict versioning actually hold
-// on THIS instance? (BV1.R30a, task 1003716, goal 1000086; the harness BV1.R30
-// runs. ADR 0250, ADR 0263, ADR 0265.)
-//
-// ADR 0250 built five rules and ADR 0265 added a sixth, all enforced server-side.
-// Nothing could tell you whether they HOLD on a given instance — R30's brief said
-// "run each query against live and capture its output verbatim", which in practice
-// meant hand-assembling a dozen API calls and reading the results by eye. That is
-// how a proof ends up asserting what someone hoped rather than what the instance
-// returned.
-//
-// THE CORE SHIPS TO ANY INSTANCE, so this is not a one-off for the BONGOS-V1
-// cutover. "Is my scope actually closed?" is a question every instance will ask,
-// and its answer should not depend on someone reproducing a call sequence.
-//
-// Two halves, and the split is deliberate:
-//
-//   CHECKS are read-only and always run. They count the live rows and say what
-//   they found, whether or not it is what the rules promise.
-//
-//   PROBES (--probe) attempt writes that MUST be refused. Each one is chosen so a
-//   refusal is the only legal outcome, and it is SKIPPED WITH A STATED REASON when
-//   the preconditions for a guaranteed refusal are absent — a probe that could
-//   succeed is a mutation, not a proof. Each also RE-READS afterwards: a 409 that
-//   nevertheless mutated is the failure mode worth catching, and no amount of
-//   reading the status code finds it.
-//
-// Exit code is non-zero if any check fails, so this can become a gate.
-//
-// Usage:
-//   node scripts/gds/prove-strict-versioning.js [--probe] [--json]
-//   CLOUDBONGOS_API_BASE=https://cloudbongos.com node scripts/gds/prove-strict-versioning.js --probe
-
-// apiCall is the ONE HTTP client for this directory: it resolves the instance
-// base and bearer, returns { status, ok, data } WITHOUT throwing on an HTTP
-// status (exactly what a refusal probe needs), and routes through the
-// no-keep-alive dispatcher — a bare fetch() leaves sockets armed and turns a
-// natural exit into a hang.
-const { apiCall, hasFlag, cliExit, API_BASE } = require('./cli-lib');
-
-// The statuses that mean a task is FINISHED — one vocabulary, declared once
-// (BV1.R01, task 1003588). Everything else holds its goal, and therefore its
-// version, open. Read from the module rather than re-listed here so this file
-// cannot drift from the rule it is checking.
-const { TERMINAL_STATUSES } = require('../../modules/lifecycle/task-status');
-const NON_TERMINAL = ['backlog', 'ready', 'active', 'blocked', 'completed', 'confirmed']
-  .filter((s) => !TERMINAL_STATUSES.includes(s));
-
-// A goal that is no longer open must hold no unfinished work (ADR 0250 D2/D3).
-const CLOSED_GOAL_STATUSES = ['achieved', 'archived'];
-
-// A version's catch-all goal, by the two shapes the codebase has used. The
-// em-dash form is what `generalGoalTitle` matches; "Work with no goal yet" is
-// BONGOS-V1's, and the mismatch between them is exactly why 47 tasks went
-// homeless unnoticed (R31, task 1003711). Match BOTH, or this proof inherits the
-// blind spot it exists to close.
-const CATCH_ALL = (title, versionId) =>
-  title === `${versionId} — general` || /^work with no goal yet$/i.test(String(title || '').trim());
-
-// The API returns a refusal code in two shapes depending on which `res.fail`
-// overload the route used — a bare string, or an object carrying `.code`/`.error`.
-// Rendering the object straight gives `[object Object]`, which tells a reader
-// nothing about WHICH rule fired. Normalise both to the code.
-function errorCode(body) {
-  const e = body && body.error;
-  if (!e) return null;
-  if (typeof e === 'string') return e;
-  return e.code || e.error || e.message || null;
-}
-
-/** GET a Bongos API path, returning the parsed body. Throws on a non-2xx. */
-async function get(path) {
-  const r = await apiCall('GET', `/api/bongos${path}`);
-  if (!r.ok) throw new Error(`GET ${path} → ${r.status}`);
-  return r.data;
-}
-
-/** POST a probe. Returns the status WITHOUT throwing — the status IS the proof. */
-async function probePost(path, body) {
-  const r = await apiCall('POST', `/api/bongos${path}`, body || {});
-  return { status: r.status, body: r.data, why: errorCode(r.data) };
-}
-
-/** Every non-terminal task on the instance, one status at a time (the list route filters by one). */
-async function allNonTerminalTasks() {
-  const out = [];
-  for (const status of NON_TERMINAL) {
-    const j = await get(`/tasks?status=${encodeURIComponent(status)}&limit=1000`);
-    out.push(...(j.tasks || []));
-  }
-  return out;
-}
-
-const results = [];
-/** Record one check. `ok` false makes the whole run exit non-zero. */
-function record(id, ok, headline, detail) {
-  results.push({ id, ok, headline, detail: detail || null });
-}
-
-async function runChecks() {
-  const [versionsRes, goalsRes, tasks] = await Promise.all([
-    get('/versions'), get('/goals'), allNonTerminalTasks(),
-  ]);
-  const versions = versionsRes.versions || [];
-  const goals = goalsRes.goals || [];
-  const byGoal = new Map(goals.map((g) => [String(g.id), g]));
-  const byVersion = new Map(versions.map((v) => [String(v.id), v]));
-
-  // C1 — a closed goal holding unfinished work (ADR 0250 D2/D3).
-  const c1 = tasks.filter((t) => {
-    const g = t.goal_id == null ? null : byGoal.get(String(t.goal_id));
-    return g && CLOSED_GOAL_STATUSES.includes(g.status);
-  });
-  const c1Goals = [...new Set(c1.map((t) => String(t.goal_id)))];
-  record('C1', c1.length === 0,
-    `${c1Goals.length} closed goal(s) holding ${c1.length} unfinished task(s)`,
-    c1Goals.map((id) => `goal ${id} (${byGoal.get(id).status}) holds ${c1.filter((t) => String(t.goal_id) === id).length}`));
-
-  // C2 — every task has a real goal (ADR 0250 D4). The two populations are
-  // reported apart because they fail for different reasons: a catch-all is a
-  // goal nobody chose, a null is a goal nobody assigned, and only the first is
-  // visible to anything that reasons per goal.
-  const nullGoal = tasks.filter((t) => t.goal_id == null);
-  const inCatchAll = tasks.filter((t) => {
-    const g = t.goal_id == null ? null : byGoal.get(String(t.goal_id));
-    return g && CATCH_ALL(g.title, g.version_id);
-  });
-  record('C2', nullGoal.length === 0 && inCatchAll.length === 0,
-    `${nullGoal.length} task(s) with no goal, ${inCatchAll.length} in a catch-all goal`,
-    [`null goal_id: ${nullGoal.length}`, `catch-all: ${inCatchAll.length}`,
-     ...[...new Set(inCatchAll.map((t) => String(t.goal_id)))].map((id) => `  catch-all goal ${id} — ${byGoal.get(id).title}`)]);
-
-  // C3 — one version builds, at most one plans (ADR 0250 D5; R04 + R19).
-  const building = versions.filter((v) => v.status === 'building');
-  const planning = versions.filter((v) => v.status === 'planning');
-  record('C3', building.length === 1 && planning.length <= 1,
-    `${building.length} building, ${planning.length} planning`,
-    [`building: ${building.map((v) => v.id).join(', ') || '(none)'}`,
-     `planning: ${planning.map((v) => v.id).join(', ') || '(none)'}`]);
-
-  // C4 — the next version is scoped: every goal on the planning version carries
-  // at least one done-when criterion (R29b). A criterion-less goal can never
-  // achieve, so it entombs its version the way the catch-alls entombed V1.
-  if (planning.length === 0) {
-    record('C4', true, 'no planning version — nothing to scope yet (not a failure)', null);
-  } else {
-    const pv = planning[0];
-    const pvGoals = goals.filter((g) => String(g.version_id) === String(pv.id) && g.status === 'open');
-    const detail = [];
-    let missing = 0;
-    for (const g of pvGoals) {
-      const full = await get(`/goals/${g.id}`);
-      const n = (full.criteria || []).length;
-      if (n === 0) { missing++; detail.push(`goal ${g.id} — NO criteria — ${g.title}`); }
-    }
-    record('C4', missing === 0,
-      `${pv.id}: ${pvGoals.length - missing}/${pvGoals.length} goal(s) carry a done-when criterion`, detail);
-  }
-
-  // C5 — beyond R30's original four. R32 (task 1003713) made a close refuse to
-  // leave work behind; this is the same rule read from the other end, and it
-  // catches what closed BEFORE that rule existed.
-  const onShipped = tasks.filter((t) => {
-    const v = byVersion.get(String(t.version_id));
-    return v && v.status === 'shipped';
-  });
-  record('C5', onShipped.length === 0,
-    `${onShipped.length} unfinished task(s) stranded on a shipped version`,
-    onShipped.slice(0, 20).map((t) => `task ${t.id} (${t.status}) on ${t.version_id}`));
-
-  // C6 — a task and its goal must be on the SAME version. `PATCH /tasks/:id`
-  // refuses a cross-version link with 409 `goal_version_mismatch`, but nothing
-  // has ever checked the rows that predate that rule — and the hierarchy is
-  // version → goal → task, so a split row is counted by one version's rollup
-  // while appearing under the other version's goal. It is also how C5 and a
-  // by-goal count can honestly disagree about the same task, which is exactly
-  // how this check got written.
-  const split = tasks.filter((t) => {
-    const g = t.goal_id == null ? null : byGoal.get(String(t.goal_id));
-    return g && String(g.version_id) !== String(t.version_id);
-  });
-  record('C6', split.length === 0,
-    `${split.length} task(s) whose goal lives on a different version`,
-    split.slice(0, 20).map((t) => `task ${t.id} on ${t.version_id}, but goal ${t.goal_id} is on ${byGoal.get(String(t.goal_id)).version_id}`));
-
-  return { versions, goals, tasks, building, planning, byGoal };
-}
-
-async function runProbes(ctx) {
-  const { goals, tasks, building, byGoal } = ctx;
-  const out = [];
-  /** A probe is only a proof when refusal is the sole legal outcome. */
-  const skip = (id, why) => out.push({ id, skipped: true, why });
-
-  // P1 — R03: a goal cannot join a version that is already building.
-  if (building.length === 0) {
-    skip('P1', 'no building version, so a refusal is not guaranteed');
-  } else {
-    const before = (await get('/goals')).goals.length;
-    const r = await probePost('/goals', { version_id: building[0].id, title: '__probe__ R03 refusal — must never be created' });
-    const after = (await get('/goals')).goals.length;
-    out.push({ absent: r.status === 404, id: 'P1', rule: 'R03 — goal onto a building version', status: r.status,
-      refused: r.status === 409, error: r.why, mutated: after !== before });
-  }
-
-  // P2 — R10: archive refuses without a disposition. Aimed at a goal VERIFIED to
-  // hold open tasks, because a goal holding none archives legitimately — that is
-  // the one shape of this probe that would destroy something.
-  const held = new Map();
-  for (const t of tasks) if (t.goal_id != null) held.set(String(t.goal_id), (held.get(String(t.goal_id)) || 0) + 1);
-  const target = goals.find((g) => g.status === 'open' && (held.get(String(g.id)) || 0) > 0);
-  if (!target) {
-    skip('P2', 'no open goal holds unfinished tasks, so a bare archive could succeed');
-  } else {
-    const r = await probePost(`/goals/${target.id}/archive`, {});
-    const after = (await get(`/goals/${target.id}`)).goal;
-    out.push({ absent: r.status === 404, id: 'P2', rule: `R10 — bare archive of goal ${target.id} (holds ${held.get(String(target.id))})`,
-      status: r.status, refused: r.status === 409 || r.status === 403, error: r.why, mutated: after.status !== 'open' });
-  }
-
-  // P3 — R12: a version holding open goals refuses a close with no dispositions.
-  if (building.length === 0) {
-    skip('P3', 'no building version to close');
-  } else {
-    const v = building[0];
-    const openGoals = goals.filter((g) => String(g.version_id) === String(v.id) && g.status === 'open');
-    if (openGoals.length === 0) {
-      skip('P3', `${v.id} holds no open goals, so a bare close could succeed`);
-    } else {
-      const r = await probePost(`/versions/${v.id}/close`, {});
-      const after = (await get('/versions')).versions.find((x) => String(x.id) === String(v.id));
-      out.push({ absent: r.status === 404, id: 'P3', rule: `R12 — bare close of ${v.id} (holds ${openGoals.length} open goals)`,
-        status: r.status, refused: r.status === 409, error: r.why, mutated: after.status !== 'building' });
-    }
-  }
-  return out;
-}
-
-(async () => {
-  const base = API_BASE;
-  const wantProbe = hasFlag('--probe');
-  const asJson = hasFlag('--json');
-
-  const ctx = await runChecks();
-  const probes = wantProbe ? await runProbes(ctx) : [];
-
-  if (asJson) {
-    console.log(JSON.stringify({ instance: base, at: new Date().toISOString(), checks: results, probes }, null, 2));
-  } else {
-    console.log(`\nStrict-versioning proof — ${base}`);
-    console.log(`  ${new Date().toISOString()}\n`);
-    for (const r of results) {
-      console.log(`  ${r.ok ? 'HOLDS ' : 'FAILS '} ${r.id}  ${r.headline}`);
-      if (r.detail) for (const d of r.detail) console.log(`           ${d}`);
-    }
-    if (wantProbe) {
-      console.log('\n  Refusal probes (each write below MUST be refused):');
-      for (const p of probes) {
-        if (p.skipped) { console.log(`  SKIP   ${p.id}  ${p.why}`); continue; }
-        const verdict = p.absent ? 'ABSENT ' : (p.refused && !p.mutated ? 'REFUSED' : 'LEAKED ');
-        console.log(`  ${verdict} ${p.id}  ${p.rule} → ${p.status}${p.error ? ` ${p.error}` : ''}`);
-        if (p.absent) console.log('           the route does not exist on this instance — the rule is built but NOT DEPLOYED here.');
-        if (p.mutated) console.log('           ⚠ THE STATE CHANGED ANYWAY — the refusal is cosmetic.');
-      }
-    } else {
-      console.log('\n  (read-only; pass --probe to also attempt the three refusals)');
-    }
-    console.log('');
-  }
-
-  const failedChecks = results.filter((r) => !r.ok).length;
-  // A 404 is NOT a leak — the rule simply is not on this instance yet. Counting it
-  // as a failure would make the harness cry wolf on every instance running an
-  // older core, and the honest signal ("built, not deployed") is already printed.
-  const leakedProbes = probes.filter((p) => !p.skipped && !p.absent && (!p.refused || p.mutated)).length;
-  // cliExit, never process.exit — a hard exit while the request machinery is still
-  // tearing down aborts natively on Windows/Node 24 AFTER stdout has flushed, so
-  // the run looks fine and then exits 127 (this directory's CLAUDE.md; task 1002734).
-  cliExit(failedChecks + leakedProbes > 0 ? 1 : 0);
-})().catch((err) => {
-  console.error('prove-strict-versioning failed:', err.message);
-  cliExit(2);
-});
+// scripts/gds/prove-strict-versioning.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/prove-strict-versioning.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'prove-strict-versioning.js');