@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/publish-watch.js

@@ -1,268 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/publish-watch.js — does the registry actually have what the lane
-// SAID it released? (task 1003916)
-//
-// WHY THIS EXISTS. On 2026-09-13 eight consecutive publish runs failed between
-// 09:54 and 13:02 UTC on a mis-scoped leak gate. Nothing reported that the
-// registry had stopped receiving releases for three hours. It was found by
-// someone idly reading the npm version list and noticing a hole. Task 1003914
-// fixed the LOSSINESS (the bump is no longer pushed before the publish, so a
-// failure retries the same version instead of burning it) and deliberately left
-// the SILENCE, which is this task.
-//
-// The silence is structural, not an oversight:
-//   • a failed publish is a red run in the Actions tab, and nobody watches it;
-//   • `main` keeps looking healthy — the next work merge bumps past the failure
-//     and publishes normally, so the repo self-heals in a way that ERASES the
-//     evidence;
-//   • the lane's own `Publish verdict` step writes ✅/⬜ to the job summary,
-//     which is correct and read by nobody.
-//
-// WHAT CHANGED, AND WHY THIS IS NOW A THREE-LINE QUESTION. The lane cannot ASK
-// the registry whether a version is published: publishing via OIDC trusted
-// publishing means there is no read credential, and OIDC authenticates
-// `npm publish` and nothing else. That constraint is what pushed
-// laneReleasedVersions onto a git-log derivation (see bump-version.js).
-// It no longer binds a READER. Post-task 1003872 `@bongos/core` is PUBLIC, so an
-// anonymous `npm view` needs no credential at all — verified 2026-09-16, and the
-// reason this check can exist as a plain comparison rather than an inference.
-//
-// THE COMPARISON. Two independent sources that should agree:
-//   announced — every version the lane wrote a release commit for, read from git
-//               via bump-version.js's RELEASE_COMMIT_RE. Deliberately the SAME
-//               constant the lane itself uses, so an announcement shape can
-//               never mean one thing to the publisher and another here.
-//   published — every version actually on the registry (anonymous read).
-// A version in `announced` and not in `published` is a PHANTOM: the lane said it
-// shipped something it never delivered. 1.19.716..723 are exactly that, and are
-// still observable today — tests/publish_watch.mjs pins the detector against
-// that real history rather than a synthetic failure.
-//
-// WHY A TIME WINDOW, NOT ALL OF HISTORY. The 2026-09-13 phantoms are permanent
-// git history: an all-history check would fire forever on a closed incident and
-// train the owner to scroll past it — the precise failure this task exists to
-// prevent. The window is by TIME rather than by count so it cannot be outrun by
-// a burst of releases (the rate varies from ~5 to ~20 a day).
+// scripts/gds/publish-watch.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/publish-watch.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const { execFileSync } = require('child_process');
-const path = require('path');
-const { RELEASE_COMMIT_RE } = require(path.join(__dirname, 'bump-version.js'));
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const PKG = '@bongos/core';
-const DEFAULT_WINDOW_DAYS = 3;
-// npm acknowledges a publish before the aggregate listing shows it: the CLI
-// prints "Your package is being processed and may take a few minutes to become
-// available." A version announced inside this grace period is therefore not yet
-// evidence of anything. Found by RUNNING this check (2026-09-16): it flagged
-// 1.19.794 as a phantom fifteen minutes after a publish whose own log ended
-// `published @bongos/core@1.19.794`, and whose per-version endpoint answered 200.
-const DEFAULT_GRACE_MINUTES = 30;
-const GIT_TIMEOUT_MS = 15000;
-const NPM_TIMEOUT_MS = 60000;
-
-// WHAT COUNTS AS AN ANNOUNCEMENT — deliberately BROADER than the publisher's
-// own RELEASE_COMMIT_RE, and the difference is the point.
-//
-// RELEASE_COMMIT_RE is narrow BY DESIGN: it is the cascade terminator, and it
-// must not match a human release commit, because a human release is a version
-// that still needs publishing (see bump-version.js). That is the right answer to
-// the publisher's question ("is this HEAD already done?").
-//
-// It is the WRONG answer to this file's question ("what did we tell the world we
-// released?"). A human carrier announces a release just as loudly —
-// `release: core 1.19.3 — CLI/init ergonomics carrier (task 1002631)`,
-// `release: core 1.18.19 — carrier bump for the 32 commits since 1.18.18` — and
-// publish.yml fires on any main HEAD with a bumped CORE_VERSION, hand-edited or
-// not. Matching only the CI shape would have left a failed HUMAN release
-// invisible to the exact check meant to catch a failed release.
-//
-// So: anchored at `^` so a commit merely QUOTING a release line cannot match
-// (tested), version-shaped, and each entry records WHICH lane announced it so a
-// finding can say so.
-const ANNOUNCED_RE = /^release: core (\d+\.\d+\.\d+) /;
-
-// Pure. Release commits newest-first, as {version, sha, iso, lane}, parsed from
-// `git log --format=%H|%cI|%s`.
-function parseAnnounced(logText) {
-  const out = [];
-  for (const raw of String(logText == null ? '' : logText).split('\n')) {
-    const line = raw.trim();
-    if (!line) continue;
-    const parts = line.split('|');
-    if (parts.length < 3) continue;
-    const [sha, iso] = parts;
-    const subject = parts.slice(2).join('|');
-    const m = ANNOUNCED_RE.exec(subject);
-    if (!m) continue;
-    out.push({
-      version: m[1],
-      sha,
-      shortSha: sha.slice(0, 8),
-      iso,
-      lane: RELEASE_COMMIT_RE.test(subject) ? 'ci' : 'human',
-    });
-  }
-  return out;
-}
-
-// Pure, and the whole verdict. `published` is any iterable of version strings.
-function phantoms({ announced = [], published = [], now = new Date(), windowDays = DEFAULT_WINDOW_DAYS, graceMinutes = DEFAULT_GRACE_MINUTES } = {}) {
-  const have = new Set(Array.from(published, (v) => String(v)));
-  const nowMs = new Date(now).getTime();
-  const cutoff = nowMs - windowDays * 86400000;
-  const graceEdge = nowMs - graceMinutes * 60000;
-  const considered = [];
-  const missing = [];
-  const settling = [];
-  for (const rel of announced) {
-    const t = Date.parse(rel.iso);
-    if (!Number.isFinite(t) || t < cutoff) continue;
-    considered.push(rel);
-    if (have.has(rel.version)) continue;
-    // Too fresh to judge — the registry may simply not have finished processing.
-    if (t > graceEdge) { settling.push(rel); continue; }
-    missing.push(rel);
-  }
-  return { considered, missing, settling, windowDays, graceMinutes, cutoffIso: new Date(cutoff).toISOString() };
-}
-
-// execFileSync, NOT execSync: the `%H|%cI|%s` format is full of pipes, and a
-// shell splits the command on them into a nonsense pipeline. Caught by running
-// it (exit 2, "could not complete") rather than by reading it.
-function gitLog(ref, { days, cwd = REPO_ROOT } = {}) {
-  const args = ['log', ref];
-  if (days) args.push(`--since=${days + 1} days ago`);
-  args.push('--format=%H|%cI|%s');
-  return execFileSync('git', args, {
-    cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-    maxBuffer: 256 * 1024 * 1024, timeout: GIT_TIMEOUT_MS,
-  });
-}
-
-// Anonymous registry read. Throws on failure — a read that did NOT happen must
-// never be reported as "nothing missing" (the accounting bug that let the
-// nightly upgrade sweep die reporting failed=0 on 2026-08-25).
-function publishedVersions(pkg = PKG) {
-  const raw = execFileSync('npm', ['view', pkg, 'versions', '--json'], {
-    encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
-    maxBuffer: 64 * 1024 * 1024, timeout: NPM_TIMEOUT_MS,
-  });
-  const parsed = JSON.parse(raw);
-  const list = Array.isArray(parsed) ? parsed : [parsed];
-  if (!list.length) throw new Error(`registry returned no versions for ${pkg}`);
-  return list;
-}
-
-// The aggregate listing is a CANDIDATE source, never a verdict: it lags a
-// publish by minutes. This asks the registry about one exact version, which does
-// not lag — the endpoint answered 200 for 1.19.794 while the listing still
-// omitted it. Returns true only on a clear "it is there"; a thrown request is
-// reported as still-missing by the caller, never silently as present.
-function versionIsPublished(pkg, version) {
-  try {
-    const out = execFileSync('npm', ['view', `${pkg}@${version}`, 'version'], {
-      encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: NPM_TIMEOUT_MS,
-    });
-    return String(out).trim() === String(version);
-  } catch {
-    return false;
-  }
-}
-
-function check({ ref = 'origin/main', windowDays = DEFAULT_WINDOW_DAYS, now = new Date(), pkg = PKG, graceMinutes = DEFAULT_GRACE_MINUTES, confirm = versionIsPublished } = {}) {
-  const announced = parseAnnounced(gitLog(ref, { days: windowDays }));
-  const published = publishedVersions(pkg);
-  const r = phantoms({ announced, published, now, windowDays, graceMinutes });
-  // Confirm each candidate individually before calling it a phantom. Only runs
-  // on suspects, so a healthy lane costs exactly one registry read.
-  const confirmed = [];
-  const lagging = [];
-  for (const cand of r.missing) (confirm(pkg, cand.version) ? lagging : confirmed).push(cand);
-  return { pkg, ref, ...r, missing: confirmed, lagging, publishedCount: published.length };
-}
-
-// One line when healthy; the roll-call when not. Written for Discord #ship-news,
-// so it stays plain language — the owner reads that channel, not this file.
-function report(r) {
-  if (!r.missing.length) {
-    const extra = [];
-    if (r.settling && r.settling.length) extra.push(`${r.settling.length} still settling`);
-    if (r.lagging && r.lagging.length) extra.push(`${r.lagging.length} present but not yet in the listing`);
-    const tail = extra.length ? ` (${extra.join('; ')})` : '';
-    return `Publish lane healthy — all ${r.considered.length} release(s) announced in the last ${r.windowDays} days are on the registry${tail}.`;
-  }
-  const lines = [
-    `⚠ The publish lane announced ${r.missing.length} release(s) it never delivered to the registry.`,
-    '',
-    `Anyone installing ${r.pkg} cannot get ${r.missing.length === 1 ? 'this version' : 'these versions'}:`,
-  ];
-  for (const m of r.missing) lines.push(`  • ${m.version} — announced ${m.iso.slice(0, 16).replace('T', ' ')}Z by commit ${m.shortSha}${m.lane === 'human' ? ' (hand-cut release)' : ''}`);
-  lines.push('', 'A publish run failed and the next merge will paper over it. Check the publish workflow runs for that window.');
-  return lines.join('\n');
-}
-
-// Deliver the finding ourselves rather than via run-routine.js's `sink: discord`.
-// WHY: run-routine treats a non-zero step as a FAILED step and aborts before it
-// routes stdout anywhere — so exit 1 ("found a phantom") would have thrown the
-// finding away instead of posting it. Caught by running the routine with a
-// forced finding and no webhook (2026-09-16). artifact-audit has the same shape
-// for the same reason: the script performs its own side effect and the routine
-// step stays `sink: none`.
-async function deliver(text) {
-  const { postWebhook } = require(path.join(__dirname, '..', 'discord', 'lib.js'));
-  await postWebhook('ship_news', text);
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const arg = (f, d) => { const i = argv.indexOf(f); return i >= 0 && argv[i + 1] ? argv[i + 1] : d; };
-  const windowDays = Number(arg('--window-days', DEFAULT_WINDOW_DAYS));
-  const graceMinutes = Number(arg('--grace-minutes', DEFAULT_GRACE_MINUTES));
-  const ref = arg('--ref', 'origin/main');
-  const json = argv.includes('--json');
-
-  let r;
-  try {
-    r = check({
-      ref,
-      windowDays: Number.isFinite(windowDays) && windowDays > 0 ? windowDays : DEFAULT_WINDOW_DAYS,
-      graceMinutes: Number.isFinite(graceMinutes) && graceMinutes >= 0 ? graceMinutes : DEFAULT_GRACE_MINUTES,
-    });
-  } catch (err) {
-    // Exit 2 = COULD NOT RUN. Distinct from 1 (ran, found something) so a
-    // scheduler can go red on the former and merely report the latter.
-    console.error(`publish-watch could not complete: ${err && err.message ? err.message : err}`);
-    process.exit(2);
-  }
-
-  const text = report(r);
-  if (json) { console.log(JSON.stringify(r, null, 2)); process.exit(r.missing.length ? 1 : 0); }
-
-  // A healthy day is deliberately quiet: it reports to a person running this by
-  // hand (stderr) and posts nothing. A daily "all fine" in #ship-news is how the
-  // channel becomes wallpaper, which is the failure this check exists to fix.
-  if (!r.missing.length) { console.error(text); process.exit(0); }
-
-  console.log(text);
-  if (argv.includes('--no-post')) process.exit(1);
-
-  try {
-    await deliver(text);
-    console.error('posted the finding to Discord #ship-news.');
-    process.exit(1);
-  } catch (err) {
-    // FOUND SOMETHING AND COULD NOT SAY IT. This is the original defect one
-    // layer down, so it must be the LOUDEST outcome, not the quietest: exit 3
-    // is >= 2, which turns the scheduled run red. A finding that reached nobody
-    // is not a successful run.
-    console.error(`\nFOUND A PHANTOM AND COULD NOT DELIVER IT: ${err && err.message ? err.message : err}`);
-    console.error('The finding is above. Set DISCORD_SHIP_NEWS_WEBHOOK (repo secret) so this reaches #ship-news.');
-    process.exit(3);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { ANNOUNCED_RE, parseAnnounced, phantoms, publishedVersions, versionIsPublished, check, report, DEFAULT_WINDOW_DAYS, DEFAULT_GRACE_MINUTES, PKG };
+require('../bongos/forwarder.js').forward(module, 'publish-watch.js');

package/scripts/gds/pulse.js

@@ -1,336 +1,7 @@
 #!/usr/bin/env node
-// Fire-and-forget heartbeat for an active GDS claim, plus the stale-claim
-// auto-release sweeper. Two distinct modes share this file because both
-// concern the session_pulses table:
-//
-//   1) Pulse mode (default) — POST a single heartbeat for one claim. Used
-//      by a background process while a builder works.
-//        node scripts/gds/pulse.js --claim-id <N>
-//
-//   2) Release-stale mode (V3.R49 / #268) — scan for active claims with
-//      no pulse in N hours and auto-release them. Used by the
-//      `stale-claim-release` scheduled task (runs every 15 min on the
-//      droplet) and runnable by hand for ops.
-//        node scripts/gds/pulse.js --release-stale [--threshold-hours 6] [--dry-run]
-//
-// -------------------------------------------------------------------------
-// Pulse-mode follow-up note (unchanged from original):
-//   POST /api/bongos/pulse is NOT yet wired (route lives in src/bongos/routes.js,
-//   which is OUT of THAT task's touches[]). Once a follow-up task adds
-//   the route, the pulse path starts working with no changes. Until then,
-//   running it will print a 404 from the server — that is expected.
-//
-// -------------------------------------------------------------------------
-// Release-stale-mode notes (V3.R49):
-//   - Threshold is HOURS, and it is THE PROJECT'S — resolved by src/stale-timer.js
-//     (--threshold-hours -> <PREFIX>_STALE_CLAIM_HOURS, legacy GDS_ honoured -> 6),
-//     the same reader the Archon roster uses so the surface that REPORTS staleness
-//     and this sweep that ACTS on it can no longer disagree (task 1003476; they were
-//     24h and 6h apart). The underlying sweepStaleClaims() helper takes minutes;
-//     staleClaimMinutes() converts, in one place.
-//   - An unreadable timer STOPS the sweep rather than falling back. Releasing another
-//     builder's claim is not undone by reloading a page, so this mode refuses where a
-//     read-only surface degrades — see the posture note in src/stale-timer.js.
-//   - We talk to Postgres directly via the existing src/db.js pool (peer auth
-//     on the droplet). No HTTP session needed — this routine ships with the
-//     server and runs in the same trust boundary.
-//   - claims.outcome and session_logs.outcome are both DB-constrained to
-//     ('shipped', 'partial', 'abandoned') / ('shipped', 'abandoned', 'partial',
-//     'expired'). We do NOT add a new 'abandoned-stale' enum value (the task's
-//     touches[] excludes migrations/ — adding one is a separate follow-up).
-//     Instead we set outcome='abandoned' AND tag the audit trail in notes_md
-//     with a stable [auto-released:stale] prefix so the case is discoverable
-//     by anyone reading the log or grepping the table.
-//   - Tasks return to status='ready', no credits, just like a manual release.
-//   - Affected builders get one broadcast each via scripts/discord/post.js
-//     (Discord #ship-feed, the builders' channel — task 1002846 keeps the
-//     owner-facing #ship-news for shipped features and fixes; outbound moved
-//     off Google Chat per ADR 0032 / #607; scripts/chat/ is inbound-only now).
-//     Post failure is non-fatal (mirrors ship.js).
-//   - Exit codes: 0 = success (including "nothing stale"); 1 = fatal error.
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-const { cliClient, requireSession, arg } = require('./cli-lib');
-// The project's stale-claim timer — one number, one precedence, shared with the
-// roster and the lib defaults (task 1003476). Scripts sit outside the kernel
-// boundary, so a direct require is the idiom here.
-const {
-  resolveStaleClaimHours, staleClaimMinutes, describeStaleTimer,
-  MIN_STALE_CLAIM_HOURS, MAX_STALE_CLAIM_HOURS,
-} = require('../../src/stale-timer');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-
-// Lazy require — only when release-stale mode is engaged, so the lightweight
-// pulse path doesn't pull in pg unless needed (e.g. when invoked from a non-
-// droplet machine without Postgres reachable).
-function loadDeps() {
-  // eslint-disable-next-line global-require
-  const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
-  // eslint-disable-next-line global-require
-  // pulse.js (the lib) carved → modules/sessions/ (BV1.R82 / ADR 0093 §1); the CLI
-  // shell stays here and requires the module lib directly (scripts are outside the
-  // kernel boundary, so a direct module require is fine).
-  const { sweepStaleClaims } = require(path.join(REPO_ROOT, 'modules/sessions/pulse'));
-  return { pool, sweepStaleClaims };
-}
-
-// Resolve the timer THIS SWEEP will act on, and refuse rather than guess.
-//
-// Task 1003476 (goal 1000072) moved the precedence itself into src/stale-timer.js so
-// the roster that REPORTS staleness and this sweeper that ENFORCES it read one number
-// (they were 24h and 6h apart). What stays here is the posture: the resolver reports an
-// unusable value instead of throwing, because a read-only surface should degrade to the
-// default and SAY SO — but this sweeper releases other people's claims and stamps their
-// session logs, and no reload undoes that. So an unreadable timer stops the sweep.
-//
-// `--threshold-hours` keeps behaving exactly as it did: an explicit per-run lens that
-// overrides the project's timer for this invocation only, and a bad one is a usage error.
-function parseThresholdHours(args) {
-  const cliVal = arg('--threshold-hours', args);
-  const resolved = resolveStaleClaimHours({ override: cliVal });
-  if (resolved.invalid) {
-    const where = resolved.invalid.where === 'override'
-      ? '--threshold-hours'
-      : resolved.invalid.varName;
-    throw new Error(
-      `${where}="${resolved.invalid.raw}" is unusable (${resolved.invalid.reason}) — `
-      + `refusing to sweep on a timer this project cannot read. `
-      + `Fix it, or pass --threshold-hours ${MIN_STALE_CLAIM_HOURS}..${MAX_STALE_CLAIM_HOURS} for this run.`
-    );
-  }
-  return resolved;
-}
-
-// Post a single broadcast about an auto-released claim. Best-effort —
-// returns { ok, error } and never throws. Mirrors the pattern in ship.js
-// (synchronous execFile via the local scripts/discord/post.js helper, on
-// #ship-feed: a reclaim nudge is builder housekeeping, never owner news —
-// task 1002846; outbound moved off Google Chat per ADR 0032). The line opens
-// with `@name`, never `#<id>`, so the applause bot ignores it.
-function postDiscordPing(text) {
-  try {
-    execFileSync('node', ['scripts/discord/post.js', '--channel', 'ship_feed', text], {
-      cwd: REPO_ROOT,
-      stdio: 'pipe',
-    });
-    return { ok: true };
-  } catch (e) {
-    return { ok: false, error: e && e.message ? e.message : String(e) };
-  }
-}
-
-async function releaseStale({ timer, dryRun }) {
-  const { pool, sweepStaleClaims } = loadDeps();
-  const thresholdMin = staleClaimMinutes(timer.hours);
-
-  let stale;
-  try {
-    stale = await sweepStaleClaims({ thresholdMin });
-  } catch (e) {
-    console.error('sweepStaleClaims failed:', e.message);
-    await pool.end().catch(() => {});
-    process.exit(1);
-  }
-
-  // The header names the timer AND where it came from. A bare "6h" is what let the
-  // sweeper's 6 and the roster's 24 sit side by side unnoticed for a year of ops logs.
-  const header =
-    `stale-claim sweep (threshold=${describeStaleTimer(timer)} / ${thresholdMin}m` +
-    `${dryRun ? ', dry-run' : ''}): ${stale.length} claim(s) eligible`;
-  console.log(header);
-
-  if (stale.length === 0) {
-    await pool.end().catch(() => {});
-    return;
-  }
-
-  const NOTE_TAG = '[auto-released:stale]';
-
-  const results = [];
-  for (const row of stale) {
-    const { claim_id, task_id, builder_id, claimed_at, last_pulse_at } = row;
-    const lastSeen = last_pulse_at
-      ? `last pulse at ${new Date(last_pulse_at).toISOString()}`
-      : `never pulsed (claimed at ${new Date(claimed_at).toISOString()})`;
-
-    if (dryRun) {
-      console.log(
-        `  would release claim #${claim_id} (task #${task_id}, builder #${builder_id}) — ${lastSeen}`
-      );
-      results.push({ claim_id, task_id, builder_id, status: 'dry-run' });
-      continue;
-    }
-
-    const client = await pool.connect();
-    let outcome;
-    try {
-      await client.query('BEGIN');
-
-      // Lock the claim row and re-check it's still open. If a real release
-      // raced us between the sweep query and now, skip it.
-      const { rows: cur } = await client.query(
-        `SELECT c.id, c.task_id, c.builder_id, c.claimed_at, c.released_at,
-                t.title
-           FROM claims c JOIN tasks t ON t.id = c.task_id
-          WHERE c.id = $1
-          FOR UPDATE`,
-        [claim_id]
-      );
-      if (cur.length === 0) {
-        await client.query('ROLLBACK');
-        results.push({ claim_id, task_id, builder_id, status: 'skip-missing' });
-        continue;
-      }
-      if (cur[0].released_at) {
-        await client.query('ROLLBACK');
-        results.push({ claim_id, task_id, builder_id, status: 'skip-already-released' });
-        continue;
-      }
-
-      const taskTitle = cur[0].title;
-      const claimedAtSql = cur[0].claimed_at;
-      const notesMd =
-        `${NOTE_TAG} session_pulses heartbeat went silent for ` +
-        `>= ${timer.hours}h (threshold ${thresholdMin}m, ${timer.source}). ` +
-        (last_pulse_at
-          ? `Last pulse: ${new Date(last_pulse_at).toISOString()}.`
-          : `No pulse ever recorded; claimed_at ${new Date(claimedAtSql).toISOString()}.`) +
-        ' Claim auto-released; task returned to status=ready, no credits awarded.';
-
-      // Release the claim. outcome='abandoned' is the closest existing enum
-      // value (DB CHECK constraint blocks new values without a migration —
-      // see header note). The [auto-released:stale] tag in notes_md is the
-      // discoverability hook.
-      await client.query(
-        `UPDATE claims SET released_at = now(), outcome = 'abandoned' WHERE id = $1`,
-        [claim_id]
-      );
-
-      // Send the task back to ready (same map as release.js).
-      await client.query(
-        `UPDATE tasks
-            SET status = 'ready',
-                updated_at = now()
-          WHERE id = $1`,
-        [task_id]
-      );
-
-      // Write the session_logs entry so the audit trail is complete.
-      await client.query(
-        `INSERT INTO session_logs (builder_id, task_id, claim_id, started_at, ended_at, outcome, notes_md)
-         VALUES ($1, $2, $3, $4, now(), 'abandoned', $5)`,
-        [builder_id, task_id, claim_id, claimedAtSql, notesMd]
-      );
-
-      await client.query('COMMIT');
-
-      outcome = { task_id, builder_id, taskTitle, lastSeen };
-      console.log(
-        `  released claim #${claim_id} (task #${task_id} "${taskTitle}", builder #${builder_id}) — ${lastSeen}`
-      );
-    } catch (e) {
-      await client.query('ROLLBACK').catch(() => {});
-      console.error(`  release failed for claim #${claim_id}:`, e.message);
-      results.push({ claim_id, task_id, builder_id, status: 'error', error: e.message });
-      continue;
-    } finally {
-      client.release();
-    }
-
-    // Look up the builder's display name (display_name / github_login) for
-    // the broadcast. Outside the transaction — read-only and tolerant of
-    // missing rows.
-    let builderName = `builder #${builder_id}`;
-    try {
-      const { rows } = await pool.query(
-        `SELECT COALESCE(display_name, github_login, 'builder #' || id) AS name
-           FROM builders WHERE id = $1`,
-        [builder_id]
-      );
-      if (rows.length > 0) builderName = rows[0].name;
-    } catch (_) {
-      /* fall through with default */
-    }
-
-    const msg =
-      `@${builderName} your claim on task #${outcome.task_id} ` +
-      `("${outcome.taskTitle}") was auto-released because the session ` +
-      `heartbeat went silent for >= ${timer.hours}h. ` +
-      `No credits awarded. Task is back to ready — reclaim with ` +
-      `\`/builder-claim ${outcome.task_id}\` if you're back.`;
-
-    const ping = postDiscordPing(msg);
-    if (!ping.ok) {
-      console.log(`    Discord ping FAILED (non-blocking): ${ping.error}`);
-      results.push({ claim_id, ...outcome, status: 'released-ping-failed', ping_error: ping.error });
-    } else {
-      results.push({ claim_id, ...outcome, status: 'released' });
-    }
-  }
-
-  const summary = {
-    released: results.filter((r) => r.status === 'released').length,
-    released_ping_failed: results.filter((r) => r.status === 'released-ping-failed').length,
-    skipped: results.filter((r) => r.status.startsWith('skip-')).length,
-    errors: results.filter((r) => r.status === 'error').length,
-    dry_run: results.filter((r) => r.status === 'dry-run').length,
-  };
-  console.log(`done — released=${summary.released} ping-failed=${summary.released_ping_failed} skipped=${summary.skipped} errors=${summary.errors} dry-run=${summary.dry_run}`);
-
-  await pool.end().catch(() => {});
-}
-
-(async () => {
-  const args = process.argv.slice(2);
-
-  if (args.includes('--release-stale')) {
-    let timer;
-    try {
-      timer = parseThresholdHours(args);
-    } catch (e) {
-      console.error(e.message);
-      process.exit(1);
-    }
-    const dryRun = args.includes('--dry-run');
-    await releaseStale({ timer, dryRun });
-    return;
-  }
-
-  // ----- pulse mode (unchanged) -----
-  await requireSession();
-  const claimIdStr = arg('--claim-id', args);
-  const claimId = claimIdStr ? Number(claimIdStr) : NaN;
-  if (!Number.isFinite(claimId)) {
-    console.error('usage:');
-    console.error('  node scripts/gds/pulse.js --claim-id <N>');
-    console.error('  node scripts/gds/pulse.js --release-stale [--threshold-hours H] [--dry-run]');
-    process.exit(1);
-  }
-
-  // POST /pulse is a non-spec route (not in the generated client) — use the
-  // escape hatch, which honors the same { status, ok, data } contract.
-  const api = await cliClient();
-  const r = await api.request('POST', '/pulse', { body: { claim_id: claimId } });
-  if (!r.ok) {
-    // Fire-and-forget: log the diagnostic but do not fail.
-    // Until the /api/bongos/pulse route is mounted, this routinely returns 404.
-    console.error(`pulse non-ok (status ${r.status}):`, r.data);
-    process.exit(0);
-  }
-  console.log(`pulse ok for claim #${claimId}`);
-})().catch((err) => {
-  // pulse mode is fire-and-forget — never break the foreground workflow.
-  // release-stale mode handles its own errors above and only reaches here
-  // on an unexpected throw (e.g. a syntax bug). Exit 0 so a CLI-mode pulse
-  // never propagates a failure to the foreground caller.
-  console.error('pulse error:', err && err.message ? err.message : err);
-  process.exit(0);
-});
-
-// Quiet the "unused" lint signal if fs/path ever get tree-shaken in CI.
-void fs;
-void path;
+// scripts/gds/pulse.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/pulse.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'pulse.js');