@bongos/core 1.21.175 → 1.21.176

package/release-notes.json

@@ -10132,9 +10132,181 @@
     }
   ],
   "1.21.175": [
+    {
+      "id": "1004866",
+      "text": "The generated API docs and API client are no longer stored in the project's history: they are rebuilt automatically wherever they are needed, so changing an API no longer adds an extra clean-up commit to every ship."
+    },
+    {
+      "id": "1004873",
+      "text": "Session-start and ship messages now say truthfully when a change reaches cloudbongos.com: only after a release carries it and someone moves the site to it."
+    },
+    {
+      "id": "1004861",
+      "text": "Seven database tests that had quietly stopped checking anything are running and passing again. They broke because their test setup made a second \"planning\" version, which the database only allows once. Five come off the known-"
+    },
+    {
+      "id": "1004874",
+      "text": "The automatic test run that guards every core release works again, so releases can go out once more."
+    },
+    {
+      "id": "1004854",
+      "text": "The hall home page no longer downloads your whole work history every time it loads or refreshes itself. It now asks only for your five newest pieces of work and a count. For a builder with 3,000 shipped tasks that drops from a"
+    },
+    {
+      "id": "1004857",
+      "text": "Removed five old helper scripts that nothing ever used (about 1,700 lines with their tests). Nothing a user sees changes; the codebase is just smaller and easier to read."
+    },
+    {
+      "id": "1004864",
+      "text": "Three tests for builder profiles and project visibility were switched off because the test database was only half built. The test run now builds it fully, and all three are checked again on every merge — one needed a small rep"
+    },
+    {
+      "id": "1004860",
+      "text": "Cleared out leftovers from the old game and art modules: a test list that did nothing, a broken benchmark, and stale config lines. The daily job that tops up beginner tasks also stops crashing every run, because it no longer l"
+    },
+    {
+      "id": "1004865",
+      "text": "Five safety tests that had quietly stopped running every day are fixed and back in the daily checks, and the test report now owns up to every check it skipped."
+    },
+    {
+      "id": "1004868",
+      "text": "The build now refuses any new test that only checks how the code is worded instead of what it does. There are 36 such tests today; that number can only go down from here, and the failure message explains how to write a proper"
+    },
+    {
+      "id": "1004853",
+      "text": "The hall's \"me\" panel and the public leaderboard now do less repeated work. The streak hint on each task you hold is worked out from one database read instead of three per task, and the leaderboard is reused for a minute inste"
+    },
+    {
+      "id": "1004855",
+      "text": "Hall pages now load faster on repeat visits: browsers keep the page's scripts and styles instead of re-checking about 26 files every minute. Updates still show up on the next page load after a deploy."
+    },
+    {
+      "id": "1004850",
+      "text": "Marking an account as a tester can no longer be done to your own account or to a system account."
+    },
+    {
+      "id": "1004848",
+      "text": "Builder scripts moved to a properly named folder, and every old command still works and says where it moved — nothing anyone has installed breaks."
+    },
+    {
+      "id": "1004852",
+      "text": "Every pull request was stuck behind four broken checks on main; they pass again, and projects on a custom look now get their own colour in the logo."
+    },
+    {
+      "text": "The pre-seed investor page now lives in the Bongos codebase, so builders can improve it through normal tasks; the team keeps editing its text straight on the page."
+    },
+    {
+      "text": "The Cloud Bongos logo is now the new moon-in-the-gap mark everywhere: ink with a salmon moon on light backgrounds, and the pale Night ink version in dark mode. The site header, the builders' hall, the browser tab icon and the sign-in gate pages all show it."
+    },
+    {
+      "id": "1004845",
+      "text": "Accounts that exist only to try the product can now be marked as testers, so they no longer show on the public leaderboard or the builder directory. Nothing is merged or deleted, and an owner can still see and untag them."
+    },
+    {
+      "id": "1004829",
+      "text": "The government pages now read like the rebuilt Home. Approving a held change on Gate, and moving the project to a new version on Deploy, are now asked as a short question card, and only people who are actually allowed to do it"
+    },
+    {
+      "id": "1004844",
+      "text": "task-city-card"
+    },
+    {
+      "id": "1004828",
+      "text": "The Docs pages (Primer, Ranks, Economy, Commands, Diagrams, Repo Atlas and Modules) now read like the rebuilt Home: the hidden header lines are gone, the explanations under each section are shorter, and the Ranks page shows it"
+    },
+    {
+      "id": "1004826",
+      "text": "The Standing page is now called Accomplishments everywhere: the side menu, the quick-jump search, the links on Home and the page itself. Old links still work. The page is quieter too: the warnings that Home already shows no lo"
+    },
+    {
+      "id": "1004827",
+      "text": "The Profile page is quieter and clearer. When someone has asked to connect with you, their profile now shows one simple card: \"Connect with them?\" with Accept or Decline. The lines at the top of the page are gone, and a profil"
+    },
+    {
+      "id": "1004825",
+      "text": "The Board Room now asks its question the way Home does: each open sitting shows one card, \"Pass this idea?\", with Vote yes or Object. Only people who actually sit on that sitting's board see the card, so nobody is offered a vo"
+    },
+    {
+      "id": "1004843",
+      "text": "The hall top bar is now nearly solid, so text scrolling underneath no longer shows through the banner."
+    },
+    {
+      "id": "1004824",
+      "text": "The Blockers page now reads like Home. The list is called \"Requires project owner fix\", the line repeated on every card is gone, and each card asks one thing: Resolve it. Linking a task is a small plain button beside the card'"
+    },
+    {
+      "id": "1004838",
+      "text": "Project creation is simpler and clearer: the setup page shows only what matters now, says what to do, and the site header stays put while scrolling."
+    },
+    {
+      "id": "1004842",
+      "text": "Pull requests no longer fail the dependency security check, so they can merge again."
+    },
+    {
+      "id": "1004836",
+      "text": "Hall pages no longer open with a title, a tagline and a little cluster of links at the top: the left menu and the top bar already say where you are, so every page except Home now starts with its content. On Goals, New goal and"
+    },
+    {
+      "id": "1004823",
+      "text": "On a goal's page, a request to join is now the shared ask card with a plain question (Let Ana join? Let them in / Say no), and only people who can manage that goal see it. Everything else stays a normal button, and the page's"
+    },
+    {
+      "id": "1004837",
+      "text": "A page tweak stuck in a state nobody could read now has a release button in the Studio, so the owner can send it back to the queue or close it and start the page again."
+    },
+    {
+      "id": "1004834",
+      "text": "Voting on ideas now has its own setting in the project permissions, separate from voting on tasks. Nothing changes today: everyone who could vote on tasks can still vote on ideas, but a project can now change one without the o"
+    },
+    {
+      "id": "1004831",
+      "text": "Builders whose account was switched off (for example after deleting their GitHub account) used to land on a blank, unclickable hall. Sign-in now tells them plainly that the account is switched off and what to do, and a stale l"
+    },
+    {
+      "id": "1004833",
+      "text": "The Peer recognition list on Home now uses the same vote buttons as every other task and idea list in the hall, so voting looks and works the same everywhere. The vote count and your vote sit together in one column, and nothin"
+    },
+    {
+      "id": "1004822",
+      "text": "On a task's own page, the two decisions it waits on (ship it, and the Archon's confirm) are now the shared ask card with a plain question. Claim, release, copy and retire stay ordinary buttons. Notes on the page and the board'"
+    },
+    {
+      "id": "1004818",
+      "text": "The daily welcome on Home is now the owner's own painting of a circuit city, brought to life: a sunny version by day and a glowing night version in the evening. Lights pulse up the circuit towers, hover cars cross the skyline,"
+    },
+    {
+      "id": "1004832",
+      "text": "On the work board, long task numbers no longer spill out of their space on the task rows. They now always fit, on wide screens and phones, in light and dark mode. This was an older layout fault, not caused by the recent vote b"
+    },
+    {
+      "id": "1004821",
+      "text": "Roadmap page now reads like the rebuilt Home: choosing the focus version is the shared ask card at the top, the header line is one short sentence, and filler lines on the version cards are cut."
+    },
+    {
+      "id": "1004727",
+      "text": "Builders can now give karma straight from the lists they already read. Finished tasks on the work board, goal pages and profiles, and ideas on the ideas page and the Home triage list, all carry the same up and down vote button"
+    },
+    {
+      "id": "1004830",
+      "text": "Sign-ins unused for 10 days now end automatically, so your Active sessions list only shows what you actually use."
+    },
+    {
+      "id": "1004785",
+      "text": "The first time each day a builder opens Home, a short welcome plays: the project drawn as a skyscraper going up, floor by floor, from its own modules, with the crew on lunch break on the top beam and a crane lowering the next"
+    },
+    {
+      "id": "1003810",
+      "text": "Module authors can now ask the store why their module isn't listed, and get a plain answer with what to fix."
+    },
     {
       "id": "1004820",
       "text": "Actions in the hall now use the city's ask card: a question, then one big button per answer that says what it does. Home's inbox (join invites and requests, the nod, removals, stale work) and the Blockers page and Board Room v"
     }
+  ],
+  "1.21.176": [
+    {
+      "id": "1004858",
+      "text": "The status page no longer shows an uptime panel and a \"standing\" card that only ever said \"unknown\" — the checker behind them was never switched on. The dead checker and its data feed are gone too."
+    }
   ]
 }

package/scripts/bongos/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/scripts/bongos/abandon.js

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+// Abandon a task — the terminal "retire this task" transition (task 987).
+//
+// Usage:
+//   node scripts/bongos/abandon.js <task-id> [--reason "..."]
+//
+// Sets the task's status to 'abandoned' (the missing first-class lifecycle
+// transition — the GDS already had promote/ship/confirm/resolve). Use this to
+// retire a task that is no longer relevant — a stale chore, or a duplicate of
+// work another session already shipped — instead of leaving it in 'ready' as
+// claimable noise.
+//
+// Metic+ (the route is requireRank('metic', 'archon') as of ADR 0152; Archon-only
+// before that). Refuses on a shipped task (immutable history) and on a task with an
+// active claim (release it first); idempotent on an already-abandoned task. The
+// abandon + reason are recorded in audit_log by the server's writing middleware, so
+// the ledger stays complete. Retired the wrong task? POST /tasks/<id>/promote
+// restores it to backlog at the same rank (db.restoreTask) — no Archon SQL needed.
+
+const { errCode, cliClient, requireSession, arg } = require('./cli-lib');
+// task 1003153 — the live-status set, shared with the dead-edge detector so
+// "who did this cut strand" means the same thing in both places.
+const { LIVE_STATUSES } = require('../../modules/lifecycle/dead-deps.js');
+// task 1003779 — the other thing a cut leaves behind: the code itself.
+const { leftoversForTask, leftoverNotice } = require('../../modules/lifecycle/abandon-leftovers.js');
+const { execFileSync } = require('node:child_process');
+
+// Best-effort git, always. Every call here is advisory decoration on an abandon
+// that has ALREADY landed, so a missing git, a detached network or a shallow
+// clone must return "I don't know" — never throw, and never abort the command.
+function git(args, ms = 20000) {
+  return execFileSync('git', args, { encoding: 'utf8', timeout: ms, stdio: ['ignore', 'pipe', 'ignore'] });
+}
+
+// The remote branches this task owns. ONE network round trip, scoped to the two
+// name shapes worktree.js produces — listing all 800-odd heads to filter locally
+// would be the expensive way to learn the same thing.
+function remoteBranchesFor(taskId) {
+  try {
+    const out = git(['ls-remote', '--heads', 'origin', `refs/heads/task-${taskId}`, `refs/heads/task-${taskId}-*`]);
+    return out.split('\n').map((l) => l.split('\t')[1] || '').filter(Boolean)
+      .map((r) => r.replace(/^refs\/heads\//, ''));
+  } catch (_) { return null; }  // null = could not look
+}
+
+// How many commits the branch carries that main does not. Returns null when it
+// cannot be determined, which leftoversForTask reports as undetermined rather
+// than folding into "clean" — see that module's header.
+function commitsAheadOfMain(branch) {
+  try {
+    git(['fetch', 'origin', '--quiet', branch, 'main']);
+    const n = Number(String(git(['rev-list', '--count', 'FETCH_HEAD', '--not', 'origin/main'])).trim());
+    return Number.isFinite(n) ? n : null;
+  } catch (_) { return null; }
+}
+
+
+(async () => {
+  await requireSession();
+  const args = process.argv.slice(2);
+  const taskId = Number(args[0]);
+  if (!Number.isFinite(taskId)) {
+    console.error('usage: node scripts/bongos/abandon.js <task-id> [--reason "..."]');
+    process.exit(2);
+  }
+  const reason = arg('--reason', args) || '';
+
+  const api = await cliClient();
+  const r = await api.tasks.postTasksIdAbandon({ id: taskId, body: { reason } });
+  if (!r.ok) {
+    // ADR 0116 nests the slug at error.code; a flat `r.data.error === '…'` compares an
+    // object to a string and never matches, so every branch below was unreachable
+    // against a live server (task 1003658).
+    const code = errCode(r.data);
+    if (code === 'cannot_abandon_shipped') {
+      console.error(`Task #${taskId} is shipped — shipped work is immutable history and cannot be abandoned.`);
+    } else if (code === 'task_has_active_claim') {
+      console.error(`Task #${taskId} has an active claim. Release it first:`);
+      console.error(`  node scripts/bongos/release.js ${taskId}`);
+    } else if (code === 'task_not_found') {
+      console.error(`Task #${taskId} not found.`);
+    } else if (r.status === 403) {
+      console.error('Abandoning a task needs Metic+ rank (ADR 0152).');
+    } else {
+      console.error(`abandon failed (${r.status}):`, r.data);
+    }
+    process.exit(1);
+  }
+
+  if (r.data.alreadyAbandoned) {
+    console.log(`Task #${r.data.taskId} (${r.data.taskTitle}) was already abandoned — no change.`);
+  } else {
+    console.log(`Abandoned task #${r.data.taskId}: ${r.data.taskTitle}`);
+    console.log(`Status: ${r.data.previousStatus} -> abandoned.`);
+  }
+
+  // task 1003153 — REPORT what this cut just stranded. An abandoned task can
+  // never ship, so every LIVE task depending on it is now permanently gated:
+  // it will not auto-promote (task_is_fully_unblocked wants status='shipped')
+  // and cannot be claimed (DEPS_NOT_SHIPPED). Per the owner ruling the gate
+  // stays strict, which makes surfacing this at cut time the whole remedy —
+  // the edge needs a deliberate decision, and the person cutting the task is
+  // the one who knows. Best-effort: never fail an abandon over the report.
+  try {
+    const dep = await api.tasks.getTasksId({ id: taskId, query: { include: 'deps' } });
+    const dependents = (dep?.data?.task?.blocks || []).filter((b) => LIVE_STATUSES.has(String(b.status)));
+    if (dependents.length) {
+      console.log('');
+      console.log(`⚠ TOP PRIORITY — this cut just STRANDED ${dependents.length} live task(s) that depend on #${taskId}:`);
+      for (const b of dependents) console.log(`    #${b.id}  [${b.status}]  ${b.title}`);
+      console.log('  They can never auto-promote or be claimed while this edge stands, because an');
+      console.log('  abandoned task can never ship. Resolve each edge deliberately — do not leave it:');
+      console.log(`    drop the edge:    node scripts/bongos/api.js DELETE /api/bongos/dependencies --body '{"from_kind":"task","from_id":<dependent>,"to_kind":"task","to_id":${taskId}}'`);
+      console.log(`    or restore this:  node scripts/bongos/api.js POST /api/bongos/tasks/${taskId}/promote`);
+      console.log('  Sweep for any you miss:  node scripts/bongos/audit-deps.js --stranded');
+    }
+  } catch (_) { /* the abandon already landed — the report is advisory */ }
+
+  // task 1003779 — REPORT the code this cut orphaned. Abandoning retires the ROW;
+  // the branch and its PR stay exactly where they were, reading as live work.
+  // Task 1002464 was cut carrying two commits never merged to main, and the
+  // follow-up filed off its review (task 1003626) then sat at 'ready' asking for
+  // changes to a function that exists nowhere on main — 'sequence.js --check'
+  // called it clear to run. Nothing had said the branch was dead, so nothing could.
+  // Same posture as the stranded-dependents report above: best-effort, and it
+  // never fails an abandon that already landed.
+  try {
+    const branches = remoteBranchesFor(taskId);
+    if (branches && branches.length) {
+      const notice = leftoverNotice(taskId, leftoversForTask(taskId, { branches, aheadCount: commitsAheadOfMain }));
+      if (notice) console.log(notice);
+    }
+  } catch (_) { /* advisory only */ }
+})().catch((err) => {
+  console.error('fatal:', err);
+  process.exit(1);
+});

package/scripts/bongos/accessibility-replay.js

@@ -0,0 +1,195 @@
+// scripts/bongos/accessibility-replay.js — the two-profile replay regression for the
+// accessibility dimension (task 1002517; clauses 5 and 8 of criterion
+// `accessibility-fluency-profile`, which named this run as its OWN proof).
+//
+// WHAT IT PROVES, and why it is not already covered.
+// tests/session_accessibility.mjs pins the scorer's contracts against synthetic
+// fixtures it builds itself — a test of the arithmetic. It cannot answer the
+// criterion's actual question, which is about PROSE: does the dimension reward a
+// reply a newcomer can use, and does it leave an expert's reply alone? So this
+// harness takes a FIXED set of eight questions a newcomer really asks, each the
+// documented trigger of a surface that exists, answered twice — once in each
+// register — and scores both runs.
+//
+// Four legs. Each one fails a different way of being wrong:
+//
+//   1. FLOOR          the non-technical run, under the non-technical profile,
+//                     clears FLOOR. The dimension recognises accessible prose.
+//   2. NO PENALTY     the engineer run, under the engineer profile, is not
+//                     scored at all — every signal waived, score null.
+//   3. DISCRIMINATION the SAME engineer prose under the NON-TECHNICAL profile
+//                     falls BELOW FLOOR, with every detector registering hits.
+//                     Without this leg 1 proves nothing — a scorer that returned
+//                     10 for everything, or three detectors that had gone blind,
+//                     would pass leg 1 and look identical to a working one.
+//   4. LENGTH         `doubleRun` says the same prose twice. Chars double, hits
+//                     double, the rate is unchanged, so the score must be
+//                     IDENTICAL. That is the metric reading density rather than
+//                     volume, asserted against real prose.
+//
+// WHERE TERSENESS PROTECTION ACTUALLY COMES FROM, since the task's "watch out"
+// is a metric that punishes an expert's brevity. It is leg 2 — the WAIVER — not
+// the per-1000-character rates. The rates make the score independent of how long
+// an answer is at a fixed density (leg 4); they do NOT make it independent of
+// density, and they should not: three undefined terms in three hundred
+// characters really is denser than three in three thousand. What protects the
+// expert is that their profile removes those two signals from the scoring set
+// entirely. `terseVariant` — every turn cut to its first sentence, a genuinely
+// shorter and thinner answer — is checked too, asserting only that answering
+// more briefly never COSTS points; it is a guard, not the mechanism.
+//
+// One honest asymmetry this surfaced and the corpus now records: under
+// `technical_level: engineer` with `toolchain_familiarity: new`, the engineer
+// run still scores, because terminal-where-a-click-path-exists is waived by the
+// TOOLCHAIN setting, not the technical one. "I think in code" and "I live in a
+// terminal" are two different answers, and the scorer is right to keep them
+// apart. tests/accessibility_replay.mjs pins that pairing so a future widening
+// of the engineer waiver has to be a deliberate edit.
+//
+// The corpus is data — tests/fixtures/accessibility-replay.json — so adding a
+// prompt is an edit to JSON, not to code.
+//
+// Run:  node scripts/bongos/accessibility-replay.js
+//       node scripts/bongos/accessibility-replay.js --json
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { scoreAccessibility, bandFor } = require('../../modules/sessions/accessibility.js');
+
+const CORPUS_PATH = path.join(__dirname, '..', '..', 'tests', 'fixtures', 'accessibility-replay.json');
+
+// FLOOR — the score a non-technical run has to clear. It is bandFor()'s
+// 'workable' boundary and deliberately not a second independent number: the
+// scorer already draws the line between prose a newcomer can work with and prose
+// that is merely dense, and inventing a different one here would let the two
+// drift. tests/accessibility_replay.mjs asserts they stay tied.
+const FLOOR = 6.0;
+
+function loadCorpus(file = CORPUS_PATH) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+// terseVariant — each turn cut to its first sentence: a shorter, thinner answer.
+// Mechanical on purpose. A hand-written "terse version" in the corpus would be a
+// version tuned until it passed; taking the first sentence of prose written for
+// another purpose is a variant nobody got to tune.
+function terseVariant(turns) {
+  return turns.map((t) => {
+    const m = /^[^.!?]*[.!?]/.exec(t);
+    return m ? m[0] : t;
+  });
+}
+
+// doubleRun — the same prose said twice. Every count doubles and so does the
+// character total, so every rate is unchanged and the score must come back
+// EXACTLY equal. This is the length-independence property at prose altitude: a
+// scorer that had drifted to absolute counts would double its penalties here.
+function doubleRun(turns) {
+  return [...turns, ...turns];
+}
+
+// asDetail — a run's replies as the per-turn digest shape scoreAccessibility
+// reads. The user turns are included because a real digest has them and
+// assistantProse must keep ignoring them; if it ever stopped, the prompts would
+// start scoring the builder's own words and every number here would move.
+function asDetail(corpus, replies, { transform } = {}) {
+  const detail = [];
+  let i = 0;
+  for (const { id, prompt } of corpus.prompts) {
+    detail.push({ i: i++, role: 'user', snippet: prompt });
+    const turns = replies[id] || [];
+    for (const snippet of transform ? transform(turns) : turns) {
+      detail.push({ i: i++, role: 'assistant', snippet });
+    }
+  }
+  return detail;
+}
+
+const TRANSFORMS = { terse: terseVariant, doubled: doubleRun };
+
+// replay — score one named run under one profile. `profile` defaults to the
+// run's own declared profile, which is the pairing the criterion asks about;
+// passing another is how leg 3 reads engineer prose as a newcomer would.
+function replay(corpus, runName, { profile, variant } = {}) {
+  const run = corpus.runs[runName];
+  if (!run) throw new Error(`no such run in the corpus: ${runName}`);
+  const transform = variant ? TRANSFORMS[variant] : undefined;
+  if (variant && !transform) throw new Error(`no such variant: ${variant}`);
+  const effective = profile || run.profile;
+  const result = scoreAccessibility(asDetail(corpus, run.replies, { transform }), { profile: effective });
+  return { run: runName, variant: variant || 'full', profile: effective, result };
+}
+
+// The partial engineer profile — thinks in code, new to the toolchain. Named
+// here because it is the pairing that shows the two waivers are independent.
+const ENGINEER_NEW_TO_TOOLCHAIN = Object.freeze({ technical_level: 'engineer', toolchain_familiarity: 'new' });
+
+function rows(corpus) {
+  const newcomer = corpus.runs.non_technical.profile;
+  return [
+    ['non-technical prose, non-technical profile', replay(corpus, 'non_technical')],
+    ['engineer prose, engineer profile', replay(corpus, 'engineer')],
+    ['engineer prose, NON-TECHNICAL profile', replay(corpus, 'engineer', { profile: newcomer })],
+    ['engineer prose, engineer but new to the terminal', replay(corpus, 'engineer', { profile: ENGINEER_NEW_TO_TOOLCHAIN })],
+    ['non-technical prose, said twice', replay(corpus, 'non_technical', { variant: 'doubled' })],
+    ['non-technical prose, first sentences only', replay(corpus, 'non_technical', { variant: 'terse' })],
+  ];
+}
+
+function fmt(n) {
+  return n == null ? '—' : n.toFixed(1);
+}
+
+function formatReport(corpus) {
+  const lines = [`accessibility replay — ${corpus.prompts.length} fixed beginner prompts, floor ${FLOOR.toFixed(1)}`, ''];
+  for (const [label, r] of rows(corpus)) {
+    const { score, band, sampled_chars: chars, sampled_turns: turns } = r.result;
+    const waived = r.result.signals.filter((s) => s.waived).length;
+    lines.push(
+      `  ${label.padEnd(48)} ${fmt(score).padStart(5)}  ${band.padEnd(9)} ` +
+        `${String(turns).padStart(3)} turns  ${String(chars).padStart(5)} chars  ${waived}/3 waived`
+    );
+    for (const s of r.result.signals) {
+      if (s.waived) continue;
+      if (!s.count) continue;
+      lines.push(
+        `      ${s.type.padEnd(28)} ${String(s.count).padStart(2)} hits  rate ${s.rate.toFixed(2)}/1k  −${s.penalty.toFixed(2)}`
+      );
+    }
+  }
+  return lines.join('\n');
+}
+
+// main — the CLI. `write` is injectable so the test can exercise both output
+// paths without printing a screenful of JSON into the test log.
+function main(argv = process.argv.slice(2), write = (s) => process.stdout.write(s)) {
+  const corpus = loadCorpus();
+  if (argv.includes('--json')) {
+    const out = { floor: FLOOR };
+    for (const [label, r] of rows(corpus)) out[label] = r.result;
+    write(`${JSON.stringify(out, null, 2)}\n`);
+    return 0;
+  }
+  write(`${formatReport(corpus)}\n`);
+  return 0;
+}
+
+module.exports = {
+  FLOOR,
+  CORPUS_PATH,
+  ENGINEER_NEW_TO_TOOLCHAIN,
+  loadCorpus,
+  terseVariant,
+  doubleRun,
+  asDetail,
+  replay,
+  rows,
+  formatReport,
+  bandFor,
+  main,
+};
+
+if (require.main === module) process.exit(main());

package/scripts/bongos/address-park-sweep.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# scripts/bongos/address-park-sweep.sh — park the addresses of projects torn down BEFORE
+# teardown learned to do it itself (task 1003947, the backfill half of task 1002897).
+#
+# WHY. Task 1002897 made a teardown remove its <slug>.caddy block and park its hostname
+# at the RFC 5737 blackhole. That only applies to teardowns run after the pin carries it,
+# so every earlier row still has its Caddy block proxying to a dead port and its A record
+# pointing at the platform: eleven hostnames answered 502 on 2026-09-16, while the hub
+# copy says "nothing answers there". This is that same teardown step, run once over the
+# ledger's torn-down rows. It does not re-run `provision.js teardown <slug>`, which would
+# rewrite each row's torn_down_at.
+#
+# The reserved-hostname rule, the zone and the apex come from the INSTALLED core (the
+# same helpers a teardown calls), so this sweep cannot disagree with what teardown parks.
+#
+# Run on the control plane as a sudoer:
+#   bash scripts/bongos/address-park-sweep.sh            # survey only — read-only
+#   bash scripts/bongos/address-park-sweep.sh --apply    # remove the snippets, reload Caddy, park the hostnames
+# Run from anywhere but an instance's own vendored core, set INSTANCE_DIR to that instance.
+#
+# Left in place on purpose, even with --apply: each project's database, dumps and checkout,
+# and the row's domain + port (ADR 0181 — a revive re-uses that address).
+set -uo pipefail
+
+APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
+DB="${PGDATABASE:-cloudbongos}"
+# The instance checkout and the account that owns it (task 1004135) — never a named person.
+# Run from an instance's vendored core, the checkout is three levels up (the rule
+# selfInstanceRoot() in provision-repo.js uses); from anywhere else it must be named. The
+# account is that checkout's owner unless PROVISION_APP_USER pins it; root holds no role here.
+CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
+[ -n "${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout — this sweep is not running from one"; exit 1; }
+# Owner by name: GNU stat spells it `-c %U`, BSD/macOS stat `-f %Su`, and each refuses the
+# other's flag, so GNU is asked first and BSD answers when it refuses (task 1004170).
+APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null || stat -f %Su "$INSTANCE_DIR" 2>/dev/null)}"
+if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
+  echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns $INSTANCE_DIR"; exit 1
+fi
+SITES="${PROVISION_CADDY_SNIPPET_DIR:-/etc/caddy/sites}"
+BOX_ENV="${BOX_ENV:-/etc/cloudbongos/box.env}"
+
+rows=$(sudo -n -u "$APP_USER" psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as $APP_USER"; exit 1; }
+
+# slug|domain|zone|reserved|blackhole per row, plus an apex line — from the installed core.
+plan=$(sudo -n -u "$APP_USER" env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
+const core = './node_modules/@bongos/core';
+const { isReservedHostname } = require(`${core}/modules/provisioning/provisioning.js`);
+const { dnsReleaseEnv } = require(`${core}/scripts/bongos/provision-net.js`);
+const apex = require(`${core}/scripts/bongos/instance-apex.js`).instanceApex();
+console.log(`apex|${apex || ''}`);
+for (const line of String(process.env.ROWS || '').split('\n').filter(Boolean)) {
+  const [slug, domain] = line.split('|');
+  const env = domain ? dnsReleaseEnv(domain) : { CLOUDFLARE_ZONE: '', BOX_IP: '' };
+  console.log(['row', slug, domain || '', env.CLOUDFLARE_ZONE, domain && isReservedHostname(domain, apex) ? 1 : 0, env.BOX_IP].join('|'));
+}
+JS
+) || { echo "cannot load the installed core from $INSTANCE_DIR"; exit 1; }
+
+apex=$(printf '%s\n' "$plan" | awk -F'|' '$1 == "apex" {print $2}')
+[ -n "$apex" ] || { echo "the installed core names no apex — refusing: the reserved-hostname guard would be blind"; exit 1; }
+echo "== torn-down rows still holding a Caddy block or an unparked address (apex $apex) =="
+
+left=(); reload=0
+while IFS='|' read -r kind slug domain zone reserved blackhole; do
+  [ "$kind" = "row" ] || continue
+  # The slug grammar provisioning.isValidSlug enforces; anything else never reaches a command.
+  [[ "$slug" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || continue
+  if [ -e "$SITES/$slug.caddy" ]; then
+    printf '  %-22s snippet %s\n' "$slug" "$SITES/$slug.caddy"
+    left+=("$slug:snippet")
+    if [ "$APPLY" = 1 ]; then sudo -n rm -f "$SITES/$slug.caddy" </dev/null && reload=1; fi
+  fi
+  [ -n "$domain" ] || continue
+  if [ "$reserved" = 1 ]; then printf '  %-22s %s is platform-reserved — never parked\n' "$slug" "$domain"; continue; fi
+  now=$(getent ahostsv4 "$domain" 2>/dev/null </dev/null | awk 'NR == 1 {print $1}')
+  [ -z "$now" ] || [ "$now" = "$blackhole" ] && continue
+  printf '  %-22s %s resolves to %s — park at %s (zone %s)\n' "$slug" "$domain" "$now" "$blackhole" "$zone"
+  left+=("$slug:dns")
+  [ "$APPLY" = 1 ] || continue
+  sudo -n -u "$APP_USER" bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
+    _ "$BOX_ENV" "$domain" "$blackhole" "$zone" </dev/null || echo "  ⚠ could not park $domain — re-run to retry"
+done <<< "$plan"
+
+[ "$reload" = 1 ] && { sudo -n systemctl reload caddy || echo "  ⚠ caddy reload failed — the removed blocks are still loaded"; }
+
+echo "== summary =="
+if [ "$APPLY" = 1 ]; then echo "  acted on (${#left[@]}): ${left[*]:-none}"; else echo "  left (${#left[@]}): ${left[*]:-none}"; fi
+if [ "$APPLY" = 1 ]; then echo "  (applied — re-run without --apply to confirm nothing is left; DNS may take a TTL to settle)";
+else echo "  (survey only — re-run with --apply to remove the snippets, reload Caddy and park the hostnames)"; fi