@bongos/core 1.21.175 → 1.21.176

package/tests/copy_desk_page_release.mjs

@@ -0,0 +1,192 @@
+// tests/copy_desk_page_release.mjs — a page round the reads cannot name can be
+// released, the WHOLE path (task 1004837).
+//
+// The report: the stuck-tweaks digest listed four pages as "needs a look, 0
+// days" and the Studio had nothing that moved them. A round in copy-desk's
+// `unknown` state (an active round nobody holds; a ready round with an applied
+// block and no send-back) is stuck at once, and no route took it anywhere.
+//
+// Driven through the real release route (routes/copy-desk-release.js), the real
+// lifecycle port (releaseStuckTweak) and the real page reads, against the shared
+// stateful fake ledger (tests/fixtures/page-ledger.mjs).
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { makeRunner } from './helpers.mjs';
+import { installPageLedger } from './fixtures/page-ledger.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const F = require('../modules/copy-desk/tests/fixtures/page-tweak.cjs');
+const pages = require('../modules/copy-desk/pages.js');
+const api = require('../src/module-api.js');
+
+const ALICE = '7'; // an artist
+const CARL = '9';  // the applier, Metic
+const { db } = installPageLedger(api, {
+  builders: [
+    { id: ALICE, github_login: 'alice', display_name: 'Alice', preferred_disciplines: ['artist'] },
+    { id: CARL, github_login: 'carl', display_name: 'Carl', preferred_disciplines: ['engineer'] },
+  ],
+});
+
+// The rank wall is the kernel's; here it reads the rank the test sends.
+api.requireBuilder = (req, res, next) => {
+  req.builder = { id: String(req.headers['x-builder'] || CARL), rank: String(req.headers['x-rank'] || 'metic') };
+  next();
+};
+// task.abandon floors at Metic; the stub holds it for Metic and Archon only.
+Object.defineProperty(api, 'requirePermission', {
+  configurable: true,
+  value: (atom) => (req, res, next) => (atom === 'task.abandon' && ['metic', 'archon'].includes(req.builder.rank) ? next() : res.status(403).json({ error: { code: 'forbidden' } })),
+});
+
+const seams = require('../src/module-seams.js');
+const lifecyclePort = require('../modules/lifecycle/lifecycle.js');
+if (!seams.hasProvider('lifecycle')) seams.registerProvider('lifecycle', lifecyclePort);
+
+const pageData = require('../modules/copy-desk/page-data.js');
+const pageStatus = require('../modules/copy-desk/page-status.js');
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildRouter = require('../modules/copy-desk/routes/copy-desk.js');
+const buildReleaseRouter = require('../modules/copy-desk/routes/copy-desk-release.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildRouter());
+app.use(buildReleaseRouter());
+const server = await new Promise((resolve) => { const s = app.listen(0, '127.0.0.1', () => resolve(s)); });
+const base = `http://127.0.0.1:${server.address().port}`;
+
+async function call(method, p, { rank = 'metic', body = {} } = {}) {
+  const r = await fetch(base + p, { method, headers: { 'content-type': 'application/json', 'x-builder': CARL, 'x-rank': rank }, body: method === 'GET' ? undefined : JSON.stringify(body) });
+  return { status: r.status, body: await r.json() };
+}
+const errCode = (b) => (b && b.error && b.error.code) || null;
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'page-release-'));
+fs.mkdirSync(path.join(tmp, 'docs'), { recursive: true });
+fs.writeFileSync(path.join(tmp, 'docs/page-inventory.json'), JSON.stringify(F.INVENTORY));
+fs.writeFileSync(path.join(tmp, 'docs/page-readings.json'), JSON.stringify(F.READINGS));
+pageData._setRoot(tmp);
+
+// ---- the ledger ------------------------------------------------------------
+
+const lines = [{ key: 'L0002', section: 'hero', before: 'Build here', after: 'Build it here', placement: 'placed', file: 'x.html', line: 1, string_id: 'abc' }];
+const batch = (pageId) => pages.composeBatchBlock({ page_id: pageId, reading_hash: 'h', submitted_at: '2026-09-19T00:00:00Z', lines });
+const applied = (pageId) => pages.composeAppliedBlock({ page_id: pageId, applied_at: '2026-09-21T10:00:00Z', reading_hash_after: 'h2', lines_after: ['Build it here'], refused: [] });
+
+// A READY round, applied, never sent back, never graded: the reads cannot name it.
+db.tasks.push({ id: '7001', status: 'ready', title: 'Tweak: Home', description: [batch('landing:index'), applied('landing:index')].join('\n\n'), source: 'page-tweak', source_ref: pages.roundSourceRef('landing:index', 1), touches: [], version_id: 'V9', goal_id: '77' });
+db.claims.push({ id: String(++db.seq.claim), task_id: '7001', builder_id: ALICE, worktree_name: null, creator_session_id: null, claimed_at: '2026-09-19T00:00:00Z', released_at: '2026-09-19T01:00:00Z', outcome: 'partial' });
+// An ACTIVE round nobody holds: the other way to be unnameable.
+db.tasks.push({ id: '7002', status: 'active', title: 'Tweak: Projects', description: 'Page tweak round 1 for landing:projects.', source: 'page-tweak', source_ref: pages.roundSourceRef('landing:projects', 1), touches: [], version_id: 'V9', goal_id: '77' });
+// A healthy SUBMITTED round: ready, a batch, nothing applied. Not stuck in this way.
+db.tasks.push({ id: '7003', status: 'ready', title: 'Tweak: Explore', description: batch('status:explore'), source: 'page-tweak', source_ref: pages.roundSourceRef('status:explore', 1), touches: [], version_id: 'V9', goal_id: '77' });
+
+const task = (id) => db.tasks.find((t) => String(t.id) === String(id));
+const stateOf = (id) => pageStatus.roundState({
+  ...task(id), holder_id: null, holder_worktree: null, grade_passed: db.grades.has(String(id)) ? db.grades.get(String(id)) : null,
+});
+const RELEASE = (pageId) => `/copy-desk/pages/${pageId}/release`;
+const NOTE = 'Stuck in a state the Studio could not read; released.';
+const { test, summary } = makeRunner();
+
+try {
+  await test('the two rounds read as unknown and stuck, and the healthy one does not', async () => {
+    const r = await call('GET', '/copy-desk/pages');
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    const flight = Object.fromEntries(r.body.in_flight.map((f) => [f.page_id, f]));
+    assert.deepEqual([flight['landing:index'].state, flight['landing:index'].stuck, flight['landing:index'].task_id], ['unknown', true, '7001']);
+    assert.deepEqual([flight['landing:projects'].state, flight['landing:projects'].stuck], ['unknown', true]);
+    assert.equal(flight['status:explore'].state, 'submitted');
+    assert.equal(flight['status:explore'].stuck, false);
+  });
+
+  await test('the Studio row offers a release only for the unknown state, and names the round it looked at', async () => {
+    const lib = require('../modules/hall-ui/public/studio-lib.js');
+    const rows = lib.inFlightRows((await call('GET', '/copy-desk/pages')).body, new Date());
+    const by = Object.fromEntries(rows.map((r) => [r.page_id, r]));
+    assert.deepEqual([by['landing:index'].release, by['landing:index'].task_id], [true, '7001']);
+    assert.equal(by['status:explore'].release, false);
+  });
+
+  await test('release is the applier\'s call: a rank below Metic is refused and nothing moves', async () => {
+    const r = await call('POST', RELEASE('landing:index'), { rank: 'thetes', body: { note: NOTE } });
+    assert.equal(r.status, 403);
+    assert.equal(task(7001).status, 'ready');
+    assert.equal(pages.parseSentBackBlocks(task(7001).description).length, 0);
+  });
+
+  await test('a short note, an unknown page and a round that is not stuck are refused by name', async () => {
+    assert.equal(errCode((await call('POST', RELEASE('landing:index'), { body: { note: 'no' } })).body), 'note_too_short');
+    const gone = await call('POST', RELEASE('landing:nowhere'), { body: { note: NOTE } });
+    assert.equal(gone.status, 404);
+    const ok = await call('POST', RELEASE('status:explore'), { body: { note: NOTE } });
+    assert.equal(ok.status, 409);
+    assert.equal(errCode(ok.body), 'not_stuck');
+    assert.equal(task(7003).status, 'ready', 'a healthy submitted round is left alone');
+    assert.equal(pages.parseSentBackBlocks(task(7003).description).length, 0);
+  });
+
+  await test('task_id pins the round the viewer looked at', async () => {
+    const r = await call('POST', RELEASE('landing:index'), { body: { note: NOTE, task_id: '9999' } });
+    assert.equal(r.status, 409);
+    assert.equal(errCode(r.body), 'round_moved');
+    assert.equal(pages.parseSentBackBlocks(task(7001).description).length, 0);
+  });
+
+  await test('a round that still holds its batch goes back to the /tweak queue with the note', async () => {
+    const r = await call('POST', RELEASE('landing:index'), { body: { note: NOTE, task_id: '7001' } });
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.equal(r.body.outcome, 'released');
+    assert.equal(task(7001).status, 'ready');
+    const [back] = pages.parseSentBackBlocks(task(7001).description);
+    assert.equal(back.note, NOTE);
+    assert.equal(back.by, CARL);
+    assert.equal(stateOf(7001), 'submitted', 'the round now reads submitted: the /tweak queue');
+    const flight = (await call('GET', '/copy-desk/pages')).body.in_flight.find((f) => f.page_id === 'landing:index');
+    assert.deepEqual([flight.state, flight.stuck], ['submitted', false]);
+  });
+
+  await test('a round with nothing to keep is closed with the note as its reason, freeing the page', async () => {
+    const r = await call('POST', RELEASE('landing:projects'), { body: { note: NOTE } });
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.equal(r.body.outcome, 'abandoned');
+    assert.equal(task(7002).status, 'abandoned');
+    assert.equal(task(7002).value_summary, `Abandoned: ${NOTE}`);
+    const flight = (await call('GET', '/copy-desk/pages')).body.in_flight.find((f) => f.page_id === 'landing:projects');
+    assert.equal(flight, undefined, 'the page has no open round any more');
+  });
+
+  await test('a second release finds nothing stuck and changes nothing', async () => {
+    const r = await call('POST', RELEASE('landing:projects'), { body: { note: NOTE } });
+    assert.equal(r.status, 409);
+    assert.equal(errCode(r.body), 'not_stuck');
+  });
+
+  await test('the port refuses a round held for its artist, a shipped round and an ordinary task', async () => {
+    db.tasks.push({ id: '7004', status: 'completed', title: 'x', description: '', source: 'page-tweak', source_ref: pages.roundSourceRef('landing:index', 9), touches: [] });
+    db.grades.set('7004', true);
+    assert.equal((await lifecyclePort.releaseStuckTweak({ taskId: '7004', builderId: CARL, expectedStatus: 'completed' })).outcome, 'not_stuck');
+    assert.equal(task(7004).status, 'completed');
+    db.tasks.push({ id: '7005', status: 'completed', title: 'x', description: '', source: 'planning-session', source_ref: 'x', touches: [] });
+    assert.equal((await lifecyclePort.releaseStuckTweak({ taskId: '7005', builderId: CARL, expectedStatus: 'completed' })).outcome, 'wrong_source');
+    assert.equal((await lifecyclePort.releaseStuckTweak({ taskId: '7002', builderId: CARL, expectedStatus: 'abandoned' })).outcome, 'not_stuck');
+    db.tasks.push({ id: '7006', status: 'active', title: 'x', description: '', source: 'page-tweak', source_ref: pages.roundSourceRef('landing:index', 8), touches: [] });
+    db.claims.push({ id: String(++db.seq.claim), task_id: '7006', builder_id: ALICE, worktree_name: null, creator_session_id: null, claimed_at: '2026-09-19T00:00:00Z', released_at: null });
+    assert.equal((await lifecyclePort.releaseStuckTweak({ taskId: '7006', builderId: CARL, expectedStatus: 'active' })).outcome, 'round_moved', 'a claim taken since the read stops the release');
+    assert.equal(task(7006).status, 'active');
+    assert.equal((await lifecyclePort.releaseStuckTweak({ taskId: '7003', builderId: CARL, expectedStatus: 'active' })).outcome, 'round_moved');
+  });
+} finally {
+  server.close();
+  fs.rmSync(tmp, { recursive: true, force: true });
+}
+
+summary();

package/tests/copy_inventory.mjs

@@ -26,7 +26,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const inv = require(path.join(ROOT, 'scripts', 'gds', 'copy-inventory.js'));
+const inv = require(path.join(ROOT, 'scripts', 'bongos', 'copy-inventory.js'));
 
 test('stable ids survive a move and change with the text', () => {
   const a = inv.stableId('builders-hall', 'Close your tab');
@@ -230,7 +230,7 @@ test('the report says what it cannot see, every time', () => {
 test('the committed artifacts match the tree (regenerate + commit, never hand-edit)', () => {
   const { stale } = inv.write({ check: true });
   assert.deepEqual(stale, [],
-    `stale: ${stale.join(', ')} — run \`node scripts/gds/copy-inventory.js\` and commit the result`);
+    `stale: ${stale.join(', ')} — run \`node scripts/bongos/copy-inventory.js\` and commit the result`);
 });
 
 test('the landing surface points at the real template, not the file that reads it', () => {

package/tests/core_auto_upgrade.mjs

@@ -13,7 +13,7 @@
 // Run:  node tests/core_auto_upgrade.mjs
 
 import { strict as assert } from 'node:assert';
-import { autoUpgradeTick, AUTO_MOVES_PER_TICK, autoUpgradeEnabled, TRANSIENT_HOLD_MS } from '../scripts/gds/provision-auto-upgrade.js';
+import { autoUpgradeTick, AUTO_MOVES_PER_TICK, autoUpgradeEnabled, TRANSIENT_HOLD_MS } from '../scripts/bongos/provision-auto-upgrade.js';
 
 let passed = 0;
 let failed = 0;

package/tests/core_move_notice.mjs

@@ -1,7 +1,7 @@
 // tests/core_move_notice.mjs — after the project's core moves, its own hall says so once,
 // with what changed, and Settings → Software update keeps a short history (task 1004731).
 //
-// The move writes one row to THIS project's own core_upgrades ledger (scripts/gds/upgrade.js);
+// The move writes one row to THIS project's own core_upgrades ledger (scripts/bongos/upgrade.js);
 // the running core carries the release notes for every version up to itself
 // (release-notes.json). src/bongos/core-moves.js reads both back: GET /core-update carries
 // the one-time notice (`moved`) for the banner, GET /software-update the history. The
@@ -344,7 +344,7 @@ await t('no history, no change: the panel draws exactly what it did before', asy
 // ---- the hub's automatic move marks itself in the project's ledger -------------------------
 
 await t('the hub\'s automatic move passes the auto-subscription note; a door move and a preview do not', () => {
-  const R = require('../scripts/gds/provision-core-upgrade.js');
+  const R = require('../scripts/bongos/provision-core-upgrade.js');
   const box = { slug: 'toast', port: 4100, hosting_shape: 'cloud-host' };
   const as = { runAs: 'bongos', migrateAs: 'bongos' };
   assert.match(R.upgradeInvocation(box, '1.21.23', { ...as, automatic: true }).cmd, / --note auto-subscription(\s|$)/);

package/tests/core_origin_follow.mjs

@@ -18,8 +18,8 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 
 const require = createRequire(import.meta.url);
-const follow = require('../scripts/gds/core-origin-follow.js');
-const pinSync = require('../scripts/gds/core-pin-sync.js');
+const follow = require('../scripts/bongos/core-origin-follow.js');
+const pinSync = require('../scripts/bongos/core-pin-sync.js');
 
 let passed = 0;
 let failed = 0;
@@ -50,10 +50,10 @@ function installCore(root, version) {
   const core = path.join(root, 'node_modules', '@bongos', 'core');
   fs.rmSync(path.join(root, 'node_modules'), { recursive: true, force: true });
   fs.mkdirSync(path.join(core, 'bin'), { recursive: true });
-  fs.mkdirSync(path.join(core, 'scripts', 'gds'), { recursive: true });
+  fs.mkdirSync(path.join(core, 'scripts', 'bongos'), { recursive: true });
   fs.writeFileSync(path.join(core, 'package.json'), JSON.stringify({ name: '@bongos/core', version }));
   fs.writeFileSync(path.join(core, 'bin', 'bongos.js'), '');
-  fs.writeFileSync(path.join(core, 'scripts', 'gds', 'fitness.js'), '');
+  fs.writeFileSync(path.join(core, 'scripts', 'bongos', 'fitness.js'), '');
   return core;
 }
 
@@ -124,7 +124,7 @@ test('clean main: says the project moved, fast-forwards, reinstalls, re-runs, sc
   assert.equal(calls.installs.length, 1, 'npm ran once');
   assert.equal(calls.installs[0][0], 'ci');
   assert.deepEqual(calls.reruns, [['start']], 'start re-ran under the new core');
-  assert.ok(fs.existsSync(path.join(laptop, 'scripts', 'gds', 'fitness.js')), 'the scripts link still resolves');
+  assert.ok(fs.existsSync(path.join(laptop, 'scripts', 'bongos', 'fitness.js')), 'the scripts link still resolves');
   const installed = JSON.parse(fs.readFileSync(path.join(laptop, 'node_modules', '@bongos', 'core', 'package.json'), 'utf8'));
   assert.equal(installed.version, NEW);
 });
@@ -270,7 +270,7 @@ test('a scripts link left dangling after the install is re-pointed at the instal
   fs.rmSync(gone, { recursive: true });
   const logs = [];
   assert.equal(pinSync.healScriptsLink(laptop, { log: (s) => logs.push(s) }), 'repointed');
-  assert.ok(fs.existsSync(path.join(link, 'gds', 'fitness.js')));
+  assert.ok(fs.existsSync(path.join(link, 'bongos', 'fitness.js')));
   // a real scripts/ directory (the core repo shape) is never touched
   const real = fs.mkdtempSync(path.join(os.tmpdir(), 'core-origin-follow-real-'));
   fs.mkdirSync(path.join(real, 'scripts'));
@@ -280,7 +280,7 @@ test('a scripts link left dangling after the install is re-pointed at the instal
 test('the dispatcher runs the follow before ship and start', () => {
   const src = fs.readFileSync(new URL('../bin/bongos.js', import.meta.url), 'utf8');
   assert.match(src, /verb === 'ship' \|\| verb === 'start'/);
-  assert.match(src, /require\('\.\.\/scripts\/gds\/core-origin-follow\.js'\)\.ensureCurrentCore/);
+  assert.match(src, /require\('\.\.\/scripts\/(?:gds|bongos)\/core-origin-follow\.js'\)\.ensureCurrentCore/);
 });
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/core_pin_sync.mjs

@@ -17,7 +17,7 @@ import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 
 const require = createRequire(import.meta.url);
-const sync = require('../scripts/gds/core-pin-sync.js');
+const sync = require('../scripts/bongos/core-pin-sync.js');
 
 let passed = 0;
 let failed = 0;
@@ -233,8 +233,8 @@ test('the dispatcher runs the check for ship (and start only after a followed co
   // which calls ensurePinnedCore for `ship` always and for `start` only after it
   // fast-forwarded a hub pin move (tests/core_origin_follow.mjs drives both).
   const src = fs.readFileSync(new URL('../bin/bongos.js', import.meta.url), 'utf8');
-  assert.match(src, /if \(!COMPILED && \(verb === 'ship' \|\| verb === 'start'\)\) \{\s*const synced = require\('\.\.\/scripts\/gds\/core-origin-follow\.js'\)\.ensureCurrentCore/);
-  const follow = fs.readFileSync(new URL('../scripts/gds/core-origin-follow.js', import.meta.url), 'utf8');
+  assert.match(src, /if \(!COMPILED && \(verb === 'ship' \|\| verb === 'start'\)\) \{\s*const synced = require\('\.\.\/scripts\/(?:gds|bongos)\/core-origin-follow\.js'\)\.ensureCurrentCore/);
+  const follow = fs.readFileSync(new URL('../scripts/bongos/core-origin-follow.js', import.meta.url), 'utf8');
   assert.match(follow, /if \(verb !== 'ship' && followed\.action !== 'fast-forwarded'\) return null;\s*return pinSync\.ensurePinnedCore/);
 });
 

package/tests/core_upgrade_door.mjs

@@ -375,7 +375,7 @@ await t('THE SELF-ROW GUARD IS VACUOUS FOR THIS ACTION, so neither door half may
   }
   // Neither half of the door may name it. If a later edit puts it back, this fails
   // and points at the sentence above rather than at a mystery.
-  for (const f of [['modules', 'provisioning', 'core-upgrade.js'], ['scripts', 'gds', 'provision-core-upgrade.js']]) {
+  for (const f of [['modules', 'provisioning', 'core-upgrade.js'], ['scripts', 'bongos', 'provision-core-upgrade.js']]) {
     const src = read(...f).replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/^\s*\/\/.*$/gm, ' ');
     assert.ok(!/intentAllowedForShape\s*\(/.test(src),
       `${f.join('/')} must not call intentAllowedForShape — it can only ever return true here`);
@@ -933,7 +933,7 @@ const runChannel = async (inst, body, calls = []) => {
 };
 
 await t('the web tier\'s channel list is the runner\'s, and the migration\'s CHECK carries the same values', () => {
-  const policy = require('../scripts/gds/update-channel.js');
+  const policy = require('../scripts/bongos/update-channel.js');
   assert.deepEqual([...UPDATE_CHANNELS], policy.VALID_CHANNELS, 're-stated in the module (ADR 0083) — so it must be equal');
   assert.equal(DEFAULT_UPDATE_CHANNEL, policy.DEFAULT_CHANNEL);
   const sql = read('modules', 'provisioning', 'migrations', 'provisioning_029_update_channel.sql');

package/tests/core_upgrade_owner_door.mjs

@@ -38,7 +38,7 @@ const seams = require('../src/module-seams.js');
 const catalog = require('../modules/government/catalog.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 const AZ = require('../modules/provisioning/core-upgrade-authz.js');
-const { requestedByOf } = require('../scripts/gds/provision-core-upgrade.js');
+const { requestedByOf } = require('../scripts/bongos/provision-core-upgrade.js');
 const { hubDeployUrl } = require('../src/bongos/routes/core-update.js');
 
 let passed = 0;
@@ -323,6 +323,39 @@ await t('an Archon is admitted by the atom without the second door being asked',
 seams._reset();
 nextSession = null;
 
+// ── 5b. who may press Move (task 1004829) ─────────────────────────────────────
+// The deploy page draws its "Move to X?" card only where the preview says
+// viewer_may_move. Both previews already took the move's two doors, so the answer
+// is the move's LAST check: act-alone at Release, skipped for the project's owner
+// exactly as the move skips it.
+
+console.log('\nwho may press Move:');
+
+const { viewerMayMove } = require('../modules/provisioning/routes/core-upgrade.js');
+async function mayMoveWith(actAlone, req) {
+  seams._reset();
+  if (actAlone !== undefined) seams.registerProvider('government', { checkActAlone: actAlone });
+  try { return await viewerMayMove(req); } finally { seams._reset(); }
+}
+const PIN_REQ = { builder: { id: 42 }, coreUpgradeAuthority: 'pin' };
+
+await t('a pin holder the Release building lets act alone may press Move', async () => {
+  assert.equal(await mayMoveWith(async (area) => { assert.equal(area, 'release'); return { ok: true }; }, PIN_REQ), true);
+});
+await t('a pin holder whose Release is decided by the board may not', async () => {
+  assert.equal(await mayMoveWith(async () => ({ ok: false, reason: 'decided_by_sitting' }), PIN_REQ), false);
+});
+await t('an unreadable rule offers no Move, as the move itself would refuse', async () => {
+  assert.equal(await mayMoveWith(async () => { throw new Error('db down'); }, PIN_REQ), false);
+});
+await t('the project\'s owner is not asked about Release, as the move does not ask', async () => {
+  const spy = async () => { throw new Error('must not be consulted for the owner door'); };
+  assert.equal(await mayMoveWith(spy, { builder: { id: 7 }, coreUpgradeAuthority: 'owner' }), true);
+});
+await t('no government port passes, as requireActAlone does', async () => {
+  assert.equal(await mayMoveWith(undefined, PIN_REQ), true);
+});
+
 // ── 6. the hand-off address, and the hall that uses it ────────────────────────
 
 console.log('\nthe hand-off to the hub:');

package/tests/core_upgrade_runner.mjs

@@ -31,15 +31,15 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 // An ESM named import, not R.parseSchemaPending: knip credits a CJS export only when a test imports it this way.
-import { parseSchemaPending, repoNote, REPO_NOTES, instanceChannel } from '../scripts/gds/provision-core-upgrade.js';
+import { parseSchemaPending, repoNote, REPO_NOTES, instanceChannel } from '../scripts/bongos/provision-core-upgrade.js';
 import { parseRepoNote } from '../modules/provisioning/core-upgrade.js';
 
 const require = createRequire(import.meta.url);
-const R = require('../scripts/gds/provision-core-upgrade.js');
-const U = require('../scripts/gds/upgrade.js');
+const R = require('../scripts/bongos/provision-core-upgrade.js');
+const U = require('../scripts/bongos/upgrade.js');
 const P = require('../modules/provisioning/provisioning.js');
 const G = require('../modules/provisioning/control-plane-guard.js');
-const RP = require('../scripts/gds/provision-repo.js');
+const RP = require('../scripts/bongos/provision-repo.js');
 
 // task 1002719: the app user is derived, so pin one that is nobody's real account.
 process.env.PROVISION_APP_USER = 'appsvc';
@@ -236,20 +236,20 @@ await t('a target the box ALREADY SERVES is not a channel refusal — the move i
   // 2026-10-01 16:32: the sweep and the door both went for 1.20.73; the sweep got there
   // first, and the door's press was refused as "outside this project's 'minor' update
   // channel … across a major version or onto a prerelease" — false on every count.
-  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
-  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  const channelAllows = require('../scripts/bongos/update-channel.js').channelAllows;
+  const compare = require('../scripts/bongos/update-channel.js').compareSemver;
   assert.equal(R.targetFault('1.20.73', ['1.20.72', '1.20.73'], '1.20.73', 'minor', channelAllows, compare), null,
     'no fault: the runner\'s own already-serving check answers it as a no-op');
 });
 
 await t('a target BELOW what the box serves says so, and is never called outside the update rule (task 1004534)', () => {
-  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
-  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  const channelAllows = require('../scripts/bongos/update-channel.js').channelAllows;
+  const compare = require('../scripts/bongos/update-channel.js').compareSemver;
   const f = R.targetFault('1.20.73', ['1.20.73', '1.21.5'], '1.21.5', 'minor', channelAllows, compare);
   assert.ok(f, 'still refused — a move never goes backwards on its own');
   assert.doesNotMatch(f, /update channel|major version|prerelease/, 'none of the channel sentence is true here');
   assert.match(f, /already runs core 1\.21\.5/);
-  assert.equal(require('../scripts/gds/upgrade-outcome.js').runnerReason(f), 'downgrade');
+  assert.equal(require('../scripts/bongos/upgrade-outcome.js').runnerReason(f), 'downgrade');
 });
 
 await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
@@ -295,7 +295,7 @@ await t('drives upgrade.js with the registry, the health gate, the version read-
 
 await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that broke every standalone tenant (task 1004053)', async () => {
   // The whole failure was a path that resolved nowhere:
-  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
+  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/bongos/upgrade.js'
   // No assertion about FLAGS could have caught it, so this one resolves the composed
   // cwd + relative CLI against the real filesystem, for every shape the door admits.
   for (const shape of ['control-plane', 'cloud-host', 'co-tenant']) {
@@ -303,7 +303,7 @@ await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that br
     await R.coreUpgradeInstance(inst({ hosting_shape: shape, slug: 'hermeslines-marketing', port: 3011 }), d, intent());
     const call = d.ranWith.find((c) => /upgrade\.js/.test(c.cmd));
     assert.ok(call, `${shape}: it ran the upgrade CLI`);
-    const rel = (call.cmd.match(/node (\S*scripts\/gds\/upgrade\.js)/) || [])[1];
+    const rel = (call.cmd.match(/node (\S*scripts\/(?:gds|bongos)\/upgrade\.js)/) || [])[1];
     assert.ok(rel, `${shape}: the command names the CLI`);
     assert.ok(fs.existsSync(path.join(call.cwd, rel)),
       `${shape}: ${path.join(call.cwd, rel)} must exist — this is the assertion the original bug would have failed`);
@@ -547,7 +547,7 @@ await t('an UNPRIVILEGED runner still adds no sudo and no env at all', async ()
   await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.doesNotMatch(cmd, /sudo/, 'no escalation when the runner is not privileged');
-  assert.match(cmd, /^node \S*scripts\/gds\/upgrade\.js /, 'it still invokes the CLI directly');
+  assert.match(cmd, /^node \S*scripts\/(?:gds|bongos)\/upgrade\.js /, 'it still invokes the CLI directly');
 });
 
 console.log('\nthe dry run behind "see what would change" (task 1004121):');
@@ -685,7 +685,7 @@ await t('the CLI runs where it lives and NAMES the instance it is aimed at', asy
 });
 
 await t('the legacy shape still omits --instance, because there is nothing to disambiguate', async () => {
-  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => require('../scripts/gds/provision-config.js').REPO_ROOT };
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => require('../scripts/bongos/provision-config.js').REPO_ROOT };
   await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
   assert.doesNotMatch(upgradeCall(d), /--instance /, 'a checkout run in place is its own instance');
 });
@@ -1442,7 +1442,7 @@ await t('every note the runner writes is one the web tier reads back, code and s
 await t('the DRAIN LOOP resolves a done-with-a-note move WITH its note, still as done', async () => {
   // Driven through the real dispatch: the note is only worth anything if it reaches the
   // intent row the deploy page reads.
-  const P2 = require('../scripts/gds/provision.js');
+  const P2 = require('../scripts/bongos/provision.js');
   let claims = 0; const resolved = []; const statusWrites = [];
   const d = pinDeps({ token: null, originResult: refusedBy('ERROR: The key you are authenticating with has been marked as read only.') });
   d.provisioning = {
@@ -1465,7 +1465,7 @@ console.log('\nthe project\'s own update rule (task 1004445):');
 
 // The REAL policy module, not the stub makeDeps hands every other case: these cases are
 // about which rule the runner applies, so a stub that admits everything would prove nothing.
-const realChannel = require('../scripts/gds/update-channel.js');
+const realChannel = require('../scripts/bongos/update-channel.js');
 const withRealChannel = (over) => {
   const d = makeDeps(over);
   // readReleaseTags is stubbed too: the real one shells out to npm. `released` defaults to the newest
@@ -1557,8 +1557,8 @@ await t('a failed migrate reaches the stored failure with its migration and psql
   const run = () => ({ status: 3, stdout: 'apply  core_998_ok\napply  core_999_x\n',
     stderr: 'psql:migrations/core_999_x.sql:7: ERROR:  check constraint "tasks_kind_check" of relation "tasks" is violated by some row\n' });
   const mig = await U.runMigrate(fs.mkdtempSync(path.join(require('node:os').tmpdir(), 'mig-')), run);
-  const res = { ok: false, error: require('../scripts/gds/upgrade-migrate.js').migrateError(mig), rolledBack: true, rollback: {} };
-  const stderr = `\n✖ ${res.error}\n${require('../scripts/gds/upgrade-outcome.js').outcomeLine(res)}`;
+  const res = { ok: false, error: require('../scripts/bongos/upgrade-migrate.js').migrateError(mig), rolledBack: true, rollback: {} };
+  const stderr = `\n✖ ${res.error}\n${require('../scripts/bongos/upgrade-outcome.js').outcomeLine(res)}`;
   const r = await R.coreUpgradeInstance(inst(), upgradeThrows(stderr)(makeDeps()), intent());
   assert.deepEqual(r.failure, { class: 'unknown', reason: 'migrate_check_violation' });
   assert.match(r.error, /failed and was rolled back/);
@@ -1593,12 +1593,12 @@ await t('the runner\'s own refusals are classified too', async () => {
 });
 
 await t('upgrade.js ends a failed run with the outcome line', () => {
-  const src = fs.readFileSync(new URL('../scripts/gds/upgrade.js', import.meta.url), 'utf8');
+  const src = fs.readFileSync(new URL('../scripts/bongos/upgrade.js', import.meta.url), 'utf8');
   assert.match(src, /if \(!res\.ok\) \{ process\.stderr\.write\([^\n]*outcomeLine\(res\)/);
 });
 
 await t('the drain loop writes the class beside the sentence (behaviour: tests/provision.mjs)', () => {
-  const src = fs.readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  const src = fs.readFileSync(new URL('../scripts/bongos/provision.js', import.meta.url), 'utf8');
   assert.match(src, /SET failure_class = \$2, failure_reason = \$3/);
 });
 

package/tests/credential_presence.mjs

@@ -19,8 +19,8 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'credential-presence.js');
-const { CREDENTIALS, parseEnvFile, sweep, format, readFiles } = require('../scripts/gds/credential-presence.js');
+const SCRIPT = path.join(ROOT, 'scripts', 'bongos', 'credential-presence.js');
+const { CREDENTIALS, parseEnvFile, sweep, format, readFiles } = require('../scripts/bongos/credential-presence.js');
 const { envPrefix } = require('../src/instance-config.js');
 const P = envPrefix();
 

package/tests/credit_grant.mjs

@@ -607,9 +607,9 @@ await test('cost-plus-only cascade: a 0 per-task credit → idea-promotion slice
 const fs = require('node:fs');
 const os = require('node:os');
 const nodePath = require('node:path');
-const { priceTranscript, priceSubagents, buildCostRows } = require('../scripts/gds/session-cost.js');
-const { buildSessionDigest } = require('../scripts/gds/session-digest-build.js');
-const { foldSubagentUsage } = require('../scripts/gds/ship-session-upload.js');
+const { priceTranscript, priceSubagents, buildCostRows } = require('../scripts/bongos/session-cost.js');
+const { buildSessionDigest } = require('../scripts/bongos/session-digest-build.js');
+const { foldSubagentUsage } = require('../scripts/bongos/ship-session-upload.js');
 const { priceModelUsage } = require('../src/bongos/llm-pricing.js');
 
 const PARALLEL_SID = 'sess-parallel';

package/tests/credit_log_single_writer.mjs

@@ -2,7 +2,7 @@
 //
 // Task 1003641 — the balance is moved by the TRIGGER, and by nothing else.
 //
-// THE BUG. scripts/gds/backfill-task-rewards.js applyPlan() did both: INSERT INTO
+// THE BUG. scripts/bongos/backfill-task-rewards.js applyPlan() did both: INSERT INTO
 // credit_log (which fires trg_credit_log_apply AFTER INSERT) *and* a separate
 // `UPDATE builders SET total_credits = total_credits + $1`. The trigger had already
 // applied that delta, so every credit the script minted landed twice. A real
@@ -38,8 +38,8 @@ const code = (src) => src
 
 // Every file in the repo that inserts a credit_log row.
 const WRITERS = [
-  ['scripts', 'gds', 'backfill-task-rewards.js'],
-  ['scripts', 'gds', 'backfill-subagent-rewards.js'],
+  ['scripts', 'bongos', 'backfill-task-rewards.js'],
+  ['scripts', 'bongos', 'backfill-subagent-rewards.js'],
   ['modules', 'economy', 'achievements.js'],
   ['modules', 'economy', 'credits.js'],
   ['modules', 'lifecycle', 'db-rank-authz.js'],
@@ -75,7 +75,7 @@ test('no credit_log writer ALSO updates builders.total_credits', () => {
 });
 
 test('backfill-task-rewards.js specifically — the regression that cost real credits', () => {
-  const src = read('scripts', 'gds', 'backfill-task-rewards.js');
+  const src = read('scripts', 'bongos', 'backfill-task-rewards.js');
   assert.match(src, /INSERT INTO credit_log/, 'it still mints the audit row');
   assert.doesNotMatch(code(src), /\btotal_credits\s*=/i,
     'and must never assign total_credits — the trigger owns the balance');
@@ -87,7 +87,7 @@ test('backfill-task-rewards.js specifically — the regression that cost real cr
 test('the idempotency key still guards re-runs', () => {
   // Removing the double-write must not disturb the other half of this script's
   // safety: a second run of the same backfill must mint nothing.
-  const src = code(read('scripts', 'gds', 'backfill-task-rewards.js'));
+  const src = code(read('scripts', 'bongos', 'backfill-task-rewards.js'));
   assert.match(src, /SELECT 1 FROM credit_log WHERE task_id = \$1 AND reason = \$2/,
     'the per-task idempotency re-check inside the transaction');
   assert.match(src, /BACKFILL_REASON/, 'keyed on the backfill reason');

package/tests/criterion_ref_status.mjs

@@ -1,7 +1,7 @@
 // tests/criterion_ref_status.mjs
 //
 // The READ side of the criterion-ref vocabulary (task 1004069): what
-// scripts/gds/status.js accepts on input and what it calls a criterion in
+// scripts/bongos/status.js accepts on input and what it calls a criterion in
 // output. The write half is tests/criterion_ref_parse.mjs.
 //
 // WHY THESE CASES. `Cn` is ROW_NUMBER() over a reorderable sort_order, so it is
@@ -19,7 +19,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const status = require('../scripts/gds/status.js');
+const status = require('../scripts/bongos/status.js');
 const refs = require('../modules/lifecycle/criterion-ref.js');
 
 let passed = 0;

package/tests/cross_discipline_priority_direction.mjs

@@ -10,7 +10,7 @@
 // "You might enjoy" section.
 //
 // The function has TWO hand-copied implementations — the canonical one in
-// modules/lifecycle/db-tasks.js and a mirror in scripts/gds/start.js, which is
+// modules/lifecycle/db-tasks.js and a mirror in scripts/bongos/start.js, which is
 // a pure HTTP client and cannot import the server module. This test EXECUTES
 // both against the same fixtures and asserts they agree, so the pair cannot
 // drift apart again.
@@ -29,7 +29,7 @@ const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
 
 const CANONICAL = require(path.join(ROOT, 'modules/lifecycle/db-tasks.js'))
   .rankCrossDisciplineRecommendations;
-const MIRROR = require(path.join(ROOT, 'scripts/gds/start.js'))
+const MIRROR = require(path.join(ROOT, 'scripts/bongos/start.js'))
   .rankCrossDisciplineRecommendations;
 
 // Both copies, run over the same input. Every behavioural assertion below goes
@@ -174,7 +174,7 @@ await test('the DB still says 1 is most urgent (CHECK + the 6 - COALESCE weighti
 
 await test('neither copy claims priority DESC, and the mirror pointer resolves', () => {
   const canonicalSrc = read('modules/lifecycle/db-tasks.js');
-  const mirrorSrc = read('scripts/gds/start.js');
+  const mirrorSrc = read('scripts/bongos/start.js');
   for (const [name, src] of [['db-tasks.js', canonicalSrc], ['start.js', mirrorSrc]]) {
     assert.ok(!/priority DESC/.test(src), `${name}: no comment may assert priority DESC`);
   }