@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/autobongos-service.cmd

@@ -1,50 +1,9 @@
 @echo off
-REM scripts/gds/autobongos-service.cmd -- what the scheduled task actually runs
-REM (task 1003905). A .cmd, not a direct node invocation, for three reasons the
-REM scheduler cannot do itself.
-REM
-REM 1. THE CHECKOUT IS BROUGHT CURRENT FIRST. A runner pinned to whatever was on
-REM    disk the day it was installed drifts silently, and the first symptom is
-REM    workers building against a stale fence. `git fetch` + `reset --hard` on the
-REM    MAIN checkout only -- worker trees are separate worktrees and are never
-REM    touched here.
-REM 2. OUTPUT IS APPENDED TO ONE FILE the owner can read remotely. The scheduler
-REM    keeps only an exit code, which cannot answer "what was it doing".
-REM 3. A NON-ZERO EXIT IS RETURNED so the scheduler's restart rule can see it.
-REM
-REM The runner itself never exits on failure (task 1003904) -- it backs off and
-REM probes -- so reaching the end of this file at all means something the inner
-REM loop could not survive.
-
-setlocal
-set "REPO=%~dp0..\.."
-set "LOGDIR=%LOCALAPPDATA%\cloudbongos"
-set "LOG=%LOGDIR%\autobongos.log"
-if not exist "%LOGDIR%" mkdir "%LOGDIR%"
-
-cd /d "%REPO%" || exit /b 1
-
-REM THE UPGRADE LOOP (task 1004374). The runner exits 75 when main has moved
-REM past the code it loaded; we refresh and relaunch. Without this --forever
-REM never returns and so never picks up a fix: on the host this ran week-old
-REM code for four days across three landed fixes while the heartbeat reported
-REM it alive. Looping HERE rather than leaning on the scheduler matters,
-REM because MultipleInstances IgnoreNew makes a restart a silent no-op while
-REM the old process is still up.
-:run
-echo. >> "%LOG%"
-echo ==== autobongos starting %DATE% %TIME% ==== >> "%LOG%"
-
-REM Best effort: a fetch that fails must not stop the runner from starting on the
-REM code it already has. Being a commit behind beats not running at all.
-git fetch --quiet origin main >> "%LOG%" 2>&1
-git reset --quiet --hard origin/main >> "%LOG%" 2>&1
-
-node scripts\gds\autobongos-run.js --forever --json >> "%LOG%" 2>&1
-set EXITCODE=%ERRORLEVEL%
-if "%EXITCODE%"=="75" (
-  echo ==== autobongos relaunching for an upgrade at %DATE% %TIME% ==== >> "%LOG%"
-  goto run
-)
-echo ==== autobongos exited %EXITCODE% at %DATE% %TIME% ==== >> "%LOG%"
-exit /b %EXITCODE%
+rem scripts/gds/autobongos-service.cmd -- @bongos-forwarder (task 1004848). Generated by
+rem scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+rem The real script is scripts/bongos/autobongos-service.cmd. This forwarder keeps callers that still name
+rem the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if not defined BONGOS_FORWARDER_WARNED echo [bongos] scripts/gds/autobongos-service.cmd has moved to scripts/bongos/autobongos-service.cmd. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release. 1>&2
+set BONGOS_FORWARDER_WARNED=1
+call "%~dp0..\bongos\autobongos-service.cmd" %*
+exit /b %ERRORLEVEL%

package/scripts/gds/autobongos-service.ps1

@@ -1,270 +1,8 @@
-# scripts/gds/autobongos-service.ps1 -- install the Autobongos runner so it
-# outlives the reboot (task 1003905, ADR 0307 section 5).
-#
-#   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 install
-#   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 status
-#   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 digest
-#   powershell -ExecutionPolicy Bypass -File scripts\gds\autobongos-service.ps1 start|stop|uninstall
-#
-# WHY TASK SCHEDULER AND NOT A REAL SERVICE. Windows services speak a protocol
-# (SCM handshakes, stop signals) that node does not, so every "node as a service"
-# route needs a third-party wrapper: nssm, winsw, node-windows. Each is a binary
-# to download, verify, update and explain -- a permanent dependency bought for one
-# machine. Task Scheduler is already on the box, runs at boot with no session,
-# survives sign-out, and restarts a crashed task natively. The one thing it does
-# not give is the Services panel, which nobody here needs.
-#
-# WHAT ACTUALLY KEEPS IT ALIVE IS THE INNER LOOP, and that is the important part
-# to understand before reading the RestartCount settings below. `--forever` never
-# returns: it backs off and probes instead of exiting (task 1003904), so the
-# scheduler's restart is the OUTER ring, for the cases the loop cannot survive at
-# all -- a reboot, a power cut, a node crash, an OOM kill. If this ring is doing
-# work regularly, something is wrong that the backoff should have absorbed, and
-# the run log will say so.
-#
-# UNPRIVILEGED ON PURPOSE. It runs as the logged-in user, not SYSTEM: the runner
-# needs that user's git credential, npm config and Claude session, and SYSTEM has
-# none of them. It is also the smaller blast radius for a process that spawns
-# workers with blanket bypassPermissions. (INSTALLING it is the one step that
-# needs an elevated shell of that same user -- see Assert-Prereqs, task 1004177.)
-
-[CmdletBinding()]
-param(
-  [Parameter(Position = 0)]
-  [ValidateSet('install', 'uninstall', 'start', 'stop', 'status', 'digest')]
-  [string]$Action = 'status',
-
-  # The checkout to run from. Defaults to the repo this script lives in, so the
-  # common case needs no argument and cannot point at the wrong tree by typo.
-  [string]$RepoRoot,
-
-  [string]$TaskName = 'Autobongos'
-)
-
-$ErrorActionPreference = 'Stop'
-
-if (-not $RepoRoot) {
-  $RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
-}
-$LogDir = Join-Path $env:LOCALAPPDATA 'cloudbongos'
-$LogFile = Join-Path $LogDir 'autobongos.log'
-$Wrapper = Join-Path $RepoRoot 'scripts\gds\autobongos-service.cmd'
-
-# Is this shell elevated (Run as administrator)? Its own function so the tests
-# can stand it in: the check is Windows-only, and CI runs on Linux.
-function Test-Elevated {
-  $id = [Security.Principal.WindowsIdentity]::GetCurrent()
-  return ([Security.Principal.WindowsPrincipal]$id).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
-}
-
-# REGISTERING vs RUNNING (task 1004177). The task RUNS as this user, unelevated
-# (-RunLevel Limited): that is what reaches the user's git credential and Claude
-# session, and it is load-bearing. But REGISTERING a task with an S4U principal
-# needs an elevated shell -- unelevated, Register-ScheduledTask fails with a bare
-# "Access is denied" (0x80070005) that says nothing about why. Elevating the SAME
-# account keeps $env:USERNAME, so the principal below is still this user. So
-# install -- and only install -- checks, and says so in words, before trying.
-$ElevationNeeded = @(
-  'install needs an elevated shell: registering a task that runs whether or not you are signed in (the S4U logon type) requires Administrator.',
-  'Open PowerShell with "Run as administrator" AS THIS SAME USER and run install again. The task still RUNS as you, unelevated (-RunLevel Limited) -- only the registration needs admin.',
-  'Do NOT install it as SYSTEM or another admin account: the runner needs your git credential and Claude session, and SYSTEM has neither.'
-) -join ' '
-
-function Assert-Prereqs {
-  param([switch]$ForInstall)
-  if (-not (Test-Path (Join-Path $RepoRoot 'scripts\gds\autobongos-run.js'))) {
-    throw "No autobongos-run.js under $RepoRoot -- pass -RepoRoot <path to the checkout>."
-  }
-  if ($ForInstall -and -not (Test-Elevated)) { throw $ElevationNeeded }
-  foreach ($exe in @('node', 'git', 'claude')) {
-    if (-not (Get-Command $exe -ErrorAction SilentlyContinue)) {
-      # Named, not guessed at: a runner that starts without `claude` on PATH will
-      # spawn-fail every worker and look like a mysterious outage in the log.
-      throw "'$exe' is not on PATH for this user. The runner needs node, git and claude."
-    }
-  }
-}
-
-function Show-Status {
-  $t = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
-  if (-not $t) { Write-Host "not installed  (task '$TaskName' does not exist)"; return }
-  $info = Get-ScheduledTaskInfo -TaskName $TaskName
-  Write-Host "task       : $TaskName"
-  Write-Host "state      : $($t.State)"
-  Write-Host "last run   : $($info.LastRunTime)  (result $($info.LastTaskResult))"
-  Write-Host "next run   : $($info.NextRunTime)"
-  Write-Host "log        : $LogFile"
-  if (Test-Path $LogFile) {
-    Write-Host "log size   : $([math]::Round((Get-Item $LogFile).Length / 1KB)) KB"
-    Write-Host ''
-    Write-Host '--- last 15 lines ---'
-    Get-Content $LogFile -Tail 15
-  } else {
-    Write-Host 'log        : (not written yet)'
-  }
-  Write-Host ''
-  Write-Host 'The scheduler only says whether the PROCESS is up. Whether the runner'
-  Write-Host 'is actually working is the hall: it reads the heartbeat this posts.'
-}
-
-# --- stop, and say what actually happened (task 1004375) -----------------------
-#
-# Stop-ScheduledTask returns as soon as the scheduler has been ASKED. It does not
-# wait, and it does not report whether the process went away -- and on the host
-# it did not: the runner, started under the S4U logon type, sat in a session the
-# interactive user could not terminate, survived Stop-ScheduledTask AND a
-# Stop-Process -Force, while this script printed "stopped". Because the task is
-# MultipleInstances IgnoreNew, a following `start` then no-ops against the old
-# process, and the pair reads as a clean restart that changed nothing.
-#
-# So 'stop' now reads the runner's own pid from the heartbeat it writes
-# (autobongos-run.js writeHeartbeat -> <config dir>\autobongos-heartbeat.json),
-# asks the scheduler to stop, POLLS for that pid to exit, and reports one of four
-# outcomes. It never says "stopped" about a process it has not watched exit.
-
-# Where the runner writes its heartbeat: asked of the RUNNER, via its own
-# exported heartbeatPath(), not re-derived here. That function is the only
-# definition -- AUTOBONGOS_HEARTBEAT_FILE first, then the branding pack's config
-# dir, then the repo root -- and a second copy of it in PowerShell would drift
-# from the file the runner actually writes, which is the exact bug this fixes.
-# Only if node itself cannot answer does this fall back to the repo-root name.
-function Get-HeartbeatFile {
-  $fromRunner = $null
-  try {
-    $run = Join-Path $RepoRoot 'scripts\gds\autobongos-run.js'
-    $fromRunner = & node -e "process.stdout.write(String(require(process.argv[1]).heartbeatPath()))" $run
-  } catch { $fromRunner = $null }
-  if ($fromRunner) { return [string]$fromRunner }
-  return (Join-Path $RepoRoot '.autobongos-heartbeat.json')
-}
-
-# The pid the runner recorded, or $null when there is no file or no usable pid.
-function Read-RunnerPid([string]$HeartbeatFile) {
-  if (-not $HeartbeatFile -or -not (Test-Path $HeartbeatFile)) { return $null }
-  try { $hb = Get-Content -Raw -Path $HeartbeatFile | ConvertFrom-Json } catch { return $null }
-  $n = 0
-  if ($hb -and [int]::TryParse([string]$hb.pid, [ref]$n) -and $n -gt 0) { return $n }
-  return $null
-}
-
-# Alive AND node: a heartbeat left behind by a crash can name a pid that Windows
-# has since handed to some unrelated process, and that must not read as "the
-# runner is still running".
-function Test-RunnerAlive([int]$ProcessId) {
-  $p = Get-Process -Id $ProcessId -ErrorAction SilentlyContinue
-  return [bool]($p -and $p.ProcessName -eq 'node')
-}
-
-# Outcome is one of:
-#   stopped        -- the pid was alive, and was watched to exit
-#   still_running  -- the pid was alive and is STILL alive after the wait
-#   not_running    -- the heartbeat's pid was already gone before the stop
-#   unknown        -- no pid to check, so nothing can be claimed either way
-# StopTask is injectable so tests/autobongos_service_ps1.mjs can drive the real
-# polling against a real process without a scheduled task.
-function Invoke-RunnerStop {
-  param(
-    [string]$HeartbeatFile,
-    [int]$TimeoutSeconds = 20,
-    [scriptblock]$StopTask = { Stop-ScheduledTask -TaskName $TaskName }
-  )
-  $runnerPid = Read-RunnerPid $HeartbeatFile
-  $wasAlive = [bool]($runnerPid -and (Test-RunnerAlive $runnerPid))
-  & $StopTask
-  if (-not $runnerPid) { return [pscustomobject]@{ Outcome = 'unknown'; Pid = $null; Waited = 0 } }
-  if (-not $wasAlive) { return [pscustomobject]@{ Outcome = 'not_running'; Pid = $runnerPid; Waited = 0 } }
-  $started = Get-Date
-  $deadline = $started.AddSeconds($TimeoutSeconds)
-  while ((Test-RunnerAlive $runnerPid) -and ((Get-Date) -lt $deadline)) { Start-Sleep -Milliseconds 250 }
-  $waited = [int][math]::Round(((Get-Date) - $started).TotalSeconds)
-  $outcome = if (Test-RunnerAlive $runnerPid) { 'still_running' } else { 'stopped' }
-  return [pscustomobject]@{ Outcome = $outcome; Pid = $runnerPid; Waited = $waited }
-}
-
-function Format-StopReport($Result, [string]$HeartbeatFile) {
-  $p = $Result.Pid
-  switch ($Result.Outcome) {
-    'stopped' {
-      "stopped '$TaskName' -- runner pid $p has exited (watched, not assumed)."
-      'That is for now only: the next boot starts it again. To keep the runner from'
-      'working, use the kill switch in the hall (/builders/gate) -- it survives a'
-      'reboot and nothing running on this machine can undo it.'
-    }
-    'still_running' {
-      "NOT STOPPED: asked Task Scheduler to stop '$TaskName', but runner pid $p is still running after $($Result.Waited)s."
-      'It may be under a different logon session (the task runs as S4U), which this'
-      'shell cannot end -- Stop-Process from here fails the same way.'
-      "Remedy: from an elevated (Administrator) PowerShell run   taskkill /F /PID $p"
-      'or reboot the machine. Until it exits, `start` does nothing: the task will not'
-      'launch a second copy over a live one (MultipleInstances IgnoreNew).'
-    }
-    'not_running' {
-      "'$TaskName' was not running: runner pid $p from the heartbeat had already exited."
-    }
-    default {
-      "asked Task Scheduler to stop '$TaskName', but CANNOT CONFIRM the runner exited:"
-      "no runner pid in $HeartbeatFile. Check   Get-Process node   before assuming it stopped."
-    }
-  }
-}
-
-# Dot-sourced (the tests do this to reach the functions above), stop here: the
-# switch below is the command-line entry point and must not run on a load.
-if ($MyInvocation.InvocationName -eq '.') { return }
-
-switch ($Action) {
-  'install' {
-    Assert-Prereqs -ForInstall
-    New-Item -ItemType Directory -Force -Path $LogDir | Out-Null
-
-    # NOT $action: PowerShell variable names are CASE-INSENSITIVE, so $action IS the
-    # $Action parameter above, and its [ValidateSet]/[string] attributes stay attached
-    # to the variable. Assigning a task-action object to it throws "the value
-    # MSFT_TaskExecAction is not a valid value for the Action variable" and install
-    # fails every time, on every machine. Same trap as the `run` shadow in task 1003908.
-    $taskAction = New-ScheduledTaskAction -Execute $Wrapper -WorkingDirectory $RepoRoot
-    # AtStartup covers the cold reboot the done-when actually names. AtLogOn is
-    # NOT used: it would wait for someone to sign in, which is the one thing that
-    # must not be required.
-    $trigger = New-ScheduledTaskTrigger -AtStartup
-    $principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -LogonType S4U -RunLevel Limited
-    $settings = New-ScheduledTaskSettingsSet `
-      -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
-      -StartWhenAvailable `
-      -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) `
-      -ExecutionTimeLimit ([TimeSpan]::Zero) `
-      -MultipleInstances IgnoreNew
-    # ExecutionTimeLimit ZERO = never kill it. The default is three days, and a
-    # daemon silently executed after three days is exactly the invisible death
-    # this whole task exists to prevent.
-    # MultipleInstances IgnoreNew = the scheduler will not start a second copy
-    # over a live one; the heartbeat file is the second guard, inside the runner.
-
-    Register-ScheduledTask -TaskName $TaskName -Action $taskAction -Trigger $trigger `
-      -Principal $principal -Settings $settings -Force | Out-Null
-
-    Write-Host "installed '$TaskName' -- starts at boot, restarts on crash, logs to $LogFile"
-    Write-Host ''
-    Write-Host 'Start it now with:   .\scripts\gds\autobongos-service.ps1 start'
-    Write-Host 'Then confirm from the hall (/builders/gate) that it is checking in.'
-  }
-  'uninstall' {
-    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
-    Write-Host "removed '$TaskName'. The log at $LogFile is left in place."
-  }
-  'digest' {
-    # The night in one page (task 1003906). On the box for convenience; the same
-    # five answers are what the Gate page and a mailed digest would carry.
-    & node (Join-Path $RepoRoot 'scripts\gds\autobongos-digest.js') @args
-  }
-  'start'  { Start-ScheduledTask -TaskName $TaskName; Write-Host "started '$TaskName'" }
-  'stop'   {
-    $hbFile = Get-HeartbeatFile
-    $result = Invoke-RunnerStop -HeartbeatFile $hbFile
-    Format-StopReport $result $hbFile | ForEach-Object { Write-Host $_ }
-    # Non-zero when the process outlived the stop, so a script driving this
-    # (a restart, a maintenance step) cannot carry on as if it had worked.
-    if ($result.Outcome -eq 'still_running') { exit 1 }
-  }
-  default  { Show-Status }
-}
+# scripts/gds/autobongos-service.ps1 -- @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/autobongos-service.ps1. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if (-not $env:BONGOS_FORWARDER_WARNED) { Write-Warning '[bongos] scripts/gds/autobongos-service.ps1 has moved to scripts/bongos/autobongos-service.ps1. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release.' }
+$env:BONGOS_FORWARDER_WARNED = '1'
+& (Join-Path $PSScriptRoot '..\bongos\autobongos-service.ps1') @args
+exit $LASTEXITCODE

package/scripts/gds/autobongos-tweak-lane.js

@@ -1,262 +1,6 @@
-// scripts/gds/autobongos-tweak-lane.js — the Autobongos tweak lane: pick the
-// oldest submitted page round and hand it to a worker (task 1004679 / BV2.TW19c,
-// ADR 0371 D1, D2, D4, D6, D7).
-//
-// WHY. An artist who presses submit with nobody at a terminal waits forever. The
-// runner already wakes on a cadence, holds a fence and ships through the normal
-// grade, so the lane is a step INSIDE its iteration (D1), before ordinary work,
-// fed by the same derived state the studio shows (D2: open_round.state ===
-// 'submitted', oldest task id first). Everything a person's /tweak does still
-// happens; the worker runs `/tweak --page <id> --unattended` (task 1004678).
-//
-// THE RULES, each its own refusal so a run-log row can say which one held:
-//   lane_off            tweak.autopickup is off (D3) — the lane is silent
-//   lane_at_cap         this month's marked claims reached the cap (D5)
-//   lane_rank_too_low   the runner's builder is below Metic (D4) — reported ONCE
-//   round_waits_for_person  this runner already applied the round twice (D6.2)
-//   round_failed_unchanged  the last apply failed and the round has not moved (D6.3)
-//   page_unknown / protected_path / needs_host_access   the fence over the
-//                       PAGE'S files (D7) — the setting replaces only the goal
-//                       allowlist, so decideTask is asked with the round's own goal
-//
-// The server holds the cap, the per-round limit, the artist gate and the file
-// rule again (tasks 1004677, 1004678). This file is the runner not ASKING for
-// what would be refused, so a quiet machine does not spend a worker learning it.
-
+// scripts/gds/autobongos-tweak-lane.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/autobongos-tweak-lane.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const fence = require('../../modules/autonomy/fence');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const LANE_RANK_FLOOR = 'metic';
-// D6.2, the same number the server refuses a third marked claim at.
-const MAX_AUTO_APPLIES_PER_ROUND = 2;
-const MAX_ROUNDS_READ_PER_PASS = 10;
-// The runner's own tree names (autobongos-run.js worktreeName). Restated rather
-// than required: requiring the runner here would be a cycle.
-const RUNNER_TREE_RE = /^autobongos-\d+-[0-9a-f]{6}$/;
-// The fence refusals that are about the goal allowlist and nothing else: the lane
-// runs past them (D3). The kill switch, a paused builder and the grader stop do not.
-const GOAL_ONLY_CODES = new Set(['goal_not_allowlisted', 'no_allowlist', 'no_builder_scope']);
-
-// ---- pure ------------------------------------------------------------------
-
-// The lane as a whole: may it try at all this pass?
-function decideLane({ settings, rank, state = {} }) {
-  if (!settings || typeof settings !== 'object') return { go: false, code: 'lane_unreadable', quiet: true, reason: 'could not read the tweak auto-pickup setting' };
-  if (settings.mode !== 'on') return { go: false, code: 'lane_off', quiet: true, reason: 'tweak auto-pickup is off for this project' };
-  const remaining = Number.isFinite(Number(settings.remaining_this_month))
-    ? Number(settings.remaining_this_month) : Number(settings.cap) - Number(settings.used_this_month);
-  if (!(remaining > 0)) return { go: false, code: 'lane_at_cap', reason: `this month's ${settings.cap} automatic page tweaks are used up — rounds wait for a person` };
-  const { RANK_TIER } = require('../../src/module-api'); // the one rank map (lazy: only when the lane is on)
-  if (!(RANK_TIER[rank] >= RANK_TIER[LANE_RANK_FLOOR])) {
-    const once = !state.laneRankReported;
-    state.laneRankReported = true;
-    return { go: false, code: 'lane_rank_too_low', quiet: !once, reason: `the runner's builder is ${rank || 'of unknown rank'}; applying a page tweak needs Metic or higher` };
-  }
-  return { go: true };
-}
-
-// The submitted rounds, oldest first (D2).
-function submittedRounds(pagesBody) {
-  const out = [];
-  for (const p of (pagesBody && pagesBody.pages) || []) {
-    const r = p && p.open_round;
-    if (r && r.state === 'submitted' && /^[1-9][0-9]*$/.test(String(r.task_id))) out.push({ pageId: p.id, taskId: String(r.task_id) });
-  }
-  return out.sort((a, b) => Number(a.taskId) - Number(b.taskId));
-}
-
-// How many times THIS runner applied the round: its claims from a runner tree.
-function autoAppliesByRunner(claims) {
-  return (claims || []).filter((c) => c && RUNNER_TREE_RE.test(String(c.worktree_name || ''))).length;
-}
-
-function pageFiles(inventory, pageId) {
-  const page = ((inventory && inventory.pages) || []).find((p) => p && p.id === pageId);
-  return page ? [...(page.files || []), ...(page.states_files || [])] : null;
-}
-
-// One round: may the lane take it?
-function decideRound({ task, claims, files, failedAt, matchProtected }) {
-  if (autoAppliesByRunner(claims) >= MAX_AUTO_APPLIES_PER_ROUND) {
-    return { go: false, code: 'round_waits_for_person', reason: `applied automatically ${MAX_AUTO_APPLIES_PER_ROUND} times already — waiting for a person` };
-  }
-  if (failedAt !== undefined && failedAt === task.updated_at) {
-    return { go: false, code: 'round_failed_unchanged', reason: 'the last automatic apply failed and the round has not changed since' };
-  }
-  if (!files || !files.length) return { go: false, code: 'page_unknown', reason: 'the page inventory does not list this page\'s files' };
-  return fence.decideTask({
-    task: { ...task, touches: files },
-    goals: task.goal_id == null ? [] : [task.goal_id],
-    protectedHits: matchProtected(files),
-  });
-}
-
-function buildTweakPrompt({ task, pageId }) {
-  return [
-    `You are an unattended Autobongos worker applying ONE page tweak: task ${task.id}, page ${pageId}.`,
-    'The round is already claimed in this worktree with the auto_pickup mark.',
-    `Read modules/copy-desk/skills/tweak/SKILL.md and follow its "Unattended mode" for: /tweak --page ${pageId} --unattended`,
-    'Never ask a question. On any halt, run the tweak-halt.js line the skill names and stop.',
-    'Never pass --skip-grade, --force or --allow-empty. Your finish line is WAITING FOR THE ARTIST.',
-  ].join('\n');
-}
-
-// After the worker: what the LEDGER says happened to the round. A held pass at
-// completed is the success; a released round is a halt (no blocker: the round
-// already carries its note, and D6.3 keeps the lane off it until it moves).
-function tweakOutcome({ task, grade }) {
-  const status = task && task.status;
-  if (status === 'completed' && grade && grade.passed === true) return { shape: 'waiting_for_artist', ok: true };
-  if (status === 'ready' || status === 'backlog') return { shape: 'tweak_halted', ok: false, failed: true };
-  return { shape: 'other', ok: false };
-}
-
-// ---- reads -----------------------------------------------------------------
-
-function readInventory(root = REPO_ROOT) {
-  return JSON.parse(fs.readFileSync(path.join(root, 'docs', 'page-inventory.json'), 'utf8'));
-}
-
-async function readRound(api, taskId) {
-  const r = await api.tasks.getTasksId({ id: Number(taskId), query: { include: 'claims,grade' } });
-  if (!r || !r.ok || !r.data || !r.data.task) return null;
-  return { task: r.data.task, claims: r.data.claims || [], grade: r.data.grade || null };
-}
-
-// pickRound — the lane's one call per iteration. Returns { round } to work,
-// or { none, code, reason, quiet?, skipped[] }.
-async function pickRound(deps) {
-  const { api, state, matchProtected } = deps;
-  let settings = null;
-  try { const r = await api.projectSettings.getProjectSettingsTweakAutopickup(); if (r && r.ok) settings = r.data; } catch (_) { /* unreadable */ }
-  let rank = deps.rank;
-  if (rank === undefined) {
-    try { const me = await api.me.getMe(); rank = me && me.ok ? me.data.builder?.rank : null; } catch (_) { rank = null; }
-  }
-  const lane = decideLane({ settings, rank, state });
-  if (!lane.go) return { none: true, ...lane, skipped: [] };
-
-  let pages = null;
-  try { const r = await api.copyDesk.getCopyDeskPages(); if (r && r.ok) pages = r.data; } catch (_) { /* unreadable */ }
-  if (!pages) return { none: true, code: 'lane_unreadable', reason: 'could not read the studio\'s page list', skipped: [] };
-  let inventory = null;
-  try { inventory = (deps.readInventory || readInventory)(); } catch (_) { inventory = null; }
-
-  const skipped = [];
-  const failed = state.tweakFailed || new Map();
-  // Bounded: a backlog of rounds the lane must skip costs at most this many reads a pass.
-  for (const { pageId, taskId } of submittedRounds(pages).slice(0, MAX_ROUNDS_READ_PER_PASS)) {
-    const round = await (deps.readRound || readRound)(api, taskId);
-    if (!round) { skipped.push({ id: taskId, page_id: pageId, code: 'round_unreadable' }); continue; }
-    const files = pageFiles(inventory, pageId);
-    const d = decideRound({ task: round.task, claims: round.claims, files, failedAt: failed.get(taskId), matchProtected });
-    if (!d.go) { skipped.push({ id: taskId, page_id: pageId, code: d.code }); continue; }
-    return { round: { task: round.task, pageId, files } };
-  }
-  return { none: true, code: 'lane_empty', quiet: true, reason: 'no submitted page round the lane may take', skipped };
-}
-
-// Is the lane's switch on? Asked only when the fence refused on goals alone, so a
-// runner with no allowlist and the lane off reports "fenced" exactly as before.
-// Unreadable answers no.
-async function laneSwitchOn(api) {
-  try {
-    const client = api || await (require('./cli-lib').cliClient)();
-    const r = await client.projectSettings.getProjectSettingsTweakAutopickup();
-    return !!(r && r.ok && r.data && r.data.mode === 'on');
-  } catch (_) { return false; }
-}
-
-// ---- the iteration step ----------------------------------------------------
-
-// The codes a lane refusal is logged under. A quiet one (off, nothing to do, the
-// rank refusal after its first report) writes no row, so an idle lane costs the
-// run log nothing.
-function laneRow(got) {
-  return { event: 'tweak_lane', code: got.code, reason: got.reason, skipped: got.skipped || [] };
-}
-
-// workRound — tree, marked claim, one worker, then the ledger. `d` carries the
-// runner's own helpers (runCmd, spawnWork, worktreeName, log, api) so this file
-// adds a lane, not a second way to run a worker.
-async function workRound({ round, opts, state }, d) {
-  const { task, pageId } = round;
-  const id = String(task.id);
-  const node = process.execPath;
-  const failedAt = async () => {
-    const after = await (d.readRound || readRound)(d.api, id).catch(() => null);
-    if (!state.tweakFailed) state.tweakFailed = new Map();
-    state.tweakFailed.set(id, after && after.task ? after.task.updated_at : task.updated_at);
-    return after;
-  };
-  const name = d.worktreeName(task.id);
-  const made = await d.runCmd(node, [path.join('scripts', 'gds', 'worktree.js'), 'add', name, '--base', 'origin/main']);
-  if (!made.ok) return d.log({ event: 'worktree_failed', lane: 'tweak', task_id: task.id, page_id: pageId, worktree: name });
-  const treePath = path.join(REPO_ROOT, '.claude', 'worktrees', name);
-  const claimed = await d.runCmd(node, [path.join(REPO_ROOT, 'scripts', 'gds', 'claim.js'), id, '--auto-pickup'], { cwd: treePath });
-  if (!claimed.ok) {
-    await d.runCmd(node, [path.join('scripts', 'gds', 'worktree.js'), 'remove', name]);
-    await failedAt();
-    return d.log({ event: 'claim_failed', lane: 'tweak', task_id: task.id, page_id: pageId, worktree: name, reason: String(claimed.stderr || claimed.stdout || '').slice(0, 400) });
-  }
-  const started = Date.now();
-  // The grade cap (task 1004536) holds here as on ordinary work: the run's own
-  // grade ledger, read after the worker, never the worker's word.
-  const gradeLedger = d.gradeLedgerPath ? d.gradeLedgerPath(task.id) : null;
-  const capCheck = d.gradeCapReader ? await d.gradeCapReader({ api: d.api, taskId: task.id, ledger: gradeLedger }) : null;
-  const res = await d.spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: treePath, gradeLedger, capCheck, prompt: buildTweakPrompt({ task, pageId }), deps: d.spawnDeps || {} });
-  const grades = capCheck ? await capCheck() : null;
-  if (gradeLedger) { try { fs.rmSync(gradeLedger, { force: true }); } catch (_) { /* its counts travel in the row */ } }
-  let after = await (d.readRound || readRound)(d.api, id).catch(() => null);
-  const capped = !!(grades && grades.exhausted);
-  if (after && after.task && (after.task.status === 'active' || (capped && after.task.status === 'completed' && !(after.grade && after.grade.passed === true)))) {
-    // Left held, or the grade cap reached: release with the fixed note (ADR 0371 D8).
-    await d.runCmd(node, [path.join(REPO_ROOT, 'scripts', 'gds', 'tweak-halt.js'), id, '--code', capped ? 'grade_failed' : 'worker_stopped'], { cwd: treePath });
-    after = await (d.readRound || readRound)(d.api, id).catch(() => null);
-  }
-  const out = after ? tweakOutcome(after) : { shape: 'unreadable', ok: false };
-  if (!out.ok) await failedAt();
-  return d.log({
-    event: 'worked', lane: 'tweak', task_id: task.id, title: task.title, page_id: pageId, worktree: name,
-    outcome: out.shape, ledger_status: after && after.task ? after.task.status : null,
-    ...(grades && (grades.graded || grades.outages) ? { grade_rounds: grades.graded, grade_outages: grades.outages, grade_cap_reached: capped } : {}),
-    session_id: (res && res.sessionId) || null, duration_s: Math.round((Date.now() - started) / 1000),
-    // A read that fails stops the run, as an unreadable ledger does for ordinary work.
-    ...(out.shape === 'unreadable' ? { event: 'verify_halt' } : {}),
-  });
-}
-
-// tweakLaneStep — the runner's call. Returns a run-log row when the lane did
-// something this pass (worked, refused a claim, dry run), else null and the
-// iteration goes on to ordinary work.
-async function tweakLaneStep({ opts, state }, d) {
-  const got = await (d.pickRound || pickRound)({ api: d.api, state, matchProtected: d.matchProtected, readInventory: d.readInventory, readRound: d.readRound, rank: d.rank });
-  if (got.none) {
-    if (!got.quiet) d.log(laneRow(got));
-    return null;
-  }
-  if (opts.dryRun) return d.log({ event: 'dry_run', lane: 'tweak', task_id: got.round.task.id, page_id: got.round.pageId });
-  return workRound({ round: got.round, opts, state }, d);
-}
-
-module.exports = {
-  GOAL_ONLY_CODES,
-  laneSwitchOn,
-  tweakLaneStep,
-  workRound,
-  MAX_AUTO_APPLIES_PER_ROUND,
-  LANE_RANK_FLOOR,
-  decideLane,
-  submittedRounds,
-  autoAppliesByRunner,
-  pageFiles,
-  decideRound,
-  buildTweakPrompt,
-  tweakOutcome,
-  readRound,
-  pickRound,
-};
+require('../bongos/forwarder.js').forward(module, 'autobongos-tweak-lane.js');