@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/fitness.js

@@ -1,1495 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/fitness.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/fitness.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// fitness.js — architecture fitness functions (Path C / ADR 0062 §9, task 1225).
-//
-// The ENFORCEMENT layer for the Cloud Bongos decoupling. A dependency-cruiser/ArchUnit-style gate that
-// keeps the architecture from silently rotting back together. Each check is a pure function over
-// the repo on disk returning { name, ok, hardFail, violations[], warnings[], note }. The CLI runs
-// them all, prints a report, and exits non-zero on any hard failure. tests/fitness.mjs asserts
-// each check passes, so the DB-free unit gate (run-unit-tests.js → the `unit` required check)
-// enforces them on every PR — no new workflow needed.
-//
-// RATCHET, not big-bang. The structural epics that physically separate the core (R51 entrypoint
-// #1190, R52 DB carve-out #1191, R54 module system #1193) are not built yet, so the codebase is
-// still fused (every src/bongos/*.js shares the game's pg Pool via require('../db')). These checks
-// therefore lock in the boundary DIRECTION now and fail only on NEW violations beyond a documented
-// grandfather list; as the epics land they SHRINK the grandfather list. Module-level boundary
-// enforcement (§4) tightens once R54 (#1193) gives us a module manifest to check against.
-//
-// Usage:
-//   node scripts/gds/fitness.js          # run all checks, print report, exit 1 on any hard failure
-//   node scripts/gds/fitness.js --json    # machine-readable report
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-const { checkRankGuards, checkModulePinKeysResolve } = require('./fitness-checks-route-pins.js'); // Checks 4 + 4b — carved out by task 1003192 (the 1,500-line ratchet)
-const genApiDocs = require('./gen-api-docs'); // R12 (#1999): reuse the route model (readsBody/validated) that drives the OpenAPI spec
-const { parseRoutineFrontmatter } = require('./run-routine'); // System 4 (ADR 0078): deterministic-routine boundary
-const { filenameViolation, stemCollisions, numberCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
-const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
-
-// task 1003206 (goal 1000079): fitness.js was 2,004 lines. Four cohesive pieces now
-// live beside it — the shared roots/walkers and three check clusters. They are
-// IMPORTED (not registered by path) so the CHECKS array and module.exports below
-// stay byte-identical to the single-file version every test was written against.
-const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, runChecks, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
-const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
-const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
-const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, PRELAUNCH_SURFACE, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkPrelaunchVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
-const { checkCoreRequiresExcludedConfig, checkCoreRequiresExcludedModule } = require('./fitness-checks-packaging.js'); // Checks 16 + 16b — carved out by task 1003825 (the 1,500-line ratchet)
-const { FLAT_ERROR_BASELINE, checkErrorEnvelope, countFlatErrors, scanFlatErrorSites } = require('./fitness-checks-error-envelope.js'); // Check 17 — carved out by task 1003825
-// ============================================================================
-// Check 1 — core ↔ host/game import boundary (ADR 0062 §1 cut-line)
-// ============================================================================
-//
-// The portable core (src/bongos/) must not import the HOST GAME runtime. After BV1.R49 the game
-// module lives in modules/game/ (rooms, world, db, seats, public, migrations). The only game-
-// related file that stays in src/ is src/preview-server.js (the game-only sandbox entrypoint).
-// Imports into scripts/ (build tooling / engine) are NOT host-game coupling.
-const HOST_GAME = [
-  /^modules\/game\//,           // everything in the game module (moved from src/ by BV1.R49)
-  /^src\/preview-server\.js$/,  // game-only sandbox entrypoint (stays in src/)
-];
-// Empty as of R52/#1191 — the core owns its pool (src/bongos/pool.js) and no longer imports the
-// game's db helper. The boundary now enforces with ZERO grandfathered exceptions.
-const GRANDFATHERED = new Set([]);
-const REQUIRE_RE = /require\(\s*['"](\.\.?\/[^'"]+)['"]\s*\)/g;
-
-function resolvesToHostGame(fromAbsFile, spec) {
-  const abs = path.resolve(path.dirname(fromAbsFile), spec);
-  const r = rel(abs);
-  for (const cand of [r, r + '.js', r.replace(/\/$/, '') + '/index.js']) {
-    if (GRANDFATHERED.has(cand)) return null; // allowed (and not a violation)
-    if (HOST_GAME.some((re) => re.test(cand))) return cand;
-  }
-  return null;
-}
-
-function checkCoreHostBoundary() {
-  const coreDir = path.join(REPO_ROOT, 'src', 'bongos');
-  const violations = [];
-  for (const abs of walkJs(coreDir)) {
-    // scan line-by-line, skipping comment lines so a require(...) quoted in a doc comment
-    // (e.g. explaining the boundary) is never mistaken for a real import.
-    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
-      const trimmed = raw.trim();
-      if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) continue;
-      let m;
-      REQUIRE_RE.lastIndex = 0;
-      while ((m = REQUIRE_RE.exec(raw))) {
-        const target = resolvesToHostGame(abs, m[1]);
-        if (target) violations.push(`${rel(abs)} → require('${m[1]}') reaches host-game code (${target}) — the core must not import the game runtime (ADR 0062 §1).`);
-      }
-    }
-  }
-  return {
-    name: 'core↔host import boundary',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `src/bongos/ must not import the host game runtime (grandfathered: ${[...GRANDFATHERED].join(', ') || 'none'} — severed by R52/#1191).`,
-  };
-}
-
-// ============================================================================
-// Check 2 — root CLAUDE.md size budget + charter presence (ADR 0061)
-// ============================================================================
-const ROOT_HARD_MAX = 300; // ceiling: the always-loaded file must never balloon past this. Ratcheted
-                           // 360→310 when task 1226 generated the §13 session-log index (was a ~58-line
-                           // hand-maintained list), then 310→300 when task 1283 trimmed the quick-nav
-                           // table + §2/§8/§9/§10/§12 verbose prose down to ~294 lines. Lower further as
-                           // more detail relocates to nested docs / ADRs (ADR 0061).
-const ROOT_TARGET = 200;   // the charter's stated aim; keep ratcheting toward it.
-
-// The line count is a structure/readability proxy; the cost paid EVERY session is
-// characters/tokens. A 600-char quick-nav row is one line but ~150 tokens, so
-// within-line bloat slips past ROOT_HARD_MAX entirely (exactly what task 1283
-// trimmed). Guard the real cost too (task 1286). Ratcheted just above the
-// post-1283 size (~39.5K chars / ~9.9K tok); lower alongside ROOT_HARD_MAX as
-// detail relocates to nested docs / ADRs.
-const ROOT_CHAR_HARD_MAX = 42000; // ~10.5K tokens — the always-loaded file must never balloon past this.
-const ROOT_CHAR_TARGET = 32000;   // ~8K tokens — aspirational, mirrors the ~200-line aim.
-const estTokens = (n) => Math.round(n / 4); // ~4 chars/token for markdown prose.
-
-// Where the charter BODY lives since task 1003687. It is guidance for EDITING a
-// CLAUDE.md, so it is paths-scoped (`paths:` frontmatter, same mechanism as
-// .claude/rules/hook-authoring.md) and costs nothing in the sessions — the large
-// majority — that never open one. The kernel keeps the heading and a pointer.
-const CHARTER_RULE_REL = '.claude/rules/claudemd-authoring.md';
-
-function checkClaudeMdBudget(opts = {}) {
-  const p = path.join(INSTANCE_ROOT, 'CLAUDE.md'); // the root CLAUDE.md is INSTANCE content (materialized per instance; ADR 0108)
-  const text = opts.text != null ? opts.text : fs.readFileSync(p, 'utf8');
-  const lines = text.split('\n').length;
-  const violations = [];
-  const warnings = [];
-  if (lines > ROOT_HARD_MAX) {
-    violations.push(`CLAUDE.md is ${lines} lines — over the ${ROOT_HARD_MAX}-line hard ceiling. It loads in full every session; relocate detail to a nested CLAUDE.md / ADR / recipe (ADR 0061).`);
-  } else if (lines > ROOT_TARGET) {
-    warnings.push(`CLAUDE.md is ${lines} lines — over the ~${ROOT_TARGET}-line target (still under the ${ROOT_HARD_MAX} ceiling). Relocate more detail to nested CLAUDE.md / ADRs / recipes (ADR 0061), then lower ROOT_HARD_MAX as it shrinks.`);
-  }
-  const chars = text.length;
-  const tok = estTokens(chars);
-  if (chars > ROOT_CHAR_HARD_MAX) {
-    violations.push(`CLAUDE.md is ${chars} chars (~${tok} tokens) — over the ${ROOT_CHAR_HARD_MAX}-char (~${estTokens(ROOT_CHAR_HARD_MAX)}-token) hard ceiling. The line count may be fine, but the per-session token cost is not — trim verbose prose WITHIN lines (long quick-nav rows, restated rationale), not just whole lines (ADR 0061).`);
-  } else if (chars > ROOT_CHAR_TARGET) {
-    warnings.push(`CLAUDE.md is ${chars} chars (~${tok} tokens) — over the ~${ROOT_CHAR_TARGET}-char (~${estTokens(ROOT_CHAR_TARGET)}-token) target. This is the true per-session cost; within-line bloat (a 600-char table row is one line) escapes the line check. Trim prose, then lower ROOT_CHAR_HARD_MAX.`);
-  }
-  if (!text.includes('## Working with this file (content charter)')) {
-    violations.push('CLAUDE.md is missing the content-charter section (ADR 0061) — the per-line test + "what goes where" table must stay.');
-  } else {
-    // Task 1003687 relocated the charter BODY to a paths-scoped rule, so the kernel
-    // keeps the heading and a pointer. That makes the heading cheap to fake: a section
-    // with nothing behind it satisfies a substring check while the rules it names are
-    // gone. So the charter must resolve to something — either inline here, or through a
-    // pointer whose target actually exists and still carries the two rules + the table.
-    const namesRule = text.includes(CHARTER_RULE_REL);
-    const inlineCharter = text.includes('Per-line test:');
-    if (namesRule) {
-      const rulePath = path.join(INSTANCE_ROOT, CHARTER_RULE_REL); // .claude/ is materialized INSTANCE content (ADR 0108 §3)
-      if (!fs.existsSync(rulePath)) {
-        violations.push(`CLAUDE.md points its content charter at ${CHARTER_RULE_REL}, but that file does not exist — a pointer to nothing is worse than no pointer (ADR 0061 / task 1003687).`);
-      } else {
-        const rule = fs.readFileSync(rulePath, 'utf8');
-        const missing = [];
-        if (!/^---\r?\n[\s\S]*?\bpaths:[\s\S]*?["']\*\*\/CLAUDE\.md["'][\s\S]*?^---$/m.test(rule)) {
-          missing.push('`paths:` frontmatter matching `**/CLAUDE.md` (without it the rule never loads, and the charter is simply gone)');
-        }
-        if (!rule.includes('Per-line test:')) missing.push('the per-line test');
-        if (!rule.includes('## What goes where')) missing.push('the "what goes where" table');
-        if (missing.length) {
-          violations.push(`${CHARTER_RULE_REL} is missing ${missing.join(', ')} — the kernel delegates the charter to it, so the charter is only as real as that file (ADR 0061 / task 1003687).`);
-        }
-      }
-    } else if (!inlineCharter) {
-      violations.push('The CLAUDE.md content-charter section is hollow — it has the heading but neither the per-line test inline nor a pointer to `' + CHARTER_RULE_REL + '`. The heading exists to make the rules findable; on its own it only satisfies this check (ADR 0061).');
-    }
-  }
-  return { name: 'root CLAUDE.md budget + charter', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings, note: `≤ ${ROOT_HARD_MAX} lines / ${ROOT_CHAR_HARD_MAX} chars (~${estTokens(ROOT_CHAR_HARD_MAX)} tok); targets ~${ROOT_TARGET} lines / ~${estTokens(ROOT_CHAR_TARGET)} tok; charter resolves (inline or via ${CHARTER_RULE_REL}).` };
-}
-
-// ============================================================================
-// Check 3 — nested per-module CLAUDE.md presence for high-traffic dirs (ADR 0061)
-// ============================================================================
-const HIGH_TRAFFIC = ['src/bongos', 'src/bongos/routes', 'scripts/gds'];
-
-function checkNestedDocsPresent() {
-  const violations = [];
-  for (const dir of HIGH_TRAFFIC) {
-    // HIGH_TRAFFIC dirs (src/bongos, src/bongos/routes, scripts/gds) are CORE-package dirs — resolve
-    // against the core root, not the instance repo (ADR 0108 §Consequences #4).
-    const doc = path.join(CORE_ROOT, dir, 'CLAUDE.md');
-    if (!fs.existsSync(doc)) violations.push(`${dir}/CLAUDE.md is missing — high-traffic dirs must carry a nested altitude map (ADR 0061).`);
-  }
-  return { name: 'nested CLAUDE.md presence', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: `present for: ${HIGH_TRAFFIC.join(', ')}.` };
-}
-
-// ============================================================================
-// Check 5 — generated artifacts are fresh (Path C enforces Path B; ADR 0063 + ADR 0062 §8)
-// ============================================================================
-// Deterministic file-reads with a `--check` mode (regenerate in-memory, diff, exit non-zero on
-// drift). This gate fails a PR that committed a stale artifact so the "generate, don't hand-maintain"
-// contract can't rot.
-// ADR 0110 (task 1926): docs/repo-map.md + docs/session-log-index.md are now GITIGNORED and
-// regenerated at deploy/box-fetch (the gen-atlas.js model), so parallel branches never collide on
-// them — and there is no committed copy to gate. Their generators are DUAL-DUTY, though: each also
-// refreshes a TRACKED embedded block (the nested CLAUDE.md symbol blocks; the CLAUDE.md §13 snippet).
-// Those blocks stay committed, so we gate the BLOCK bucket HARD via `--check-block`. A naive `--check`
-// here would false-fail every PR (the gitignored whole file is absent from a clean checkout, so it
-// always reads as "would change"); `--check-block` is the exact, non-noisy gate. (docs/file-map.md +
-// the OpenAPI docs are still fully committed and unchanged by ADR 0110 — they keep the plain --check.)
-function checkGeneratedArtifactsFresh() {
-  const violations = [];
-  try {
-    execFileSync(process.execPath, [path.join(__dirname, 'gen-repo-map.js'), '--check-block'], { cwd: REPO_ROOT, stdio: 'pipe' });
-  } catch {
-    violations.push('The tracked nested-doc symbol blocks (src/bongos/CLAUDE.md, src/bongos/routes/CLAUDE.md) are STALE — run `node scripts/gds/gen-repo-map.js` and commit (ADR 0063 / ADR 0110). NB docs/repo-map.md itself is gitignored + deploy-regenerated, not gated here.');
-  }
-  try {
-    execFileSync(process.execPath, [path.join(__dirname, 'gen-session-index.js'), '--check-block'], { cwd: REPO_ROOT, stdio: 'pipe' });
-  } catch {
-    violations.push('The tracked CLAUDE.md §13 recent-sessions snippet is STALE — run `node scripts/gds/gen-session-index.js` and commit (ADR 0062 §8 / ADR 0110). NB docs/session-log-index.md itself is gitignored + deploy-regenerated, not gated here.');
-  }
-  try {
-    // task 1002515 (criterion `accessibility-fluency-profile`, clause 2): the CLAUDE.md §2
-    // fallback posture is generated from the interaction knob's own defaults, so the kernel
-    // and modules/builder-settings/interaction-prefs.js cannot drift into two copies of one
-    // rule — which is what they were. Fully tracked (unlike the ADR 0110 pair above), so a
-    // plain --check is the right gate.
-    execFileSync(process.execPath, [path.join(__dirname, 'gen-interaction-posture.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
-  } catch {
-    violations.push('The CLAUDE.md §2 interaction-posture block is STALE — it is generated from modules/builder-settings/interaction-prefs.js. Run `node scripts/gds/gen-interaction-posture.js` and commit (task 1002515).');
-  }
-  try {
-    execFileSync(process.execPath, [path.join(__dirname, 'gen-file-map.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
-  } catch {
-    violations.push('docs/file-map.md generated sections (.claude/skills/, .claude/scheduled-tasks/) are STALE, a skill/routine has no note in docs/file-map.notes.json, or a directory under modules/ has no file-map entry at all — run `node scripts/gds/gen-file-map.js --check` for the exact list, then fix and commit (ADR 0066; module coverage: task 1004066).');
-  }
-  try {
-    // Also structurally validates the spec (exit 1 on invalid OpenAPI 3.1) beyond the drift check (exit 2). Task 1918.
-    execFileSync(process.execPath, [path.join(__dirname, 'gen-api-docs.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
-  } catch {
-    violations.push('docs/api/openapi.json + docs/api-reference.md + docs/routes-permissions.md are STALE (or the spec is not valid OpenAPI 3.1) — run `node scripts/gds/gen-api-docs.js` and commit (task 1918).');
-  }
-  try {
-    // task 1003556: the copy registry's rows carry LINE NUMBERS, so editing any scanned
-    // UI file stales it. It was covered only by ship-check's OPTIONAL step, which a
-    // builder has to remember to run — so the first signal was CI failing on the PR's
-    // MERGE ref, where the shift is hardest to attribute. Gated here so a local fitness
-    // run says so first.
-    execFileSync(process.execPath, [path.join(__dirname, 'copy-inventory.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
-  } catch {
-    violations.push('docs/copy-registry.json + docs/copy-inventory.md are STALE — every row carries a line number, so editing any scanned UI file shifts them. Run `node scripts/gds/copy-inventory.js` and commit (task 1003556).');
-  }
-  try {
-    // task 1004314 (BV2.TW02): the page inventory is the key Tweak Mode's page status,
-    // claims and pay join on, so a page added, renamed or retitled without it would
-    // be a page the chain cannot see. --check also fails on a duplicate or malformed id.
-    execFileSync(process.execPath, [path.join(__dirname, 'page-inventory.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
-  } catch {
-    violations.push('docs/page-inventory.json + docs/page-inventory.md are STALE (or two pages claim one id) — a page was added, renamed, retitled or changed its scripts/states. Run `node scripts/gds/page-inventory.js` and commit (task 1004314).');
-  }
-  // NB the role packs' responsibility blocks are generated too, but their freshness
-  // is asserted by role-pack-guard.js — one check owns "the packs are correct".
-  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus the CLAUDE.md §2 interaction-posture block (the knob defaults), docs/file-map.md skills/scheduled-tasks sections, docs/api/openapi.json + api-reference.md (API), docs/copy-registry.json + copy-inventory.md (the reader-facing copy, task 1003556) and docs/page-inventory.json + page-inventory.md (every page and its stable id, task 1004314). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
-}
-
-// ---- deterministic cron routine boundary (System 4 / ADR 0078) -------------
-//
-// A `mode: deterministic` routine runs as plain node via run-routine.js — NO
-// model session reads its SKILL body. So that body must not rot back into a
-// wrapped session: it may not instruct a model to mutate (Edit/Write/git
-// push/commit/deploy) or synthesize free text, and its documented commands must
-// not diverge from its declared steps. Keeps the markdown-graveyard pattern out.
-
-const SCHEDULED_TASKS_DIR = path.join(INSTANCE_ROOT, '.claude', 'scheduled-tasks'); // .claude/ is materialized INSTANCE content (ADR 0108 §3)
-
-// Judgment/mutation instructions illegal in a deterministic body. Negated
-// mentions ("never pushes", "does NOT edit") are descriptive boundaries — allowed.
-const JUDGMENT_PATTERNS = [
-  { re: /\bgit\s+(push|commit|add)\b/i, label: 'a git push/commit/add' },
-  { re: /deploy\.sh\b/i, label: 'a deploy.sh invocation' },
-  { re: /`(Edit|Write|MultiEdit|NotebookEdit)`/, label: 'an Edit/Write tool instruction' },
-  { re: /\bsynthesi[sz]e\b/i, label: 'free-text synthesis' },
-  { re: /\b(write|compose|draft)\s+(a|an|the)\s+(summary|report|analysis|narrative|note)\b/i, label: 'free-text synthesis' },
-];
-const NEGATION_RE = /\b(never|not|no|without|cannot|can't|don'?t|doesn'?t|won'?t)\b/i;
-
-// Pure: scan one routine's parsed (mode, steps, body). Returns violation strings.
-// Only inspects deterministic routines; others return []. Exported for tests.
-function scanDeterministicBody(name, { mode, steps, body }) {
-  if (mode !== 'deterministic') return [];
-  const violations = [];
-  if (!steps || steps.length === 0) {
-    violations.push(`${name}: mode: deterministic but no steps: — run-routine.js would launch nothing (ADR 0078).`);
-  }
-  const text = String(body == null ? '' : body);
-  for (const raw of text.split('\n')) {
-    const line = raw.trim();
-    if (!line || NEGATION_RE.test(line)) continue; // skip blank + negated (boundary) lines
-    for (const p of JUDGMENT_PATTERNS) {
-      if (p.re.test(line)) {
-        violations.push(`${name}: deterministic SKILL body contains ${p.label} ("${line.slice(0, 70)}") — it runs as plain node with no model; move remediation/judgment to a separate claimed task (ADR 0078).`);
-      }
-    }
-  }
-  // Divergence: every `node …` command in a fenced code block must be a declared step.
-  const stepCmds = (steps || []).map((s) => String(s.command).replace(/\s+/g, ' ').trim());
-  for (const fence of text.match(/```[\s\S]*?```/g) || []) {
-    for (const fl of fence.split('\n')) {
-      const cmd = fl.trim().replace(/\s+/g, ' ');
-      if (!cmd.startsWith('node ')) continue;
-      if (!stepCmds.some((s) => cmd === s || cmd.startsWith(s) || s.startsWith(cmd))) {
-        violations.push(`${name}: deterministic SKILL body documents \`${cmd.slice(0, 70)}\` which is not in its steps: — prose and steps must not diverge (ADR 0078).`);
-      }
-    }
-  }
-  return violations;
-}
-
-function checkDeterministicRoutines() {
-  const violations = [];
-  let detCount = 0;
-  let dirs = [];
-  try {
-    dirs = fs.readdirSync(SCHEDULED_TASKS_DIR, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
-  } catch (_) { /* no scheduled-tasks dir → nothing to check */ }
-  for (const name of dirs) {
-    let md;
-    try { md = fs.readFileSync(path.join(SCHEDULED_TASKS_DIR, name, 'SKILL.md'), 'utf8'); } catch (_) { continue; }
-    const { mode, steps } = parseRoutineFrontmatter(md);
-    if (mode !== 'deterministic') continue;
-    detCount += 1;
-    const body = md.replace(/^---\n[\s\S]*?\n---\n?/, ''); // strip frontmatter
-    violations.push(...scanDeterministicBody(name, { mode, steps, body }));
-  }
-  return {
-    name: 'deterministic cron routines (ADR 0078)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${detCount} mode:deterministic routine(s): steps declared, no judgment instructions, prose↔steps aligned.`,
-  };
-}
-
-// ============================================================================
-// Check 7/8 — module boundary (the one-way rule, ADR 0083 / design 04§3)
-// ============================================================================
-//
-// The module system's one-way rule: a module imports ONLY src/module-api.js (the
-// published doorway); the core NEVER imports a module; a module NEVER imports a
-// sibling module. These two checks enforce it.
-//
-// Both were GREEN through the strangler: the first two moved modules (M07/M08)
-// imported only the doorway, and the core imported neither. The boundary
-// shipped in WARN mode so a half-moved module mid-migration couldn't red the
-// build; BV1.R45 (task 1414) flips it to ENFORCING now that the first move
-// (M07) proved clean — the monotonic ratchet (ADR 0062 §9 / design
-// 04§3). A NEW cross-boundary import is now a red build; warn-mode is gone.
-let MODULE_BOUNDARY_ENFORCING = true;
-const MODULE_API_REL = 'src/module-api.js';
-
-// If `spec` (a relative require) from `fromAbsFile` resolves into modules/<key>/,
-// return <key>; else null. Pure path math — no fs.
-function resolvesToModule(fromAbsFile, spec) {
-  const abs = path.resolve(path.dirname(fromAbsFile), spec);
-  const r = rel(abs);
-  const m = /^modules\/([^/]+)(\/|$)/.exec(r);
-  return m ? m[1] : null;
-}
-
-// The module a core/module file belongs to, or null if it isn't under modules/.
-function moduleOwnerOf(absFile) {
-  const m = /^modules\/([^/]+)\//.exec(rel(absFile));
-  return m ? m[1] : null;
-}
-
-// For a require `spec` inside a MODULE file, return a violation string or null.
-// Allowed: src/module-api.js (the doorway), intra-module relatives, and bare
-// (npm/node) specs. Forbidden: deep core imports + sibling-module imports.
-function moduleImportViolation(fromAbsFile, spec) {
-  const ownKey = moduleOwnerOf(fromAbsFile);
-  if (!ownKey) return null; // not a module file
-  const absTarget = path.resolve(path.dirname(fromAbsFile), spec);
-  const r = rel(absTarget);
-  // resolve possible file forms
-  const forms = [r, r + '.js', r.replace(/\/$/, '') + '/index.js'];
-  if (forms.includes(MODULE_API_REL)) return null; // the doorway — allowed
-  const otherKey = (() => { const m = /^modules\/([^/]+)(\/|$)/.exec(r); return m ? m[1] : null; })();
-  if (otherKey) {
-    if (otherKey === ownKey) return null; // intra-module — allowed
-    return `${rel(fromAbsFile)} → require('${spec}') reaches sibling module "${otherKey}" — modules must not import each other (use a kernel seam; ADR 0083).`;
-  }
-  if (/^src\//.test(r)) {
-    return `${rel(fromAbsFile)} → require('${spec}') reaches core internals (${r}) — a module may import only the published doorway src/module-api.js (ADR 0083).`;
-  }
-  return null; // outside the repo (node/npm) — not our concern
-}
-
-function checkCoreNeverImportsModule() {
-  const findings = [];
-  const roots = [path.join(REPO_ROOT, 'src'), path.join(REPO_ROOT, 'server.js')];
-  for (const root of roots) {
-    for (const abs of walkJs(root)) {
-      if (moduleOwnerOf(abs)) continue; // module files are scanned by the other check
-      if (HOST_GAME.some((re) => re.test(rel(abs)))) continue; // game-owned files that live in src/ (e.g. preview-server.js) may import game module
-      for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
-        const t = raw.trim();
-        if (t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) continue;
-        let m; REQUIRE_RE.lastIndex = 0;
-        while ((m = REQUIRE_RE.exec(raw))) {
-          const key = resolvesToModule(abs, m[1]);
-          if (key) findings.push(`${rel(abs)} → require('${m[1]}') reaches module "${key}" — the core must never import a module (ADR 0083).`);
-        }
-      }
-    }
-  }
-  const enforcing = MODULE_BOUNDARY_ENFORCING;
-  return {
-    name: 'core never imports a module',
-    ok: findings.length === 0,
-    hardFail: enforcing && findings.length > 0,
-    violations: enforcing ? findings : [],
-    warnings: enforcing ? [] : findings,
-    note: `core (src/, server.js) must not require modules/* — ${enforcing ? 'ENFORCING' : 'warn-mode until BV1.R45'} (ADR 0083).`,
-  };
-}
-
-function checkModulesImportOnlyApi() {
-  const findings = [];
-  for (const abs of walkJsAllRoots('modules')) { // modules ship from BOTH roots (ADR 0108 §Consequences #4)
-    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
-      const t = raw.trim();
-      if (t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) continue;
-      let m; REQUIRE_RE.lastIndex = 0;
-      while ((m = REQUIRE_RE.exec(raw))) {
-        const v = moduleImportViolation(abs, m[1]);
-        if (v) findings.push(v);
-      }
-    }
-  }
-  const enforcing = MODULE_BOUNDARY_ENFORCING;
-  return {
-    name: 'modules import only the published API',
-    ok: findings.length === 0,
-    hardFail: enforcing && findings.length > 0,
-    violations: enforcing ? findings : [],
-    warnings: enforcing ? [] : findings,
-    note: `modules/** may require only src/module-api.js (no deep core, no sibling) — ${enforcing ? 'ENFORCING' : 'warn-mode until BV1.R45'} (ADR 0083).`,
-  };
-}
-
-// ============================================================================
-// Check 9 — the goal scope map imports PROTECTED_GLOBS, never re-declares it
-//           (ADR 0086 §7; the SEC #863 "second list that drifts" failure mode)
-// ============================================================================
-//
-// src/bongos/module-scope-map.js (BV1.R54) derives each module's `protected` flag
-// from PROTECTED_GLOBS. That derivation is only trustworthy if it reads the ONE
-// source (permission-path-check.js) — a hand-copied second list would silently
-// drift from the real protected set and quietly de-protect a module. This check
-// reds the build if the scope map stops importing PROTECTED_GLOBS, or copies it.
-const SCOPE_MAP_REL = 'src/bongos/module-scope-map.js';
-
-// Pure: scan the scope-map source for the import contract. Exported for the
-// "actually catches a violation" test (mirrors scanDeterministicBody).
-function scanScopeMapSource(src) {
-  const violations = [];
-  const text = String(src || '');
-  const importsFrom = /require\(\s*['"]\.\/permission-path-check['"]\s*\)/.test(text);
-  const namesIt = /\bPROTECTED_GLOBS\b/.test(text);
-  if (!importsFrom || !namesIt) {
-    violations.push(`${SCOPE_MAP_REL} must IMPORT PROTECTED_GLOBS from ./permission-path-check and derive \`protected\` from it — never hand-maintain a second protected list (ADR 0086 §7).`);
-  }
-  if (/\b(?:const|let|var)\s+PROTECTED_GLOBS\s*=/.test(text)) {
-    violations.push(`${SCOPE_MAP_REL} re-declares PROTECTED_GLOBS — it must import the single source from permission-path-check.js, not copy it (ADR 0086 §7; the SEC #863 second-list failure mode).`);
-  }
-  return violations;
-}
-
-function checkScopeMapImportsProtected() {
-  const abs = path.join(REPO_ROOT, SCOPE_MAP_REL);
-  let src = null;
-  try { src = fs.readFileSync(abs, 'utf8'); } catch (_) { /* absent → skip */ }
-  // Absent → clean pass: the scope map is a BV1.R54 deliverable; until it exists
-  // there is no import contract to enforce (its own unit test asserts existence).
-  const violations = src == null ? [] : scanScopeMapSource(src);
-  return {
-    name: 'scope map imports PROTECTED_GLOBS (ADR 0086)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: src == null
-      ? `${SCOPE_MAP_REL} absent — skipped (created by BV1.R54).`
-      : `${SCOPE_MAP_REL} derives \`protected\` from the imported PROTECTED_GLOBS (single source; no copied list).`,
-  };
-}
-
-// ============================================================================
-// Check 10 — core carries no module-specific code (ADR 0083 §Decision #4 / design 04§3)
-// ============================================================================
-//
-// The module-system MACHINERY (the doorway + loader + seam registry) must stay
-// module-AGNOSTIC: it discovers, validates, and mounts modules uniformly and may
-// never special-case one by name. The import checks (Check 7/8) stop a module's
-// CODE from being reached by `require`; this stops a module's IDENTITY from being
-// hardcoded into the kernel (`if (key === 'art-pipeline') …`, a copied module helper,
-// a registry entry that should have moved out). "No module-specific code" is
-// operationalized as the one drift-free signal — the kernel names no discovered
-// module KEY (the canonical id from modules/<key>/module.json). Domain terms are
-// deliberately NOT pattern-matched: they're non-deterministic and the doorway
-// legitimately re-exports capability accessors (getBuilderGeminiKeyRow, …); the
-// KEY is the precise thing a generic kernel never needs to write.
-//
-// Scope (BV1.R70 / ADR 0091 §1): the real ~3.5k-LOC TRUST KERNEL — the module-
-// system machinery PLUS the trust primitives + data substrate + config/identity
-// the rest of core depends on. This replaces the original 6-file machinery-only
-// roster (the kernel was unbounded before — the audit's finding). Deliberately
-// EXCLUDED: the still-fused monolith remnants (src/bongos/db.js, routes/me.js,
-// routes.js, server.js) still carry un-stranglered module seams by design
-// (lifecycle + tranche-2 domains leave later) — scanning them would red the
-// build on intentional state. Comment lines are skipped (a key named in a
-// doc/example comment is documentation, not code), and the scope-map registry is
-// exempt from the no-module-keys scan (see KERNEL_NAMES_MODULES_OK).
-const KERNEL_FILES = [
-  // module-system machinery (the original roster)
-  'src/module-api.js',                    // the published doorway
-  'src/modules.js',                       // the registry/resolver facade
-  'src/module-seams.js',                  // the seam registry (ports/events/contributions)
-  'src/role-responsibilities.js',         // the owner's written role statements (task 1003732) — modules.js reads it; imports nothing
-  'src/module-loader/loader.js',          // the disk loader (discover → validate → mount)
-  'src/module-loader/manifest-schema.js', // the manifest validator
-  'src/module-loader/semver.js',          // coreVersion compatibility
-  'src/module-loader/error-tally.js',     // per-module runtime-error counts the loader feeds (task 1004637)
-  'src/bongos/module-scope-map.js',          // the module→path registry (it NAMES every module — exempt below)
-  // trust primitives (ADR 0091 §1) — the authz boundary + data substrate
-  'src/bongos/auth.js',                      // authz gates (requireBuilder/requireRank, ADR 0016)
-  // task 1003206 (goal 1000079) split auth.js's 1,867 lines into these five sign-in
-  // flow modules. They are the SAME kernel machinery, not new domain — auth.js is a
-  // kernel file, so if they were left off this roster the boundary check would read
-  // its own carve as five kernel→non-kernel leaks. Being on the roster also means
-  // each of them is itself held to the kernel import rule, which is the point.
-  'src/bongos/auth-config.js',               // provider config + OAuth scope selection
-  'src/bongos/auth-admission.js',            // membership kind, admission gate, first-admin seating
-  'src/bongos/auth-github.js',               // GitHub device + web OAuth flows
-  'src/bongos/auth-idp.js',                  // hub federation, assertion + logout-token verification
-  'src/bongos/auth-discord.js',              // Discord OAuth link + guild membership
-  'src/bongos/route-rank-check.js',          // deterministic route→rank classification
-  'src/bongos/permission-path-check.js',     // protected-path matcher (PROTECTED_GLOBS, ADR 0043)
-  'src/bongos/goal-scope-check.js',          // goal create-gate scope wall (composes the 3 matchers above; ADR 0086 §3, BV1.R60)
-  'src/bongos/secret-box.js',                // AES-256-GCM per-builder secret box
-  'src/bongos/pool.js',                      // the singleton Postgres pool accessor
-  // task 1003208: the structured logger is kernel infrastructure in the same sense
-  // the pool is — src/module-api.js hands every module a child of it, so it sits
-  // BELOW the module boundary, not beside a domain. It imports only node built-ins
-  // and pino, so joining the roster costs nothing and buys the import-direction
-  // guarantee on the file every module now logs through.
-  'src/bongos/logger.js',                    // pino + request correlation + ADR 0022 redaction
-  // task 1003339 (ADR 0209): the abuse ceiling is a trust primitive in the same
-  // sense the authz gates are — authz says WHO may ask, this says HOW OFTEN, and
-  // an unauthenticated read route has nothing else holding it. src/module-api.js
-  // now hands modules the shared account-existence limiter (the onboarding
-  // module's account-existence probe spends the same budget as core's), so it
-  // sits BELOW the module boundary exactly as logger.js does. It requires NOTHING
-  // — no relative imports at all — so joining the roster costs nothing and buys
-  // the import-direction guarantee on a file two surfaces now trust.
-  'src/bongos/middleware/rate-limit.js',     // the sliding-window abuse ceilings (write + per-surface read)
-  'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
-  // task 1002969 (ADR 0356): when an invite's door closes is part of the admission
-  // gate db-kernel.js runs, and the doorway hands the same definition to the
-  // onboarding and hub modules. It requires NOTHING, so joining costs nothing.
-  'src/bongos/invite-expiry.js',             // the read-time invite expiry (INVITE_EXPIRY_DAYS + its SQL)
-  'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
-  // config / identity (host context a module reads, never hardcodes)
-  'src/instance-config.js',
-  'src/branding.js',
-  // task 1004421 (ADR 0358): branding.js lays the chosen look over the pack through this
-  // file — the same identity/config category, requiring only instance-config and node
-  // built-ins, so it joins the roster rather than reading as a kernel→domain leak.
-  'src/hall-look.js',
-  'src/build-info.js',
-  // task 1003476 (goal 1000072): the project's stale-claim timer — host configuration
-  // a module reads rather than hardcodes, exactly the category instance-config.js and
-  // branding.js are in. The doorway (a KERNEL_FILE) re-exports it, so leaving it off
-  // this roster would read as a kernel->non-kernel leak; it imports only
-  // instance-config + node built-ins, so joining costs nothing.
-  'src/stale-timer.js',
-  // task 1003279 (goal 1000072, ADR 0232): the project's live knob store and the ROT
-  // timer resolver over it — the same category as stale-timer.js directly above (host
-  // configuration a module reads rather than hardcodes), differing only in living in
-  // the DB instead of the env, because task 1003280 requires that knob be changeable
-  // from a page without a redeploy. The doorway re-exports it, so leaving it off this
-  // roster reads as a kernel->non-kernel leak; it imports only pool.js (itself on this
-  // roster) + node built-ins, so joining costs nothing and buys the import-direction
-  // guarantee on the file every future project knob will be read through.
-  'src/bongos/project-settings.js',
-  // BV1.R86: the git-remote/slug + publish-target identity the doorway exposes
-  // (api.repoInfo) for the carved lifecycle github-push/conflict-resolve. It is
-  // KERNEL (already in the module-scope-map kernel key) and imports only the
-  // kernel (instance-config) + node built-ins, so it joins the roster cleanly.
-  'src/bongos/repo-info.js',
-  // task 1002331 (ADR 0182 D6 / ADR 0247): the project's composed join/apply door — a
-  // deterministic classifier over three policy values, the same category as
-  // route-rank-check.js and goal-scope-check.js above (a trust decision the doorway
-  // hands to modules so no module re-derives it). The doorway re-exports it, so
-  // leaving it off this roster reads as a kernel->non-kernel leak; it imports only
-  // branding.js, instance-config.js and logger.js — all on this roster — so joining
-  // costs nothing and buys the import-direction guarantee on the file that decides
-  // who may knock. (Task 1003579 moved joinabilityMode the other way: the gate reads
-  // the composed door, so reader and composer had to sit together or the two would
-  // cycle.) The ARTIST GATE joins for the same reason — task 1003575, ADR 0241.
-  'src/bongos/project-door.js', 'src/bongos/artist-gate.js',
-  // task 1004296 (ADR 0340 D5): the npm registry reader — packument, the in-process
-  // tarball stream and its small tar reader. It moved INTO the core because Settings →
-  // Software update needs it in every hall, and the doorway re-exports it
-  // (readPackageRegistry) for the module that publishes a package, so leaving it off
-  // this roster reads as a kernel->non-kernel leak. It imports only node built-ins
-  // (https, zlib), so joining costs nothing.
-  'src/bongos/package-registry.js',
-  // task 1004657 (ADR 0363 D5): requireActAlone, the gate a building's own page mounts
-  // after its permission gate — the same trust-gate category as auth.js, re-exported
-  // by the doorway, so leaving it off reads as a kernel->non-kernel leak. It imports
-  // only module-seams.js and logger.js (both on this roster) and reaches the
-  // government module through its port, never by require.
-  'src/bongos/act-alone.js',
-];
-
-// Kernel files exempt from the no-module-keys scan (Check 10) because naming a
-// module is, for them, the JOB — they stay in KERNEL_FILES for the import check
-// (Check 12), which guards dependency *direction* (a much stronger guarantee than
-// "never write the string 'art-pipeline'"). Two legitimate reasons a kernel file names
-// a module:
-//   • the REGISTRY — module-scope-map.js IS the module→path map (and
-//     checkScopeMapImportsProtected already guards how it derives `protected`).
-//   • the TRUST BOUNDARY — auth.js carries the Discord OAuth account-LINK flow
-//     (core by design — see modules/discord/CLAUDE.md "NOT in this module"); and
-//     permission-path-check.js / route-rank-check.js MUST name module path
-//     subtrees ('modules/grading/', …) to protect + rank-gate them. Forbidding
-//     these the string would force the trust layer to stop protecting module
-//     surfaces — exactly backwards. The generic machinery + data + config files
-//     (module-api, the loader, db-kernel, secret-box, pool, _helpers, branding,
-//     instance-config, build-info) are NOT exempt and must stay module-agnostic.
-const KERNEL_NAMES_MODULES_OK = new Set([
-  'src/bongos/module-scope-map.js',      // the module→path registry
-  // auth.js and the auth-*.js flow modules task 1003206 split out of it: the
-  // sign-in path legitimately names modules — it resolves the 'onboarding' and
-  // 'government' PORTS by key, and carries the Discord OAuth account-link flow
-  // (core by design — see modules/discord/CLAUDE.md "NOT in this module"). The
-  // exemption follows the code, exactly as the KERNEL_FILES roster above does;
-  // Check 12 still guards these files' dependency DIRECTION, which is the
-  // stronger guarantee.
-  'src/bongos/auth.js',                  // Discord OAuth account-link flow (core by design)
-  'src/bongos/auth-config.js',
-  'src/bongos/auth-admission.js',        // resolves the 'government' rank-role port by key
-  'src/bongos/auth-github.js',           // ticks the 'onboarding' port on first sign-in
-  'src/bongos/auth-idp.js',              // same, on the federated path
-  'src/bongos/auth-discord.js',          // the Discord account-link flow itself
-  'src/bongos/act-alone.js',             // resolves the 'government' port by key for checkActAlone (task 1004657)
-  'src/bongos/permission-path-check.js', // names module path subtrees to PROTECT them
-  'src/bongos/route-rank-check.js',      // names module route dirs to rank-gate them
-  'src/role-responsibilities.js',        // the ideator's VERBATIM statement reads "Make good ideas" — the English word, colliding with the `ideas` key. Owner text; unparaphrasable.
-]);
-
-// The discovered module keys = the directory names under modules/ (a manifest's
-// `key` must equal its dir name — manifest-schema). Empty before any move. With no explicit
-// `modulesDir` it UNIONS every module root (core package + instance repo, ADR 0108 §Consequences
-// #4); an explicit dir keeps the old single-dir behavior (tests). Deduped — a key resolves to
-// exactly one root (the loader errors on a cross-root collision), and today the roots coincide.
-function _moduleKeysIn(modulesDir) {
-  try {
-    return fs.readdirSync(modulesDir, { withFileTypes: true })
-      .filter((d) => d.isDirectory())
-      .map((d) => d.name);
-  } catch { return []; }
-}
-function discoveredModuleKeys(modulesDir) {
-  if (modulesDir) return _moduleKeysIn(modulesDir);
-  const keys = new Set();
-  for (const root of MODULE_ROOTS) for (const k of _moduleKeysIn(path.join(root, 'modules'))) keys.add(k);
-  return [...keys];
-}
-// task 1002790: two questions, previously conflated and asserted EQUAL. BROAD
-// (every dir) stays broad — the migration checks need it, since a .sql in a
-// manifest-less dir must still be namespace/stem-checked (schema_migrations is
-// stem-keyed; a collision is silently SKIPPED). NARROW = carries module.json,
-// which is what makes a module a module (ADR 0083) and what kernel-naming means.
-function manifestModuleKeys(modulesDir) {
-  const manifested = (dir) => _moduleKeysIn(dir).filter((k) => fs.existsSync(path.join(dir, k, 'module.json')));
-  if (modulesDir) return manifested(modulesDir);
-  return [...new Set(MODULE_ROOTS.flatMap((r) => manifested(path.join(r, 'modules'))))];
-}
-// The DIFFERENCE as an instruction, not a bare diff — and a WARNING, because a
-// dir without a manifest is the normal transient shape of scaffolding a module.
-function manifestlessModuleDirs(modulesDir) {
-  const narrow = new Set(manifestModuleKeys(modulesDir));
-  return discoveredModuleKeys(modulesDir).filter((k) => !narrow.has(k)).sort().map((k) =>
-    `modules/${k}/ has no module.json — it is a directory, not a module. Add the manifest (ADR 0083) or remove the dir. Warning, not a failure: scaffolding a module dir before its manifest is normal and must not red CI.`);
-}
-// Absolute path to a discovered module's dir, resolving WHICH root holds it (core package or
-// instance repo). Today both roots coincide → the single checkout.
-function moduleDir(key) {
-  for (const root of MODULE_ROOTS) {
-    const d = path.join(root, 'modules', key);
-    if (fs.existsSync(d)) return d;
-  }
-  return path.join(CORE_ROOT, 'modules', key);
-}
-
-// Pure: scan kernel source text for any hardcoded module key, skipping comment
-// lines. Returns violation strings (one per hit). Exported for the negative test
-// (mirrors scanScopeMapSource / scanDeterministicBody).
-function scanKernelForModuleKeys(text, keys) {
-  const violations = [];
-  if (!keys || keys.length === 0) return violations;
-  const probes = keys.map((k) => ({ key: k, re: keyTokenRe(k) }));
-  String(text == null ? '' : text).split('\n').forEach((raw, i) => {
-    const t = raw.trim();
-    if (!t || t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) return;
-    for (const { key, re } of probes) {
-      if (re.test(raw)) {
-        violations.push(`names module "${key}" at line ${i + 1} — the kernel/module-system machinery must stay module-agnostic; no module key may be hardcoded in core (ADR 0083 §Decision #4).`);
-      }
-    }
-  });
-  return violations;
-}
-
-function checkCoreCarriesNoModuleCode() {
-  const keys = manifestModuleKeys(); // task 1002790 — NARROW: a manifest-less dir is not a module
-  const violations = [];
-  for (const relFile of KERNEL_FILES) {
-    if (KERNEL_NAMES_MODULES_OK.has(relFile)) continue; // the registry legitimately names every module
-    let text;
-    try { text = fs.readFileSync(path.join(REPO_ROOT, relFile), 'utf8'); } catch { continue; }
-    for (const v of scanKernelForModuleKeys(text, keys)) violations.push(`${relFile} ${v}`);
-  }
-  return {
-    name: 'core carries no module code',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: manifestlessModuleDirs(), // task 1002790 — named, and never a hard fail
-    note: `kernel machinery (${KERNEL_FILES.length} files) names no module key${keys.length ? ` (keys: ${keys.join(', ')})` : ' (none yet)'} (ADR 0083 §Decision #4). A key is a modules/ dir carrying module.json; the migration checks deliberately scan every dir (task 1002790).`,
-  };
-}
-
-// ============================================================================
-// Check 12 — the kernel imports no domain (ADR 0091 §1 / BV1.R70)
-// ============================================================================
-//
-// A bounded kernel is only real if it DEPENDS on nothing but itself. This check
-// walks every KERNEL_FILE's relative requires and flags any that reach a
-// non-kernel core file (a soon-to-be-module domain). Kernel→kernel is fine;
-// kernel→grandfathered-infra (the raw base pg pool, the pure path-match util) is
-// fine; a bare npm/node spec is fine. Everything else is a tracked leak.
-//
-// ENFORCING (ADR 0102): the tranche-2 ratchet reached zero, so this is now a hard
-// gate — the kernel imports only itself + grandfathered infra, and any NEW
-// kernel→domain import fails the build (violations). The last leaks cleared were
-// auth.js→db (carved to db-kernel), the doorway's Gemini-key re-exports (→ the
-// art-pipeline 'art.getBuilderGeminiKeyRow' port) and builderRollingAvgGrade (→ the
-// grading 'grade.builderRollingAvgGrade' port), plus reclassifying llm-cache /
-// llm-pricing as kernel-adjacent infra. Adding a leak back reds the build.
-
-// Grandfathered kernel-adjacent targets a KERNEL_FILE may import without it
-// counting as a domain leak. The still-fused src/bongos/db.js monolith is NOT here:
-// a kernel file reaching into it IS a real (tracked) leak until the identity/
-// session slices finish carving into db-kernel.js.
-const KERNEL_IMPORT_ALLOWLIST = new Set([
-  'src/db.js',             // the raw shared pg Pool (base infra; pool.js wraps it)
-  'src/bongos/path-match.js', // pure touches-overlap matcher (no domain logic)
-  // Cross-cutting LLM-cost infra (ADR 0102): a stateless token→USD pricing table
-  // (llm-pricing) + a best-effort content-addressed cache (llm-cache), consumed by
-  // core, the grading module, and the CLI cost tooling ALIKE — no domain logic and
-  // no domain state beyond a cache table. Same category as the pg pool / path-match,
-  // not a domain module core would have to depend on anyway. The doorway may import
-  // them; they never flip the kernel→domain leak.
-  'src/bongos/llm-cache.js',
-  'src/bongos/llm-pricing.js',
-  // The cheapest-model-first cascade router (task 1001691 / ADR 0101 Part 1):
-  // a pure ladder + an INJECTED runner (never a domain call itself — its own
-  // header says so: "nothing calls it but its mock unit test" until this
-  // task), holding no domain state of its own. Its first real caller is the
-  // lifecycle module's relevance judge, which reaches it through the doorway
-  // exactly as grading reaches llm-cache — same category as the pg pool /
-  // path-match / llm-cache above, not a domain module core would otherwise
-  // depend on.
-  'src/bongos/cascade-dispatch.js',
-]);
-
-// Pure: for relative require `spec` from kernel file `fromRel` (repo-relative),
-// return the offending non-kernel target relpath, or null if the import is clean
-// (kernel→kernel, kernel→allowlisted-infra, or a bare npm/node spec). Exported
-// for the "actually catches a leak" negative test (mirrors scanScopeMapSource).
-function kernelDomainImport(fromRel, spec, kernelSet = new Set(KERNEL_FILES), allow = KERNEL_IMPORT_ALLOWLIST) {
-  if (!/^\.\.?\//.test(spec)) return null; // bare npm/node spec — not our concern
-  const absTarget = path.resolve(path.dirname(path.join(REPO_ROOT, fromRel)), spec);
-  const r = rel(absTarget);
-  const forms = [r, r + '.js', r.replace(/\/$/, '') + '/index.js'];
-  if (forms.some((f) => kernelSet.has(f))) return null; // kernel → kernel
-  if (forms.some((f) => allow.has(f))) return null;      // grandfathered infra/util
-  if (!/^src\//.test(r)) return null;                    // only flag app-source targets
-  return r.endsWith('.js') || r.endsWith('.json') ? r : `${r}.js`; // name the real file
-}
-
-function checkKernelImportsNoDomain() {
-  const kernelSet = new Set(KERNEL_FILES);
-  const findings = [];
-  for (const relFile of KERNEL_FILES) {
-    let text;
-    try { text = fs.readFileSync(path.join(REPO_ROOT, relFile), 'utf8'); } catch { continue; }
-    for (const raw of text.split('\n')) {
-      const t = raw.trim();
-      if (t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) continue;
-      let m; REQUIRE_RE.lastIndex = 0;
-      while ((m = REQUIRE_RE.exec(raw))) {
-        const target = kernelDomainImport(relFile, m[1], kernelSet);
-        if (target) findings.push(`${relFile} → require('${m[1]}') reaches non-kernel core file ${target} — a kernel file must depend only on the kernel (ADR 0091 §1). Carve ${target}'s domain out (or promote it into the kernel) to clear this.`);
-      }
-    }
-  }
-  return {
-    name: 'kernel imports no domain',
-    ok: findings.length === 0,
-    hardFail: findings.length > 0, // ENFORCING (ADR 0102): the ratchet reached zero — any new kernel→domain import now reds the build
-    violations: findings,
-    warnings: [],
-    note: `every KERNEL_FILE (${KERNEL_FILES.length}) must import only the kernel + grandfathered infra — ENFORCING (ADR 0091 §1 / ADR 0102).${findings.length ? ` ${findings.length} leak(s).` : ' Boundary clean.'}`,
-  };
-}
-
-// ============================================================================
-// Check 11 — module migrations are additive + namespaced (ADR 0083 §Decision #5 / design 04§3)
-// ============================================================================
-//
-// A module owns its DB slice through migrations under modules/<key>/migrations/.
-// Two invariants keep that slice from clobbering core or a sibling:
-//   • ADDITIVE — no destructive DDL. "Disable a module" means "stop applying its
-//     migrations," never "drop its tables" (ADR 0083 §Module-owned migrations);
-//     there is no down path, so a DROP/TRUNCATE can only be an accident.
-//   • NAMESPACED — every object it CREATEs lives under the <key>_ prefix
-//     (art-pipeline → art_pipeline_), and it may only ALTER its own namespaced tables;
-//     core/sibling state is reached through the doorway/seams, never raw DDL.
-//
-// LEGACY_NAMESPACED: tables that predate the <key>_-prefix convention (created before the module
-// system existed). Grandfathered per-module to avoid requiring a rename migration for legacy prod
-// data. The fitness rule applies in full to any NEW migration a module ships.
-const LEGACY_NAMESPACED = {
-  // game module: world_events + players were created before the module system (V1 schema). The
-  // schema_migrations table is a core tracking table that every migration may re-create idempotently.
-  game: new Set(['world_events', 'players', 'schema_migrations']),
-  // government module: the module KEY was renamed governance→government (ADR 0174, goal 1000068),
-  // so its own historical migrations now read as "outside the namespace" purely because the key
-  // moved underneath them. These three tables ARE this module's — under the name it used to have.
-  // They are not renamed in place because schema_migrations is keyed by filename STEM: renaming an
-  // already-applied migration file makes it look unapplied and re-runs it, and governance_002 is a
-  // seed/backfill. government_001_rename_from_governance.sql renames the live tables forward; these
-  // entries let the historical files that created them keep describing what actually happened.
-  government: new Set([
-    'governance_roles', 'governance_builder_roles', 'governance_role_permissions',
-  ]),
-};
-const DESTRUCTIVE_DDL = [
-  { re: /\bdrop\s+table\b/i, label: 'DROP TABLE' },
-  { re: /\balter\s+table\b[\s\S]*?\bdrop\s+(?:column|constraint)\b/i, label: 'ALTER TABLE … DROP COLUMN/CONSTRAINT' },
-  { re: /\bdrop\s+(?:column|constraint)\b/i, label: 'DROP COLUMN/CONSTRAINT' },
-  { re: /\bdrop\s+(?:index|type|view|sequence|schema|materialized\s+view)\b/i, label: 'DROP <object>' },
-  { re: /\btruncate\b/i, label: 'TRUNCATE' },
-];
-const CREATE_OBJ_RE = /\bcreate\s+(?:or\s+replace\s+)?(?:unique\s+)?(?:materialized\s+)?(table|view|sequence|type)\s+(?:if\s+not\s+exists\s+)?("?[\w.]+"?)/gi;
-const CREATE_INDEX_RE = /\bcreate\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:"?[\w.]+"?)\s+on\s+(?:only\s+)?("?[\w.]+"?)/gi;
-const ALTER_TABLE_RE = /\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?("?[\w.]+"?)/gi;
-
-// SQL object-namespace prefix for a module key: art-pipeline → art_pipeline (SQL-safe).
-function moduleNamespace(key) { return key.replace(/-/g, '_'); }
-
-// strip SQL comments so a commented-out statement is never scanned
-function stripSqlComments(sql) {
-  return String(sql == null ? '' : sql)
-    .replace(/\/\*[\s\S]*?\*\//g, ' ')
-    .replace(/--[^\n]*/g, ' ');
-}
-
-// is `rawName` (possibly quoted / schema-qualified) under the <ns>_ namespace?
-function inNamespace(rawName, ns, legacySet) {
-  const name = String(rawName).replace(/"/g, '').replace(/^[A-Za-z_]\w*\./, '');
-  return name.startsWith(ns + '_') || (legacySet && legacySet.has(name));
-}
-
-// A CHECK-enum WIDENING is additive-in-spirit: `DROP CONSTRAINT IF EXISTS <c>` PAIRED
-// with a re-`ADD CONSTRAINT <c>` (SAME name) in the SAME migration only PERMITS more
-// values — no existing row changes, no data is lost (task 1978: provisioning gains a
-// 'standalone' hosting_shape). Allow that exact pattern; a BARE `DROP CONSTRAINT` (no
-// re-add), or any DROP TABLE/COLUMN/TRUNCATE, stays destructive. PURE.
-function reAddedConstraintNames(sql) {
-  const names = new Set();
-  const re = /\badd\s+constraint\s+("?[\w.]+"?)/gi;
-  let m;
-  while ((m = re.exec(sql))) names.add(m[1].replace(/"/g, ''));
-  return names;
-}
-function isConstraintWidening(stmt, reAdded) {
-  const m = /\bdrop\s+constraint\s+(?:if\s+exists\s+)?("?[\w.]+"?)/i.exec(stmt);
-  if (!m) return false;                                  // not a DROP CONSTRAINT at all
-  // never let a DROP CONSTRAINT statement smuggle a table/column drop past the gate
-  if (/\bdrop\s+(?:table|column|index|type|view|sequence|schema|materialized\s+view)\b/i.test(stmt)) return false;
-  if (/\btruncate\b/i.test(stmt)) return false;
-  return reAdded.has(m[1].replace(/"/g, ''));            // re-added same-named constraint → widening
-}
-
-// The ONE destructive shape a module may carry: an ACKNOWLEDGED contract-phase
-// `ALTER TABLE <own table> DROP COLUMN <c>` (task 1003092 — the expand-then-contract
-// rename of ADR 0177 has to finish; ADR 0083 §Module-owned migrations, amended). The
-// pragma is read off the RAW sql (it is a comment); everything else here still runs.
-const { acknowledgedContraction, isAcknowledgedColumnContraction } = require('./fitness-migration-contraction.js');
-
-// Pure: violations for ONE module's migration SQL. Exported for the negative test.
-function moduleMigrationViolations(key, sql) {
-  const ns = moduleNamespace(key);
-  const legacy = LEGACY_NAMESPACED[key] || null;
-  const clean = stripSqlComments(sql);
-  const violations = [];
-  // additive — scan per statement so an ALTER…DROP never spans a `;`
-  const reAdded = reAddedConstraintNames(clean);
-  const acknowledged = acknowledgedContraction(sql);
-  const ownTable = (t) => inNamespace(t, ns, legacy);
-  for (const stmt of clean.split(';')) {
-    if (isConstraintWidening(stmt, reAdded)) continue; // additive CHECK-enum widening (task 1978)
-    if (isAcknowledgedColumnContraction(stmt, { acknowledged, inNamespace: ownTable })) continue; // contract phase (task 1003092)
-    for (const d of DESTRUCTIVE_DDL) {
-      if (d.re.test(stmt)) {
-        violations.push(`module "${key}" migration uses destructive DDL (${d.label}) — module migrations must be ADDITIVE; disabling a module stops applying, it never drops (ADR 0083 §Decision #5).`);
-        break; // one destructive flag per statement is enough
-      }
-    }
-  }
-  // namespaced — CREATEd objects + ALTER targets must live under <ns>_ (or be grandfathered)
-  let m;
-  CREATE_OBJ_RE.lastIndex = 0;
-  while ((m = CREATE_OBJ_RE.exec(clean))) {
-    if (!inNamespace(m[2], ns, legacy)) {
-      violations.push(`module "${key}" migration creates ${m[1].toUpperCase()} ${m[2]} outside its namespace — module objects must be ${ns}_-prefixed (ADR 0083 §Decision #5).`);
-    }
-  }
-  CREATE_INDEX_RE.lastIndex = 0;
-  while ((m = CREATE_INDEX_RE.exec(clean))) {
-    if (!inNamespace(m[1], ns, legacy)) {
-      violations.push(`module "${key}" migration indexes a non-namespaced table ${m[1]} — a module migration may only touch its own ${ns}_ tables (ADR 0083 §Decision #5).`);
-    }
-  }
-  ALTER_TABLE_RE.lastIndex = 0;
-  while ((m = ALTER_TABLE_RE.exec(clean))) {
-    if (!inNamespace(m[1], ns, legacy)) {
-      violations.push(`module "${key}" migration alters a non-namespaced table ${m[1]} — a module migration may only touch its own ${ns}_ tables; reach core state through the doorway/seams, not DDL (ADR 0083 §Decision #5).`);
-    }
-  }
-  return violations;
-}
-
-function checkModuleMigrationsAdditive() {
-  const violations = [];
-  let scanned = 0;
-  for (const key of discoveredModuleKeys()) { // union across module roots (ADR 0108 §Consequences #4)
-    const migDir = path.join(moduleDir(key), 'migrations');
-    let files = [];
-    try { files = fs.readdirSync(migDir).filter((f) => f.endsWith('.sql')); } catch { continue; }
-    for (const f of files.sort()) {
-      scanned += 1;
-      const sql = fs.readFileSync(path.join(migDir, f), 'utf8');
-      for (const v of moduleMigrationViolations(key, sql)) {
-        violations.push(`modules/${key}/migrations/${f}: ${v}`);
-      }
-    }
-  }
-  return {
-    name: 'module migrations additive + namespaced',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${scanned} module migration file(s): additive (no destructive DDL) + <key>_-namespaced objects (ADR 0083 §Decision #5).`,
-  };
-}
-
-// ============================================================================
-// Check 11b — migration FILENAMES are namespaced + no cross-root stem collision
-//             (ADR 0108 §5; extends Check 11 to the cross-repo layer)
-// ============================================================================
-//
-// Check 11 (above) guards a module migration's OBJECTS (additive + <key>_-namespaced
-// tables). THIS check guards migration FILENAMES across all three roots — the
-// discipline that lets the core repo and the instance repo version independently
-// (ADR 0108) without their migrations colliding:
-//   • migrations/*.sql            (CORE)     → NEW files must be core_-prefixed
-//   • migrations/instance/*.sql   (INSTANCE) → stay bare (or instance_-prefixed)
-//   • modules/<key>/migrations/   (MODULE)   → NEW files must be <key>_-prefixed
-// Existing bare files are grandfathered (migration-namespace.js LEGACY_BARE_*). The
-// second invariant is the real bug guard: migrate.sh keys schema_migrations by
-// filename STEM, so two migrations from different sources sharing a stem would apply
-// ONCE and the other be SILENTLY SKIPPED (never applied). Single-root today; W6/task
-// 1886 makes the root resolution two-root-aware once the core installs from node_modules.
-function sqlFilesIn(absDir) {
-  try { return fs.readdirSync(absDir).filter((f) => f.endsWith('.sql')).sort(); }
-  catch { return []; } // dir absent (e.g. no migrations/instance in a vanilla instance) → nothing to scan
-}
-
-function checkMigrationNamespacing() {
-  const violations = [];
-  const files = []; // { source, moduleKey?, basename } — fed to the stem-collision scan
-
-  const coreFiles = sqlFilesIn(path.join(CORE_ROOT, 'migrations')); // core migrations ship in the core package
-  for (const f of coreFiles) {
-    const v = filenameViolation(CORE_NS, f);
-    if (v) violations.push(`migrations/${f}: ${v}`);
-    files.push({ source: CORE_NS, basename: f });
-  }
-
-  const instFiles = sqlFilesIn(path.join(INSTANCE_ROOT, 'migrations', 'instance')); // instance seeds live in the host repo
-  for (const f of instFiles) {
-    const v = filenameViolation(INSTANCE_NS, f);
-    if (v) violations.push(`migrations/instance/${f}: ${v}`);
-    files.push({ source: INSTANCE_NS, basename: f });
-  }
-
-  let moduleCount = 0;
-  for (const key of discoveredModuleKeys()) {
-    for (const f of sqlFilesIn(path.join(moduleDir(key), 'migrations'))) {
-      moduleCount += 1;
-      const v = filenameViolation('module', f, { moduleKey: key });
-      if (v) violations.push(`modules/${key}/migrations/${f}: ${v}`);
-      files.push({ source: 'module', moduleKey: key, basename: f });
-    }
-  }
-
-  for (const c of stemCollisions(files)) {
-    violations.push(`migration stem "${c.stem}" is produced by more than one source (${c.files.join(', ')}) — schema_migrations is stem-keyed, so one applies and the rest are SILENTLY SKIPPED; namespace them (ADR 0108 §5).`);
-  }
-
-  // Two DIFFERENT stems at one number inside ONE series (task 1003646). Not the
-  // silent-skip above — all of them apply — but migrate.sh orders by basename, so
-  // their relative order is the alphabetical accident of the slug, and a from-scratch
-  // replay can order them differently from the merge order prod applied. Renumbering an
-  // APPLIED migration re-runs it, so the fix for a new one is to renumber BEFORE it
-  // lands; the single pre-existing case is grandfathered in migration-namespace.js.
-  for (const c of numberCollisions(files)) {
-    violations.push(`migration number ${String(c.number).padStart(3, '0')} is used by ${c.files.length} different migrations in one series (${c.series}): ${c.files.join(', ')} — each was allocated max+1 from its own branch point. migrate.sh applies in BASENAME order, so their order is decided by the slug alphabetically and a fresh replay can differ from the order prod applied. Renumber the one that has NOT landed yet (renaming an applied migration re-runs it) (task 1003646).`);
-  }
-
-  return {
-    name: 'migration filenames namespaced + no stem/number collision (ADR 0108 §5)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${coreFiles.length} core + ${instFiles.length} instance + ${moduleCount} module migration file(s): new core→core_, new module→<key>_, instance bare; no cross-root stem collision, and no two migrations share a number within one series.`,
-  };
-}
-
-// ============================================================================
-// Check — hall sections are registry-owned, not hardcoded (BV1.R75 / ADR 0062 §4)
-// ============================================================================
-// The builders'-hall widgets are now a REGISTRY (modules/hall-ui/public/dom-utils.js
-// contributeHallWidget; the core set in modules/hall-ui/public/hall-widgets.js, modules
-// via their own client script). The hall's <main> is filled by builders.js from that
-// registry. So no widget may be hardcoded as a literal <section class="scroll"> inside
-// <main> in index.html — that was the pre-R75 second copy this carve removed. This
-// gate fails if one creeps back, keeping the registry the single source of truth (so a
-// reskin/module-toggle reaches every widget). Self-contained: a pure scan of
-// index.html's <main>, no module/registry state needed. Exported for the unit test.
-// (The hall surface itself carved to modules/hall-ui/public/ in BV1.R85.)
-//
-// task 2177 — the check also asserts the HOME ZONE BUDGETS. builders.js caps how
-// many widgets each Home zone mounts (ZONE_BUDGETS); past the cap a widget still
-// mounts, but into a hidden overflow behind a "More" link. That graceful degrade
-// is the runtime safety net — it is NOT a licence to keep adding cards, and
-// because nothing goes red, a Home that has quietly outgrown its budget looks
-// fine. So CI counts the registrations statically and fails on a breach: the
-// budget becomes a decision someone has to make deliberately (raise the number
-// in builders.js, with a reason) instead of one that erodes.
-//
-// NOT statically checkable, by design: the `home-banner` rule is "at most ONE
-// VISIBLE", not "at most one registered" — both banner widgets (welcome,
-// getting-started) are hiddenByDefault and reveal themselves from onboarding
-// state, so only runtime knows the count. It is documented as a runtime
-// invariant in modules/hall-ui/CLAUDE.md rather than faked with a static count
-// that would either fail today or assert nothing.
-const HALL_INDEX = path.join(moduleDir('hall-ui'), 'public', 'index.html'); // hall-ui is a module — resolve its root (ADR 0108)
-const HALL_PUBLIC = path.join(moduleDir('hall-ui'), 'public');
-// task 1003206 split the hall page script: builders.js keeps state/loading/wiring
-// and hall-render.js holds the view painters — ZONE_BUDGETS travelled with the
-// widget mounting. Read whichever of the pair actually declares it, so this
-// check follows the code instead of a filename (it went vacuous on the move).
-const HALL_BUILDERS_JS = path.join(HALL_PUBLIC, 'builders.js');
-const HALL_RENDER_JS = path.join(HALL_PUBLIC, 'hall-render.js');
-function hallWidgetSource() {
-  const parts = [];
-  for (const f of [HALL_BUILDERS_JS, HALL_RENDER_JS]) {
-    try { parts.push(fs.readFileSync(f, 'utf8')); } catch { /* absent → skip */ }
-  }
-  return parts.join('\n');
-}
-
-// Parse builders.js's ZONE_BUDGETS object literal — the single source of truth
-// for the caps (this check must never carry its own copy of the numbers).
-function parseZoneBudgets(js) {
-  const block = js.match(/const\s+ZONE_BUDGETS\s*=\s*\{([^}]*)\}/);
-  if (!block) return null;
-  const budgets = {};
-  for (const [, zone, n] of block[1].matchAll(/['"]([\w-]+)['"]\s*:\s*(\d+)/g)) {
-    budgets[zone] = Number(n);
-  }
-  return Object.keys(budgets).length ? budgets : null;
-}
-
-// Count registrations per Home zone across every hall client script that calls
-// contributeHallWidget. The zones are static string literals in the registration
-// object, so a literal scan is exact for the code we have (and a computed zone
-// would be a placement smell in its own right — dom-utils' runtime validation
-// still rejects an unknown one). Requiring the contributeHallWidget mention is
-// what keeps an unrelated `zone:` key in some other object from eating budget.
-function scanHallZoneCounts(dir = HALL_PUBLIC, fsImpl = fs) {
-  const counts = {};
-  let files = [];
-  try { files = fsImpl.readdirSync(dir).filter((f) => f.endsWith('.js')); } catch { return counts; }
-  for (const file of files) {
-    let src = '';
-    try { src = fsImpl.readFileSync(path.join(dir, file), 'utf8'); } catch { continue; }
-    if (!src.includes('contributeHallWidget')) continue;
-    for (const [, zone] of src.matchAll(/\bzone:\s*['"]([\w-]+)['"]/g)) {
-      counts[zone] = (counts[zone] || 0) + 1;
-    }
-  }
-  return counts;
-}
-
-function checkHallZoneBudgets(fsImpl = fs) {
-  let js = '';
-  try {
-    js = [HALL_BUILDERS_JS, HALL_RENDER_JS]
-      .map((f) => { try { return fsImpl.readFileSync(f, 'utf8'); } catch { return ''; } })
-      .join('\n');
-  } catch { return []; }
-  const budgets = parseZoneBudgets(js);
-  if (!budgets) {
-    return ['modules/hall-ui/public/{builders,hall-render}.js no longer declares a parseable ZONE_BUDGETS literal — the Home zone budgets are unenforced (task 2177).'];
-  }
-  const counts = scanHallZoneCounts(HALL_PUBLIC, fsImpl);
-  const violations = [];
-  for (const [zone, budget] of Object.entries(budgets)) {
-    const n = counts[zone] || 0;
-    if (n > budget) {
-      violations.push(
-        `Home zone "${zone}" has ${n} registered hall widgets but its budget is ${budget} — the extras mount into the hidden overflow, so Home silently grew. Move it to its own page (see modules/hall-ui/CLAUDE.md §Placement), or raise ZONE_BUDGETS['${zone}'] in modules/hall-ui/public/builders.js deliberately (task 2177).`);
-    }
-  }
-  return violations;
-}
-
-function hallMainSlice(html) {
-  // Strip HTML comments first so a comment that merely MENTIONS <main> or a
-  // <section class="scroll"> (e.g. the carve's own explanatory note) never trips
-  // the scan — only real, rendered markup counts.
-  const stripped = html.replace(/<!--[\s\S]*?-->/g, '');
-  const open = stripped.indexOf('<main');
-  if (open === -1) return '';
-  const start = stripped.indexOf('>', open);
-  const close = stripped.indexOf('</main>', start === -1 ? open : start);
-  if (start === -1 || close === -1) return '';
-  return stripped.slice(start + 1, close);
-}
-
-function scanHallSectionRegistry(html) {
-  const main = hallMainSlice(html);
-  // A hall widget section carries class="scroll" (possibly with modifiers, e.g.
-  // "scroll scroll--welcome"). Catch any <section ... class="...scroll..."> in <main>.
-  const re = /<section\b[^>]*\bclass\s*=\s*"(?:[^"]*\b)?scroll\b[^"]*"/gi;
-  const hits = main.match(re) || [];
-  return hits.map((h) => h.replace(/\s+/g, ' ').trim());
-}
-
-function checkHallSectionRegistry() {
-  let html = '';
-  try { html = fs.readFileSync(HALL_INDEX, 'utf8'); }
-  catch { return { name: 'hall widgets are registry-owned (ADR 0062 §4)', ok: true, hardFail: false, violations: [], warnings: ['modules/hall-ui/public/index.html not found — skipped'], note: 'index.html absent.' }; }
-  const hardcoded = scanHallSectionRegistry(html);
-  const violations = hardcoded.map((s) =>
-    `modules/hall-ui/public/index.html <main> hardcodes a hall section "${s}" — register it via window.OTB.contributeHallWidget (modules/hall-ui/public/hall-widgets.js for core, a module's client script otherwise), don't inline the markup (BV1.R75 / ADR 0062 §4).`);
-  violations.push(...checkHallZoneBudgets());
-  return {
-    name: 'hall widgets are registry-owned + within zone budget (ADR 0062 §4, task 2177)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: 'modules/hall-ui/public/index.html <main> contains no hardcoded <section class="scroll">, and every Home zone is within the ZONE_BUDGETS cap builders.js declares — the registry is the single source of truth and Home cannot grow unnoticed.',
-  };
-}
-
-
-// ============================================================================
-// Check 2c — every SKILL.md frontmatter parses the way Claude Code's YAML reader reads it (task 1003548)
-// ============================================================================
-// Ten of fifty skills shipped with an unquoted description holding ": " or " #": YAML dropped or
-// truncated EVERY field, the skill matched on its body text, and nothing in CI noticed. A parse
-// error is a hard fail; description length and the listing budget are advisory (the listing is
-// resident in every session, ~1% of context, and gets truncated past ~8k chars). The check reads
-// every skill Claude Code can load — the instance's .claude/skills/ AND the module-owned
-// modules/*/skills/ that claude-materialize.js copies into it (task 1003587: scanning only the
-// tracked root meant 14 ui-design skills went unlinted until the untracked copy existed, so four
-// unparseable frontmatters shipped and fitness only went red on a checkout that had materialized).
-// A quiet pass when a checkout carries none (published core).
-function checkSkillFrontmatter() {
-  const violations = [];
-  const warnings = [];
-  let lint;
-  try { lint = require('./skill-lint'); } catch (e) {
-    return { name: 'skill frontmatter parses (task 1003548)', ok: true, hardFail: false, violations, warnings: [`skill-lint unavailable: ${e.message}`], note: 'linter missing — check skipped.' };
-  }
-  const files = lint.listSkillFiles(INSTANCE_ROOT);
-  // Lint every file; count the listing over the skills RESIDENT here (task 1004470).
-  const report = lint.lintSkills(files, { resident: lint.residentSkillFiles(INSTANCE_ROOT, { files }) });
-  const rel = (f) => path.relative(INSTANCE_ROOT, f).replace(/\\/g, '/');
-  const long = [];
-  for (const r of report.results) {
-    for (const e of r.errors) violations.push(`${rel(r.file)}: ${e}`);
-    if (r.description.length > lint.DESC_WARN_CHARS) long.push({ file: rel(r.file), n: r.description.length });
-  }
-  if (long.length) {
-    long.sort((a, b) => b.n - a.n);
-    // The skill's own name is its PARENT dir — a fixed path index would read "skills"
-    // for a module-owned path (modules/<key>/skills/<name>/SKILL.md).
-    const skillName = (f) => f.split('/').slice(-2, -1)[0] || f;
-    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${skillName(l.file)} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/gds/skill-lint.js.`);
-  }
-  if (report.overBudget) warnings.push(`the skill listing is ${report.listingChars} chars (~${estTokens(report.listingChars)} tokens) against a ~${report.budgetChars}-char budget — Claude Code truncates entries past it and routing degrades.`);
-  return {
-    name: 'skill frontmatter parses (task 1003548)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings,
-    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ + modules/*/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
-  };
-}
-
-// ============================================================================
-// Check 35 — no raw NUL byte in tracked publishable text (task 1002854)
-// ============================================================================
-//
-// scripts/public-mirror-export.js decides binary-vs-text by sniffing for a NUL byte in
-// the first 8 KiB (`isBinary`, ~line 86), and `redactBlob` skips `redactText` entirely
-// for anything it classifies binary. So a TEXT source containing a raw NUL is published
-// to the public AGPL mirror WITHOUT REDACTION.
-//
-// WHAT THIS IS AND IS NOT. The binary branch is not unguarded: it still leak-scans the
-// blob's latin1 view, so an embedded instance literal trips the gate. But the gate uses
-// `sensitiveLiterals` — raw substrings — while `redactText` applies the full `rules` set.
-// The exposure is therefore the DELTA between them: anything redaction would have
-// rewritten but the literal gate does not recognise ships verbatim. That is a latent
-// unredacted-publish, not a live one, which is why this is a lint rather than a fix.
-//
-// THE CLASS RECURS, WHICH IS THE ARGUMENT FOR A LINT RATHER THAN ANOTHER FIX.
-// Task 1703 found and fixed three instances, all the same mistake: a raw NUL used as a
-// join delimiter instead of the `\u0000` escape. Task 1002507 fixed a fourth in session
-// digests. Open idea 1000523 covers a fifth (search-ingest rollback). This check found
-// four more — modules/copy-desk/proposals.js, scripts/gds/claim.js,
-// scripts/gds/probe-cache.js and tests/copy_inventory.mjs — fixed in the same commit so
-// the check lands green. Nothing prevented any of them; nothing would prevent the next.
-//
-// The fix is always the same and never changes behaviour: `\u0000` compiles to exactly
-// the same string, so hashes, joins and regex ranges are byte-identical at runtime. Only
-// the SOURCE stops carrying the byte.
-//
-// SCOPE. Tracked files only (git ls-files — an untracked scratch file is not published),
-// with publishable text extensions. Binary formats are out of scope by definition: a PNG
-// is *supposed* to contain NULs and the mirror is right to pass it through.
-const NUL_TEXT_EXTS = ['.js', '.mjs', '.cjs', '.mts', '.md', '.sql', '.json'];
-
-// Exemptions must be justified, not just listed. There are none today, and that is the
-// preferred state: the fix is a one-character escape with no behavioural cost, so
-// "exempt it" should always lose to "escape it". Kept as a named, empty constant so a
-// future addition is a visible, reviewable edit rather than a quiet change to a regex.
-const NUL_EXEMPT_PATHS = [];
-
-function scanForRawNul(root, { listFiles, readFile } = {}) {
-  const list = listFiles || (() => execFileSync('git', ['ls-files', '-z'], {
-    cwd: root, encoding: 'latin1', maxBuffer: 1 << 26,
-  }).split('\u0000').filter(Boolean));
-  const read = readFile || ((f) => fs.readFileSync(path.join(root, f)));
-
-  const hits = [];
-  for (const f of list()) {
-    if (!NUL_TEXT_EXTS.includes(path.extname(f))) continue;
-    if (NUL_EXEMPT_PATHS.some((e) => f === e || f.startsWith(e))) continue;
-    let buf;
-    try { buf = read(f); } catch (_) { continue; }   // deleted-but-tracked, or unreadable
-    const at = buf.indexOf(0);
-    if (at === -1) continue;
-    // Report the LINE, not the byte offset — a byte offset is not actionable.
-    const line = buf.slice(0, at).toString('latin1').split('\n').length;
-    hits.push(`${f}:${line} — raw NUL byte; use the \\u0000 escape (same string at runtime, no NUL in source)`);
-  }
-  return hits;
-}
-
-function checkNoRawNulInText() {
-  let violations = [];
-  let note = '';
-  try {
-    violations = scanForRawNul(REPO_ROOT);
-    note = `tracked ${NUL_TEXT_EXTS.join('/')} sources carry no raw NUL byte, so none can be misclassified `
-      + 'as binary and skip public-mirror redaction (task 1002854).';
-  } catch (e) {
-    // Never let the scan itself fail the build — a git failure is not a boundary breach.
-    return {
-      name: 'no raw NUL byte in tracked publishable text (task 1002854)',
-      ok: true, hardFail: false, violations: [], warnings: [`skipped: ${e.message}`],
-      note: 'could not list tracked files — check skipped.',
-    };
-  }
-  return {
-    name: 'no raw NUL byte in tracked publishable text (task 1002854)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note,
-  };
-}
-
-const CHECKS = [
-  checkCoreHostBoundary,
-  checkNoRawNulInText, // Check 35 — task 1002854: a raw NUL makes the mirror skip redaction
-  checkClaudeMdBudget,
-  // Check 32 — task 1002990 / criterion wa6-kernel-and-packs: the root CLAUDE.md is
-  // now a role-neutral KERNEL and each craft's playbook lives in a pack under
-  // docs/packs/. claim.js resolves the pack through the role registry and fails
-  // OPEN, so a pack path that points at nothing is invisible at runtime — CI is the
-  // only place a hollowed-out role can be caught. Rationale in that file.
-  require('./role-pack-guard.js').checkRolePacks,
-  checkSkillFrontmatter,
-  checkNestedDocsPresent,
-  checkRankGuards,
-  checkModulePinKeysResolve,
-  checkGeneratedArtifactsFresh,
-  checkDeterministicRoutines,
-  checkCoreNeverImportsModule,
-  checkModulesImportOnlyApi,
-  checkScopeMapImportsProtected,
-  // Check 36 — task 1002900: a carved module with no roster key walls nothing. Extracted
-  // to its own file (the role-pack-guard.js precedent) to keep fitness.js under the size ratchet.
-  () => require('./scope-roster-guard.js').checkScopeRosterCoversModules({ repoRoot: REPO_ROOT, discoveredModuleKeys }),
-  checkCoreCarriesNoModuleCode,
-  checkKernelImportsNoDomain,
-  checkModuleMigrationsAdditive,
-  checkMigrationNamespacing, // Check 11b — ADR 0108 §5 cross-repo migration filenames + stem collision
-  checkDesignContract,
-  checkKernelPromptsNoHardcodedIdentity, // BV1.R76 — kernel prompts read identity from branding()
-  checkNeutralConfigsNoHostIdentity, // Check 15b — BV1.R102: .json is outside the scan above
-  checkHallSectionRegistry,
-  checkCoreRequiresExcludedConfig, // task 1824 — core→instance-config require guard
-  checkCoreRequiresExcludedModule, // Check 16b — task 2135: core→excluded-module require guard (R89 split)
-  checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
-  checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
-  checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
-  checkGovernmentRenameIdentity, checkPrelaunchVocabulary, // 19c task 1003120 (`X`→`X` rename arrow) + 19d task 1003152 ("stealth" is the product's word) — sharing a line: this file is AT the 1,500 budget (Check 23/24 precedent below; task 1003825 buys it back)
-  checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
-  require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
-  require('./doc-control-claims.js').checkDocControlClaims, // Check 37 — task 1003418 / audit A14: a doc cannot describe an enforcement control that does not exist (derived from the docs, not a hand list)
-  require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
-  require('./skill-preflight.js').checkOpsSkillsDeclareMachine, // Check 23 — task 1003167 / G03: an ops skill declares the machine it needs
-  // Check 24 — task 1003166 / G02: no ops script hardcodes a version id. It landed
-  // sharing Check 23's line, deliberately, because fitness.js was ~500 lines over
-  // the excess-lines ratchet and a new check could not afford one (idea 1000810).
-  // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
-  // and the check gets its own line back.
-  require('./version-literal-guard.js').checkNoVersionLiterals,
-  require('./dev-box-guard.js').checkNoDevBox, // task 1003899 / ADR 0346: the retired dev box stays out (its exemption list lives in that file)
-  require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
-  require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
-  require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why
-  require('./client-baseurl-guard.js').checkClientBaseUrl,
-  require('./route-shadow-guard.js').checkNoRouteShadowing, // Check 31 — task 1003747: a `:param` route must not swallow a literal route mounted after it (cross-module mount order; the rot feed shipped dead this way). Rationale in that file.
-  require('./test-path-guard.js').checkTestsUseFileUrlToPath, // Check 30 — task 1002889: a test builds its repo root with fileURLToPath, never URL.pathname (a %20 or a Windows drive slash makes require() throw at load; CI's spaceless checkout can't see it)
-  // Check 29 — task 1003275 / ADR 0189: a work category ORIENTS a human and steers
-  // Claude; it authorises nothing. The owner said so twice, and the goal's own prose
-  // predicts the failure: a second thing that looks like a hierarchy gets mistaken
-  // for one within a release. A comment cannot refuse the line that does it.
-  require('./category-advisory-guard.js').checkCategoryIsAdvisory, // Check 27 — task 1003263: a page must not combine baseUrl:'' with a generated namespaced call (that pairing 404s every request; three pages shipped it, two of them dead in prod)
-  // Check 28 — task 1001654 / ADR 0095: does each source file open with a module
-  // header saying what it does and why. ADVISORY ONLY (never hardFail) — a
-  // doc-comment gate that blocks a ship buys filler prose, not understanding.
-  // Making it blocking is an owner decision and needs its own ADR.
-  require('./doc-comment-coverage.js').checkDocCommentCoverage,
-  // Check 31 — task 1003164: two ADRs may not share a number, and docs/adr/README.md
-  // must agree with the tree. The ADR half of the guard Check 11b already gives
-  // migrations: same shared, monotonic, human-allocated number line, and until this
-  // landed only one of the two was enforced. An ADR number is a citation target, so a
-  // duplicate is wrong forever (ADR 0195).
-  // Check 33 — task 1003819: a module declares what it contributes, and nothing
-  // checked that a declared seam is actually WIRED. verifyPortsSatisfied asks the
-  // opposite question (every `consumes` has a provider) and validateManifest checks
-  // only the SHAPE, so a contributes entry whose artifact was never shipped — or was
-  // renamed out from under the manifest — boots silent: every consumer skips it the
-  // same way it correctly skips a real declarative-only entry. CI, not boot: nothing
-  // crashes later, so a start-up refusal would trade an outage risk for a cosmetic
-  // one (ADR 0289). Rationale + the seam→consumer table live in that file.
-  require('./seam-wiring-guard.js').checkSeamWiring,
-  require('./home-isolation-guard.js').checkHomeIsolation, // Check 34 — task 1003763: a test that sets HOME for a child without USERPROFILE isolates NOTHING on win32, so it silently stops testing what its comment says. Three tasks fixed this one site at a time. Rationale in that file.
-  ...['checkDevsecopsOwnsItsChecks', 'checkEveryModuleDirIsScoped', 'checkNoNewUnownedRoot'].map((k) => require('./scope-map-guard.js')[k]), // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Check 36 — task 1004132: the same defect one level up, a carved module whose own directory no key claims (modules/specialities/ shipped that way). Sharing the line per the ratchet convention above. Rationale in that file.
-  require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
-];
-
-function runAll() {
-  return runChecks(CHECKS); // task 1004737: an installed core has no core source to measure — one skipped result, not a crash
-}
-
-function main() {
-  const results = runAll();
-  if (process.argv.includes('--json')) {
-    process.stdout.write(JSON.stringify(results, null, 2) + '\n');
-  } else {
-    console.log('Architecture fitness functions (Path C / ADR 0062 §9)\n');
-    for (const r of results) {
-      const mark = r.hardFail ? '✗ FAIL' : (r.warnings.length ? '! WARN' : '✓ PASS');
-      console.log(`${mark}  ${r.name}`);
-      console.log(`        ${r.note}`);
-      for (const v of r.violations) console.log(`        ✗ ${v}`);
-      for (const w of r.warnings) console.log(`        ! ${w}`);
-    }
-    const failed = results.filter((r) => r.hardFail).length;
-    console.log(`\n${failed ? `${failed} check(s) FAILED` : 'all checks passed'}.`);
-  }
-  process.exit(results.some((r) => r.hardFail) ? 1 : 0);
-}
-
-if (require.main === module) main();
-
-module.exports = {
-  scanForRawNul,
-  checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
-  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, checkPrelaunchVocabulary, PRELAUNCH_SURFACE, // 19c task 1003120, 19d task 1003152
-  runAll,
-  resolvesToHostGame,
-  checkCoreHostBoundary,
-  checkClaudeMdBudget,
-  checkNestedDocsPresent,
-  checkRankGuards,
-  checkModulePinKeysResolve,
-  checkGeneratedArtifactsFresh,
-  checkDeterministicRoutines,
-  checkCoreNeverImportsModule,
-  checkModulesImportOnlyApi,
-  checkScopeMapImportsProtected,
-  checkCoreCarriesNoModuleCode,
-  checkKernelImportsNoDomain,
-  checkModuleMigrationsAdditive,
-  checkMigrationNamespacing, // Check 11b — ADR 0108 §5 cross-repo migration filenames
-  checkAdrNumbering: require('./adr-namespace.js').checkAdrNumbering, // Check 31 — task 1003164 / ADR 0195: ADR numbers unique + index agrees with the tree
-  checkDesignContract,
-  checkKernelPromptsNoHardcodedIdentity, // BV1.R76 / task 1705
-  scanPromptIdentity,                    // BV1.R76 — negative-test hook
-  stripCommentsForIdentity,              // task 1705 — comment-strip helper (tested)
-  checkNeutralConfigsNoHostIdentity,     // Check 15b — BV1.R102 (tested)
-  checkHallSectionRegistry,
-  scanHallSectionRegistry,
-  hallMainSlice,
-  parseZoneBudgets,      // task 2177 — hall Home zone budgets (tested)
-  scanHallZoneCounts,
-  checkHallZoneBudgets,
-  checkErrorEnvelope,       // Check 17 — BV1 R03 / task 1990 (ADR 0116)
-  scanFlatErrorSites,       // shared with the R04 sweep + its test
-  countFlatErrors,          // per-text detector (tested)
-  FLAT_ERROR_BASELINE,
-  checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999 (ADR 0118)
-  scanUnvalidatedWriteRoutes, // shared with its test
-  WRITE_VALIDATION_EXEMPT,
-  scanScopeMapSource,
-  scanKernelForModuleKeys,
-  kernelDomainImport,
-  KERNEL_FILES,
-  discoveredModuleKeys,
-  manifestModuleKeys, manifestlessModuleDirs, // task 1002790 — narrow defn + the difference
-  moduleMigrationViolations,
-  moduleNamespace,
-  resolvesToModule,
-  moduleImportViolation,
-  moduleOwnerOf,
-  // test/ratchet hook: toggle the module boundary enforce flag. Default is now
-  // ENFORCING (BV1.R45 / task 1414); tests that need warn-mode restore the
-  // default in a finally.
-  _setModuleBoundaryEnforcing: (v) => { MODULE_BOUNDARY_ENFORCING = !!v; },
-  scanDeterministicBody,
-  HOST_GAME,
-  GRANDFATHERED,
-  LEGACY_NAMESPACED,
-  ROOT_HARD_MAX,
-  ROOT_TARGET,
-  ROOT_CHAR_HARD_MAX,
-  ROOT_CHAR_TARGET,
-  HIGH_TRAFFIC,
-};
+require('../bongos/forwarder.js').forward(module, 'fitness.js');