@bongos/core 1.21.175 → 1.21.177

package/tests/core_upgrade_runner.mjs

@@ -31,15 +31,15 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 // An ESM named import, not R.parseSchemaPending: knip credits a CJS export only when a test imports it this way.
-import { parseSchemaPending, repoNote, REPO_NOTES, instanceChannel } from '../scripts/gds/provision-core-upgrade.js';
+import { parseSchemaPending, repoNote, REPO_NOTES, instanceChannel } from '../scripts/bongos/provision-core-upgrade.js';
 import { parseRepoNote } from '../modules/provisioning/core-upgrade.js';
 
 const require = createRequire(import.meta.url);
-const R = require('../scripts/gds/provision-core-upgrade.js');
-const U = require('../scripts/gds/upgrade.js');
+const R = require('../scripts/bongos/provision-core-upgrade.js');
+const U = require('../scripts/bongos/upgrade.js');
 const P = require('../modules/provisioning/provisioning.js');
 const G = require('../modules/provisioning/control-plane-guard.js');
-const RP = require('../scripts/gds/provision-repo.js');
+const RP = require('../scripts/bongos/provision-repo.js');
 
 // task 1002719: the app user is derived, so pin one that is nobody's real account.
 process.env.PROVISION_APP_USER = 'appsvc';
@@ -236,20 +236,20 @@ await t('a target the box ALREADY SERVES is not a channel refusal — the move i
   // 2026-10-01 16:32: the sweep and the door both went for 1.20.73; the sweep got there
   // first, and the door's press was refused as "outside this project's 'minor' update
   // channel … across a major version or onto a prerelease" — false on every count.
-  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
-  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  const channelAllows = require('../scripts/bongos/update-channel.js').channelAllows;
+  const compare = require('../scripts/bongos/update-channel.js').compareSemver;
   assert.equal(R.targetFault('1.20.73', ['1.20.72', '1.20.73'], '1.20.73', 'minor', channelAllows, compare), null,
     'no fault: the runner\'s own already-serving check answers it as a no-op');
 });
 
 await t('a target BELOW what the box serves says so, and is never called outside the update rule (task 1004534)', () => {
-  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
-  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  const channelAllows = require('../scripts/bongos/update-channel.js').channelAllows;
+  const compare = require('../scripts/bongos/update-channel.js').compareSemver;
   const f = R.targetFault('1.20.73', ['1.20.73', '1.21.5'], '1.21.5', 'minor', channelAllows, compare);
   assert.ok(f, 'still refused — a move never goes backwards on its own');
   assert.doesNotMatch(f, /update channel|major version|prerelease/, 'none of the channel sentence is true here');
   assert.match(f, /already runs core 1\.21\.5/);
-  assert.equal(require('../scripts/gds/upgrade-outcome.js').runnerReason(f), 'downgrade');
+  assert.equal(require('../scripts/bongos/upgrade-outcome.js').runnerReason(f), 'downgrade');
 });
 
 await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
@@ -295,7 +295,7 @@ await t('drives upgrade.js with the registry, the health gate, the version read-
 
 await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that broke every standalone tenant (task 1004053)', async () => {
   // The whole failure was a path that resolved nowhere:
-  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
+  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/bongos/upgrade.js'
   // No assertion about FLAGS could have caught it, so this one resolves the composed
   // cwd + relative CLI against the real filesystem, for every shape the door admits.
   for (const shape of ['control-plane', 'cloud-host', 'co-tenant']) {
@@ -303,7 +303,7 @@ await t('the upgrade CLI is run somewhere it ACTUALLY EXISTS — the bug that br
     await R.coreUpgradeInstance(inst({ hosting_shape: shape, slug: 'hermeslines-marketing', port: 3011 }), d, intent());
     const call = d.ranWith.find((c) => /upgrade\.js/.test(c.cmd));
     assert.ok(call, `${shape}: it ran the upgrade CLI`);
-    const rel = (call.cmd.match(/node (\S*scripts\/gds\/upgrade\.js)/) || [])[1];
+    const rel = (call.cmd.match(/node (\S*scripts\/(?:gds|bongos)\/upgrade\.js)/) || [])[1];
     assert.ok(rel, `${shape}: the command names the CLI`);
     assert.ok(fs.existsSync(path.join(call.cwd, rel)),
       `${shape}: ${path.join(call.cwd, rel)} must exist — this is the assertion the original bug would have failed`);
@@ -547,7 +547,7 @@ await t('an UNPRIVILEGED runner still adds no sudo and no env at all', async ()
   await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.doesNotMatch(cmd, /sudo/, 'no escalation when the runner is not privileged');
-  assert.match(cmd, /^node \S*scripts\/gds\/upgrade\.js /, 'it still invokes the CLI directly');
+  assert.match(cmd, /^node \S*scripts\/(?:gds|bongos)\/upgrade\.js /, 'it still invokes the CLI directly');
 });
 
 console.log('\nthe dry run behind "see what would change" (task 1004121):');
@@ -685,7 +685,7 @@ await t('the CLI runs where it lives and NAMES the instance it is aimed at', asy
 });
 
 await t('the legacy shape still omits --instance, because there is nothing to disambiguate', async () => {
-  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => require('../scripts/gds/provision-config.js').REPO_ROOT };
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => require('../scripts/bongos/provision-config.js').REPO_ROOT };
   await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
   assert.doesNotMatch(upgradeCall(d), /--instance /, 'a checkout run in place is its own instance');
 });
@@ -1442,7 +1442,7 @@ await t('every note the runner writes is one the web tier reads back, code and s
 await t('the DRAIN LOOP resolves a done-with-a-note move WITH its note, still as done', async () => {
   // Driven through the real dispatch: the note is only worth anything if it reaches the
   // intent row the deploy page reads.
-  const P2 = require('../scripts/gds/provision.js');
+  const P2 = require('../scripts/bongos/provision.js');
   let claims = 0; const resolved = []; const statusWrites = [];
   const d = pinDeps({ token: null, originResult: refusedBy('ERROR: The key you are authenticating with has been marked as read only.') });
   d.provisioning = {
@@ -1465,7 +1465,7 @@ console.log('\nthe project\'s own update rule (task 1004445):');
 
 // The REAL policy module, not the stub makeDeps hands every other case: these cases are
 // about which rule the runner applies, so a stub that admits everything would prove nothing.
-const realChannel = require('../scripts/gds/update-channel.js');
+const realChannel = require('../scripts/bongos/update-channel.js');
 const withRealChannel = (over) => {
   const d = makeDeps(over);
   // readReleaseTags is stubbed too: the real one shells out to npm. `released` defaults to the newest
@@ -1557,8 +1557,8 @@ await t('a failed migrate reaches the stored failure with its migration and psql
   const run = () => ({ status: 3, stdout: 'apply  core_998_ok\napply  core_999_x\n',
     stderr: 'psql:migrations/core_999_x.sql:7: ERROR:  check constraint "tasks_kind_check" of relation "tasks" is violated by some row\n' });
   const mig = await U.runMigrate(fs.mkdtempSync(path.join(require('node:os').tmpdir(), 'mig-')), run);
-  const res = { ok: false, error: require('../scripts/gds/upgrade-migrate.js').migrateError(mig), rolledBack: true, rollback: {} };
-  const stderr = `\n✖ ${res.error}\n${require('../scripts/gds/upgrade-outcome.js').outcomeLine(res)}`;
+  const res = { ok: false, error: require('../scripts/bongos/upgrade-migrate.js').migrateError(mig), rolledBack: true, rollback: {} };
+  const stderr = `\n✖ ${res.error}\n${require('../scripts/bongos/upgrade-outcome.js').outcomeLine(res)}`;
   const r = await R.coreUpgradeInstance(inst(), upgradeThrows(stderr)(makeDeps()), intent());
   assert.deepEqual(r.failure, { class: 'unknown', reason: 'migrate_check_violation' });
   assert.match(r.error, /failed and was rolled back/);
@@ -1593,12 +1593,12 @@ await t('the runner\'s own refusals are classified too', async () => {
 });
 
 await t('upgrade.js ends a failed run with the outcome line', () => {
-  const src = fs.readFileSync(new URL('../scripts/gds/upgrade.js', import.meta.url), 'utf8');
+  const src = fs.readFileSync(new URL('../scripts/bongos/upgrade.js', import.meta.url), 'utf8');
   assert.match(src, /if \(!res\.ok\) \{ process\.stderr\.write\([^\n]*outcomeLine\(res\)/);
 });
 
 await t('the drain loop writes the class beside the sentence (behaviour: tests/provision.mjs)', () => {
-  const src = fs.readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  const src = fs.readFileSync(new URL('../scripts/bongos/provision.js', import.meta.url), 'utf8');
   assert.match(src, /SET failure_class = \$2, failure_reason = \$3/);
 });
 

package/tests/credential_presence.mjs

@@ -19,8 +19,8 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'credential-presence.js');
-const { CREDENTIALS, parseEnvFile, sweep, format, readFiles } = require('../scripts/gds/credential-presence.js');
+const SCRIPT = path.join(ROOT, 'scripts', 'bongos', 'credential-presence.js');
+const { CREDENTIALS, parseEnvFile, sweep, format, readFiles } = require('../scripts/bongos/credential-presence.js');
 const { envPrefix } = require('../src/instance-config.js');
 const P = envPrefix();
 

package/tests/credit_grant.mjs

@@ -607,9 +607,9 @@ await test('cost-plus-only cascade: a 0 per-task credit → idea-promotion slice
 const fs = require('node:fs');
 const os = require('node:os');
 const nodePath = require('node:path');
-const { priceTranscript, priceSubagents, buildCostRows } = require('../scripts/gds/session-cost.js');
-const { buildSessionDigest } = require('../scripts/gds/session-digest-build.js');
-const { foldSubagentUsage } = require('../scripts/gds/ship-session-upload.js');
+const { priceTranscript, priceSubagents, buildCostRows } = require('../scripts/bongos/session-cost.js');
+const { buildSessionDigest } = require('../scripts/bongos/session-digest-build.js');
+const { foldSubagentUsage } = require('../scripts/bongos/ship-session-upload.js');
 const { priceModelUsage } = require('../src/bongos/llm-pricing.js');
 
 const PARALLEL_SID = 'sess-parallel';

package/tests/credit_log_single_writer.mjs

@@ -2,7 +2,7 @@
 //
 // Task 1003641 — the balance is moved by the TRIGGER, and by nothing else.
 //
-// THE BUG. scripts/gds/backfill-task-rewards.js applyPlan() did both: INSERT INTO
+// THE BUG. scripts/bongos/backfill-task-rewards.js applyPlan() did both: INSERT INTO
 // credit_log (which fires trg_credit_log_apply AFTER INSERT) *and* a separate
 // `UPDATE builders SET total_credits = total_credits + $1`. The trigger had already
 // applied that delta, so every credit the script minted landed twice. A real
@@ -38,8 +38,8 @@ const code = (src) => src
 
 // Every file in the repo that inserts a credit_log row.
 const WRITERS = [
-  ['scripts', 'gds', 'backfill-task-rewards.js'],
-  ['scripts', 'gds', 'backfill-subagent-rewards.js'],
+  ['scripts', 'bongos', 'backfill-task-rewards.js'],
+  ['scripts', 'bongos', 'backfill-subagent-rewards.js'],
   ['modules', 'economy', 'achievements.js'],
   ['modules', 'economy', 'credits.js'],
   ['modules', 'lifecycle', 'db-rank-authz.js'],
@@ -75,7 +75,7 @@ test('no credit_log writer ALSO updates builders.total_credits', () => {
 });
 
 test('backfill-task-rewards.js specifically — the regression that cost real credits', () => {
-  const src = read('scripts', 'gds', 'backfill-task-rewards.js');
+  const src = read('scripts', 'bongos', 'backfill-task-rewards.js');
   assert.match(src, /INSERT INTO credit_log/, 'it still mints the audit row');
   assert.doesNotMatch(code(src), /\btotal_credits\s*=/i,
     'and must never assign total_credits — the trigger owns the balance');
@@ -87,7 +87,7 @@ test('backfill-task-rewards.js specifically — the regression that cost real cr
 test('the idempotency key still guards re-runs', () => {
   // Removing the double-write must not disturb the other half of this script's
   // safety: a second run of the same backfill must mint nothing.
-  const src = code(read('scripts', 'gds', 'backfill-task-rewards.js'));
+  const src = code(read('scripts', 'bongos', 'backfill-task-rewards.js'));
   assert.match(src, /SELECT 1 FROM credit_log WHERE task_id = \$1 AND reason = \$2/,
     'the per-task idempotency re-check inside the transaction');
   assert.match(src, /BACKFILL_REASON/, 'keyed on the backfill reason');

package/tests/criterion_ref_status.mjs

@@ -1,7 +1,7 @@
 // tests/criterion_ref_status.mjs
 //
 // The READ side of the criterion-ref vocabulary (task 1004069): what
-// scripts/gds/status.js accepts on input and what it calls a criterion in
+// scripts/bongos/status.js accepts on input and what it calls a criterion in
 // output. The write half is tests/criterion_ref_parse.mjs.
 //
 // WHY THESE CASES. `Cn` is ROW_NUMBER() over a reorderable sort_order, so it is
@@ -19,7 +19,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const status = require('../scripts/gds/status.js');
+const status = require('../scripts/bongos/status.js');
 const refs = require('../modules/lifecycle/criterion-ref.js');
 
 let passed = 0;

package/tests/cross_discipline_priority_direction.mjs

@@ -10,7 +10,7 @@
 // "You might enjoy" section.
 //
 // The function has TWO hand-copied implementations — the canonical one in
-// modules/lifecycle/db-tasks.js and a mirror in scripts/gds/start.js, which is
+// modules/lifecycle/db-tasks.js and a mirror in scripts/bongos/start.js, which is
 // a pure HTTP client and cannot import the server module. This test EXECUTES
 // both against the same fixtures and asserts they agree, so the pair cannot
 // drift apart again.
@@ -29,7 +29,7 @@ const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
 
 const CANONICAL = require(path.join(ROOT, 'modules/lifecycle/db-tasks.js'))
   .rankCrossDisciplineRecommendations;
-const MIRROR = require(path.join(ROOT, 'scripts/gds/start.js'))
+const MIRROR = require(path.join(ROOT, 'scripts/bongos/start.js'))
   .rankCrossDisciplineRecommendations;
 
 // Both copies, run over the same input. Every behavioural assertion below goes
@@ -174,7 +174,7 @@ await test('the DB still says 1 is most urgent (CHECK + the 6 - COALESCE weighti
 
 await test('neither copy claims priority DESC, and the mirror pointer resolves', () => {
   const canonicalSrc = read('modules/lifecycle/db-tasks.js');
-  const mirrorSrc = read('scripts/gds/start.js');
+  const mirrorSrc = read('scripts/bongos/start.js');
   for (const [name, src] of [['db-tasks.js', canonicalSrc], ['start.js', mirrorSrc]]) {
     assert.ok(!/priority DESC/.test(src), `${name}: no comment may assert priority DESC`);
   }

package/tests/cutover_codemod.mjs

@@ -12,7 +12,7 @@ import { createRequire } from 'node:module';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const cm = require('../scripts/gds/cutover-codemod.js');
+const cm = require('../scripts/bongos/cutover-codemod.js');
 const { rewriteCoreRequires, isHostFile, looksLikeConsumer, planCodemod, CORE_INTERNAL_MAP } = cm;
 
 let passed = 0;
@@ -83,8 +83,6 @@ t('rewrites every mapped entry in the table', () => {
 t('F3: rewrites server.js core internals from ./src/* form', () => {
   assert.equal(rewriteCoreRequires(`const p = require('./src/bongos/api-path-404');`).text,
     `const p = require('@bongos/core/bongos/api-path-404');`);
-  assert.equal(rewriteCoreRequires(`const u = require('./src/bongos/uptime-poller');`).text,
-    `const u = require('@bongos/core/bongos/uptime-poller');`);
   assert.equal(rewriteCoreRequires(`const l = require('./src/module-loader/loader');`).text,
     `const l = require('@bongos/core/module-loader/loader');`);
   assert.equal(rewriteCoreRequires(`const m = require('./src/modules');`).text,
@@ -184,7 +182,7 @@ t('planCodemod rewrites host files, skips core files, reports unmapped', () => {
 // ---- invariant: every mapped target is an actual @bongos/core export ---------
 
 t('every CORE_INTERNAL_MAP target is exported by the core package (a rewrite never outruns an export)', () => {
-  const { buildPackageJson } = require('../scripts/gds/package-core.js');
+  const { buildPackageJson } = require('../scripts/bongos/package-core.js');
   const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   for (const mapped of Object.values(CORE_INTERNAL_MAP)) {
     assert.ok(pkg.exports[`./${mapped}`], `@bongos/core must export ./${mapped} (targeted by the codemod)`);

package/tests/db_backup_nightly.mjs

@@ -21,7 +21,7 @@ import { fileURLToPath } from 'node:url';
 import { macShapedTools } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'db-backup-nightly.sh');
+const SCRIPT = path.join(ROOT, 'scripts', 'bongos', 'db-backup-nightly.sh');
 const skip = process.platform === 'win32' ? 'needs a POSIX bash + coreutils (runs in CI)' : false;
 // The script's env-var prefix, built rather than written so the legacy-literal ratchet
 // does not count a test that has to speak the script's own variable names.

package/tests/db_backup_offsite.mjs

@@ -23,7 +23,7 @@ import { fileURLToPath } from 'node:url';
 import { macShapedTools } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'db-backup-offsite.sh');
+const SCRIPT = path.join(ROOT, 'scripts', 'bongos', 'db-backup-offsite.sh');
 const skip = process.platform === 'win32' ? 'needs a POSIX bash + coreutils (runs in CI)' : false;
 // The script's env-var prefix, built rather than written — the same reason as in
 // tests/db_backup_nightly.mjs: the legacy-literal ratchet counts the spelled-out form.

package/tests/db_ownership_handover.mjs

@@ -5,7 +5,7 @@
 // and only GRANTed to the account. Later core moves migrate AS that account, and GRANT ALL
 // does not carry the right to ALTER TABLE or CREATE OR REPLACE FUNCTION — only ownership
 // does — so toast's first ALTERing move failed "must be owner of table tasks" and rolled
-// back. dbOwnershipSql (scripts/gds/provision-repo.js) hands everything over. It is one long
+// back. dbOwnershipSql (scripts/bongos/provision-repo.js) hands everything over. It is one long
 // DO block of catalog queries, which a string test cannot prove: whether it actually runs,
 // which objects it reaches, and that it leaves extension-owned objects alone are questions
 // only a real engine answers.
@@ -24,7 +24,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
-const { dbOwnershipSql } = require('../scripts/gds/provision-repo.js');
+const { dbOwnershipSql } = require('../scripts/bongos/provision-repo.js');
 
 const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
 let client;

package/tests/dead_deps.mjs

@@ -31,7 +31,7 @@ process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
 const { absorbedInto, depRefusalRow, splitDeadDeps, deadDepHint, findStrandedTasks, DEAD_DEP_STATUSES, LIVE_STATUSES } =
   require('../modules/lifecycle/dead-deps.js');
-const { formatClaimFailure } = require('../scripts/gds/claim.js');
+const { formatClaimFailure } = require('../scripts/bongos/claim.js');
 const { test, summary } = makeRunner();
 
 const dep = (id, status, kind = 'task') => ({ kind, id, title: `t${id}`, status });
@@ -172,10 +172,10 @@ await test('findStrandedTasks: every live status counts, and a healthy dep never
 });
 
 await test('audit-deps exposes the --stranded mode and abandon.js reports what a cut strands', () => {
-  const audit = readFileSync(new URL('../scripts/gds/audit-deps.js', import.meta.url), 'utf8');
+  const audit = readFileSync(new URL('../scripts/bongos/audit-deps.js', import.meta.url), 'utf8');
   assert.match(audit, /--stranded/, 'the mode is documented in the usage header');
   assert.match(audit, /findStrandedTasks/, 'and uses the shared core, not a second copy');
-  const abandon = readFileSync(new URL('../scripts/gds/abandon.js', import.meta.url), 'utf8');
+  const abandon = readFileSync(new URL('../scripts/bongos/abandon.js', import.meta.url), 'utf8');
   assert.match(abandon, /TOP PRIORITY/, 'cutting a depended-on task reports the strand at cut time');
   assert.match(abandon, /LIVE_STATUSES/, 'and shares the live-status definition with the detector');
 });

package/tests/dependency_advisory.mjs

@@ -1,7 +1,7 @@
 // tests/dependency_advisory.mjs — the missing-dependency advisory on POST
 // /tasks (task 1002827, goal 1000089).
 //
-// scripts/gds/audit-deps.js has shipped a working likely-missing-dependency
+// scripts/bongos/audit-deps.js has shipped a working likely-missing-dependency
 // detector since task 1000349 (tests/audit_deps.mjs, tests/missing_dep_classify.mjs)
 // and nothing called it. This wires the SAME detector's pure core
 // (modules/lifecycle/missing-dep-classify.js) live, mirroring goal-advisory.js's

package/tests/deploy_audit_gate.mjs

@@ -23,7 +23,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GATE = path.join(ROOT, 'scripts', 'gds', 'deploy-main-audit-gate.sh');
+const GATE = path.join(ROOT, 'scripts', 'bongos', 'deploy-main-audit-gate.sh');
 
 // A throwaway repo with two commits, checked out at the second — the state a deploy is in
 // when the gate runs: PREV is what was deployed, HEAD is what was just pulled.
@@ -41,7 +41,7 @@ function makeRepo({ auditor = 'exit 0' } = {}) {
   const head = git('rev-parse', 'HEAD').trim();
 
   if (auditor !== null) {
-    const gdsDir = path.join(dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    const gdsDir = path.join(dir, 'node_modules', '@bongos', 'core', 'scripts', 'bongos');
     fs.mkdirSync(gdsDir, { recursive: true });
     fs.writeFileSync(path.join(gdsDir, 'main-audit.js'), `process.${auditor.replace('exit ', 'exit(')});\n`);
   }
@@ -87,7 +87,7 @@ test('the range handed to the auditor is the exact deploy delta, not a window',
   // Pinned because the whole row is named for an audit range that could be slipped under.
   const repo = makeRepo({ auditor: null });
   try {
-    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'bongos');
     fs.mkdirSync(gdsDir, { recursive: true });
     // The range rides --range, not an env var (task 1001441): a shell cannot compute
     // the instance's branded env prefix, and argv needs none.
@@ -139,7 +139,7 @@ test('a missing auditor FAILS CLOSED — it never waves the deploy through', ()
 test('OTB_AUDIT_STRICT=1 is passed through, and is OFF by default', () => {
   const repo = makeRepo({ auditor: null });
   try {
-    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'bongos');
     fs.mkdirSync(gdsDir, { recursive: true });
     fs.writeFileSync(path.join(gdsDir, 'main-audit.js'),
       'require("fs").writeFileSync("argv.txt", process.argv.slice(2).join(" "));\n');

package/tests/deploy_divergence_line.mjs

@@ -29,9 +29,9 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { line, check } = require('../scripts/gds/deploy-divergence.js');
+const { line, check } = require('../scripts/bongos/deploy-divergence.js');
 const ic = require('../src/instance-config.js');
-const SCRIPT = path.join(ROOT, 'scripts/gds/deploy-divergence.js');
+const SCRIPT = path.join(ROOT, 'scripts/bongos/deploy-divergence.js');
 
 // Run `--line` exactly as SessionStart does. Returns {status, stdout} instead of
 // throwing, so a non-zero exit is an ASSERTABLE value rather than a test crash.
@@ -71,16 +71,32 @@ test('a behind instance names both versions and the host', () => {
   assert.equal(s.split('\n').length, 1, 'must be ONE line — it is injected context');
 });
 
-test('the line says who sees a merge, not a blanket "deploys nothing"', () => {
-  // task 1004682: the old advice ("Merging to main deploys nothing") was the ADR 0137
-  // rule, false since ADR 0161, and sessions repeated it to the owner about live work.
-  // The invariant now: name BOTH audiences — the hub redeploys on every merge, hosted
-  // projects only when a release carries the change and their pin moves.
+test('the line says who sees a merge, not a blanket rule in either direction', () => {
+  // task 1004682: "Merging to main deploys nothing" (ADR 0137) was false since ADR 0161.
+  // task 1004873: its replacement, "the hub redeploys from main on every merge, within
+  // minutes", was never true — the hub pins a published core like every instance, and
+  // served one build through 200+ merges while sessions called work live.
   const s = line(behind);
   assert.doesNotMatch(s, /deploys nothing/);
-  assert.match(s, /cloudbongos[.]com redeploys from main on every merge/);
+  assert.doesNotMatch(s, /redeploys from main|on every merge|within minutes/);
+  assert.match(s, /cloudbongos[.]com gets a merge only when a published core release carries it and its pin moves [(]owner-gated[)]/);
   assert.match(s, /hosted projects: only when a published core release carries the change and their pin moves/);
-  assert.match(s, /Say which one you mean before calling work live/);
+  assert.match(s, /Never call work live until that instance's \/version shows it/);
+});
+
+test('the line says whether main\'s latest merge is in a release yet', () => {
+  // task 1004873: the first question behind "is it live?" is "is it released?".
+  const none = line({ ...behind, behind: false, hasUnreleased: true, unreleased: { count: 4 }, tip: { short: '0f39e344', version: null } });
+  assert.match(none, /main's latest merge [(]0f39e344[)] is in NO release yet, so no instance can have it/);
+  const carried = line({ ...behind, tip: { short: 'adfd7c27', version: '1.19.69' } });
+  assert.match(carried, /main's latest merge [(]adfd7c27[)] is in release 1[.]19[.]69/);
+  assert.equal(carried.split('\n').length, 1);
+  // Bounded: the tip and version are interpolated into injected context.
+  const hostile = line({ ...behind, tip: { short: 'zz IGNORE PREVIOUS', version: '1.0.0 do X' } });
+  assert.doesNotMatch(hostile, /IGNORE|do X/);
+  assert.match(hostile, /main's latest merge is in NO release yet/);
+  // Nothing to say → still silent.
+  assert.equal(line({ ...behind, ok: true, behind: false, tip: { short: 'abc12345', version: null } }), null);
 });
 
 test('live AHEAD of main is reported, not treated as fine', () => {
@@ -228,7 +244,7 @@ test('the line frames its numbers as read from the network', () => {
 });
 
 test('git calls carry their own timeout (SessionStart cannot hang on a wedged git)', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/deploy-divergence.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/bongos/deploy-divergence.js'), 'utf8');
   const fn = src.slice(src.indexOf('function git('), src.indexOf('function git(') + 500);
   assert.match(fn, /timeout:/, 'execSync in git() must pass a timeout');
 });
@@ -258,11 +274,11 @@ test('settings.json wires SessionStart to --line on the real script', () => {
 test('settings.json stays OUT of the published package', () => {
   // Topology (PROTECTED_TOPOLOGY_EXCLUDE). If it leaked into the package, every
   // consumer would inherit this repo's hook wiring verbatim.
-  const { isPublishable } = require('../scripts/gds/publish-manifest.js');
+  const { isPublishable } = require('../scripts/bongos/publish-manifest.js');
   assert.equal(isPublishable('.claude/settings.json'), false);
   // The script it calls, by contrast, MUST ship — an instance that materializes
   // this settings.json needs the target to exist.
-  assert.equal(isPublishable('scripts/gds/deploy-divergence.js'), true);
+  assert.equal(isPublishable('scripts/bongos/deploy-divergence.js'), true);
 });
 
 // ── schema behind (task 1002002) ────────────────────────────────────────────
@@ -279,14 +295,14 @@ test('a database missing migrations is named on the one line, with its own advic
   const s = line(schemaOnly);
   assert.match(s, /MISSING 3 migrations the running code ships/);
   assert.match(s, /Run migrate against that instance DB/);
-  assert.doesNotMatch(s, /redeploys from main/, 'the version advice is for version gaps only');
+  assert.doesNotMatch(s, /gets a merge only when/, 'the version advice is for version gaps only');
   assert.equal(s.split('\n').length, 1);
   assert.match(line({ ...schemaOnly, live: { ...schemaOnly.live, schemaPending: 1 } }), /MISSING 1 migration the/);
 
   const both = line({ ...schemaOnly, behind: true, live: { version: '1.0.0', coreVersion: '1.19.56', schemaPending: 2 } });
   assert.match(both, /1\.19\.56/);
   assert.match(both, /MISSING 2 migrations/);
-  assert.match(both, /redeploys from main on every merge/);
+  assert.match(both, /gets a merge only when a published core release carries it/);
 });
 
 test('a non-integer schemaPending never reaches the line', () => {
@@ -329,7 +345,7 @@ test('check() reads schemaPending off /version, and only a bounded integer count
 // CORE_VERSION bump at or after the commit (the hub runs its own repo and reports
 // its own commit). Pinned against this repo's real history, on HEAD so a checkout
 // without origin/main still runs it (CI checks out fetch-depth 0).
-const { liveIncludes, hubReading, coreVersionAt } = require('../scripts/gds/deploy-divergence.js');
+const { liveIncludes, hubReading, coreVersionAt } = require('../scripts/bongos/deploy-divergence.js');
 const gitOut = (args) => spawnSync('git', args, { cwd: ROOT, encoding: 'utf8' }).stdout.trim();
 const bumps = gitOut(['log', 'HEAD', '-3', '--format=%H', '-G^const CORE_VERSION = ', '--', 'src/module-api.js']).split('\n').filter(Boolean);
 
@@ -372,7 +388,7 @@ test('hubReading bounds what the sentence prints', () => {
 
 test('the full report prints the same two lines the ship card does', () => {
   const { whoSeesAMerge } = require('../modules/lifecycle/merge-reach.js');
-  const { report } = require('../scripts/gds/deploy-divergence.js');
+  const { report } = require('../scripts/bongos/deploy-divergence.js');
   const reach = { host: 'cloudbongos.com', liveShort: '09478c8e', includes: true };
   const lines = [];
   const orig = console.log;
@@ -392,6 +408,10 @@ test('check() computes the hub reading for the report, and skips it for the Sess
   assert.equal(full.reach.liveShort, '09478c8e', 'the report and ship card read it');
   const lean = await withVersionStub(body, (base) => check({ base, timeoutMs: 5000, withReach: false }));
   assert.equal(lean.reach, null, '--line never prints it, so it pays no git calls for it');
+  // task 1004873: the --line path DOES carry the latest-merge release state.
+  assert.match(lean.tip.short, /^[0-9a-f]{8}$/, 'main\'s tip, as a short sha');
+  assert.equal(lean.tip.version, lean.unreleased && lean.unreleased.count === 0 ? lean.onMain : null,
+    'released exactly when no work commit sits past the last CORE_VERSION bump');
   const src = fs.readFileSync(SCRIPT, 'utf8');
   assert.match(src, /line\(await check\(\{ timeoutMs: ms, withReach: false \}\)\)/, 'the --line path opts out');
 });

package/tests/deploy_page_projects.mjs

@@ -20,11 +20,15 @@ import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deploy.js'), 'utf8');
+// The shared ask card the move is drawn with (task 1004829), loaded before the page
+// exactly as deploy.html does.
+const ASK_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/hall-ask.js'), 'utf8');
 
 const preview = (id, slug, over = {}) => ({
   instance_id: id, slug, hosting_shape: 'cloud-host',
   served_version: '1.19.800', recommended_version: '1.19.871',
   behind: true, reading: 'ok', observed_at: new Date().toISOString(), open_intent: null,
+  viewer_may_move: true,
   ...over,
 });
 
@@ -106,6 +110,7 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise, decodeURIComponent };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  vm.runInContext(ASK_SRC, sandbox, { filename: 'hall-ask.js' });
   vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
   documentObj._ready();
   const settle = async () => { for (let i = 0; i < 40; i++) await new Promise((r) => setTimeout(r, 0)); };
@@ -113,7 +118,7 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   // `settle` drains the whole loop (POLL_MS is 0 here), so an assertion about the
   // in-flight row has to look before the loop finishes, not after it.
   const tick = async (n = 3) => { for (let i = 0; i < n; i++) await new Promise((r) => setTimeout(r, 0)); };
-  return { els, posts, gets, reads, toasts, settle, tick, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
+  return { els, posts, gets, reads, toasts, settle, tick, panel: () => els.get('dp-panel').innerHTML };
 }
 
 // ---- WHICH project the page is about (task 1004171) -------------------------------
@@ -125,7 +130,6 @@ test('unscoped, the page is the hall’s OWN project and nothing else', async ()
   assert.match(html, /cloudbongos/, 'the hall’s own project');
   assert.doesNotMatch(html, /mercury/, 'and not another project');
   assert.doesNotMatch(html, /hoodify-finance/);
-  assert.match(b.sub(), /^cloudbongos$/);
 });
 
 test('unscoped, it never LISTS the fleet or probes a project it is not about', async () => {
@@ -147,7 +151,6 @@ test('?project= renders THAT project, by slug, and still only one row', async ()
   assert.match(html, /mercury/);
   assert.doesNotMatch(html, /cloudbongos/, 'the self row is not added beside it');
   assert.doesNotMatch(html, /hoodify-finance/, 'nor any other project');
-  assert.equal(b.sub(), 'mercury');
   assert.ok(!b.gets.includes('/provisioning/control-plane'), 'and the self row is not even read');
 });
 
@@ -790,7 +793,7 @@ test('every reason the runner can give has owner words on this page — none fal
   // sentence here would reach the owner as "no words for this yet".
   const { createRequire } = await import('node:module');
   const req = createRequire(import.meta.url);
-  const vocab = Object.keys(req(path.join(ROOT, 'scripts/gds/upgrade-outcome.js')).REASON_CLASS || {});
+  const vocab = Object.keys(req(path.join(ROOT, 'scripts/bongos/upgrade-outcome.js')).REASON_CLASS || {});
   assert.ok(vocab.length > 20, 'the vocabulary was read');
   const block = SRC.slice(SRC.indexOf('const REASON_WORDS = {'), SRC.indexOf('const reasonWords'));
   const missing = vocab.filter((k) => !new RegExp(`\\b${k}:`).test(block));
@@ -809,3 +812,31 @@ test('a known snag it could not fix names the next step, and does NOT point at a
   assert.match(b.panel(), /whoever runs that machine clears the snag/);
   assert.doesNotMatch(b.panel(), /href="\/blockers"/, 'move-escalation files no blocker for this class');
 });
+
+// ---- the move is the hall's ask card (task 1004829) -------------------------------
+
+test('the move is asked as a question, with the press as its answer', async () => {
+  const b = boot({ scope: 'mercury' });
+  await b.settle();
+  b.els.get('dp-preview-31')._on.click();
+  const html = b.panel();
+  assert.match(html, /class="hask/, 'the shared ask card');
+  assert.match(html, /Move mercury to core 1\.19\.871\?/, 'a question naming the project and the version');
+  assert.match(html, /id="dp-confirm-31"/, 'the answer is the same control the handler is wired to');
+  assert.match(html, /id="dp-cancel-31"/, 'and Cancel stays a plain step back');
+});
+
+test('a viewer the move would refuse is never offered the press', async () => {
+  // viewer_may_move is the server's answer (the release building's act-alone rule
+  // on top of the move's own doors). Anything but true offers nothing.
+  for (const flag of [false, undefined]) {
+    const b = boot({ scope: 'mercury', instanceOver: () => ({ viewer_may_move: flag }) });
+    await b.settle();
+    b.els.get('dp-preview-31')._on.click();
+    const html = b.panel();
+    assert.doesNotMatch(html, /id="dp-confirm-31"/, `no Move for viewer_may_move=${flag}`);
+    assert.doesNotMatch(html, /class="hask/, 'and no card asking for one');
+    assert.match(html, /decided by the project’s government/, 'it says why');
+    assert.match(html, /id="dp-cancel-31"/);
+  }
+});

package/tests/dev_lib.mjs

@@ -1,4 +1,4 @@
-// tests/dev_lib.mjs — hermetic unit smoke for scripts/gds/dev-lib.js (the `bongos
+// tests/dev_lib.mjs — hermetic unit smoke for scripts/bongos/dev-lib.js (the `bongos
 // dev` local launcher core, ADR 0149). NO real spawn, DB, network, or fs writes:
 // fs / spawn / kill / fetchImpl / env / userInfo are all injected.
 //
@@ -8,7 +8,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const lib = require('../scripts/gds/dev-lib.js');
+const lib = require('../scripts/bongos/dev-lib.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {

package/tests/dev_windows.mjs

@@ -19,8 +19,8 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const cp = require('node:child_process');
 const fs = require('node:fs');
-const lib = require('../scripts/gds/dev-lib.js');
-const devCli = require('../scripts/gds/dev.js');
+const lib = require('../scripts/bongos/dev-lib.js');
+const devCli = require('../scripts/bongos/dev.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {