@bongos/core 1.21.175 → 1.21.177

package/tests/wizard_born_first_board.mjs

@@ -4,7 +4,7 @@
 //
 // WHY THIS FILE EXISTS. The fix spans two files that never import each other:
 //
-//   scripts/gds/provision-repo.js   seedFirstVersionCmd()  — seeds the instance's ONE
+//   scripts/bongos/provision-repo.js   seedFirstVersionCmd()  — seeds the instance's ONE
 //                                   version at standup, status 'building'
 //   modules/lifecycle/kickoff-seed.js  seedKickoffIfEmpty() — at the founder's first
 //                                   sign-in, files the checklist UNDER that version
@@ -25,10 +25,10 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
+const P = require('../scripts/bongos/provision.js');
 const { seedKickoffIfEmpty, FIRST_VERSION_SQL } = require('../modules/lifecycle/kickoff-seed.js');
 const { kickoffChecklist } = require('../modules/lifecycle/kickoff-checklist.js');
-const { kickoffTasks } = require('../scripts/gds/init.js');
+const { kickoffTasks } = require('../scripts/bongos/init.js');
 
 // The control plane's own fixture shape (mirrors tests/provision.mjs).
 const coTenant = { id: 1, slug: 'mercury', hosting_shape: 'co-tenant', status: 'requested', owner_builder_id: 7, port: 3003, db_name: 'mercury', domain: null };

package/tests/wizard_demo.mjs

@@ -263,7 +263,7 @@ test('the small link opens the demo in place, the steppers stay in their limits,
   assert.equal(h.$('demoSetup').hidden, true, 'the same link closes it again');
   assert.equal(h.$('wizDemo').attrs['aria-expanded'], 'false');
   assert.doesNotMatch(HUB, /id="demoReady"|id="demoRing"|id="demoNext1"|id="demoBack1"|id="demoBack2"|id="demoStageCap"|id="forkIntro"/, 'no second demo screen and no fork');
-  assert.match(HUB, /<p class="pageSub" id="pageSub">Three parts, one page\. Just looking\? <button type="button" class="linklike" id="wizDemo" aria-controls="demoSetup" aria-expanded="false">Try a small demo instead<\/button>\.<\/p>/,
+  assert.match(HUB, /<p class="pageSub" id="pageSub">Just looking\? <button type="button" class="linklike" id="wizDemo" aria-controls="demoSetup" aria-expanded="false">Try a small demo instead<\/button>\.<\/p>/,
     'the demo is a small link under the heading, in the mockup\'s words');
 });
 

package/tests/wizard_one_page.mjs

@@ -61,7 +61,7 @@ test('the old screens, their doors and the confirm-every-row machinery are gone,
 test('the page opens with the mockup\'s own words, in the mockup\'s order', () => {
   const words = [
     'Make something.',
-    'Three parts, one page. Just looking?',
+    'Just looking?',
     'Try a small demo instead',
     'Your project',
     'A few quick checks. They decide which legal and payout options we can offer.',
@@ -70,11 +70,12 @@ test('the page opens with the mockup\'s own words, in the mockup\'s order', () =
     'Create my project',
     'Connect GitHub',
     'opens once your project exists',
-    'One trip to GitHub. Approve the app, pick your repo, and you land back here. We tick each step as it happens, from any tab or device.',
+    'Two steps on GitHub: approve the app, then install it on your repo. You land back here afterwards.',
   ];
   let at = 0;
   for (const w of words) {
-    assert.ok(MOCK.includes(w.replace('How it’s run', 'How it\'s run')), `"${w}" is the mockup's own`);
+    // part 03's sub-line was rewritten after the mockup (owner feedback from UAT): plain words, what to do
+    if (!w.startsWith('Two steps on GitHub')) assert.ok(MOCK.includes(w.replace('How it’s run', 'How it\'s run')), `"${w}" is the mockup's own`);
     const i = PAGE.indexOf(w, at);
     assert.ok(i >= at, `"${w}" comes next on the page`);
     at = i;

package/tests/wizard_physics.mjs

@@ -111,7 +111,9 @@ test('the page carries the server\'s countries, regions and entity forms, exactl
   const plain = (v) => JSON.parse(JSON.stringify(v)); // values born in the vm
   assert.deepEqual(plain(box.PHYS_COUNTRIES), [...physics.COUNTRY_CODES]);
   assert.deepEqual(Object.keys(box.PHYS_REGIONS).sort(), [...physics.REGION_CODES].sort());
-  assert.deepEqual(plain(box.PHYS_ENTITY_FORMS), [...physics.ENTITY_FORMS]);
+  // the page no longer offers the two group forms (a group is an owner answer with its own text);
+  // the server still accepts them for projects that stored one
+  assert.deepEqual(plain(box.PHYS_ENTITY_FORMS), physics.ENTITY_FORMS.filter((f) => f !== 'university-project' && f !== 'social-group'));
   // every entity the page has words for is an entity answer (PHYS_MATERIAL, the plates
   // per entity, left with the forming planet in task 1004504)
   assert.equal(box.PHYS_MATERIAL, undefined, 'the per-entity plates are gone');

package/tests/wizard_physics_more.mjs

@@ -243,6 +243,45 @@ test('the kit stub\'s physics hide rules are the table\'s own, word for word', (
   }
 });
 
+// ── the region is typed, and a group owner says what kind of group ───────────
+test('the region is a typed box: a name or a code becomes the code the server reads, anything else un-answers it', () => {
+  const w = boot();
+  w.run('physDefaults(); paintChecks();');
+  w.a().home_country = 'US';
+  for (const [typed, want] of [['New York', 'US-NY'], ['california', 'US-CA'], ['ny', 'US-NY'], ['Atlantis', null], ['', null]]) {
+    w.$('physRegion').value = typed;
+    w.$('physRegion').listeners.input();
+    assert.equal(w.a().home_region, want, `"${typed}" reads as ${want}`);
+  }
+  w.a().home_country = 'CA';
+  w.$('physRegion').value = 'Ontario';
+  w.$('physRegion').listeners.input();
+  assert.equal(w.a().home_region, 'CA-ON', 'Canada reads its own provinces');
+  w.$('physRegion').value = 'New York';
+  w.$('physRegion').listeners.input();
+  assert.equal(w.a().home_region, null, 'and not a state of another country');
+});
+
+test('"A group" asks what type of group, and the words travel with the create; no other owner sends them', () => {
+  const w = boot();
+  w.run('physDefaults(); paintChecks();');
+  assert.equal(w.$('physGroupField').hidden, true, 'hidden until A group is picked');
+  w.pick('entity', 'intent-group');
+  w.run('paintChecks()');
+  assert.equal(w.$('physGroupField').hidden, false, 'A group opens the question');
+  w.$('physGroupType').value = '  A neighborhood association ';
+  w.$('physGroupType').listeners.input();
+  assert.equal(w.a().entity_group_type, 'A neighborhood association');
+  const d = plain(w.run('createDetail()'));
+  assert.equal(d.entity, 'intent-group');
+  assert.equal(d.entity_group_type, 'A neighborhood association');
+  assert.equal(physics.canonicalAnswer(physics.PLANET_PHYSICS_QUESTIONS.entity_group_type, d.entity_group_type), d.entity_group_type, 'the server accepts what the page sends');
+  w.pick('entity', 'intent-company');
+  w.run('paintChecks()');
+  assert.equal(w.$('physGroupField').hidden, true, 'another owner closes it again');
+  assert.equal(plain(w.run('createDetail()')).entity_group_type, undefined, 'and the words are not sent');
+});
+
 // ── part 01, the quick checks ────────────────────────────────────────────────
 test('the quick checks reveal what an answer opens: the age tiers, the legal forms, a state or province', () => {
   const w = boot();
@@ -268,7 +307,7 @@ test('the quick checks reveal what an answer opens: the age tiers, the legal for
   w.$('physCountry').value = 'US';
   w.$('physCountry').listeners.change();
   assert.equal(w.$('physRegionField').hidden, false, 'a country with states asks for one');
-  assert.ok(w.$('physRegion').children.some((o) => o.value === 'US-CA'));
+  assert.ok(w.$('physRegionList').children.some((o) => o.value === 'California'));
   w.$('physCountry').value = 'NL';
   w.$('physCountry').listeners.change();
   assert.equal(w.$('physRegionField').hidden, true, 'and one without does not');
@@ -566,7 +605,7 @@ test('a new owner walks the page from the quick checks through the rows they cha
   const w = boot({ draft: { description: 'An inventory tool our team started last year.' } });
   w.run('physDefaults(); paintChecks(); paintSetup();');
   w.$('physCountry').value = 'US'; w.$('physCountry').listeners.change();
-  w.$('physRegion').value = 'US-NY'; w.$('physRegion').listeners.change();
+  w.$('physRegion').value = 'New York'; w.$('physRegion').listeners.input();
   w.pick('builder_geography', 'global');
   w.pick('minors_on_board', 'false');
   w.$('physHaveEntity').click();
@@ -722,7 +761,7 @@ test('a country picked from the list runs the select\'s own path: the region, th
   assert.equal(w.a().home_country, 'CA');
   assert.equal(w.a().home_region, null, 'a state of another country is dropped');
   assert.equal(w.$('physRegionField').hidden, false, 'a country with provinces asks for one');
-  assert.ok(w.$('physRegion').children.some((o) => o.value === 'CA-ON'));
+  assert.ok(w.$('physRegionList').children.some((o) => o.value === 'Ontario'));
   typeCountry(w, 'netherlands');
   w.$('physCountryList').children.find((c) => c.getAttribute('data-code') === 'NL').click();
   assert.equal(w.$('physRegionField').hidden, true, 'and one without does not');

package/tests/work_title_wrap.mjs

@@ -2,7 +2,7 @@
 //
 // At 390 the backlog title "Watch redesign: … People/Operations/Security tabs" ran
 // 44px past its column: a slash-joined run offers the browser no break point. The
-// rendered check (scripts/gds/render-check.js) is what measures it; this pins the
+// rendered check (scripts/bongos/render-check.js) is what measures it; this pins the
 // two halves of the fix in source so neither is dropped by an unrelated edit.
 //
 // Run:  node tests/work_title_wrap.mjs

package/tests/workflow_exec_paths.mjs

@@ -18,7 +18,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const { lintWorkflowExec } = require('../scripts/gds/lint-workflow-exec.js');
+const { lintWorkflowExec } = require('../scripts/bongos/lint-workflow-exec.js');
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..');
 const CORE_PATH_SH = path.join(REPO, 'infra', 'core-path.sh');
@@ -48,8 +48,8 @@ hostTest('lint-workflow-exec: every core invocation is routed + publishable (no
   assert.ok(r.ok, 'lint should pass');
   // The security-critical merge gates + the functional gates must all be covered.
   const rels = r.checked.map((c) => `${c.file}:${c.rel}`);
-  assert.ok(rels.some((s) => s.startsWith('gate-review.yml:') && s.endsWith('scripts/gds/gate-review.js')), 'gate-review routed');
-  assert.ok(rels.some((s) => s.startsWith('grade-gate.yml:') && s.endsWith('scripts/gds/ci-grade.js')), 'grade-gate routed');
+  assert.ok(rels.some((s) => s.startsWith('gate-review.yml:') && s.endsWith('scripts/bongos/gate-review.js')), 'gate-review routed');
+  assert.ok(rels.some((s) => s.startsWith('grade-gate.yml:') && s.endsWith('scripts/bongos/ci-grade.js')), 'grade-gate routed');
   assert.ok(rels.some((s) => s.endsWith('scripts/migrate.sh')), 'selfhost migrate routed via core-path.sh');
 });
 
@@ -57,10 +57,10 @@ test('lint-workflow-exec: a bare core invocation in a workflow is flagged (count
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'wf-lint-'));
   try {
     fs.mkdirSync(path.join(tmp, '.github', 'workflows'), { recursive: true });
-    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
-    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'gate-review.js'), '// probe\n');
+    fs.mkdirSync(path.join(tmp, 'scripts', 'bongos'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'gate-review.js'), '// probe\n');
     fs.writeFileSync(path.join(tmp, '.github', 'workflows', 'legacy.yml'),
-      'jobs:\n  x:\n    steps:\n      - run: node scripts/gds/gate-review.js\n');
+      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/gate-review.js\n');
     const r = lintWorkflowExec({ instanceRoot: tmp, coreRoot: tmp });
     assert.ok(!r.ok, 'a bare core invocation must fail the lint');
     assert.equal(r.violations.length, 1);

package/tests/worktree_claim_guard.mjs

@@ -15,7 +15,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { decideWorktreeClaim, ESCAPE_FLAG } = require('../scripts/gds/worktree-claim-guard.js');
+const { decideWorktreeClaim, ESCAPE_FLAG } = require('../scripts/bongos/worktree-claim-guard.js');
 
 let passed = 0;
 let failed = 0;

package/tests/worktree_helper.mjs

@@ -1,6 +1,6 @@
 // tests/worktree_helper.mjs
 //
-// Unit tests for the pure decision helpers behind scripts/gds/worktree.js
+// Unit tests for the pure decision helpers behind scripts/bongos/worktree.js
 // (task 1002809) — the junction-safe worktree lifecycle for Windows builders.
 //
 // The trap this tooling kills: a worktree OUTSIDE the repo root (C:/tmp/wt-N,
@@ -27,7 +27,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition, unlinkNodeModulesLink } = require('../scripts/gds/worktree.js');
+const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition, unlinkNodeModulesLink } = require('../scripts/bongos/worktree.js');
 
 const HOUR = 60 * 60 * 1000;
 

package/tests/write_validation_gaps.mjs

@@ -23,20 +23,20 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8');
 
 test('the baseline is empty — the invariant is back to hard-zero', () => {
-  const fit = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+  const fit = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
   const baseline = fit.WRITE_VALIDATION_BASELINE;
   if (baseline !== undefined) {
     assert.equal(baseline.size, 0, `still-exempt write routes: ${[...baseline].join(', ')}`);
   } else {
     // Deleted outright rather than emptied — also acceptable, and the fitness
     // check below is the real assertion either way.
-    assert.doesNotMatch(read('scripts/gds/fitness.js'), /'POST \/inbox\/:id\/ratify'/,
+    assert.doesNotMatch(read('scripts/bongos/fitness.js'), /'POST \/inbox\/:id\/ratify'/,
       'the ratify entry must be gone from the baseline');
   }
 });
 
 test('fitness reports ZERO unvalidated write routes', () => {
-  const fit = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+  const fit = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
   assert.equal(typeof fit.scanUnvalidatedWriteRoutes, 'function',
     'the scanner must stay exported so this cannot silently stop being checked');
   const unvalidated = fit.scanUnvalidatedWriteRoutes();

package/scripts/gds/api.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-# scripts/gds/api.sh — Git Bash/Linux passthrough wrapper around api.js.
-# MSYS_NO_PATHCONV avoids Git Bash mangling API paths (e.g. /api/bongos/inbox) into
-# Windows paths before node ever sees them.
-export MSYS_NO_PATHCONV=1
-exec node "$(dirname "$0")/api.js" "$@"

package/scripts/gds/artifact-staleness.js

@@ -1,267 +0,0 @@
-#!/usr/bin/env node
-// scripts/gds/artifact-staleness.js — are the gitignored generated artifacts on
-// THIS machine actually current with the commit it has checked out? (task 1001930,
-// ADR 0110 pt.5)
-//
-// WHY THIS EXISTS. ADR 0110 moved `docs/repo-map.md` and `docs/session-log-index.md`
-// off the git graph: they are 100%-generated, two parallel branches collided on them
-// constantly, so they became untracked files regenerated at deploy. That trade was
-// deliberate, and the ADR names the debt it took on in its own Consequences:
-//
-//   "A generator that breaks at deploy leaves a stale/absent file with no blocking
-//    backstop; the LOUD ::ERROR:: line is the alarm (mandatory, not optional)."
-//
-// That alarm is a line in the droplet's journald. Nobody reads journald. The per-PR
-// freshness gate cannot help either — the files are gitignored, so they never appear
-// in a diff for CI to check (`--check-whole`'s own comment says it plainly: "used by
-// nothing hard; deploy owns it"). So if the deploy regen step silently stops running,
-// every agent keeps reading a symbol map of a codebase that has moved on, and nothing
-// anywhere says so. This check is the backstop that posture depends on.
-//
-// WHAT IT COMPARES. For each registered artifact, its own generator's `--check-whole`
-// answers "would regenerating this file change it?" — run against the checkout that is
-// actually serving. A difference means the deploy generator did not run, or ran and
-// broke. Asking the generator rather than reimplementing the comparison is the point:
-// there is exactly one definition of "fresh" per artifact and it lives with the thing
-// that writes it, so this check cannot drift away from what deploy produces.
-//
-// ABSENT AND STALE ARE REPORTED SEPARATELY, and the split is operational, not cosmetic:
-// absent means the regen step never ran here at all (a deploy line was dropped, or a
-// fresh clone was never generated into), stale means it ran once and has not since.
-// Those send someone to two different places, so the report must not blur them.
-//
-// ── WHERE THIS MAY RUN — read before scheduling it anywhere new ───────────────
-//
-// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance after its
-// source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
-// has no `docs/repo-map.md` — it is gitignored, so it is not in the repository at all
-// — and this check would report it absent on every single run. A monitor that is red
-// every run teaches its reader to ignore it, which is the exact failure ADR 0110's
-// warn-only posture already has. That is why this ships as a scheduled routine on the
-// instance and NOT as a `.github/workflows/` job, unlike its sibling publish-watch.js
-// (which reads git and the registry, and so is true anywhere).
-//
-// THE MAIN GUARD. "Fresh" here means "matches what THIS commit generates". On a
-// deployed instance that commit is main, because deploy does `git reset --hard
-// origin/main` — so the question the caller actually wants ("does the served artifact
-// lag main's HEAD?") and the question `--check-whole` answers are the same question.
-// In a feature worktree they are NOT: the artifact would be compared against that
-// branch, and a pass or a fail would both be meaningless. So a checkout that is not at
-// origin/main is INCONCLUSIVE (exit 2), never a finding — a monitor that cannot tell
-// which question it just answered must say so rather than guess.
-'use strict';
-
-const { spawnSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const GIT_TIMEOUT_MS = 15000;
-const CHECK_TIMEOUT_MS = 120000;
-
-// The gitignored, whole-file generated artifacts this check covers.
-//
-// MEMBERSHIP RULE — an artifact belongs here when all three hold: it is gitignored (so
-// no PR gate can see it), it is written by a deploy-time generator (so it can silently
-// stop being written), and its generator exposes `--check-whole` (so freshness has one
-// definition, owned by the writer). tests/artifact_staleness.mjs pins this list against
-// .gitignore and against the generators' real flags, so an artifact that gains a
-// `--check-whole` and is left out of here fails that test rather than going unwatched.
-//
-// DELIBERATELY NOT HERE, and each for a reason that is not "we forgot":
-//   • modules/hall-ui/public/atlas.json (gen-atlas.js, ADR 0094) — gitignored and
-//     deploy-generated, but its payload embeds `generatedAt: new Date()`, so a
-//     regenerate-and-compare differs on every run by construction. Checking it needs a
-//     comparison over `views` only, or a freshness-by-age test against the last deploy
-//     — a different mechanism, not this one. gen-atlas has no --check mode at all today.
-//   • docs/onboarding/diagrams/*.svg|png — rendering them needs a headless Chromium the
-//     droplet does not have (the reason ADR 0110 deferred the diagram half in the first
-//     place), so freshness cannot be evaluated where this runs. Their FACTS are already
-//     backstopped by the diagram-drift routine, which reads assertions.json instead.
-const ARTIFACTS = Object.freeze([
-  Object.freeze({
-    rel: 'docs/repo-map.md',
-    generator: 'gen-repo-map.js',
-    what: 'the symbol skeleton agents navigate the codebase by (ADR 0063)',
-  }),
-  Object.freeze({
-    rel: 'docs/session-log-index.md',
-    generator: 'gen-session-index.js',
-    what: 'the full session-log index the CLAUDE.md §13 snippet links out to (ADR 0062 §8)',
-  }),
-]);
-
-function git(args, run = spawnSync) {
-  const raw = gitRaw(args, run);
-  return raw === null ? null : raw.trim();
-}
-
-// Untrimmed, because `git status --porcelain` is column-significant: a line is
-// `XY<space>PATH` and an unstaged modification's X is a SPACE (" M path"). Trimming the
-// buffer eats that leading space on the FIRST line only, so a slice(3) then swallows the
-// path's first character — which is exactly how this printed "cripts/gds/…" until
-// tests/artifact_staleness.mjs caught it.
-function gitRaw(args, run = spawnSync) {
-  const r = run('git', args, { cwd: REPO_ROOT, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
-  if (!r || r.error || r.status !== 0) return null;
-  return String(r.stdout || '');
-}
-
-// The paths in a porcelain listing, status columns removed.
-function porcelainPaths(raw) {
-  return raw.split('\n').filter((l) => l.length > 3).map((l) => l.slice(3).trim()).filter(Boolean);
-}
-
-// Is this checkout a fair thing to compare the artifacts against — at origin/main AND
-// clean? Returns { ok } or { ok:false, reason }; git being unable to answer is equally
-// inconclusive.
-//
-// The CLEAN half is not belt-and-braces, and it was found by running this check against
-// its own uncommitted source file: a generator regenerates from the WORKING TREE, so one
-// uncommitted file that moves a symbol makes repo-map.md "stale" against a main it in
-// fact matches. On the droplet the tree is clean by construction (deploy does
-// `git reset --hard`), so requiring it costs a correct run nothing — while without it
-// every hand-run from a working checkout invents a finding, which is precisely how a
-// monitor teaches its reader to ignore it. Gitignored files (the artifacts themselves)
-// never appear in `--porcelain`, so they cannot trip this.
-function atMain(run = spawnSync) {
-  const head = git(['rev-parse', 'HEAD'], run);
-  const main = git(['rev-parse', 'origin/main'], run);
-  if (!head) return { ok: false, reason: 'could not read HEAD (not a git checkout?)' };
-  if (!main) return { ok: false, reason: 'could not read origin/main (no remote ref here?)' };
-  if (head !== main) {
-    const branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], run) || '(detached)';
-    return { ok: false, reason: `checkout is at ${branch} ${head.slice(0, 8)}, not origin/main ${main.slice(0, 8)}` };
-  }
-  const dirty = gitRaw(['status', '--porcelain'], run);
-  if (dirty === null) return { ok: false, reason: 'could not read the working tree state' };
-  const paths = porcelainPaths(dirty);
-  if (paths.length) {
-    const shown = paths.slice(0, 3).join(', ');
-    const more = paths.length > 3 ? `, +${paths.length - 3} more` : '';
-    return { ok: false, reason: `working tree is not clean (${shown}${more}) — the generators would compare against those edits, not main` };
-  }
-  return { ok: true, sha: head };
-}
-
-// Ask ONE artifact's own generator whether it is current.
-//   fresh    exit 0 — regenerating would change nothing
-//   stale    exit 2 — it would (absent counts as stale; `present` says which)
-//   unknown  anything else — the generator itself could not answer, which is not a
-//            finding about the artifact and must never be reported as one.
-function checkArtifact(a, { root = REPO_ROOT, run = spawnSync, exists = fs.existsSync } = {}) {
-  const present = exists(path.join(root, a.rel));
-  const r = run(process.execPath, [path.join(root, 'scripts', 'gds', a.generator), '--check-whole'],
-    { cwd: root, encoding: 'utf8', timeout: CHECK_TIMEOUT_MS });
-  if (!r || r.error) {
-    return { ...a, state: 'unknown', present, detail: r && r.error ? r.error.message : 'generator did not run' };
-  }
-  if (r.status === 0) return { ...a, state: 'fresh', present };
-  if (r.status === 2) return { ...a, state: present ? 'stale' : 'absent', present };
-  const said = String(r.stderr || r.stdout || '').trim().split('\n').pop() || `exit ${r.status}`;
-  return { ...a, state: 'unknown', present, detail: said };
-}
-
-function check({ root = REPO_ROOT, run = spawnSync, exists = fs.existsSync, artifacts = ARTIFACTS, requireMain = true } = {}) {
-  if (requireMain) {
-    const m = atMain(run);
-    if (!m.ok) { const e = new Error(m.reason); e.inconclusive = true; throw e; }
-  }
-  const results = artifacts.map((a) => checkArtifact(a, { root, run, exists }));
-  return {
-    results,
-    fresh: results.filter((r) => r.state === 'fresh'),
-    stale: results.filter((r) => r.state === 'stale'),
-    absent: results.filter((r) => r.state === 'absent'),
-    unknown: results.filter((r) => r.state === 'unknown'),
-  };
-}
-
-// Plain language: this lands in Discord #ship-news, where the audience is the owner,
-// not whoever wrote the generator.
-function report(r) {
-  const bad = [...r.absent, ...r.stale];
-  if (!bad.length && !r.unknown.length) {
-    return `Generated navigation docs are current — ${r.fresh.length} artifact(s) match this commit.`;
-  }
-  const lines = [];
-  if (bad.length) {
-    lines.push(`⚠ ${bad.length} generated file(s) on this instance no longer match the code being served.`);
-    lines.push('');
-    for (const a of r.absent) lines.push(`  • ${a.rel} — MISSING entirely. Nothing has generated it here. It is ${a.what}.`);
-    for (const a of r.stale) lines.push(`  • ${a.rel} — out of date: it no longer matches what this commit would produce. It is ${a.what}.`);
-    lines.push('');
-    lines.push('These are rebuilt by the deploy step, so this means that step stopped running or broke.');
-    lines.push('Nothing blocks on them, which is why it went unreported until now — anyone reading these');
-    lines.push('files is being given an out-of-date picture. Check the deploy log for its regen lines');
-    lines.push('(they print ::ERROR:: when a generator fails).');
-  }
-  if (r.unknown.length) {
-    if (bad.length) lines.push('');
-    lines.push(`Could not check ${r.unknown.length} artifact(s):`);
-    for (const a of r.unknown) lines.push(`  • ${a.rel} — ${a.detail}`);
-  }
-  return lines.join('\n');
-}
-
-// Deliver the finding here rather than through run-routine.js's `sink: discord`.
-// run-routine treats a non-zero step as a FAILED step and aborts BEFORE it routes
-// stdout, so exiting 1 on a finding would throw that finding away. publish-watch.js
-// and artifact-audit.js carry the same shape for the same reason; their routine steps
-// all stay `sink: none` and the script performs its own side effect.
-async function deliver(text) {
-  const { postWebhook } = require(path.join(__dirname, '..', 'discord', 'lib.js'));
-  await postWebhook('ship_news', text);
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const json = argv.includes('--json');
-
-  let r;
-  try {
-    r = check({ requireMain: !argv.includes('--any-ref') });
-  } catch (err) {
-    // Exit 2 = COULD NOT RUN, kept distinct from 1 (ran, found something) so a
-    // scheduler can go red on the former and merely report the latter.
-    console.error(`artifact-staleness could not complete: ${err && err.message ? err.message : err}`);
-    if (err && err.inconclusive) {
-      console.error('  Freshness is only meaningful against the commit being served. Re-run on the');
-      console.error('  deployed instance, or pass --any-ref to compare against whatever is checked out.');
-    }
-    process.exit(2);
-  }
-
-  const text = report(r);
-  const found = r.stale.length + r.absent.length;
-
-  if (json) { console.log(JSON.stringify(r, null, 2)); process.exit(found ? 1 : 0); }
-
-  // A healthy run is deliberately quiet — it tells a person who ran it by hand
-  // (stderr) and posts nothing. A daily "all fine" is how a channel becomes wallpaper.
-  if (!found) {
-    console.error(text);
-    // An artifact we could not check is not a finding, but it must not be silent
-    // either: a permanently-unknown artifact is unwatched without anyone deciding so.
-    process.exit(r.unknown.length ? 2 : 0);
-  }
-
-  console.log(text);
-  if (argv.includes('--no-post')) process.exit(1);
-
-  try {
-    await deliver(text);
-    console.error('posted the finding to Discord #ship-news.');
-    process.exit(1);
-  } catch (err) {
-    // Found something and could not say it — the original defect one layer down, so
-    // it is the LOUDEST outcome: exit 3 is >= 2, which turns the scheduled run red.
-    console.error(`\nFOUND STALE ARTIFACTS AND COULD NOT DELIVER THE FINDING: ${err && err.message ? err.message : err}`);
-    console.error('The finding is above. Set DISCORD_SHIP_NEWS_WEBHOOK so this reaches #ship-news.');
-    process.exit(3);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { ARTIFACTS, atMain, checkArtifact, check, report };

package/scripts/gds/audit-exports.js

@@ -1,128 +0,0 @@
-#!/usr/bin/env node
-// audit-exports.js — V3.R?? (#467). Dead-export checker for the grader modules.
-//
-// The MAS grader accreted v1/v2/v3 code; some exported symbols outlived their
-// only consumer (the dead exports #466 deletes). This script is the cheap,
-// greppable, CI-hookable guard that catches that class — same spirit as
-// audit-authorship.sh (V3.R12): require the target modules, read their actual
-// export keys, then scan the repo for a real consumer of each.
-//
-// Classification per exported symbol:
-//   consumed   — referenced in src/ or scripts/ outside the defining file
-//   test-only  — referenced ONLY under tests/ (a warning: exported for tests)
-//   DEAD       — no word-boundary reference anywhere outside the defining file
-//
-// Exit 1 if any DEAD export (nothing imports it). test-only is reported but
-// does not fail. --json prints the raw classification.
-//
-// Usage: node scripts/gds/audit-exports.js [--json]
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const REPO_ROOT = path.resolve(__dirname, '../..');
-
-// Modules whose export surface we police. Add more as the grader grows.
-const TARGETS = [
-  'modules/grading/grader.js',
-  'modules/grading/grader-workers/index.js',
-];
-
-// Dirs scanned for consumers.
-const SCAN_DIRS = ['src', 'scripts', 'tests'];
-const CODE_EXT = new Set(['.js', '.mjs', '.cjs']);
-
-// Walk a dir collecting code files (skip node_modules / .git).
-function collectFiles(dir, out) {
-  let entries;
-  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return out; }
-  for (const e of entries) {
-    if (e.name === 'node_modules' || e.name === '.git') continue;
-    const full = path.join(dir, e.name);
-    if (e.isDirectory()) collectFiles(full, out);
-    else if (CODE_EXT.has(path.extname(e.name))) out.push(full);
-  }
-  return out;
-}
-
-// Build { absPath: content } for the whole scan corpus.
-function buildCorpus() {
-  const files = [];
-  for (const d of SCAN_DIRS) collectFiles(path.join(REPO_ROOT, d), files);
-  const corpus = {};
-  for (const f of files) {
-    try { corpus[f] = fs.readFileSync(f, 'utf8'); } catch { /* skip unreadable */ }
-  }
-  return corpus;
-}
-
-// Pure core: given a target's absolute path + its exported symbol names + the
-// corpus ({absPath: content}), classify each export. A reference is a
-// word-boundary match of the symbol in any corpus file OTHER than the defining
-// file. Exported under tests/ only → test-only; nowhere → DEAD.
-function classifyExports(targetAbsPath, exportNames, corpus) {
-  const results = [];
-  for (const name of exportNames) {
-    const re = new RegExp(`\\b${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
-    let inSrcOrScripts = false;
-    let inTests = false;
-    for (const [file, content] of Object.entries(corpus)) {
-      if (file === targetAbsPath) continue; // self-references don't count
-      if (!re.test(content)) continue;
-      // A file is a test by virtue of living under a tests/ segment — checked
-      // on the raw path (not REPO_ROOT-relative) so the core stays pure +
-      // unit-testable with synthetic paths.
-      const isTest = /(^|[\\/])tests[\\/]/.test(file);
-      if (isTest) inTests = true;
-      else inSrcOrScripts = true;
-    }
-    const status = inSrcOrScripts ? 'consumed' : inTests ? 'test-only' : 'DEAD';
-    results.push({ name, status });
-  }
-  return results;
-}
-
-function run({ json = false } = {}) {
-  const corpus = buildCorpus();
-  const all = [];
-  for (const rel of TARGETS) {
-    const abs = path.join(REPO_ROOT, rel);
-    let mod;
-    try { mod = require(abs); } catch (err) {
-      console.error(`audit-exports: could not require ${rel}: ${err.message}`);
-      process.exitCode = 1;
-      continue;
-    }
-    const names = Object.keys(mod);
-    for (const r of classifyExports(abs, names, corpus)) {
-      all.push({ module: rel, ...r });
-    }
-  }
-
-  const dead = all.filter((r) => r.status === 'DEAD');
-  const testOnly = all.filter((r) => r.status === 'test-only');
-
-  if (json) {
-    console.log(JSON.stringify({ dead, test_only: testOnly, all }, null, 2));
-  } else {
-    console.log(`audit-exports: ${all.length} exported symbol(s) across ${TARGETS.length} module(s)`);
-    if (dead.length) {
-      console.log(`\n  DEAD (no consumer anywhere — un-export or delete):`);
-      for (const r of dead) console.log(`    ✗ ${r.module} → ${r.name}`);
-    }
-    if (testOnly.length) {
-      console.log(`\n  test-only (exported but used only by tests):`);
-      for (const r of testOnly) console.log(`    • ${r.module} → ${r.name}`);
-    }
-    if (!dead.length) console.log('  no dead exports — every exported symbol has a consumer ✓');
-  }
-
-  if (dead.length) process.exitCode = 1;
-  return { dead, testOnly, all };
-}
-
-if (require.main === module) {
-  run({ json: process.argv.includes('--json') });
-}
-
-module.exports = { classifyExports, buildCorpus, run, TARGETS };