@bongos/core 1.21.175 → 1.21.177

package/scripts/bongos/fitness.js

@@ -0,0 +1,1498 @@
+#!/usr/bin/env node
+'use strict';
+// fitness.js — architecture fitness functions (Path C / ADR 0062 §9, task 1225).
+//
+// The ENFORCEMENT layer for the Cloud Bongos decoupling. A dependency-cruiser/ArchUnit-style gate that
+// keeps the architecture from silently rotting back together. Each check is a pure function over
+// the repo on disk returning { name, ok, hardFail, violations[], warnings[], note }. The CLI runs
+// them all, prints a report, and exits non-zero on any hard failure. tests/fitness.mjs asserts
+// each check passes, so the DB-free unit gate (run-unit-tests.js → the `unit` required check)
+// enforces them on every PR — no new workflow needed.
+//
+// RATCHET, not big-bang. The structural epics that physically separate the core (R51 entrypoint
+// #1190, R52 DB carve-out #1191, R54 module system #1193) are not built yet, so the codebase is
+// still fused (every src/bongos/*.js shares the game's pg Pool via require('../db')). These checks
+// therefore lock in the boundary DIRECTION now and fail only on NEW violations beyond a documented
+// grandfather list; as the epics land they SHRINK the grandfather list. Module-level boundary
+// enforcement (§4) tightens once R54 (#1193) gives us a module manifest to check against.
+//
+// Usage:
+//   node scripts/bongos/fitness.js          # run all checks, print report, exit 1 on any hard failure
+//   node scripts/bongos/fitness.js --json    # machine-readable report
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { checkRankGuards, checkModulePinKeysResolve } = require('./fitness-checks-route-pins.js'); // Checks 4 + 4b — carved out by task 1003192 (the 1,500-line ratchet)
+const genApiDocs = require('./gen-api-docs'); // R12 (#1999): reuse the route model (readsBody/validated) that drives the OpenAPI spec
+const { parseRoutineFrontmatter } = require('./run-routine'); // System 4 (ADR 0078): deterministic-routine boundary
+const { filenameViolation, stemCollisions, numberCollisions, CORE_NS, INSTANCE_NS } = require('./migration-namespace'); // ADR 0108 §5: cross-repo migration namespacing
+const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config'); // ADR 0108 §1: configurable-root
+
+// task 1003206 (goal 1000079): fitness.js was 2,004 lines. Four cohesive pieces now
+// live beside it — the shared roots/walkers and three check clusters. They are
+// IMPORTED (not registered by path) so the CHECKS array and module.exports below
+// stay byte-identical to the single-file version every test was written against.
+const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, runChecks, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
+const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
+const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
+const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, PRELAUNCH_SURFACE, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkPrelaunchVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
+const { checkCoreRequiresExcludedConfig, checkCoreRequiresExcludedModule } = require('./fitness-checks-packaging.js'); // Checks 16 + 16b — carved out by task 1003825 (the 1,500-line ratchet)
+const { FLAT_ERROR_BASELINE, checkErrorEnvelope, countFlatErrors, scanFlatErrorSites } = require('./fitness-checks-error-envelope.js'); // Check 17 — carved out by task 1003825
+// ============================================================================
+// Check 1 — core ↔ host/game import boundary (ADR 0062 §1 cut-line)
+// ============================================================================
+//
+// The portable core (src/bongos/) must not import the HOST GAME runtime. After BV1.R49 the game
+// module lives in modules/game/ (rooms, world, db, seats, public, migrations). The only game-
+// related file that stays in src/ is src/preview-server.js (the game-only sandbox entrypoint).
+// Imports into scripts/ (build tooling / engine) are NOT host-game coupling.
+const HOST_GAME = [
+  /^modules\/game\//,           // everything in the game module (moved from src/ by BV1.R49)
+  /^src\/preview-server\.js$/,  // game-only sandbox entrypoint (stays in src/)
+];
+// Empty as of R52/#1191 — the core owns its pool (src/bongos/pool.js) and no longer imports the
+// game's db helper. The boundary now enforces with ZERO grandfathered exceptions.
+const GRANDFATHERED = new Set([]);
+const REQUIRE_RE = /require\(\s*['"](\.\.?\/[^'"]+)['"]\s*\)/g;
+
+function resolvesToHostGame(fromAbsFile, spec) {
+  const abs = path.resolve(path.dirname(fromAbsFile), spec);
+  const r = rel(abs);
+  for (const cand of [r, r + '.js', r.replace(/\/$/, '') + '/index.js']) {
+    if (GRANDFATHERED.has(cand)) return null; // allowed (and not a violation)
+    if (HOST_GAME.some((re) => re.test(cand))) return cand;
+  }
+  return null;
+}
+
+function checkCoreHostBoundary() {
+  const coreDir = path.join(REPO_ROOT, 'src', 'bongos');
+  const violations = [];
+  for (const abs of walkJs(coreDir)) {
+    // scan line-by-line, skipping comment lines so a require(...) quoted in a doc comment
+    // (e.g. explaining the boundary) is never mistaken for a real import.
+    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
+      const trimmed = raw.trim();
+      if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) continue;
+      let m;
+      REQUIRE_RE.lastIndex = 0;
+      while ((m = REQUIRE_RE.exec(raw))) {
+        const target = resolvesToHostGame(abs, m[1]);
+        if (target) violations.push(`${rel(abs)} → require('${m[1]}') reaches host-game code (${target}) — the core must not import the game runtime (ADR 0062 §1).`);
+      }
+    }
+  }
+  return {
+    name: 'core↔host import boundary',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `src/bongos/ must not import the host game runtime (grandfathered: ${[...GRANDFATHERED].join(', ') || 'none'} — severed by R52/#1191).`,
+  };
+}
+
+// ============================================================================
+// Check 2 — root CLAUDE.md size budget + charter presence (ADR 0061)
+// ============================================================================
+const ROOT_HARD_MAX = 300; // ceiling: the always-loaded file must never balloon past this. Ratcheted
+                           // 360→310 when task 1226 generated the §13 session-log index (was a ~58-line
+                           // hand-maintained list), then 310→300 when task 1283 trimmed the quick-nav
+                           // table + §2/§8/§9/§10/§12 verbose prose down to ~294 lines. Lower further as
+                           // more detail relocates to nested docs / ADRs (ADR 0061).
+const ROOT_TARGET = 200;   // the charter's stated aim; keep ratcheting toward it.
+
+// The line count is a structure/readability proxy; the cost paid EVERY session is
+// characters/tokens. A 600-char quick-nav row is one line but ~150 tokens, so
+// within-line bloat slips past ROOT_HARD_MAX entirely (exactly what task 1283
+// trimmed). Guard the real cost too (task 1286). Ratcheted just above the
+// post-1283 size (~39.5K chars / ~9.9K tok); lower alongside ROOT_HARD_MAX as
+// detail relocates to nested docs / ADRs.
+const ROOT_CHAR_HARD_MAX = 42000; // ~10.5K tokens — the always-loaded file must never balloon past this.
+const ROOT_CHAR_TARGET = 32000;   // ~8K tokens — aspirational, mirrors the ~200-line aim.
+const estTokens = (n) => Math.round(n / 4); // ~4 chars/token for markdown prose.
+
+// Where the charter BODY lives since task 1003687. It is guidance for EDITING a
+// CLAUDE.md, so it is paths-scoped (`paths:` frontmatter, same mechanism as
+// .claude/rules/hook-authoring.md) and costs nothing in the sessions — the large
+// majority — that never open one. The kernel keeps the heading and a pointer.
+const CHARTER_RULE_REL = '.claude/rules/claudemd-authoring.md';
+
+function checkClaudeMdBudget(opts = {}) {
+  const p = path.join(INSTANCE_ROOT, 'CLAUDE.md'); // the root CLAUDE.md is INSTANCE content (materialized per instance; ADR 0108)
+  const text = opts.text != null ? opts.text : fs.readFileSync(p, 'utf8');
+  const lines = text.split('\n').length;
+  const violations = [];
+  const warnings = [];
+  if (lines > ROOT_HARD_MAX) {
+    violations.push(`CLAUDE.md is ${lines} lines — over the ${ROOT_HARD_MAX}-line hard ceiling. It loads in full every session; relocate detail to a nested CLAUDE.md / ADR / recipe (ADR 0061).`);
+  } else if (lines > ROOT_TARGET) {
+    warnings.push(`CLAUDE.md is ${lines} lines — over the ~${ROOT_TARGET}-line target (still under the ${ROOT_HARD_MAX} ceiling). Relocate more detail to nested CLAUDE.md / ADRs / recipes (ADR 0061), then lower ROOT_HARD_MAX as it shrinks.`);
+  }
+  const chars = text.length;
+  const tok = estTokens(chars);
+  if (chars > ROOT_CHAR_HARD_MAX) {
+    violations.push(`CLAUDE.md is ${chars} chars (~${tok} tokens) — over the ${ROOT_CHAR_HARD_MAX}-char (~${estTokens(ROOT_CHAR_HARD_MAX)}-token) hard ceiling. The line count may be fine, but the per-session token cost is not — trim verbose prose WITHIN lines (long quick-nav rows, restated rationale), not just whole lines (ADR 0061).`);
+  } else if (chars > ROOT_CHAR_TARGET) {
+    warnings.push(`CLAUDE.md is ${chars} chars (~${tok} tokens) — over the ~${ROOT_CHAR_TARGET}-char (~${estTokens(ROOT_CHAR_TARGET)}-token) target. This is the true per-session cost; within-line bloat (a 600-char table row is one line) escapes the line check. Trim prose, then lower ROOT_CHAR_HARD_MAX.`);
+  }
+  if (!text.includes('## Working with this file (content charter)')) {
+    violations.push('CLAUDE.md is missing the content-charter section (ADR 0061) — the per-line test + "what goes where" table must stay.');
+  } else {
+    // Task 1003687 relocated the charter BODY to a paths-scoped rule, so the kernel
+    // keeps the heading and a pointer. That makes the heading cheap to fake: a section
+    // with nothing behind it satisfies a substring check while the rules it names are
+    // gone. So the charter must resolve to something — either inline here, or through a
+    // pointer whose target actually exists and still carries the two rules + the table.
+    const namesRule = text.includes(CHARTER_RULE_REL);
+    const inlineCharter = text.includes('Per-line test:');
+    if (namesRule) {
+      const rulePath = path.join(INSTANCE_ROOT, CHARTER_RULE_REL); // .claude/ is materialized INSTANCE content (ADR 0108 §3)
+      if (!fs.existsSync(rulePath)) {
+        violations.push(`CLAUDE.md points its content charter at ${CHARTER_RULE_REL}, but that file does not exist — a pointer to nothing is worse than no pointer (ADR 0061 / task 1003687).`);
+      } else {
+        const rule = fs.readFileSync(rulePath, 'utf8');
+        const missing = [];
+        if (!/^---\r?\n[\s\S]*?\bpaths:[\s\S]*?["']\*\*\/CLAUDE\.md["'][\s\S]*?^---$/m.test(rule)) {
+          missing.push('`paths:` frontmatter matching `**/CLAUDE.md` (without it the rule never loads, and the charter is simply gone)');
+        }
+        if (!rule.includes('Per-line test:')) missing.push('the per-line test');
+        if (!rule.includes('## What goes where')) missing.push('the "what goes where" table');
+        if (missing.length) {
+          violations.push(`${CHARTER_RULE_REL} is missing ${missing.join(', ')} — the kernel delegates the charter to it, so the charter is only as real as that file (ADR 0061 / task 1003687).`);
+        }
+      }
+    } else if (!inlineCharter) {
+      violations.push('The CLAUDE.md content-charter section is hollow — it has the heading but neither the per-line test inline nor a pointer to `' + CHARTER_RULE_REL + '`. The heading exists to make the rules findable; on its own it only satisfies this check (ADR 0061).');
+    }
+  }
+  return { name: 'root CLAUDE.md budget + charter', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings, note: `≤ ${ROOT_HARD_MAX} lines / ${ROOT_CHAR_HARD_MAX} chars (~${estTokens(ROOT_CHAR_HARD_MAX)} tok); targets ~${ROOT_TARGET} lines / ~${estTokens(ROOT_CHAR_TARGET)} tok; charter resolves (inline or via ${CHARTER_RULE_REL}).` };
+}
+
+// ============================================================================
+// Check 3 — nested per-module CLAUDE.md presence for high-traffic dirs (ADR 0061)
+// ============================================================================
+const HIGH_TRAFFIC = ['src/bongos', 'src/bongos/routes', 'scripts/bongos'];
+
+function checkNestedDocsPresent() {
+  const violations = [];
+  for (const dir of HIGH_TRAFFIC) {
+    // HIGH_TRAFFIC dirs (src/bongos, src/bongos/routes, scripts/bongos) are CORE-package dirs — resolve
+    // against the core root, not the instance repo (ADR 0108 §Consequences #4).
+    const doc = path.join(CORE_ROOT, dir, 'CLAUDE.md');
+    if (!fs.existsSync(doc)) violations.push(`${dir}/CLAUDE.md is missing — high-traffic dirs must carry a nested altitude map (ADR 0061).`);
+  }
+  return { name: 'nested CLAUDE.md presence', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: `present for: ${HIGH_TRAFFIC.join(', ')}.` };
+}
+
+// ============================================================================
+// Check 5 — generated artifacts are fresh (Path C enforces Path B; ADR 0063 + ADR 0062 §8)
+// ============================================================================
+// Deterministic file-reads with a `--check` mode (regenerate in-memory, diff, exit non-zero on
+// drift). This gate fails a PR that committed a stale artifact so the "generate, don't hand-maintain"
+// contract can't rot.
+// ADR 0110 (task 1926): docs/repo-map.md + docs/session-log-index.md are now GITIGNORED and
+// regenerated at deploy/box-fetch (the gen-atlas.js model), so parallel branches never collide on
+// them — and there is no committed copy to gate. Their generators are DUAL-DUTY, though: each also
+// refreshes a TRACKED embedded block (the nested CLAUDE.md symbol blocks; the CLAUDE.md §13 snippet).
+// Those blocks stay committed, so we gate the BLOCK bucket HARD via `--check-block`. A naive `--check`
+// here would false-fail every PR (the gitignored whole file is absent from a clean checkout, so it
+// always reads as "would change"); `--check-block` is the exact, non-noisy gate. (docs/file-map.md +
+// the OpenAPI docs are still fully committed and unchanged by ADR 0110 — they keep the plain --check.)
+function checkGeneratedArtifactsFresh() {
+  const violations = [];
+  try {
+    execFileSync(process.execPath, [path.join(__dirname, 'gen-repo-map.js'), '--check-block'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('The tracked nested-doc symbol blocks (src/bongos/CLAUDE.md, src/bongos/routes/CLAUDE.md) are STALE — run `node scripts/bongos/gen-repo-map.js` and commit (ADR 0063 / ADR 0110). NB docs/repo-map.md itself is gitignored + deploy-regenerated, not gated here.');
+  }
+  try {
+    execFileSync(process.execPath, [path.join(__dirname, 'gen-session-index.js'), '--check-block'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('The tracked CLAUDE.md §13 recent-sessions snippet is STALE — run `node scripts/bongos/gen-session-index.js` and commit (ADR 0062 §8 / ADR 0110). NB docs/session-log-index.md itself is gitignored + deploy-regenerated, not gated here.');
+  }
+  try {
+    // task 1002515 (criterion `accessibility-fluency-profile`, clause 2): the CLAUDE.md §2
+    // fallback posture is generated from the interaction knob's own defaults, so the kernel
+    // and modules/builder-settings/interaction-prefs.js cannot drift into two copies of one
+    // rule — which is what they were. Fully tracked (unlike the ADR 0110 pair above), so a
+    // plain --check is the right gate.
+    execFileSync(process.execPath, [path.join(__dirname, 'gen-interaction-posture.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('The CLAUDE.md §2 interaction-posture block is STALE — it is generated from modules/builder-settings/interaction-prefs.js. Run `node scripts/bongos/gen-interaction-posture.js` and commit (task 1002515).');
+  }
+  try {
+    execFileSync(process.execPath, [path.join(__dirname, 'gen-file-map.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('docs/file-map.md generated sections (.claude/skills/, .claude/scheduled-tasks/) are STALE, a skill/routine has no note in docs/file-map.notes.json, or a directory under modules/ has no file-map entry at all — run `node scripts/bongos/gen-file-map.js --check` for the exact list, then fix and commit (ADR 0066; module coverage: task 1004066).');
+  }
+  try {
+    // Also structurally validates the spec (exit 1 on invalid OpenAPI 3.1) beyond the drift check (exit 2). Task 1918.
+    execFileSync(process.execPath, [path.join(__dirname, 'gen-api-docs.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('The API spec generated from the routes is not valid OpenAPI 3.1, or the committed docs/routes-permissions.md stub is STALE — run `node scripts/bongos/gen-api-docs.js --check` for the detail (task 1918). The spec + reference themselves are gitignored (task 1004866).');
+  }
+  // task 1004866: the client is gitignored, so the gate is "a client built from the routes compiles".
+  try { execFileSync(process.execPath, [path.join(__dirname, 'gen-api-client.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' }); }
+  catch { violations.push('The typed API client could not be generated from the routes — run `node scripts/bongos/gen-api-client.js --check` for the detail (task 1004866).'); }
+  try {
+    // task 1003556: the copy registry's rows carry LINE NUMBERS, so editing any scanned
+    // UI file stales it. It was covered only by ship-check's OPTIONAL step, which a
+    // builder has to remember to run — so the first signal was CI failing on the PR's
+    // MERGE ref, where the shift is hardest to attribute. Gated here so a local fitness
+    // run says so first.
+    execFileSync(process.execPath, [path.join(__dirname, 'copy-inventory.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('docs/copy-registry.json + docs/copy-inventory.md are STALE — every row carries a line number, so editing any scanned UI file shifts them. Run `node scripts/bongos/copy-inventory.js` and commit (task 1003556).');
+  }
+  try {
+    // task 1004314 (BV2.TW02): the page inventory is the key Tweak Mode's page status,
+    // claims and pay join on, so a page added, renamed or retitled without it would
+    // be a page the chain cannot see. --check also fails on a duplicate or malformed id.
+    execFileSync(process.execPath, [path.join(__dirname, 'page-inventory.js'), '--check'], { cwd: REPO_ROOT, stdio: 'pipe' });
+  } catch {
+    violations.push('docs/page-inventory.json + docs/page-inventory.md are STALE (or two pages claim one id) — a page was added, renamed, retitled or changed its scripts/states. Run `node scripts/bongos/page-inventory.js` and commit (task 1004314).');
+  }
+  // NB the role packs' responsibility blocks are generated too, but their freshness
+  // is asserted by role-pack-guard.js — one check owns "the packs are correct".
+  return { name: 'generated artifacts fresh', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note: 'Tracked generated content matches source: nested CLAUDE.md symbol blocks (code) + the CLAUDE.md §13 snippet (sessions) via --check-block, plus the CLAUDE.md §2 interaction-posture block (the knob defaults), docs/file-map.md skills/scheduled-tasks sections, the API spec + typed client GENERATE from the routes (both gitignored, task 1004866), docs/copy-registry.json + copy-inventory.md (the reader-facing copy, task 1003556) and docs/page-inventory.json + page-inventory.md (every page and its stable id, task 1004314). The gitignored docs/repo-map.md + docs/session-log-index.md are deploy-regenerated (ADR 0110), not gated here.' };
+}
+
+// ---- deterministic cron routine boundary (System 4 / ADR 0078) -------------
+//
+// A `mode: deterministic` routine runs as plain node via run-routine.js — NO
+// model session reads its SKILL body. So that body must not rot back into a
+// wrapped session: it may not instruct a model to mutate (Edit/Write/git
+// push/commit/deploy) or synthesize free text, and its documented commands must
+// not diverge from its declared steps. Keeps the markdown-graveyard pattern out.
+
+const SCHEDULED_TASKS_DIR = path.join(INSTANCE_ROOT, '.claude', 'scheduled-tasks'); // .claude/ is materialized INSTANCE content (ADR 0108 §3)
+
+// Judgment/mutation instructions illegal in a deterministic body. Negated
+// mentions ("never pushes", "does NOT edit") are descriptive boundaries — allowed.
+const JUDGMENT_PATTERNS = [
+  { re: /\bgit\s+(push|commit|add)\b/i, label: 'a git push/commit/add' },
+  { re: /deploy\.sh\b/i, label: 'a deploy.sh invocation' },
+  { re: /`(Edit|Write|MultiEdit|NotebookEdit)`/, label: 'an Edit/Write tool instruction' },
+  { re: /\bsynthesi[sz]e\b/i, label: 'free-text synthesis' },
+  { re: /\b(write|compose|draft)\s+(a|an|the)\s+(summary|report|analysis|narrative|note)\b/i, label: 'free-text synthesis' },
+];
+const NEGATION_RE = /\b(never|not|no|without|cannot|can't|don'?t|doesn'?t|won'?t)\b/i;
+
+// Pure: scan one routine's parsed (mode, steps, body). Returns violation strings.
+// Only inspects deterministic routines; others return []. Exported for tests.
+function scanDeterministicBody(name, { mode, steps, body }) {
+  if (mode !== 'deterministic') return [];
+  const violations = [];
+  if (!steps || steps.length === 0) {
+    violations.push(`${name}: mode: deterministic but no steps: — run-routine.js would launch nothing (ADR 0078).`);
+  }
+  const text = String(body == null ? '' : body);
+  for (const raw of text.split('\n')) {
+    const line = raw.trim();
+    if (!line || NEGATION_RE.test(line)) continue; // skip blank + negated (boundary) lines
+    for (const p of JUDGMENT_PATTERNS) {
+      if (p.re.test(line)) {
+        violations.push(`${name}: deterministic SKILL body contains ${p.label} ("${line.slice(0, 70)}") — it runs as plain node with no model; move remediation/judgment to a separate claimed task (ADR 0078).`);
+      }
+    }
+  }
+  // Divergence: every `node …` command in a fenced code block must be a declared step.
+  const stepCmds = (steps || []).map((s) => String(s.command).replace(/\s+/g, ' ').trim());
+  for (const fence of text.match(/```[\s\S]*?```/g) || []) {
+    for (const fl of fence.split('\n')) {
+      const cmd = fl.trim().replace(/\s+/g, ' ');
+      if (!cmd.startsWith('node ')) continue;
+      if (!stepCmds.some((s) => cmd === s || cmd.startsWith(s) || s.startsWith(cmd))) {
+        violations.push(`${name}: deterministic SKILL body documents \`${cmd.slice(0, 70)}\` which is not in its steps: — prose and steps must not diverge (ADR 0078).`);
+      }
+    }
+  }
+  return violations;
+}
+
+function checkDeterministicRoutines() {
+  const violations = [];
+  let detCount = 0;
+  let dirs = [];
+  try {
+    dirs = fs.readdirSync(SCHEDULED_TASKS_DIR, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch (_) { /* no scheduled-tasks dir → nothing to check */ }
+  for (const name of dirs) {
+    let md;
+    try { md = fs.readFileSync(path.join(SCHEDULED_TASKS_DIR, name, 'SKILL.md'), 'utf8'); } catch (_) { continue; }
+    const { mode, steps } = parseRoutineFrontmatter(md);
+    if (mode !== 'deterministic') continue;
+    detCount += 1;
+    const body = md.replace(/^---\n[\s\S]*?\n---\n?/, ''); // strip frontmatter
+    violations.push(...scanDeterministicBody(name, { mode, steps, body }));
+  }
+  return {
+    name: 'deterministic cron routines (ADR 0078)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${detCount} mode:deterministic routine(s): steps declared, no judgment instructions, prose↔steps aligned.`,
+  };
+}
+
+// ============================================================================
+// Check 7/8 — module boundary (the one-way rule, ADR 0083 / design 04§3)
+// ============================================================================
+//
+// The module system's one-way rule: a module imports ONLY src/module-api.js (the
+// published doorway); the core NEVER imports a module; a module NEVER imports a
+// sibling module. These two checks enforce it.
+//
+// Both were GREEN through the strangler: the first two moved modules (M07/M08)
+// imported only the doorway, and the core imported neither. The boundary
+// shipped in WARN mode so a half-moved module mid-migration couldn't red the
+// build; BV1.R45 (task 1414) flips it to ENFORCING now that the first move
+// (M07) proved clean — the monotonic ratchet (ADR 0062 §9 / design
+// 04§3). A NEW cross-boundary import is now a red build; warn-mode is gone.
+let MODULE_BOUNDARY_ENFORCING = true;
+const MODULE_API_REL = 'src/module-api.js';
+
+// If `spec` (a relative require) from `fromAbsFile` resolves into modules/<key>/,
+// return <key>; else null. Pure path math — no fs.
+function resolvesToModule(fromAbsFile, spec) {
+  const abs = path.resolve(path.dirname(fromAbsFile), spec);
+  const r = rel(abs);
+  const m = /^modules\/([^/]+)(\/|$)/.exec(r);
+  return m ? m[1] : null;
+}
+
+// The module a core/module file belongs to, or null if it isn't under modules/.
+function moduleOwnerOf(absFile) {
+  const m = /^modules\/([^/]+)\//.exec(rel(absFile));
+  return m ? m[1] : null;
+}
+
+// For a require `spec` inside a MODULE file, return a violation string or null.
+// Allowed: src/module-api.js (the doorway), intra-module relatives, and bare
+// (npm/node) specs. Forbidden: deep core imports + sibling-module imports.
+function moduleImportViolation(fromAbsFile, spec) {
+  const ownKey = moduleOwnerOf(fromAbsFile);
+  if (!ownKey) return null; // not a module file
+  const absTarget = path.resolve(path.dirname(fromAbsFile), spec);
+  const r = rel(absTarget);
+  // resolve possible file forms
+  const forms = [r, r + '.js', r.replace(/\/$/, '') + '/index.js'];
+  if (forms.includes(MODULE_API_REL)) return null; // the doorway — allowed
+  const otherKey = (() => { const m = /^modules\/([^/]+)(\/|$)/.exec(r); return m ? m[1] : null; })();
+  if (otherKey) {
+    if (otherKey === ownKey) return null; // intra-module — allowed
+    return `${rel(fromAbsFile)} → require('${spec}') reaches sibling module "${otherKey}" — modules must not import each other (use a kernel seam; ADR 0083).`;
+  }
+  if (/^src\//.test(r)) {
+    return `${rel(fromAbsFile)} → require('${spec}') reaches core internals (${r}) — a module may import only the published doorway src/module-api.js (ADR 0083).`;
+  }
+  return null; // outside the repo (node/npm) — not our concern
+}
+
+function checkCoreNeverImportsModule() {
+  const findings = [];
+  const roots = [path.join(REPO_ROOT, 'src'), path.join(REPO_ROOT, 'server.js')];
+  for (const root of roots) {
+    for (const abs of walkJs(root)) {
+      if (moduleOwnerOf(abs)) continue; // module files are scanned by the other check
+      if (HOST_GAME.some((re) => re.test(rel(abs)))) continue; // game-owned files that live in src/ (e.g. preview-server.js) may import game module
+      for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
+        const t = raw.trim();
+        if (t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) continue;
+        let m; REQUIRE_RE.lastIndex = 0;
+        while ((m = REQUIRE_RE.exec(raw))) {
+          const key = resolvesToModule(abs, m[1]);
+          if (key) findings.push(`${rel(abs)} → require('${m[1]}') reaches module "${key}" — the core must never import a module (ADR 0083).`);
+        }
+      }
+    }
+  }
+  const enforcing = MODULE_BOUNDARY_ENFORCING;
+  return {
+    name: 'core never imports a module',
+    ok: findings.length === 0,
+    hardFail: enforcing && findings.length > 0,
+    violations: enforcing ? findings : [],
+    warnings: enforcing ? [] : findings,
+    note: `core (src/, server.js) must not require modules/* — ${enforcing ? 'ENFORCING' : 'warn-mode until BV1.R45'} (ADR 0083).`,
+  };
+}
+
+function checkModulesImportOnlyApi() {
+  const findings = [];
+  for (const abs of walkJsAllRoots('modules')) { // modules ship from BOTH roots (ADR 0108 §Consequences #4)
+    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
+      const t = raw.trim();
+      if (t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) continue;
+      let m; REQUIRE_RE.lastIndex = 0;
+      while ((m = REQUIRE_RE.exec(raw))) {
+        const v = moduleImportViolation(abs, m[1]);
+        if (v) findings.push(v);
+      }
+    }
+  }
+  const enforcing = MODULE_BOUNDARY_ENFORCING;
+  return {
+    name: 'modules import only the published API',
+    ok: findings.length === 0,
+    hardFail: enforcing && findings.length > 0,
+    violations: enforcing ? findings : [],
+    warnings: enforcing ? [] : findings,
+    note: `modules/** may require only src/module-api.js (no deep core, no sibling) — ${enforcing ? 'ENFORCING' : 'warn-mode until BV1.R45'} (ADR 0083).`,
+  };
+}
+
+// ============================================================================
+// Check 9 — the goal scope map imports PROTECTED_GLOBS, never re-declares it
+//           (ADR 0086 §7; the SEC #863 "second list that drifts" failure mode)
+// ============================================================================
+//
+// src/bongos/module-scope-map.js (BV1.R54) derives each module's `protected` flag
+// from PROTECTED_GLOBS. That derivation is only trustworthy if it reads the ONE
+// source (permission-path-check.js) — a hand-copied second list would silently
+// drift from the real protected set and quietly de-protect a module. This check
+// reds the build if the scope map stops importing PROTECTED_GLOBS, or copies it.
+const SCOPE_MAP_REL = 'src/bongos/module-scope-map.js';
+
+// Pure: scan the scope-map source for the import contract. Exported for the
+// "actually catches a violation" test (mirrors scanDeterministicBody).
+function scanScopeMapSource(src) {
+  const violations = [];
+  const text = String(src || '');
+  const importsFrom = /require\(\s*['"]\.\/permission-path-check['"]\s*\)/.test(text);
+  const namesIt = /\bPROTECTED_GLOBS\b/.test(text);
+  if (!importsFrom || !namesIt) {
+    violations.push(`${SCOPE_MAP_REL} must IMPORT PROTECTED_GLOBS from ./permission-path-check and derive \`protected\` from it — never hand-maintain a second protected list (ADR 0086 §7).`);
+  }
+  if (/\b(?:const|let|var)\s+PROTECTED_GLOBS\s*=/.test(text)) {
+    violations.push(`${SCOPE_MAP_REL} re-declares PROTECTED_GLOBS — it must import the single source from permission-path-check.js, not copy it (ADR 0086 §7; the SEC #863 second-list failure mode).`);
+  }
+  return violations;
+}
+
+function checkScopeMapImportsProtected() {
+  const abs = path.join(REPO_ROOT, SCOPE_MAP_REL);
+  let src = null;
+  try { src = fs.readFileSync(abs, 'utf8'); } catch (_) { /* absent → skip */ }
+  // Absent → clean pass: the scope map is a BV1.R54 deliverable; until it exists
+  // there is no import contract to enforce (its own unit test asserts existence).
+  const violations = src == null ? [] : scanScopeMapSource(src);
+  return {
+    name: 'scope map imports PROTECTED_GLOBS (ADR 0086)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: src == null
+      ? `${SCOPE_MAP_REL} absent — skipped (created by BV1.R54).`
+      : `${SCOPE_MAP_REL} derives \`protected\` from the imported PROTECTED_GLOBS (single source; no copied list).`,
+  };
+}
+
+// ============================================================================
+// Check 10 — core carries no module-specific code (ADR 0083 §Decision #4 / design 04§3)
+// ============================================================================
+//
+// The module-system MACHINERY (the doorway + loader + seam registry) must stay
+// module-AGNOSTIC: it discovers, validates, and mounts modules uniformly and may
+// never special-case one by name. The import checks (Check 7/8) stop a module's
+// CODE from being reached by `require`; this stops a module's IDENTITY from being
+// hardcoded into the kernel (`if (key === 'art-pipeline') …`, a copied module helper,
+// a registry entry that should have moved out). "No module-specific code" is
+// operationalized as the one drift-free signal — the kernel names no discovered
+// module KEY (the canonical id from modules/<key>/module.json). Domain terms are
+// deliberately NOT pattern-matched: they're non-deterministic and the doorway
+// legitimately re-exports capability accessors (getBuilderGeminiKeyRow, …); the
+// KEY is the precise thing a generic kernel never needs to write.
+//
+// Scope (BV1.R70 / ADR 0091 §1): the real ~3.5k-LOC TRUST KERNEL — the module-
+// system machinery PLUS the trust primitives + data substrate + config/identity
+// the rest of core depends on. This replaces the original 6-file machinery-only
+// roster (the kernel was unbounded before — the audit's finding). Deliberately
+// EXCLUDED: the still-fused monolith remnants (src/bongos/db.js, routes/me.js,
+// routes.js, server.js) still carry un-stranglered module seams by design
+// (lifecycle + tranche-2 domains leave later) — scanning them would red the
+// build on intentional state. Comment lines are skipped (a key named in a
+// doc/example comment is documentation, not code), and the scope-map registry is
+// exempt from the no-module-keys scan (see KERNEL_NAMES_MODULES_OK).
+const KERNEL_FILES = [
+  // module-system machinery (the original roster)
+  'src/module-api.js',                    // the published doorway
+  'src/modules.js',                       // the registry/resolver facade
+  'src/module-seams.js',                  // the seam registry (ports/events/contributions)
+  'src/role-responsibilities.js',         // the owner's written role statements (task 1003732) — modules.js reads it; imports nothing
+  'src/module-loader/loader.js',          // the disk loader (discover → validate → mount)
+  'src/module-loader/manifest-schema.js', // the manifest validator
+  'src/module-loader/semver.js',          // coreVersion compatibility
+  'src/module-loader/error-tally.js',     // per-module runtime-error counts the loader feeds (task 1004637)
+  'src/bongos/module-scope-map.js',          // the module→path registry (it NAMES every module — exempt below)
+  // trust primitives (ADR 0091 §1) — the authz boundary + data substrate
+  'src/bongos/auth.js',                      // authz gates (requireBuilder/requireRank, ADR 0016)
+  // task 1003206 (goal 1000079) split auth.js's 1,867 lines into these five sign-in
+  // flow modules. They are the SAME kernel machinery, not new domain — auth.js is a
+  // kernel file, so if they were left off this roster the boundary check would read
+  // its own carve as five kernel→non-kernel leaks. Being on the roster also means
+  // each of them is itself held to the kernel import rule, which is the point.
+  'src/bongos/auth-config.js',               // provider config + OAuth scope selection
+  'src/bongos/auth-admission.js',            // membership kind, admission gate, first-admin seating
+  'src/bongos/auth-github.js',               // GitHub device + web OAuth flows
+  'src/bongos/auth-idp.js',                  // hub federation, assertion + logout-token verification
+  'src/bongos/auth-discord.js',              // Discord OAuth link + guild membership
+  'src/bongos/route-rank-check.js',          // deterministic route→rank classification
+  'src/bongos/permission-path-check.js',     // protected-path matcher (PROTECTED_GLOBS, ADR 0043)
+  'src/bongos/goal-scope-check.js',          // goal create-gate scope wall (composes the 3 matchers above; ADR 0086 §3, BV1.R60)
+  'src/bongos/secret-box.js',                // AES-256-GCM per-builder secret box
+  'src/bongos/pool.js',                      // the singleton Postgres pool accessor
+  // task 1003208: the structured logger is kernel infrastructure in the same sense
+  // the pool is — src/module-api.js hands every module a child of it, so it sits
+  // BELOW the module boundary, not beside a domain. It imports only node built-ins
+  // and pino, so joining the roster costs nothing and buys the import-direction
+  // guarantee on the file every module now logs through.
+  'src/bongos/logger.js',                    // pino + request correlation + ADR 0022 redaction
+  // task 1003339 (ADR 0209): the abuse ceiling is a trust primitive in the same
+  // sense the authz gates are — authz says WHO may ask, this says HOW OFTEN, and
+  // an unauthenticated read route has nothing else holding it. src/module-api.js
+  // now hands modules the shared account-existence limiter (the onboarding
+  // module's account-existence probe spends the same budget as core's), so it
+  // sits BELOW the module boundary exactly as logger.js does. It requires NOTHING
+  // — no relative imports at all — so joining the roster costs nothing and buys
+  // the import-direction guarantee on a file two surfaces now trust.
+  'src/bongos/middleware/rate-limit.js',     // the sliding-window abuse ceilings (write + per-surface read)
+  'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
+  // task 1002969 (ADR 0356): when an invite's door closes is part of the admission
+  // gate db-kernel.js runs, and the doorway hands the same definition to the
+  // onboarding and hub modules. It requires NOTHING, so joining costs nothing.
+  'src/bongos/invite-expiry.js',             // the read-time invite expiry (INVITE_EXPIRY_DAYS + its SQL)
+  'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
+  // config / identity (host context a module reads, never hardcodes)
+  'src/instance-config.js',
+  'src/branding.js',
+  // task 1004421 (ADR 0358): branding.js lays the chosen look over the pack through this
+  // file — the same identity/config category, requiring only instance-config and node
+  // built-ins, so it joins the roster rather than reading as a kernel→domain leak.
+  'src/hall-look.js',
+  'src/build-info.js',
+  // task 1003476 (goal 1000072): the project's stale-claim timer — host configuration
+  // a module reads rather than hardcodes, exactly the category instance-config.js and
+  // branding.js are in. The doorway (a KERNEL_FILE) re-exports it, so leaving it off
+  // this roster would read as a kernel->non-kernel leak; it imports only
+  // instance-config + node built-ins, so joining costs nothing.
+  'src/stale-timer.js',
+  // task 1003279 (goal 1000072, ADR 0232): the project's live knob store and the ROT
+  // timer resolver over it — the same category as stale-timer.js directly above (host
+  // configuration a module reads rather than hardcodes), differing only in living in
+  // the DB instead of the env, because task 1003280 requires that knob be changeable
+  // from a page without a redeploy. The doorway re-exports it, so leaving it off this
+  // roster reads as a kernel->non-kernel leak; it imports only pool.js (itself on this
+  // roster) + node built-ins, so joining costs nothing and buys the import-direction
+  // guarantee on the file every future project knob will be read through.
+  'src/bongos/project-settings.js',
+  // BV1.R86: the git-remote/slug + publish-target identity the doorway exposes
+  // (api.repoInfo) for the carved lifecycle github-push/conflict-resolve. It is
+  // KERNEL (already in the module-scope-map kernel key) and imports only the
+  // kernel (instance-config) + node built-ins, so it joins the roster cleanly.
+  'src/bongos/repo-info.js',
+  // task 1002331 (ADR 0182 D6 / ADR 0247): the project's composed join/apply door — a
+  // deterministic classifier over three policy values, the same category as
+  // route-rank-check.js and goal-scope-check.js above (a trust decision the doorway
+  // hands to modules so no module re-derives it). The doorway re-exports it, so
+  // leaving it off this roster reads as a kernel->non-kernel leak; it imports only
+  // branding.js, instance-config.js and logger.js — all on this roster — so joining
+  // costs nothing and buys the import-direction guarantee on the file that decides
+  // who may knock. (Task 1003579 moved joinabilityMode the other way: the gate reads
+  // the composed door, so reader and composer had to sit together or the two would
+  // cycle.) The ARTIST GATE joins for the same reason — task 1003575, ADR 0241.
+  'src/bongos/project-door.js', 'src/bongos/artist-gate.js',
+  // task 1004296 (ADR 0340 D5): the npm registry reader — packument, the in-process
+  // tarball stream and its small tar reader. It moved INTO the core because Settings →
+  // Software update needs it in every hall, and the doorway re-exports it
+  // (readPackageRegistry) for the module that publishes a package, so leaving it off
+  // this roster reads as a kernel->non-kernel leak. It imports only node built-ins
+  // (https, zlib), so joining costs nothing.
+  'src/bongos/package-registry.js',
+  // task 1004657 (ADR 0363 D5): requireActAlone, the gate a building's own page mounts
+  // after its permission gate — the same trust-gate category as auth.js, re-exported
+  // by the doorway, so leaving it off reads as a kernel->non-kernel leak. It imports
+  // only module-seams.js and logger.js (both on this roster) and reaches the
+  // government module through its port, never by require.
+  'src/bongos/act-alone.js',
+];
+
+// Kernel files exempt from the no-module-keys scan (Check 10) because naming a
+// module is, for them, the JOB — they stay in KERNEL_FILES for the import check
+// (Check 12), which guards dependency *direction* (a much stronger guarantee than
+// "never write the string 'art-pipeline'"). Two legitimate reasons a kernel file names
+// a module:
+//   • the REGISTRY — module-scope-map.js IS the module→path map (and
+//     checkScopeMapImportsProtected already guards how it derives `protected`).
+//   • the TRUST BOUNDARY — auth.js carries the Discord OAuth account-LINK flow
+//     (core by design — see modules/discord/CLAUDE.md "NOT in this module"); and
+//     permission-path-check.js / route-rank-check.js MUST name module path
+//     subtrees ('modules/grading/', …) to protect + rank-gate them. Forbidding
+//     these the string would force the trust layer to stop protecting module
+//     surfaces — exactly backwards. The generic machinery + data + config files
+//     (module-api, the loader, db-kernel, secret-box, pool, _helpers, branding,
+//     instance-config, build-info) are NOT exempt and must stay module-agnostic.
+const KERNEL_NAMES_MODULES_OK = new Set([
+  'src/bongos/module-scope-map.js',      // the module→path registry
+  // auth.js and the auth-*.js flow modules task 1003206 split out of it: the
+  // sign-in path legitimately names modules — it resolves the 'onboarding' and
+  // 'government' PORTS by key, and carries the Discord OAuth account-link flow
+  // (core by design — see modules/discord/CLAUDE.md "NOT in this module"). The
+  // exemption follows the code, exactly as the KERNEL_FILES roster above does;
+  // Check 12 still guards these files' dependency DIRECTION, which is the
+  // stronger guarantee.
+  'src/bongos/auth.js',                  // Discord OAuth account-link flow (core by design)
+  'src/bongos/auth-config.js',
+  'src/bongos/auth-admission.js',        // resolves the 'government' rank-role port by key
+  'src/bongos/auth-github.js',           // ticks the 'onboarding' port on first sign-in
+  'src/bongos/auth-idp.js',              // same, on the federated path
+  'src/bongos/auth-discord.js',          // the Discord account-link flow itself
+  'src/bongos/act-alone.js',             // resolves the 'government' port by key for checkActAlone (task 1004657)
+  'src/bongos/permission-path-check.js', // names module path subtrees to PROTECT them
+  'src/bongos/route-rank-check.js',      // names module route dirs to rank-gate them
+  'src/role-responsibilities.js',        // the ideator's VERBATIM statement reads "Make good ideas" — the English word, colliding with the `ideas` key. Owner text; unparaphrasable.
+]);
+
+// The discovered module keys = the directory names under modules/ (a manifest's
+// `key` must equal its dir name — manifest-schema). Empty before any move. With no explicit
+// `modulesDir` it UNIONS every module root (core package + instance repo, ADR 0108 §Consequences
+// #4); an explicit dir keeps the old single-dir behavior (tests). Deduped — a key resolves to
+// exactly one root (the loader errors on a cross-root collision), and today the roots coincide.
+function _moduleKeysIn(modulesDir) {
+  try {
+    return fs.readdirSync(modulesDir, { withFileTypes: true })
+      .filter((d) => d.isDirectory())
+      .map((d) => d.name);
+  } catch { return []; }
+}
+function discoveredModuleKeys(modulesDir) {
+  if (modulesDir) return _moduleKeysIn(modulesDir);
+  const keys = new Set();
+  for (const root of MODULE_ROOTS) for (const k of _moduleKeysIn(path.join(root, 'modules'))) keys.add(k);
+  return [...keys];
+}
+// task 1002790: two questions, previously conflated and asserted EQUAL. BROAD
+// (every dir) stays broad — the migration checks need it, since a .sql in a
+// manifest-less dir must still be namespace/stem-checked (schema_migrations is
+// stem-keyed; a collision is silently SKIPPED). NARROW = carries module.json,
+// which is what makes a module a module (ADR 0083) and what kernel-naming means.
+function manifestModuleKeys(modulesDir) {
+  const manifested = (dir) => _moduleKeysIn(dir).filter((k) => fs.existsSync(path.join(dir, k, 'module.json')));
+  if (modulesDir) return manifested(modulesDir);
+  return [...new Set(MODULE_ROOTS.flatMap((r) => manifested(path.join(r, 'modules'))))];
+}
+// The DIFFERENCE as an instruction, not a bare diff — and a WARNING, because a
+// dir without a manifest is the normal transient shape of scaffolding a module.
+function manifestlessModuleDirs(modulesDir) {
+  const narrow = new Set(manifestModuleKeys(modulesDir));
+  return discoveredModuleKeys(modulesDir).filter((k) => !narrow.has(k)).sort().map((k) =>
+    `modules/${k}/ has no module.json — it is a directory, not a module. Add the manifest (ADR 0083) or remove the dir. Warning, not a failure: scaffolding a module dir before its manifest is normal and must not red CI.`);
+}
+// Absolute path to a discovered module's dir, resolving WHICH root holds it (core package or
+// instance repo). Today both roots coincide → the single checkout.
+function moduleDir(key) {
+  for (const root of MODULE_ROOTS) {
+    const d = path.join(root, 'modules', key);
+    if (fs.existsSync(d)) return d;
+  }
+  return path.join(CORE_ROOT, 'modules', key);
+}
+
+// Pure: scan kernel source text for any hardcoded module key, skipping comment
+// lines. Returns violation strings (one per hit). Exported for the negative test
+// (mirrors scanScopeMapSource / scanDeterministicBody).
+function scanKernelForModuleKeys(text, keys) {
+  const violations = [];
+  if (!keys || keys.length === 0) return violations;
+  const probes = keys.map((k) => ({ key: k, re: keyTokenRe(k) }));
+  String(text == null ? '' : text).split('\n').forEach((raw, i) => {
+    const t = raw.trim();
+    if (!t || t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) return;
+    for (const { key, re } of probes) {
+      if (re.test(raw)) {
+        violations.push(`names module "${key}" at line ${i + 1} — the kernel/module-system machinery must stay module-agnostic; no module key may be hardcoded in core (ADR 0083 §Decision #4).`);
+      }
+    }
+  });
+  return violations;
+}
+
+function checkCoreCarriesNoModuleCode() {
+  const keys = manifestModuleKeys(); // task 1002790 — NARROW: a manifest-less dir is not a module
+  const violations = [];
+  for (const relFile of KERNEL_FILES) {
+    if (KERNEL_NAMES_MODULES_OK.has(relFile)) continue; // the registry legitimately names every module
+    let text;
+    try { text = fs.readFileSync(path.join(REPO_ROOT, relFile), 'utf8'); } catch { continue; }
+    for (const v of scanKernelForModuleKeys(text, keys)) violations.push(`${relFile} ${v}`);
+  }
+  return {
+    name: 'core carries no module code',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: manifestlessModuleDirs(), // task 1002790 — named, and never a hard fail
+    note: `kernel machinery (${KERNEL_FILES.length} files) names no module key${keys.length ? ` (keys: ${keys.join(', ')})` : ' (none yet)'} (ADR 0083 §Decision #4). A key is a modules/ dir carrying module.json; the migration checks deliberately scan every dir (task 1002790).`,
+  };
+}
+
+// ============================================================================
+// Check 12 — the kernel imports no domain (ADR 0091 §1 / BV1.R70)
+// ============================================================================
+//
+// A bounded kernel is only real if it DEPENDS on nothing but itself. This check
+// walks every KERNEL_FILE's relative requires and flags any that reach a
+// non-kernel core file (a soon-to-be-module domain). Kernel→kernel is fine;
+// kernel→grandfathered-infra (the raw base pg pool, the pure path-match util) is
+// fine; a bare npm/node spec is fine. Everything else is a tracked leak.
+//
+// ENFORCING (ADR 0102): the tranche-2 ratchet reached zero, so this is now a hard
+// gate — the kernel imports only itself + grandfathered infra, and any NEW
+// kernel→domain import fails the build (violations). The last leaks cleared were
+// auth.js→db (carved to db-kernel), the doorway's Gemini-key re-exports (→ the
+// art-pipeline 'art.getBuilderGeminiKeyRow' port) and builderRollingAvgGrade (→ the
+// grading 'grade.builderRollingAvgGrade' port), plus reclassifying llm-cache /
+// llm-pricing as kernel-adjacent infra. Adding a leak back reds the build.
+
+// Grandfathered kernel-adjacent targets a KERNEL_FILE may import without it
+// counting as a domain leak. The still-fused src/bongos/db.js monolith is NOT here:
+// a kernel file reaching into it IS a real (tracked) leak until the identity/
+// session slices finish carving into db-kernel.js.
+const KERNEL_IMPORT_ALLOWLIST = new Set([
+  'src/db.js',             // the raw shared pg Pool (base infra; pool.js wraps it)
+  'src/bongos/path-match.js', // pure touches-overlap matcher (no domain logic)
+  // Cross-cutting LLM-cost infra (ADR 0102): a stateless token→USD pricing table
+  // (llm-pricing) + a best-effort content-addressed cache (llm-cache), consumed by
+  // core, the grading module, and the CLI cost tooling ALIKE — no domain logic and
+  // no domain state beyond a cache table. Same category as the pg pool / path-match,
+  // not a domain module core would have to depend on anyway. The doorway may import
+  // them; they never flip the kernel→domain leak.
+  'src/bongos/llm-cache.js',
+  'src/bongos/llm-pricing.js',
+  // The cheapest-model-first cascade router (task 1001691 / ADR 0101 Part 1):
+  // a pure ladder + an INJECTED runner (never a domain call itself — its own
+  // header says so: "nothing calls it but its mock unit test" until this
+  // task), holding no domain state of its own. Its first real caller is the
+  // lifecycle module's relevance judge, which reaches it through the doorway
+  // exactly as grading reaches llm-cache — same category as the pg pool /
+  // path-match / llm-cache above, not a domain module core would otherwise
+  // depend on.
+  'src/bongos/cascade-dispatch.js',
+]);
+
+// Pure: for relative require `spec` from kernel file `fromRel` (repo-relative),
+// return the offending non-kernel target relpath, or null if the import is clean
+// (kernel→kernel, kernel→allowlisted-infra, or a bare npm/node spec). Exported
+// for the "actually catches a leak" negative test (mirrors scanScopeMapSource).
+function kernelDomainImport(fromRel, spec, kernelSet = new Set(KERNEL_FILES), allow = KERNEL_IMPORT_ALLOWLIST) {
+  if (!/^\.\.?\//.test(spec)) return null; // bare npm/node spec — not our concern
+  const absTarget = path.resolve(path.dirname(path.join(REPO_ROOT, fromRel)), spec);
+  const r = rel(absTarget);
+  const forms = [r, r + '.js', r.replace(/\/$/, '') + '/index.js'];
+  if (forms.some((f) => kernelSet.has(f))) return null; // kernel → kernel
+  if (forms.some((f) => allow.has(f))) return null;      // grandfathered infra/util
+  if (!/^src\//.test(r)) return null;                    // only flag app-source targets
+  return r.endsWith('.js') || r.endsWith('.json') ? r : `${r}.js`; // name the real file
+}
+
+function checkKernelImportsNoDomain() {
+  const kernelSet = new Set(KERNEL_FILES);
+  const findings = [];
+  for (const relFile of KERNEL_FILES) {
+    let text;
+    try { text = fs.readFileSync(path.join(REPO_ROOT, relFile), 'utf8'); } catch { continue; }
+    for (const raw of text.split('\n')) {
+      const t = raw.trim();
+      if (t.startsWith('//') || t.startsWith('*') || t.startsWith('/*')) continue;
+      let m; REQUIRE_RE.lastIndex = 0;
+      while ((m = REQUIRE_RE.exec(raw))) {
+        const target = kernelDomainImport(relFile, m[1], kernelSet);
+        if (target) findings.push(`${relFile} → require('${m[1]}') reaches non-kernel core file ${target} — a kernel file must depend only on the kernel (ADR 0091 §1). Carve ${target}'s domain out (or promote it into the kernel) to clear this.`);
+      }
+    }
+  }
+  return {
+    name: 'kernel imports no domain',
+    ok: findings.length === 0,
+    hardFail: findings.length > 0, // ENFORCING (ADR 0102): the ratchet reached zero — any new kernel→domain import now reds the build
+    violations: findings,
+    warnings: [],
+    note: `every KERNEL_FILE (${KERNEL_FILES.length}) must import only the kernel + grandfathered infra — ENFORCING (ADR 0091 §1 / ADR 0102).${findings.length ? ` ${findings.length} leak(s).` : ' Boundary clean.'}`,
+  };
+}
+
+// ============================================================================
+// Check 11 — module migrations are additive + namespaced (ADR 0083 §Decision #5 / design 04§3)
+// ============================================================================
+//
+// A module owns its DB slice through migrations under modules/<key>/migrations/.
+// Two invariants keep that slice from clobbering core or a sibling:
+//   • ADDITIVE — no destructive DDL. "Disable a module" means "stop applying its
+//     migrations," never "drop its tables" (ADR 0083 §Module-owned migrations);
+//     there is no down path, so a DROP/TRUNCATE can only be an accident.
+//   • NAMESPACED — every object it CREATEs lives under the <key>_ prefix
+//     (art-pipeline → art_pipeline_), and it may only ALTER its own namespaced tables;
+//     core/sibling state is reached through the doorway/seams, never raw DDL.
+//
+// LEGACY_NAMESPACED: tables that predate the <key>_-prefix convention (created before the module
+// system existed). Grandfathered per-module to avoid requiring a rename migration for legacy prod
+// data. The fitness rule applies in full to any NEW migration a module ships.
+const LEGACY_NAMESPACED = {
+  // game module: world_events + players were created before the module system (V1 schema). The
+  // schema_migrations table is a core tracking table that every migration may re-create idempotently.
+  game: new Set(['world_events', 'players', 'schema_migrations']),
+  // government module: the module KEY was renamed governance→government (ADR 0174, goal 1000068),
+  // so its own historical migrations now read as "outside the namespace" purely because the key
+  // moved underneath them. These three tables ARE this module's — under the name it used to have.
+  // They are not renamed in place because schema_migrations is keyed by filename STEM: renaming an
+  // already-applied migration file makes it look unapplied and re-runs it, and governance_002 is a
+  // seed/backfill. government_001_rename_from_governance.sql renames the live tables forward; these
+  // entries let the historical files that created them keep describing what actually happened.
+  government: new Set([
+    'governance_roles', 'governance_builder_roles', 'governance_role_permissions',
+  ]),
+};
+const DESTRUCTIVE_DDL = [
+  { re: /\bdrop\s+table\b/i, label: 'DROP TABLE' },
+  { re: /\balter\s+table\b[\s\S]*?\bdrop\s+(?:column|constraint)\b/i, label: 'ALTER TABLE … DROP COLUMN/CONSTRAINT' },
+  { re: /\bdrop\s+(?:column|constraint)\b/i, label: 'DROP COLUMN/CONSTRAINT' },
+  { re: /\bdrop\s+(?:index|type|view|sequence|schema|materialized\s+view)\b/i, label: 'DROP <object>' },
+  { re: /\btruncate\b/i, label: 'TRUNCATE' },
+];
+const CREATE_OBJ_RE = /\bcreate\s+(?:or\s+replace\s+)?(?:unique\s+)?(?:materialized\s+)?(table|view|sequence|type)\s+(?:if\s+not\s+exists\s+)?("?[\w.]+"?)/gi;
+const CREATE_INDEX_RE = /\bcreate\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:"?[\w.]+"?)\s+on\s+(?:only\s+)?("?[\w.]+"?)/gi;
+const ALTER_TABLE_RE = /\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?("?[\w.]+"?)/gi;
+
+// SQL object-namespace prefix for a module key: art-pipeline → art_pipeline (SQL-safe).
+function moduleNamespace(key) { return key.replace(/-/g, '_'); }
+
+// strip SQL comments so a commented-out statement is never scanned
+function stripSqlComments(sql) {
+  return String(sql == null ? '' : sql)
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/--[^\n]*/g, ' ');
+}
+
+// is `rawName` (possibly quoted / schema-qualified) under the <ns>_ namespace?
+function inNamespace(rawName, ns, legacySet) {
+  const name = String(rawName).replace(/"/g, '').replace(/^[A-Za-z_]\w*\./, '');
+  return name.startsWith(ns + '_') || (legacySet && legacySet.has(name));
+}
+
+// A CHECK-enum WIDENING is additive-in-spirit: `DROP CONSTRAINT IF EXISTS <c>` PAIRED
+// with a re-`ADD CONSTRAINT <c>` (SAME name) in the SAME migration only PERMITS more
+// values — no existing row changes, no data is lost (task 1978: provisioning gains a
+// 'standalone' hosting_shape). Allow that exact pattern; a BARE `DROP CONSTRAINT` (no
+// re-add), or any DROP TABLE/COLUMN/TRUNCATE, stays destructive. PURE.
+function reAddedConstraintNames(sql) {
+  const names = new Set();
+  const re = /\badd\s+constraint\s+("?[\w.]+"?)/gi;
+  let m;
+  while ((m = re.exec(sql))) names.add(m[1].replace(/"/g, ''));
+  return names;
+}
+function isConstraintWidening(stmt, reAdded) {
+  const m = /\bdrop\s+constraint\s+(?:if\s+exists\s+)?("?[\w.]+"?)/i.exec(stmt);
+  if (!m) return false;                                  // not a DROP CONSTRAINT at all
+  // never let a DROP CONSTRAINT statement smuggle a table/column drop past the gate
+  if (/\bdrop\s+(?:table|column|index|type|view|sequence|schema|materialized\s+view)\b/i.test(stmt)) return false;
+  if (/\btruncate\b/i.test(stmt)) return false;
+  return reAdded.has(m[1].replace(/"/g, ''));            // re-added same-named constraint → widening
+}
+
+// The ONE destructive shape a module may carry: an ACKNOWLEDGED contract-phase
+// `ALTER TABLE <own table> DROP COLUMN <c>` (task 1003092 — the expand-then-contract
+// rename of ADR 0177 has to finish; ADR 0083 §Module-owned migrations, amended). The
+// pragma is read off the RAW sql (it is a comment); everything else here still runs.
+const { acknowledgedContraction, isAcknowledgedColumnContraction } = require('./fitness-migration-contraction.js');
+
+// Pure: violations for ONE module's migration SQL. Exported for the negative test.
+function moduleMigrationViolations(key, sql) {
+  const ns = moduleNamespace(key);
+  const legacy = LEGACY_NAMESPACED[key] || null;
+  const clean = stripSqlComments(sql);
+  const violations = [];
+  // additive — scan per statement so an ALTER…DROP never spans a `;`
+  const reAdded = reAddedConstraintNames(clean);
+  const acknowledged = acknowledgedContraction(sql);
+  const ownTable = (t) => inNamespace(t, ns, legacy);
+  for (const stmt of clean.split(';')) {
+    if (isConstraintWidening(stmt, reAdded)) continue; // additive CHECK-enum widening (task 1978)
+    if (isAcknowledgedColumnContraction(stmt, { acknowledged, inNamespace: ownTable })) continue; // contract phase (task 1003092)
+    for (const d of DESTRUCTIVE_DDL) {
+      if (d.re.test(stmt)) {
+        violations.push(`module "${key}" migration uses destructive DDL (${d.label}) — module migrations must be ADDITIVE; disabling a module stops applying, it never drops (ADR 0083 §Decision #5).`);
+        break; // one destructive flag per statement is enough
+      }
+    }
+  }
+  // namespaced — CREATEd objects + ALTER targets must live under <ns>_ (or be grandfathered)
+  let m;
+  CREATE_OBJ_RE.lastIndex = 0;
+  while ((m = CREATE_OBJ_RE.exec(clean))) {
+    if (!inNamespace(m[2], ns, legacy)) {
+      violations.push(`module "${key}" migration creates ${m[1].toUpperCase()} ${m[2]} outside its namespace — module objects must be ${ns}_-prefixed (ADR 0083 §Decision #5).`);
+    }
+  }
+  CREATE_INDEX_RE.lastIndex = 0;
+  while ((m = CREATE_INDEX_RE.exec(clean))) {
+    if (!inNamespace(m[1], ns, legacy)) {
+      violations.push(`module "${key}" migration indexes a non-namespaced table ${m[1]} — a module migration may only touch its own ${ns}_ tables (ADR 0083 §Decision #5).`);
+    }
+  }
+  ALTER_TABLE_RE.lastIndex = 0;
+  while ((m = ALTER_TABLE_RE.exec(clean))) {
+    if (!inNamespace(m[1], ns, legacy)) {
+      violations.push(`module "${key}" migration alters a non-namespaced table ${m[1]} — a module migration may only touch its own ${ns}_ tables; reach core state through the doorway/seams, not DDL (ADR 0083 §Decision #5).`);
+    }
+  }
+  return violations;
+}
+
+function checkModuleMigrationsAdditive() {
+  const violations = [];
+  let scanned = 0;
+  for (const key of discoveredModuleKeys()) { // union across module roots (ADR 0108 §Consequences #4)
+    const migDir = path.join(moduleDir(key), 'migrations');
+    let files = [];
+    try { files = fs.readdirSync(migDir).filter((f) => f.endsWith('.sql')); } catch { continue; }
+    for (const f of files.sort()) {
+      scanned += 1;
+      const sql = fs.readFileSync(path.join(migDir, f), 'utf8');
+      for (const v of moduleMigrationViolations(key, sql)) {
+        violations.push(`modules/${key}/migrations/${f}: ${v}`);
+      }
+    }
+  }
+  return {
+    name: 'module migrations additive + namespaced',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} module migration file(s): additive (no destructive DDL) + <key>_-namespaced objects (ADR 0083 §Decision #5).`,
+  };
+}
+
+// ============================================================================
+// Check 11b — migration FILENAMES are namespaced + no cross-root stem collision
+//             (ADR 0108 §5; extends Check 11 to the cross-repo layer)
+// ============================================================================
+//
+// Check 11 (above) guards a module migration's OBJECTS (additive + <key>_-namespaced
+// tables). THIS check guards migration FILENAMES across all three roots — the
+// discipline that lets the core repo and the instance repo version independently
+// (ADR 0108) without their migrations colliding:
+//   • migrations/*.sql            (CORE)     → NEW files must be core_-prefixed
+//   • migrations/instance/*.sql   (INSTANCE) → stay bare (or instance_-prefixed)
+//   • modules/<key>/migrations/   (MODULE)   → NEW files must be <key>_-prefixed
+// Existing bare files are grandfathered (migration-namespace.js LEGACY_BARE_*). The
+// second invariant is the real bug guard: migrate.sh keys schema_migrations by
+// filename STEM, so two migrations from different sources sharing a stem would apply
+// ONCE and the other be SILENTLY SKIPPED (never applied). Single-root today; W6/task
+// 1886 makes the root resolution two-root-aware once the core installs from node_modules.
+function sqlFilesIn(absDir) {
+  try { return fs.readdirSync(absDir).filter((f) => f.endsWith('.sql')).sort(); }
+  catch { return []; } // dir absent (e.g. no migrations/instance in a vanilla instance) → nothing to scan
+}
+
+function checkMigrationNamespacing() {
+  const violations = [];
+  const files = []; // { source, moduleKey?, basename } — fed to the stem-collision scan
+
+  const coreFiles = sqlFilesIn(path.join(CORE_ROOT, 'migrations')); // core migrations ship in the core package
+  for (const f of coreFiles) {
+    const v = filenameViolation(CORE_NS, f);
+    if (v) violations.push(`migrations/${f}: ${v}`);
+    files.push({ source: CORE_NS, basename: f });
+  }
+
+  const instFiles = sqlFilesIn(path.join(INSTANCE_ROOT, 'migrations', 'instance')); // instance seeds live in the host repo
+  for (const f of instFiles) {
+    const v = filenameViolation(INSTANCE_NS, f);
+    if (v) violations.push(`migrations/instance/${f}: ${v}`);
+    files.push({ source: INSTANCE_NS, basename: f });
+  }
+
+  let moduleCount = 0;
+  for (const key of discoveredModuleKeys()) {
+    for (const f of sqlFilesIn(path.join(moduleDir(key), 'migrations'))) {
+      moduleCount += 1;
+      const v = filenameViolation('module', f, { moduleKey: key });
+      if (v) violations.push(`modules/${key}/migrations/${f}: ${v}`);
+      files.push({ source: 'module', moduleKey: key, basename: f });
+    }
+  }
+
+  for (const c of stemCollisions(files)) {
+    violations.push(`migration stem "${c.stem}" is produced by more than one source (${c.files.join(', ')}) — schema_migrations is stem-keyed, so one applies and the rest are SILENTLY SKIPPED; namespace them (ADR 0108 §5).`);
+  }
+
+  // Two DIFFERENT stems at one number inside ONE series (task 1003646). Not the
+  // silent-skip above — all of them apply — but migrate.sh orders by basename, so
+  // their relative order is the alphabetical accident of the slug, and a from-scratch
+  // replay can order them differently from the merge order prod applied. Renumbering an
+  // APPLIED migration re-runs it, so the fix for a new one is to renumber BEFORE it
+  // lands; the single pre-existing case is grandfathered in migration-namespace.js.
+  for (const c of numberCollisions(files)) {
+    violations.push(`migration number ${String(c.number).padStart(3, '0')} is used by ${c.files.length} different migrations in one series (${c.series}): ${c.files.join(', ')} — each was allocated max+1 from its own branch point. migrate.sh applies in BASENAME order, so their order is decided by the slug alphabetically and a fresh replay can differ from the order prod applied. Renumber the one that has NOT landed yet (renaming an applied migration re-runs it) (task 1003646).`);
+  }
+
+  return {
+    name: 'migration filenames namespaced + no stem/number collision (ADR 0108 §5)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${coreFiles.length} core + ${instFiles.length} instance + ${moduleCount} module migration file(s): new core→core_, new module→<key>_, instance bare; no cross-root stem collision, and no two migrations share a number within one series.`,
+  };
+}
+
+// ============================================================================
+// Check — hall sections are registry-owned, not hardcoded (BV1.R75 / ADR 0062 §4)
+// ============================================================================
+// The builders'-hall widgets are now a REGISTRY (modules/hall-ui/public/dom-utils.js
+// contributeHallWidget; the core set in modules/hall-ui/public/hall-widgets.js, modules
+// via their own client script). The hall's <main> is filled by builders.js from that
+// registry. So no widget may be hardcoded as a literal <section class="scroll"> inside
+// <main> in index.html — that was the pre-R75 second copy this carve removed. This
+// gate fails if one creeps back, keeping the registry the single source of truth (so a
+// reskin/module-toggle reaches every widget). Self-contained: a pure scan of
+// index.html's <main>, no module/registry state needed. Exported for the unit test.
+// (The hall surface itself carved to modules/hall-ui/public/ in BV1.R85.)
+//
+// task 2177 — the check also asserts the HOME ZONE BUDGETS. builders.js caps how
+// many widgets each Home zone mounts (ZONE_BUDGETS); past the cap a widget still
+// mounts, but into a hidden overflow behind a "More" link. That graceful degrade
+// is the runtime safety net — it is NOT a licence to keep adding cards, and
+// because nothing goes red, a Home that has quietly outgrown its budget looks
+// fine. So CI counts the registrations statically and fails on a breach: the
+// budget becomes a decision someone has to make deliberately (raise the number
+// in builders.js, with a reason) instead of one that erodes.
+//
+// NOT statically checkable, by design: the `home-banner` rule is "at most ONE
+// VISIBLE", not "at most one registered" — both banner widgets (welcome,
+// getting-started) are hiddenByDefault and reveal themselves from onboarding
+// state, so only runtime knows the count. It is documented as a runtime
+// invariant in modules/hall-ui/CLAUDE.md rather than faked with a static count
+// that would either fail today or assert nothing.
+const HALL_INDEX = path.join(moduleDir('hall-ui'), 'public', 'index.html'); // hall-ui is a module — resolve its root (ADR 0108)
+const HALL_PUBLIC = path.join(moduleDir('hall-ui'), 'public');
+// task 1003206 split the hall page script: builders.js keeps state/loading/wiring
+// and hall-render.js holds the view painters — ZONE_BUDGETS travelled with the
+// widget mounting. Read whichever of the pair actually declares it, so this
+// check follows the code instead of a filename (it went vacuous on the move).
+const HALL_BUILDERS_JS = path.join(HALL_PUBLIC, 'builders.js');
+const HALL_RENDER_JS = path.join(HALL_PUBLIC, 'hall-render.js');
+function hallWidgetSource() {
+  const parts = [];
+  for (const f of [HALL_BUILDERS_JS, HALL_RENDER_JS]) {
+    try { parts.push(fs.readFileSync(f, 'utf8')); } catch { /* absent → skip */ }
+  }
+  return parts.join('\n');
+}
+
+// Parse builders.js's ZONE_BUDGETS object literal — the single source of truth
+// for the caps (this check must never carry its own copy of the numbers).
+function parseZoneBudgets(js) {
+  const block = js.match(/const\s+ZONE_BUDGETS\s*=\s*\{([^}]*)\}/);
+  if (!block) return null;
+  const budgets = {};
+  for (const [, zone, n] of block[1].matchAll(/['"]([\w-]+)['"]\s*:\s*(\d+)/g)) {
+    budgets[zone] = Number(n);
+  }
+  return Object.keys(budgets).length ? budgets : null;
+}
+
+// Count registrations per Home zone across every hall client script that calls
+// contributeHallWidget. The zones are static string literals in the registration
+// object, so a literal scan is exact for the code we have (and a computed zone
+// would be a placement smell in its own right — dom-utils' runtime validation
+// still rejects an unknown one). Requiring the contributeHallWidget mention is
+// what keeps an unrelated `zone:` key in some other object from eating budget.
+function scanHallZoneCounts(dir = HALL_PUBLIC, fsImpl = fs) {
+  const counts = {};
+  let files = [];
+  try { files = fsImpl.readdirSync(dir).filter((f) => f.endsWith('.js')); } catch { return counts; }
+  for (const file of files) {
+    let src = '';
+    try { src = fsImpl.readFileSync(path.join(dir, file), 'utf8'); } catch { continue; }
+    if (!src.includes('contributeHallWidget')) continue;
+    for (const [, zone] of src.matchAll(/\bzone:\s*['"]([\w-]+)['"]/g)) {
+      counts[zone] = (counts[zone] || 0) + 1;
+    }
+  }
+  return counts;
+}
+
+function checkHallZoneBudgets(fsImpl = fs) {
+  let js = '';
+  try {
+    js = [HALL_BUILDERS_JS, HALL_RENDER_JS]
+      .map((f) => { try { return fsImpl.readFileSync(f, 'utf8'); } catch { return ''; } })
+      .join('\n');
+  } catch { return []; }
+  const budgets = parseZoneBudgets(js);
+  if (!budgets) {
+    return ['modules/hall-ui/public/{builders,hall-render}.js no longer declares a parseable ZONE_BUDGETS literal — the Home zone budgets are unenforced (task 2177).'];
+  }
+  const counts = scanHallZoneCounts(HALL_PUBLIC, fsImpl);
+  const violations = [];
+  for (const [zone, budget] of Object.entries(budgets)) {
+    const n = counts[zone] || 0;
+    if (n > budget) {
+      violations.push(
+        `Home zone "${zone}" has ${n} registered hall widgets but its budget is ${budget} — the extras mount into the hidden overflow, so Home silently grew. Move it to its own page (see modules/hall-ui/CLAUDE.md §Placement), or raise ZONE_BUDGETS['${zone}'] in modules/hall-ui/public/builders.js deliberately (task 2177).`);
+    }
+  }
+  return violations;
+}
+
+function hallMainSlice(html) {
+  // Strip HTML comments first so a comment that merely MENTIONS <main> or a
+  // <section class="scroll"> (e.g. the carve's own explanatory note) never trips
+  // the scan — only real, rendered markup counts.
+  const stripped = html.replace(/<!--[\s\S]*?-->/g, '');
+  const open = stripped.indexOf('<main');
+  if (open === -1) return '';
+  const start = stripped.indexOf('>', open);
+  const close = stripped.indexOf('</main>', start === -1 ? open : start);
+  if (start === -1 || close === -1) return '';
+  return stripped.slice(start + 1, close);
+}
+
+function scanHallSectionRegistry(html) {
+  const main = hallMainSlice(html);
+  // A hall widget section carries class="scroll" (possibly with modifiers, e.g.
+  // "scroll scroll--welcome"). Catch any <section ... class="...scroll..."> in <main>.
+  const re = /<section\b[^>]*\bclass\s*=\s*"(?:[^"]*\b)?scroll\b[^"]*"/gi;
+  const hits = main.match(re) || [];
+  return hits.map((h) => h.replace(/\s+/g, ' ').trim());
+}
+
+function checkHallSectionRegistry() {
+  let html = '';
+  try { html = fs.readFileSync(HALL_INDEX, 'utf8'); }
+  catch { return { name: 'hall widgets are registry-owned (ADR 0062 §4)', ok: true, hardFail: false, violations: [], warnings: ['modules/hall-ui/public/index.html not found — skipped'], note: 'index.html absent.' }; }
+  const hardcoded = scanHallSectionRegistry(html);
+  const violations = hardcoded.map((s) =>
+    `modules/hall-ui/public/index.html <main> hardcodes a hall section "${s}" — register it via window.OTB.contributeHallWidget (modules/hall-ui/public/hall-widgets.js for core, a module's client script otherwise), don't inline the markup (BV1.R75 / ADR 0062 §4).`);
+  violations.push(...checkHallZoneBudgets());
+  return {
+    name: 'hall widgets are registry-owned + within zone budget (ADR 0062 §4, task 2177)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: 'modules/hall-ui/public/index.html <main> contains no hardcoded <section class="scroll">, and every Home zone is within the ZONE_BUDGETS cap builders.js declares — the registry is the single source of truth and Home cannot grow unnoticed.',
+  };
+}
+
+
+// ============================================================================
+// Check 2c — every SKILL.md frontmatter parses the way Claude Code's YAML reader reads it (task 1003548)
+// ============================================================================
+// Ten of fifty skills shipped with an unquoted description holding ": " or " #": YAML dropped or
+// truncated EVERY field, the skill matched on its body text, and nothing in CI noticed. A parse
+// error is a hard fail; description length and the listing budget are advisory (the listing is
+// resident in every session, ~1% of context, and gets truncated past ~8k chars). The check reads
+// every skill Claude Code can load — the instance's .claude/skills/ AND the module-owned
+// modules/*/skills/ that claude-materialize.js copies into it (task 1003587: scanning only the
+// tracked root meant 14 ui-design skills went unlinted until the untracked copy existed, so four
+// unparseable frontmatters shipped and fitness only went red on a checkout that had materialized).
+// A quiet pass when a checkout carries none (published core).
+function checkSkillFrontmatter() {
+  const violations = [];
+  const warnings = [];
+  let lint;
+  try { lint = require('./skill-lint'); } catch (e) {
+    return { name: 'skill frontmatter parses (task 1003548)', ok: true, hardFail: false, violations, warnings: [`skill-lint unavailable: ${e.message}`], note: 'linter missing — check skipped.' };
+  }
+  const files = lint.listSkillFiles(INSTANCE_ROOT);
+  // Lint every file; count the listing over the skills RESIDENT here (task 1004470).
+  const report = lint.lintSkills(files, { resident: lint.residentSkillFiles(INSTANCE_ROOT, { files }) });
+  const rel = (f) => path.relative(INSTANCE_ROOT, f).replace(/\\/g, '/');
+  const long = [];
+  for (const r of report.results) {
+    for (const e of r.errors) violations.push(`${rel(r.file)}: ${e}`);
+    if (r.description.length > lint.DESC_WARN_CHARS) long.push({ file: rel(r.file), n: r.description.length });
+  }
+  if (long.length) {
+    long.sort((a, b) => b.n - a.n);
+    // The skill's own name is its PARENT dir — a fixed path index would read "skills"
+    // for a module-owned path (modules/<key>/skills/<name>/SKILL.md).
+    const skillName = (f) => f.split('/').slice(-2, -1)[0] || f;
+    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${skillName(l.file)} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/bongos/skill-lint.js.`);
+  }
+  if (report.overBudget) warnings.push(`the skill listing is ${report.listingChars} chars (~${estTokens(report.listingChars)} tokens) against a ~${report.budgetChars}-char budget — Claude Code truncates entries past it and routing degrades.`);
+  return {
+    name: 'skill frontmatter parses (task 1003548)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ + modules/*/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
+  };
+}
+
+// ============================================================================
+// Check 35 — no raw NUL byte in tracked publishable text (task 1002854)
+// ============================================================================
+//
+// scripts/public-mirror-export.js decides binary-vs-text by sniffing for a NUL byte in
+// the first 8 KiB (`isBinary`, ~line 86), and `redactBlob` skips `redactText` entirely
+// for anything it classifies binary. So a TEXT source containing a raw NUL is published
+// to the public AGPL mirror WITHOUT REDACTION.
+//
+// WHAT THIS IS AND IS NOT. The binary branch is not unguarded: it still leak-scans the
+// blob's latin1 view, so an embedded instance literal trips the gate. But the gate uses
+// `sensitiveLiterals` — raw substrings — while `redactText` applies the full `rules` set.
+// The exposure is therefore the DELTA between them: anything redaction would have
+// rewritten but the literal gate does not recognise ships verbatim. That is a latent
+// unredacted-publish, not a live one, which is why this is a lint rather than a fix.
+//
+// THE CLASS RECURS, WHICH IS THE ARGUMENT FOR A LINT RATHER THAN ANOTHER FIX.
+// Task 1703 found and fixed three instances, all the same mistake: a raw NUL used as a
+// join delimiter instead of the `\u0000` escape. Task 1002507 fixed a fourth in session
+// digests. Open idea 1000523 covers a fifth (search-ingest rollback). This check found
+// four more — modules/copy-desk/proposals.js, scripts/bongos/claim.js,
+// scripts/bongos/probe-cache.js and tests/copy_inventory.mjs — fixed in the same commit so
+// the check lands green. Nothing prevented any of them; nothing would prevent the next.
+//
+// The fix is always the same and never changes behaviour: `\u0000` compiles to exactly
+// the same string, so hashes, joins and regex ranges are byte-identical at runtime. Only
+// the SOURCE stops carrying the byte.
+//
+// SCOPE. Tracked files only (git ls-files — an untracked scratch file is not published),
+// with publishable text extensions. Binary formats are out of scope by definition: a PNG
+// is *supposed* to contain NULs and the mirror is right to pass it through.
+const NUL_TEXT_EXTS = ['.js', '.mjs', '.cjs', '.mts', '.md', '.sql', '.json'];
+
+// Exemptions must be justified, not just listed. There are none today, and that is the
+// preferred state: the fix is a one-character escape with no behavioural cost, so
+// "exempt it" should always lose to "escape it". Kept as a named, empty constant so a
+// future addition is a visible, reviewable edit rather than a quiet change to a regex.
+const NUL_EXEMPT_PATHS = [];
+
+function scanForRawNul(root, { listFiles, readFile } = {}) {
+  const list = listFiles || (() => execFileSync('git', ['ls-files', '-z'], {
+    cwd: root, encoding: 'latin1', maxBuffer: 1 << 26,
+  }).split('\u0000').filter(Boolean));
+  const read = readFile || ((f) => fs.readFileSync(path.join(root, f)));
+
+  const hits = [];
+  for (const f of list()) {
+    if (!NUL_TEXT_EXTS.includes(path.extname(f))) continue;
+    if (NUL_EXEMPT_PATHS.some((e) => f === e || f.startsWith(e))) continue;
+    let buf;
+    try { buf = read(f); } catch (_) { continue; }   // deleted-but-tracked, or unreadable
+    const at = buf.indexOf(0);
+    if (at === -1) continue;
+    // Report the LINE, not the byte offset — a byte offset is not actionable.
+    const line = buf.slice(0, at).toString('latin1').split('\n').length;
+    hits.push(`${f}:${line} — raw NUL byte; use the \\u0000 escape (same string at runtime, no NUL in source)`);
+  }
+  return hits;
+}
+
+function checkNoRawNulInText() {
+  let violations = [];
+  let note = '';
+  try {
+    violations = scanForRawNul(REPO_ROOT);
+    note = `tracked ${NUL_TEXT_EXTS.join('/')} sources carry no raw NUL byte, so none can be misclassified `
+      + 'as binary and skip public-mirror redaction (task 1002854).';
+  } catch (e) {
+    // Never let the scan itself fail the build — a git failure is not a boundary breach.
+    return {
+      name: 'no raw NUL byte in tracked publishable text (task 1002854)',
+      ok: true, hardFail: false, violations: [], warnings: [`skipped: ${e.message}`],
+      note: 'could not list tracked files — check skipped.',
+    };
+  }
+  return {
+    name: 'no raw NUL byte in tracked publishable text (task 1002854)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note,
+  };
+}
+
+const CHECKS = [
+  checkCoreHostBoundary,
+  checkNoRawNulInText, // Check 35 — task 1002854: a raw NUL makes the mirror skip redaction
+  checkClaudeMdBudget,
+  // Check 32 — task 1002990 / criterion wa6-kernel-and-packs: the root CLAUDE.md is
+  // now a role-neutral KERNEL and each craft's playbook lives in a pack under
+  // docs/packs/. claim.js resolves the pack through the role registry and fails
+  // OPEN, so a pack path that points at nothing is invisible at runtime — CI is the
+  // only place a hollowed-out role can be caught. Rationale in that file.
+  require('./role-pack-guard.js').checkRolePacks,
+  checkSkillFrontmatter,
+  checkNestedDocsPresent,
+  checkRankGuards,
+  checkModulePinKeysResolve,
+  checkGeneratedArtifactsFresh,
+  checkDeterministicRoutines,
+  checkCoreNeverImportsModule,
+  checkModulesImportOnlyApi,
+  checkScopeMapImportsProtected,
+  // Check 36 — task 1002900: a carved module with no roster key walls nothing. Extracted
+  // to its own file (the role-pack-guard.js precedent) to keep fitness.js under the size ratchet.
+  () => require('./scope-roster-guard.js').checkScopeRosterCoversModules({ repoRoot: REPO_ROOT, discoveredModuleKeys }),
+  checkCoreCarriesNoModuleCode,
+  checkKernelImportsNoDomain,
+  checkModuleMigrationsAdditive,
+  checkMigrationNamespacing, // Check 11b — ADR 0108 §5 cross-repo migration filenames + stem collision
+  checkDesignContract,
+  checkKernelPromptsNoHardcodedIdentity, // BV1.R76 — kernel prompts read identity from branding()
+  checkNeutralConfigsNoHostIdentity, // Check 15b — BV1.R102: .json is outside the scan above
+  checkHallSectionRegistry,
+  checkCoreRequiresExcludedConfig, // task 1824 — core→instance-config require guard
+  checkCoreRequiresExcludedModule, // Check 16b — task 2135: core→excluded-module require guard (R89 split)
+  checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
+  checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
+  checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
+  checkGovernmentRenameIdentity, checkPrelaunchVocabulary, // 19c task 1003120 (`X`→`X` rename arrow) + 19d task 1003152 ("stealth" is the product's word) — sharing a line: this file is AT the 1,500 budget (Check 23/24 precedent below; task 1003825 buys it back)
+  checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
+  require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
+  require('./doc-control-claims.js').checkDocControlClaims, // Check 37 — task 1003418 / audit A14: a doc cannot describe an enforcement control that does not exist (derived from the docs, not a hand list)
+  require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
+  require('./skill-preflight.js').checkOpsSkillsDeclareMachine, // Check 23 — task 1003167 / G03: an ops skill declares the machine it needs
+  // Check 24 — task 1003166 / G02: no ops script hardcodes a version id. It landed
+  // sharing Check 23's line, deliberately, because fitness.js was ~500 lines over
+  // the excess-lines ratchet and a new check could not afford one (idea 1000810).
+  // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
+  // and the check gets its own line back.
+  require('./version-literal-guard.js').checkNoVersionLiterals,
+  require('./dev-box-guard.js').checkNoDevBox, // task 1003899 / ADR 0346: the retired dev box stays out (its exemption list lives in that file)
+  require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
+  require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
+  require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why
+  require('./client-baseurl-guard.js').checkClientBaseUrl,
+  require('./route-shadow-guard.js').checkNoRouteShadowing, // Check 31 — task 1003747: a `:param` route must not swallow a literal route mounted after it (cross-module mount order; the rot feed shipped dead this way). Rationale in that file.
+  require('./test-path-guard.js').checkTestsUseFileUrlToPath, // Check 30 — task 1002889: a test builds its repo root with fileURLToPath, never URL.pathname (a %20 or a Windows drive slash makes require() throw at load; CI's spaceless checkout can't see it)
+  // Check 29 — task 1003275 / ADR 0189: a work category ORIENTS a human and steers
+  // Claude; it authorises nothing. The owner said so twice, and the goal's own prose
+  // predicts the failure: a second thing that looks like a hierarchy gets mistaken
+  // for one within a release. A comment cannot refuse the line that does it.
+  require('./category-advisory-guard.js').checkCategoryIsAdvisory, // Check 27 — task 1003263: a page must not combine baseUrl:'' with a generated namespaced call (that pairing 404s every request; three pages shipped it, two of them dead in prod)
+  // Check 28 — task 1001654 / ADR 0095: does each source file open with a module
+  // header saying what it does and why. ADVISORY ONLY (never hardFail) — a
+  // doc-comment gate that blocks a ship buys filler prose, not understanding.
+  // Making it blocking is an owner decision and needs its own ADR.
+  require('./doc-comment-coverage.js').checkDocCommentCoverage,
+  // Check 31 — task 1003164: two ADRs may not share a number, and docs/adr/README.md
+  // must agree with the tree. The ADR half of the guard Check 11b already gives
+  // migrations: same shared, monotonic, human-allocated number line, and until this
+  // landed only one of the two was enforced. An ADR number is a citation target, so a
+  // duplicate is wrong forever (ADR 0195).
+  // Check 33 — task 1003819: a module declares what it contributes, and nothing
+  // checked that a declared seam is actually WIRED. verifyPortsSatisfied asks the
+  // opposite question (every `consumes` has a provider) and validateManifest checks
+  // only the SHAPE, so a contributes entry whose artifact was never shipped — or was
+  // renamed out from under the manifest — boots silent: every consumer skips it the
+  // same way it correctly skips a real declarative-only entry. CI, not boot: nothing
+  // crashes later, so a start-up refusal would trade an outage risk for a cosmetic
+  // one (ADR 0289). Rationale + the seam→consumer table live in that file.
+  require('./seam-wiring-guard.js').checkSeamWiring,
+  require('./home-isolation-guard.js').checkHomeIsolation, // Check 34 — task 1003763: a test that sets HOME for a child without USERPROFILE isolates NOTHING on win32, so it silently stops testing what its comment says. Three tasks fixed this one site at a time. Rationale in that file.
+  ...['checkDevsecopsOwnsItsChecks', 'checkEveryModuleDirIsScoped', 'checkNoNewUnownedRoot'].map((k) => require('./scope-map-guard.js')[k]), // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Check 36 — task 1004132: the same defect one level up, a carved module whose own directory no key claims (modules/specialities/ shipped that way). Sharing the line per the ratchet convention above. Rationale in that file.
+  require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
+];
+
+function runAll() {
+  return runChecks(CHECKS); // task 1004737: an installed core has no core source to measure — one skipped result, not a crash
+}
+
+function main() {
+  const results = runAll();
+  if (process.argv.includes('--json')) {
+    process.stdout.write(JSON.stringify(results, null, 2) + '\n');
+  } else {
+    console.log('Architecture fitness functions (Path C / ADR 0062 §9)\n');
+    for (const r of results) {
+      const mark = r.hardFail ? '✗ FAIL' : (r.warnings.length ? '! WARN' : '✓ PASS');
+      console.log(`${mark}  ${r.name}`);
+      console.log(`        ${r.note}`);
+      for (const v of r.violations) console.log(`        ✗ ${v}`);
+      for (const w of r.warnings) console.log(`        ! ${w}`);
+    }
+    const failed = results.filter((r) => r.hardFail).length;
+    console.log(`\n${failed ? `${failed} check(s) FAILED` : 'all checks passed'}.`);
+  }
+  process.exit(results.some((r) => r.hardFail) ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  scanForRawNul,
+  checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
+  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, checkPrelaunchVocabulary, PRELAUNCH_SURFACE, // 19c task 1003120, 19d task 1003152
+  runAll,
+  resolvesToHostGame,
+  checkCoreHostBoundary,
+  checkClaudeMdBudget,
+  checkNestedDocsPresent,
+  checkRankGuards,
+  checkModulePinKeysResolve,
+  checkGeneratedArtifactsFresh,
+  checkDeterministicRoutines,
+  checkCoreNeverImportsModule,
+  checkModulesImportOnlyApi,
+  checkScopeMapImportsProtected,
+  checkCoreCarriesNoModuleCode,
+  checkKernelImportsNoDomain,
+  checkModuleMigrationsAdditive,
+  checkMigrationNamespacing, // Check 11b — ADR 0108 §5 cross-repo migration filenames
+  checkAdrNumbering: require('./adr-namespace.js').checkAdrNumbering, // Check 31 — task 1003164 / ADR 0195: ADR numbers unique + index agrees with the tree
+  checkDesignContract,
+  checkKernelPromptsNoHardcodedIdentity, // BV1.R76 / task 1705
+  scanPromptIdentity,                    // BV1.R76 — negative-test hook
+  stripCommentsForIdentity,              // task 1705 — comment-strip helper (tested)
+  checkNeutralConfigsNoHostIdentity,     // Check 15b — BV1.R102 (tested)
+  checkHallSectionRegistry,
+  scanHallSectionRegistry,
+  hallMainSlice,
+  parseZoneBudgets,      // task 2177 — hall Home zone budgets (tested)
+  scanHallZoneCounts,
+  checkHallZoneBudgets,
+  checkErrorEnvelope,       // Check 17 — BV1 R03 / task 1990 (ADR 0116)
+  scanFlatErrorSites,       // shared with the R04 sweep + its test
+  countFlatErrors,          // per-text detector (tested)
+  FLAT_ERROR_BASELINE,
+  checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999 (ADR 0118)
+  scanUnvalidatedWriteRoutes, // shared with its test
+  WRITE_VALIDATION_EXEMPT,
+  scanScopeMapSource,
+  scanKernelForModuleKeys,
+  kernelDomainImport,
+  KERNEL_FILES,
+  discoveredModuleKeys,
+  manifestModuleKeys, manifestlessModuleDirs, // task 1002790 — narrow defn + the difference
+  moduleMigrationViolations,
+  moduleNamespace,
+  resolvesToModule,
+  moduleImportViolation,
+  moduleOwnerOf,
+  // test/ratchet hook: toggle the module boundary enforce flag. Default is now
+  // ENFORCING (BV1.R45 / task 1414); tests that need warn-mode restore the
+  // default in a finally.
+  _setModuleBoundaryEnforcing: (v) => { MODULE_BOUNDARY_ENFORCING = !!v; },
+  scanDeterministicBody,
+  HOST_GAME,
+  GRANDFATHERED,
+  LEGACY_NAMESPACED,
+  ROOT_HARD_MAX,
+  ROOT_TARGET,
+  ROOT_CHAR_HARD_MAX,
+  ROOT_CHAR_TARGET,
+  HIGH_TRAFFIC,
+};