@bongos/core 1.21.176 → 1.21.177

package/.claude/skills/planning-session/SKILL.md

@@ -303,7 +303,7 @@ Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` a
      - **For a brand-new version scaffolded from scratch (DR / a fresh instance):** put the `INSERT INTO done_when_criteria` (with `goal_id`, `ON CONFLICT ... DO UPDATE`) in **`migrations/instance/<NN>_<ver_slug>_planning_seed.sql`** — and recreate the goal idempotently in the same file (the goal is a runtime row a replay won't have). Applies only under `GDS_APPLY_INSTANCE_SEEDS=1`.
    - **Migration** at `migrations/<NN>_<ver_slug>_planning_seed.sql` (CORE — platform-universal, non-scope-truth changes only): `UPDATE versions SET done_when = ...` and `UPDATE tasks` for existing-task priority + V##.R## title prefix (guarded by `WHERE title NOT LIKE 'V<ver>.R%'`). **Do NOT put versions/goals/`done_when_criteria` INSERTs here** — that's scope-truth and fails the `selfhost-boot` gate (ADR 0105).
 
-3. **Write a seed script** at `scripts/bongos/seed-<ver_slug>-tasks.js` modeled on `scripts/bongos/seed-v3-tasks.js` containing:
+3. **Write a seed script** at `scripts/bongos/seed-<ver_slug>-tasks.js` modeled on `scripts/bongos/<redacted>.js` (or `<redacted>.js`) containing:
    - The TASKS array — one entry per net-new task with full description, kind, discipline, priority, est_minutes, manual_degree, credits_reward, **optional** `touches` (see below), optional `promoted_idea_id`, `depends_on_refs: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['Cn', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. **Use the criterion_id SLUG, not a positional `"Cn"` token.** `Cn` ranks over the whole VERSION's criteria, so on a version holding more than one goal it resolves to some other goal's criterion — which is how all 15 tasks of goal 1000071 were mislinked while the seed printed success (learning 1000188). Since task 1003108 the server **refuses** a positional ref on a multi-goal version (`400 ambiguous_criterion_ref`) rather than guessing, so a slug is the only ref that works there. The server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
    - **`touches` is now OPTIONAL (task 882 / [ADR 0049](../../../docs/adr/0049-split-parallel-safety-contract.md)).** Omit it (or leave it blank) unless you already know a tight file set and want the advisory overlap signal during the brainstorm. At first `/builder-ship` the server backfills `touches[]` from the real committed diff — the declared set becomes what git actually reported. Don't burn planning effort predicting file lists; a rough or absent prediction is fine and no longer ship-blocking.
    - **`requires_rank` AUTO-DERIVES — you don't hand-set it per task (task [#1498](https://example.com/builders#/task/1498) / [ADR 0084](../../../docs/adr/0084-auto-derived-per-task-rank-floor.md)).** On create the server floors a task at `metic` when it is `security_sensitive` or its `touches` reach the permission / authz / ship-grade / deploy / migration core (the same protected paths a sub-Metic builder can't push to); everything else stays the open `xenos` default. To deliberately gate a task **higher** than the auto-floor (e.g. owner-only work), pass `requires_rank: 'metic' | 'archon'` on the task — it can only RAISE the floor, never drop below it.
@@ -395,7 +395,7 @@ node scripts/bongos/api.js GET /api/bongos/inbox
 node scripts/bongos/api.js GET /api/bongos/versions/<id>/done-when
 ```
 
-Phase 5 writes use the same `POST /tasks`, `PATCH /inbox/:id` shape as `idea-triage` and `seed-v3-tasks.js`. Mirror those patterns rather than inventing new ones.
+Phase 5 writes use the same `POST /tasks`, `PATCH /inbox/:id` shape as `idea-triage` and `scripts/bongos/<redacted>.js`. Mirror those patterns rather than inventing new ones.
 
 ## Tone for the user
 

package/config/scheduled-routines.json

@@ -3,25 +3,20 @@
   "defaults": { "scope": "instance-wide", "enabled": true, "requiresAutonomy": false },
   "routines": {
     "artifact-audit":        { "scope": "instance-wide", "enabled": true,  "cadence": "weekly",  "requiresAutonomy": false, "note": "deterministic; task 1003200. Reads main's own history + tree, so it runs in CI (a vendored core is not a git repo) — .github/workflows/artifact-audit.yml." },
-    "artifact-staleness":    { "scope": "instance-wide", "enabled": true,  "cadence": "daily",   "requiresAutonomy": false, "note": "deterministic; task 1001930 / ADR 0110 pt.5. INSTANCE-SIDE ONLY, and the opposite of artifact-audit above: it reads the gitignored deploy-generated files on the serving machine's disk, which a CI checkout legitimately does not have — so it declares no cadence in its SKILL.md and no workflow fires it. This cadence is the hint the operator's own scheduler reads." },
     "bfg":                    { "scope": "instance-wide", "builderAware": true, "enabled": true,  "cadence": "nightly", "requiresAutonomy": false, "note": "Parts A+B read-only + always-on; Part C (cross-builder write) is separately gated by BFG_WRITE_ENABLED + a provisioned principal token." },
     "bfg-session-eval":       { "scope": "instance-wide", "builderAware": true, "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
     "core-update-subscription": { "scope": "instance-wide", "enabled": true, "cadence": "15min", "requiresAutonomy": true, "note": "Patch-only auto-upgrade of subscribed consumer instances (ADR 0136 / task 2150). Default OFF + opt-in: the roster (config/update-subscriptions.json) ships empty, so this is a no-op until an operator arms autonomy AND lists an instance. Every upgrade is health-gated with auto-rollback (task 2149). CADENCE (task 1003674): this is the knob that decides how long a published release waits before a subscribed instance takes it — at 'daily' a builder's ship reached the live site up to 24h late, because everything upstream is already fast (CI publishes to npm within ~2 min of merge) and this sweep was the only slow step. 15min is the worst-case lag, not a re-check cost: the sweep exits immediately when the registry has nothing newer. FLOOR ~5min: an upgrading run takes ~2 min, and runs must not overlap. Installing the period is the operator's half — see docs/recipes/upgrading-the-core.md." },
-    "dep-audit-nightly":      { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
-    "diagram-drift":          { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
+    "dep-audit-nightly":      { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false, "note": "deterministic; task 1004878. Fired by the in-process daily-checks poller (modules/autonomy/pollers/daily-checks.js): npm audit of the deployed instance, high/critical findings filed as ONE idea, re-filed only when the set changes." },
     "idea-triage-nightly":    { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true },
     "main-audit":             { "scope": "instance-wide", "enabled": true,  "cadence": "on-merge", "requiresAutonomy": false, "note": "Trust-boundary backstop — audits commits landed on main." },
-    "newcomer-floor":         { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
-    "newcomer-generator":     { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
     "overnight-builder":      { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true, "note": "Autonomous claim+ship; OFF until the instance arms autonomy." },
     "overnight-code-review":  { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true },
-    "peer-vote-tally":        { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
-    "rank-roles-audit":       { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false, "note": "deterministic; read-only; never fatal at boot (idea 1000622) — task 1002873" },
+    "peer-vote-tally":        { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false, "note": "deterministic; fired weekly by the in-process routine-timers poller (modules/autonomy/pollers/routine-timers.js)." },
+    "rank-roles-audit":       { "scope": "instance-wide", "enabled": true,  "cadence": "daily", "requiresAutonomy": false, "note": "deterministic; read-only; never fatal at boot (idea 1000622) — task 1002873. Fired by the in-process daily-checks poller (task 1004878)." },
     "redteam-weekly":         { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false, "note": "deterministic; task 1003128" },
     "repo-simplify-sweep":    { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false },
     "security-review-weekly": { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false },
     "skill-usage-review":     { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
-    "stale-claim-release":    { "scope": "instance-wide", "enabled": true,  "cadence": "hourly", "requiresAutonomy": false },
     "stranded-rows":          { "scope": "instance-wide", "enabled": true,  "requiresAutonomy": false, "note": "no cadence: nothing schedules it yet, so it is run by hand — declaring one with no cron firing it fails fitness Check 25 (task 1003775)" }
   }
 }

package/docs/adr/0091-bounding-the-kernel-and-db-carve.md

@@ -84,7 +84,7 @@ This ADR's deliverable is the decision above **plus** the carve broken into clai
 
 **Proof of equivalence at every step** (ADR 0083 / 0062 discipline): after each carve, OTB behaves **byte-for-byte the same**. That is the per-task done-when.
 
-**Tranche-1 status: PROVEN** (R74, [#1578](https://example.com/builders#/task/1578)). The five claims above are demonstrated, in one re-runnable command, by [`scripts/gds/coreB-carve-proof.sh`](../../scripts/gds/coreB-carve-proof.sh): memory + grading are loader-discovered modules; `db-kernel.js` + the memory query slice left the `db.js` monolith; `KERNEL_FILES` is the bounded 17-file roster with zero fitness hard-failures (incl. the three ENFORCING C7 boundary checks); grading resolves through the `grade` kernel port (`seams.resolveOptional('grade')`) with no core→grader import; and the 27 DB-free tests exercising the carved surfaces pass unchanged (byte-identical). The ongoing guard is CI — `fitness.js` (the kernel-imports-no-domain ratchet flips red at zero leaks) + `run-unit-tests.js` on every PR; the script is the consolidated demonstration, not a new gate. Tranche 2 (the remaining ~8 core domains) stays deferred per owner until greenlit.
+**Tranche-1 status: PROVEN** (R74, [#1578](https://example.com/builders#/task/1578)). The five claims above are demonstrated, in one re-runnable command, by `scripts/gds/coreB-carve-proof.sh` (deleted once the carve was done, task 1004856; in history at dc7d88169): memory + grading are loader-discovered modules; `db-kernel.js` + the memory query slice left the `db.js` monolith; `KERNEL_FILES` is the bounded 17-file roster with zero fitness hard-failures (incl. the three ENFORCING C7 boundary checks); grading resolves through the `grade` kernel port (`seams.resolveOptional('grade')`) with no core→grader import; and the 27 DB-free tests exercising the carved surfaces pass unchanged (byte-identical). The ongoing guard is CI — `fitness.js` (the kernel-imports-no-domain ratchet flips red at zero leaks) + `run-unit-tests.js` on every PR; the script is the consolidated demonstration, not a new gate. Tranche 2 (the remaining ~8 core domains) stays deferred per owner until greenlit.
 
 ---
 

package/docs/adr/0093-tranche-2-core-carve-sequence.md

@@ -10,7 +10,7 @@
 
 ## Context
 
-Tranche 1 ([ADR 0091](0091-bounding-the-kernel-and-db-carve.md)) did two things: it **proved the core-carve pattern** on the two cleanest-slicing domains (memory, grading — demonstrated by [`scripts/gds/coreB-carve-proof.sh`](../../scripts/gds/coreB-carve-proof.sh), R74), and it **shipped the infrastructure** every later carve reuses — the bounded kernel roster + `KERNEL_FILES` fitness ratchet (R70), the doorway with `withTx` (R68), the per-domain `db.js` slice pattern + `db-kernel.js` (R69), and the `grade` kernel **port** (R73). That infrastructure is generic: each remaining core domain is now a *pure carve* copying R72/R73, with **no new scaffolding**.
+Tranche 1 ([ADR 0091](0091-bounding-the-kernel-and-db-carve.md)) did two things: it **proved the core-carve pattern** on the two cleanest-slicing domains (memory, grading — demonstrated by `scripts/gds/coreB-carve-proof.sh` (deleted once the carve was done, task 1004856; in history at dc7d88169), R74), and it **shipped the infrastructure** every later carve reuses — the bounded kernel roster + `KERNEL_FILES` fitness ratchet (R70), the doorway with `withTx` (R68), the per-domain `db.js` slice pattern + `db-kernel.js` (R69), and the `grade` kernel **port** (R73). That infrastructure is generic: each remaining core domain is now a *pure carve* copying R72/R73, with **no new scaffolding**.
 
 What remains is the bulk of the core: ~8 cohesive domains + the two web UIs + the lifecycle state machine ([02 §6](../design/modular-architecture/02-module-map.md) roster). The import-graph scan ([02 §2](../design/modular-architecture/02-module-map.md)) already told us which slice cleanly (economy, ideas, security alongside the proven memory/grading) and which is the coupled cluster (the lifecycle — `tasks → grader/github-push/ship-broadcast`). This ADR turns that evidence into a sequence.
 

package/docs/canonical-permissions.md

@@ -94,7 +94,7 @@ forming the ordered claim-gate tier **`xenos` (1) < `thetes` (2) < `metic` (3) <
   deliberate Archon promotion.
 - **`xenos`** — the **sandboxed entry rank** every new GitHub-authed builder defaults to (migration
   029 flipped the column default here). Read-only on public surfaces; may claim + ship **only** tasks
-  an Archon (or the newcomer-generator) has flagged `newcomer_friendly = true` (enforced in
+  an Archon has flagged `newcomer_friendly = true` (enforced in
   `db.claimTask` / `claimTasksBatch`, returns `rank_too_low_for_task`). Cannot triage, resolve
   blockers, or run planning/priority sessions. This is also the tier a deactivated/offboarded builder
   is dropped to by `/builder-exit` (migration `025`); for them `status='inactive'` additionally blocks

package/docs/file-map.md

@@ -431,26 +431,21 @@ tests/
 ```
 .claude/scheduled-tasks/
 ├── artifact-audit/SKILL.md            ← weekly artifact audit (task 1003200): every task at shipped/confirmed/completed that DECLARES a code artifact is checked against main's commit messages AND the content of its tracked files — both, because a fix can land under another branch and be cited only in a comment (task 1003212). Anything unproven is filed as a blocker, deduped on the finding set. Scoped to ships on/after the ship-assurance gate (2026-08-19, ADR 0184), before which a DB-only ship recorded no declaration and silence proves nothing. FIRED BY .github/workflows/artifact-audit.yml, Mondays 06:23 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/bongos/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
-├── artifact-staleness/SKILL.md        ← freshness backstop for the gitignored deploy-generated navigation docs (task 1001930, ADR 0110 pt.5): docs/repo-map.md and docs/session-log-index.md are untracked, so no PR gate can see them and a broken deploy regen step leaves a stale or missing map with only a journald line as the alarm. Asks each artifact's own generator (--check-whole) whether it still matches the served commit, reports absent and stale separately, and posts findings to Discord #ship-news itself. INSTANCE-SIDE ONLY — a fresh CI clone legitimately lacks these files, so it declares no cadence and no workflow fires it; config/scheduled-routines.json records the intended daily cadence.
 ├── bfg/SKILL.md                       ← nightly BFG pass (MAS Phase 6, ADR 0026) — doc/memory hygiene + DB counter-vs-ledger drift (Part A), per-builder interaction scoring into transferable-practice suggestions (Part B), and the audited cross-builder memory write (Part C, OFF unless BFG_WRITE_ENABLED) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── bfg-session-eval/SKILL.md          ← nightly session-inefficiency evaluator (MAS Phase 6D, ADR 0027) — mines the session corpus for wasteful sessions and files the fixes as idea_inbox rows plus a docs/audits report (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── core-update-subscription/SKILL.md  ← daily patch-only auto-upgrade of subscribed consumer instances (ADR 0136) — deterministic `subscribe.js` step, health-gated with auto-rollback; opt-in and autonomy-gated, so a no-op until an operator arms it (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── dep-audit-nightly/SKILL.md         ← nightly dependency-vulnerability scan (`scripts/security/dep-audit.js`) across npm and the droplet's system packages; findings become idea_inbox rows plus one vulnerability_report per high/critical (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── diagram-drift/SKILL.md             ← daily deterministic backstop that re-derives the onboarding diagrams from migrations plus the live version API and files an idea when the committed ones have drifted (`check.js --file-idea`) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── dep-audit-nightly/SKILL.md         ← daily npm audit of the deployed instance (`scripts/security/dep-audit.js`); high/critical findings become ONE idea_inbox row, re-filed only when the set changes — fired in-process by modules/autonomy/pollers/daily-checks.js (task 1004878)
 ├── idea-triage-nightly/SKILL.md       ← nightly autonomous idea_inbox walk — promotes high-confidence ideas to tasks, discards obvious noise, defers anything ambiguous; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── main-audit/SKILL.md                ← post-merge trust-boundary backstop (ADR 0043 / SEC 863) — audits commits landed on main for sub-Metic edits to permission-sensitive surfaces (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── newcomer-floor/SKILL.md            ← daily check that the three evergreen newcomer chores (engineer / artist / ideator) stay stocked; the server restocks them via modules/onboarding/newcomer-restock.js (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── newcomer-generator/SKILL.md        ← daily deterministic generator (`generate.js`) that tops the newcomer_friendly task queue back up to its floor (criterion C1 — newcomer queue always populated) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── overnight-builder/SKILL.md         ← autonomous overnight session-runner — claims the highest-priority safe task, works it end-to-end and ships it; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── overnight-code-review/SKILL.md     ← nightly autonomous code-quality review; each finding lands as its own idea_inbox row so it survives triage; autonomy-gated and OFF by default (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── peer-vote-tally/SKILL.md           ← deterministic tally (`tally.js`) folding builder-on-builder peer votes at least 7 days old into karma_log rows (criterion C2) (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── peer-vote-tally/SKILL.md           ← deterministic tally (`tally.js`) folding builder-on-builder peer votes at least 7 days old into karma_log rows (criterion C2) — fired weekly in-process by modules/autonomy/pollers/routine-timers.js
 ├── publish-watch/SKILL.md             ← daily publish-lane check (task 1003916): compares every version the release lane ANNOUNCED in its own release commits against what the registry actually holds, and posts anything announced-but-never-delivered to Discord #ship-news. Exists because the 2026-09-13 outage (8 failed runs, 3 hours) was found by a person reading the npm version list — a failed run is one red row nobody watches, and the next merge erases the evidence. Silent on a healthy day by design; exit 2 (could not read) is distinct from exit 1 (found one).
-├── rank-roles-audit/SKILL.md          ← nightly deterministic check that every builder holds one of the four live ranks, so none silently resolves to zero permissions under the governance_002 backfill's INNER JOIN; detect-only, files one idea_inbox row and never repairs, and never fatal at boot (task 1002873; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── rank-roles-audit/SKILL.md          ← daily deterministic check that every builder holds one of the four live ranks, so none silently resolves to zero permissions under the governance_002 backfill's INNER JOIN; detect-only, files one idea_inbox row and never repairs (task 1002873) — fired in-process by modules/autonomy/pollers/daily-checks.js (task 1004878)
 ├── redteam-weekly/SKILL.md            ← weekly deterministic red-team patrol (task 1003128): full-history gitleaks scan + dependency drift review (audit delta, cooldown, young pkgs, stale overrides) + action-pin check → files security reports (advisory, ADR 0158 §2). FIRED BY .github/workflows/redteam-patrol.yml, Mondays 06:17 UTC — `cadence: weekly` here and that cron must agree or fitness Check 25 (scripts/bongos/routine-schedule.js) fails the gate (task 1003209, ADR 0188)
 ├── repo-simplify-sweep/SKILL.md       ← weekly repo-cleanliness janitor — runs repo-metrics, files dead-code findings to idea_inbox, and auto-fixes only the narrow safe class (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── security-review-weekly/SKILL.md    ← weekly security-state review — stale vulnerability_reports, ageing security-tagged tasks, recent high/critical dependency alerts; one Archon broadcast when anything is stale, silent otherwise (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── skill-usage-review/SKILL.md        ← nightly skill-usage feedback loop — aggregates 24h of skill invocations into friction findings filed as `[skill-friction]` idea_inbox rows (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-├── stale-claim-release/SKILL.md       ← hourly sweep releasing claims whose session_pulses heartbeat has been silent for GDS_STALE_CLAIM_HOURS, returning the task to ready and pinging the builder (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 └── stranded-rows/SKILL.md             ← flags an open task whose work ALREADY LANDED on main (task 1003775): a row still in ready/backlog while a commit claims it with a line ending in `(task N)`. Narrower than "mentions N" on purpose — idea 1000807 measured that a mention-scan returns ~44 open rows that merely cite an id. Measured clean at 878 claims vs 434 open rows, and still catches the historical case (task 1002200, whose claim lives in the MERGE commit body). NO cadence declared: nothing schedules it yet, so it is run by hand — wiring a scheduler needs the control plane, and declaring a cadence with no cron firing it fails fitness Check 25 (task 1003209, ADR 0188). Prints ids + fixed vocabulary only, never builder-authored text.
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->

package/docs/handoff-template.md

@@ -70,7 +70,7 @@ If your change touched anything the onboarding diagrams describe — the **rank
 - **All five diagrams are auto-generated** by `scripts/bongos/gen-diagrams.js` — run it (`node scripts/bongos/gen-diagrams.js`) and confirm the result looks right; **do not hand-edit any `.mmd`**. The mechanical three (`01-task-lifecycle`, `02-rank-ladder`, `05-versioning`) regenerate from migrations + the public version API. The conceptual two (`03-example-karma`, `04-architecture`) regenerate from the **authenticated** `/tasks/:id` status of their backing tasks (and 03's seeded-achievement count); if no session is present the generator skips them cleanly. Rendering produces both `.svg` (the pannable viewer asset) and `.png` (fallback).
 - To change a diagram's **layout or wording**, edit the matching template function in `gen-diagrams.js` — not the `.mmd`. `assertions.json` is rebuilt by the generator in lockstep, so you don't hand-maintain it.
 
-The `diagram-drift` routine is a belt-and-braces backstop (it should find nothing once the generator has run), but the point is not to rely on it — running `gen-diagrams.js` is part of the change.
+There is no drift backstop (the `diagram-drift` routine was retired in task 1004878) — running `gen-diagrams.js` is part of the change.
 
 ---
 

package/docs/module-api-changelog.md

@@ -3189,5 +3189,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.174 with no explicit bump. run 40234506483. (task 1002620)
   1.21.176 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.175 with no explicit bump. run 40235567383. (task 1002620)
+  1.21.177 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.176 with no explicit bump. run 40241825861. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/onboarding/diagrams/README.md

@@ -69,16 +69,12 @@ The diagrams are surfaced inside the authenticated **builders' hall** at
 
 ## Staying current (auto-update)
 
-Two mechanisms keep these honest as the system changes (added under [#356](https://example.com/builders#/task/356)):
+One mechanism keeps these honest as the system changes (added under [#356](https://example.com/builders#/task/356)):
 
 1. **Render-on-deploy** — all five diagrams auto-regenerate on deploy: `scripts/bongos/gen-diagrams.js` re-renders every `.mmd` to its `.svg` + `.png` and rebuilds `assertions.json` in lockstep, so the committed images never drift from their source. (Do **not** hand-edit the `.mmd`/`.svg`/`.png`/`assertions.json` — edit the template in `gen-diagrams.js` and re-run it.)
-2. **Drift detection** — the `diagram-drift` scheduled task (`.claude/scheduled-tasks/diagram-drift/`) runs a deterministic checker that compares `assertions.json` (below) against the live DB/code. Since all five diagrams auto-regenerate on deploy, this is a **belt-and-braces backstop** (it should find nothing in normal operation); on divergence it files an `idea_inbox` entry. Run it manually any time:
-   ```bash
-   node .claude/scheduled-tasks/diagram-drift/check.js          # report only
-   node .claude/scheduled-tasks/diagram-drift/check.js --file-idea
-   ```
+(A second, the `diagram-drift` scheduled check, was retired in task 1004878: it was never scheduled, could not run on the packaged server, and duplicated the regeneration above.)
 
-`assertions.json` is the machine-readable record of what these diagrams claim about the live system (rank enum + wired ranks, task-status set, live versions, and the conceptual `architecture` + `example_karma` piece→task slices). It is **rebuilt by `gen-diagrams.js` in lockstep with the diagrams**, so you no longer hand-maintain it; it stays as the drift checker's reference.
+`assertions.json` is the machine-readable record of what these diagrams claim about the live system (rank enum + wired ranks, task-status set, live versions, and the conceptual `architecture` + `example_karma` piece→task slices). It is **rebuilt by `gen-diagrams.js` in lockstep with the diagrams**, so you no longer hand-maintain it.
 
 ## Regenerating the diagrams by hand
 

package/docs/onboarding/diagrams/assertions.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Machine-readable facts the onboarding diagrams assert about the LIVE system. The diagram-drift scheduled task (.claude/scheduled-tasks/diagram-drift/) compares these against the live DB/code and files an idea_inbox entry when they diverge, so the diagrams stay an honest snapshot. When a diagram is intentionally updated, update the matching values here in the same commit. Baselined 2026-05-26 under task #356.",
+  "_comment": "Machine-readable facts the onboarding diagrams assert about the LIVE system. gen-diagrams.js rebuilds them from the live DB/code in lockstep with the diagrams. When a diagram is intentionally updated, update the matching values here in the same commit. Baselined 2026-05-26 under task #356.",
   "rank_ladder": {
     "diagram": "02-rank-ladder",
     "rank_enum": [
@@ -82,7 +82,7 @@
   },
   "drachmae_karma": {
     "diagram": "03-drachmae-karma",
-    "_comment": "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/bongos/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep, so this slice is a redundant backstop the drift checker verifies. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
+    "_comment": "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/bongos/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
     "live_tasks": [
       {
         "id": 284,
@@ -115,7 +115,7 @@
   },
   "architecture": {
     "diagram": "04-architecture",
-    "_comment": "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/bongos/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
+    "_comment": "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/bongos/gen-diagrams.js in lockstep with the diagram. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
     "live_tasks": [
       {
         "id": 273,

package/docs/recipes/ops-gotchas.md

@@ -216,11 +216,13 @@ Inside the namespace the file lists as `---------- 1 root root 0`. The runner un
 
 ## Bongos build pipeline
 
-### Two deterministic routines run as in-process server timers, not external cron
+### The deterministic routines run as in-process server timers, not external cron
 
 - **What:** `peer-vote-tally` (weekly) runs inside the always-on Node process via the autonomy module's poller `modules/autonomy/pollers/routine-timers.js` (ADR 0078 amendment, task 1382; carved into `modules/autonomy/` at BV1.R83) — no `claude -p`, no external cron, no token. The loader's `startModulePollers` starts it from `src/platform-server.js` at boot (task 1002419 — before that fix the call site had been lost with the retired `server.js` and no module poller started at all); it reaches `tallyPeerVotes` through the doorway. It's a no-op anywhere the DB is unreachable (builder machines), so it only does work on the prod droplet.
 - **Disable / move it out-of-process:** set `ROUTINE_TIMERS_DISABLED=1` in `/etc/example/web-source.env` and restart. Also set it on any **second** always-on instance that shares the `example` DB so the tally can't double-fold (the `FOR UPDATE OF pv` row lock is the hard guard if you forget).
 - **Run it manually now:** `node scripts/bongos/run-routine.js peer-vote-tally` (the dispatcher front door still works). The cadence is boot-anchored ("~90s after boot, then weekly"), not a wall-clock Monday job — frequent deploys re-anchor it, which is harmless (the tally is idempotent).
+- **The daily checks** (task 1004878): `rank-roles-audit` and `dep-audit-nightly` run from the sibling poller `modules/autonomy/pollers/daily-checks.js`. Unlike peer-vote it is **not** boot-anchored — deploys restart the server many times a day — so it ticks hourly and runs a check only when that check's last `autonomy_runs` row is ~a day old. Findings go to the idea inbox, once per distinct set (the row stores a fingerprint; an identical result is recorded `unchanged`). See what ran without SSH: `GET /autonomy/runs?routine=dep-audit-nightly`. Same kill switch (`ROUTINE_TIMERS_DISABLED=1`). Which routines the server fires, and how often, is ONE table — `modules/autonomy/server-schedule.js` — read by both the pollers and the merge-gate check `scripts/bongos/routine-schedule.js`.
+- **`dep-audit-nightly` audits the INSTANCE root** (`resolveInstanceRoot()`, the service's working directory), so it needs `npm` on the service's PATH and a `package-lock.json` there. Without either it records a `no-go` row with the reason — never a clean pass.
 
 ### A ship was graded FAIL but the work is genuinely good (grader false-negative)
 

package/modules/autonomy/db.js

@@ -62,6 +62,14 @@ async function readAutonomyRuns({ routine = null, limit = 20 } = {}) {
   return rows.map((r) => ({ ...r, id: String(r.id) }));
 }
 
+// readRankRoster — every builder's id, login, rank and status, for the daily
+// rank-roles check (task 1004878). No WHERE on purpose: an INACTIVE builder on a
+// legacy rank is exactly the row a future CHECK-narrowing migration would fail on.
+async function readRankRoster() {
+  const { rows } = await pool.query('SELECT id, github_login, rank, status FROM builders ORDER BY id');
+  return rows;
+}
+
 // ── the Autobongos fence (task 1003908, ADR 0307 §6) ─────────────────────────
 //
 // These back the one control surface the runner host cannot write to. Everything
@@ -350,6 +358,7 @@ module.exports = {
   recordAutonomyRun,
   lastAutonomyHead,
   readAutonomyRuns,
+  readRankRoster,
   recordRunnerHeartbeat,
   readRunnerHeartbeats,
   readFence,

package/modules/autonomy/module.json

@@ -1,7 +1,7 @@
 {
   "key": "autonomy",
   "title": "Autonomy & MAS (conductor · architect · gate · routine timers)",
-  "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
+  "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller, and since task 1004878 the daily rank-roles and dependency-audit checks). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
   "version": "1.0.0",
   "coreVersion": "^1.11.0",
   "category": { "parent": "work" },
@@ -9,7 +9,7 @@
   "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["autonomy"],
-    "pollers": ["routine-timers"]
+    "pollers": ["routine-timers", "daily-checks"]
   },
   "provides": [],
   "consumes": []

package/modules/autonomy/pollers/daily-checks.js

@@ -0,0 +1,262 @@
+'use strict';
+
+// modules/autonomy/pollers/daily-checks.js — the deterministic daily checks, fired
+// by the always-on server itself (task 1004878).
+//
+// WHY IN-PROCESS. Every one of these routines declared a cadence and nothing fired
+// it: the repo's only scheduler was .github/workflows/, whose minutes are billable
+// and already oversubscribed, and the operator-side cron the SKILL.md files kept
+// asking for was never written. The routine-timers poller beside this one solved
+// the same problem for peer-vote-tally (ADR 0078 amendment) — an in-process timer
+// costs nothing and cannot be forgotten by an operator. This is that pattern for
+// the daily checks.
+//
+// THE CHECKS (the rows of ../server-schedule.js with poller 'daily-checks'):
+//   - rank-roles-audit  — every builder on one of the live ranks (task 1002873).
+//                         Reads the roster straight from this instance's DB, so it
+//                         needs no CLI session — the reason the script never ran
+//                         unattended.
+//   - dep-audit-nightly — `npm audit` of the DEPLOYED instance (its own root and
+//                         lockfile, not a repo checkout), high/critical only.
+//
+// DAILY BY THE CLOCK, NOT BY THE BOOT. The server restarts on every deploy, and a
+// boot-anchored timer would re-run (and re-file) on each one. So the timer only
+// ticks hourly and asks the ledger: a check runs when its last `autonomy_runs` row
+// is (nearly) a day old. The same rows are what GET /autonomy/runs shows, so
+// "did the daily check run, and what did it find" is answerable from a laptop.
+//
+// ONE IDEA PER DISTINCT FINDING SET. A finding is filed into the idea inbox once;
+// the run row stores a fingerprint of what was found, and the next day's identical
+// result is recorded as `unchanged` instead of filed again. A changed set (a new
+// vulnerability, a second bad rank) files again. A clean run clears it, so a
+// regression after a fix is a fresh idea.
+//
+// Mirrors routine-timers.js (but logs through api.logger, not console): kill switch ROUTINE_TIMERS_DISABLED, unref'd timers,
+// best-effort (a throw logs and waits for the next tick — never crashes the
+// server), pure w.r.t. injected deps so it unit-tests without a database, and a
+// quiet no-op anywhere the database is unreachable (builder laptops).
+
+const { execFile } = require('node:child_process');
+const crypto = require('node:crypto');
+const api = require('../../../src/module-api');
+const autonomyDb = require('../db');
+const rankRoles = require('../rank-roles');
+const depAudit = require('../../../scripts/security/dep-audit');
+const { SERVER_ROUTINES, periodMs } = require('../server-schedule');
+
+const log = api.logger('autonomy');
+
+const ROUTINES = SERVER_ROUTINES.filter((r) => r.poller === 'daily-checks').map((r) => r.routine);
+
+const TICK_MS = Number(process.env.ROUTINE_DAILY_CHECKS_TICK_MS) || 60 * 60_000;
+// Later than peer-vote's 90s so the two first ticks never land together.
+const FIRST_MS = Number(process.env.ROUTINE_DAILY_CHECKS_FIRST_MS) || 3 * 60_000;
+const JITTER_MS = 60_000;
+// A check is due this long BEFORE a full period has passed. Hourly ticks land up to
+// an hour late; without the slack each day's run would slide an hour later than the
+// last. With it, runs stay between 23.5 and 24.5 hours apart.
+const DUE_SLACK_MS = 30 * 60_000;
+// npm audit is a network call to the registry; one stuck call must not hold the
+// next day's check hostage.
+const NPM_AUDIT_TIMEOUT_MS = 5 * 60_000;
+
+// ── the checks ─────────────────────────────────────────────────────────────────
+// Each returns { keys, idea } — `keys` identify the findings (empty = clean) and
+// feed the fingerprint; `idea` is what gets filed. A check that cannot run THROWS:
+// "could not check" must never be recorded as clean.
+
+async function checkRankRoles(deps) {
+  const rows = await deps.db.readRankRoster();
+  const offenders = rankRoles.findRanksWithoutRoles(rows, deps.liveRanks || api.LIVE_RANK_LADDER);
+  return {
+    keys: offenders.map((o) => `${o.id}:${o.rank}`),
+    idea: { ...rankRoles.ideaFor(offenders, { filedBy: "the server's daily rank-roles check" }), kind: 'bug' },
+  };
+}
+
+// The async spawn. execFile reports npm's own exit 1 (findings present) as an error
+// too, so only a missing binary or a timeout counts as "could not run".
+function npmAudit(cwd) {
+  return new Promise((resolve) => {
+    execFile('npm', depAudit.NPM_AUDIT_ARGS, { cwd, maxBuffer: 32 * 1024 * 1024, timeout: NPM_AUDIT_TIMEOUT_MS },
+      (err, stdout, stderr) => {
+        const failed = err && (err.code === 'ENOENT' || err.killed);
+        resolve({ stdout, stderr, error: failed ? (err.code === 'ENOENT' ? 'npm not found' : 'npm audit timed out') : null });
+      });
+  });
+}
+
+async function checkDepAudit(deps) {
+  const cwd = deps.cwd || api.resolveInstanceRoot();
+  const out = await (deps.npmAudit || npmAudit)(cwd);
+  if (out.error) throw new Error(out.error);
+  const res = depAudit.parseNpmAudit(out.stdout, out.stderr);
+  if (!res.ok) throw new Error(res.raw_error);
+  const f = res.findings;
+  return {
+    keys: f.map((x) => `${x.package}:${x.id || x.summary}`),
+    idea: {
+      kind: 'infra',
+      title: `[dep-audit] ${f.length} high/critical ${f.length === 1 ? 'vulnerability' : 'vulnerabilities'} in this instance's dependencies`,
+      bodyMd: [
+        `The server's daily \`npm audit\` of this instance (${cwd}) found ${f.length} high/critical advisory(ies):`,
+        '',
+        ...f.map((x) => `- **${x.package}** (${x.severity}) — ${x.summary}${x.url ? ` — ${x.url}` : ''}. Fix: ${x.fix}.`),
+        '',
+        'Most of these arrive through the core package, so the fix is usually a core release',
+        'that bumps the dependency, then moving this instance onto it.',
+        '',
+        'Filed by modules/autonomy/pollers/daily-checks.js (task 1004878). The same set is not',
+        're-filed tomorrow; a changed set is.',
+      ].join('\n'),
+    },
+  };
+}
+
+const CHECKS = {
+  'rank-roles-audit': checkRankRoles,
+  'dep-audit-nightly': checkDepAudit,
+};
+
+// ── the ledger half ────────────────────────────────────────────────────────────
+
+const fingerprint = (keys) =>
+  crypto.createHash('sha1').update([...keys].sort().join('\n')).digest('hex').slice(0, 12);
+
+// The fingerprint the last DELIVERED finding carried, or null. Only a `go` row
+// counts: an error or an undelivered filing in between must not make tomorrow's
+// identical result look new, and must not make it look delivered either.
+function lastFiledFingerprint(rows) {
+  const go = (rows || []).find((r) => r.decision === 'go');
+  const m = go && /\bfp=([0-9a-f]+)/.exec(go.reason || '');
+  return m ? m[1] : null;
+}
+
+function isDue(rows, routine, now) {
+  const last = (rows || [])[0];
+  if (!last) return true;
+  const at = new Date(last.created_at).getTime();
+  if (!Number.isFinite(at)) return true;
+  return now - at >= periodMs(routine) - DUE_SLACK_MS;
+}
+
+// One routine, once: run it if it is due, file what it found if that is new, and
+// write the row that says so. NEVER throws.
+async function runCheck(routine, deps = {}) {
+  const db = deps.db || autonomyDb;
+  const logFn = deps.log || ((m) => log.info(m));
+  const errFn = deps.error || ((m) => log.error(m));
+  const now = deps.now ? deps.now() : Date.now();
+  const record = (decision, reason) =>
+    db.recordAutonomyRun({ routine, decision, reason }).catch((e) =>
+      errFn(`[daily-checks] ${routine}: could not record the run (${e && e.message})`));
+
+  let rows;
+  try {
+    rows = await db.readAutonomyRuns({ routine, limit: 10 });
+  } catch (e) {
+    return { skipped: 'db_unreachable', error: e && e.message };
+  }
+  if (!isDue(rows, routine, now)) return { skipped: 'not_due' };
+
+  let result;
+  try {
+    result = await CHECKS[routine]({ ...deps, db });
+  } catch (e) {
+    const msg = (e && e.message) || String(e);
+    errFn(`[daily-checks] ${routine}: could not run (${msg})`);
+    await record('no-go', `error: ${msg}`.slice(0, 500));
+    return { outcome: 'error', error: msg };
+  }
+
+  if (!result.keys.length) {
+    await record('go', 'clean');
+    return { outcome: 'clean' };
+  }
+  const fp = fingerprint(result.keys);
+  const n = result.keys.length;
+  if (fp === lastFiledFingerprint(rows)) {
+    await record('go', `findings n=${n} fp=${fp} unchanged`);
+    return { outcome: 'unchanged', fingerprint: fp };
+  }
+  const capture = deps.captureIdea || api.resolveOptional('ideas.capture');
+  if (typeof capture !== 'function') {
+    errFn(`[daily-checks] ${routine}: ${n} finding(s) and no idea inbox to file them in (ideas module off)`);
+    await record('no-go', `findings n=${n} fp=${fp} undelivered: no ideas.capture`);
+    return { outcome: 'undelivered', fingerprint: fp };
+  }
+  try {
+    const idea = await capture({ ...result.idea, filedVia: 'api' });
+    logFn(`[daily-checks] ${routine}: ${n} finding(s) filed as idea ${idea && idea.id}`);
+    await record('go', `findings n=${n} fp=${fp} idea=${idea && idea.id}`);
+    return { outcome: 'filed', fingerprint: fp, ideaId: idea && idea.id };
+  } catch (e) {
+    const msg = (e && (e.message || e.code)) || String(e);
+    errFn(`[daily-checks] ${routine}: ${n} finding(s), filing failed (${msg})`);
+    await record('no-go', `findings n=${n} fp=${fp} undelivered: ${msg}`.slice(0, 500));
+    return { outcome: 'undelivered', fingerprint: fp, error: msg };
+  }
+}
+
+// One tick: every daily routine in turn. Sequential on purpose — npm audit is the
+// heavy one and nothing here is urgent enough to run two at once.
+let running = false;
+let warnedUnreachable = false;
+async function tick(deps = {}) {
+  if (running) return [];
+  running = true;
+  try {
+    const out = [];
+    for (const routine of ROUTINES) {
+      const r = await runCheck(routine, deps);
+      if (r.skipped === 'db_unreachable' && !warnedUnreachable) {
+        warnedUnreachable = true;
+        log.info(`[daily-checks] skipped — database unreachable (${r.error}); a builder machine has nothing to check`);
+      }
+      out.push({ routine, ...r });
+    }
+    return out;
+  } finally {
+    running = false;
+  }
+}
+
+let firstTimer = null;
+let interval = null;
+
+function start(deps = {}) {
+  if (process.env.ROUTINE_TIMERS_DISABLED === '1') {
+    log.info('[daily-checks] disabled (ROUTINE_TIMERS_DISABLED=1)');
+    return;
+  }
+  if (firstTimer || interval) return; // already started
+  const fire = () => tick(deps).catch((e) => log.error(`[daily-checks] tick crashed: ${e && e.message}`));
+  firstTimer = setTimeout(() => {
+    fire();
+    interval = setInterval(fire, TICK_MS);
+    if (interval.unref) interval.unref();
+  }, FIRST_MS + Math.floor(Math.random() * JITTER_MS));
+  if (firstTimer.unref) firstTimer.unref();
+  log.info(`[daily-checks] started — ${ROUTINES.join(', ')} once a day (checked hourly against the run ledger)`);
+}
+
+function stop() {
+  if (firstTimer) clearTimeout(firstTimer);
+  if (interval) clearInterval(interval);
+  firstTimer = interval = null;
+}
+
+module.exports = {
+  start,
+  stop,
+  tick,
+  runCheck,
+  isDue,
+  fingerprint,
+  lastFiledFingerprint,
+  checkRankRoles,
+  checkDepAudit,
+  ROUTINES,
+  TICK_MS,
+  DUE_SLACK_MS,
+};

package/modules/autonomy/pollers/routine-timers.js

@@ -38,9 +38,9 @@
 //     so over-/under-firing is harmless and a second instance can't double-fold.
 //
 // (diagram-drift was intentionally NOT made a timer: all five onboarding diagrams
-// already auto-regenerate from live facts on every deploy, so a daily drift check
-// is near-redundant; the manual `node scripts/bongos/run-routine.js diagram-drift`
-// remains for on-demand use. See the ADR 0078 amendment.)
+// already auto-regenerate from live facts on every deploy. Task 1004878 retired
+// the routine outright. The daily checks that ARE timed live beside this file, in
+// daily-checks.js.)
 //
 // Mirrors the publish-reconciler contract: env-overridable interval, an UNREF'd
 // timer (never holds the process open across a systemd restart), best-effort (a
@@ -57,9 +57,11 @@
 // core load at module-discovery time, and so tests that pass deps.db bypass it.
 const api = require('../../../src/module-api');
 
-const WEEK_MS = 7 * 24 * 60 * 60_000;
+// The period comes from ../server-schedule.js, the table the merge-gate cadence check
+// (scripts/bongos/routine-schedule.js) also reads — so the two cannot disagree.
+const { periodMs } = require('../server-schedule');
 
-const PEER_VOTE_INTERVAL_MS = Number(process.env.ROUTINE_PEER_VOTE_MS) || WEEK_MS;
+const PEER_VOTE_INTERVAL_MS = Number(process.env.ROUTINE_PEER_VOTE_MS) || periodMs('peer-vote-tally');
 // First-fire delay: let the server finish binding + the other in-process pollers
 // settle before the first tally. Jitter spreads first-fire across a minute so a
 // crash-loop / deploy storm doesn't synchronize every restart's first run.