@bongos/core 1.21.176 → 1.21.178

package/modules/hall-ui/public/settings.html

@@ -472,7 +472,7 @@
      chrome exists before the page scripts run. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -371,7 +371,7 @@
       // Metic+ oversight could not honestly hold it. Everything below IS a rank
       // surface, so this group's gate and audience are unchanged.
       { id: 'watch', label: 'Watch', icon: 'watch', href: '/watch', gate: 'government', position: true },
-      { id: 'gate', label: 'Gate', icon: 'gate', href: '/gate', gate: 'government', position: true },
+      { id: 'gate', label: 'Autobongos', icon: 'gate', href: '/gate', gate: 'government', position: true }, // task 1004859: the runner panel; URL kept for bookmarks
       { id: 'sessions', label: 'Sessions', icon: 'sessions', href: '/sessions', gate: 'government', position: true },
       // The project's own fundamentals (task 1003280, goal 1000072). Mirrors the
       // server's requireGovernmentPage floor; cosmetic only, as every item here is.

package/modules/hall-ui/public/street-card.js

@@ -39,8 +39,8 @@
 //    filed it — an amendment with its revised words, a who-decides change with
 //    its rows, a building's matter with its revised detail. The constitution's own
 //    fields are changed in the Board Room's amendment form, not here.
-//  * Release. An override and a PR held at the gate are released from the card
-//    through their own decide routes. A newer CORE keeps its check-then-take:
+//  * Release. An override is released from the card through its own decide
+//    route (the PR-at-the-gate release went with its route, task 1004859). A newer CORE keeps its check-then-take:
 //    the card draws the Release desk's core row (check, then take it), the same
 //    as the floor desk; only a hall without that row links to the pin's page.
 //
@@ -447,11 +447,9 @@
       cv.actions = [act('fine', 'fine by me', 'primary'), act('refuse', 'object', 'quiet')];
       return cv;
     }
-    if (m.source === 'override_requests' || m.source === 'gate_approvals') {
+    if (m.source === 'override_requests') {
       if (!mine) { cv.readOnly = true; cv.result = 'Someone who may decide it will.'; return cv; }
-      cv.result = m.source === 'gate_approvals'
-        ? 'It is held at the gate. Releasing it lets it merge and go live. The call is yours.'
-        : 'It failed a check or a grade. Releasing it lets it go live anyway. The call is yours.';
+      cv.result = 'It failed a check or a grade. Releasing it lets it go live anyway. The call is yours.';
       cv.actions = [act('release', 'release', 'primary'), act('hold', 'hold', 'quiet')];
       return cv;
     }
@@ -712,7 +710,6 @@
     },
     criteria_uat: { force: function (id, inp, who) { return { title: 'Sign off: ' + who, action: { type: 'satisfy_criterion', criterion_id: Number(id) } }; } },
     override_requests: { release: function (id, inp, who) { return { title: 'Release past its check: ' + who, action: { type: 'approve_override', request_id: Number(id) } }; } },
-    gate_approvals: { release: function (id, inp, who) { return { title: 'Release from the gate: ' + who, action: { type: 'approve_gate', pr: Number(id) } }; } },
     builder_budget: {
       budget: function (id, inp, who) { return inp.option ? { title: who + ': ' + str(inp.label || inp.option), action: { type: 'set_budget', builder_id: Number(id), monthly_usd: inp.option === 'none' ? null : Number(inp.option) } } : null; },
     },
@@ -779,7 +776,6 @@
     if (s.council && COUNCIL_ACTS[s.kind] && COUNCIL_ACTS[s.kind][key]) return councilRequest(s, key, inp);
     if (ACT_ROUTES[s.kind] && ACT_ROUTES[s.kind][key]) return ACT_ROUTES[s.kind][key](enc(s.id), inp);
     if (s.kind === 'override_requests' && key === 'release') return post('/override-requests/' + enc(s.id) + '/decide', { decision: 'approve' });
-    if (s.kind === 'gate_approvals' && key === 'release') return post('/gate-approvals/' + enc(s.id) + '/approve', {});
     return null; // hold, abstain and the core's release (a link) record nothing here
   }
 
@@ -814,7 +810,7 @@
     if (key === 'abstain') return { toast: 'Noted. Nothing goes on the record, and it still waits for your vote until it closes.', building: null, kind: null, close: true };
     if (key === 'revise') return { toast: 'Revised. It sits again on the new wording.', building: b, kind: 'light', close: true };
     if (key === 'hold') return { toast: 'Held. It waits for you.', building: null, kind: null, close: true };
-    if (key === 'release') return { toast: cv && cv.source === 'gate_approvals' ? 'Released from the gate. It merges and goes live.' : 'Released. It goes live.', building: b, kind: 'rise', close: true };
+    if (key === 'release') return { toast: 'Released. It goes live.', building: b, kind: 'rise', close: true };
     if (key === 'fine') return { toast: cv && cv.source === 'goal_join_requests' ? 'Noted. ' + who + ' joins the team.' : 'Noted. ' + who + ' is invited in.', building: b, kind: 'rise', close: false };
     if (key === 'refuse') return { toast: 'Noted. ' + who + ' is not let in.', building: b, kind: 'settle', close: false };
     if (key === 'record') {

package/modules/hall-ui/public/street-desk.js

@@ -154,12 +154,12 @@
 
   // The words a floor counts its rows in, and says when it is cleared.
   const NOUNS = Object.freeze({
-    access_requests: 'waiting', goal_join_requests: 'asking', override_requests: 'asked', gate_approvals: 'ready',
+    access_requests: 'waiting', goal_join_requests: 'asking', override_requests: 'asked',
     core_update: 'update', blockers: 'waiting', board: 'open vote', idea: 'open vote',
   });
   const CLEAR = Object.freeze({
     access_requests: 'Everyone is in', goal_join_requests: 'No one is asking', override_requests: 'No overrides asked',
-    gate_approvals: 'Everything ready is live', blockers: 'Nothing blocked on you', board: 'Every vote is in', idea: 'No ideas waiting',
+    blockers: 'Nothing blocked on you', board: 'Every vote is in', idea: 'No ideas waiting',
     // every other floor that holds matters says its own line too (task 1004562)
     redteam_reports: 'No reports open', removal_proposals: 'No removals asked', grade_appeals: 'No appeals open',
     module_rechecks: 'Every module checked', criteria_uat: 'Nothing waits for a tester', core_update: 'Core is up to date',

package/modules/hall-ui/public/street-inside.js

@@ -466,7 +466,7 @@
     release: {
       holds: 'Putting finished work live, and taking updates to Bongos itself.', rule: 'decide', cap: 7,
       growth: 'Room for a second gate if releases are ever split by area.', annex: 'room for a second gate',
-      floors: [['Overrides', 'past a failed check or grade', { source: 'override_requests' }], ['Modules', 'listed modules, and their re-checks', { source: 'module_rechecks' }], ['Held back', 'work held from going live', { floor: 'release.held_back' }], ['Core update', 'a new version of Bongos', { source: 'core_update', desk: 'release.core' }], ['Live this month', 'what went live', { floor: 'release.live_month' }], ['Ready to go', 'signed off, waiting to go live', { source: 'gate_approvals' }]],
+      floors: [['Overrides', 'past a failed check or grade', { source: 'override_requests' }], ['Modules', 'listed modules, and their re-checks', { source: 'module_rechecks' }], ['Held back', 'work held from going live', { floor: 'release.held_back' }], ['Core update', 'a new version of Bongos', { source: 'core_update', desk: 'release.core' }], ['Live this month', 'what went live', { floor: 'release.live_month' }]],
     },
     treasury: {
       holds: 'The budget, and who gets paid for what.', rule: 'majority', cap: 7,

package/modules/hall-ui/public/street.html

@@ -230,7 +230,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/studio.html

@@ -190,7 +190,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -140,7 +140,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -144,7 +144,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -165,7 +165,7 @@
      chrome exists before the page script runs. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -173,7 +173,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/lifecycle/matter-acts.js

@@ -6,7 +6,6 @@
 // commits, through the SAME function the direct route calls:
 //   review  satisfy_criterion → satisfyByOverride   (POST /done-when/:id/satisfy)
 //   release approve_override  → db.decideOverrideRequest (POST /override-requests/:id/decide)
-//   release approve_gate      → approveGatePr       (POST /gate-approvals/:pr/approve)
 // The government module only checks the act's shape and calls in through the
 // 'governor.matterAct' contribution point (a module never requires a sibling).
 // Each act returns { done, reason? }: a refusal the route would give (already
@@ -23,7 +22,6 @@ const why = (area, ctx) => `A passed ${area} matter (matter ${ctx && ctx.matterI
 // functions are needed here.
 const routes = {
   doneWhen: () => require('./routes/done-when'),
-  gate: () => require('./routes/gate-approvals'),
 };
 
 const ACTS = Object.freeze({
@@ -47,10 +45,6 @@ const ACTS = Object.freeze({
         throw err;
       }
     },
-    approve_gate: async (action, ctx) => {
-      const out = await routes.gate().approveGatePr({ number: action.pr, login: `council, matter ${ctx && ctx.matterId}` });
-      return out.ok ? { done: true } : { done: false, reason: out.code };
-    },
   }),
 });
 

package/modules/lifecycle/module.json

@@ -19,7 +19,6 @@
       "goals",
       "goal-move",
       "dependencies",
-      "gate-approvals",
       "analytics",
       "lifecycle",
       "help-requests",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.176",
+  "version": "1.21.178",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.176",
+      "version": "1.21.178",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.176",
+  "version": "1.21.178",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10308,5 +10308,41 @@
       "id": "1004858",
       "text": "The status page no longer shows an uptime panel and a \"standing\" card that only ever said \"unknown\" — the checker behind them was never switched on. The dead checker and its data feed are gone too."
     }
+  ],
+  "1.21.177": [
+    {
+      "id": "1004887",
+      "text": "Main was failing one safety check after two cleanup changes landed together. The check's expected count now matches the files we deliberately removed, so main is green again."
+    },
+    {
+      "id": "1004878",
+      "text": "Two daily safety checks — builders on a broken rank and known-vulnerable dependencies — now run on the server by themselves and land in the ideas inbox; five dead routines were retired."
+    },
+    {
+      "id": "1004856",
+      "text": "Removed 30 old scripts that each did one job once (mostly creating batches of tasks) and were never used again — about 6,500 lines less to read and maintain. Nothing that runs today used them."
+    }
+  ],
+  "1.21.178": [
+    {
+      "id": "1004888",
+      "text": "A test now guarantees the 2.4 MB of hall sample data from this instance can never sneak back into the core every hosted project installs, while the hall preview tool itself keeps shipping."
+    },
+    {
+      "id": "1004889",
+      "text": "An automatic security check on search results works again, and it now really catches a private note leaking to the wrong person instead of passing by luck."
+    },
+    {
+      "id": "1004886",
+      "text": "Core releases can no longer be labelled as containing code that never actually went out."
+    },
+    {
+      "id": "1004859",
+      "text": "The Gate page is now called Autobongos. It keeps the runner controls and drops the list of held pull requests, which was always empty because the check it waited on never ran. Old links to /gate still work. The two permissions"
+    },
+    {
+      "id": "1004863",
+      "text": "Eight database tests that had quietly stopped working are repaired and now run on every change, including the one that proves an idea's author is never paid twice and the one that proves search never shows someone a page above"
+    }
   ]
 }

package/scripts/bongos/adopt-preflight.js

@@ -8,7 +8,7 @@
 //   • core<->host fitness-boundary overlaps — repo dirs that shadow core's reserved
 //     src/bongos or modules/ namespaces the fitness gate scans (ADR 0062 §1).
 //   • protected-path landings — incoming files that fall on the trust-boundary hard
-//     floor (ADR 0043, via gate-review.js's canonical matchesHardFloor).
+//     floor (ADR 0043, via hard-floor.js's canonical matchesHardFloor).
 //   • CI collisions — the repo's workflows vs core's expected unit/secret-scan/
 //     gate-review checks.
 //   • IGNORED incoming files — a pre-existing .gitignore rule that would swallow what
@@ -26,7 +26,7 @@ const nodeFs = require('node:fs');
 const nodePath = require('node:path');
 const { execFileSync: nodeExecFileSync } = require('node:child_process');
 const { filenameViolation, INSTANCE_NS } = require('./migration-namespace');
-const { matchesHardFloor } = require('./gate-review');
+const { matchesHardFloor } = require('./hard-floor');
 
 const SEV = { BLOCK: 'blocking', WARN: 'warning', INFO: 'info' };
 const CORE_EXPECTED_CHECKS = ['unit', 'secret-scan', 'gate-review']; // the merge-gate checks core adds
@@ -66,7 +66,7 @@ function checkFitnessBoundary({ topLevelDirs = [], hasSrcBongos = false } = {})
 }
 
 // PURE — incoming paths → protected-path findings (ADR 0043). Which files adopt writes
-// land on the trust-boundary hard floor (via gate-review's canonical matcher)?
+// land on the trust-boundary hard floor (via hard-floor.js's canonical matcher)?
 function checkProtectedPaths(incoming = INCOMING_PATHS) {
   const hits = incoming.filter((p) => matchesHardFloor(p));
   if (!hits.length) return [{ category: 'protected-paths', severity: SEV.INFO, message: 'no incoming files land on protected paths.' }];

package/scripts/bongos/api-alias-caller-scan.js

@@ -36,7 +36,7 @@
 //      Note fitness-ratchets.js belongs here too: it is the GATE, and its builder-facing hint has
 //      to spell the alias out to tell anyone what they tripped over.
 //   4. THE RENAME GUARDRAILS (path-excluded). rename-history-check.js, rename-ledger-prose.js,
-//      gds-literal-scan.js, codemod-rename-src-gds.js, fitness-ratchets.js and THIS FILE name the
+//      gds-literal-scan.js, fitness-ratchets.js and THIS FILE name the
 //      old path because that is what they are for. Same principle as GDS_RULE_FILES next door: a
 //      gate that cannot state its own rule cannot explain itself.
 //   5. tests/ (path-excluded). Tests are what keeps the alias exercised in CI. Moving them off it
@@ -110,7 +110,7 @@ const ALIAS_EXCLUDED_PATHS = [
   // 3. the live proof that the alias still answers
   /^scripts\/(?:gds|bongos)\/smoke-gds\.js$/,
   // 4. the rename guardrails — they name the old path on purpose
-  /^scripts\/(?:gds|bongos)\/(rename-history-check|rename-ledger-prose|gds-literal-scan|codemod-rename-src-gds|api-alias-caller-scan|fitness-ratchets)\.js$/,
+  /^scripts\/(?:gds|bongos)\/(rename-history-check|rename-ledger-prose|gds-literal-scan|api-alias-caller-scan|fitness-ratchets)\.js$/,
   /^config\/(fitness-baselines|rename-history-baseline)\.json$/,
   // 5. tests keep the alias exercised in CI — the repo's own two spellings, `tests/` at the root
   //    and a module's `tests/` or `test/` dir. Deliberately NOT a blanket `\.mjs$`: three .mjs

package/scripts/bongos/audit-authorship.sh

@@ -165,14 +165,12 @@ ALLOWLIST=(
   'tests/setup_smoke.mjs'
 
   # Test DATA that pins a real contract (task 1002640) — identity in an
-  # assertion IS the contract, not a mis-attribution: owner approval RECORDS
-  # the Archon's login (gate_approvals), packaging/provisioning tests
+  # assertion IS the contract, not a mis-attribution: packaging/provisioning tests
   # exercise the real repo owner + the mirror-redaction floor. Listed per file
   # (never a blanket tests/ exclusion) so a NEW test file is still scanned.
   'tests/provision.mjs'
   'tests/package_core.mjs'
   'tests/init.mjs'
-  'tests/gate_approvals.mjs'
   'tests/publish_reconciler.mjs'
   'tests/dev_lib.mjs'
   'tests/ship_card.mjs'
@@ -196,11 +194,6 @@ ALLOWLIST=(
   # instance's owner literal precisely so packaging can SCRUB it from every
   # published core — the anti-leak spec, not a runtime hardcode (task 1002640).
   'scripts/bongos/package-core.js'
-
-  # Frozen seed script — a task DESCRIPTION quotes migration 023's founding-
-  # Archon literal as the thing that task exists to remove (the
-  # seed-v3-tasks.js class: stripping it would lose the task history).
-  'scripts/bongos/seed-medusa-tasks.js'
 )
 
 # ----------------------------------------------------------------------------

package/scripts/bongos/audit-rank-roles.js

@@ -21,8 +21,10 @@
 // THIS IS THE RE-RUNNABLE HALF, and it is deliberately NOT fatal at boot. Idea
 // 1000622 records that trap: an assertion that throws on startup turns a data
 // problem on one instance into an outage. This is a standalone read-only script
-// for a nightly/deploy-time caller — it exits 1 so a caller can act, and nothing
-// in the server's boot path requires it.
+// for a by-hand or deploy-time caller — it exits 1 so a caller can act, and nothing
+// in the server's boot path requires it. The SCHEDULED run is in-process: the
+// server's daily-checks poller (task 1004878) reads the roster straight from its
+// database and files the same idea, so it needs no CLI session.
 //
 // It reports rather than repairs, and that is a decision, not an omission:
 // rewriting somebody's rank is an authority change, and it belongs to an operator
@@ -36,7 +38,7 @@
 //   2  could not read the roster (no session / network / route absent)
 //
 // `--file-idea` is what makes this a SURFACE rather than another thing nobody
-// runs — the same shape diagram-drift/check.js uses, spawning capture.js so idea
+// runs — spawning capture.js so idea
 // filing has one implementation. Without it a nightly deterministic run that exits
 // 1 reports into a log nobody reads, which is the exact criticism this task makes
 // of the status quo.
@@ -48,69 +50,26 @@ const os = require('node:os');
 const { cliClient, requireSession, cliExit } = require('./cli-lib');
 const { LIVE_RANK_LADDER } = require('../../src/bongos/db-kernel.js');
 
-// findRanksWithoutRoles — the PURE half. Given roster rows and the live ladder,
-// which builders hold a rank that `governance_002`'s INNER JOIN cannot match?
-//
-// Pure + exported because this is the only altitude the repo can test: the unit
-// gate has no Postgres, which is exactly why the gap this script closes went
-// unverified for so long. A DB-free test of the decision is not a consolation
-// prize here — it is the thing that can actually run in CI.
-//
-// A row with NO rank at all counts: NULL fails the INNER JOIN the same way a
-// legacy value does, and reads as "fine" in every UI that renders a blank.
-function findRanksWithoutRoles(rows, liveRanks = LIVE_RANK_LADDER) {
-  const live = new Set(liveRanks);
-  return (Array.isArray(rows) ? rows : [])
-    .filter((b) => b && !live.has(b.rank))
-    .map((b) => ({
-      id: b.id != null ? String(b.id) : null,
-      // The login is what an operator needs to act; it is already visible to any
-      // caller authorised to read the roster, so this adds no exposure.
-      github_login: b.github_login || null,
-      rank: b.rank === undefined ? null : b.rank,
-      status: b.status || null,
-    }));
-}
+// The pure half lives in modules/autonomy/rank-roles.js (task 1004878), shared with
+// the server's daily check (modules/autonomy/pollers/daily-checks.js) so the two
+// cannot disagree about what an offender is. This wrapper defaults the ladder.
+const rankRoles = require('../../modules/autonomy/rank-roles.js');
 
-// summarize — the rank histogram, so a CLEAN run still says what it looked at.
-// A green check that prints nothing is indistinguishable from one that read
-// nothing, which is the failure mode this whole task is about.
-function summarize(rows) {
-  const counts = new Map();
-  for (const b of Array.isArray(rows) ? rows : []) {
-    const key = b && b.rank ? b.rank : '(none)';
-    counts.set(key, (counts.get(key) || 0) + 1);
-  }
-  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
-}
+const findRanksWithoutRoles = (rows, liveRanks = LIVE_RANK_LADDER) => rankRoles.findRanksWithoutRoles(rows, liveRanks);
+const { summarize } = rankRoles;
 
 // Spawn capture.js rather than POSTing here, so idea filing keeps one
-// implementation (the diagram-drift/check.js precedent). Best-effort: a failure to
+// implementation. Best-effort: a failure to
 // file must not turn a successful audit into a crash — the exit code and stdout
 // still carry the finding.
 function fileIdea(offenders) {
-  const body = [
-    `${offenders.length} builder(s) hold a rank with no matching governance_roles row.`,
-    '',
-    'They resolve to ZERO permissions — admitted by rank threshold under requireRank,',
-    'refused by the permission resolver, and given no reason (ADR 0151 fail-closed).',
-    '',
-    ...offenders.map((o) => `- builder ${o.id}${o.github_login ? ` (${o.github_login})` : ''} rank=${o.rank === null ? '(none)' : o.rank} status=${o.status || '?'}`),
-    '',
-    'Fix: move each to a live rank through the normal rank-change path, which rotates',
-    'the governance role in the same transaction. Not auto-repaired: changing a rank is',
-    'an authority decision, and a sweep is the wrong actor for it.',
-    '',
-    'Filed by scripts/bongos/audit-rank-roles.js (task 1002873).',
-  ].join('\n');
+  const { title, bodyMd } = rankRoles.ideaFor(offenders);
   const tmp = path.join(os.tmpdir(), `rank-roles-audit-${process.pid}.md`);
   try {
-    fs.writeFileSync(tmp, body, 'utf8');
+    fs.writeFileSync(tmp, bodyMd, 'utf8');
     const r = spawnSync(
       process.execPath,
-      [path.join(__dirname, 'capture.js'),
-        `[rank-roles] ${offenders.length} builder(s) on a rank with no governance role`,
-        '--kind', 'bug', '--body-file', tmp],
+      [path.join(__dirname, 'capture.js'), title, '--kind', 'bug', '--body-file', tmp],
       { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
     );
     if (r.status !== 0) console.error('audit-rank-roles: capture.js failed to file the idea — the exit code above still carries the finding.');

package/scripts/bongos/bump-version.js

@@ -30,6 +30,8 @@
 //   node scripts/bongos/bump-version.js                # dry-run: print the plan
 //   node scripts/bongos/bump-version.js --apply        # rewrite both files
 //   node scripts/bongos/bump-version.js --apply --note "run 123456"  # extra provenance
+//   node scripts/bongos/bump-version.js --apply --taken-file versions.json
+//       # skip every version in that JSON array (`npm view @bongos/core versions --json`)
 // stdout (both modes): one JSON line { from, to, applied } for CI to capture.
 
 'use strict';
@@ -51,12 +53,18 @@ const DIVIDER = '---------------------------------------------------------------
 // entry appended too; omit it to bump the literal alone (the unit tests do).
 // Throws with a precise message on any shape it does not recognize — a silent
 // mis-edit of the version literal is the worst possible failure mode here.
-function bumpPatch(src, { note = '', changelog = null } = {}) {
+//
+// `taken` (task 1004886): versions that already exist on the registry. The bump
+// lands on the first patch past `from` that is NOT taken, because npm never lets a
+// version be published twice — and a run that "re-publishes" a taken number ships
+// nothing new while main is told it did. That is how 1.21.175 got recorded on main
+// on 2026-10-25 for a tree the registry's 1.21.175 (built 2026-10-23) never held.
+function bumpPatch(src, { note = '', changelog = null, taken = new Set() } = {}) {
   const m = src.match(CONST_RE);
   if (!m) throw new Error(`bump-version: could not find the CORE_VERSION literal in ${TARGET} (expected: const CORE_VERSION = 'x.y.z';)`);
   const [major, minor, patch] = [Number(m[1]), Number(m[2]), Number(m[3])];
   const from = `${major}.${minor}.${patch}`;
-  const to = `${major}.${minor}.${patch + 1}`;
+  const to = nextFreePatch(major, minor, patch, taken);
 
   // 1. The literal — same line shape deploy-divergence greps for.
   const newConstLine = `const CORE_VERSION = '${to}'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md`;
@@ -79,17 +87,40 @@ function bumpPatch(src, { note = '', changelog = null } = {}) {
   return { from, to, text, changelogText };
 }
 
+// The first patch after `patch` whose version is not in `taken`. Bounded, so a
+// corrupt taken-list can never spin: 10,000 consecutive taken patches is not a
+// registry, it is a bug, and it throws.
+function nextFreePatch(major, minor, patch, taken = new Set()) {
+  for (let p = patch + 1; p <= patch + 10000; p += 1) {
+    const v = `${major}.${minor}.${p}`;
+    if (!taken.has(v)) return v;
+  }
+  throw new Error(`bump-version: no free patch within 10000 of ${major}.${minor}.${patch} — the taken-list is not a registry listing`);
+}
+
+// Parse `npm view <pkg> versions --json` output into a Set of x.y.z strings. npm
+// prints a bare string (not an array) when exactly one version exists. Anything
+// that is not a strict x.y.z is dropped, so a stray line cannot become a version.
+function registryVersions(jsonText) {
+  let v;
+  try { v = JSON.parse(String(jsonText)); } catch { return new Set(); }
+  const list = Array.isArray(v) ? v : (typeof v === 'string' ? [v] : []);
+  return new Set(list.filter((x) => typeof x === 'string' && /^\d+\.\d+\.\d+$/.test(x)));
+}
+
 function main() {
   const apply = process.argv.includes('--apply');
   const noteIdx = process.argv.indexOf('--note');
   const note = noteIdx !== -1 ? (process.argv[noteIdx + 1] || '') : '';
+  const takenIdx = process.argv.indexOf('--taken-file');
+  const taken = takenIdx !== -1 ? registryVersions(fs.readFileSync(process.argv[takenIdx + 1], 'utf8')) : new Set();
 
   // Read and transform BOTH files before writing EITHER: a half-applied bump
   // (literal moved, ledger silent) is precisely the drift this script exists
   // to prevent, and it would be committed and pushed to main before anyone saw it.
   const src = fs.readFileSync(TARGET, 'utf8');
   const changelog = fs.readFileSync(CHANGELOG, 'utf8');
-  const { from, to, text, changelogText } = bumpPatch(src, { note, changelog });
+  const { from, to, text, changelogText } = bumpPatch(src, { note, changelog, taken });
   if (changelogText === null) throw new Error('bump-version: the ledger was not rewritten — refusing to write a versionless release');
   if (apply) {
     fs.writeFileSync(TARGET, text);
@@ -143,10 +174,13 @@ function isReleaseCommit(subject) {
 //   • pack or publish failed  → the bump commit was never pushed (it only ever
 //     existed on the discarded runner), so no version looks taken and the next
 //     run recomputes and retries the SAME version. No gap, nothing burned.
-//   • published, push then failed → version looks free, so the next run bumps to
-//     it and npm refuses the duplicate. publish.yml treats that refusal as
-//     success and falls through to the record step, which commits the release
-//     line main was missing. Self-healing, and nothing wrong ships.
+//   • published, push then failed → version looks free to git, but the registry
+//     listing publish.yml passes as --taken-file has it, so the next run bumps PAST
+//     it (a gap in main's ledger, harmless). Task 1003914 used to treat npm's
+//     duplicate refusal as success and record the version instead — but the push
+//     fails precisely because main MOVED, so the recorded tree was never the one on
+//     the registry. That recorded 1.21.175 for 200+ commits npm never had (task
+//     1004886). A duplicate refusal now fails the run and records nothing.
 //
 // Before that reorder the first case was the lossy one: the push landed first,
 // so a failed publish left main declaring a version the registry never had, the
@@ -196,8 +230,9 @@ function isHumanReleaseCommit(subject) {
 //
 // BOTH failure directions stay safe, which is what makes this acceptable here. A
 // subject wrongly counted → the lane bumps PAST a free version (a gap, harmless). A
-// real release missed → npm refuses the duplicate and publish.yml's already-present
-// branch records it (task 1003914). Neither direction can double-publish.
+// real release missed → the registry listing marks it taken and the lane bumps past
+// it; if even that read failed, npm refuses the duplicate and the run fails without
+// recording anything (task 1004886). Neither direction can double-publish or mislabel.
 function laneReleasedVersions(subjects = []) {
   const out = new Set();
   for (const subject of subjects) {
@@ -211,6 +246,8 @@ function laneReleasedVersions(subjects = []) {
 
 module.exports = {
   bumpPatch,
+  nextFreePatch,
+  registryVersions,
   CONST_RE,
   RELEASE_COMMIT_RE,
   HUMAN_RELEASE_COMMIT_RE,

package/scripts/bongos/codemod-rename-scripts-gds.js

@@ -81,7 +81,6 @@ const EXCLUDE = new Set([
   'tests/scripts_gds_forwarders.mjs',
   'modules/lifecycle/executed-closure.js',
   'scripts/bongos/rename-ledger-prose.js',
-  'scripts/bongos/codemod-rename-src-gds.js',
   '.bongos-core.json',
 ]);
 

package/scripts/bongos/diagram-facts.js

@@ -1,7 +1,7 @@
 // Shared fact-extractor for the onboarding diagrams (task #357).
 //
 // Single source of truth for "what the live system actually is", used by BOTH:
-//   - the drift checker (.claude/scheduled-tasks/diagram-drift/check.js), which
+//   - (formerly) the drift checker .claude/scheduled-tasks/diagram-drift/check.js, retired in task 1004878, which
 //     compares these facts against assertions.json and nudges on divergence; and
 //   - the generator (scripts/bongos/gen-diagrams.js), which regenerates the
 //     mechanical diagrams (.mmd) FROM these facts on every deploy.

package/scripts/bongos/do-api.js

@@ -15,7 +15,7 @@
 //     logs the call it WOULD make and returns a synthetic, clearly-marked
 //     result (`{ dryRun: true, ... }`) so the orchestrator's control flow runs
 //     end-to-end against a throwaway plan. This mirrors how provision-staging.sh
-//     and stale-claim-release ship runnable logic whose LIVE leg is a separate,
+//     ships runnable logic whose LIVE leg is a separate,
 //     explicit operator action.
 //   - Live mode requires a token (DO_API_TOKEN); the constructor throws clearly
 //     if asked to run live without one — it never silently no-ops a real call.

package/scripts/bongos/doc-cli-guard.js

@@ -48,6 +48,8 @@ const DOC_CLI_ALLOW = new Map([
     'an accepted ADR recording how its evidence was measured; the spike harness was deleted once the verdict stood (task 1004857) and the ADR names the commit to recover it from.'],
   ['docs/session-logs/2026-08-28-goal-1000072-stale-timer-and-network-map-spike.md::scripts/bongos/spike-task-map.js',
     'a dated session log — the historical record, never rewritten — of the spike whose harness task 1004857 deleted; it describes what was run then, not what to run now.'],
+  ['docs/session-logs/2026-09-16-task-1003752-stranded-detector-never-ran.md::scripts/bongos/gate-review.js',
+    'a dated session log — the historical record, never rewritten — naming the gate-review classifier task 1004859 deleted (its CI check never ran); it describes what was run then, not what to run now.'],
 ]);
 
 // `node scripts/bongos/foo.js` … up to the end of the line/segment, so the flags that