@bongos/core 1.22.1 → 1.23.1

package/modules/platform-identity/project-stats.js

@@ -36,6 +36,7 @@ const net = require('node:net');
 // prove it belongs to the project it is filed under; the ship-link path in
 // platform-identity.js reads the identical rule from the identical place.
 const { urlWithinOrigin } = require('./origin-containment');
+const { sleep } = require('../../src/module-api'); // the one shared sleep (task 1004893)
 
 const TTL_MS = 10 * 60 * 1000;   // owner's choice, 2026-08-13
 const FETCH_TIMEOUT_MS = 2500;   // per request
@@ -322,7 +323,7 @@ async function getProjectStats(origins = []) {
   if (cold.length) {
     await Promise.race([
       Promise.allSettled(cold.map((o) => refresh(o))),
-      new Promise((r) => setTimeout(r, COLD_DEADLINE_MS)),
+      sleep(COLD_DEADLINE_MS),
     ]);
   }
 

package/modules/platform-identity/read-rate-limit.js

@@ -65,4 +65,4 @@ function createReadRateLimit({ scope, limit, windowMs = 60 * 1000, maxTrackedIps
   return limiter;
 }
 
-module.exports = { createReadRateLimit, MAX_TRACKED_IPS };
+module.exports = { createReadRateLimit };

package/modules/platform-identity/visibility-pull.js

@@ -59,14 +59,6 @@ const { pool: defaultPool } = require('../../src/module-api');
 const { ORB_BY_STATE } = require('./projects-feed');
 const projectStats = require('./project-stats');
 
-// The manifest route every Cloud Bongos instance already serves, unauthenticated and
-// CORS-open (ADR 0114's discovery surface; `src/bongos/routes/instance.js`). Nothing is
-// added to it by this task — ADR 0252 §2.3: the field already ships in every core, so
-// there is no wire change on anyone else's upgrade schedule. The API router is
-// dual-mounted at `/api/bongos` (canonical) and at the permanent legacy alias ADR 0252
-// happened to write, so either prefix reaches it; the fetch uses the canonical one.
-const MANIFEST_ROUTE = '/api/bongos/instance';
-
 // Rows the PULL may write: the ones the ADR 0246 control-plane bridge has never claimed.
 // `IS DISTINCT FROM` rather than `<> `, deliberately — a NULL source is the unclaimed
 // state and plain inequality would drop exactly those rows on a NULL comparison.
@@ -190,7 +182,6 @@ async function sweepVisibilityOnce({ pool = defaultPool, limit = 200, fetchVisib
 }
 
 module.exports = {
-  MANIFEST_ROUTE,
   PULLABLE_SQL,
   visibilityFromManifest,
   pullDecision,

package/modules/provisioning/app-status.js

@@ -93,4 +93,4 @@ function retryAnswers(h) {
   return r;
 }
 
-module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE, SERVICE_ID_RE };
+module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE };

package/modules/provisioning/catalog-bridge.js

@@ -161,7 +161,6 @@ async function healInstanceCatalog(db, row) {
 }
 
 module.exports = {
-  CATALOG_HIDDEN_STATES,
   catalogEntryForInstance,
   // the disconnect runner leg forgets exactly what a publish wrote (task 1003249)
   catalogOriginForInstance, ownerGithubIdForInstance,

package/modules/provisioning/core-upgrade.js

@@ -551,5 +551,5 @@ function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespo
   };
 }
 
-module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, lastCoreMove, lastMoveSuperseded, parseRepoNote, UPGRADE_SHAPES, VERSION_RE, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/credential-preflight.js

@@ -167,4 +167,4 @@ async function adoptCredentialFault({ builderId, onboardMode, targetRef }, deps)
   return null;
 }
 
-module.exports = { adoptCredentialFault, parseTargetRef, readOwnerRepoToken, fetchRepoVisibility };
+module.exports = { adoptCredentialFault, parseTargetRef };

package/modules/provisioning/demo.js

@@ -171,6 +171,6 @@ async function sweepDemos(db, { enqueueTeardown, recordEvent, now = new Date() }
 }
 
 module.exports = {
-  DEMO_LIMITS, DEMO_OFFLINE_DAYS, DEMO_WARN_DAYS, DEMO_DETAIL, DEMO_SETTINGS, OUTCOMES,
-  parseDemo, fitCheck, withDemoDetail, demoRecord, demoView, startDemo, startDemoProject, settleDemo, sweepDemos,
+  DEMO_LIMITS, DEMO_SETTINGS, OUTCOMES,
+  parseDemo, fitCheck, withDemoDetail, demoRecord, demoView, startDemoProject, settleDemo, sweepDemos,
 };

package/modules/provisioning/look.js

@@ -165,5 +165,5 @@ module.exports = {
   upsertLogo, deleteLogo, readLogo,
   LIBRARY_LOOKS, LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV,
   lookChoice, lookAdjustAccent, lookAccentOf, logoUrlOf,
-  LOGO_MAX_BYTES, LOGO_MIME, screenLogo, sniffLogo, logoFileName, LOGO_FILE,
+  LOGO_MAX_BYTES, LOGO_MIME, screenLogo, logoFileName, LOGO_FILE,
 };

package/modules/provisioning/routes/callback-page.js

@@ -190,4 +190,4 @@ function callbackPage({ ok, title, body, state, domain, next }) {
 </body></html>`;
 }
 
-module.exports = { esc, callbackPage, returnHref, RETURN_PATH };
+module.exports = { esc, callbackPage, returnHref };

package/modules/raise/raise.js

@@ -170,5 +170,5 @@ module.exports = {
   TOKENS, SETTING_KEYS, MAX_BLOCK, EDIT_MIN_RANK, TBA,
   defaultCopy, defaultSettings, ndaBody, ndaVersion, isEditableKey,
   esc, usd, kindOf, normalizeBlock, renderInline, renderBlock, renderContext, fill, cleanSetting,
-  hashPassword, passwordOk, validLinkedin, normalizeSignin, newSessionToken, hashToken, plainForDiscord,
+  hashPassword, passwordOk, normalizeSignin, newSessionToken, hashToken, plainForDiscord,
 };

package/modules/render-deploy/deploys.js

@@ -197,7 +197,7 @@ async function saveApp(pool, { ownerId, serviceId, serviceName, builderId }) {
 }
 
 module.exports = {
-  KEY_RE, OWNER_RE, SERVICE_RE, DEPLOY_RE, HISTORY_LIMIT,
+  KEY_RE, OWNER_RE, SERVICE_RE, DEPLOY_RE,
   statusWords, taskIdsIn, previewOf, costOf, shapeHistory, readHistory, getApp, saveApp,
   ROLLBACK_STATUSES,
 };

package/modules/security/artifact-scan/aggregate.js

@@ -33,7 +33,6 @@ const TIER_CLAMP = Object.freeze({
 // A lens that did not finish cleanly contributes caution, never silence: an
 // errored/timed-out/budget-exhausted lens means its surface went UNREVIEWED.
 const LENS_OK = 'ok';
-const LENS_PROBLEM_STATUSES = Object.freeze(['error', 'timeout', 'budget_exhausted']);
 
 const rank = (v) => VERDICT_RANK[v] ?? VERDICT_RANK.dangerous; // unknown → worst
 const maxVerdict = (a, b) => (rank(a) >= rank(b) ? a : b);
@@ -123,11 +122,8 @@ function reduceVerdict({ floorReport = {}, lenses = [], tier = 'low', declaredDe
 
 module.exports = {
   VERDICTS,
-  TIER_CLAMP,
   LENS_OK,
-  LENS_PROBLEM_STATUSES,
   panelOutcome,
-  lensHealth,
   coverageCap,
   reduceVerdict,
 };

package/modules/security/artifact-scan/detectors/capabilities.js

@@ -50,4 +50,4 @@ function inventory(corpus) {
 
 // Constants exported as the white-box surface: the reducer/report stages and
 // tests read them to stay in lockstep with what the inventory actually covers.
-module.exports = { inventory, CAPABILITY_PATTERNS, SCRIPT_EXTENSIONS };
+module.exports = { inventory };

package/modules/security/artifact-scan/detectors/config-obfuscation.js

@@ -38,4 +38,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, isJsonConfig };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/credentials.js

@@ -114,4 +114,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, perFileHits, CREDENTIAL_PATTERNS };
+module.exports = { detect, perFileHits };

package/modules/security/artifact-scan/detectors/dependencies.js

@@ -112,4 +112,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, specSeverity, DEP_SECTIONS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/injection.js

@@ -115,4 +115,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, OVERRIDE_PHRASES, SCANNER_PHRASES, codepointClasses };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/network.js

@@ -64,4 +64,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, perFileHits, NETWORK_PATTERNS };
+module.exports = { detect, perFileHits };

package/modules/security/artifact-scan/detectors/npm-lifecycle.js

@@ -78,4 +78,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, AUTO_RUN_SCRIPTS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/permissions.js

@@ -88,4 +88,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, BYPASS_MARKERS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/shared.js

@@ -202,14 +202,11 @@ function escapedConfigKeyCount(text) {
 }
 
 module.exports = {
-  EXCERPT_MAX_CHARS,
   SEVERITIES,
-  SENSITIVE_BASENAMES,
   isSensitivePath,
   basename,
   finding,
   excerpt,
-  sanitizeDetail,
   lineAt,
   parseJsonStrict,
   rawKeyCounts,

package/modules/security/artifact-scan/floor.js

@@ -359,12 +359,9 @@ async function runFloor({ pristineDir, quarantineRoot, entries, sha = null, cont
 
 module.exports = {
   FLOOR_VERSION,
-  REPORT_BASENAME,
   VERDICT_RANK,
   DETECTORS,
   buildCorpus,
-  computeFloorVerdict,
-  countBySeverity,
   coOccurrence,
   coverageFindings,
   dedupeFindings,

package/modules/security/artifact-scan/mirror.js

@@ -155,4 +155,4 @@ async function buildMirror({ pristineDir, mirrorDir, quarantineRoot, entries, ca
   return { mirrored, stubs, unreviewedBytes, fenceDelim, indexPath };
 }
 
-module.exports = { buildMirror, MIRROR_CAPS, INDEX_BASENAME };
+module.exports = { buildMirror, MIRROR_CAPS };

package/modules/security/artifact-scan/quarantine.js

@@ -254,7 +254,6 @@ function createQuarantine({ tmpRoot = os.tmpdir(), forbiddenRoots } = {}) {
 module.exports = {
   canonical,
   isInsideLexical,
-  canonicalUncached,
   clearCanonicalCache,
   CAPS,
   REPO_ROOT,

package/modules/security/artifact-scan/rebuild-spec.js

@@ -112,8 +112,6 @@ function assembleRebuildSpec({
 }
 
 module.exports = {
-  SPEC_LIMITS,
-  GROUND_RULES,
   isDocPath,
   selectDocFiles,
   assembleRebuildSpec,

package/modules/security/artifact-scan/report.js

@@ -152,4 +152,4 @@ function assembleReport({
   return out.join('\n');
 }
 
-module.exports = { assembleReport, findingLine };
+module.exports = { assembleReport };

package/modules/security/artifact-scan/sanitize.js

@@ -313,8 +313,6 @@ async function buildSanitizedCopy({ pristineDir, quarantineRoot, entries, remova
 }
 
 module.exports = {
-  SANITIZED_DIRNAME,
-  DIFF_BASENAME,
   hasMaliceIndicator,
   planSanitize,
   buildSanitizedCopy,

package/modules/security/secret-scrub.js

@@ -255,15 +255,11 @@ function scrubSecrets(text, extraSecrets = [], opts = undefined) {
 module.exports = {
   REDACTED,
   SECRET_PATTERNS,
-  SECRET_ASSIGNMENT_RE,
   shannonEntropy,
-  charClasses,
   looksHighEntropySecret,
-  ENTROPY_CANDIDATE_RE,
   redactHighEntropy,
   ENV_SECRET_KEY_RE,
   ENV_SECRET_PREFIX_RE,
-  ENV_BENIGN_KEY_RE,
   collectEnvSecrets,
   scrubSecrets,
 };

package/modules/security/security.js

@@ -283,8 +283,6 @@ async function linkVulnerabilityReportFix(id, fixTaskId) {
 module.exports = {
   SEVERITIES,
   VULN_STATUSES,
-  DEFAULT_BOUNTY,
-  SEVERITY_BLURB,
   envName,
   bountyTable,
   bountyTableDetailed,

package/modules/sessions/accessibility.js

@@ -356,7 +356,6 @@ module.exports = {
   scoreAccessibility,
   // Exported so the tests can pin the contracts (waivers, leniency, each
   // detector) without reconstructing a whole digest for every case.
-  resolveProfile,
   waiversFor,
   leniencyFor,
   assistantProse,
@@ -366,7 +365,6 @@ module.exports = {
   bandFor,
   SIGNAL_SPEC,
   JARGON_TERMS,
-  UI_BACKED_SUBJECTS,
   LOW_CONFIDENCE_CHARS,
   PROFILE_DEFAULTS,
   PROFILE_VALUES,

package/modules/sessions/bfg.js

@@ -346,12 +346,8 @@ module.exports = {
   buildAdoptionSuggestion,
   // 6C.2 correction builder
   buildCorrection,
-  TRANSFERABLE_TYPES,
-  PII_PATTERNS,
   // exported for tests + reuse
   parseFrontmatter,
-  stripFrontmatter,
   clamp01,
   QUALITY_WEIGHTS,
-  ALLOWED_MEMORY_TYPES,
 };

package/modules/sessions/upload-health.js

@@ -187,11 +187,8 @@ function uploadHealthVerdict(rows, opts = {}) {
 module.exports = {
   DEFAULT_WINDOW_HOURS,
   DEFAULT_LOOKBACK_DAYS,
-  DEFAULT_MIN_SHIPS,
-  DEFAULT_MAX_UNCOVERED_SHARE,
   clampLookbackDays,
   clampWindowHours,
   clampSampleLimit,
-  normalizeBuilderRows,
   uploadHealthVerdict,
 };

package/modules/specialities/db.js

@@ -278,5 +278,5 @@ module.exports = {
   createSpeciality, getSpeciality, listVisibleTo, updateSpeciality,
   addDocument, listDocuments, deleteDocument,
   linkLearning, countTraining,
-  adopt, abandon, deactivateCraft, activeForCraft, listAdoptions, setEnabledSkills,
+  adopt, abandon, activeForCraft, listAdoptions, setEnabledSkills,
 };

package/modules/specialities/specialities.js

@@ -303,4 +303,4 @@ function offeredTo(specialities, viewer, adoptions = []) {
   });
 }
 
-module.exports = { VISIBILITIES, LIMITS, SKILL_NAME_RE, slugify, validateDraft, skillListErrors, enabledSkillsErrors, canAdopt, describeForApi, offeredTo };
+module.exports = { VISIBILITIES, LIMITS, SKILL_NAME_RE, slugify, validateDraft, enabledSkillsErrors, canAdopt, describeForApi, offeredTo };

package/modules/ui-design/kit/lib.js

@@ -524,9 +524,9 @@ function packColors(pack) {
 }
 
 module.exports = {
-  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS, EXPECT_KEYS,
+  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS,
   argOf, hasFlag, listArg, pageName, normalizePageArg, resolveSurfaceDir, sidecarPath, readJson,
-  validateActions, runActions, validateExpect, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
+  runActions, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
   validateStatesFile, validateProbesFile, NoBrowserError, launchBrowser, attachCollectors, withMode,
   freePort, startStub, parseColor, composite, luminance, contrastRatio, instancePack, packColors,
   listStyles, resolveStyle, styleBrandingFile,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.22.1",
+  "version": "1.23.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.22.1",
+      "version": "1.23.1",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.22.1",
+  "version": "1.23.1",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10376,5 +10376,18 @@
       "id": "1004876",
       "text": "Builder-written text now goes through one safety filter in the browser and one on the server instead of 42 hand-made copies, six of which let a stray quote through — and a check stops a new copy from creeping back."
     }
+  ],
+  "1.22.2": [
+    {
+      "id": "1004891",
+      "text": "Cleaned up 220 internal code hooks nothing else used, cutting the project's dead-code count from 439 to 213."
+    }
+  ],
+  "1.23.0": [],
+  "1.23.1": [
+    {
+      "id": "1004893",
+      "text": "The ~30 copy-pasted \"wait a moment\" helpers across the codebase now all use one shared helper (one for the browser, one for the server), and a fitness check stops new copies from creeping back in. Nothing users see changes."
+    }
   ]
 }

package/scripts/bongos/autobongos-run.js

@@ -54,6 +54,7 @@ const { matchProtected } = require('../../src/bongos/permission-path-check');
 const { resolveEnv, envPrefix, LEGACY_ENV_PREFIXES } = require('../../src/instance-config');
 const cadence = require('../../modules/autonomy/cadence.js');
 const configIdle = require('../../modules/autonomy/config-idle.js');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
@@ -1149,7 +1150,7 @@ async function runFetchHead(deps = {}) {
 async function waitOrJump(waitS, deps = {}, cfg = {}) {
   if (!(waitS > 0)) return { waited: 0, jumped: false };
   const pollEveryS = cfg.pollEveryS ?? 60;
-  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep = deps.sleep || sharedSleep;
   const poll = deps.pollSignals || pollSignals;
 
   const before = await poll(deps);

package/scripts/bongos/autonomy-gauge.js

@@ -18,6 +18,7 @@
 
 const fs = require('node:fs');
 const { decideCapacity } = require('../../modules/autonomy/gauge.js');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 function gaugePath() {
   if (process.env.AUTOBONGOS_GAUGE_FILE) return process.env.AUTOBONGOS_GAUGE_FILE;
@@ -70,7 +71,7 @@ async function main(argv) {
     const now = Math.floor(Date.now() / 1000);
     const waitS = d.sleepUntil ? Math.max(1, d.sleepUntil - now) : 60;
     if (!json) console.log(`  sleeping ${waitS}s…`);
-    await new Promise((r) => setTimeout(r, waitS * 1000));
+    await sharedSleep(waitS * 1000);
   }
 }
 

package/scripts/bongos/backfill-disciplines.js

@@ -47,7 +47,7 @@ function classify(task) {
   return { discipline: FALLBACK, reasoned: false, confidence: null };
 }
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // PATCH one row, WAITING OUT the per-session rate limit rather than counting it as a
 // failure. The first run of this backfill treated a 429 as a failed row and stopped

package/scripts/bongos/backfill-sessions.js

@@ -241,7 +241,7 @@ function loadExisting() {
   return set;
 }
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 async function main() {
   const existing = loadExisting();

package/scripts/bongos/backup.js

@@ -8,6 +8,7 @@
 // Rank gate: metic+archon.
 
 const { cliClient, requireSession } = require('./cli-lib');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 function fmtBytes(n) {
   if (n == null) return '(unknown size)';
@@ -84,7 +85,7 @@ async function trigger() {
   const deadline = Date.now() + 60_000;
   let landed = false;
   while (Date.now() < deadline) {
-    await new Promise(resolve => setTimeout(resolve, 3_000));
+    await sleep(3_000);
     const status = await fetchStatus();
     const nowFile = status.latest_dump && status.latest_dump.filename;
     if (nowFile && nowFile !== beforeFile) {

package/scripts/bongos/dev.js

@@ -57,7 +57,7 @@ function tail(s, n = 6) {
 }
 // Portable synchronous pause (no subprocess, no foreground-sleep dependency).
 function sleepSync(ms) { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); }
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 function usage() {
   console.log(`bongos dev — run THIS instance, in one command.

package/scripts/bongos/do-api.js

@@ -24,6 +24,7 @@
 //   createDroplet · getDroplet · deleteDroplet · settleDroplet (poll to active)
 
 const { JsonHttpApi, makeApiError } = require('./http-api-client');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const DO_API_BASE = 'https://api.digitalocean.com/v2';
 
@@ -79,7 +80,7 @@ class DoApi extends JsonHttpApi {
   // Returns the stopping value, or { timedOut:true } after `tries` rounds.
   // `sleepFn` lets tests drive the loop with no real clock.
   async _poll({ tries = 60, sleepMs = 5000, sleepFn } = {}, step) {
-    const sleep = sleepFn || ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const sleep = sleepFn || sharedSleep;
     for (let i = 0; i < tries; i++) {
       const r = await step(i);
       if (r && r.done) return r.value;

package/scripts/bongos/fitness.js

@@ -523,7 +523,7 @@ const KERNEL_FILES = [
   'src/module-api.js',                    // the published doorway
   'src/modules.js',                       // the registry/resolver facade
   'src/module-seams.js',                  // the seam registry (ports/events/contributions)
-  'src/role-responsibilities.js', 'src/html-escape.js', // owner's role statements (task 1003732) + THE server HTML escaper (task 1004876) — both import nothing
+  'src/role-responsibilities.js', 'src/html-escape.js', 'src/sleep.js', // owner's role statements (task 1003732) + THE server HTML escaper (task 1004876) + THE server sleep (task 1004893) — all import nothing
   'src/module-loader/loader.js',          // the disk loader (discover → validate → mount)
   'src/module-loader/manifest-schema.js', // the manifest validator
   'src/module-loader/semver.js',          // coreVersion compatibility
@@ -1365,13 +1365,12 @@ const CHECKS = [
   require('./doc-control-claims.js').checkDocControlClaims, // Check 37 — task 1003418 / audit A14: a doc cannot describe an enforcement control that does not exist (derived from the docs, not a hand list)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
   require('./skill-preflight.js').checkOpsSkillsDeclareMachine, // Check 23 — task 1003167 / G03: an ops skill declares the machine it needs
-  // Check 24 — task 1003166 / G02: no ops script hardcodes a version id. It landed
-  // sharing Check 23's line, deliberately, because fitness.js was ~500 lines over
-  // the excess-lines ratchet and a new check could not afford one (idea 1000810).
-  // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
-  // and the check gets its own line back.
+  // Check 24 — task 1003166 / G02: no ops script hardcodes a version id. It once shared
+  // Check 23's line because fitness.js was over the excess-lines ratchet (idea 1000810);
+  // task 1003206 carved this file from 2,004 lines to ~1,350, so it has its own line back.
   require('./version-literal-guard.js').checkNoVersionLiterals,
   require('./escape-helper-guard.js').checkOneHtmlEscaper, // task 1004876: ONE HTML escaper per side (dom-utils.js / src/html-escape.js), and hall pages load dom-utils first
+  require('./sleep-helper-guard.js').checkOneSleepHelper, // task 1004893: ONE sleep per side (dom-utils.js OTB.sleep / src/sleep.js)
   require('./dev-box-guard.js').checkNoDevBox, // task 1003899 / ADR 0346: the retired dev box stays out (its exemption list lives in that file)
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)

package/scripts/bongos/local-preview.js

@@ -15,12 +15,13 @@
 // shipped. Set OTB_PREVIEW_PORT to override the default 3100.
 
 const lib = require('./local-preview-lib');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 async function pollHealthy(ms = 20_000) {
   const end = Date.now() + ms;
   while (Date.now() < end) {
     if (await lib.health()) return true;
-    await new Promise((r) => setTimeout(r, 500));
+    await sleep(500);
   }
   return false;
 }

package/scripts/bongos/login.js

@@ -86,7 +86,7 @@ function prompt(q) {
   return new Promise((resolve) => rl.question(q, (a) => { rl.close(); resolve(String(a || '').trim()); }));
 }
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // Run the device flow and return one of:
 //   { state: 'ok', token, builder } | { state: 'not_approved' } | { state: 'expired' }

package/scripts/bongos/page-reader.js

@@ -57,6 +57,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { spawn, spawnSync } = require('node:child_process');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 const INVENTORY_REL = 'docs/page-inventory.json';
@@ -511,7 +512,7 @@ async function renderOne(browser, kit, plan, base) {
     try { await kit.runActions(page, plan.actions); } catch (e) { notes.push(`${plan.state}: an action failed (${String(e.message).split('\n')[0].slice(0, 120)}); read as it stood`); }
     // A body read on a response from a page that has since navigated away never
     // settles, so the wait for the data is bounded.
-    await Promise.race([Promise.all(pending), new Promise((r) => setTimeout(r, 2000))]);
+    await Promise.race([Promise.all(pending), sleep(2000)]);
     const got = await page.evaluate(captureInPage);
     if (got.branding) collectStrings(got.branding, data);
     return { state: plan.state, strings: got.strings, notes, data };

package/scripts/bongos/probe-cache.js

@@ -38,6 +38,7 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // Default freshness. The probes this serves answer questions that change on a
 // deploy or a ship — minutes, not seconds — so 60s is generous for a session brief
@@ -156,7 +157,7 @@ const POLL_MS = 100;
 async function waitForRecord(file, ttlMs, now) {
   const deadline = Date.now() + WAIT_MS;
   while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, POLL_MS));
+    await sleep(POLL_MS);
     const rec = readRecord(file);
     if (isFresh(rec, ttlMs, now())) return rec;
     // The holder is gone and left nothing: stop waiting and do the work ourselves.