@bongos/core 1.22.2 → 1.23.2

package/scripts/bongos/autonomy-gauge.js

@@ -18,6 +18,7 @@
 
 const fs = require('node:fs');
 const { decideCapacity } = require('../../modules/autonomy/gauge.js');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 function gaugePath() {
   if (process.env.AUTOBONGOS_GAUGE_FILE) return process.env.AUTOBONGOS_GAUGE_FILE;
@@ -70,7 +71,7 @@ async function main(argv) {
     const now = Math.floor(Date.now() / 1000);
     const waitS = d.sleepUntil ? Math.max(1, d.sleepUntil - now) : 60;
     if (!json) console.log(`  sleeping ${waitS}s…`);
-    await new Promise((r) => setTimeout(r, waitS * 1000));
+    await sharedSleep(waitS * 1000);
   }
 }
 

package/scripts/bongos/backfill-disciplines.js

@@ -47,7 +47,7 @@ function classify(task) {
   return { discipline: FALLBACK, reasoned: false, confidence: null };
 }
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // PATCH one row, WAITING OUT the per-session rate limit rather than counting it as a
 // failure. The first run of this backfill treated a 429 as a failed row and stopped

package/scripts/bongos/backfill-sessions.js

@@ -241,7 +241,7 @@ function loadExisting() {
   return set;
 }
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 async function main() {
   const existing = loadExisting();

package/scripts/bongos/backup.js

@@ -8,6 +8,7 @@
 // Rank gate: metic+archon.
 
 const { cliClient, requireSession } = require('./cli-lib');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 function fmtBytes(n) {
   if (n == null) return '(unknown size)';
@@ -84,7 +85,7 @@ async function trigger() {
   const deadline = Date.now() + 60_000;
   let landed = false;
   while (Date.now() < deadline) {
-    await new Promise(resolve => setTimeout(resolve, 3_000));
+    await sleep(3_000);
     const status = await fetchStatus();
     const nowFile = status.latest_dump && status.latest_dump.filename;
     if (nowFile && nowFile !== beforeFile) {

package/scripts/bongos/dev.js

@@ -57,7 +57,7 @@ function tail(s, n = 6) {
 }
 // Portable synchronous pause (no subprocess, no foreground-sleep dependency).
 function sleepSync(ms) { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); }
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 function usage() {
   console.log(`bongos dev — run THIS instance, in one command.

package/scripts/bongos/do-api.js

@@ -24,6 +24,7 @@
 //   createDroplet · getDroplet · deleteDroplet · settleDroplet (poll to active)
 
 const { JsonHttpApi, makeApiError } = require('./http-api-client');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const DO_API_BASE = 'https://api.digitalocean.com/v2';
 
@@ -79,7 +80,7 @@ class DoApi extends JsonHttpApi {
   // Returns the stopping value, or { timedOut:true } after `tries` rounds.
   // `sleepFn` lets tests drive the loop with no real clock.
   async _poll({ tries = 60, sleepMs = 5000, sleepFn } = {}, step) {
-    const sleep = sleepFn || ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const sleep = sleepFn || sharedSleep;
     for (let i = 0; i < tries; i++) {
       const r = await step(i);
       if (r && r.done) return r.value;

package/scripts/bongos/fitness.js

@@ -523,7 +523,7 @@ const KERNEL_FILES = [
   'src/module-api.js',                    // the published doorway
   'src/modules.js',                       // the registry/resolver facade
   'src/module-seams.js',                  // the seam registry (ports/events/contributions)
-  'src/role-responsibilities.js', 'src/html-escape.js', // owner's role statements (task 1003732) + THE server HTML escaper (task 1004876) — both import nothing
+  'src/role-responsibilities.js', 'src/html-escape.js', 'src/sleep.js', // owner's role statements (task 1003732) + THE server HTML escaper (task 1004876) + THE server sleep (task 1004893) — all import nothing
   'src/module-loader/loader.js',          // the disk loader (discover → validate → mount)
   'src/module-loader/manifest-schema.js', // the manifest validator
   'src/module-loader/semver.js',          // coreVersion compatibility
@@ -1365,13 +1365,12 @@ const CHECKS = [
   require('./doc-control-claims.js').checkDocControlClaims, // Check 37 — task 1003418 / audit A14: a doc cannot describe an enforcement control that does not exist (derived from the docs, not a hand list)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
   require('./skill-preflight.js').checkOpsSkillsDeclareMachine, // Check 23 — task 1003167 / G03: an ops skill declares the machine it needs
-  // Check 24 — task 1003166 / G02: no ops script hardcodes a version id. It landed
-  // sharing Check 23's line, deliberately, because fitness.js was ~500 lines over
-  // the excess-lines ratchet and a new check could not afford one (idea 1000810).
-  // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
-  // and the check gets its own line back.
+  // Check 24 — task 1003166 / G02: no ops script hardcodes a version id. It once shared
+  // Check 23's line because fitness.js was over the excess-lines ratchet (idea 1000810);
+  // task 1003206 carved this file from 2,004 lines to ~1,350, so it has its own line back.
   require('./version-literal-guard.js').checkNoVersionLiterals,
   require('./escape-helper-guard.js').checkOneHtmlEscaper, // task 1004876: ONE HTML escaper per side (dom-utils.js / src/html-escape.js), and hall pages load dom-utils first
+  require('./sleep-helper-guard.js').checkOneSleepHelper, // task 1004893: ONE sleep per side (dom-utils.js OTB.sleep / src/sleep.js)
   require('./dev-box-guard.js').checkNoDevBox, // task 1003899 / ADR 0346: the retired dev box stays out (its exemption list lives in that file)
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)

package/scripts/bongos/local-preview.js

@@ -15,12 +15,13 @@
 // shipped. Set OTB_PREVIEW_PORT to override the default 3100.
 
 const lib = require('./local-preview-lib');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 async function pollHealthy(ms = 20_000) {
   const end = Date.now() + ms;
   while (Date.now() < end) {
     if (await lib.health()) return true;
-    await new Promise((r) => setTimeout(r, 500));
+    await sleep(500);
   }
   return false;
 }

package/scripts/bongos/login.js

@@ -86,7 +86,7 @@ function prompt(q) {
   return new Promise((resolve) => rl.question(q, (a) => { rl.close(); resolve(String(a || '').trim()); }));
 }
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // Run the device flow and return one of:
 //   { state: 'ok', token, builder } | { state: 'not_approved' } | { state: 'expired' }

package/scripts/bongos/page-reader.js

@@ -57,6 +57,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { spawn, spawnSync } = require('node:child_process');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 const INVENTORY_REL = 'docs/page-inventory.json';
@@ -511,7 +512,7 @@ async function renderOne(browser, kit, plan, base) {
     try { await kit.runActions(page, plan.actions); } catch (e) { notes.push(`${plan.state}: an action failed (${String(e.message).split('\n')[0].slice(0, 120)}); read as it stood`); }
     // A body read on a response from a page that has since navigated away never
     // settles, so the wait for the data is bounded.
-    await Promise.race([Promise.all(pending), new Promise((r) => setTimeout(r, 2000))]);
+    await Promise.race([Promise.all(pending), sleep(2000)]);
     const got = await page.evaluate(captureInPage);
     if (got.branding) collectStrings(got.branding, data);
     return { state: plan.state, strings: got.strings, notes, data };

package/scripts/bongos/probe-cache.js

@@ -38,6 +38,7 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // Default freshness. The probes this serves answer questions that change on a
 // deploy or a ship — minutes, not seconds — so 60s is generous for a session brief
@@ -156,7 +157,7 @@ const POLL_MS = 100;
 async function waitForRecord(file, ttlMs, now) {
   const deadline = Date.now() + WAIT_MS;
   while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, POLL_MS));
+    await sleep(POLL_MS);
     const rec = readRecord(file);
     if (isFresh(rec, ttlMs, now())) return rec;
     // The holder is gone and left nothing: stop waiting and do the work ourselves.

package/scripts/bongos/provision-core-upgrade.js

@@ -39,6 +39,7 @@ const { ensurePinWriteKey, hasOwnAccount, pinKeyPath, pinSshCommand } = require(
 const { replayPinCommit } = require('./provision-pin-replay.js'); // GitHub ahead → pin on top (task 1004733)
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 const { RELEASE_NOTES_FILE, RELEASE_NOTES_MAX_BYTES, parseChangeRecords, notesBetween } = require('./release-notes.js');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 const outcome = require('./upgrade-outcome.js'); // how far a failed move got, as a class (task 1004446)
 
 // The shapes whose box this runner can actually reach. Mirrors UPGRADE_SHAPES in the
@@ -359,7 +360,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // single immediate read races it binding its port. A false "did not take" here is
   // never cosmetic — it is what the owner is shown after the one act they were told they
   // could finally perform.
-  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep = deps.sleep || sharedSleep;
   let served = null;
   for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
     const res = boxExec(versionCmd(inst), { allowFail: true });

package/scripts/bongos/provision.js

@@ -57,6 +57,7 @@ const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.
 const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
 const { disconnectInstance } = require('./provision-disconnect.js');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 const { coreUpgradeInstance, preflightCoreUpgrade, snapshotAllCoreVersions } = require('./provision-core-upgrade.js'); // the owner's deploy door, ADR 0293
 const { isByoHost, recordByoHost } = require('./provision-byo-host.js'); // stand up NOTHING for a byo-host row, ADR 0323
 
@@ -515,7 +516,7 @@ async function provisionInstance(inst, deps) {
   // budget on an instance that may simply be slow); the liveness overlay is
   // what tells the owner the truth.
   log('  [healthz] verify the instance answers');
-  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep = deps.sleep || sharedSleep;
   let healthy = null;                     // null = not observed (dry-run)
   const tries = apply ? 10 : 1;
   for (let i = 0; i < tries; i++) {
@@ -869,7 +870,7 @@ async function settingsApplyInstance(inst, deps) {
   // 7's rule); a loopback PASS proves the process, not the address — the
   // domain-scoped sweep earns that claim.
   log('  [healthz] verify the instance answers after the restart');
-  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep = deps.sleep || sharedSleep;
   let healthy = false;
   for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
     const res = boxExec(healthzCmd(inst), { allowFail: true });
@@ -959,7 +960,7 @@ async function restartInstance(inst, deps) {
   // false "down" is never cosmetic here: this instance is ALREADY flagged
   // unreachable, and a hasty verdict would tell the owner their restart failed.
   log('  [healthz] verify the instance answers after the restart');
-  const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep = deps.sleep || sharedSleep;
   let healthy = false;
   for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
     const res = boxExec(healthzCmd(inst), { allowFail: true });
@@ -1113,7 +1114,7 @@ async function placeManifestCreds(inst, mrow, deps) {
   //    used to record a failure for a setup that had succeeded. The JSON answer lives
   //    at /api/bongos/healthz — the root /healthz says a plain "ok" (task 1004577).
   if (apply) {
-    const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const sleep = deps.sleep || sharedSleep;
     let authConfigured = false;
     for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
       const out = boxExec(authHealthzCmd(inst), { allowFail: true });

package/scripts/bongos/publish-integration-gate.js

@@ -38,6 +38,7 @@
 'use strict';
 
 const fs = require('node:fs');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const WORKFLOW_FILE = 'integration.yml';
 const DEFAULT_TIMEOUT_MIN = 12; // inside publish.yml's 20-minute job, leaving room to pack + publish
@@ -70,7 +71,7 @@ function runsUrl(repo, sha) {
 // touches the world is injectable for tests/publish_integration_gate.mjs.
 async function waitForIntegration({
   sha, repo, token, timeoutMs, intervalMs,
-  fetchImpl = globalThis.fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now,
+  fetchImpl = globalThis.fetch, sleep = sharedSleep, now = Date.now,
 }) {
   const deadline = now() + timeoutMs;
   let last = { verdict: 'wait', run: null, why: 'no read yet' };

package/scripts/bongos/render-api.js

@@ -31,6 +31,7 @@
 'use strict';
 
 const { JsonHttpApi, makeApiError } = require('./http-api-client');
+const { sleep: sharedSleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const RENDER_API_BASE = 'https://api.render.com/v1';
 
@@ -184,7 +185,7 @@ class RenderApi extends JsonHttpApi {
 
   // Poll until a new database is 'available'. `sleepFn` lets tests drive it with no clock.
   async settlePostgres(postgresId, { tries = 60, sleepMs = 5000, sleepFn } = {}) {
-    const sleep = sleepFn || ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const sleep = sleepFn || sharedSleep;
     for (let i = 0; i < tries; i++) {
       const pg = await this.getPostgres(postgresId);
       if (pg.status === 'available') return pg;

package/scripts/bongos/sandbox-stage.js

@@ -26,6 +26,7 @@ const os = require('node:os');
 const path = require('node:path');
 const readline = require('node:readline');
 const localPreview = require('./local-preview-lib');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // The default health URL waitHealthy probes when a caller supplies none; the
 // local context always passes its own (localPreview.healthUrl).
@@ -198,7 +199,7 @@ async function waitHealthy(deps = {}) {
     } catch (e) {
       lastErr = e.message;
     }
-    await new Promise((r) => setTimeout(r, deps.pollMs || HEALTH_POLL_MS));
+    await sleep(deps.pollMs || HEALTH_POLL_MS);
   }
   return { ok: false, reason: lastErr };
 }

package/scripts/bongos/seed-bongos-v1-idea-routing-tasks.js

@@ -25,7 +25,7 @@ const META_TASK = 1003059;      // this planning session's meta task — moved i
 const DISCORD_BUGS_IDEA = 1000771; // subsumed by R11; marked promoted against it
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 async function api(method, path, body, _tries = 0) {
   await sleep(400); // base throttle to stay under the per-IP rate limit
   const res = await fetch(`${BASE}/api/bongos${path}`, {

package/scripts/bongos/seed-bv1-profiles-tasks.js

@@ -21,7 +21,7 @@ const GOAL = 1000045;
 const SRC = 'planning-session';
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 async function api(method, path, body, _tries = 0) {
   await sleep(400); // base throttle to stay under the per-IP rate limit
   const res = await fetch(`${BASE}/api/bongos${path}`, {

package/scripts/bongos/seed-bv2-ideator-surface-tasks.js

@@ -32,7 +32,7 @@ const CRIT = {
 
 const SPEC = 'Spec: `docs/specs/bongos-v2-ideator-surface.md` (final). Design of record: idea 1001072 + `docs/design/ideator-surface-direction.md`.';
 
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 async function api(method, path, body, _tries = 0) {
   await sleep(400); // base throttle to stay under the per-IP rate limit
   const res = await fetch(`${BASE}/api/bongos${path}`, {

package/scripts/bongos/session-eval.js

@@ -27,6 +27,7 @@ const wanderingPrefs = require('../../modules/builder-settings/wandering-prefs')
 // fitness scans (modules/sessions/CLAUDE.md, "NOT in this module").
 const { scoreAccessibility } = require('../../modules/sessions/accessibility');
 const { resolveDefaultVersion } = require('./version-select.js');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 // ---- classification vocabularies -----------------------------------------
 
@@ -489,7 +490,7 @@ if (require.main === module) {
       candidates = (search.data && search.data.sessions) || [];
       if (candidates.length > 0 || attempt === maxAttempts) break;
       console.error(`search returned 0 candidates (attempt ${attempt}/${maxAttempts}) — retrying in 1500ms (possible stale read, #608)...`);
-      await new Promise((r) => setTimeout(r, 1500));
+      await sleep(1500);
     }
     // An empty corpus is an ANOMALY by default (stale read / upload gap), NOT a
     // clean "nothing to do" — refuse to write a misleadingly-empty report so the

package/scripts/bongos/setup.js

@@ -32,6 +32,7 @@ function statusOrigin() {
   return API_BASE;
 }
 const onboardingConfig = require('./onboarding-config');
+const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const DRY_RUN = process.argv.includes('--dry-run');
 // --skip-keys mirrors the same flag on scripts/setup-builder.sh — when set,
@@ -586,7 +587,7 @@ async function main() {
   const deadline = Date.now() + expires_in * 1000;
   let pollInterval = interval * 1000;
   while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, pollInterval));
+    await sleep(pollInterval);
     const poll = await (await cliClient()).auth.postAuthDevicePoll({ body: { device_code } });
     // Admission gate (SR-19 / task #1000): a first-time GitHub account that an
     // Archon hasn't approved is refused (HTTP 403, state:'not_approved'). Print a

package/scripts/bongos/sleep-helper-guard.js

@@ -0,0 +1,88 @@
+// scripts/bongos/sleep-helper-guard.js — fitness check: ONE "wait N milliseconds"
+// helper per side (task 1004893, goal 1000135).
+//
+// WHY. ~27 files each hand-rolled a Promise around setTimeout to wait. That is
+// harmless on its own, but it is the copy-paste that task 1004876 found ~45 of for
+// the HTML escaper, where some copies had quietly drifted. They were collapsed onto
+// exactly two definitions:
+//
+//   browser  modules/hall-ui/public/dom-utils.js  → window.OTB.sleep
+//   server   src/sleep.js                          → sleep (modules reach it
+//                                                   through src/module-api.js)
+//
+// This check keeps it that way. It looks for the SHAPE, not a name: a Promise whose
+// resolver is handed straight to setTimeout is a sleep whatever the variable is
+// called, and inline copies with no name at all were half of what the audit found. A BLOCKING sleep (Atomics.wait —
+// merge-lock.js, rename-ledger-prose.js) has a different shape and is left alone:
+// it freezes the thread on purpose, and the shared helper cannot do that.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { REPO_ROOT } = require('./fitness-lib.js');
+
+const ALLOWED = new Map([
+  ['modules/hall-ui/public/dom-utils.js', 'the shared BROWSER sleep (window.OTB.sleep)'],
+  ['src/sleep.js', 'the shared SERVER sleep (module-api sleep)'],
+  ['modules/ui-design/kit/render.js', 'its wait runs INSIDE the browser page via page.evaluate — the function is serialized, so it cannot reach either shared helper'],
+]);
+
+// Where code lives. Tests are out of scope: a test injects its own fake sleep.
+const SCAN_ROOTS = ['src', 'scripts', 'modules', 'server.js', 'bin'];
+const SCAN_EXT = /\.(c|m)?js$|\.html$/;
+const SKIP_DIR = new Set(['node_modules', '.git', 'tests', 'fixtures']);
+
+// new Promise(<resolver> => [{] setTimeout(<same resolver>, …  — arrow or function form.
+const SLEEP_RE = /new\s+Promise\(\s*(?:function\s*)?\(?\s*(\w+)\s*\)?\s*(?:=>\s*)?\{?\s*setTimeout\(\s*(\w+)\s*,/g;
+
+function walk(abs, out) {
+  let st;
+  try { st = fs.statSync(abs); } catch { return out; }
+  if (st.isFile()) { if (SCAN_EXT.test(abs)) out.push(abs); return out; }
+  for (const ent of fs.readdirSync(abs, { withFileTypes: true })) {
+    if (SKIP_DIR.has(ent.name)) continue;
+    walk(path.join(abs, ent.name), out);
+  }
+  return out;
+}
+
+// findHandRolledSleeps(text) → 1-based line numbers holding a hand-rolled sleep.
+function findHandRolledSleeps(text) {
+  const lines = String(text).split('\n');
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    for (const m of lines[i].matchAll(SLEEP_RE)) {
+      if (m[1] === m[2]) { hits.push(i + 1); break; }
+    }
+  }
+  return hits;
+}
+
+function checkOneSleepHelper({ root = REPO_ROOT } = {}) {
+  const violations = [];
+  let scanned = 0;
+  for (const r of SCAN_ROOTS) {
+    for (const abs of walk(path.join(root, r), [])) {
+      scanned++;
+      const relPath = path.relative(root, abs).split(path.sep).join('/');
+      if (ALLOWED.has(relPath)) continue;
+      const hits = findHandRolledSleeps(fs.readFileSync(abs, 'utf8'));
+      if (hits.length) {
+        violations.push(`${relPath}:${hits[0]} — a hand-rolled sleep (new Promise → setTimeout). Use the shared one: `
+          + 'window.OTB.sleep in the browser, sleep from src/sleep.js (or api.sleep in a module) on the server.');
+      }
+    }
+  }
+  return {
+    name: 'one sleep helper per side (task 1004893)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} code files hold no hand-rolled sleep (allowed: ${[...ALLOWED.keys()].join(', ')}).`,
+  };
+}
+
+module.exports = { checkOneSleepHelper, findHandRolledSleeps };

package/scripts/bongos/upgrade.js

@@ -832,7 +832,7 @@ async function recordLedger({ fromVersion, toVersion, sourceCommit, note, reques
 // Connection-refused fails fast, so the early retries are cheap; the backoff caps at 2s.
 async function pollHealth(healthUrl, deps = {}) {
   const fetchImpl = deps.fetch || fetch;
-  const sleep = deps.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep = deps.sleep || require('../../src/sleep').sleep; // the one shared sleep (task 1004893)
   const now = deps.now || Date.now;
   const budgetMs = deps.healthBudgetMs != null ? deps.healthBudgetMs : 30_000;
   const deadline = now() + budgetMs;
@@ -882,7 +882,7 @@ function deriveVersionUrl(healthUrl) {
 // (a real failure) from "it wouldn't tell me" (unconfirmed), because only the first is proof.
 async function pollServedVersion(versionUrl, deps = {}) {
   const fetchImpl = deps.fetch || fetch;
-  const sleep = deps.sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep = deps.sleep || require('../../src/sleep').sleep; // the one shared sleep (task 1004893)
   const now = deps.now || Date.now;
   // Default to the health budget when a caller (or a test) has already narrowed it, else 15s.
   const budgetMs = deps.versionBudgetMs != null

package/scripts/gds/sleep-helper-guard.js

@@ -0,0 +1,6 @@
+// scripts/gds/sleep-helper-guard.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/sleep-helper-guard.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'sleep-helper-guard.js');

package/src/bongos/module-scope-map.js

@@ -465,6 +465,7 @@ const MODULE_GLOBS = {
     'scripts/bongos/seam-wiring-guard.js', 'scripts/bongos/skill-preflight.js',
     'scripts/bongos/test-path-guard.js', 'scripts/bongos/version-literal-guard.js', 'scripts/bongos/dev-box-guard.js',
     'scripts/bongos/escape-helper-guard.js', // task 1004876
+    'scripts/bongos/sleep-helper-guard.js', // task 1004893
   
     // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
     // install-git-hooks.js + scripts/bongos/hooks/ are the pre-push hook beside the

package/src/bongos/module-store.js

@@ -25,6 +25,7 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const { parseVersion, cmp } = require('../module-loader/semver');
 const { KEY_RE } = require('../module-loader/manifest-schema');
+const { recordPublishCategory } = require('./module-subcategories');
 
 // Where the store lives: <INSTANCE ROOT>/var/module-store (task 1004399).
 //
@@ -172,11 +173,11 @@ function relativeArtifactPath(file, { dir = storeDir() } = {}) {
 const PUBLISH_CHANNEL = 'tester';
 
 // One transaction. `db` is a pg Pool (anything with connect()). Returns
-// { ok: true, version: row, created: bool, channel } or { ok: false, code, message, status }.
+// { ok: true, version: row, created: bool, channel, category } or { ok: false, code, message, status }.
 async function publishVersion(input, { db, beforeCommit } = {}) {
   const {
     key, title, description, version, coreVersion, manifest,
-    treeSha256, tarballSha256, bytes, artifactPath: relPath, builderId,
+    treeSha256, tarballSha256, bytes, artifactPath: relPath, builderId, category,
   } = input;
   const pool = db || require('./pool').pool;
   const client = await pool.connect();
@@ -229,11 +230,15 @@ async function publishVersion(input, { db, beforeCommit } = {}) {
       `INSERT INTO store_module_version_channels (version_id, channel, reason, set_by)
        VALUES ($1, $2, $3, $4)`,
       [row.id, PUBLISH_CHANNEL, 'new_version', builderId]);
+    // Where the module sits, on the same transaction (task 1004355, ADR 0342 D3): a
+    // sub-category the store has not seen is proposed here and is not live until a
+    // Metic+ person approves it. A version naming no category leaves it where it was.
+    const placed = category ? await recordPublishCategory(client, { key, category, builderId }) : null;
     // Put the tarball in place while the row is still uncommitted: if this throws,
     // the catch below rolls the row back, so the two can never disagree.
     if (beforeCommit) await beforeCommit();
     await client.query('COMMIT');
-    return { ok: true, created, version: row, channel: PUBLISH_CHANNEL };
+    return { ok: true, created, version: row, channel: PUBLISH_CHANNEL, category: placed };
   } catch (e) {
     try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
     // Two publishes of the same version racing past the check: the UNIQUE wins.