@bongos/core 1.24.4 → 1.24.5

package/modules/copy-desk/page-status.js

@@ -193,7 +193,11 @@ function roundState(round) {
         if (p.last_sent_back_at && (!p.applied_at || p.applied_at <= p.last_sent_back_at)) return 'submitted';
         return 'unknown';
       }
-      return p.draft ? 'draft' : 'unknown';
+      // task 1004972: opened and nothing written is a state of its own, not one
+      // the reads cannot name. It waits on its artist and closes itself after
+      // BLANK_CLOSES_AFTER (the auto-close sweep), so it never reads "Needs to be
+      // reviewed" or asks an applier to release it.
+      return p.draft ? 'draft' : 'blank';
     case 'completed':
       // A held pass waits for the artist; a failed grade stays with the applier.
       return round.grade_passed === true ? 'waiting_for_artist' : 'applying';
@@ -319,7 +323,10 @@ const DAY_MS = 24 * 60 * 60 * 1000;
 // Home and in the daily digest). A draft nobody touches also EXPIRES
 // (expires_after): the auto-close sweep abandons it, its words kept on the task.
 const DRAFT_EXPIRES_AFTER = 14 * DAY_MS;
+// task 1004972 (owner, task 1004971): a round opened and left blank closes after a day.
+const BLANK_CLOSES_AFTER = DAY_MS;
 const IN_FLIGHT = Object.freeze({
+  blank: { word: 'Opened, nothing written yet', stuck_after: BLANK_CLOSES_AFTER, waits_on: 'artist', expires_after: BLANK_CLOSES_AFTER },
   draft: { word: 'Being written', stuck_after: 7 * DAY_MS, waits_on: 'artist', expires_after: DRAFT_EXPIRES_AFTER },
   writing: { word: 'Being written', stuck_after: 7 * DAY_MS, waits_on: 'artist' },
   words_review: { word: 'Words waiting for review', stuck_after: 3 * DAY_MS, waits_on: 'artist' },
@@ -330,7 +337,7 @@ const IN_FLIGHT = Object.freeze({
   landing: { word: 'Approved, going live', stuck_after: DAY_MS, waits_on: 'appliers' },
   unknown: { word: 'Needs to be reviewed', stuck_after: 0, waits_on: 'appliers' },
 });
-const IN_FLIGHT_ORDER = ['unknown', 'landing', 'applying', 'submitted', 'waiting_for_artist', 'words_review', 'writing', 'draft'];
+const IN_FLIGHT_ORDER = ['unknown', 'landing', 'applying', 'submitted', 'waiting_for_artist', 'words_review', 'writing', 'draft', 'blank'];
 
 function inFlightFor(list, byPage, nowMs) {
   const out = [];
@@ -980,4 +987,6 @@ module.exports = {
   stuckDigestText,
   // task 1004901: when an untouched draft expires (the auto-close sweep reads it).
   DRAFT_EXPIRES_AFTER,
+  // task 1004972: when a blank round closes (the auto-close sweep reads it).
+  BLANK_CLOSES_AFTER,
 };

package/modules/copy-desk/tests/copy_no_cms.mjs

@@ -312,8 +312,15 @@ await test('the module manifest declares no seam another module could write copy
   assert.equal(/writeFile|\.query\(|UPDATE |INSERT /.test(stuckSrc), false, 'the stuck-tweaks port writes nothing');
   // task 1004899: the auto-close sweep only ABANDONS an empty round through the
   // lifecycle port; it never hands a compose, so it cannot write a description.
+  // task 1004973: it may hand ONE compose, for an orphaned apply released back to
+  // the queue, and that compose is pages.appendSentBack: it appends the reason and
+  // changes no word (copy_page_auto_close.mjs proves the description is kept whole).
   const closeSrc = stripComments(read('auto-close.js'));
-  assert.equal(/writeFile|\.query\(|UPDATE |INSERT |compose/.test(closeSrc), false, 'the auto-close sweep abandons and writes nothing');
+  assert.equal(/writeFile|\.query\(|UPDATE |INSERT /.test(closeSrc), false, 'the auto-close sweep writes nothing itself');
+  const composes = closeSrc.match(/\bcompose\b[^\n]*/g) || [];
+  assert.deepEqual(composes.length, 1, 'one compose, for the orphan release');
+  assert.match(closeSrc, /\(task\) => pages\.appendSentBack\(task\.description, \{ at, by, note \}\)/, 'and it only appends the sent-back note');
+  assert.equal(/composeDraftBlock|composeBatchBlock|saveDraftInto|replaceBlock/.test(closeSrc), false, 'no draft or batch writer');
   const stats = read('artist-stats.js');
   assert.equal(/\b(pool|query|writeFile|appendFile|INSERT|UPDATE|DELETE)\b/.test(stats.replace(/\/\/.*$/gm, '')), false,
     'the artist-stats port reads through other ports and writes nothing');

package/modules/copy-desk/tests/copy_page_auto_close.mjs

@@ -65,9 +65,35 @@ await test('a draft left untouched for two weeks expires; a younger one stays (t
 });
 
 await test('the grace period is honoured: a round touched within it stays', () => {
-  const t = round({ updated_at: new Date(NOW - 59 * 60_000).toISOString() });
+  const t = round({ description: `${draft}\n\n${batch([])}`, updated_at: new Date(NOW - 59 * 60_000).toISOString() });
   assert.equal(autoClose.closeReason(t, { now: NOW, graceMs: 60 * 60_000 }), null);
-  assert.equal(autoClose.closeReason(t, { now: NOW, graceMs: 30 * 60_000 }), 'blank');
+  assert.equal(autoClose.closeReason(t, { now: NOW, graceMs: 30 * 60_000 }), 'nothing_to_apply');
+});
+
+// task 1004972 (owner, task 1004971): a blank round closes after one day, not an hour.
+await test('a blank round closes once a day old, and a round with a draft or a batch never closes as blank', () => {
+  const D = 86400000;
+  const at = (days, over = {}) => round({ updated_at: new Date(NOW - days * D).toISOString(), ...over });
+  assert.equal(autoClose.closeReason(at(0.9), { now: NOW }), null, 'under a day: it stays, reading "Opened, nothing written yet"');
+  assert.equal(autoClose.closeReason(at(1.1), { now: NOW }), 'blank');
+  assert.equal(autoClose.closeReason(at(1.1, { holder_id: '7' }), { now: NOW }), null, 'a held round is being written');
+  for (const [name, description] of [['draft', draft], ['batch with lines', `${draft}\n\n${batch([line])}`],
+    ['approved batch', `${batch([line])}\n\n${pages.composeWordsApprovedBlock({ at: OLD, by: '7' })}`]]) {
+    assert.notEqual(autoClose.closeReason(at(1.1, { description }), { now: NOW }), 'blank', `${name} is not blank`);
+  }
+  assert.equal(autoClose.closeReason(at(30, { description: `${draft}\n\n${batch([line])}` }), { now: NOW }), null, 'a batch with lines is never closed, however old');
+});
+
+await test('the blank note says nothing was written, and the sweep never writes words', async () => {
+  const calls = [];
+  const lifecycle = {
+    listPageTweakTasks: async () => [ROUNDS.blank],
+    releaseStuckTweak: async (args) => { calls.push(args); return { outcome: 'abandoned' }; },
+  };
+  await autoClose.runAutoClose({ now: NOW, resolve: () => lifecycle, founder: async () => ({ id: '1' }) });
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].note, /^Closed: nothing was written\./);
+  assert.deepEqual(Object.keys(calls[0]).sort(), ['builderId', 'expectedStatus', 'note', 'taskId'], 'no compose, no description, no wording');
 });
 
 await test('the sweep abandons through the lifecycle port, as the owner, with a plain note and no rewrite', async () => {
@@ -86,6 +112,42 @@ await test('the sweep abandons through the lifecycle port, as the owner, with a
   }
 });
 
+// task 1004973: an apply that stopped without finishing is released with a reason.
+await test('an orphaned apply (active, nobody holds it) is released back to the queue with the reason; a live apply is not', async () => {
+  const approved = `${draft}\n\n${batch([line])}\n\n${pages.composeWordsApprovedBlock({ at: OLD, by: '7' })}`;
+  const orphan = round({ id: '21', status: 'active', holder_id: null, description: approved });
+  const orphanDraft = round({ id: '22', status: 'active', holder_id: null, description: draft });
+  const live = round({ id: '23', status: 'active', holder_id: '7', holder_worktree: true, description: approved });
+  const fresh = round({ id: '24', status: 'active', holder_id: null, description: approved, updated_at: new Date(NOW - 5 * 60_000).toISOString() });
+  assert.deepEqual([orphan, orphanDraft, live, fresh].map((t) => autoClose.orphanReason(t, { now: NOW })), ['orphaned_apply', 'orphaned_apply', null, null]);
+  assert.equal(autoClose.closeReason(orphan, { now: NOW }), null, 'the ready-round rules never see an active round');
+
+  const calls = [];
+  const lifecycle = {
+    listPageTweakTasks: async () => [orphan, orphanDraft, live, fresh, ROUNDS.real_batch],
+    releaseStuckTweak: async (args) => { calls.push(args); return { outcome: 'released' }; },
+  };
+  const r = await autoClose.runAutoClose({ now: NOW, resolve: () => lifecycle, founder: async () => ({ id: '1' }) });
+  assert.deepEqual(r.closed.map((c) => [c.task_id, c.why, c.outcome]), [['21', 'orphaned_apply', 'released'], ['22', 'orphaned_apply', 'released']],
+    'after one sweep no round sits active with nobody holding it; the live apply and the fresh one are left alone');
+  for (const c of calls) {
+    assert.equal(c.expectedStatus, 'active');
+    assert.match(c.note, /^Released: the apply stopped without finishing\./);
+    assert.equal(typeof c.compose, 'function', 'released back to the queue, not abandoned');
+  }
+  // The reason is on the round, and the words are kept whole: the compose only appends.
+  const [batchOut, draftOut] = calls.map((c, i) => c.compose([orphan, orphanDraft][i]));
+  assert.equal(batchOut.ok, true);
+  assert.ok(batchOut.description.startsWith(approved), 'the draft, batch and approval are unchanged');
+  assert.ok(draftOut.description.startsWith(draft), 'a draft stays as it was');
+  const p = pages.blockPresence(batchOut.description);
+  assert.equal(p.batch && p.words_approved && !!p.last_sent_back_at, true, 'the batch carries the sent-back reason');
+  const pageStatus = require('../page-status.js');
+  assert.equal(pageStatus.roundState({ status: 'ready', holder_id: null, description: batchOut.description }), 'submitted', 'back in the /tweak queue');
+  assert.equal(pageStatus.roundState({ status: 'ready', holder_id: null, description: draftOut.description }), 'draft', 'a draft is its artist\'s again');
+  assert.match(draftOut.description, /the apply stopped without finishing/);
+});
+
 await test('nothing due, no owner read; no owner, no sweep; no lifecycle, no sweep', async () => {
   let asked = 0;
   const quiet = { listPageTweakTasks: async () => [ROUNDS.real_batch], releaseStuckTweak: async () => { throw new Error('must not run'); } };

package/modules/copy-desk/tests/copy_page_status.mjs

@@ -199,6 +199,8 @@ await test('every row of the D7 state table', () => {
 ${pages.composeWordsApprovedBlock({ at: 't2', by: '7' })}` }, 'submitted'],
     [{ status: 'ready', description: sentBackAfterApply }, 'submitted'],
     [{ status: 'ready', description: applied }, 'unknown'],
+    // task 1004972: opened and nothing written is its own state, never "Needs to be reviewed".
+    [{ status: 'ready', description: 'Page tweak round 1.' }, 'blank'],
     [{ status: 'completed', grade_passed: true }, 'waiting_for_artist'],
     [{ status: 'completed', grade_passed: false }, 'applying'],
     [{ status: 'confirmed' }, 'landing'],
@@ -258,7 +260,9 @@ ${pages.composeWordsApprovedBlock({ at: ago(9), by: '7' })}`;
     round(3, 'landing:c', { status: 'confirmed', updated_at: ago(17) }),
     round(4, 'builders:d', { status: 'completed', grade_passed: true, updated_at: ago(20) }),
     round(5, 'builders:e', { status: 'active', holder_id: '7', holder_login: 'me', holder_worktree: false, updated_at: ago(5) }),
-    round(6, 'builders:f', { status: 'ready', updated_at: ago(0.2) }),
+    // An active round nobody holds is one the reads cannot name. (A blank ready
+    // round is no longer that: it reads 'blank', task 1004972.)
+    round(6, 'builders:f', { status: 'active', holder_id: null, updated_at: ago(0.2) }),
     round(7, 'builders:g', { status: 'shipped', shipped_at: ago(3), updated_at: ago(3) }),
     round(8, 'status:h', { status: 'active', holder_id: '8', holder_worktree: true, updated_at: ago(2) }),
   ];

package/modules/hall-ui/public/tweak-editor.js

@@ -319,7 +319,8 @@
       notice('<p>The page changed after your draft was saved, so the draft is not shown over its new words. Rewrite the lines again here.</p>');
     }
     if (st.writable) { if (!st.ed.draft_on_older_reading) notice(''); return; }
-    if (!r || r.state === 'draft' || (r.state === 'writing' && !r.holder)) {
+    // A blank round (opened, nothing written; task 1004972) is free to take, like a draft.
+    if (!r || r.state === 'draft' || r.state === 'blank' || (r.state === 'writing' && !r.holder)) {
       notice('<p>Nobody is writing this page. Take it, and every line here is yours to type over.</p>'
         + '<button class="tw-notice__act" id="tw-claim" type="button">take this page</button>');
       return;

package/modules/lifecycle/db-claims.js

@@ -39,7 +39,7 @@ const { unsatisfiedDeps } = require('./db-deps-criteria.js');
 const { depRefusalRow } = require('./dead-deps.js');
 const { siblingOverlaps, RESOLVED_STATUSES } = require('./goal-conflicts.js');
 const { claimGate, claimPermissionsFor, disambiguateWorktreeName, foldWorktreeName } = require('./db-rank-authz.js');
-const { sealSessionLog } = require('./db-shared.js');
+const { idKey, sealSessionLog } = require('./db-shared.js');
 const { gatingRebaseTasksForBuilder, shouldRefuseClaimResolve } = require('./db-ship.js');
 const { splitRebaseGate, rebaseRefusalTasks } = require('./rebase-gate.js');
 const { REWARD_SUGGESTION_CAP, rewardGateAssignment } = require('./db-tasks.js');
@@ -898,7 +898,7 @@ async function releaseClaimsBatch({ claimIds, builderId, resolverSessionId, reso
     for (const claimId of uniqIds) {
       const claim = byId.get(claimId);
       if (!claim) { failures.push({ claim_id: claimId, reason: 'CLAIM_NOT_FOUND' }); continue; }
-      if (claim.builder_id !== builderId) { failures.push({ claim_id: claimId, reason: 'NOT_YOUR_CLAIM' }); continue; }
+      if (idKey(claim.builder_id) !== idKey(builderId)) { failures.push({ claim_id: claimId, reason: 'NOT_YOUR_CLAIM' }); continue; }
       if (claim.released_at) { failures.push({ claim_id: claimId, reason: 'ALREADY_RESOLVED' }); continue; }
       // task 1003767: the SAME decision resolveClaim uses, not a third copy of
       // the auth-session compare (this was the second of three). Batch release

package/modules/lifecycle/db-ship.js

@@ -16,7 +16,7 @@ const log = api.logger('lifecycle');
 const seams = api;
 const doneWhen = require('./done-when.js');
 const { THETES_GRADUATION_THRESHOLD, maybeAutoGraduateToThetes, foldWorktreeName } = require('./db-rank-authz.js');
-const { mostRecentClaimHolderId, sealSessionLog, staleClaimHourPredicate } = require('./db-shared.js');
+const { idKey, mostRecentClaimHolderId, sealSessionLog, staleClaimHourPredicate } = require('./db-shared.js');
 const { LIVE_STATUSES } = require('./dead-deps.js');
 const { isPageTweak } = require('./page-tweak-hold.js');
 const pageTweakArtist = require('./page-tweak-artist.js');
@@ -138,7 +138,7 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
     );
     if (claimRows.length === 0) throw { code: 'CLAIM_NOT_FOUND' };
     const claim = claimRows[0];
-    if (claim.builder_id !== builderId) throw { code: 'NOT_YOUR_CLAIM' };
+    if (idKey(claim.builder_id) !== idKey(builderId)) throw { code: 'NOT_YOUR_CLAIM' }; // task 1005004: pg bigint string vs a number
     if (claim.released_at) throw { code: 'ALREADY_RESOLVED' };
     // Resolve lock: only the WORKING TREE that created this claim can resolve it
     // (task 1003767) — falling back to the creating session where no tree is

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.4",
+  "version": "1.24.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.4",
+      "version": "1.24.5",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.4",
+  "version": "1.24.5",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10812,7 +10812,27 @@
       "text": "The payments decision record now carries the owner's answers: credits can be tuned but not switched off, pay rules live on the settings page, and Verro is Verro Labs."
     }
   ],
-  "1.24.4": [
+  "1.24.5": [
+    {
+      "id": "1004973",
+      "text": "A page tweak whose apply stopped partway, with nobody holding it any more, now goes back in the queue by itself with a note saying the apply stopped, instead of sitting stuck forever."
+    },
+    {
+      "id": "1005004",
+      "text": "Fixed a check that could wrongly stop a builder from handing back or finishing their own task when their ID arrived written as a number instead of text."
+    },
+    {
+      "id": "1005015",
+      "text": "AI agents now reliably flag when they need you (HUMAN TASK / HUMAN DECISION) and own up when a doc or tool misled them, on every machine, even ones running out-of-date copies."
+    },
+    {
+      "id": "1004972",
+      "text": "A page tweak someone opened but never wrote in now shows as \"Opened, nothing written yet\" instead of \"Needs to be reviewed\", and closes itself after one day with a note saying nothing was written."
+    },
+    {
+      "id": "1004978",
+      "text": "Deleted an old, out-of-date manifest file from the repository root that nothing used, so old scripts it listed no longer look like they are still in use."
+    },
     {
       "id": "1004968",
       "text": "The setting that sizes credit rewards is now called a cost scale instead of a dollar peg, so it no longer reads like an exchange rate; old project settings keep working and nobody's rewards change."

package/scripts/bongos/codemod-rename-scripts-gds.js

@@ -52,8 +52,7 @@
 //   - files that deliberately name BOTH spellings or the old one: this codemod, forwarder.js,
 //     the forwarder test, modules/lifecycle/executed-closure.js (lists both on purpose),
 //     rename-ledger-prose.js (masks `scripts/gds` as a protected identifier in ledger prose),
-//     the task-2004 codemod (a historical tool), and .bongos-core.json (the manifest of a
-//     core build cut from an older commit — its paths describe THAT build).
+//     and the task-2004 codemod (a historical tool).
 //
 // Usage:
 //   node scripts/bongos/codemod-rename-scripts-gds.js           # apply
@@ -81,7 +80,6 @@ const EXCLUDE = new Set([
   'tests/scripts_gds_forwarders.mjs',
   'modules/lifecycle/executed-closure.js',
   'scripts/bongos/rename-ledger-prose.js',
-  '.bongos-core.json',
 ]);
 
 const FROZEN_PATHS = [

package/scripts/bongos/dev-box-guard.js

@@ -85,7 +85,6 @@ const DEV_BOX_EXEMPT = new Map([
   // Captured data and seed history that name real records.
   ['scripts/bongos/seed-', 'one-shot task seeders: their subject is the historical tasks they filed'],
   ['scripts/hall-preview/fixtures/', 'captured API responses: the ledger still holds these task and goal rows'],
-  ['.bongos-core.json', 'a 1.0.0 seed manifest from July (commit b6ee5d29) that this repo never regenerates'],
 ]);
 
 const TEXT_EXT = /\.(js|mjs|cjs|json|md|sql|sh|html|css|yml|yaml|txt|toml)$/;

package/scripts/bongos/publish-manifest.js

@@ -316,7 +316,7 @@ const INSTANCE_EXCLUDE = [
   // the instance-recipe / game-design carve-outs above. (The portable ADRs + the README index still publish.)
   // The instance's OWN name + trademark decision. Its prose redacts cleanly, but the FILENAME
   // carries the brand and the publish manifest lists every path — so the literal shipped in
-  // .bongos-core.json no matter how well the body was redacted. It also genericizes to nothing:
+  // the tarball's inner .bongos-core.json no matter how well the body was redacted. It also genericizes to nothing:
   // "accepting trademark risk on <our name>" is not a decision another instance inherits.
   // (task 1003869 — the last literal in the artifact.)
   'docs/adr/0004-amazonprimea-name-and-trademark-acceptance.md',

package/src/bongos/agent-standing-rules.js

@@ -0,0 +1,44 @@
+'use strict';
+// src/bongos/agent-standing-rules.js — the rules every AI session obeys whoever the
+// builder is, served by the SERVER so a stale checkout still hears them (task 1005015).
+//
+// WHY THE SERVER. The human signal (task 1004922) lived only in the local Conductor
+// hook, told once on a session's first prompt. A hook runs from whatever checkout the
+// machine has, and on the owner's box that was 823 commits behind, so the markers never
+// appeared at all. Slop detection lived only as a CLAUDE.md table row nothing ever
+// triggered. GET /me's interaction contract is relayed verbatim by EVERY Conductor
+// since task 2010, stale ones included, so appending these rules to it reaches every
+// active user the moment the instance serving them runs this code.
+//
+// The wording is the rule's home for sessions; docs/voice.md is its home for people.
+// conductor.js and stop-slopcheck.js carry their own copies (they must work on a
+// checkout whose core cannot load), and tests/agent_standing_rules.mjs holds every
+// copy equal to the contract this file serves. Only withStandingRules is exported:
+// the hooks' dynamic core resolve is invisible to the dead-code scan.
+
+const HUMAN_SIGNAL_TEXT = 'When you need the person, start that line with `🙋 **HUMAN TASK:**` if they must DO something '
+  + 'only a person can do (try it on the live site, add a key, sign in, approve), or `🔀 **HUMAN DECISION:**` if they must '
+  + 'CHOOSE (list the options and mark your pick). Put the same marker at the start of a question-box question. Never use them for anything else.';
+
+const SLOP_TEXT = 'The moment you find you were wrong because something told you so (a doc, a hook\'s output, a script\'s message, '
+  + 'a stale file) — or the person corrects you — say `🐛 Bongo Slop Detected!!, Filing Bug 🐛`, name the source that misled you, '
+  + 'and file it: `node scripts/bongos/capture.js "<file>: says X, truth is Y" --kind bug`. The misleading source is the bug. '
+  + 'Your own plain mistake, with nothing misleading behind it, is not slop.';
+
+const HEADER = 'Standing rules for every session:';
+
+function standingRulesBlock() {
+  return `${HEADER}\n- ${HUMAN_SIGNAL_TEXT}\n- ${SLOP_TEXT}`;
+}
+
+// The interaction slice of GET /me with the standing rules appended. `interaction` is
+// describeInteraction's object or null (builder-settings module off); either way the
+// result injects, because these rules do not depend on any preference. Idempotent.
+function withStandingRules(interaction) {
+  const base = interaction && typeof interaction === 'object' ? interaction : {};
+  const contract = typeof base.contract === 'string' ? base.contract : '';
+  if (contract.includes(HEADER)) return { ...base, inject: true };
+  return { ...base, contract: contract ? `${contract}\n${standingRulesBlock()}` : standingRulesBlock(), inject: true };
+}
+
+module.exports = { withStandingRules };

package/src/bongos/module-scope-map.js

@@ -615,8 +615,9 @@ const SHARED_GLOBS = Object.freeze(
 // Assigning nineteen roots in one pass is the one-at-a-time churn task 1004132 was
 // filed to avoid; freezing the set and naming the arguable ones is the cheap half.
 const UNOWNED_ROOTS = Object.freeze({
-  // Generated packaging manifests — written by package-core.js, never hand-edited.
-  '.bongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
+  // Generated packaging manifest — written by package-core.js, never hand-edited.
+  // (The repo-root .bongos-core.json, a stale July 1.0.0 seed, was deleted in task 1004978;
+  // the live one is the INNER manifest package-core writes into the tarball.)
   '.cloudbongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
   // Governance + legal. Deliberately not methodology: methodology owns docs/, and
   // these are the project's constitutional documents rather than its handbook.

package/src/bongos/routes/me.js

@@ -34,6 +34,7 @@ const db = require('../db');
 // prefs-module-less instance so the slices simply render their unset/default shape.
 const { validateOrRespond } = require('./_helpers');
 const { readModes: readCraftModes, describeCraftMode } = require('../craft-mode'); // task 1002992
+const { withStandingRules } = require('../agent-standing-rules'); // task 1005015
 const { branding } = require('../../branding'); // task 2011: instance model-allocation default
 // The onboarding state machine carved into modules/onboarding/ (BV1.R81 / ADR
 // 0093 §1): the GET /me aggregator + PATCH /me/disciplines resolve the
@@ -565,7 +566,9 @@ module.exports = function buildMeRouter() {
       // contract. The old §2 "The Prompter" owner-defaults, now per-builder. The
       // session-start injection + /settings UI read this; describeInteraction is
       // the SSOT (builder-settings port). null when the prefs module is off.
-      interaction: lawed ? lawed.interaction : (settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null),
+      // task 1005015: the standing rules (human-task markers, slop detection) ride
+      // this contract because every Conductor, stale ones included, relays it.
+      interaction: withStandingRules(lawed ? lawed.interaction : (settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null)),
       // task 1004707: the project's LAWS, read into every AI session. The
       // Conductor hook relays `contract` verbatim beside the interaction profile
       // (inject:false, and no block, when no law is in force). `laws` is the book

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/agent_standing_rules.mjs

@@ -0,0 +1,142 @@
+// tests/agent_standing_rules.mjs — the human-task markers and the Slop Bongo rule reach
+// every session (task 1005015).
+//
+// They used to live only in the local Conductor hook (markers, first prompt only) and
+// a CLAUDE.md table row (slop, never triggered), so a stale checkout or a long session
+// lost them. Now: the SERVER appends them to the interaction contract every Conductor
+// relays; the Conductor re-says them when the person corrects the agent or is about to
+// be asked something; a Stop hook asks once when the agent reverses itself.
+//
+// .claude/hooks/ is package-excluded, so a clean core checkout skips this file
+// (tests/host_topology_skips.mjs carries the allowlist entry).
+//
+// Run:  node tests/agent_standing_rules.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { requireHostModule } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const rules = require('../src/bongos/agent-standing-rules.js');
+const conductor = requireHostModule(require, '../.claude/hooks/conductor.js');
+const slopcheck = requireHostModule(require, '../.claude/hooks/stop-slopcheck.js');
+
+// The words as the server serves them: a header line, then one '- ' line per rule.
+const [HEADER, HUMAN, SLOP] = rules.withStandingRules(null).contract.split('\n').map((l, i) => (i ? l.slice(2) : l));
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); } catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('the server appends both rules to a builder\'s interaction contract and keeps it injecting', () => {
+  const out = rules.withStandingRules({ inject: true, contract: 'Interaction profile — P', fields: [1] });
+  assert.ok(out.contract.startsWith('Interaction profile — P\n'), 'the profile stays first');
+  assert.ok(out.contract.includes(HUMAN));
+  assert.ok(out.contract.includes(SLOP));
+  assert.equal(out.inject, true);
+  assert.deepEqual(out.fields, [1], 'the rest of the slice is untouched');
+});
+
+t('with the settings module off (null) the rules still reach the session', () => {
+  const out = rules.withStandingRules(null);
+  assert.equal(out.inject, true);
+  assert.ok(out.contract.startsWith(HEADER));
+});
+
+t('appending is idempotent', () => {
+  const once = rules.withStandingRules({ inject: true, contract: 'P' });
+  assert.equal(rules.withStandingRules(once).contract, once.contract);
+});
+
+t('GET /me wraps the interaction slice (wiring pin)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'routes', 'me.js'), 'utf8');
+  assert.match(src, /interaction: withStandingRules\(/);
+});
+
+t('the rules mark both markers and the slop line exactly as the owner set them', () => {
+  assert.ok(HUMAN.includes('🙋 **HUMAN TASK:**'));
+  assert.ok(HUMAN.includes('🔀 **HUMAN DECISION:**'));
+  assert.ok(SLOP.includes('🐛 Bongo Slop Detected!!, Filing Bug 🐛'));
+  assert.ok(fs.readFileSync(path.join(ROOT, 'CLAUDE.md'), 'utf8').includes('🐛 Bongo Slop Detected!!, Filing Bug 🐛'), 'CLAUDE.md says the same line');
+});
+
+t('the Conductor\'s copy says exactly what the server sends', () => {
+  assert.equal(conductor.HUMAN_SIGNAL_TEXT, HUMAN);
+  assert.equal(conductor.SLOP_TEXT, SLOP);
+  assert.equal(conductor.STANDING_HEADER, HEADER);
+});
+
+t('the first-prompt marker line is skipped when the server already sent the rules', () => {
+  const served = rules.withStandingRules({ inject: true, contract: 'P' });
+  const a = conductor.evaluateTriggers({ firstPrompt: true, interaction: served });
+  assert.ok(!a.some((x) => x.id === 'human-signal'));
+  assert.ok(a.some((x) => x.id === 'interaction' && x.text.includes('HUMAN TASK')));
+  const old = conductor.evaluateTriggers({ firstPrompt: true, interaction: { inject: true, contract: 'P' } });
+  assert.ok(old.some((x) => x.id === 'human-signal'), 'an older server still gets the local line');
+});
+
+t('an ask names the markers', () => {
+  const a = conductor.evaluateTriggers({ prompt: 'file a blocker for this' }).find((x) => x.id === 'ask-shape');
+  assert.ok(a && a.text.includes('🔀 **HUMAN DECISION:**') && a.text.includes('🙋 **HUMAN TASK:**'));
+});
+
+t('a person correcting the agent triggers the slop check, every time', () => {
+  for (const p of ["that's wrong, it is live", 'you said it needs a dev box', 'actually it already works', "it's already deployed", 'not true', 'is slop detection firing?']) {
+    const a = conductor.evaluateTriggers({ prompt: p }).find((x) => x.id === 'slop-check');
+    assert.ok(a, `no slop check for: ${p}`);
+    assert.equal(a.always, true, 'renders even when the advisory set repeats');
+  }
+});
+
+t('ordinary prompts do not trigger the slop check', () => {
+  for (const p of ['add a dark mode toggle', 'run the tests', 'what can I work on', 'make the button wider']) {
+    assert.ok(!conductor.evaluateTriggers({ prompt: p }).some((x) => x.id === 'slop-check'), p);
+  }
+});
+
+t('the Stop hook asks once when the agent reverses itself', () => {
+  for (const m of ['Turns out the deploy needs no ssh.', 'I was wrong about the branch.', 'My mistake — it is live.', 'I said it was stale but it is current.']) {
+    const r = slopcheck.evaluate(m);
+    assert.equal(r.block, true, m);
+    assert.ok(r.reason.includes('Bongo Slop Detected'));
+  }
+});
+
+t('the Stop hook stays quiet on ordinary text and when the rule was already followed', () => {
+  assert.equal(slopcheck.evaluate('Done. All 12 tests pass.').block, false);
+  assert.equal(slopcheck.evaluate('The old test was wrong about the count; I fixed it.').block, false);
+  assert.equal(slopcheck.evaluate('🐛 Bongo Slop Detected!!, Filing Bug 🐛 — turns out the doc was stale.').block, false);
+  assert.equal(slopcheck.evaluate('').block, false);
+});
+
+t('the Stop hook\'s copy says exactly what the server sends', () => {
+  assert.equal(slopcheck.SLOP_TEXT, SLOP);
+});
+
+t('the Stop hook reads only the transcript tail, and still finds the last message past a cut line', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'slopcheck-'));
+  const tp = path.join(dir, 't.jsonl');
+  const filler = JSON.stringify({ type: 'user', message: { content: 'x'.repeat(1000) } });
+  const lines = Array.from({ length: 600 }, () => filler); // ~600 KB, past the 256 KB tail
+  lines.push(JSON.stringify({ type: 'assistant', message: { content: [{ type: 'text', text: 'Turns out it was live.' }] } }));
+  lines.push(JSON.stringify({ type: 'assistant', message: { content: [{ type: 'tool_use', name: 'x' }] } }));
+  fs.writeFileSync(tp, lines.join('\n') + '\n');
+  assert.equal(slopcheck.lastAssistantText(tp), 'Turns out it was live.');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+t('the Stop hook is wired through the node resolver', () => {
+  const s = JSON.parse(fs.readFileSync(path.join(ROOT, '.claude', 'settings.json'), 'utf8'));
+  const cmds = s.hooks.Stop.flatMap((e) => e.hooks.map((h) => h.command));
+  assert.ok(cmds.some((c) => /run-node\.sh.*stop-slopcheck\.js/.test(c)));
+});
+
+console.log(`\nagent_standing_rules: ${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/tests/claims_batch_routes.mjs

@@ -47,7 +47,8 @@ function answer(sql, params, via) {
   // The release's locked read (FOR UPDATE) — distinct from the newcomer gate's
   // active-claims read, which joins the same tables.
   if (/FROM claims c JOIN tasks t ON t\.id = c\.task_id/.test(sql) && /FOR UPDATE/.test(sql)) {
-    const wanted = new Set(params[0].map(String));
+    // An array for the batch release; a single id for resolveClaim.
+    const wanted = new Set([].concat(params[0]).map(String));
     return { rows: claimFixture.filter((r) => wanted.has(String(r.id))) };
   }
   if (/FROM claims c/.test(sql) && /released_at IS NULL/.test(sql)) {
@@ -215,19 +216,41 @@ test('own claim with matching id types (both strings, as production sends them)
   assert.equal(claimReleases().length, 1);
 });
 
-// KNOWN BUG (task 1005004, filed by task 1004983): releaseClaimsBatch compares
-// claim.builder_id !== builderId strictly, so a STRING row id (node-pg bigint)
-// against a NUMBER caller id refuses the caller's OWN claim as NOT_YOUR_CLAIM.
-// Production is unaffected today only because req.builder.id is also a string.
-// It fails closed (never releases a stranger's claim), so this pins CURRENT
-// behaviour; when the compare is fixed, flip this to expect a release.
-test('KNOWN BUG: own claim as string builder_id vs a NUMBER caller id is refused NOT_YOUR_CLAIM (fails closed)', async () => {
-  caller = { id: 42, rank: 'thetes' };
-  claimFixture = [row({ builder_id: '42' })];
-  const r = await post(RELEASE, { claim_ids: [101] });
-  assert.deepEqual(r.json.released, []);
-  assert.deepEqual(r.json.failures, [{ claim_id: 101, reason: 'NOT_YOUR_CLAIM' }]);
+// task 1005004 (found by task 1004983): the ownership compare was a strict
+// claim.builder_id !== builderId, so a STRING row id (node-pg bigint) against a
+// NUMBER caller id refused the caller's OWN claim as NOT_YOUR_CLAIM. It now
+// compares one spelling of each side (db-shared idKey). The stranger matrix
+// above still refuses in every combination.
+test('own claim is released whatever the id types — string or number on either side', async () => {
+  for (const [rowId, callerId] of [['42', 42], [42, '42'], [42, 42], ['42', '42']]) {
+    calls = [];
+    caller = { id: callerId, rank: 'thetes' };
+    claimFixture = [row({ builder_id: rowId })];
+    const r = await post(RELEASE, { claim_ids: [101] });
+    const label = `row builder_id ${JSON.stringify(rowId)} vs caller ${JSON.stringify(callerId)}`;
+    assert.deepEqual(r.json.released.map((x) => x.claim_id), [101], label);
+    assert.deepEqual(r.json.failures, [], label);
+    assert.equal(claimReleases().length, 1, label);
+  }
+});
+
+// The same compare in resolveClaim (db-ship.js), the single-claim ship/release
+// path: a number caller id must reach past the ownership check on its own
+// claim, and a stranger's claim is still NOT_YOUR_CLAIM before any write.
+test('resolveClaim: own claim with a NUMBER caller id passes the ownership check; a stranger\'s is refused, nothing written', async () => {
+  const resolve = (builderId) => db.resolveClaim({
+    claimId: 101, builderId, outcome: 'abandoned', resolverSessionId: 'sess-A', force: true,
+  }).then(() => null, (e) => e);
+
+  claimFixture = [row({ builder_id: '7', creator_session_id: 'sess-Z' })];
+  const stranger = await resolve(42);
+  assert.equal(stranger && stranger.code, 'NOT_YOUR_CLAIM');
   assert.deepEqual(writes(), []);
+
+  calls = [];
+  claimFixture = [row({ builder_id: '42' })];
+  const own = await resolve(42);
+  assert.notEqual(own && own.code, 'NOT_YOUR_CLAIM', `own claim refused: ${own && (own.code || own.message)}`);
 });
 
 // ── the session check, and force ─────────────────────────────────────────────

package/tests/copy_stuck_page_tweaks.mjs

@@ -63,7 +63,9 @@ await test('every state has an owner and a deadline: overdue only past it, told
     ['applying', () => ({ status: 'active', holder_id: '99', holder_worktree: true }), 'appliers', 1],
     ['waiting_for_artist', () => ({ status: 'completed', grade_passed: true }), 'artist', 3],
     ['landing', () => ({ status: 'confirmed' }), 'appliers', 1],
-    ['unknown', () => ({ status: 'ready' }), 'appliers', 0],
+    ['unknown', () => ({ status: 'active', holder_id: null }), 'appliers', 0],
+    // task 1004972: a blank round waits on its artist and is due when it closes itself (1 day).
+    ['blank', () => ({ status: 'ready' }), 'artist', 1],
   ];
   for (const [state, shape, owner, days] of table) {
     const id = 'landing:projects';