@bongos/core 1.24.68 → 1.24.69

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.68",
-  "core_contract": "1.24.68",
-  "source_commit": "11d18a24f88e4a0dc0348653d46f1436332533b7",
+  "core_version": "1.24.69",
+  "core_contract": "1.24.69",
+  "source_commit": "68d624516bb357028ebcde65caf3b4a8fec22239",
   "source_ref": "HEAD",
-  "built_at": "2026-11-09T20:26:36.856Z",
+  "built_at": "2026-11-09T21:00:37.018Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 638,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3904,
+    "functional_verbatim": 3905,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4575,
-  "tree_sha256": "55f8f3d3ffc2f4ed3ccf4c3dfbc91607b1a72f70d465e1930d322a45ed7438dd",
+  "file_count": 4576,
+  "tree_sha256": "dbadf59ddc54d1764c6ad589df54766251762350991b5db66d08fb3283a5f471",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -557,7 +557,7 @@
     {
       "path": "docs/adr/0029-status-page-outage-resilience.md",
       "mode": "0000644",
-      "sha256": "ec0298ea8652e72c00f90546a57a08a1aca9d0208593bb56bde0a7254aa1e851"
+      "sha256": "199fc3e775f32f46a658294bbbe83783a7455cff2b554f8680f4235b1ae0ece1"
     },
     {
       "path": "docs/adr/0030-builders-hall-live-updates.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "15027e86a94259e4ea08d9d2b47234bd92e4ee8b205677ee27ef20b6579e30a2"
+      "sha256": "65351a8f07adc711a0045deb60cad8493c943702365a855d6400748fbdf2108d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3127,7 +3127,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "c5840a0cae12bde4eef54a5b2785046fe3bfbb750bb7be7bc3808e4eb3491d0d"
+      "sha256": "09cb01eeb9aa79bca4380b11498c05dd30e4985358e8cb8fdec7497b2a9581b6"
     },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
@@ -8157,7 +8157,7 @@
     {
       "path": "modules/lifecycle/merge-reach.js",
       "mode": "0000644",
-      "sha256": "77ee8eb1615feb977701f8f50f14a080b9ebb0cda07dbc5ce0a5061ab2063fb8"
+      "sha256": "422b941660edc139d0353cccb110c8d130827c02200511da372d23456f133e51"
     },
     {
       "path": "modules/lifecycle/migrations/lifecycle_001_goal_first_leads.sql",
@@ -11902,12 +11902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ae81a9706d5fb007fa6ab9d3fa6783616f3adb642fd256c5478bf30a211026f6"
+      "sha256": "7965aa4c685c6bdd12a6710eb50550a823662415b832362a07f41b2b8ac7d2af"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cd129832a4eea52b6613553aa6da6fb2ce7f853bff8d1032d5adfd233e53710c"
+      "sha256": "fb8d2aa51f2449ffe9ba7c21b564fdc36c288f5fd55737f16b245dd60430d780"
     },
     {
       "path": "public-docs/index.html",
@@ -11927,7 +11927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "24f4dda6011cf1e1c255226457e1647e80821260e443a11b76e858193073b8eb"
+      "sha256": "325bd7b65c334113a2600e606108a7f2597e9fa0ba045ef76170d3d4907af92c"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12182,7 +12182,7 @@
     {
       "path": "scripts/bongos/claim.js",
       "mode": "0000644",
-      "sha256": "bb8b7a0104622d725c7057f04aea6b82f0586f6323a761302afdb3942fb65ae2"
+      "sha256": "377cd8c4aa3bff219bf2d071cdfe0f918a3ceb30b775d8c881f329f36173f1e0"
     },
     {
       "path": "scripts/bongos/claude-materialize.js",
@@ -12292,7 +12292,7 @@
     {
       "path": "scripts/bongos/deploy-divergence.js",
       "mode": "0000644",
-      "sha256": "bf18a79242d650a5974b40607dbedcf2d40c9c65d86ddc61cdf19e242cc4f2cb"
+      "sha256": "82b9f7657d6fcd5ed8bd79e4e7104e3b960b649eaf122d6ab871f48b86494ad9"
     },
     {
       "path": "scripts/bongos/deploy-main-audit-gate.sh",
@@ -15867,7 +15867,7 @@
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
-      "sha256": "17daf4a38c2e208130fbfe5afe56f548d9bc3bfa9fd57a2ab2dbe459748da811"
+      "sha256": "b123541932f206894a652aebf64a13ed0794a4b44e68936a11d65bf49c7a2fc9"
     },
     {
       "path": "src/link-preview.js",
@@ -15877,7 +15877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c1a27021e0c321c2125b4cac14ae9441f74250c88c3b9fb8fe2d7b562d06924c"
+      "sha256": "610ccbeab694b699af5e1a2e5142760bf95ce1c3c8affe30d076d36272390410"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16087,7 +16087,7 @@
     {
       "path": "tests/agent_standing_rules.mjs",
       "mode": "0000644",
-      "sha256": "f296357646d9eb778a5334b75742ef1172ff87e10b26a5e7eaffe0e8fe983120"
+      "sha256": "08edffc3a673b01249586330d7cb0fbb4f31d7dfaaadc80864191899fedb5545"
     },
     {
       "path": "tests/agents_authoring.mjs",
@@ -16814,6 +16814,11 @@
       "mode": "0000644",
       "sha256": "8b937f463b8f03dba8c67047d8aca9be84a00839f4821e00ee5d31a96a6bead9"
     },
+    {
+      "path": "tests/claim_finish_hint.mjs",
+      "mode": "0000644",
+      "sha256": "a8c2e33617c23d9f6584f2901a7ad9f77f0ed5588b2dd219ba79b3c4c805b4b0"
+    },
     {
       "path": "tests/claim_from_task_and_home.mjs",
       "mode": "0000644",
@@ -17397,7 +17402,7 @@
     {
       "path": "tests/deploy_divergence_line.mjs",
       "mode": "0000644",
-      "sha256": "fcf4e6ca24b37e8872ffc1830aafa2dbeb8e28131bec0bebba622114001d3182"
+      "sha256": "b4067239ab71d3aaf3fa7e05fd4a1aaee3938a975970265f3f1679eeab838062"
     },
     {
       "path": "tests/deploy_handoff.mjs",
@@ -19517,7 +19522,7 @@
     {
       "path": "tests/instance_config.mjs",
       "mode": "0000644",
-      "sha256": "ba3404f1fd37d33dac3e64ac17a0c71fd8d73a56f7fcef362f5ffd1423136e55"
+      "sha256": "355349970d4a6f903a55bebacdde11eaca4283b22c8ee8266b346a9ecdd8a8ca"
     },
     {
       "path": "tests/instance_db_migrated_on_code_move.mjs",
@@ -21862,7 +21867,7 @@
     {
       "path": "tests/shell_hooks.mjs",
       "mode": "0000644",
-      "sha256": "3105a2a2c7a911e1993efd83af537fb2294b332cd5262ab83b41cc720e98a3da"
+      "sha256": "efafe5abb508560bae1287e6e811f9efb907280b1c032e5bb07e6027f6b17add"
     },
     {
       "path": "tests/shell_stat_portability.mjs",
@@ -22267,7 +22272,7 @@
     {
       "path": "tests/status_mirror_sync.mjs",
       "mode": "0000644",
-      "sha256": "78d32bb02f7e40885d3c1a0a23209f92531d3eaabe212728d1993af0b7cccaea"
+      "sha256": "9112bd164ed3eaf73826677a646e37819d8400c2f857cb2ff668ae9a8173d5d7"
     },
     {
       "path": "tests/status_page_chrome.mjs",

package/docs/adr/0029-status-page-outage-resilience.md

@@ -1,6 +1,6 @@
 # 0029 — Status-page outage resilience: measure from outside, host off-box, prevent at the source
 
-- **Status:** Accepted. **Slice 1 (external prober) built this session** under task **[#565](https://example.com/builders#/task/565)**: `.github/workflows/status-probe.yml` + `scripts/status-probe.mjs` + this ADR. **Follow-up B (page off-box) has since SHIPPED** — `status.example.com` is served off the droplet from GitHub Pages (repo `example-owner/example-status`), synced by `.github/workflows/sync-status-mirror.yml`. Incident-backfill (follow-up C) is **not yet built**. **Since removed (task 1004858, 2026-10-25):** the in-process `uptime-poller.js` (nothing started it), the `status-probe.mjs` prober (its workflow was already gone) and the `/public/uptime` feed — the file references below are history.
+- **Status:** Accepted. **Slice 1 (external prober) built this session** under task **[#565](https://example.com/builders#/task/565)**: `.github/workflows/status-probe.yml` + `scripts/status-probe.mjs` + this ADR. **Follow-up B (page off-box) has since SHIPPED** — `status.example.com` is served off the droplet from GitHub Pages (repo `example-owner/example-status`). **No workflow syncs it** (task 1005131): `sync-status-mirror.yml` is not in this repo, so the page updates only when someone runs `node scripts/status-mirror-sync.js --repo-dir <mirror-checkout> --push` by hand. Incident-backfill (follow-up C) is **not yet built**. **Since removed (task 1004858, 2026-10-25):** the in-process `uptime-poller.js` (nothing started it), the `status-probe.mjs` prober (its workflow was already gone) and the `/public/uptime` feed — the file references below are history.
 - **Date:** 2026-06-03
 - **Deciders:** Lars Kristensen (Archon), Claude
 - **Track:** `internal` (the status dashboard / The Watch)
@@ -29,7 +29,7 @@ An **external prober runs on GitHub-hosted runners** — off our DigitalOcean in
 - `.github/workflows/status-probe.yml` — `*/5` cron + `workflow_dispatch`; publishes the result to an **orphan `status-data` branch** (off-box, web-readable, survives a droplet outage); **fails the job when the site is confirmed down**, which emails the repo owner — the alert.
 
 ### 2. Host the page off-box (follow-up B — SHIPPED)
-`status.example.com` is now served off the droplet from **GitHub Pages** (repo `example-owner/example-status`), synced by [`.github/workflows/sync-status-mirror.yml`](../../.github/workflows/sync-status-mirror.yml); the page no longer shares fate with the product. Original plan, for the record:
+`status.example.com` is now served off the droplet from **GitHub Pages** (repo `example-owner/example-status`), published by hand with `scripts/status-mirror-sync.js` (no workflow runs it — task 1005131); the page no longer shares fate with the product. Original plan, for the record:
 Move `public-status/` to free static hosting **separate from the droplet** (Cloudflare Pages or GitHub Pages). The page shell + the **uptime/incident section** are served off-box and read the `status-data` source, so they stay truthful during an outage. The rich GDS panels (treasury, grades, progress) keep loading client-side from `example.com/api/gds/public/*` and **degrade gracefully** to "origin unreachable" when the droplet is down (requires adding CORS to those public routes). Then repoint `status.example.com` DNS at the off-box host.
 
 ### 3. Prevent at the source + alert (blocker [#6](https://example.com/builders#/blocker/6))

package/docs/module-api-changelog.md

@@ -3390,5 +3390,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.66 with no explicit bump. run 42689728958. (task 1002620)
   1.24.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.67 with no explicit bump. run 42692736161. (task 1002620)
+  1.24.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.68 with no explicit bump. run 42698123714. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/core-release-pipeline.md

@@ -4,7 +4,7 @@
 
 | Who | Gets a merged change | How to check |
 |---|---|---|
-| **cloudbongos.com** — the projects hub and the builders hall | only when a **published core release** carries it **and the hub's pin moves** — owner-gated, never automatic on merge | its `/version`; the ship card's **Deploy** row reads it: *"live at `<sha>` (includes this merge \| not yet)"* |
+| **cloudbongos.com** — the projects hub and the builders hall | only when a **published core release** carries it **and the hub's pin moves** — its patch-channel subscription moves the pin to a new patch release on its own (task 1005020); a new minor release waits for the owner | its `/version`; the ship card's **Deploy** row reads it: *"live at `<sha>` (includes this merge \| not yet)"* |
 | **Projects hosted on the platform** | only when a **published core release** carries it (auto-published per merge, [ADR 0161](../adr/0161-publish-on-merge.md)) **and that project's pin moves** — a patch-channel subscription or a core-upgrade | that project's `/version` `coreVersion`; the ship card's **Projects** row states the rule |
 
 So a shipped task is live nowhere until a release carries it, and then only on an instance whose pin has moved — the hub included. The release itself waits on a green integration lane: the publish lane's integration gate refuses while `integration` on `main` is red. Never call work live until that instance's `/version` shows it. (This table used to say the hub redeploys from `main` on every merge, within minutes. It never did; on 2026-10-25 the hub had served one build through 200+ merges — task 1004873.) The wording has one source, [`modules/lifecycle/merge-reach.js`](../../modules/lifecycle/merge-reach.js); the ship card, `deploy-divergence.js` and the SessionStart line all print it (task 1004682). `/recall who sees a merge` finds the same rule as learning 1000292, which corrects learning 1000291 (that one still says the hub redeploys on every merge; the API has no way to edit a learning).
@@ -297,7 +297,7 @@ If live is **at or past** `<VER>`, stop and pick again. On 2026-09-17 a paste pr
 
 What each piece is for — each guards a failure that actually happened:
 
-- **`BONGOS_INSTANCE_ROOT`, not `CLOUDBONGOS_INSTANCE_ROOT`.** The legacy spelling still works but prints a deprecation warning three times per run and stops being read in core 1.21; the new spelling is verified in this exact line (2026-09-17, twice).
+- **`BONGOS_INSTANCE_ROOT`, not `CLOUDBONGOS_INSTANCE_ROOT`.** The legacy spelling still works but prints a deprecation warning three times per run (it is still read, but will stop being read in a future core release); the new spelling is verified in this exact line (2026-09-17, twice).
 - **The token lives in root-only `/etc/cloudbongos/npm.env`, and is handed DOWN to `lars`.** This is the step that used to be documented wrongly, so read it before improvising. `NPM_TOKEN` is **not** in lars’s environment, **not** in the interactive profile, and **not** in `/home/lars/.npmrc` — all three probed empty (2026-08-17). An earlier version of this runbook grepped `~/.npmrc` and therefore aborted on its own `[ -n "$NPM_TOKEN" ]` guard every time. Worse, it could not have worked even if that file were populated: the project `.npmrc` says `_authToken=<redacted>, which **overrides** lars’s user `~/.npmrc`, so the variable is the only channel. Hence the shape above: `set -a; . /etc/cloudbongos/npm.env; set +a` reads it as **root** (mode 600), and `--preserve-env=NPM_TOKEN` hands it to the unprivileged `lars` — exactly what systemd does for the sweep unit (`User=lars` + `EnvironmentFile=`). Without it npm falls back to the **public** registry, 404s on the private `@bongos/core`, and rolls back cleanly having taught you nothing.
 - **Never put the token in the command line — `sudo` logs the full argv (task 1003218).** The shape above is safe *because* the token is read INSIDE the quoted script, so only the `grep` reaches argv. The tempting variant is not:
   ```
@@ -342,7 +342,7 @@ node scripts/bongos/deploy-divergence.js --url https://<instance-host>
 It reports the two gaps **separately**, because they have different fixes:
 
 - **UNRELEASED** — commits on `main` past the last `CORE_VERSION` bump. *No instance, the hub included, can take these at any pin* — no published version contains them yet. The publish lane (ADR 0161) normally carries a merge within minutes; a gap that stays means the lane is disarmed, red, or refused by its integration gate. The SessionStart line also says whether `main`'s latest merge is in a release yet.
-- **UNDEPLOYED** — the live instance's `coreVersion` is behind `main`'s. A release exists it has not picked up: its pin has not moved (gate 3). On the hub that move is owner-gated.
+- **UNDEPLOYED** — the live instance's `coreVersion` is behind `main`'s. A release exists it has not picked up: its pin has not moved (gate 3). On the hub the patch-channel sweep makes that move on its own; a gap that stays means the sweep is held (artist gate, failed health check) or the release is a new minor, which waits for the owner.
 
 Exit codes: `0` aligned, `1` diverged, `2` undetermined.
 

package/modules/lifecycle/merge-reach.js

@@ -1,14 +1,16 @@
 // modules/lifecycle/merge-reach.js — who sees a merge, and when. The ONE source of
-// the sentence (task 1004682; corrected by task 1004873).
+// the sentence (task 1004682; corrected by tasks 1004873 and 1005020).
 //
 // One path, for every instance — the hub included:
 //   1. A merge to main is first carried by a PUBLISHED core release. The publish
 //      lane cuts one per merge (ADR 0161), but only while its integration gate is
 //      green; a red integration lane stalls every release behind it.
-//   2. An instance gets that release only when its PIN moves. On the hub
-//      (cloudbongos.com: the projects hub and the builders hall) that is
-//      owner-gated; on a hosted project it is a patch-channel subscription or a
-//      core-upgrade.
+//   2. An instance gets that release only when its PIN moves. The hub
+//      (cloudbongos.com: the projects hub and the builders hall) is subscribed to
+//      the patch channel, so its update sweep moves the pin to a new patch release
+//      on its own — no person needed; only a new MINOR release (which the patch
+//      channel never takes) waits for the owner's Hall → Deploy. On a hosted
+//      project it is a patch-channel subscription or a core-upgrade.
 //
 // History: this file used to say the hub "redeploys from main on every merge,
 // within minutes". It never did — the hub pins a published core like any other
@@ -16,7 +18,9 @@
 // while sessions told the owner that work was live (task 1004873). Before that,
 // deploy-divergence.js printed "Merging to main deploys nothing" (ADR 0137), false
 // in the other direction. The ship card, the divergence report and the SessionStart
-// line all read their wording from here, so they cannot drift apart again.
+// line all read their wording from here, so they cannot drift apart again. Then
+// task 1004873's wording called the hub's pin move "owner-gated", which was false
+// for patches: cloudbongos.com moved to core 1.24.12 with no person (task 1005015).
 //
 // PURE and dependency-free: callers pass an already-sanitised reading (host, short
 // sha, inclusion), never a raw network response — some of this text is injected
@@ -26,8 +30,11 @@
 
 const HOSTED_LINE = 'Hosted projects: only when a published core release carries the change and their pin moves (patch-channel subscription or a core-upgrade).';
 
+// How the hub's pin moves (task 1005020): by itself for a patch release, by the owner for a minor.
+const HUB_PIN = 'its patch-channel subscription moves that pin on its own; a new minor release waits for the owner';
+
 function hubRule(host) {
-  return `${host || 'The hub'} gets a merge only when a published core release carries it and its pin moves (owner-gated)`;
+  return `${host || 'The hub'} gets a merge only when a published core release carries it and its pin moves (${HUB_PIN})`;
 }
 
 // includes: true (the live build carries this merge), false (not yet), null (cannot tell).
@@ -36,7 +43,7 @@ function hubLine({ host = null, liveShort = null, includes = null } = {}) {
   const state = includes === true ? 'includes this merge'
     : includes === false ? 'not yet'
       : 'cannot tell yet whether it includes this merge';
-  return `${host || 'The hub'}: live at ${liveShort} (${state}) — it gets a merge only when a published core release carries it and its pin moves (owner-gated).`;
+  return `${host || 'The hub'}: live at ${liveShort} (${state}) — it gets a merge only when a published core release carries it and its pin moves (${HUB_PIN}).`;
 }
 
 // Is main's latest merge in a published release yet? `tipShort` is a short sha,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.68",
+  "version": "1.24.69",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.68",
+      "version": "1.24.69",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.68",
+  "version": "1.24.69",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11411,5 +11411,31 @@
       "id": "1005132",
       "text": "The design checker now catches text hidden under a dark overlay (the bug that made the components page unreadable in dark mode), instead of reporting it clean."
     }
+  ],
+  "1.24.69": [
+    {
+      "id": "1005113",
+      "text": "In a project that installs Bongos from npm (like toast), the claim card now tells you to finish with 'npx bongos ship', a command that exists there, instead of a script path that doesn't."
+    },
+    {
+      "id": "1005131",
+      "text": "The status-page docs no longer claim an automatic sync that does not exist. They now say plainly that the off-site status page updates only when someone publishes it by hand, and a test keeps that claim honest."
+    },
+    {
+      "id": "1005022",
+      "text": "The 'you may have made a mistake' nudge no longer fires on automatic messages from other sessions or CI — only on a person's own corrections."
+    },
+    {
+      "id": "1005020",
+      "text": "Status messages now say plainly that cloudbongos.com picks up small (patch) releases on its own — no one has to move it by hand. Only a bigger (minor) release waits for the owner."
+    },
+    {
+      "id": "1005042",
+      "text": "The old-style settings warning no longer promises a removal date that already passed; it now says honestly the old names still work for now."
+    },
+    {
+      "id": "1004949",
+      "text": "When a shell command was blocked by one hook and another hook was missing, the warning about the missing hook vanished. Now both messages show."
+    }
   ]
 }

package/scripts/bongos/claim.js

@@ -763,10 +763,7 @@ async function main() {
     // best-effort and never block the claim.
     const shownLearningKeys = await printRelevantLearnings(task);
     await printClaimRecall(task, { excludeKeys: shownLearningKeys });
-    console.log('\nWhen you finish:');
-    console.log(`  node scripts/bongos/ship.js ${task.id} --notes "..." --summary "..."`);
-    console.log('Or to abandon:');
-    console.log(`  node scripts/bongos/release.js ${task.id}`);
+    for (const line of finishHintLines(task.id)) console.log(line);
     // V3.R13 (#237): post-claim nudge — for a newcomer, this becomes
     // "Next: Ship thy first work" so the path forward is visible. Reuses the
     // /me fetched above for the context pack (no second round-trip).
@@ -802,6 +799,20 @@ async function main() {
 
 // Only auto-run when invoked directly (`node claim.js …`); a `require()` (the
 // unit test) just imports formatClaimFailure without executing the claim flow.
+// task 1005113 - claim card finish: the "When you finish" hint names the command that
+// exists where this claim ran. A project that installs the core from npm has no
+// scripts/bongos/ of its own — the CLI ships in node_modules/@bongos/core and runs as
+// `npx bongos <verb>` — so a node path there points at nothing. isInstalledCore() is the
+// one positive "this core sits under node_modules" check fitness already uses.
+function finishHintLines(taskId, { installed } = {}) {
+  if (installed === undefined) {
+    try { installed = require('./fitness-lib').isInstalledCore(); } catch { installed = false; }
+  }
+  const ship = installed ? `npx bongos ship ${taskId}` : `node scripts/bongos/ship.js ${taskId}`;
+  const release = installed ? `npx bongos release ${taskId}` : `node scripts/bongos/release.js ${taskId}`;
+  return ['\nWhen you finish:', `  ${ship} --notes "..." --summary "..."`, 'Or to abandon:', `  ${release}`];
+}
+
 if (require.main === module) {
   main().catch((err) => {
     console.error('fatal:', err);
@@ -809,4 +820,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, liveStrandLeases, QUEUE_GATED_EXIT };
+module.exports = { finishHintLines, formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, liveStrandLeases, QUEUE_GATED_EXIT };

package/scripts/bongos/deploy-divergence.js

@@ -5,7 +5,8 @@
 // modules/lifecycle/merge-reach.js): every instance, the hub included, gets a merge
 // only when a published core release carries it AND that instance's pin moves. The
 // publish lane cuts a release per merge (ADR 0161) only while the integration lane
-// is green; on the hub (cloudbongos.com) the pin move is owner-gated.
+// is green; on the hub (cloudbongos.com) its patch-channel subscription moves the pin
+// on its own (task 1005020), and only a new minor release waits for the owner.
 // Two blanket claims have been wrong here: "Merging to main deploys nothing" (ADR
 // 0137, false since ADR 0161) and "the hub redeploys from main on every merge"
 // (never true — the hub pins a published core). Sessions repeated each to the owner.
@@ -335,8 +336,9 @@ function report(r, { quiet = false } = {}) {
   }
   if (r.behind) {
     say(`  ⚠ UNDEPLOYED — live is ${r.live.coreVersion}, main declares ${r.onMain}.`);
-    say('    A release exists that this instance has not picked up: its pin has not moved. On the hub that move is');
-    say('    owner-gated; on a hosted project it is its update channel or a core-upgrade (docs/recipes/upgrading-the-core.md).');
+    say('    A release exists that this instance has not picked up: its pin has not moved. On the hub its patch-channel');
+    say('    sweep moves it on its own (a new minor waits for the owner); on a hosted project it is its update channel or a');
+    say('    core-upgrade (docs/recipes/upgrading-the-core.md). A gap that stays means the sweep is held or failing.');
   }
   if (r.schemaBehind) {
     const n = r.live.schemaPending;

package/src/instance-config.js

@@ -46,12 +46,10 @@ const LEGACY_DIRS = ['otb'];
 // test that it FIRES rather than one that merely tolerates it.
 const LEGACY_ENV_PREFIXES = ['CLOUDBONGOS', 'OTB', 'GDS', 'PMS'];
 
-// The core release in which the legacy prefixes above stop being read. Named in
-// every deprecation warning so an operator learns the deadline from the warning
-// itself rather than from a changelog they will not read. This lands in 1.19.x,
-// so 1.21 leaves a full minor of overlap; task 1003706 is the task that both
-// removes the fallback and moves this constant's meaning to "already gone".
-const LEGACY_ENV_SUNSET_RELEASE = '1.21';
+// The deprecation warning names no removal release (task 1005042 - legacy env
+// warning): it promised 1.21, the retirement (task 1003706 - C3d) was abandoned,
+// and 1.24 still read the old names. Name a real release only in the diff that
+// deletes the fallback.
 
 // Lazy require (ADR 0108 §1 made this a two-way edge: branding.js now requires
 // resolveCoreRoot()/resolveInstanceRoot() from this module, so a top-level
@@ -267,7 +265,7 @@ function warnLegacyEnv({ legacyName, canonicalName, shadowed, differs, log = con
     : shadowed
       ? `${canonicalName} is also set and wins`
       : `rename it to ${canonicalName}`;
-  log.warn(`[bongos] deprecated env ${legacyName} — ${fate}. The legacy spelling stops being read in core ${LEGACY_ENV_SUNSET_RELEASE}.`);
+  log.warn(`[bongos] deprecated env ${legacyName} — ${fate}. The legacy spelling is still read for now, but will stop being read in a future core release.`);
   return true;
 }
 
@@ -282,11 +280,10 @@ function warnPackPrefix({ prefix, name, log = console } = {}) {
   return true;
 }
 
-// NOT exported, deliberately: warnLegacyEnv, LEGACY_ENV_SUNSET_RELEASE and the
-// ledger are internals. resolveEnv's injectable `warn` is the whole test seam a
+// NOT exported, deliberately: warnLegacyEnv and the ledger are internals. resolveEnv's injectable `warn` is the whole test seam a
 // caller needs, and a test of the DEFAULT path captures console.warn — which
 // exercises the real wiring rather than a hand-called helper. Exporting them
-// would also add three untraceable entries to the knip dead-code ratchet.
+// would also add untraceable entries to the knip dead-code ratchet.
 
 // resolveCoreRoot() / resolveInstanceRoot() — the ADR 0108 §1 configurable-root
 // resolvers, extending this module's established zero-risk pattern from

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.68'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.69'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/agent_standing_rules.mjs

@@ -112,6 +112,20 @@ t('the app\'s own status messages never trigger the slop check (task 1005023)',
   assert.ok(conductor.evaluateTriggers({ prompt: "that's wrong, it's already live" }).some((x) => x.id === 'slop-check'), 'a real correction still fires');
 });
 
+t('side-session events, cross-session messages and CI events never trigger the slop check (task 1005022)', () => {
+  const words = "It's already live, not true, actually it works, you said it was slop";
+  for (const notice of [
+    `<side-sessions-event>Session bug-x ended a turn: ${words}</side-sessions-event>`,
+    `<cross-session-message from="local_abc">${words}</cross-session-message>`,
+    `<teammate-message teammate_id="t1">${words}</teammate-message>`,
+    `<ci-monitor-event pr="12">${words}</ci-monitor-event>`,
+    `  \n<channel source="discord">${words}</channel>`,
+  ]) {
+    assert.ok(!conductor.evaluateTriggers({ prompt: notice }).some((x) => x.id === 'slop-check'), notice);
+  }
+  assert.ok(conductor.evaluateTriggers({ prompt: "<b>that's wrong</b>, it's already live" }).some((x) => x.id === 'slop-check'), 'a person typing a tag still gets checked');
+});
+
 t('ordinary prompts do not trigger the slop check', () => {
   for (const p of ['add a dark mode toggle', 'run the tests', 'what can I work on', 'make the button wider']) {
     assert.ok(!conductor.evaluateTriggers({ prompt: p }).some((x) => x.id === 'slop-check'), p);

package/tests/claim_finish_hint.mjs

@@ -0,0 +1,50 @@
+// tests/claim_finish_hint.mjs
+//
+// task 1005113 - claim card finish: the claim card's "When you finish" hint printed
+// `node scripts/bongos/ship.js N` everywhere. In a project that installs the core from npm
+// (toast), that path is not in the project — the CLI ships inside node_modules/@bongos/core
+// and runs as `npx bongos ship N`. finishHintLines() picks the command for where the core
+// is: a core checkout keeps the node path; an installed core gets the npx verbs.
+//
+// Run:  node tests/claim_finish_hint.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { finishHintLines } = require('../scripts/bongos/claim.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('installed core: ship + release hints use npx bongos, never a scripts/ path', () => {
+  const text = finishHintLines('1005113', { installed: true }).join('\n');
+  assert.match(text, /npx bongos ship 1005113 --notes "\.\.\." --summary "\.\.\."/);
+  assert.match(text, /npx bongos release 1005113/);
+  assert.doesNotMatch(text, /scripts\//);
+});
+
+t('core checkout: hints keep the node scripts/bongos path', () => {
+  const text = finishHintLines('42', { installed: false }).join('\n');
+  assert.match(text, /node scripts\/bongos\/ship\.js 42 --notes/);
+  assert.match(text, /node scripts\/bongos\/release\.js 42/);
+  assert.doesNotMatch(text, /scripts\/gds\//);
+});
+
+t('hint keeps its headings', () => {
+  const lines = finishHintLines('7', { installed: true });
+  assert.equal(lines[0], '\nWhen you finish:');
+  assert.ok(lines.includes('Or to abandon:'));
+});
+
+t('defaults to detecting the core here (this checkout is not installed)', () => {
+  const text = finishHintLines('9').join('\n');
+  assert.match(text, /node scripts\/bongos\/ship\.js 9/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/deploy_divergence_line.mjs

@@ -79,7 +79,11 @@ test('the line says who sees a merge, not a blanket rule in either direction', (
   const s = line(behind);
   assert.doesNotMatch(s, /deploys nothing/);
   assert.doesNotMatch(s, /redeploys from main|on every merge|within minutes/);
-  assert.match(s, /cloudbongos[.]com gets a merge only when a published core release carries it and its pin moves [(]owner-gated[)]/);
+  assert.match(s, /cloudbongos[.]com gets a merge only when a published core release carries it and its pin moves/);
+  // task 1005020: the hub's pin is NOT owner-gated for a patch release — its patch-channel
+  // subscription moved cloudbongos.com to core 1.24.12 with no person (task 1005015).
+  assert.doesNotMatch(s, /owner-gated[)]/, 'a patch move on the hub needs no person');
+  assert.match(s, /its patch-channel subscription moves that pin on its own/);
   assert.match(s, /hosted projects: only when a published core release carries the change and their pin moves/);
   assert.match(s, /Never call work live until that instance's \/version shows it/);
 });

package/tests/instance_config.mjs

@@ -2,6 +2,7 @@
 // Pure: every input is injected, so no env mutation / disk dependence.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import ic from '../src/instance-config.js';
@@ -108,7 +109,37 @@ test('resolveEnv: ONLY the old spelling set — resolves, and warns naming old,
   assert.equal(lines.length, 1);
   assert.match(lines[0], /CLOUDBONGOS_C3A_RENDER_PROBE/, 'names the old spelling');
   assert.match(lines[0], /BONGOS_C3A_RENDER_PROBE/, 'names the new spelling');
-  assert.match(lines[0], /stops being read in core 1\.21/, 'names the release it stops working in');
+  // Task 1005042 - legacy env warning: the line used to promise "stops being read
+  // in core 1.21" long after 1.21 passed with the spelling still read. Whatever it
+  // says about removal must be TRUE against the version actually running: it may
+  // name a future release, never the current one or a past one.
+  assert.deepEqual(stalePromisedReleases(lines[0], runningCore()), [],
+    `the warning names a removal release that is not in the future: ${lines[0]}`);
+  assert.match(lines[0], /still read/i, 'says plainly that the old spelling still works today');
+  assert.match(lines[0], /future core release/i, 'says it will go, without inventing a date nobody has committed to');
+});
+
+// Every "core X.Y" a line names that is NOT after the running release — i.e. a
+// removal promise that is already broken, since the running core still reads the
+// spelling. Empty = the line is honest about dates.
+function runningCore() {
+  const coreSrc = fs.readFileSync(new URL('../src/module-api.js', import.meta.url), 'utf8');
+  return coreSrc.match(/^const CORE_VERSION = '(\d+)\.(\d+)\.\d+'/m).slice(1).map(Number);
+}
+function stalePromisedReleases(line, [runMaj, runMin]) {
+  return [...line.matchAll(/core (\d+)\.(\d+)/g)]
+    .map((m) => [Number(m[1]), Number(m[2])])
+    .filter(([maj, min]) => !(maj > runMaj || (maj === runMaj && min > runMin)))
+    .map(([maj, min]) => `${maj}.${min}`);
+}
+
+test('stalePromisedReleases: catches the passed-release warning task 1005042 fixed, accepts a future one', () => {
+  const old = '[bongos] deprecated env CLOUDBONGOS_X — rename it to BONGOS_X. The legacy spelling stops being read in core 1.21.';
+  assert.deepEqual(stalePromisedReleases(old, [1, 24]), ['1.21'], 'the original line names a release already passed');
+  assert.deepEqual(stalePromisedReleases('stops being read in core 1.24.', [1, 24]), ['1.24'], 'the running release is not a future one');
+  assert.deepEqual(stalePromisedReleases('stops being read in core 1.25.', [1, 24]), [], 'a genuinely future release is honest');
+  assert.deepEqual(stalePromisedReleases('stops being read in core 2.0.', [1, 24]), [], 'a future major is honest');
+  assert.ok(runningCore()[0] >= 1, 'CORE_VERSION is readable from src/module-api.js');
 });
 
 test('resolveEnv: ONLY the new spelling set — resolves, and is SILENT', () => {

package/tests/shell_hooks.mjs

@@ -165,6 +165,13 @@ t('a missing hook is visible (exit 1, one line) and never blocks; the others sti
   assert.match(r.stderr, /no-such-hook\.js/);
   const b = together(['no-such-hook.js', 'git-guard.js'], shell('Bash', 'git stash push -m x'));
   assert.equal(b.status, 2, 'a real block still blocks beside a missing hook');
+  assert.match(b.stderr, /no-such-hook\.js/, 'the missing-hook line survives the block (task 1004949)');
+  assert.match(b.stderr, /git-guard: blocked/, 'and the block reason is still there');
+});
+
+t('merge: a code-1 diagnostic is joined into the block stderr, in roster order (task 1004949)', () => {
+  const m = dispatcher.merge([{ code: 1, stderr: 'missing\n' }, { code: 2, stderr: 'blocked\n' }, { code: 0, stdout: '' }]);
+  assert.deepEqual(m, { code: 2, stdout: '', stderr: 'missing\nblocked\n' });
 });
 
 t('only plain sibling names load — no paths, not itself', () => {

package/tests/status_mirror_sync.mjs

@@ -8,7 +8,7 @@
 // exited 2. The `require.main === module` guard is what makes the transform testable.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import mirror from '../scripts/status-mirror-sync.js';
 
 const { buildMirrorIndex, injectOnce, brandTokens } = mirror;
@@ -120,3 +120,24 @@ test('the publisher source hardcodes no host identity (the ratchet this slice in
   const hit = stripped.match(/example|example-owner|example world/i);
   assert.equal(hit, null, `scripts/status-mirror-sync.js hardcodes the host identity "${hit && hit[0]}" — resolve it from branding() instead`);
 });
+
+test('no doc claims a sync workflow runs the mirror publish while none exists (task 1005131)', () => {
+  // The publish is run by hand: nothing in .github/workflows/ calls this script. A doc
+  // saying "synced by sync-status-mirror.yml" (or calling the sync CI-driven) sends the
+  // reader waiting for an automatic update that never comes, so the live page goes stale.
+  const wfDir = new URL('../.github/workflows/', import.meta.url);
+  const workflows = readdirSync(wfDir).map((f) => readFileSync(new URL(f, wfDir), 'utf8'));
+  const automated = workflows.some((w) => /status-mirror-sync\.js/.test(w));
+  if (automated) return; // a real workflow now runs it — the claim would be true
+  const docs = [
+    'scripts/status-mirror-sync.js',
+    'docs/adr/0029-status-page-outage-resilience.md',
+    'docs/architecture.md',
+    'docs/recipes/ops-gotchas.md',
+  ];
+  for (const rel of docs) {
+    const text = readFileSync(new URL(`../${rel}`, import.meta.url), 'utf8');
+    const hit = text.match(/synced by[^\n]{0,40}sync-status-mirror\.yml|(?<!NOT )CI-driven/i);
+    assert.equal(hit, null, `${rel} claims an automatic mirror sync ("${hit && hit[0]}"), but no workflow runs scripts/status-mirror-sync.js`);
+  }
+});