@bongos/core 1.18.3 → 1.18.18

package/modules/lifecycle/db.js

@@ -34,6 +34,15 @@ const { pool, withTx, insertAuditLog, LIVE_RANK_LADDER } = api;
 // so the module reaches the `reward`/`onboarding` ports + emits kernel events
 // (task.shipped, builder.box-reconcile-needed) without importing core.
 const seams = api;
+// Sibling read-model helper (task 1002164) — the shared pending-review predicate.
+// done-when.js imports only src/module-api, so this stays acyclic.
+const doneWhen = require('./done-when.js');
+// The catch-all goal title, shared with the orphan advisory (task 1002539) so the
+// SQL below and the detector that names the same goal cannot drift apart.
+const { generalGoalTitle } = require('./goal-advisory.js');
+// BV1.R106 (ADR 0151): the permission-expressed QUEUE axis of claim eligibility.
+// Kept deliberately separate from the per-task requires_rank floor below.
+const { claimEligibilityAllows } = require('./claim-eligibility.js');
 // Pure kernel-adjacent matchers via the doorway (never the core file).
 const { matchProtected } = api.permissionPathCheck;
 const { touchesOverlap } = api.pathMatch;
@@ -164,11 +173,46 @@ const GENERAL_QUEUE_RANKS = new Set(['thetes', 'metic', 'archon']);
 // Pure + exported so tests/rank_gate.mjs can exercise it without a DB; claimTask
 // + claimTasksBatch both call it (composed with rankAllowsTask).
 
+// BV1.R106 (ADR 0151): this rank rule is no longer the primary gate — the claim
+// paths decide the queue axis on the PERMISSIONS `task.claim.any` /
+// `task.claim.newcomer` (claim-eligibility.js) and keep this as the fallback for a
+// builder whose role row the run-once compat backfill never created. It stays
+// exported: tests/rank_gate.mjs pins it, and it is the oracle the parity test in
+// tests/governance_claim_eligibility.mjs compares the permission predicate against.
+
 function xenosClaimAllowed(rank, newcomerFriendly) {
   if (GENERAL_QUEUE_RANKS.has(rank)) return true;
   return newcomerFriendly === true;
 }
 
+// claimPermissionsFor — the builder's effective permission set for the claim
+// decision, read through the `governance` kernel PORT (never by importing the
+// module — the one-way rule, ADR 0083). Returns a Set, or NULL when authority
+// cannot be ESTABLISHED, which claimEligibilityAllows reads as "fall back to the
+// incumbent rank rule":
+//   • the governance module is not mounted (no port), or the resolver throws;
+//   • the builder resolves to ZERO permissions — i.e. they hold no role row.
+//     governance_002's backfill is run-once and nothing yet re-assigns a rank-role
+//     when a builder is created or re-ranked, so this is a live gap, not a theory.
+// Every seeded rank-role grants at least twelve permissions, so an empty set never
+// means "a real role that grants nothing" today.
+//
+// Called BEFORE the claim transaction opens: authority is a per-request read (ADR
+// 0016 — resolved server-side, uncached), and taking a second pool connection while
+// a tx holds FOR UPDATE locks is a needless deadlock/exhaustion hazard.
+async function claimPermissionsFor(builderId) {
+  const governance = seams.resolveOptional('governance');
+  if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
+  try {
+    const keys = await governance.resolveBuilderPermissions(builderId);
+    if (!keys || keys.length === 0) return null;
+    return new Set(keys);
+  } catch (err) {
+    console.error('[gds] claim eligibility: permission resolve failed, falling back to the rank rule', err);
+    return null;
+  }
+}
+
 // V3.R82 (#301): the INVERSE of newcomer_friendly. Some tasks raise the floor
 // instead of opening the door — `requires_rank` is a per-task MINIMUM rank
 // that a builder must meet to claim. Default 'xenos' means "no extra gate"
@@ -318,6 +362,24 @@ function disambiguateWorktreeName(desired, taken) {
 //
 // Returns the updated builder row, or throws { code:'BUILDER_NOT_FOUND' } /
 // { code:'RANK_UNCHANGED' }.
+// syncGovernanceRankRole — keep governance_builder_roles in step with builders.rank
+// (BV1.R95b, ADR 0151). This module's rank writer backs the automatic xenos→thetes
+// graduation, which had the same hole as the Archon-driven path: the rank moved and
+// the role did not, so a freshly-graduated Thetes kept the xenos role.
+//
+// Resolved through the `governance.roleSync` kernel port (never a sibling require —
+// ADR 0083) and run on the CALLER's transaction client, so the rotation commits
+// atomically with the ship + graduation. A missing port (governance disabled) skips:
+// no role ⇒ zero permissions, fail-closed.
+//
+// TWINNED with src/bongos/db.js (the boundary-forced _applyRankChangeTx duplication,
+// ADR 0091 §2) — keep the two in sync.
+async function syncGovernanceRankRole(client, builderId, rank) {
+  const roleSync = seams.resolveOptional('governance.roleSync');
+  if (!roleSync || typeof roleSync.syncRankRole !== 'function') return null;
+  return roleSync.syncRankRole(client, { builderId, rank });
+}
+
 // _applyRankChangeTx — the in-transaction CORE of a rank change, shared by the
 // Archon-driven setBuilderRank and the automatic xenos→thetes graduation in the
 // confirm paths (#692 / ADR 0034). Runs inside the CALLER's transaction/client
@@ -326,7 +388,6 @@ function disambiguateWorktreeName(desired, taken) {
 // — on demotion — revokes live sessions so a stale token can't replay old
 // authority. Returns the audit shape (incl. the builder's `status`, so the
 // caller can fire the post-commit box reconcile on its OWN connection).
-
 async function _applyRankChangeTx(client, { builderId, newRank, actorBuilderId, reasonNote = null, enforceSingleRungPromotion = false }) {
   const { rows } = await client.query(
     `SELECT id, rank, status FROM builders WHERE id = $1 FOR UPDATE`,
@@ -351,6 +412,12 @@ async function _applyRankChangeTx(client, { builderId, newRank, actorBuilderId,
     [builderId, newRank]
   );
 
+  // BV1.R95b — rotate the seeded rank-role IN THIS TRANSACTION (removing the old one,
+  // not merely adding the new). Not try/catch-wrapped: a failure must roll the rank
+  // change back rather than leave rank and role disagreeing. See the twin in
+  // src/bongos/db.js.
+  await syncGovernanceRankRole(client, builderId, newRank);
+
   // V3.R28 / #249 — ceremony delta. Promotion (moving UP the ladder = lower
   // index in RANKS) earns +5; demotion is audit-only (0).
   const oldIdx = RANKS.indexOf(oldRank);
@@ -623,15 +690,20 @@ async function getGoalDependencies(goalId, deps = {}) {
 // by the owner's WITHIN-version priority (sort_order, task 1760), falling back
 // to created_at/id so a fresh instance and prod agree on row order pre-reorder.
 
-async function listGoals({ versionId = null, status = null } = {}, deps = {}) {
+// `limit` is optional and defaults to unbounded — the goal board reads every goal.
+// A caller that only needs the first N (the orphan advisory wants 5 candidates)
+// passes it so Postgres does the truncating instead of shipping the whole version's
+// goals to be discarded in JS (task 1002539).
+async function listGoals({ versionId = null, status = null, limit = null } = {}, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `SELECT ${GOAL_COLS}
        FROM goals
       WHERE ($1::text IS NULL OR version_id = $1)
         AND ($2::text IS NULL OR status = $2)
-      ORDER BY version_id, sort_order, created_at, id`,
-    [versionId, status]
+      ORDER BY version_id, sort_order, created_at, id
+      LIMIT $3::int`,
+    [versionId, status, limit]
   );
   return rows;
 }
@@ -779,14 +851,44 @@ async function listGoalMembers(goalId, deps = {}) {
 
 async function listCriteriaForGoal(goalId, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  // task 1002164: carry the linked-task counts so the caller can derive the
+  // "met — pending review" state the hall renders. The counts are aggregated
+  // ONCE, over only this goal's criteria (the `counts` CTE narrows on the `crit`
+  // CTE before grouping), rather than per-row correlated subqueries — one pass
+  // over the idx_task_criteria_criterion range instead of 2N lookups. The
+  // criterion columns are still listed explicitly so the projection this read
+  // already feeds (the version-criteria view, the task-create suggester) is
+  // unchanged apart from the two additive count columns.
   const { rows } = await activePool.query(
-    `SELECT id, version_id, criterion_id, criterion_md, satisfied, sort_order, goal_id
-       FROM done_when_criteria
-      WHERE goal_id = $1
+    `WITH crit AS (
+       SELECT id, version_id, criterion_id, criterion_md, satisfied, sort_order, goal_id
+         FROM done_when_criteria
+        WHERE goal_id = $1
+     ),
+     counts AS (
+       SELECT tc.criterion_id,
+              count(*)::int                                        AS linked_tasks,
+              count(*) FILTER (WHERE t.status <> 'shipped')::int    AS unshipped_tasks
+         FROM task_criteria tc
+         JOIN tasks t ON t.id = tc.task_id
+        WHERE tc.criterion_id IN (SELECT id FROM crit)
+        GROUP BY tc.criterion_id
+     )
+     SELECT c.id, c.version_id, c.criterion_id, c.criterion_md, c.satisfied,
+            c.sort_order, c.goal_id,
+            COALESCE(n.linked_tasks, 0)    AS linked_tasks,
+            COALESCE(n.unshipped_tasks, 0) AS unshipped_tasks
+       FROM crit c
+       LEFT JOIN counts n ON n.criterion_id = c.id
       ORDER BY sort_order, id`,
     [goalId]
   );
-  return rows;
+  return rows.map((r) => ({
+    ...r,
+    pending_review: doneWhen.isPendingReview({
+      satisfied: r.satisfied, linked: r.linked_tasks, unshipped: r.unshipped_tasks,
+    }),
+  }));
 }
 
 // isGoalMember — is this builder a member of this goal? The membership predicate
@@ -1179,14 +1281,15 @@ async function listPendingRequestsForGoal(goalId, deps = {}) {
 // holds for every create-vector. Returns the goal id, or null when the version has
 // no general goal (then the caller leaves goal_id NULL rather than failing a
 // create). Honors the #538 deps.pool test seam (NODE_ENV==='test') so it is
-// unit-testable DB-free. The title match mirrors migration 160's insert exactly
-// (v.id || ' — general', a spaced em-dash) — keep the two in sync.
+// unit-testable DB-free. The title mirrors migration 160's insert exactly (a spaced
+// em-dash); it is built by ../goal-advisory.generalGoalTitle so this SQL and the
+// advisory that detects the same goal can never disagree (task 1002539).
 async function generalGoalIdForVersion(versionId, deps = {}) {
   if (versionId == null) return null;
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `SELECT id FROM goals WHERE version_id = $1 AND title = $1 || ' — general' LIMIT 1`,
-    [versionId]
+    'SELECT id FROM goals WHERE version_id = $1 AND title = $2 LIMIT 1',
+    [versionId, generalGoalTitle(versionId)]
   );
   return rows[0] ? rows[0].id : null;
 }
@@ -1575,22 +1678,28 @@ async function updateTaskModuleKey(id, moduleKey) { return updateTaskColumn(id,
 
 // task 1957: credits_awarded is the ACTUAL drachmae paid out for completing a
 // task — the sum of the TASK-REWARD credit_log deltas booked against it: the
-// confirm credit ('task.confirmed', = credits_reward × kind-multiplier), the
-// idea-promotion bonus, and the net-negative (simplification) bonus, across all
-// builders. The reason allowlist is deliberate: achievement unlocks
-// ('achievement.*') also carry the shipped task's id but are GAMIFICATION, not a
-// reward for the task, so they must NOT inflate the payout (session.token_reward
-// and rank_change carry task_id=NULL and are excluded already). The CASE guard
-// short-circuits to 0 for unsettled tasks so the hot board/claimable list never
-// scans credit_log (credits don't land until 'confirmed' anyway) — the UI shows
-// credits_reward (the creation-time ESTIMATE) with an "Est." label until then,
-// and this real ledger figure once confirmed/shipped. Read-only; no schema change.
+// per-task credit (= credits_reward × kind-multiplier), the idea-promotion
+// bonus, and the net-negative (simplification) bonus, across all builders. The
+// reason allowlist is deliberate: achievement unlocks ('achievement.*') also
+// carry the shipped task's id but are GAMIFICATION, not a reward for the task,
+// so they must NOT inflate the payout (session.token_reward and rank_change
+// carry task_id=NULL and are excluded already).
+//
+// ADR 0120 "pay on land": the per-task credit reason is now 'task.shipped'
+// (booked at the confirmed→shipped flip) instead of 'task.confirmed' (booked at
+// confirm). BOTH strings are allow-listed: historical tasks confirmed under the
+// old rule carry 'task.confirmed' rows, new landings carry 'task.shipped', and
+// the one-time clawback reverses the old 'task.confirmed' deltas (a negative
+// row nets them to 0) — so summing both is correct across the transition. The
+// CASE still short-circuits to 0 for unsettled tasks; note a 'confirmed' task
+// now shows 0 until it LANDS (the credit no longer exists at confirm) — the UI
+// renders the "Est." label until the 'task.shipped' row books at land.
 const CREDITS_AWARDED_SUBQUERY =
   `CASE WHEN t.status IN ('confirmed', 'shipped')
         THEN (SELECT COALESCE(SUM(cl.delta), 0)::int
                 FROM credit_log cl
                WHERE cl.task_id = t.id
-                 AND cl.reason IN ('task.confirmed', 'idea_promotion_bonus', 'ship.net_negative'))
+                 AND cl.reason IN ('task.confirmed', 'task.shipped', 'idea_promotion_bonus', 'ship.net_negative'))
         ELSE 0 END`;
 
 async function getTask(id) {
@@ -1975,6 +2084,54 @@ async function getTaskDependents(taskId) {
   return getTaskDepEdges(taskId, { reverse: true });
 }
 
+// attachTaskDepSummaries (hall redesign task 1002439) — enrich an already-fetched
+// task list with the two dependency numbers the Goals rollup + Tasks dependency
+// view need, WITHOUT an N+1 (two aggregate queries over the whole id set, not one
+// per task). For each task:
+//   blocked_by[] — the tasks THIS task waits on ({id,title,status,goal_id,satisfied}),
+//                  where satisfied === (target.status === 'shipped'), matching the
+//                  claim gate's DEPS_NOT_SHIPPED rule (ADR 0015). A `backlog` task
+//                  with any unsatisfied entry is what the UI paints "blocked".
+//   blocks         — how many tasks are waiting on THIS one (reverse edge count) —
+//                    the "clearing this unblocks N" signal.
+// task->task edges only (from_kind/to_kind='task'), same filter as getTaskDepEdges.
+// Mutates + returns the passed array so callers can `await db.attachTaskDepSummaries(tasks)`.
+async function attachTaskDepSummaries(tasks) {
+  if (!Array.isArray(tasks) || tasks.length === 0) return tasks;
+  const ids = tasks.map((t) => Number(t.id)).filter(Number.isFinite);
+  if (ids.length === 0) return tasks;
+  const [fwd, rev] = await Promise.all([
+    pool.query(
+      `SELECT d.from_id AS task_id,
+              json_agg(json_build_object(
+                'id', t2.id, 'title', t2.title, 'status', t2.status,
+                'goal_id', t2.goal_id, 'satisfied', (t2.status = 'shipped')
+              ) ORDER BY t2.id) AS blocked_by
+         FROM dependencies d
+         JOIN tasks t2 ON t2.id = d.to_id
+        WHERE d.from_kind = 'task' AND d.to_kind = 'task'
+          AND d.from_id = ANY($1::bigint[])
+        GROUP BY d.from_id`,
+      [ids]
+    ),
+    pool.query(
+      `SELECT d.to_id AS task_id, count(*)::int AS blocks
+         FROM dependencies d
+        WHERE d.from_kind = 'task' AND d.to_kind = 'task'
+          AND d.to_id = ANY($1::bigint[])
+        GROUP BY d.to_id`,
+      [ids]
+    ),
+  ]);
+  const blockedBy = new Map(fwd.rows.map((r) => [String(r.task_id), r.blocked_by]));
+  const blocks = new Map(rev.rows.map((r) => [String(r.task_id), r.blocks]));
+  for (const t of tasks) {
+    t.blocked_by = blockedBy.get(String(t.id)) || [];
+    t.blocks = blocks.get(String(t.id)) || 0;
+  }
+  return tasks;
+}
+
 // Generic cycle check over the polymorphic graph. Adding edge (from -> to) creates
 // a cycle iff `from` is already reachable FROM `to` along existing edges, so we seed
 // the walk at `to` and look for `from`. Nodes are (kind, id) pairs tokenized as
@@ -2323,6 +2480,7 @@ async function unsatisfiedDeps(taskId, client = pool) {
 // give a useful error rather than a generic constraint failure).
 
 async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSessionId, enforceOverlap = false }) {
+  const heldPermissions = await claimPermissionsFor(builderId); // BV1.R106 — before the tx opens
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
@@ -2339,6 +2497,23 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     }
     const builderRank = builderRows[0] ? builderRows[0].rank : null;
 
+    // ADR 0120 part 3: the needs_rebase claim gate. A builder who owes a rebase
+    // on any un-landed confirmed task (flagged by the reconciler, part 2) is
+    // blocked from taking on NEW work until they LAND it (rebase the branch +
+    // re-ship → reconciler) or RELEASE it — both clear the flag. Their
+    // already-active claims are untouched (we only refuse fresh claims, never
+    // freeze in-flight work). Since the reward now lands only on ship (part 1),
+    // the builder is motivated to clear it; since it gates their queue, they
+    // can't walk away from it. Runs in THIS txn so it can't race a concurrent
+    // ship that clears the last flag.
+    const owedRebases = await needsRebaseTasksForBuilder(builderId, client);
+    if (owedRebases.length > 0) {
+      throw {
+        code: 'REBASE_REQUIRED',
+        rebaseTasks: owedRebases.map((t) => ({ id: t.id, title: t.title, reason: t.needs_rebase_reason })),
+      };
+    }
+
     const { rows: taskRows } = await client.query(
       `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind FROM tasks WHERE id = $1 FOR UPDATE`,
       [taskId]
@@ -2358,8 +2533,10 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // only explicitly-tagged-open tasks" — markdown describes it, this check
     // enforces it. Error code is rank_too_low_for_task (V3.R15); XENOS_RESTRICTED
     // is kept as an alias on the error object for callers on the pre-rename
-    // release.
-    if (!xenosClaimAllowed(builderRank, task.newcomer_friendly)) {
+    // release. BV1.R106 (ADR 0151): same rule, now decided on the PERMISSIONS
+    // task.claim.any / task.claim.newcomer — see ./claim-eligibility.js.
+    const newcomerFriendly = task.newcomer_friendly;
+    if (!claimEligibilityAllows({ heldPermissions, newcomerFriendly, rankRuleAllows: xenosClaimAllowed(builderRank, newcomerFriendly) })) {
       throw { code: 'rank_too_low_for_task', legacy_code: 'XENOS_RESTRICTED' };
     }
 
@@ -2577,6 +2754,8 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
   // sharing any rows can't deadlock by locking in opposite orders.
   uniqIds.sort((a, b) => a - b);
 
+  // BV1.R106: resolved BEFORE the tx opens — see claimPermissionsFor.
+  const heldPermissions = await claimPermissionsFor(builderId);
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
@@ -2620,9 +2799,20 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
     // Mirrors the single claimTask gate so the batch path can't be used to
     // sidestep the sandbox. Failure reason carries both names — the new
     // canonical code and the legacy alias — so callers on either release work.
+    //
+    // BV1.R106 (ADR 0151): the inner decision now reads the PERMISSION atoms, as
+    // in claimTask. The outer `builderRank === 'xenos'` short-circuit is LEFT AS
+    // IS: it is not a fast path but a semantic one (a reserved/unwired rank is
+    // never checked here, while claimTask checks every rank), so removing it would
+    // change who can batch-claim. That pre-existing asymmetry is reported, not
+    // fixed, under this task — closing it is an authority decision of its own.
     if (builderRank === 'xenos') {
       for (const t of taskRows) {
-        if (!xenosClaimAllowed(builderRank, t.newcomer_friendly)) {
+        if (!claimEligibilityAllows({
+          heldPermissions,
+          newcomerFriendly: t.newcomer_friendly,
+          rankRuleAllows: xenosClaimAllowed(builderRank, t.newcomer_friendly),
+        })) {
           failures.push({ task_id: t.id, reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
         }
       }
@@ -2858,7 +3048,13 @@ async function releaseClaimsBatch({ claimIds, builderId, resolverSessionId, forc
         [claimId]
       );
       await client.query(
-        `UPDATE tasks SET status = 'ready', updated_at = now() WHERE id = $1`,
+        // ADR 0120 part 2: releasing a task frees it from the builder's queue,
+        // so clear any needs_rebase flag — the rebase is no longer their chore
+        // (this is the "release to unblock" exit the ADR guarantees).
+        `UPDATE tasks
+            SET status = 'ready', needs_rebase = false, needs_rebase_reason = NULL,
+                needs_rebase_at = NULL, updated_at = now()
+          WHERE id = $1`,
         [claim.task_id]
       );
       await sealSessionLog(client, {
@@ -2923,12 +3119,21 @@ async function validateClaimBatch({ taskIds, builderId }) {
   const reasonsById = new Map(uniqIds.map((id) => [id, []]));
   const push = (id, reason) => reasonsById.get(id).push(reason);
 
+  // BV1.R106: same permission-expressed queue gate as claimTasksBatch (including
+  // its `builderRank === 'xenos'` short-circuit), resolved once for the whole set
+  // — authority is per-request, not per-row.
+  const heldPermissions = await claimPermissionsFor(builderId);
+
   for (const id of uniqIds) {
     if (builderInactive) push(id, { reason: 'BUILDER_INACTIVE' });
     const t = byId.get(id);
     if (!t) { push(id, { reason: 'TASK_NOT_FOUND' }); continue; }
     if (t.status !== 'ready') push(id, { reason: 'TASK_NOT_READY', currentStatus: t.status });
-    if (builderRank === 'xenos' && !xenosClaimAllowed(builderRank, t.newcomer_friendly)) {
+    if (builderRank === 'xenos' && !claimEligibilityAllows({
+      heldPermissions,
+      newcomerFriendly: t.newcomer_friendly,
+      rankRuleAllows: xenosClaimAllowed(builderRank, t.newcomer_friendly),
+    })) {
       push(id, { reason: 'rank_too_low_for_task', legacy_reason: 'XENOS_RESTRICTED' });
     }
     if (!rankAllowsTask(builderRank, t.requires_rank)) {
@@ -3002,7 +3207,8 @@ async function validateClaimBatch({ taskIds, builderId }) {
 // Resolve a claim. Three-state task lifecycle:
 //   active → completed         (builder declared done; awaiting grader)
 //   active → completed → confirmed   (promoted by applyGrade when the subagent
-//                                      grader passes; credits land at confirmed)
+//                                      grader passes; verified but NOT yet paid —
+//                                      ADR 0120 books credits at ship, not confirm)
 //   active → ready             (abandoned or partial — back to the queue)
 //
 // Caller passes `verification` = { passed: bool, scanner_clean, smoke_clean,
@@ -3168,8 +3374,9 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
 }
 
 // Final transition: confirmed → shipped. Called by /merge-mode (or auto-merge
-// in /builder-ship) once the branch is on main + deployed. No credit
-// implication — credits already landed at confirmed. Sets shipped_at.
+// in /builder-ship) once the branch is on main + deployed. THIS is the credit
+// moment — ADR 0120 pays on land, so awardLandingCredit books the reward here
+// (credit_log.reason = 'task.shipped'), not at confirm. Sets shipped_at.
 //
 // V3.R14 (#238): also stamps builders.first_ship_at the first time this
 // builder ever crosses the ship threshold. COALESCE makes the write
@@ -3177,20 +3384,104 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
 // the same transaction so a roster query that joins both tables sees a
 // consistent view.
 
+// awardLandingCredit — the per-task reward, booked at the SHIPPED transition
+// (ADR 0120 "pay on land"). Moved out of the three confirm paths (confirmTask /
+// decideOverrideRequest / applyGrade): the per-task credit + idea-promotion
+// bonus now exist ONLY once the code is merged to `main`, so a task that
+// strands at 'confirmed' pays nothing. Idempotent on (task_id,
+// reason='task.shipped') — mirrors the old (task_id, 'task.confirmed') guard —
+// so a re-ship or a reconciler re-sweep is a true no-op. The reason is
+// deliberately 'task.shipped' (not 'task.confirmed'): after the one-time
+// clawback (ADR 0120 part 4) reverses a stranded task's OLD 'task.confirmed'
+// row, re-landing books a FRESH 'task.shipped' row — the reward is fully
+// re-earnable, exactly as the ADR promises. Caller passes its ship txn client
+// so the credit commits atomically with the status flip.
+async function awardLandingCredit(client, { taskId, creditedBuilderId, creditsReward, kind }) {
+  const reward = seams.resolveOptional('reward');
+  if (!reward || creditedBuilderId == null || !(Number(creditsReward) > 0)) {
+    return { creditsAwarded: 0, ideaBonus: null };
+  }
+  const { rows: existing } = await client.query(
+    `SELECT 1 FROM credit_log WHERE task_id = $1 AND reason = 'task.shipped' LIMIT 1`,
+    [taskId]
+  );
+  if (existing.length > 0) return { creditsAwarded: 0, ideaBonus: null };
+  const credit = await reward.insertMultipliedConfirmCredit(
+    client, creditedBuilderId, taskId, creditsReward, kind, 'task.shipped'
+  );
+  const ideaBonus = await reward.maybeAwardIdeaPromotionBonus(
+    client, taskId, creditedBuilderId, credit.creditsAwarded
+  );
+  return {
+    creditsAwarded: credit.creditsAwarded,
+    creditsRaw: credit.raw,
+    creditsMultiplier: credit.multiplier,
+    ideaBonus,
+  };
+}
+
+// flagTaskNeedsRebase — ADR 0120 part 2. The publish-reconciler calls this when
+// a confirmed task's land cannot be completed after the auto-land grace (its
+// retries + the ADR 0082 generated-file self-heal): a persistently-red PR that
+// hit the regen-heal cap, or a strand older than the stale threshold that can't
+// be proven landed (never pushed / no recorded tip). It is a SIGNAL, not a
+// status change — the task stays 'confirmed'; it is simply marked as awaiting
+// its BUILDER's rebase (attribution via tasks.shipped_by = claim holder).
+//
+// Idempotent + self-limiting: only a still-'confirmed', not-already-flagged task
+// is touched (WHERE status='confirmed' AND needs_rebase=false), so a task that
+// has since shipped or been released is never (re-)flagged, and a re-sweep of an
+// already-flagged task is a no-op. Returns true iff this call newly flagged it
+// (so the reconciler logs the transition once). needs_rebase_at is set once
+// (COALESCE) so the hall/CLI can show how long it has been outstanding.
+async function flagTaskNeedsRebase(taskId, reason = null) {
+  const { rows } = await pool.query(
+    `UPDATE tasks
+        SET needs_rebase = true,
+            needs_rebase_reason = $2,
+            needs_rebase_at = COALESCE(needs_rebase_at, now()),
+            updated_at = now()
+      WHERE id = $1 AND status = 'confirmed' AND needs_rebase = false
+      RETURNING id`,
+    [taskId, reason]
+  );
+  return rows.length > 0;
+}
+
+// needsRebaseTasksForBuilder — the confirmed tasks a builder owes a rebase on
+// (ADR 0120 parts 2-3). Attribution is tasks.shipped_by (= the claim holder,
+// COALESCE'd there at confirm). Used by the claim gate (part 3) to refuse NEW
+// claims and by the hall/CLI surfacing (part 5). Accepts an optional client so
+// it can run inside claimTask's FOR UPDATE txn or standalone on the pool.
+// Ordered oldest-flagged first so the surfacing can show the longest-outstanding.
+async function needsRebaseTasksForBuilder(builderId, client = pool) {
+  const { rows } = await client.query(
+    `SELECT id, title, needs_rebase_reason, needs_rebase_at
+       FROM tasks
+      WHERE needs_rebase = true AND status = 'confirmed' AND shipped_by = $1
+      ORDER BY needs_rebase_at ASC NULLS LAST, id ASC`,
+    [builderId]
+  );
+  return rows;
+}
+
 async function shipTask({ taskId, builderId }, deps = {}) {
   // #538 test seam (mirrors confirmTask): a caller-supplied pool is honored ONLY
   // under NODE_ENV==='test', so a regression test can drive the txn with a
   // SQL-aware fakeClient. Production callers omit deps → module pool.
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
-  const { shipRow, graduationBuilder, rankGraduation, actualShipperId, closedClaimCount } = await withTx(async (client) => {
+  const { shipRow, graduationBuilder, rankGraduation, actualShipperId, closedClaimCount, creditedBuilderId, creditsAwarded, ideaBonus, justUnlocked } = await withTx(async (client) => {
     const { rows } = await client.query(
       `UPDATE tasks
           SET status = 'shipped',
               shipped_at = now(),
               shipped_by = COALESCE(shipped_by, $2),
+              needs_rebase = false,
+              needs_rebase_reason = NULL,
+              needs_rebase_at = NULL,
               updated_at = now()
         WHERE id = $1 AND status = 'confirmed'
-        RETURNING id, title, status, shipped_at, shipped_by, security_sensitive, value_summary`,
+        RETURNING id, title, status, shipped_at, shipped_by, security_sensitive, value_summary, credits_reward, kind`,
       [taskId, builderId]
     );
     if (rows.length === 0) {
@@ -3277,7 +3568,47 @@ async function shipTask({ taskId, builderId }, deps = {}) {
     // xenos→thetes atomically with this ship. Rank-guarded + idempotent.
     const rankGraduation = await maybeAutoGraduateToThetes(client, actualShipperId);
 
-    return { shipRow: rows[0], graduationBuilder, rankGraduation, actualShipperId, closedClaimCount: closedClaims.length };
+    // ADR 0120 "pay on land": the per-task credit + idea-promotion bonus are
+    // booked HERE, at the confirmed→shipped flip — no longer at confirm. The
+    // credit only exists once the code is on `main`; a task that strands at
+    // 'confirmed' (never lands) now pays nothing. Attribution is the CLAIM
+    // HOLDER (the builder who did the work), computed the same way as
+    // confirmTask — never the caller who happened to trigger the ship (the
+    // reconciler / a supervisor). mostRecentClaimHolderId reads the latest
+    // claim by claimed_at regardless of released_at, so it is correct even
+    // though the claims for this task were just closed above. Idempotent on
+    // (task_id, reason='task.shipped'), so a re-ship / reconciler re-sweep is a
+    // true no-op. Runs in THIS txn so the credit commits atomically with the
+    // status flip.
+    const creditedBuilderId = (await mostRecentClaimHolderId(client, taskId)) ?? actualShipperId;
+    const landing = await awardLandingCredit(client, {
+      taskId,
+      creditedBuilderId,
+      creditsReward: rows[0].credits_reward,
+      kind: rows[0].kind,
+    });
+    // task 1679 pattern: state-based achievement reconcile now that the credit
+    // (above) + the ship count are reflected in this txn. SAVEPOINT-wrapped so
+    // a gamification error can never fail the ship. Moved to ship because the
+    // credit it keys off (breaking-the-100c-bar etc.) now lands here.
+    let justUnlocked = [];
+    const rewardPort = seams.resolveOptional('reward');
+    if (rewardPort && rewardPort.reconcileBuilderAchievements && creditedBuilderId != null) {
+      await client.query('SAVEPOINT ach_reconcile_ship');
+      try {
+        justUnlocked = await rewardPort.reconcileBuilderAchievements(client, creditedBuilderId, { taskId });
+        await client.query('RELEASE SAVEPOINT ach_reconcile_ship');
+      } catch (_) {
+        await client.query('ROLLBACK TO SAVEPOINT ach_reconcile_ship');
+        justUnlocked = [];
+      }
+    }
+
+    return {
+      shipRow: rows[0], graduationBuilder, rankGraduation, actualShipperId,
+      closedClaimCount: closedClaims.length,
+      creditedBuilderId, creditsAwarded: landing.creditsAwarded, ideaBonus: landing.ideaBonus, justUnlocked,
+    };
   }, { pool: activePool });
   if (closedClaimCount > 0) {
     // Post-commit observability: a normal ship closes 0 here (resolveClaim
@@ -3297,7 +3628,14 @@ async function shipTask({ taskId, builderId }, deps = {}) {
       builderId: actualShipperId, rank: 'thetes', status: rankGraduation.status, actor: 'auto-graduation:#692',
     }).catch(() => {});
   }
-  return { ...shipRow, graduatedTo: rankGraduation ? 'thetes' : null };
+  return {
+    ...shipRow,
+    graduatedTo: rankGraduation ? 'thetes' : null,
+    // ADR 0120: the per-task reward that landed on THIS ship (0 on a re-ship /
+    // reconciler re-sweep — idempotent). The ship route surfaces it so the
+    // builder sees "credits landed" at ship, not at confirm.
+    creditedBuilderId, creditsAwarded, ideaBonus, justUnlocked,
+  };
 }
 
 // task 1134 — feed for the server-owned publish reconciler (src/bongos/
@@ -3544,6 +3882,9 @@ async function releaseClaimOnBehalf({ claimId, archonId, archonLogin, reason })
     await client.query(
       `UPDATE tasks
           SET status = 'ready',
+              needs_rebase = false,
+              needs_rebase_reason = NULL,
+              needs_rebase_at = NULL,
               updated_at = now()
         WHERE id = $1`,
       [taskId]
@@ -3610,25 +3951,16 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
     // without economy, so every use is guarded (degrades to a best-effort no-op).
     const reward = seams.resolveOptional('reward');
 
-    // Award credits if not already in credit_log for this task. V3.R27 (#247)
-    // routes the insert through insertMultipliedConfirmCredit so the kind
-    // multiplier and self-describing description apply to manual-confirms
-    // identically to grader-confirms.
-    const { rows: existing } = await client.query(
-      `SELECT 1 FROM credit_log WHERE task_id = $1 AND reason = 'task.confirmed' LIMIT 1`,
-      [taskId]
-    );
-    let creditsAwarded = 0;
-    let ideaBonus = null;
-    if (reward && existing.length === 0 && task.credits_reward > 0) {
-      const credit = await reward.insertMultipliedConfirmCredit(
-        client, creditedBuilderId, taskId, task.credits_reward, task.kind
-      );
-      creditsAwarded = credit.creditsAwarded;
-      ideaBonus = await reward.maybeAwardIdeaPromotionBonus(
-        client, taskId, creditedBuilderId, creditsAwarded
-      );
-    }
+    // ADR 0120 "pay on land": the per-task credit + idea-promotion bonus are NO
+    // LONGER awarded at confirm. They land at the confirmed→shipped flip
+    // (shipTask → awardLandingCredit, keyed 'task.shipped'), so a task that
+    // strands at 'confirmed' pays nothing until its code is on `main`. confirm
+    // still flips the status and attributes shipped_by to the claim holder
+    // (above); the reward waits for the land. creditsAwarded/ideaBonus stay in
+    // the return shape (0 / null at confirm) so callers/tests keep a stable
+    // contract.
+    const creditsAwarded = 0;
+    const ideaBonus = null;
 
     // task 1679: confirmTask is the --skip-grade / grader_bypass ship path — the
     // DOMINANT one — and until now it awarded credits but NEVER evaluated
@@ -3679,8 +4011,9 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
 //                           still owns the work; release it first so the abandon
 //                           can never race a ship in flight.
 // Any other status (backlog/ready/blocked/completed/confirmed) abandons. The
-// route is archon-gated, and the abandon + its reason are captured in audit_log
-// by the writing middleware, so the append-only ledger records who retired what.
+// route is metic+archon-gated (ADR 0152; archon-only until then), and the abandon
+// + its reason are captured in audit_log by the writing middleware, so the
+// append-only ledger records who retired what. restoreTask (below) is the undo.
 //
 // NOTE on dependencies: abandoning a task that is listed in another task's
 // dependencies[] does NOT auto-adjust those dependents — they will simply never
@@ -3749,6 +4082,69 @@ async function abandonTask({ taskId, reason }, deps = {}) {
   }
 }
 
+// restoreTask (ADR 0152) — the inverse of abandonTask: 'abandoned' → 'backlog'.
+// Added when abandon was re-ranked Archon→Metic+, because until then abandon was
+// one-way through the API (promote took only backlog/blocked, PATCH refuses
+// `status`), so a mis-retire could only be undone with hand-SQL on prod. Handing a
+// Metic the kill switch without an undo at the same rank would have moved the
+// owner-cleanup burden rather than removed it.
+//
+// Restores to **backlog**, not ready: the task was retired deliberately, so it
+// comes back un-workable and needs a second, explicit promote to be claimable.
+// abandonTask stamps `value_summary = 'Abandoned: <reason>'`; a restored task
+// clears exactly that stamp (and nothing else) so a live task never carries a
+// retire note into its ship card / broadcast.
+//
+// Guards: TASK_NOT_FOUND, and TASK_NOT_ABANDONED for any other status (the route
+// checks first, but the db guard makes a direct caller — a CLI, a poller — safe
+// too). Reached via POST /tasks/:id/promote; the audit_log row is written by the
+// writing middleware there, same as the abandon it reverses.
+//
+// #538 test seam: a caller-supplied pool is honored ONLY under NODE_ENV==='test'
+// (matches abandonTask/confirmTask). Production callers omit deps → module pool.
+async function restoreTask({ taskId }, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const client = await activePool.connect();
+  try {
+    await client.query('BEGIN');
+
+    const { rows: taskRows } = await client.query(
+      `SELECT id, title, status FROM tasks WHERE id = $1 FOR UPDATE`,
+      [taskId]
+    );
+    if (taskRows.length === 0) {
+      throw Object.assign(new Error('task not found'), { code: 'TASK_NOT_FOUND' });
+    }
+    const task = taskRows[0];
+    if (task.status !== 'abandoned') {
+      throw Object.assign(new Error('task is not abandoned'), { code: 'TASK_NOT_ABANDONED' });
+    }
+
+    const { rows: updated } = await client.query(
+      `UPDATE tasks
+          SET status = 'backlog',
+              value_summary = CASE WHEN value_summary LIKE 'Abandoned: %' THEN NULL ELSE value_summary END,
+              updated_at = now()
+        WHERE id = $1
+        RETURNING id, title, status`,
+      [taskId]
+    );
+
+    await client.query('COMMIT');
+    return {
+      taskId,
+      taskTitle: updated[0].title,
+      taskStatus: 'backlog',
+      previousStatus: 'abandoned',
+    };
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw err;
+  } finally {
+    client.release();
+  }
+}
+
 // task override requests — V3.R74 (#293). Rare path: a builder whose ship was
 // rejected by the subagent grader (task stays at 'completed', no credits)
 // believes the grader was wrong and asks an Archon to confirm anyway.
@@ -3886,31 +4282,14 @@ async function decideOverrideRequest({ requestId, archonId, decision, note }, de
         // can always destructure it from confirmResult without a guard (#538).
         confirmResult = { taskFlipped: false, creditsAwarded: 0, ideaBonus: null, creditedBuilderId };
       } else {
-        const task = taskRows[0];
-        const { rows: existing } = await client.query(
-          `SELECT 1 FROM credit_log WHERE task_id = $1 AND reason = 'task.confirmed' LIMIT 1`,
-          [task.id]
-        );
-        let creditsAwarded = 0;
-        let ideaBonus = null;
-        if (existing.length === 0 && task.credits_reward > 0) {
-          // V3.R27 (#247): apply kind multiplier on the override-confirm path
-          // too, so a builder who had to argue for their ship is not punished
-          // by getting the legacy 1.0× payout. Credit allocation carved to
-          // modules/economy/ (BV1.R77 / ADR 0093 §1-2): resolve the `reward`
-          // kernel port and write the credit inside this same txn.
-          const reward = seams.resolveOptional('reward');
-          const credit = await reward.insertMultipliedConfirmCredit(
-            client, creditedBuilderId, task.id, task.credits_reward, task.kind
-          );
-          creditsAwarded = credit.creditsAwarded;
-          ideaBonus = await reward.maybeAwardIdeaPromotionBonus(
-            client, task.id, creditedBuilderId, creditsAwarded
-          );
-        }
-        // #704: thetes graduation is evaluated at SHIP time (shipTask), not on
-        // confirm/override — credits here, rank graduation when the task ships.
-        confirmResult = { taskFlipped: true, creditsAwarded, ideaBonus, creditedBuilderId };
+        // ADR 0120 "pay on land": the override-approval path flips the task
+        // completed→confirmed and attributes shipped_by to the claim holder
+        // (above), but the per-task credit + idea bonus now wait for the land
+        // (shipTask → awardLandingCredit, keyed 'task.shipped'). A stranded
+        // override-confirmed task pays nothing until its code is on `main`.
+        // creditsAwarded/ideaBonus stay in the return shape (0 / null) for a
+        // stable contract; thetes graduation was already ship-time (#704).
+        confirmResult = { taskFlipped: true, creditsAwarded: 0, ideaBonus: null, creditedBuilderId };
       }
     }
 
@@ -4068,57 +4447,20 @@ async function applyGrade({ taskId, builderId, gradeResult, committedFiles = nul
       netNegativeBonus = nn.bonus;
       subtractorUnlocks = nn.justUnlocked;
 
-      // Credit award is idempotent on (task_id, 'task.confirmed'). A second
-      // pass through applyGrade for the same task (re-grade scenario) is a
-      // no-op for credit_log.
-      const { rows: existing } = await client.query(
-        `SELECT 1 FROM credit_log WHERE task_id = $1 AND reason = 'task.confirmed' LIMIT 1`,
-        [taskId]
-      );
-      if (existing.length === 0 && task.credits_reward > 0) {
-        const { rows: beforeRows } = await client.query(
-          `SELECT total_credits FROM builders WHERE id = $1`,
-          [creditedBuilderId]
-        );
-        const totalBefore = Number(beforeRows[0]?.total_credits ?? 0);
-
-        // V3.R27 (#247): apply the per-kind multiplier. The credit_log
-        // description records "<raw>c × <mult> = <effective>c (<kind>)" so
-        // the audit trail is self-explaining; the trigger on credit_log rolls
-        // the effective value into builders.total_credits exactly as before.
-        const credit = await reward.insertMultipliedConfirmCredit(
-          client, creditedBuilderId, taskId, task.credits_reward, task.kind
-        );
-        creditsAwarded = credit.creditsAwarded;
-        creditsRaw = credit.raw;
-        creditsMultiplier = credit.multiplier;
-
-        // V3.R27 (#247): staged idea-promotion bonus. If this task came out
-        // of idea_inbox and the capturer is a different builder than the
-        // shipper, give the capturer 25% of the multiplier-adjusted reward.
-        // Runs INSIDE the same txn so total_credits and bonus stay atomic.
-        ideaBonus = await reward.maybeAwardIdeaPromotionBonus(
-          client, taskId, creditedBuilderId, creditsAwarded
-        );
-
-        // #704: thetes graduation is evaluated at SHIP time (shipTask), not at
-        // grader-confirm — credits land here, rank graduation when the task ships.
-
-        const { rows: afterRows } = await client.query(
-          `SELECT total_credits FROM builders WHERE id = $1`,
-          [creditedBuilderId]
-        );
-        const totalAfter = Number(afterRows[0]?.total_credits ?? 0);
-
-        const shipUnlocks = await reward.evaluateAfterShip(client, creditedBuilderId, taskId, committedFiles);
-        const creditUnlocks = await reward.evaluateAfterCreditAward(
-          client, creditedBuilderId, totalBefore, totalAfter
-        );
-        justUnlocked = [...subtractorUnlocks, ...shipUnlocks, ...creditUnlocks];
-      } else {
-        const shipUnlocks = await reward.evaluateAfterShip(client, creditedBuilderId, taskId, committedFiles);
-        justUnlocked = [...subtractorUnlocks, ...shipUnlocks];
-      }
+      // ADR 0120 "pay on land": the per-task credit + idea-promotion bonus are
+      // NO LONGER awarded at grader-confirm. They land at the confirmed→shipped
+      // flip (shipTask → awardLandingCredit, keyed 'task.shipped'), so a task
+      // that strands at 'confirmed' pays nothing until its code is on `main`.
+      // The net-negative (simplification) bonus above STAYS here — it derives
+      // from grade-time diff_stats that only exist at grade time, so it cannot
+      // move to shipTask (and is outside ADR 0120's two named reward writes).
+      // creditsAwarded/creditsRaw/creditsMultiplier/ideaBonus stay 0/null at
+      // confirm for a stable return contract; the credit lands at ship. The
+      // credit-crossing achievement evaluator (evaluateAfterCreditAward) moves
+      // with the credit to shipTask's reconcile; here we still fire the
+      // ship/subtractor unlocks that DON'T depend on the per-task credit.
+      const shipUnlocks = await reward.evaluateAfterShip(client, creditedBuilderId, taskId, committedFiles);
+      justUnlocked = [...subtractorUnlocks, ...shipUnlocks];
 
       // task 1679: state-based safety net. The granular evaluators above are
       // boundary-/path-sensitive — breaking-the-100c-bar only fires when a
@@ -4193,19 +4535,52 @@ async function getActiveClaimsForBuilder(builderId) {
   return rows;
 }
 
+// Task-scoped dev box (goal 1000051 / R92, ADR 0148 §2). The set-union of the
+// module KEYS a builder's active claims put in scope: each active claim's task →
+// its goal → goal.scope_modules (the ADR 0086 scope wall), unioned + deduped
+// across all the builder's active claims. This is the "what code does this
+// builder's current work need" signal the dev-box source-access resolver
+// (modules/dev-box/box-access.js, wired in R93/R94) maps to git sparse-checkout
+// globs via the doorway `moduleScopeMap`. Returns [] when the builder holds no
+// active claim, or when every claimed task carries no goal / an empty
+// scope_modules — the box then falls back to BASE-only (the pre-existing Bongos
+// instance). KEYS only; glob resolution is the box module's job (it reaches
+// moduleScopeMap through the doorway, never a core-internal require — the
+// R90/ADR-0148 boundary). Honours the #538 deps.pool test seam
+// (NODE_ENV==='test' only), like the goals reads above.
+async function moduleScopeForActiveClaims(builderId, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const id = Number(builderId);
+  if (!Number.isInteger(id)) {
+    throw new Error('moduleScopeForActiveClaims: builderId must be numeric');
+  }
+  const { rows } = await activePool.query(
+    `SELECT DISTINCT m AS module_key
+       FROM claims c
+       JOIN tasks t ON t.id = c.task_id
+       JOIN goals g ON g.id = t.goal_id
+       CROSS JOIN LATERAL unnest(g.scope_modules) AS m
+      WHERE c.builder_id = $1 AND c.released_at IS NULL
+      ORDER BY m`,
+    [id]
+  );
+  return rows.map((r) => r.module_key);
+}
+
 // task 1642 — every active claim bound to a given CLI session. "Active" is the
 // claims-table convention (released_at IS NULL); there is NO `status` column on
 // claims (a common misread — the task's status lives on `tasks`). Keyed on
-// creator_session_id (the worktree's session), NOT builder_id: a builder may run
-// many concurrent sessions, each with exactly one claim/one worktree, and that
-// norm must keep working. This backs the session-scoped one-active-claim guard
-// (shouldRefuseSessionClaim) that blocks commingled ships. NULL-session callers
-// must never reach this — they are session-UNBOUND web claims (bind_session=false)
-// that any CLI session may adopt; the route short-circuits before calling here.
+// creator_session_id (the auth-token session shared across a builder's worktrees),
+// NOT builder_id. This backs the one-active-claim guard (shouldRefuseSessionClaim),
+// which further discriminates by `worktree_name` — the real commingle boundary —
+// so two claims can coexist for one auth session as long as they land in different
+// worktrees. NULL-session callers must never reach this — they are session-UNBOUND
+// web claims (bind_session=false) that any CLI session may adopt; the route
+// short-circuits before calling here.
 async function getActiveClaimsForSession(creatorSessionId) {
   if (!creatorSessionId) return [];
   const { rows } = await pool.query(
-    `SELECT c.id AS claim_id, c.task_id, c.creator_session_id, c.claimed_at,
+    `SELECT c.id AS claim_id, c.task_id, c.creator_session_id, c.worktree_name, c.claimed_at,
             t.title
        FROM claims c JOIN tasks t ON t.id = c.task_id
       WHERE c.creator_session_id = $1 AND c.released_at IS NULL
@@ -4952,6 +5327,7 @@ module.exports = {
   updateTaskStatus,
   getTaskDependencies,
   getTaskDependents,
+  attachTaskDepSummaries,
   addTaskDependency,
   removeTaskDependency,
   setTaskDependencies,
@@ -4974,12 +5350,16 @@ module.exports = {
   resolveClaim,
   confirmTask,
   abandonTask,
+  restoreTask, // ADR 0152 — the abandoned→backlog undo that pairs with the Metic+ abandon grant
   applyGrade,
   shipTask,
+  flagTaskNeedsRebase, // ADR 0120 part 2 — reconciler flags an unlandable confirmed task for its builder
+  needsRebaseTasksForBuilder, // ADR 0120 part 3/5 — the claim gate + hall/CLI read the builder's owed rebases
   listConfirmedTasksForReconcile, // task 1134 — server-owned publish reconciler feed
   setClaimPublishedSha, // task 1547 — record the SERVER-pushed tip for per-task land proof
   getClaimPublishedSha, // task 1547 — read the published tip for the reconcile gate
   getActiveClaimsForBuilder,
+  moduleScopeForActiveClaims, // goal 1000051 / R92 — dev-box task-scoped source access (ADR 0148 §2)
   getActiveClaimsForSession,
   getLastClaimHolder, // --regrade ownership guard (#678)
   getTaskGrade,       // V4.R08 — diff-hash reuse check before grading