@bongos/core 1.19.707 → 1.19.709

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.707",
-  "core_contract": "1.19.707",
-  "source_commit": "81f4406107cc23fffd1cd396faeba854cfab702e",
+  "core_version": "1.19.709",
+  "core_contract": "1.19.709",
+  "source_commit": "e931b6db287584c48e0e0fbb4f302198e7ad7ae1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T06:08:10.442Z",
+  "built_at": "2026-09-13T06:55:41.726Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2138,
+    "functional_verbatim": 2140,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2639,
-  "tree_sha256": "b1f44a9ac5209bb3aef35739af94352c50892f50161818d2e805cdcb9fb92687",
+  "file_count": 2641,
+  "tree_sha256": "38d60d3f6875f0ae881aeb4942d3a09b3aa7f9d0df66d7ec712d0ead28d6b3dd",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "59033d82daa55e0e2bb8f357d076e5e0c36b6d708ec764ed28946248da86a1c6"
+      "sha256": "ebca814eb4d786c2958e44b166b23986ef624b9145bc9c5a6b5a0068ef05a411"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3859,6 +3859,11 @@
       "mode": "0000644",
       "sha256": "03df9104a0309011df1b6e96627c62cc6612f34b654134306d13fd5c89b8f038"
     },
+    {
+      "path": "migrations/core_239_claimable_respects_blocker_status.sql",
+      "mode": "0000644",
+      "sha256": "75a3d09bce8a40b51015054b4f4c77706ce76e7f8cb3fc4a54048c9bd33814b8"
+    },
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
@@ -7782,12 +7787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0beecf6840022e259986573a8a0b444f9d4848dc0758f009b83e346f54769a1f"
+      "sha256": "9e9bbca8f0efb3bed421d30ad97be1b18edf775e80cbc07590a583b2452ea609"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bed665bc57c56a76e572401a1baed5fd08bfcca74a1a32e2dc744b6af2f79399"
+      "sha256": "eb6d8897c8a65579eaee354a12435b412606029b3f182f192cf5628941580075"
     },
     {
       "path": "public-docs/index.html",
@@ -7982,7 +7987,7 @@
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
-      "sha256": "7890dee972f792b633a86d5ac9e6195bafdfc6c197195b8ac3f00c4a0f80d5c0"
+      "sha256": "431691aed02a415c619dc0ba33106ac1e832e539260eff5f526debebe2d8ffff"
     },
     {
       "path": "scripts/gds/box-sync.js",
@@ -9567,7 +9572,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6bf49d3b72dbd08d6ede9514f8381efcb22d45602ed5f5de84893c1181b38dce"
+      "sha256": "5359ee8368381b16bb0d6e18a13e390dd9366b3a3cdc3965e749cb5746f5cc4f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10012,7 +10017,7 @@
     {
       "path": "tests/box_infra_resolve.mjs",
       "mode": "0000644",
-      "sha256": "cf261fa549f36d47ee42343bac2a297b132638aedf03beb8f521370b0c45c0e3"
+      "sha256": "fde24a8c273a098c89bbbce6c006fa4400448c9522b93707f5cd3f4fb358c515"
     },
     {
       "path": "tests/box_onboard.mjs",
@@ -10159,6 +10164,11 @@
       "mode": "0000644",
       "sha256": "6e5ff3acb835fd6219136ee2a5e144841076a82733915cc7111688f707464442"
     },
+    {
+      "path": "tests/claimable_blocker_status.mjs",
+      "mode": "0000644",
+      "sha256": "6bb10ab7ee346bbe673055e46e9fc53865540157c48c203e57c11ad51ba44336"
+    },
     {
       "path": "tests/claims_bind_session.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1873,5 +1873,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.705 with no explicit bump. run 34740247460. (task 1002620)
   1.19.707 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.706 with no explicit bump. run 34741980536. (task 1002620)
+  1.19.708 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.707 with no explicit bump. run 34742245823. (task 1002620)
+  1.19.709 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.708 with no explicit bump. run 34743928060. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_239_claimable_respects_blocker_status.sql

@@ -0,0 +1,67 @@
+-- core_239 — claimable_tasks must filter on the blocker being OPEN, not on the
+-- link row existing (task 1003863).
+--
+-- THE DEFECT. core_231's claimable_tasks excludes a task if ANY task_blockers row
+-- exists for it, with no check on the blocker's status:
+--
+--     AND NOT EXISTS (SELECT 1 FROM task_blockers tb WHERE tb.task_id = t.id)
+--
+-- Nothing ever deletes that link: there is no `DELETE FROM task_blockers` in
+-- migrations/ or modules/. So when core_223's trg_promote_tasks_on_blocker_resolve
+-- flips a task 'blocked' -> 'ready' on its last blocker resolving, the link row
+-- survives and this view keeps hiding the task. A task that has ever been blocked
+-- is promoted to ready and then never appears in /builder-start again.
+--
+-- It stays claimable BY ID — modules/lifecycle/db-claims.js checks b.status='open'
+-- correctly (task 1002650) — so the row is workable but unfindable. Same family as
+-- bug 1003553, inverted: there the feed advertises what the claim path refuses;
+-- here the claim path accepts what the feed hides.
+--
+-- LATENT, NOT HARMLESS. Every blocker on the instance was status='open' when this
+-- was written, so the bad branch had never executed. Eleven tasks were linked to
+-- open blockers at that moment, and each would have vanished from the queue the
+-- moment its blocker resolved — including task 1001440 behind blocker 1000144.
+--
+-- THE LEFT JOIN IS LOAD-BEARING. Legacy markdown-anchor links carry
+-- task_blockers.blocker_ref with NO blockers row (core_223's header, same scope as
+-- 176). An inner join would drop those rows from the NOT EXISTS and thereby
+-- UNHIDE their tasks — a silent widening of the feed. `LEFT JOIN` plus
+-- `b.id IS NULL OR b.status = 'open'` keeps an unresolvable legacy link blocking,
+-- which is exactly today's behaviour. Fail closed on anything we cannot resolve.
+--
+-- Scope: this view only. The OTHER gap in the same view — it never filters
+-- unshipped dependencies either (finding #60 of task 1000379) — is a separate
+-- clause with a separate fix and is deliberately NOT bundled here.
+--
+-- Idempotent: DROP VIEW IF EXISTS + CREATE, the same shape core_231 used. The
+-- column list is `t.*` plus the calibrated-minutes column, byte-identical to
+-- core_231 so the wildcard re-expands to every current column (core_227's header
+-- records six columns that silently never reached the feed by diverging here).
+
+BEGIN;
+
+DROP VIEW IF EXISTS claimable_tasks;
+CREATE VIEW claimable_tasks AS
+SELECT t.*,
+       pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
+  FROM tasks t
+ WHERE t.status = 'ready'
+   AND t.title NOT LIKE '\_\_smoke\_\_%' ESCAPE '\'
+   AND NOT EXISTS (
+     SELECT 1
+       FROM task_blockers tb
+       LEFT JOIN blockers b ON b.id = tb.blocker_id
+      WHERE tb.task_id = t.id
+        AND (b.id IS NULL OR b.status = 'open')
+   )
+   AND NOT EXISTS (
+     SELECT 1 FROM claims c
+       JOIN tasks t2 ON t2.id = c.task_id
+      WHERE c.released_at IS NULL
+        AND t2.touches && t.touches
+   );
+
+COMMIT;
+
+INSERT INTO schema_migrations (version) VALUES ('core_239_claimable_respects_blocker_status')
+  ON CONFLICT (version) DO NOTHING;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.707",
+  "version": "1.19.709",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.707",
+      "version": "1.19.709",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.707",
+  "version": "1.19.709",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box-infra.js

@@ -216,6 +216,9 @@ function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '',
   // below — they are minted per-provision, not read from infra/. A missing inlined
   // file is COLLECTED and fails loud after the render (ADR 0150) — a half-wired box
   // (that component silently never boots) is a bug, not something to warn past.
+  //
+  // Every name passed to fileGzB64 below is INSTANCE-owned and deliberately absent
+  // from the neutral core's own infra/ — see infra/README.md (ADR 0150).
   const missingInfra = [];
   const fileGzB64 = (name) => {
     try {
@@ -267,6 +270,36 @@ function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '',
       + `— a box would boot half-wired (ADR 0150). Fix the instance infra/ before provisioning.`,
     );
   }
+  // ADR 0150 prong B named this escalation and never implemented it: "assert no
+  // __…_B64__ placeholders survive the render, so a *partial* infra/ also surfaces
+  // rather than half-wiring". The missingInfra check above only catches files THIS
+  // file knows to ask for. It cannot catch the other direction — an instance
+  // template carrying a token box-infra.js does not substitute. That renders a
+  // cloud-init with the literal token in it, and cloud-init happily writes the
+  // garbage as a file: the box boots half-wired, silently, which is the one
+  // outcome ADR 0150 exists to prevent.
+  //
+  // The stakes are not hypothetical for one of them. __BUILDER_AUTHORIZED_KEYS_B64__
+  // is the baked SSH key block; if a template misspells it, the substitution never
+  // happens and the box comes up with a garbage authorized_keys — permanently
+  // unreachable over SSH, exactly the failure task 1003635 was filed about (it
+  // guessed the wrong mechanism, but the outcome it named was reachable this way).
+  //
+  // Same pattern the happy-path test has always asserted, now enforced in the code
+  // rather than only in the test.
+  // The pattern is the placeholder CONVENTION, so this assumes a template never
+  // carries a literal __UPPER_SNAKE__ it means to keep. Nothing in this tree does,
+  // and a false positive fails loud and legibly (it names the token) rather than
+  // shipping a bad box — the safe direction to be wrong in. An instance that ever
+  // needs a literal one should escape it in the template, not weaken this check.
+  const survivors = [...new Set(rendered.match(/__[A-Z0-9_]+__/g) || [])];
+  if (survivors.length) {
+    throw new Error(
+      `box cloud-init under ${infraDir} left ${survivors.length} placeholder(s) unsubstituted: `
+      + `${survivors.join(', ')} — box-infra.js does not know these tokens, so the box would `
+      + `boot half-wired (ADR 0150). Reconcile the instance template with this renderer.`,
+    );
+  }
   return rendered;
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.707'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.709'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_infra_resolve.mjs

@@ -17,8 +17,12 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { makeRunner } from './helpers.mjs';
 
+// This repo's root — the boundary tests at the bottom read the REAL tree.
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
 const require = createRequire(import.meta.url);
 const box = require('../scripts/gds/box.js');
 
@@ -153,5 +157,90 @@ await test('readCloudInit renders a non-empty cloud-init with no leftover __PLAC
   assert.ok(!/__[A-Z0-9_]+__/.test(out), 'no unsubstituted __PLACEHOLDER__ tokens remain');
 });
 
+// ===========================================================================
+// An UNKNOWN placeholder half-wires the box (task 1003635, ADR 0150 prong B)
+//
+// missingInfra only catches files this renderer knows to ask for. The other
+// direction — an instance template carrying a token box-infra.js never
+// substitutes — used to render straight through, leaving the literal token in
+// the cloud-init for cloud-init to write out as a file. ADR 0150 named the
+// assertion as an escalation and it was never implemented.
+// ===========================================================================
+
+await test('an UNKNOWN __TOKEN__ in the instance template is refused, not rendered through', () => {
+  const { infra } = makeInfra();
+  fs.appendFileSync(path.join(infra, TEMPLATE), '\n# __SOME_FUTURE_THING_B64__\n');
+  assert.throws(
+    () => box.readCloudInit({ infraDir: infra }),
+    (err) => /__SOME_FUTURE_THING_B64__/.test(err.message) && /placeholder|half-wired|ADR 0150/i.test(err.message),
+    'an unsubstituted placeholder must fail loud — rendering it through writes garbage onto the box',
+  );
+});
+
+await test('a misspelled AUTHORIZED_KEYS token cannot ship a permanently SSH-unreachable box', () => {
+  // The stakes case. A template that spells the key block even slightly wrong
+  // gets no substitution, so the box boots with a garbage authorized_keys and
+  // nobody can SSH in — the outcome task 1003635 reported, by the mechanism it
+  // did not find. It must be refused before DigitalOcean is touched.
+  const { infra } = makeInfra();
+  fs.appendFileSync(path.join(infra, TEMPLATE), '\n# __BUILDER_AUTHORIZED_KEY_B64__\n');
+  assert.throws(
+    () => box.readCloudInit({ infraDir: infra, authorizedKeysBlock: 'ssh-ed25519 AAAA' }),
+    /__BUILDER_AUTHORIZED_KEY_B64__/,
+  );
+});
+
+await test('the happy path still renders — the assertion does not fire on a correct template', () => {
+  const { infra } = makeInfra();
+  const out = box.readCloudInit({
+    infraDir: infra, authorizedKeysBlock: 'ssh-ed25519 AAAA', boxEnv: 'X=1', gdsSession: '{"t":1}',
+  });
+  assert.ok(out && out.length > 0, 'a correct template must still render');
+});
+
+// ===========================================================================
+// The core / instance boundary (task 1003635)
+//
+// The absence of the cloud-init set from the core's own infra/ was filed once as
+// a P1 outage ("a dev box becomes permanently SSH-unreachable"). It is not one —
+// ADR 0150 says the neutral core ships no box cloud-init, and the two throws
+// above are what make a missing one legible instead of dangerous. These pin that
+// boundary against the REAL tree so the next reader gets a test telling them so.
+// ===========================================================================
+
+await test('the INLINED list is exactly what box-infra.js actually asks fileGzB64 for', () => {
+  // The list above says "kept in sync with box.js's fileGzB64 calls" — by hand.
+  // Derive it instead, so adding a 10th inlined file cannot leave these tests
+  // silently proving less than they claim.
+  const SRC = fs.readFileSync(path.join(REPO_ROOT, 'scripts/gds/box-infra.js'), 'utf8');
+  const called = [...SRC.matchAll(/fileGzB64\('([^']+)'\)/g)].map((m) => m[1]);
+  assert.ok(called.length > 0, 'found no fileGzB64 calls — did box-infra.js move or get renamed?');
+  assert.deepEqual([...new Set(called)].sort(), [...INLINED].sort(),
+    'the INLINED fixture list has drifted from box-infra.js — the happy-path test would stop covering every inlined file');
+});
+
+await test('the neutral core ships NO box cloud-init — that is ADR 0150, not a missing file', () => {
+  const coreInfra = path.join(REPO_ROOT, 'infra');
+  assert.ok(!fs.existsSync(path.join(coreInfra, TEMPLATE)),
+    `the core now ships infra/${TEMPLATE}. ADR 0150 says it must not ("The neutral core still ships no infra/") — the cloud-init is instance-owned. If that decision changed, amend ADR 0150 and this test together.`);
+  for (const name of INLINED) {
+    assert.ok(!fs.existsSync(path.join(coreInfra, name)),
+      `infra/${name} is a cloud-init asset and belongs to the host instance, not the core (ADR 0150)`);
+  }
+});
+
+await test("core infra/ carries only the CLONE-RIDE scripts, which is why it looks half-empty", () => {
+  // The other population: these run on the box out of /workspace/infra/, arriving
+  // with the cloned source rather than through cloud-init. Their presence beside
+  // nine absences is the thing that reads as "files are missing" — infra/README.md
+  // exists to answer that, so it is required to stay.
+  const coreInfra = path.join(REPO_ROOT, 'infra');
+  for (const name of ['box-heartbeat.sh', 'box-report-host-keys.sh', 'box-report-terminal.sh', 'box-report-version.sh']) {
+    assert.ok(fs.existsSync(path.join(coreInfra, name)), `infra/${name} rides the clone and must stay in the core`);
+  }
+  assert.ok(fs.existsSync(path.join(coreInfra, 'README.md')),
+    'infra/README.md explains the two populations — without it the nine absences read as breakage again (task 1003635)');
+});
+
 for (const d of tmps) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best-effort */ } }
 summary();

package/tests/claimable_blocker_status.mjs

@@ -0,0 +1,98 @@
+// tests/claimable_blocker_status.mjs
+//
+// Task 1003863 — claimable_tasks must hide a task only while a blocker on it is
+// still OPEN, not forever because a link row exists. Static shape guard for
+// core_239, in the style of blocker_resolve_guard.mjs: no live DB, assert the SQL
+// TEXT so a future edit cannot silently drop the fix or "simplify" the LEFT JOIN
+// back into the bug. Runtime behaviour is proven against real Postgres at deploy.
+//
+// THE BUG THIS PINS. core_231's view excluded a task if ANY task_blockers row
+// existed, and nothing ever deletes that row. core_223's trigger flips the task
+// 'blocked' -> 'ready' when its last blocker resolves, so the task became ready
+// and permanently invisible to /builder-start — workable by id, unfindable in the
+// feed. Latent when found (every blocker was open), but eleven tasks were one
+// resolve away from vanishing.
+//
+// Run:  node tests/claimable_blocker_status.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+
+const MIG = 'core_239_claimable_respects_blocker_status.sql';
+const mig = read('migrations', MIG);
+// Comments carry the rationale; strip them when asserting on the executable body
+// so a claim in prose can never stand in for the real SQL.
+const body = mig.replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
+
+const { test, summary } = makeRunner();
+
+await test('239 replaces claimable_tasks, in core_231-s drop-and-create shape', () => {
+  assert.match(body, /DROP VIEW IF EXISTS claimable_tasks;/);
+  assert.match(body, /CREATE VIEW claimable_tasks AS/);
+});
+
+await test('the blocker clause filters on the blocker being OPEN, not on the link existing', () => {
+  assert.match(body, /FROM task_blockers tb/, 'it still looks at the link table');
+  assert.match(body, /blockers b ON b\.id = tb\.blocker_id/, 'and resolves the blocker itself');
+  assert.match(body, /b\.status = 'open'/, 'so a RESOLVED blocker stops hiding the task');
+});
+
+await test('the join is a LEFT JOIN with the fail-closed arm — an inner join would UNHIDE legacy links', () => {
+  // Legacy markdown-anchor links carry task_blockers.blocker_ref with no blockers
+  // row (core_223 header, same scope as 176). An inner join drops them from the
+  // NOT EXISTS and silently widens the feed. This is the one line most likely to
+  // be "tidied" later, so it is asserted from both directions.
+  assert.match(body, /LEFT JOIN blockers b/, 'LEFT, so an unresolvable link survives the join');
+  assert.match(body, /b\.id IS NULL OR b\.status = 'open'/, 'and an unresolvable link still blocks');
+  assert.doesNotMatch(
+    body,
+    /(?<!LEFT )JOIN blockers b ON b\.id = tb\.blocker_id/,
+    'a bare inner JOIN onto blockers would unhide every legacy link'
+  );
+});
+
+await test('the view-s OTHER guards survive the rewrite', () => {
+  // A view rewrite replaces the whole definition, so dropping a sibling clause is
+  // a silent regression with no error anywhere. Each of these was its own fix.
+  assert.match(body, /t\.status = 'ready'/, 'only ready tasks are claimable');
+  assert.match(body, /NOT LIKE '\\_\\_smoke\\_\\_%'/, 'smoke rows stay out of the feed');
+  assert.match(body, /c\.released_at IS NULL/, 'and the touches-overlap parallel-safety guard holds');
+  assert.match(body, /t2\.touches && t\.touches/, 'against other live claims');
+});
+
+await test('the column list stays the t.* wildcard (core_227-s silent-column lesson)', () => {
+  // core_227's header records six columns that never reached the feed because a
+  // rewrite spelled the list out instead of re-expanding it.
+  assert.match(body, /SELECT t\.\*,/, 'the wildcard re-expands to every current column');
+  assert.match(body, /pms_calibrated_minutes\(t\.est_minutes, t\.kind\) AS est_minutes_calibrated/);
+});
+
+await test('239 is the LAST definition of claimable_tasks in migrations/', () => {
+  // If a later migration redefines the view, it inherits whatever that one says —
+  // which is exactly how 177 silently dropped migration 176's blocker clause from
+  // task_is_fully_unblocked. Catch the next one at the source.
+  const defs = readdirSync(join(repoRoot, 'migrations'))
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /CREATE VIEW claimable_tasks/.test(read('migrations', f)))
+    .sort();
+  assert.ok(defs.includes(MIG), 'this migration defines the view');
+  assert.equal(defs[defs.length - 1], MIG,
+    `a later migration redefines claimable_tasks and must carry the blocker-status clause: ${defs.join(', ')}`);
+});
+
+await test('the feed and the claim path enforce the SAME rule', () => {
+  // The whole bug class is the two gates disagreeing. db-claims.js got this right
+  // for the by-id path in task 1002650; this pins that they still match.
+  const claims = read('modules', 'lifecycle', 'db-claims.js');
+  assert.match(claims, /b\.status = 'open'/,
+    'the by-id claim path checks blocker STATUS, and the view must not be laxer or stricter');
+});
+
+summary();