@bongos/core 1.19.820 → 1.19.822

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.820",
-  "core_contract": "1.19.820",
-  "source_commit": "c4a01fc04756f55d2459a179bd38a808b5950c1c",
+  "core_version": "1.19.822",
+  "core_contract": "1.19.822",
+  "source_commit": "5a9c009cff17c2a500ff23f5d0de66a1b7f00477",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T10:19:46.189Z",
+  "built_at": "2026-09-17T11:05:47.254Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 490,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2227,
+    "functional_verbatim": 2228,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2743,
-  "tree_sha256": "8f93538017b17fbc142d0e8bf95cc5f666a32ea5295ba9be2dbca5eb19acd100",
+  "file_count": 2744,
+  "tree_sha256": "acbc13ab96c308bd0c0aa200c9dd1f6af1013ed6771c70730a797f7a1fb4a697",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -62,7 +62,7 @@
     {
       "path": ".claude/skills/builder-end/SKILL.md",
       "mode": "0000644",
-      "sha256": "60573c4e129df5bb386e7588989fbb407dfd1b88b4b9d567b2415d3e597f54da"
+      "sha256": "6f410236fa6fed591838b52a1d962210ed3c376e1feb439755c39930edd96ede"
     },
     {
       "path": ".claude/skills/builder-exit/SKILL.md",
@@ -517,7 +517,7 @@
     {
       "path": "docs/adr/0021-per-builder-skill-model-preferences.md",
       "mode": "0000644",
-      "sha256": "bcd0b55d7fd83e3e8877c55dbddbc9c101a2627f1a7be29207ab3e3bf8732e71"
+      "sha256": "12ee736d317c0076261f469c7fa010f71625329d81ee15bf2f069af80850826a"
     },
     {
       "path": "docs/adr/0022-secrets-policy.md",
@@ -537,7 +537,7 @@
     {
       "path": "docs/adr/0024-multi-agent-system-architecture.md",
       "mode": "0000644",
-      "sha256": "0aa00a713d3c15f456d535c15968547141df4f76f6b351a86c4c50132bad937c"
+      "sha256": "f446e8a7b535cd9b35a7255c2e78179ca287c16985f4b3e294c4282c5b1cfab4"
     },
     {
       "path": "docs/adr/0025-offsite-backup-vendor-digitalocean-spaces.md",
@@ -552,7 +552,7 @@
     {
       "path": "docs/adr/0026-bfg-memory-hygiene-and-cross-builder-learning.md",
       "mode": "0000644",
-      "sha256": "4e337e424c15df34f411877ecc371ad2e8f111c9922f9898eedc648d5d9bb1fe"
+      "sha256": "50d275eeea0cac619c5806583db070a3b95ab4e350a89e2b99e9d6fd4022332d"
     },
     {
       "path": "docs/adr/0027-bfg-session-inefficiency-evaluator.md",
@@ -562,7 +562,7 @@
     {
       "path": "docs/adr/0028-honest-llm-spend-accounting.md",
       "mode": "0000644",
-      "sha256": "31a0378984e53c9cb08370f70f3dca296cf532c1bf7e55a39c898683b1cb0c22"
+      "sha256": "7d8e8a3de946d3ddd2b9ee2d717b067fdcf7ecaa66bad814fd4567846b4c749e"
     },
     {
       "path": "docs/adr/0029-status-page-outage-resilience.md",
@@ -597,7 +597,7 @@
     {
       "path": "docs/adr/0035-builder-onboarding-three-paths.md",
       "mode": "0000644",
-      "sha256": "e411de75d8fa21b6870d5ca85052e3608b7fc59505990fd19bd23ac4c474b0e9"
+      "sha256": "eefc4f6a5d9090c853bcb45d03e1b5fb410910a003b08331dbf16a3d50836e80"
     },
     {
       "path": "docs/adr/0036-builders-subdomain-and-ui-reorg.md",
@@ -702,7 +702,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "4b2b10b4ae53c2b5c33d1220563b3021822c3ddc5e1a5034afc04a0d286f7bec"
+      "sha256": "09b32b0cf2f01db37797c6f99262b37dd5be51a47a57cb5005c49e9058c06c81"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -722,17 +722,17 @@
     {
       "path": "docs/adr/0058-automatic-gate-surface-gatekeeper.md",
       "mode": "0000644",
-      "sha256": "308a1342c514ef4028da846a8b3963df4a3908e72e1ed3a688fe1c1e51c67ec9"
+      "sha256": "35b2bfccd503b150c3e6587564c1e1779400bdbf1899ee2346c31eb19d8b2681"
     },
     {
       "path": "docs/adr/0059-single-approval-remove-devbox-approval-gate.md",
       "mode": "0000644",
-      "sha256": "adb7a32e2afc71212a680fd59443e4435a884758053f78509ec6bc7b8f738e23"
+      "sha256": "6b425c8416bf8695c5a85b93d0f24e3db9d1a43ee9fa3032aa38a9178fbb740a"
     },
     {
       "path": "docs/adr/0060-gds-retrieval-layer.md",
       "mode": "0000644",
-      "sha256": "9d0546a4d24f38f1632aa94789c3d599777ff9dbf9664929993934f6b2ffcd1f"
+      "sha256": "9f965ad0eb78ea5e5dd83f46426129a593335bb35e312209d1cfe3a240d53be3"
     },
     {
       "path": "docs/adr/0061-context-layer-decomposition.md",
@@ -782,7 +782,7 @@
     {
       "path": "docs/adr/0070-deterministic-session-card-delivery.md",
       "mode": "0000644",
-      "sha256": "b8ecbe554ac874f415bca4e31198e77f574fdba7fc0d2a6f9491701094203062"
+      "sha256": "f215a47f3432a8efce4b9fd7a9eb90dd3221ca314b8fa8ca35486464f3027769"
     },
     {
       "path": "docs/adr/0071-box-confirm-before-destroyed-and-drift-reconcile.md",
@@ -802,7 +802,7 @@
     {
       "path": "docs/adr/0073-builder-needs-signal-and-byok-gemini-key.md",
       "mode": "0000644",
-      "sha256": "b7e794e23d06b44d7e4cbdc4985275aa4c26b5b88aa5a5c019881ac0b88bfaa7"
+      "sha256": "cf5981d3c27dfed8e2f02b07a77c9de08a8df6bda0a746ecd3bc0943d30d64da"
     },
     {
       "path": "docs/adr/0073-secrets-scan-exclude-uri-detector.md",
@@ -847,7 +847,7 @@
     {
       "path": "docs/adr/0081-tool-agnostic-design-layer.md",
       "mode": "0000644",
-      "sha256": "6fbbd598f08196d32253f15a797dd20bdc28cb7c38930e10f9dcf5467e6dbf97"
+      "sha256": "d2f5de4793bf1e9cd184a4bfc2cddb9dd44c560e42e3ef8d0f0e6668fd84d69a"
     },
     {
       "path": "docs/adr/0082-productized-key-storage-provisioning.md",
@@ -877,7 +877,7 @@
     {
       "path": "docs/adr/0086-goal-scoped-work-hierarchy.md",
       "mode": "0000644",
-      "sha256": "db082db26afc1fefd429c826ba934e99ff1e127cd0b099810de1b9e83ef8514f"
+      "sha256": "15c590ed8bb381435564f4ba797f8933b2332620da6178e2f2b47c22feedc15b"
     },
     {
       "path": "docs/adr/0087-bongos-app-architecture-and-handoff-contract.md",
@@ -1052,7 +1052,7 @@
     {
       "path": "docs/adr/0117-api-versioning-and-deprecation-policy.md",
       "mode": "0000644",
-      "sha256": "738b956bbf896aabdfd28b7f885b47e4b44cce6406d9ac9a5b67a23f3b0cac5d"
+      "sha256": "6a9f4f42867cfd07f7ad85b2d7fc8dab58f6e6ce0c7e0145cb7d58aa16955619"
     },
     {
       "path": "docs/adr/0118-api-contract-source-of-truth-code-first.md",
@@ -2547,7 +2547,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "54570238fac2a9b36678a3fa293f7ea17cc53d3c8aeb29070132a5eb35f31334"
+      "sha256": "9182a3b88e6092a231f59db4220628cb8579244c8289350406f07187c959e644"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2732,7 +2732,7 @@
     {
       "path": "docs/recipes/multi-builder-merge.md",
       "mode": "0000644",
-      "sha256": "048875fdcbd2e6637f19b96e3b6660434e4ceb68b5ee171580a6d6a13b39242b"
+      "sha256": "368b0acc045087c8aff34b3a551ced958e6e87987afcf6c3210eff093c8a9eea"
     },
     {
       "path": "docs/recipes/ops-gotchas.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/recipes/search-index-ingestion.md",
       "mode": "0000644",
-      "sha256": "70989ad134f5aaffc08007a180bfa5f9cccceef780346a965fcade293490dc71"
+      "sha256": "dd333b764d0ed25162b6bee7f02cb5231d7384918abb30a05ad3a18aa099f4dd"
     },
     {
       "path": "docs/recipes/self-host.md",
@@ -5612,7 +5612,7 @@
     {
       "path": "modules/lifecycle/dead-deps.js",
       "mode": "0000644",
-      "sha256": "c9f7aa89a4b1e9a201189608ff8ebc4910ee6ca19be33ce681f2d32cedb0b39d"
+      "sha256": "4738131a48e85dd7bf0644ddd3686c85d0d1d0da55ee623b1834d048c614b91c"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -7812,12 +7812,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e520824e675ebbb739a1f6ea7e2bc6ff857e1b6a396a61e22f20fd31b8b9a502"
+      "sha256": "d13165aac1aea3612a3c5af1b5b14267acdde35f2a8d99482310c7a749f9761c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "39eb085e8df8abd30ffe2826215c5c7eb6969b2a3990f3f7d0f12cd303cd0aaf"
+      "sha256": "0f9f0baab592f70e890e2a39e61dcf21c5170841f97b8c82cb16703c2a959756"
     },
     {
       "path": "public-docs/index.html",
@@ -7947,7 +7947,7 @@
     {
       "path": "scripts/gds/audit-deps.js",
       "mode": "0000644",
-      "sha256": "891aadcbea8ef257f68f20f140fa988c45ac06d4caa19802136c372d403db7ba"
+      "sha256": "ff7ccdf15ae2c215d3330e957d6a36adc7d48f5d9bd5042b5d61bb228b878073"
     },
     {
       "path": "scripts/gds/audit-exports.js",
@@ -9722,7 +9722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8285f22119e40dc42cf2826696104fea2321fb9da9ad5c6cbd8eb5106382807f"
+      "sha256": "782160b1ae7c1483c92337a589f92d8099a8bbee37005ea744c78bd4fcb5803c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12494,6 +12494,11 @@
       "mode": "0000644",
       "sha256": "a36acb19e59db1f9eb885ab6497a43d1c8ce0ba6198b0f5cc98f33bf08837fdf"
     },
+    {
+      "path": "tests/prose_gated_deps.mjs",
+      "mode": "0000644",
+      "sha256": "5d85d13a0cf1feb3c0aa809841126f4f9e9effe66fc57b5064b612627ce4916f"
+    },
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",

package/.claude/skills/builder-end/SKILL.md

@@ -13,7 +13,7 @@ This is **not** `/builder-exit` — that deactivates an entire builder (releases
 Composes operations that already exist, in a safe order, with the destructive ones gated last:
 
 1. **Resolve the claim** — `/builder-ship` when there's committed, shippable work; `/builder-release` when there isn't. (It calls the sibling skills; it does not re-implement shipping.)
-2. **Clean-git verify** — refuse to go further if any *tracked* file is uncommitted. This is the same guard `scripts/gds/ship.js` enforces (`trackedDirty` in [`src/bongos/ship-preflight.js`](../../../src/bongos/ship-preflight.js)): untracked scratch is ignored, but a modified/staged/deleted tracked file means real work isn't committed — stop before anything is lost.
+2. **Clean-git verify** — refuse to go further if any *tracked* file is uncommitted. This is the same guard `scripts/gds/ship.js` enforces (`trackedDirty` in [`modules/lifecycle/ship-preflight.js`](../../../modules/lifecycle/ship-preflight.js)): untracked scratch is ignored, but a modified/staged/deleted tracked file means real work isn't committed — stop before anything is lost.
 3. **Worktree teardown** — from the main checkout, remove this session's linked worktree via `node scripts/gds/worktree.js remove` (junction-aware), `prune`, and delete the now-merged `claude/<name>` branch.
 
 It never pushes to `main`, never `ssh`-es, never runs a deploy — landing is `/builder-ship`'s job (server-mediated). It only ever touches the caller's **own** claim and **own** worktree.

package/docs/adr/0021-per-builder-skill-model-preferences.md

@@ -93,7 +93,7 @@ If V4 retires per-skill defaults in favor of per-skill-*kind* defaults (the broa
 ## Cross-references
 
 - [Migration 037](../../migrations/037_builder_skill_model_prefs.sql) — the schema change.
-- [`src/bongos/skill-prefs.js`](../../src/bongos/skill-prefs.js) — the helper module and source of truth for defaults.
+- [`modules/builder-settings/skill-prefs.js`](../../modules/builder-settings/skill-prefs.js) — the helper module and source of truth for defaults.
 - [`tests/skill_prefs.mjs`](../../tests/skill_prefs.mjs) — unit coverage for the pure helpers.
 - [ADR 0017](0017-code-simplification-and-repo-cleanliness.md) — same spirit: keep judgment work intentional, mechanism work cheap.
 - CLAUDE.md §2 — the project-wide subagent routing policy this ADR sits beside (not replaces — the policy is the default the matrix opens with).

package/docs/adr/0024-multi-agent-system-architecture.md

@@ -10,7 +10,7 @@
 
 As the GDS opens to multiple builders, three structural risks scale faster than headcount:
 
-1. **The ship-time grader is lenient by construction.** [`src/bongos/grader.js`](../../src/bongos/grader.js) v2 (V3.R18 / [#209](https://example.com/builders#/task/209)) runs a *single* Opus subagent against the diff. Opus wrote the code; Opus grades it. Academic LLM-as-judge work (Zheng et al. 2023, Chiang & Lee 2023) consistently documents ~10–15% same-family inflation. The prompt asks "what score?" rather than "find what's wrong, then decide if it passes" — the default-to-pass framing is the bias. The recorded 14-day passing rate (65/75 = 87%) is suspiciously high for un-calibrated work.
+1. **The ship-time grader is lenient by construction.** [`modules/grading/grader.js`](../../modules/grading/grader.js) v2 (V3.R18 / [#209](https://example.com/builders#/task/209)) runs a *single* Opus subagent against the diff. Opus wrote the code; Opus grades it. Academic LLM-as-judge work (Zheng et al. 2023, Chiang & Lee 2023) consistently documents ~10–15% same-family inflation. The prompt asks "what score?" rather than "find what's wrong, then decide if it passes" — the default-to-pass framing is the bias. The recorded 14-day passing rate (65/75 = 87%) is suspiciously high for un-calibrated work.
 
 2. **Methodology hygiene is reactive.** Documentation drift, dead code, and architectural sprawl are caught (if at all) by `overnight-code-review` and `repo-simplify-sweep` — both downstream of merge, both advisory, both already overfilling. No upstream gate looks at the *system* the way the grader looks at the diff.
 

package/docs/adr/0026-bfg-memory-hygiene-and-cross-builder-learning.md

@@ -22,7 +22,7 @@ This ADR records the architecture and, critically, the **boundaries** that turn
 
 ### What the substrate already gives us
 
-- **Builder memory is server-canonical and per-builder isolated** — [`builder_memory`](../../src/bongos/routes/memory.js), `PRIMARY KEY (builder_id, path)`. The *only* cross-builder access that exists today is an **Archon-only, audit-logged, read-only** forensic path. **There is no cross-builder *write* path at all** — that was a conscious decision ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md), [ADR 0024-memory](0024-cloneable-repo-local-first-memory.md) §4).
+- **Builder memory is server-canonical and per-builder isolated** — [`builder_memory`](../../modules/memory/routes/memory.js), `PRIMARY KEY (builder_id, path)`. The *only* cross-builder access that exists today is an **Archon-only, audit-logged, read-only** forensic path. **There is no cross-builder *write* path at all** — that was a conscious decision ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md), [ADR 0024-memory](0024-cloneable-repo-local-first-memory.md) §4).
 - **Karma** ([`karma_log`](../../migrations/040_builder_karma.sql)) is the existing good-citizenship reputation ledger (append-only, `granted_by` records who drove a delta, `NULL` = system).
 - **Cron roles** live as `SKILL.md` files under [`.claude/scheduled-tasks/`](../../.claude/scheduled-tasks/); the read-only `overnight-code-review` routine is the closest existing pattern.
 

package/docs/adr/0028-honest-llm-spend-accounting.md

@@ -22,7 +22,7 @@ Capture the two sources at **two different seams**, because their cost data live
 
 ### 1. Grader cost — read it from the subprocess envelope (client-side, exact)
 
-`grader.runSubagent` spawns each worker as `claude -p --print --output-format json` ([src/bongos/grader.js](../../src/bongos/grader.js)). With `--output-format json`, the CLI returns a result envelope that includes **`total_cost_usd`** (and a `usage` block) — *verified* on a real call: `{type, …, total_cost_usd: 0.198, usage, modelUsage}`. The old `extractAssistantResult` parsed only `env.result` and **discarded the cost**.
+`grader.runSubagent` spawns each worker as `claude -p --print --output-format json` ([modules/grading/grader.js](../../modules/grading/grader.js)). With `--output-format json`, the CLI returns a result envelope that includes **`total_cost_usd`** (and a `usage` block) — *verified* on a real call: `{type, …, total_cost_usd: 0.198, usage, modelUsage}`. The old `extractAssistantResult` parsed only `env.result` and **discarded the cost**.
 
 > **Correction (made during [#486](https://example.com/builders#/task/486) implementation):** the panel does **not** run server-side. `gradeSubagent` is invoked **client-side in `scripts/gds/ship.js`** (and `conductor-dispatch.js`); the server's `/tasks/:id/grade` route only *validates/scores* the result ship.js POSTs. So there is no in-process DB handle at grade time — the cost is logged over HTTP, exactly like the session path. The substance below (exact envelope cost, no pricing table) is unchanged; only the seam moved from `db.logCost` to `POST /api/gds/cost`.
 

package/docs/adr/0035-builder-onboarding-three-paths.md

@@ -13,7 +13,7 @@ A new builder can reach Example three different ways, but the project has never
 
 1. **The live onboarding contradicts the intended model.** Today the *only* fully-working setup path is the one documented in [`docs/onboarding/primer.md`](../onboarding/primer.md) "Get set up": **accept a GitHub collaborator invite and clone the private repo onto your own disk** — open to *every* rank, including a brand-new Xenos. ADR 0031 §6 says source access should be a *rank-gated, revocable, box-held* boundary. So the live behavior is the exact opposite of the locked design: an unproven newcomer currently gets a permanent local copy of the whole repo. This must be reconciled.
 2. **The box lane is built but has no front door.** ADR 0031 + [#701](https://example.com/builders#/task/701) shipped the whole provisioning spine — `POST /box/ensure`, the intent queue, the control-plane runner, the pairing-link path. But there is no *guided arrival*: nothing tells a non-technical or Chromebook builder, in plain language, "here is your first session, here is what to type, here is how you wait for your box." The capability exists; the on-ramp doesn't.
-3. **Cost exposure is unbounded at the front door.** Anyone with a GitHub account can complete Device-Flow auth and become a Xenos, and a Xenos is above the box provisioning floor (`DEFAULT_PROVISION_FLOOR = 'xenos'`, [`src/bongos/boxes.js`](../../src/bongos/boxes.js)). With [#701](https://example.com/builders#/task/701)'s auto-draining intent queue, a signup could cause a paid droplet (~$24/mo, ~$5/active after auto-park) to be created with **zero human in the loop**. On a $5,000/yr budget that's a real hole.
+3. **Cost exposure is unbounded at the front door.** Anyone with a GitHub account can complete Device-Flow auth and become a Xenos, and a Xenos is above the box provisioning floor (`DEFAULT_PROVISION_FLOOR = 'xenos'`, [`modules/dev-box/boxes.js`](../../modules/dev-box/boxes.js)). With [#701](https://example.com/builders#/task/701)'s auto-draining intent queue, a signup could cause a paid droplet (~$24/mo, ~$5/active after auto-park) to be created with **zero human in the loop**. On a $5,000/yr budget that's a real hole.
 
 ## The three paths (what each *is*, who it's for, how it's gated)
 

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -26,7 +26,7 @@ A box-scoped token still cannot ship. The builder runs **`/builder-reauth`** (th
 
 - `POST /api/gds/tasks/:id/publish-branch` — `auth.requireBuilder` + `gateTaskOwnership` (the same [#871](https://example.com/builders#/task/871) gate as `/grade`/`/confirm`/`/ship`), **deliberately without `auth.allowBoxScope`**, so a box-scoped session is `403 box_scope`. Accepts the branch as a **thin git bundle** (base64, `origin/main..HEAD`), `head_sha`, and `value_summary`. The server: writes the bundle to a per-request temp dir, fast `git clone --bare --local` of its own checkout for `main`'s objects (no network, no worktree touch → never races the `deploy-prod.yml` reset), unbundles, **verifies the bundle tip == the claimed `head_sha`** (binds the pushed code to the already-graded sha), then `git push` to GitHub via a **one-shot `x-access-token:<redacted> URL** (never persisted, never logged — the `box-source-fetch.sh` pattern), opens the PR, and enables auto-merge.
 - `GET /api/gds/tasks/:id/publish-status?branch=…` — ownership-gated; the server derives PR + deploy state live from GitHub so `ship.js` confirms the land WITHOUT `gh` on the box. No DB column added.
-- Implementation: [`src/bongos/github-push.js`](../../src/bongos/github-push.js) (push/PR/status via `execFile` arg-arrays + raw `fetch`, all behind test seams), routes in [`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js), the bundle body bypasses the global 64 KB JSON cap via the skip-list in [`src/bongos/routes.js`](../../src/bongos/routes.js) (route-scoped 32 MB parser + a 20 MB decoded-byte cap).
+- Implementation: [`modules/lifecycle/github-push.js`](../../modules/lifecycle/github-push.js) (push/PR/status via `execFile` arg-arrays + raw `fetch`, all behind test seams), routes in [`modules/lifecycle/routes/tasks.js`](../../modules/lifecycle/routes/tasks.js), the bundle body bypasses the global 64 KB JSON cap via the skip-list in [`src/bongos/routes.js`](../../src/bongos/routes.js) (route-scoped 32 MB parser + a 20 MB decoded-byte cap).
 
 ### 3. `ship.js` chooses the path automatically
 

package/docs/adr/0058-automatic-gate-surface-gatekeeper.md

@@ -46,7 +46,7 @@ The hard floor is the irreducible root of trust: a compromised or prompt-injecte
 
 ## Update — enforcing, and the two server-attestation vectors (task 1142, task 1169)
 
-The gatekeeper went **ENFORCING** (task 1142): `gate-review.yml` no longer sets `GATE_REPORT_ONLY`, and `gate-review` is a required check. The `GATE_AUTHOR_TRUSTED` signal is the `gate-author-trust` **commit status** — set only by the server (which alone holds the authenticated builder's server-resolved rank + the App/PAT credential), so CI reads it but cannot forge it. The server posts it via `githubPush.setCommitStatus` from **two** ship paths, sharing one helper (`postGateAuthorTrust` in [`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js)):
+The gatekeeper went **ENFORCING** (task 1142): `gate-review.yml` no longer sets `GATE_REPORT_ONLY`, and `gate-review` is a required check. The `GATE_AUTHOR_TRUSTED` signal is the `gate-author-trust` **commit status** — set only by the server (which alone holds the authenticated builder's server-resolved rank + the App/PAT credential), so CI reads it but cannot forge it. The server posts it via `githubPush.setCommitStatus` from **two** ship paths, sharing one helper (`postGateAuthorTrust` in [`modules/lifecycle/routes/tasks.js`](../../modules/lifecycle/routes/tasks.js)):
 
 1. **Server-mediated publish** ([ADR 0055](0055-server-mediated-branch-publish.md), dev box / `pushVia 'server'`): `POST /tasks/:id/publish-branch` attests the pushed tip after opening the PR.
 2. **Laptop `ci`-land** (`pushVia 'local'` — task 1169): `ship.js` pushes the branch + opens the PR with the laptop's own `gh` credential, which **cannot** forge the attestation. So `ciLandLocal` calls `POST /tasks/:id/attest-gate` (`requireBuilder` + ownership, deliberately **no** `allowBoxScope`) right **after the push and before opening the PR** — race-free for a fresh PR, since the PR-open is what fires `gate-review` and it runs only after the status is already present. Before task 1169 the laptop path posted *nothing*, so a Metic+ author's gate-surface PR from a laptop was BLOCKED and they could not self-approve their own PR (hit live on task 1162 / PR #131).

package/docs/adr/0059-single-approval-remove-devbox-approval-gate.md

@@ -25,7 +25,7 @@ This **supersedes** [ADR 0035](0035-builder-onboarding-three-paths.md) §2 (Deci
 ## Consequences
 
 - **The member invite becomes the SOLE human gate before a paid (~$24/mo) box is created.** An admitted Xenos can provision their first box hands-off — the spend is bounded by the fact that a human already chose to admit them, not by a second per-box click.
-- **The box provisioning RANK FLOOR still bounds eligibility.** `BOX_PROVISION_MIN_RANK` ([`src/bongos/boxes.js`](../../src/bongos/boxes.js)) is unchanged: the floor is still the rank-side control on who may have a box at all, and the per-builder "one box at a time" invariant (`box_intents` partial unique index, one `builder_boxes` row) is untouched. Removing the *first-box* gate does not widen *who* qualifies; it only removes the second human click for someone already admitted and already above the floor.
+- **The box provisioning RANK FLOOR still bounds eligibility.** `BOX_PROVISION_MIN_RANK` ([`modules/dev-box/boxes.js`](../../modules/dev-box/boxes.js)) is unchanged: the floor is still the rank-side control on who may have a box at all, and the per-builder "one box at a time" invariant (`box_intents` partial unique index, one `builder_boxes` row) is untouched. Removing the *first-box* gate does not widen *who* qualifies; it only removes the second human click for someone already admitted and already above the floor.
 - **Migration 102 reverts the schema** introduced by migration 071 — the `pending_approval` box-intent state (and any approval-tracking column) is removed; in-flight first-box intents are migrated to `pending` so the runner drains them.
 - **The box-panel "awaiting approval" UI state is removed** — `/builder-box` and the hall box panel no longer surface "your box is awaiting approval," because no box waits.
 - **The `#box-approvals` Discord channel + its box-intent approve/deny wiring are removed** (the box half of [ADR 0057](0057-discord-archon-approval-channels.md)). `#member-approvals` and the admission approve/dismiss wiring stay — admission is still the gate.

package/docs/adr/0060-gds-retrieval-layer.md

@@ -67,7 +67,7 @@ Results are fused with **Reciprocal Rank Fusion** (RRF: `score = Σ 1/(k + rank_
 
 ### 6. Scoping — per-chunk `min_rank` + owner, server-enforced (V4.R12 / [#950](https://example.com/builders#/task/950))
 
-This is the load-bearing security property, mirroring [`src/bongos/routes/memory.js`](../../src/bongos/routes/memory.js)'s posture:
+This is the load-bearing security property, mirroring [`modules/memory/routes/memory.js`](../../modules/memory/routes/memory.js)'s posture:
 
 - Every query is filtered **in the SQL WHERE clause** (not post-hoc in JS) by the caller's **live, server-resolved rank** (`req.builder.rank`, read fresh per request — never from input): `min_rank` must be ≤ the caller's rank in the ladder.
 - A chunk with a non-null `owner_builder_id` (a per-builder private chunk, e.g. memory) is returned **only** to that owner — `owner_builder_id IS NULL OR owner_builder_id = req.builder.id`. There is no parameter to name another builder; the owner is always the authenticated session.

package/docs/adr/0070-deterministic-session-card-delivery.md

@@ -25,7 +25,7 @@ Make card **delivery** deterministic via hooks, and split the vehicle by whether
 
 1. **Read-only cards** (`/builder-start`, `/status`; future: `/recall`) → **[`session-cards.js`](../../.claude/hooks/session-cards.js)**, a `UserPromptSubmit` hook. On a matching intent it runs the script's `--hook` mode, which emits a one-fetch JSON envelope `{widgets_enabled, html, markdown, warnings}`, and injects the finished card + a one-step "render this once" directive. Registry-driven: adding a read-only card is one `CARDS` entry (a matcher, a script, an arg-extractor). Safe to pre-run because these scripts only fetch + render.
 
-2. **Mutating / lifecycle cards** (`/builder-claim`, `/builder-ship`; `release` matched, emits none today) → **[`lifecycle-card.js`](../../.claude/hooks/lifecycle-card.js)**, a `PostToolUse`/Bash hook. These **must never be pre-run** — claiming or shipping as a side effect of merely typing would be catastrophic. Instead the model runs the script itself; the hook fires immediately after, reads the `[otb-card-html] <path>` marker the shared emitter ([`src/bongos/ship-card.js`](../../src/bongos/ship-card.js)) wrote, reads that file, and injects the card + directive next to the tool result.
+2. **Mutating / lifecycle cards** (`/builder-claim`, `/builder-ship`; `release` matched, emits none today) → **[`lifecycle-card.js`](../../.claude/hooks/lifecycle-card.js)**, a `PostToolUse`/Bash hook. These **must never be pre-run** — claiming or shipping as a side effect of merely typing would be catastrophic. Instead the model runs the script itself; the hook fires immediately after, reads the `[otb-card-html] <path>` marker the shared emitter ([`modules/lifecycle/ship-card.js`](../../modules/lifecycle/ship-card.js)) wrote, reads that file, and injects the card + directive next to the tool result.
 
 Both hooks honor the task-1279 widgets knob (OFF ⇒ no HTML injected, the plain-text card stands), carry **exactly two** fence markers around each payload (no extraction ambiguity), and follow the standard hook discipline: silent-fail (any miss/parse/IO error → exit 0, no output), zero model calls, a kill-switch (`OTB_SESSION_CARDS_OFF`) and the `OTB_SUBAGENT` guard. The skills (`builder-start`, `status`, `builder-claim`, `builder-ship`) are slimmed to **defer to the injected directive**, keeping their old run-the-script logic as the fallback when no directive appears (hook disabled, an older checkout, or a silent failure).
 

package/docs/adr/0073-builder-needs-signal-and-byok-gemini-key.md

@@ -23,7 +23,7 @@ Two coupled pieces: a **reusable signal** (the general mechanism the owner asked
 
 ### 1. The `needs` signal — one consistent way to flag a required input
 
-A new pure module, [`src/bongos/builder-needs.js`](../../src/bongos/builder-needs.js), is a small **registry**. Each thing the system needs from a builder to run a capability — today the Gemini image key; tomorrow a Stripe key, a first-party Anthropic link, … — is one `(ctx) => need|null` entry. The server computes the live list on `GET /api/gds/me` (`needs: { items, action_needed_count, has_action_needed }`); every surface renders the **same** shape. Adding a future input is one registry entry — the renderers don't change.
+A new pure module, [`modules/builder-settings/builder-needs.js`](../../modules/builder-settings/builder-needs.js), is a small **registry**. Each thing the system needs from a builder to run a capability — today the Gemini image key; tomorrow a Stripe key, a first-party Anthropic link, … — is one `(ctx) => need|null` entry. The server computes the live list on `GET /api/gds/me` (`needs: { items, action_needed_count, has_action_needed }`); every surface renders the **same** shape. Adding a future input is one registry entry — the renderers don't change.
 
 A need is always in exactly one of three states:
 

package/docs/adr/0081-tool-agnostic-design-layer.md

@@ -9,7 +9,7 @@ Developers collaborate through Git because code is text: it diffs line-by-line a
 Three forces made this worth deciding now:
 
 1. **UI is becoming real work.** Today the GDS has three disciplines — `engineer | artist | ideator` — and "design/figma/UI" tasks fall into `artist`, the pixel-art lane. UI (HUD, menus, the builders' hall, status dashboard, landing pages) is a different problem from world tiles and deserves its own lane.
-2. **The grader is secretly two systems.** The GDS ship pipeline (`confirm → grade → merge → deploy → credits`) does **not** branch by discipline — every task rides the same rails. But the *grade* step is the code panel [`grader.js`](../../src/bongos/grader.js) (reads a git diff; scores code quality), while pixel art is really gated by a *separate* Gemini vision pipeline ([`art/pipeline/review.py`](../../art/pipeline/review.py)) that runs **upstream** in `/paint`, not at ship. Art passes the ship-time grader as a near-rubber-stamp because a text-only panel can't see pixels. Two grader codebases is a maintenance trap.
+2. **The grader is secretly two systems.** The GDS ship pipeline (`confirm → grade → merge → deploy → credits`) does **not** branch by discipline — every task rides the same rails. But the *grade* step is the code panel [`grader.js`](../../modules/grading/grader.js) (reads a git diff; scores code quality), while pixel art is really gated by a *separate* Gemini vision pipeline ([`art/pipeline/review.py`](../../art/pipeline/review.py)) that runs **upstream** in `/paint`, not at ship. Art passes the ship-time grader as a near-rubber-stamp because a text-only panel can't see pixels. Two grader codebases is a maintenance trap.
 3. **Claude Design changed the calculus.** [Claude Design](https://www.anthropic.com/news/claude-design-anthropic-labs) (Anthropic Labs, beta, 2026) **writes code and renders it** — it has no vector canvas. Its output is HTML/CSS/JS, and its June 2026 update added tight Claude Code sync (`/design-sync` imports a repo's design system in; a finished design hands off to Claude Code "where the designer left off"). So for Claude Design, *design is code* — it merges like any other code.
 
 Owner (Lars) requirements, reached in the 2026-06-21 design conversation:
@@ -40,7 +40,7 @@ Owner (Lars) requirements, reached in the 2026-06-21 design conversation:
 - **Designers keep Figma.** Manual Figma edits are first-class for structured/design-system changes and round-trip into the repo via a normal GDS task + the same grader. The honest limit: the Figma→code round-trip is lossy for arbitrary canvas art — that work becomes a committed asset, not round-tripped code.
 - **One grader to maintain, not two.** The standalone Gemini review path is retired into the unified engine. Code doesn't auto-regen today (a failed grade = human fixes + re-ships); unifying gives every type the same generate→grade→regenerate loop.
 - **Graphics is unchanged.** World pixel art stays on the Claude Code + Gemini pipeline; Figma stays its viewer ([`otb-figma-sync`](../../.claude/skills/otb-figma-sync/SKILL.md)). This ADR adds the `ui` lane beside it, it does not disturb the art pipeline.
-- **Gate-review floor applies.** [#1380](https://example.com/builders#/task/1380) touches [`grader.js`](../../src/bongos/grader.js) + [`ship.js`](../../scripts/gds/ship.js) — the gate-review **hard floor** ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)). It needs owner Gate approval even for Archon, and the multimodal call path wants a security review.
+- **Gate-review floor applies.** [#1380](https://example.com/builders#/task/1380) touches [`grader.js`](../../modules/grading/grader.js) + [`ship.js`](../../scripts/gds/ship.js) — the gate-review **hard floor** ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)). It needs owner Gate approval even for Archon, and the multimodal call path wants a security review.
 
 ## Rejected alternatives
 

package/docs/adr/0086-goal-scoped-work-hierarchy.md

@@ -12,7 +12,7 @@
 
 ## Context
 
-Today only the Archon can create or edit tasks — `POST /tasks` and `PATCH /tasks/:id` are both `requireRank('archon')` ([`src/bongos/routes/tasks.js`](../../src/bongos/routes/tasks.js)). Lower-ranking builders (`xenos`, `thetes`) can only **file ideas** into `idea_inbox`; they have no ability to shape their own work toward an objective.
+Today only the Archon can create or edit tasks — `POST /tasks` and `PATCH /tasks/:id` are both `requireRank('archon')` ([`modules/lifecycle/routes/tasks.js`](../../modules/lifecycle/routes/tasks.js)). Lower-ranking builders (`xenos`, `thetes`) can only **file ideas** into `idea_inbox`; they have no ability to shape their own work toward an objective.
 
 > **Update (2026-06-26, [ADR 0090](0090-metic-task-authoring.md)):** `POST /tasks` / `PATCH /tasks/:id` are now `requireRank('metic','archon')` — a *Metic* may author tasks directly. This ADR's goal-scoped, module-fenced authoring path (`POST /goals/:id/tasks`) is now the mechanism for **sub-Metic** ranks (`xenos`/`thetes`) specifically; everything below about the scope-subset wall and protected-path block is unchanged and still governs that path. Every task must be hand-authored by the owner first — a delegation bottleneck that wastes capable builders' judgment, and the opposite of the AI-first norm where agents do the building.
 
@@ -54,7 +54,7 @@ The tier set is host-configured, not hardcoded — the [ADR 0062](0062-medusa-in
 ### 3. Bounded task authoring (membership grants it; the create-time gate)
 
 - **`POST /goals`** — `requireRank('metic','archon')`; **Archon-only when `scope_modules` includes a `protected` module.**
-- **`POST /goals/:id/join` / `leave`** — open join for normal goals; **joining a sensitive-scope goal needs Archon approval** (reuse the access-request pattern, [`access-requests.js`](../../src/bongos/routes/access-requests.js)).
+- **`POST /goals/:id/join` / `leave`** — open join for normal goals; **joining a sensitive-scope goal needs Archon approval** (reuse the access-request pattern, [`access-requests.js`](../../modules/onboarding/routes/access-requests.js)).
 - **`POST /goals/:id/tasks`** — `requireBuilder` + an in-handler gate (the maneuverability grant), ordered + fail-closed: goal `open` and **caller is a member** (or Archon); version guards reused from `POST /tasks`; **scope subset** — every `touches[]` element covered by the goal's `scope_modules` globs (`touchesOverlap`, [`path-match.js`](../../src/bongos/path-match.js)); **protected-path block** — `checkPermissionPaths` ([`permission-path-check.js`](../../src/bongos/permission-path-check.js)) so a sub-Metic member cannot author a task touching the protected core; then `db.createTask` stamping `goal_id`. `POST /tasks` / `PATCH /tasks/:id` stay byte-identical (Archon-only) for ungoverned creation.
 - **Rank floor is auto-derived, not a bespoke cap.** Per [ADR 0084](0084-auto-derived-per-task-rank-floor.md), a created task's `requires_rank` is auto-derived from its touches + sensitivity (`deriveRequiredRank` → `metic` for protected/sensitive, else `xenos`) and can only be raised. So a goal member need not (and cannot) self-set a rank that escapes their own gate — and a sensitive task auto-floors to `metic`, which a sub-Metic author could not claim. No new cap mechanism; this composes with the one that already exists.
 
@@ -78,7 +78,7 @@ The tier set is host-configured, not hardcoded — the [ADR 0062](0062-medusa-in
 
 ### 7. How the boundary holds (reuse + defense-in-depth)
 
-The create-time gate sees only *declared* touches (advisory — git merge is the real collision detector, [ADR 0049](0049-split-parallel-safety-contract.md)), so it is the first filter, **not** the enforcement boundary. The existing **ship-time gates remain authoritative on the real diff**: the grader's `permissionPathPrePass`/`routeRankPrePass` + `serverSideGuards` ([`grader.js`](../../src/bongos/grader.js)), the `gate-review` ESCALATE floor, and the post-push `main-audit`. A mis-declared task still cannot *merge* if its real diff hits protected paths. Two CI fitness checks ([`fitness.js`](../../scripts/gds/fitness.js)) guard drift: goal routes are pinned in `route-rank-check.EXPECTED_RANKS`, and the scope code must *import* `PROTECTED_GLOBS`, never re-declare it.
+The create-time gate sees only *declared* touches (advisory — git merge is the real collision detector, [ADR 0049](0049-split-parallel-safety-contract.md)), so it is the first filter, **not** the enforcement boundary. The existing **ship-time gates remain authoritative on the real diff**: the grader's `permissionPathPrePass`/`routeRankPrePass` + `serverSideGuards` ([`grader.js`](../../modules/grading/grader.js)), the `gate-review` ESCALATE floor, and the post-push `main-audit`. A mis-declared task still cannot *merge* if its real diff hits protected paths. Two CI fitness checks ([`fitness.js`](../../scripts/gds/fitness.js)) guard drift: goal routes are pinned in `route-rank-check.EXPECTED_RANKS`, and the scope code must *import* `PROTECTED_GLOBS`, never re-declare it.
 
 ### Deferred (explicit non-decisions)
 
@@ -104,7 +104,7 @@ Each phase ships independently; implementing tasks are created via `/planning-se
 
 ## Alternatives considered
 
-- **Reuse `parent_task_id` for goals (a goal = a parent task) — rejected.** One-level cap ([`hierarchy.js`](../../src/bongos/hierarchy.js)), wrong lifecycle (a goal is a standing grant, not shippable work that earns credit on ship), and a task has no place for scope or membership.
+- **Reuse `parent_task_id` for goals (a goal = a parent task) — rejected.** One-level cap ([`hierarchy.js`](../../modules/lifecycle/hierarchy.js)), wrong lifecycle (a goal is a standing grant, not shippable work that earns credit on ship), and a task has no place for scope or membership.
 - **Reuse `done_when_criteria` as goals — rejected.** That table *is* the criteria tier; overloading it with membership + a creation grant conflates "definition of done" with "who may do work." A goal *links to* criteria; it is not one.
 - **Single-owner goals — rejected** (Lars). Goals are shared workspaces; a single assignee would force mega-claims and block collaboration. Membership grants the authority; contribution (not membership alone) is what any future reward weights on.
 - **A bespoke per-task rank cap at goal-create — rejected in favour of [ADR 0084](0084-auto-derived-per-task-rank-floor.md).** The auto-derived floor already prevents a member minting a task that escapes their gate; a second mechanism would be a second list that drifts (the SEC [#863](https://example.com/builders#/task/863) failure mode).

package/docs/adr/0117-api-versioning-and-deprecation-policy.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-07-04
 **Status:** Accepted (policy; R05 of goal 36).
-**Context:** [task 1992](https://builders.example.com#/task/1992) (BONGOS-V1, goal 36 "Robust, versioned, easy-to-call public API", criterion `api-versioning`). This is the **policy**; the mount + aliasing that implements it is R06 ([task 1993](https://builders.example.com#/task/1993)). Builds on the API-prefix chokepoint ([`src/gds/api-prefix.js`](../../src/gds/api-prefix.js), task 1918/1919), the self-describing OpenAPI + hosted `/docs` ([ADR 0109](0109-self-describing-openapi-and-hosted-docs.md)), and the docs-discovery contract ([ADR 0114](0114-instance-docs-discovery-contract.md)).
+**Context:** [task 1992](https://builders.example.com#/task/1992) (BONGOS-V1, goal 36 "Robust, versioned, easy-to-call public API", criterion `api-versioning`). This is the **policy**; the mount + aliasing that implements it is R06 ([task 1993](https://builders.example.com#/task/1993)). Builds on the API-prefix chokepoint ([`src/bongos/api-prefix.js`](../../src/bongos/api-prefix.js), task 1918/1919), the self-describing OpenAPI + hosted `/docs` ([ADR 0109](0109-self-describing-openapi-and-hosted-docs.md)), and the docs-discovery contract ([ADR 0114](0114-instance-docs-discovery-contract.md)).
 
 ## Problem
 

package/docs/module-api-changelog.md

@@ -2114,5 +2114,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.818 with no explicit bump. run 35206448426. (task 1002620)
   1.19.820 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.819 with no explicit bump. run 35209838815. (task 1002620)
+  1.19.821 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.820 with no explicit bump. run 35212866365. (task 1002620)
+  1.19.822 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.821 with no explicit bump. run 35213847140. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/multi-builder-merge.md

@@ -14,7 +14,7 @@ This recipe is the audit deliverable for [#269](https://example.com/builders#/ta
 - **Claim side is already deterministic.** `claimTask()` runs in a single transaction with `SELECT … FOR UPDATE` on the task row, a touches-overlap check, and the `uniq_active_claim_per_task` partial unique index. A lost race surfaces as `ALREADY_CLAIMED` (Postgres `23505`), never as corruption. No change needed.
 - **Merge side is the risk, and it has ONE shared resource:** the single `main` worktree (`REPO_ROOT`) on the build machine. Every ship's auto-merge and every `/merge-mode` run checks out `main`, fetches, merges, pushes, and deploys *there*.
 - **[#462](https://example.com/builders#/task/462) (criterion C4)** added a lockfile so two concurrent **ships** couldn't collide — but the lock lived *inside* `ship.js`, so `/merge-mode` (which mutates the same tree by hand) never took it. That left two races open: **ship-vs-merge-mode** and **merge-mode-vs-merge-mode**.
-- **[#269](https://example.com/builders#/task/269) (this task)** extracts the lock into [`src/bongos/merge-lock.js`](../../src/bongos/merge-lock.js) and has **both** surfaces acquire the **same** mutex. `/merge-mode` takes it via the [`scripts/gds/merge-lock.js`](../../scripts/gds/merge-lock.js) CLI before it touches `main`, and releases it after deploy.
+- **[#269](https://example.com/builders#/task/269) (this task)** extracts the lock into [`modules/lifecycle/merge-lock.js`](../../modules/lifecycle/merge-lock.js) and has **both** surfaces acquire the **same** mutex. `/merge-mode` takes it via the [`scripts/gds/merge-lock.js`](../../scripts/gds/merge-lock.js) CLI before it touches `main`, and releases it after deploy.
 
 ---
 
@@ -48,7 +48,7 @@ This recipe is the audit deliverable for [#269](https://example.com/builders#/ta
 
 ## The mutex, precisely
 
-[`src/bongos/merge-lock.js`](../../src/bongos/merge-lock.js) is a portable, advisory file lock at `<REPO_ROOT>/.git/otb-automerge.lock`. **Not `flock(2)`** — ships run on macOS over an iCloud-synced filesystem where `flock` is unreliable, and the manual `/merge-mode` holder is a short-lived CLI process with no long-lived owner.
+[`modules/lifecycle/merge-lock.js`](../../modules/lifecycle/merge-lock.js) is a portable, advisory file lock at `<REPO_ROOT>/.git/otb-automerge.lock`. **Not `flock(2)`** — ships run on macOS over an iCloud-synced filesystem where `flock` is unreliable, and the manual `/merge-mode` holder is a short-lived CLI process with no long-lived owner.
 
 Lockfile format (3 lines): `pid` · `epoch-ms timestamp` · `mode` (`auto` | `manual`).
 

package/docs/recipes/search-index-ingestion.md

@@ -2,11 +2,11 @@
 
 How the `search_chunks` index (the recall layer, [ADR 0060](../adr/0060-gds-retrieval-layer.md)) gets populated from repo markdown, and how to operate it. Read before touching `scripts/gds/search-ingest-md.js` or the deploy hook.
 
-> The query side is [`src/bongos/search.js`](../../src/bongos/search.js) + [`POST /api/gds/search`](../../src/bongos/routes/search.js) ([#949](https://example.com/builders#/task/949)); rank/owner scoping + its isolation suite are [#950](https://example.com/builders#/task/950). Ingestion has two halves: **repo markdown** (this recipe's first sections — [#947](https://example.com/builders#/task/947), the deploy hook) and **DB prose** (the [DB-prose nightly](#db-prose-nightly-timer) section below — [#948](https://example.com/builders#/task/948), a systemd timer).
+> The query side is [`modules/memory/search.js`](../../modules/memory/search.js) + [`POST /api/gds/search`](../../modules/memory/routes/search.js) ([#949](https://example.com/builders#/task/949)); rank/owner scoping + its isolation suite are [#950](https://example.com/builders#/task/950). Ingestion has two halves: **repo markdown** (this recipe's first sections — [#947](https://example.com/builders#/task/947), the deploy hook) and **DB prose** (the [DB-prose nightly](#db-prose-nightly-timer) section below — [#948](https://example.com/builders#/task/948), a systemd timer).
 
 ## What it does
 
-`node scripts/gds/search-ingest-md.js` walks the repo's markdown (~226 files), chunks each file via the heading-aware chunker ([`src/bongos/search-chunker.js`](../../src/bongos/search-chunker.js)), and upserts the chunks into `search_chunks`:
+`node scripts/gds/search-ingest-md.js` walks the repo's markdown (~226 files), chunks each file via the heading-aware chunker ([`modules/memory/search-chunker.js`](../../modules/memory/search-chunker.js)), and upserts the chunks into `search_chunks`:
 
 - **Delta-driven.** Each chunk's `content_hash` (sha256 of its body) is the change key. The upsert's `ON CONFLICT … DO UPDATE … WHERE content_hash IS DISTINCT FROM EXCLUDED.content_hash` makes an unchanged chunk a **no-op** (no row rewrite). A re-run over an unchanged tree writes nothing.
 - **Prunes shrinkage.** If a file loses sections, chunks beyond the new count are deleted; if a file is removed from the tree entirely, all its chunks are deleted (`source_kind='doc' AND source_ref NOT IN (present)`).

package/modules/lifecycle/dead-deps.js

@@ -198,7 +198,148 @@ function findStrandedTasks(tasks) {
   return out;
 }
 
+// ---- PROSE-DECLARED GATES (task 1003857) -----------------------------------
+//
+// Everything above reads the STRUCTURED graph — blocked_by edges. A gate written
+// in a task's DESCRIPTION is entirely unpoliced, and they go stale the same way:
+// task 1002839 (ready) names "existing open task 1001380" as a precondition, and
+// 1001380 was abandoned on 2026-08-18, superseded by ADR 0089. A builder opening
+// 1002839 is told to coordinate with a task that does not exist, and told it is open.
+//
+// ADVISORY, NEVER A GATE. A prose match is weaker evidence than an edge: the text
+// may be history ("this replaces task N"), a citation, or simply wrong. It reports
+// candidates for a human to read and must never refuse a claim — that is the
+// difference between this and DEAD_DEP_STATUSES above, and it is deliberate.
+//
+// PRECISION COMES FROM THE VERB, NOT THE ID. Matching "any abandoned id in the
+// body" is the mistake that made the sibling supersession scan unusable (idea
+// 1000807: ~44 hits, nearly all citations). So an id counts only when a GATE PHRASE
+// governs it within a short window — needs / depends on / blocked by / gated on /
+// requires / after / prereq — and the window is small enough that a paragraph
+// mentioning a gate and, separately, an id does not join them up.
+// TWO PHRASINGS, because the live evidence has both — and the second is the one the
+// filing task's own example actually uses.
+//
+//   A GATE: 'needs task N', 'blocked by N', 'depends on N'.
+//   A LIVENESS ASSERTION: 'existing OPEN task N', 'task N is ready to claim'.
+//
+// Task 1002839 — the live instance the task names — reads "and existing open task
+// 1001380 covers overlapping ground". That is not a dependency; it is a claim that
+// 1001380 is OPEN, and 1001380 was abandoned on 2026-08-18. A gate-only matcher
+// missed it, which I found by measuring rather than by reading the spec: the first
+// version returned it only because a 'needs' in the PREVIOUS clause leaked across a
+// semicolon, and tightening that correctly dropped it.
+//
+// Both shapes send a builder to a task that is not there, which is the harm. Only
+// the liveness one also states something false on its face.
+const GATE_PHRASE_RE = /\b(?:needs?|depends?\s+on|dependent\s+on|blocked\s+by|blocks?|gated\s+on|gates?|requires?|required\s+by|prereq(?:uisite)?s?|precondition|waits?\s+on|waiting\s+on|after)\b/i;
+
+// 'open task N', 'existing open task N', 'still-open task N', 'the open task N'.
+// Anchored to the id's immediate left so a paragraph that says 'open' somewhere does
+// not qualify every id in it.
+const LIVENESS_BEFORE_RE = /\b(?:still[-\s]+)?open\s+(?:task\s+)?#?$/i;
+// 'task N is ready to claim', 'task N is still open', 'task N remains open'.
+const LIVENESS_AFTER_RE = /^\s*(?:\([^)]{0,80}\)\s*)?(?:is|remains|stays)\s+(?:still\s+)?(?:open|ready\s+to\s+claim|unclaimed|in\s+flight)\b/i;
+
+// How far after a gate phrase an id still counts as governed by it. Sized to span
+// 'needs the existing open task 1001380 to land first', not a whole paragraph.
+const GATE_WINDOW = 80;
+
+// A task id in prose. Two forms, and the second is the trap.
+//
+//   LIVE form   — 6-7 digits: 'existing open task 1001380'.
+//   SHORT form  — the PRE-OFFSET ref this project used before the import, written as
+//                 `#528` or 'task 528'. Task 1000528's own gate is written that way,
+//                 and it is the case that motivated the original row — so a live-id
+//                 match misses precisely the instance this exists to find.
+//
+// The short form is only recognised with an explicit `task ` / `#` prefix. A bare
+// 3-digit number in prose is a count, a line number or a year far more often than it
+// is a task, and this runs over every description on the board.
+const ID_RE = /(?:\btask\s+|#)(\d{1,5})\b|(?:\btask\s+|#)?(\d{6,7})\b/g;
+
+// The id spaces to probe, newest first. Same precedent as diagram-facts.js: the import
+// shifted every id by 1,000,000, so a pre-offset ref resolves by adding the offset.
+const IMPORT_ID_OFFSETS = [0, 1_000_000];
+
+// PURE — every id a single textual ref could mean, most likely first. A short ref
+// yields the offset candidate too; a live-width ref is already resolved.
+function idCandidates(raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n <= 0) return [];
+  // A ref already in the LIVE width is resolved - probing an offset on it would invent
+  // a second id that is not what the text says (1001380 + 1e6 = 2001380, a row nobody
+  // wrote). The offset probe exists for the SHORT pre-offset form only.
+  if (String(n).length >= 6) return [String(n)];
+  const out = [];
+  for (const off of IMPORT_ID_OFFSETS) {
+    const cand = String(n + off);
+    // Only offer a candidate that could BE an id: the live space is 6-7 digits.
+    if (cand.length >= 6 && cand.length <= 7 && !out.includes(cand)) out.push(cand);
+  }
+  return out;
+}
+
+// Ids that share the integer space but are NOT tasks. Measured, not guessed: the
+// first run of this over the live board returned two hits and one was task 1002844's
+// 'Source: idea 1000454' — an idea citation, whose id happens to look like a task's.
+// Reporting it would have sent a human to look up a task that does not exist, which
+// is the very failure this detector exists to stop.
+const OTHER_ENTITY_RE = /\b(?:idea|blocker|report|learning|claim|builder|goal|version|PR|pull\s+request)\s+#?$/i;
+
+// PURE — the ids this text appears to declare a GATE on. Exported so the rule is
+// testable without a DB: the risk here is a matcher that quietly matches nothing (a
+// clean report) or everything (a report nobody reads).
+function proseGatedIds(text) {
+  const src = String(text || '');
+  const out = new Set();
+  for (const m of src.matchAll(ID_RE)) {
+    const rawId = m[1] || m[2];
+    const before = src.slice(Math.max(0, m.index - GATE_WINDOW), m.index);
+    // An id belonging to another entity is not a task gate, whatever governs it.
+    if (OTHER_ENTITY_RE.test(before)) continue;
+    // The window stops at a SENTENCE BOUNDARY. Also measured: the same false
+    // positive had 'needs' in the preceding sentence ('…the first thing that task
+    // needs. Source: idea 1000454'), so a fixed-width window let a verb govern across
+    // a full stop. A gate and its id belong to one sentence.
+    // A liveness assertion binds TIGHTLY to the id on either side, so it needs no
+    // window and no sentence rule.
+    const after = src.slice(m.index + m[0].length, m.index + m[0].length + 60);
+    if (LIVENESS_BEFORE_RE.test(before) || LIVENESS_AFTER_RE.test(after)) { for (const c of idCandidates(rawId)) out.add(c); continue; }
+    // A GATE may be a few words back, but the window stops at a SENTENCE BOUNDARY:
+    // measured, a fixed-width window let 'needs' govern across a full stop and a
+    // semicolon into an unrelated clause.
+    const lastStop = Math.max(before.lastIndexOf('. '), before.lastIndexOf('\n'), before.lastIndexOf('; '));
+    const governing = lastStop === -1 ? before : before.slice(lastStop + 1);
+    // Only the text BEFORE the id, so 'task 1001380 needs review' is not read as a
+    // gate ON 1001380 — the verb has to govern the id, not follow it.
+    if (GATE_PHRASE_RE.test(governing)) for (const c of idCandidates(rawId)) out.add(c);
+  }
+  return out;
+}
+
+// PURE — live tasks whose PROSE names a dead task as a gate. `tasks` are rows with
+// { id, status, description }; `statusById` answers what an id's status is.
+// Deliberately mirrors findStrandedTasks' shape so audit-deps can print one answer
+// to "what is stranded" rather than two.
+function findProseGatedTasks(tasks, statusById) {
+  const out = [];
+  for (const t of Array.isArray(tasks) ? tasks : []) {
+    if (!t || !LIVE_STATUSES.has(String(t.status))) continue;
+    const dead = [];
+    for (const id of proseGatedIds(t.description)) {
+      if (String(id) === String(t.id)) continue; // a task citing itself is not a gate
+      const st = statusById(id);
+      if (st && DEAD_DEP_STATUSES.has(String(st))) dead.push({ id: String(id), status: String(st) });
+    }
+    if (dead.length) out.push({ task_id: t.id, status: t.status, title: t.title, prose_dead_deps: dead.sort((a, b) => Number(a.id) - Number(b.id)) });
+  }
+  return out;
+}
+
 module.exports = {
   DEAD_DEP_STATUSES, LIVE_STATUSES,
   absorbedInto, depRefusalRow, splitDeadDeps, deadDepHint, findStrandedTasks,
+  proseGatedIds, findProseGatedTasks, idCandidates, GATE_PHRASE_RE, GATE_WINDOW, OTHER_ENTITY_RE,
+  LIVENESS_BEFORE_RE, LIVENESS_AFTER_RE, IMPORT_ID_OFFSETS,
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.820",
+  "version": "1.19.822",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.820",
+      "version": "1.19.822",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.820",
+  "version": "1.19.822",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/audit-deps.js

@@ -17,14 +17,15 @@
 // gate's notion of "overlap".
 //
 //   node scripts/gds/audit-deps.js [--version GDS-V3] [--min high|medium|low] [--json]
-//   node scripts/gds/audit-deps.js --stranded [--json]   # the INVERSE: dead edges (task 1003153)
+//   node scripts/gds/audit-deps.js --stranded [--json]   # the INVERSE: dead edges (task 1003153),
+//                                                      # plus prose-declared gates naming a dead task (task 1003857, advisory)
 
 const { touchesOverlap } = require('../../src/bongos/path-match.js');
 const { cliClient } = require('./cli-lib');
 const { resolveDefaultVersion } = require('./version-select.js');
 // task 1003153 — the DEAD-edge detector core, shared with the claim refusal so
 // "abandoned dependency" means one thing across the CLI, the route and this audit.
-const { findStrandedTasks } = require('../../modules/lifecycle/dead-deps.js');
+const { findStrandedTasks, findProseGatedTasks } = require('../../modules/lifecycle/dead-deps.js');
 // task 1003752 — the route's page bound + the first-page offset rule, declared once.
 const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
 
@@ -129,6 +130,16 @@ async function reportStranded({ asJson }) {
     process.exit(1);
   }
   const stranded = findStrandedTasks(all);
+  // task 1003857: the same question asked of PROSE. The structured graph above
+  // reads blocked_by edges; a gate written in a description is unpoliced, and stales
+  // identically — task 1002839 told a builder to coordinate with "existing open task
+  // 1001380", abandoned since 2026-08-18. Reported HERE rather than in a second tool
+  // so there is one answer to "what is stranded".
+  const statusById = (() => {
+    const byId = new Map(all.map((t) => [String(t.id), String(t.status)]));
+    return (id) => byId.get(String(id)) || null;
+  })();
+  const proseGated = findProseGatedTasks(all, statusById);
 
   // Context worth stating even at zero: abandoned tasks that still CARRY
   // dependents are the latent trap. They report clean only because every
@@ -139,7 +150,10 @@ async function reportStranded({ asJson }) {
   }
 
   if (asJson) {
-    console.log(JSON.stringify({ stranded, abandoned_deps_with_dependents: [...gatingAbandoned] }, null, 2));
+    console.log(JSON.stringify({ stranded, prose_gated: proseGated, abandoned_deps_with_dependents: [...gatingAbandoned] }, null, 2));
+    // ADVISORY: a prose match never changes the exit code. It is weaker evidence than
+    // an edge — the text may be history, a citation, or simply wrong — so it reports
+    // candidates for a human and must not gate a sweep or a CI leg.
     return stranded.length ? 1 : 0;
   }
   console.log(`audit-deps --stranded: ${all.length} task(s) scanned — ${stranded.length} LIVE task(s) stranded by an abandoned dependency\n`);
@@ -149,6 +163,14 @@ async function reportStranded({ asJson }) {
     console.log(`           fix: drop the edge (DELETE /dependencies {"from_kind":"task","from_id":${s.task_id},"to_kind":"task","to_id":${s.dead_deps[0].id}})`);
     console.log(`             or restore the dep (POST /tasks/${s.dead_deps[0].id}/promote)\n`);
   }
+  if (proseGated.length) {
+    console.log(`Prose-declared gates naming a dead task: ${proseGated.length} (ADVISORY — a human reads these; they never gate a claim)\n`);
+    for (const p of proseGated) {
+      console.log(`[PROSE]    #${p.task_id} [${p.status}]  ${(p.title || '').slice(0, 70)}`);
+      for (const d of p.prose_dead_deps) console.log(`           body names → #${d.id} [${d.status}]`);
+      console.log('           fix: correct the sentence (PATCH /tasks/' + p.task_id + ' {"description":…}), or promote the named task if the gate is real\n');
+    }
+  }
   if (!stranded.length) {
     console.log('Nothing stranded — no live task is gated by an abandoned dependency.');
     console.log(`Latent exposure: ${gatingAbandoned.size} abandoned task(s) still carry dependents; they read clean only`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.820'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.822'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/prose_gated_deps.mjs

@@ -0,0 +1,139 @@
+// tests/prose_gated_deps.mjs — a gate written in a task's DESCRIPTION goes stale the
+// same way an edge does, and nothing was watching (task 1003857).
+//
+// The structured detector (task 1003153) reads blocked_by edges and never touches a
+// description. Task 1002839 sat at `ready` telling a builder to coordinate with
+// "existing open task 1001380" — abandoned since 2026-08-18, superseded by ADR 0089.
+//
+// EVERY REGEX HERE WAS SIZED BY MEASUREMENT, not by reading the spec, and the cases
+// below are the measurements. The first cut over the live board (3,647 tasks) returned
+// two hits and BOTH taught something: one was an `idea` id wearing a task-shaped
+// number, and the true positive only matched because a verb leaked across a semicolon.
+// Tightening that correctly dropped the true positive too — which is how the liveness
+// phrasing was found, because the real sentence is not a dependency at all.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { proseGatedIds, findProseGatedTasks, idCandidates, LIVE_STATUSES } = require('../modules/lifecycle/dead-deps.js');
+
+const ids = (t) => [...proseGatedIds(t)];
+
+test('the LIVE sentence from task 1002839 is caught', () => {
+  // Verbatim. This is a liveness assertion, not a dependency — "existing open task N".
+  assert.deepEqual(
+    ids('this is a gate-review HARD FLOOR surface under ADR 0043 and needs owner approval even for an Archon; and existing open task 1001380 covers overlapping ground with stale touches[]'),
+    ['1001380'],
+  );
+});
+
+test('a liveness assertion AFTER the id is caught too', () => {
+  assert.deepEqual(ids('task 1001380 (Unify the grader: one multimodal engine) is ready to claim'), ['1001380']);
+  assert.deepEqual(ids('task 1001380 remains open'), ['1001380']);
+});
+
+test('an ordinary dependency phrasing is caught', () => {
+  assert.deepEqual(ids('needs task 1001380 to land first'), ['1001380']);
+  assert.deepEqual(ids('depends on #1001380'), ['1001380']);
+  assert.deepEqual(ids('blocked by 1001380'), ['1001380']);
+});
+
+test('an ANOTHER-ENTITY id is not a task gate', () => {
+  // Measured: 'Source: idea 1000454' was one of two hits on the first live run.
+  // Reporting it sends a human to look up a task that does not exist — the exact
+  // failure this detector exists to prevent.
+  assert.deepEqual(ids('the first thing that task needs. Source: idea 1000454'), []);
+  assert.deepEqual(ids('needs idea 1000454'), []);
+  assert.deepEqual(ids('blocked by blocker 1000082'), []);
+  assert.deepEqual(ids('after PR 1000454 lands'), []);
+});
+
+test('a gate verb does NOT reach across a sentence or clause boundary', () => {
+  // Measured: a fixed-width window let 'needs' govern an id in the next clause.
+  assert.deepEqual(ids('this needs owner approval; see 1001380 for history'), []);
+  assert.deepEqual(ids('this needs approval. Background in 1001380.'), []);
+});
+
+test('history and citation are not gates', () => {
+  assert.deepEqual(ids('this supersedes task 1001380'), []);
+  assert.deepEqual(ids('task 1001380 needs review'), [], 'the verb must govern the id, not follow it');
+  assert.deepEqual(ids('open questions remain; see 1001380'), []);
+});
+
+test('a bare number that is not a task id is ignored', () => {
+  assert.deepEqual(ids('needs the 2026 rollout and 4784 commits'), []);
+});
+
+// ---- OFFSET-AWARENESS (task 1003857) ---------------------------------------
+//
+// THE TRAP THE TASK NAMES, and which I walked straight into by reading only the first
+// part of the description. Task 1000528's own gate is written as a bare PRE-OFFSET
+// short-form ref (`#513`, `task 506`), not the live id — so a live-id-only matcher
+// misses the very case that motivated the original row. The import shifted every id by
+// 1,000,000; diagram-facts.js's IMPORT_ID_OFFSETS is the existing precedent for probing
+// both spaces.
+
+test('a SHORT pre-offset ref resolves to its live id', () => {
+  assert.deepEqual(ids('needs task 528 to land first'), ['1000528']);
+  assert.deepEqual(ids('blocked by #528'), ['1000528']);
+});
+
+test('a LIVE-width ref is NOT offset a second time', () => {
+  // 1001380 + 1e6 = 2001380, a row nobody ever wrote. Probing an already-resolved id
+  // invents a second candidate that the text does not say.
+  assert.deepEqual(ids('and existing open task 1001380 covers overlapping ground'), ['1001380']);
+  assert.deepEqual(idCandidates('1001380'), ['1001380']);
+  assert.deepEqual(idCandidates('528'), ['1000528']);
+});
+
+test('a short ref needs an explicit task/# prefix — a bare small number is not an id', () => {
+  // This runs over every description on the board, where a 3-digit number is a count, a
+  // line number or a year far more often than it is a task.
+  assert.deepEqual(ids('needs 3 more reviews'), []);
+  assert.deepEqual(ids('needs 528 lines changed'), []);
+  assert.deepEqual(ids('needs task 528'), ['1000528'], 'the prefix is what makes it a ref');
+});
+
+test('the offset probe still respects the gate/liveness rules', () => {
+  assert.deepEqual(ids('this supersedes task 528'), [], 'history is not a gate, at either width');
+  assert.deepEqual(ids('needs idea 454'), [], 'another entity is not a task, at either width');
+  assert.deepEqual(ids('existing open task 528 covers this'), ['1000528'], 'liveness works at short width too');
+});
+
+test('findProseGatedTasks reports only LIVE rows gated on a DEAD one', () => {
+  const statusById = (id) => ({ 1001380: 'abandoned', 1001381: 'shipped' })[id] || null;
+  const rows = [
+    { id: '1', status: 'ready', title: 'a', description: 'needs task 1001380' },
+    { id: '2', status: 'ready', title: 'b', description: 'needs task 1001381' },  // dep alive
+    { id: '3', status: 'shipped', title: 'c', description: 'needs task 1001380' }, // row not live
+  ];
+  const out = findProseGatedTasks(rows, statusById);
+  assert.equal(out.length, 1);
+  assert.equal(out[0].task_id, '1');
+  assert.deepEqual(out[0].prose_dead_deps, [{ id: '1001380', status: 'abandoned' }]);
+});
+
+test('a task citing ITSELF is not gated on itself', () => {
+  const out = findProseGatedTasks(
+    [{ id: '1001380', status: 'ready', title: 'x', description: 'needs task 1001380' }],
+    () => 'abandoned',
+  );
+  assert.deepEqual(out, []);
+});
+
+test('an unknown id is not reported — absence of a row is not death', () => {
+  const out = findProseGatedTasks(
+    [{ id: '1', status: 'ready', title: 'x', description: 'needs task 1009999' }],
+    () => null,
+  );
+  assert.deepEqual(out, [], 'a task the caller cannot see may simply be outside the page it fetched');
+});
+
+test('LIVE_STATUSES is the shared notion, not a second copy', () => {
+  // If this detector grew its own status set, the two halves of --stranded would
+  // disagree about what "live" means and nobody would notice.
+  assert.ok(LIVE_STATUSES.has('ready') && LIVE_STATUSES.has('backlog'));
+  assert.ok(!LIVE_STATUSES.has('shipped') && !LIVE_STATUSES.has('abandoned'));
+});