@bongos/core 1.19.848 → 1.19.850

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.848",
-  "core_contract": "1.19.848",
-  "source_commit": "cec883a4362510c614bbf91576983ff03d6df2ce",
+  "core_version": "1.19.850",
+  "core_contract": "1.19.850",
+  "source_commit": "232e375d3248cfc923d287f61d29cb6c5f59c5d9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T19:52:14.256Z",
+  "built_at": "2026-09-17T20:32:54.381Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 496,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2273,
+    "functional_verbatim": 2276,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2795,
-  "tree_sha256": "31f2347b41b6fb4c9974eb45d6b3b99d10ae8827fec75f36b3f239159ecbe87c",
+  "file_count": 2798,
+  "tree_sha256": "12391d158894c3d0cb4e4073c3939f9c3e83705fa0406663fe5a30859fba4af4",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ed51b2e95fbd3cfd4d5aed5a54aea53a9fc147ee0c7075dd4ecf9eda265ec50e"
+      "sha256": "6c3496a323791d9b6bfc8e86faba4e433a51091e5a9d12b85ede0b207d8057a5"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7907,12 +7907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c4a58e2d12411921c911607c5345671c595e34d7d7c8c51747d7ea5978cf21d4"
+      "sha256": "1e217b4d7975b9c295c2806a83a5817f93fc38a0786a1976fe8ec19aac141b50"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a3b15f291e7851a3578a38113485b76f54b695dca7bf97859954a26707a24c2a"
+      "sha256": "6943316e63bef1a867ea04e705e42a9aa28a50e2cded10e16874899c61f69f03"
     },
     {
       "path": "public-docs/index.html",
@@ -8772,7 +8772,7 @@
     {
       "path": "scripts/gds/paste-token.js",
       "mode": "0000644",
-      "sha256": "cfc9e6a9640f8392a38077a7fa50bd1caae671a60c4735d2758c0cc5a6d10610"
+      "sha256": "9c3fd12318b04062382d8f1309d2da64de7436c93ff7bb25d2b1f5ac5cec7795"
     },
     {
       "path": "scripts/gds/plain-cards.js",
@@ -9189,6 +9189,11 @@
       "mode": "0000644",
       "sha256": "96ad972d929f3733f871d45df1a9ff7013f9f74154f9e37d5e2df55e7959c1a5"
     },
+    {
+      "path": "scripts/gds/ship-escalation.js",
+      "mode": "0000644",
+      "sha256": "500c73254cb071f9e9ef08e4a3fc934f6a49a25193be9975c39704fb19e67429"
+    },
     {
       "path": "scripts/gds/ship-finish.js",
       "mode": "0000644",
@@ -9197,7 +9202,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "c29075a13419ef2bc13f2ff1fd921c725c633ab1e3284dbe9531e1fb55219678"
+      "sha256": "4b8179e5c1aae3fc4845457a4089c57f6cf105c33d03d21d3ade99776371e50f"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9847,7 +9852,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f6dcadffbe81524b07bdc5821ae2cf1f5268eeea497354a09d0e7158673e3b85"
+      "sha256": "d2a5ba427ce014f7940e2757f06541e25275e0c4f59c0b9c5026396c795e41f2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12354,6 +12359,11 @@
       "mode": "0000644",
       "sha256": "c57c0211709ab041ee895bbb4ade9f4b146b43147570bf282e6d6a808560db76"
     },
+    {
+      "path": "tests/no_artifact_escalation.mjs",
+      "mode": "0000644",
+      "sha256": "3d2b03a39cbefc02565a190dee0612e14576edbf32ea0fccf798d6ed28fee8f1"
+    },
     {
       "path": "tests/oauth_secret.mjs",
       "mode": "0000644",
@@ -12444,6 +12454,11 @@
       "mode": "0000644",
       "sha256": "e48806b48a9f7a4f9f9c010f45750e6b440d2de68feacdabacd9bd25d98f2046"
     },
+    {
+      "path": "tests/paste_token_session_store.mjs",
+      "mode": "0000644",
+      "sha256": "9901e8e0b857c3061421909180bb1e34f1752a1ccfaca8150a52e7a79bf1227b"
+    },
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
@@ -13007,7 +13022,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "0cd9f335da162c3562c099a2dbe4375b009f5a8a8321f4ef84b7a577be816bdc"
+      "sha256": "f1cb5f34e9ecbd072b56840facdc57ca2b9d2fa6efc48427ce738cc65a72011f"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/docs/module-api-changelog.md

@@ -2170,5 +2170,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.846 with no explicit bump. run 35266409194. (task 1002620)
   1.19.848 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.847 with no explicit bump. run 35267380720. (task 1002620)
+  1.19.849 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.848 with no explicit bump. run 35269098215. (task 1002620)
+  1.19.850 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.849 with no explicit bump. run 35271402682. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.848",
+  "version": "1.19.850",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.848",
+      "version": "1.19.850",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.848",
+  "version": "1.19.850",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/paste-token.js

@@ -28,6 +28,13 @@ const ic = require('../../src/instance-config');
 // Destructured for the same reason as cli-lib: a namespace-only `ic.X` read is
 // invisible to knip, which then calls the export dead code.
 const { SESSION_FILENAMES, readSessionConfigSync } = require('../../src/instance-config');
+// SESSIONS ARE PER INSTANCE (ADR 0269), and saveSession is what makes that true — see
+// step 4. Requiring cli-lib here was weighed rather than assumed: it costs ~13ms and
+// prints nothing at load (undici and the surface machinery are all lazy), and login.js
+// — the sibling pre-session flow, shipped in the same standalone on-ramp bundle as this
+// script — already requires it. So this adds no module to the package and no visible
+// cost to a paste. (task 1004003)
+const { saveSession } = require('./cli-lib');
 
 // WRITE the session to the configured instance dir (OTB → ~/.config/otb,
 // unchanged; a fresh instance → its neutral dir). R61 / task 1200.
@@ -160,10 +167,20 @@ async function main() {
     api_base: API_BASE,
   };
 
-  // 4. Ensure dir exists with safe perms, then write 0600.
+  // 4. Ensure dir exists with safe perms, then save 0600 THROUGH saveSession.
+  //
+  // WHY NOT A BARE writeFileSync HERE (task 1004003). This used to write SESSION_PATH
+  // directly, which is the ACTIVE POINTER and nothing else. Under ADR 0269 a machine has
+  // several instances, and saveSession is the only writer that knows it: it archives the
+  // OUTGOING session into the host-keyed store before overwriting the pointer, and files
+  // the incoming one there too. Writing the pointer directly skipped both, so pasting a
+  // token for instance B while signed in to instance A destroyed A's session with no
+  // archive — and `bongos login <A>`, which exists to switch back without a device flow,
+  // reads that store and found nothing, so the switch back cost a full re-auth. The state
+  // was unrecoverable, because the pointer is the file that was overwritten.
   try {
     fs.mkdirSync(path.dirname(SESSION_PATH), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(SESSION_PATH, JSON.stringify(next, null, 2), { mode: 0o600 });
+    await saveSession(next);
     // chmod again in case the file already existed with looser perms (writeFile's
     // mode arg is ignored when the file already exists on some platforms).
     fs.chmodSync(SESSION_PATH, 0o600);

package/scripts/gds/ship-escalation.js

@@ -0,0 +1,148 @@
+'use strict';
+//
+// scripts/gds/ship-escalation.js — the exit for a no-artifact close (task 1003950)
+//
+// THE DEAD END THIS REPLACES. A task that is legitimately artifact-free — an ops
+// verification, a DB-only close, or one whose premise turned out to be already-done —
+// could not be closed by any builder below archon, and the two documented paths pointed
+// at each other:
+//
+//     ship.js NNNN --allow-empty   → implies --skip-grade → 403 task.confirm.grade_bypass
+//                                  → "re-run WITHOUT --skip-grade and use --regrade"
+//     ship.js NNNN --regrade       → "Nothing to grade: the committed diff is empty"
+//                                  → "if this task is DELIBERATELY artifact-free, use --allow-empty"
+//
+// Neither exit is reachable at metic. The task parks at `completed` with the claim
+// released — the strand shape the reconciler cannot heal (no branch, no diff, and
+// `completed` sits BEFORE the confirm gate the reconciler sweeps from). Reproduced live
+// 2026-09-16 on task 1003822.
+//
+// WHAT THIS DOES, AND DELIBERATELY DOES NOT DO. It does not move the gate. The owner
+// decision recorded on task 1003950 scoped this to the third of the three shapes the
+// bug offered — "give the refusal a working escalation that does not require the builder
+// to know an archon personally" — because `task.confirm.grade_bypass` is `system: true`
+// in modules/government/catalog.js, one of the four trust-boundary keys ADR 0157 names
+// in its escalation-chain argument. Lowering or forking it is a governance migration and
+// an ADR, filed as task 1004010; grading the NOTES instead of the diff is task 1004011.
+//
+// So the close stays archon-gated. What stops is the LOOP: the refusal now files the
+// escalation on the builder's behalf and terminates, instead of returning them to a flag
+// that will send them back here.
+//
+// IDEMPOTENT BY TASK, not by run — the same reasoning artifact-audit.js carries.
+// POST /blockers dedupes on (source, source_ref), so a builder who re-runs --allow-empty
+// three times while waiting gets ONE blocker, not three. A check that spams is a check
+// that gets muted, and this one is aimed at the surface a person actually reads.
+
+const NO_ARTIFACT_SOURCE = 'no-artifact-close';
+
+// One blocker per task. Deliberately NOT keyed on the builder or the run: two builders
+// hitting the same stuck task should land on the same blocker, not race to file two.
+function escalationSourceRef(taskId) {
+  return `${NO_ARTIFACT_SOURCE}:${taskId}`;
+}
+
+function escalationTitle(taskId, title) {
+  const t = String(title || '').slice(0, 90);
+  return `No-artifact close needs an archon: task ${taskId}${t ? ` — ${t}` : ''}`;
+}
+
+// Pure so the wording is unit-testable without git or network. The body has to carry
+// enough for the archon to make the call WITHOUT re-interviewing the builder — that is
+// the whole point of filing it rather than telling them to go find someone.
+function escalationBody({ taskId, title, floor, summary, notes, builder }) {
+  const reason = [summary, notes].filter(Boolean).join('\n\n');
+  const lines = [
+    `Task **${taskId}** is claimed to be legitimately artifact-free and cannot be closed by its builder.`,
+    '',
+    `- **Task:** ${title || '(untitled)'}`,
+    `- **Declared by:** ${builder || 'the claim holder'} (ran \`ship.js ${taskId} --allow-empty\`)`,
+    `- **Blocked on:** \`task.confirm.grade_bypass\`${floor ? ` (floor: ${floor})` : ''}`,
+    '',
+    '### Why it is stuck',
+    '',
+    'The committed diff is empty and the working tree is clean, so the subagent grader has',
+    'nothing to read. Confirming without a passing grade is archon-gated, and the builder',
+    'holds no route past it. Left alone the task parks at `completed` with the claim',
+    'released — the strand shape the publish reconciler cannot heal, because `completed`',
+    'sits before the `confirmed` gate it sweeps from.',
+    '',
+    '### The reason the builder gave',
+    '',
+    reason || '_(none given — the ship carried no --summary or --notes)_',
+    '',
+    '### What is being asked of you',
+    '',
+    'Decide whether this task is genuinely artifact-free. That claim is the thing worth',
+    'checking here; the absent diff is not evidence either way.',
+    '',
+    `- If yes: \`POST /api/bongos/tasks/${taskId}/confirm\`, or run \`node scripts/gds/ship.js ${taskId} --allow-empty\` yourself.`,
+    '- If no: the work was never done, or never committed — release the claim back to `ready` and say so here.',
+    '',
+    'Filed automatically by the ship path (task 1003950). Re-running `--allow-empty` will',
+    'not file a second copy.',
+  ];
+  return lines.join('\n');
+}
+
+// The terminating refusal. THE ONE INVARIANT: these lines must never send the builder to
+// --regrade, because --regrade on an empty diff sends them straight back to --allow-empty.
+// That mutual advice IS the bug (task 1003950). Pure + exported so a test can assert the
+// loop stays closed rather than trusting a reviewer to notice it reopening.
+function noArtifactRefusalLines({ taskId, floor, escalation }) {
+  const lines = [
+    '',
+    'This task has no artifact to grade, and confirming without a passing grade is',
+    `permission-gated: task.confirm.grade_bypass${floor ? ` (floor: ${floor})` : ''}.`,
+    'This is an authorization wall, not a verdict on your work.',
+    '',
+  ];
+  if (escalation && escalation.filed) {
+    lines.push(`Escalated for you: blocker ${escalation.id} is now on the archon review queue,`);
+    lines.push('carrying this task, the reason you gave, and what is being asked. You do not');
+    lines.push('need to know an archon personally, and there is nothing further to re-run.');
+  } else if (escalation && escalation.reason === 'already-filed') {
+    lines.push('Already escalated: a blocker for this task is open on the archon review queue.');
+    lines.push('Re-running will not speed it up. Nothing further to do here.');
+  } else {
+    // Fail-open: the close is still blocked, so the builder must not be told it worked.
+    const why = escalation && escalation.reason ? ` (${escalation.reason})` : '';
+    lines.push(`Could not file the escalation automatically${why}.`);
+    lines.push('File it by hand so this does not sit silently — post a blocker naming this task:');
+    lines.push('    node scripts/gds/api.js POST /blockers --body-file <path-to-json>');
+  }
+  lines.push('');
+  lines.push(`Your claim on task ${taskId} is unchanged. Do NOT re-run with --regrade:`);
+  lines.push('the diff is empty, so a re-grade has nothing to read and will point you back here.');
+  return lines;
+}
+
+// Best-effort by design: a failure to file must not turn a blocked close into a crash,
+// but it must also never read as success — noArtifactRefusalLines prints the manual
+// fallback when `filed` is false.
+async function fileNoArtifactEscalation({ taskId, title, floor, summary, notes, builder }, { call } = {}) {
+  const post = call || require('./cli-lib').apiCall;
+  let r;
+  try {
+    r = await post('POST', '/api/bongos/blockers', {
+      title: escalationTitle(taskId, title),
+      body_md: escalationBody({ taskId, title, floor, summary, notes, builder }),
+      source: NO_ARTIFACT_SOURCE,
+      source_ref: escalationSourceRef(taskId),
+    });
+  } catch (err) {
+    return { filed: false, reason: `POST /blockers threw: ${err && err.message}` };
+  }
+  if (!r || !r.ok) return { filed: false, reason: `POST /blockers -> ${r && r.status}` };
+  if (r.data && r.data.skipped) return { filed: false, reason: 'already-filed' };
+  return { filed: true, id: r.data && r.data.blocker && r.data.blocker.id };
+}
+
+module.exports = {
+  NO_ARTIFACT_SOURCE,
+  escalationSourceRef,
+  escalationTitle,
+  escalationBody,
+  noArtifactRefusalLines,
+  fileNoArtifactEscalation,
+};

package/scripts/gds/ship-flow.js

@@ -28,6 +28,7 @@ const { pushVia } = require('./ship-deploy-target.js');
 
 const { diffstatFor, finishShip } = require('./ship-finish.js');
 const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge, shouldConfirmWithoutGrade } = require('./ship-resume.js');
+const { fileNoArtifactEscalation, noArtifactRefusalLines } = require('./ship-escalation.js');
 const { noteServerReward } = require('./ship-state.js');
 
 // ---------- Main flow ----------
@@ -70,6 +71,9 @@ async function shipMain() {
   // empty diff is refused (it used to slip through under --skip-grade — the
   // task-1363 phantom ship). Never overrides a dirty working tree.
   const allowEmpty = args.includes('--allow-empty');
+  // task 1003950: set only when the empty-diff guard below classifies this ship as a
+  // deliberate no-artifact close. Gates the auto-escalation at the confirm wall.
+  let noArtifactClose = false;
   // task 1002605 (G-18): explicit opt-in to continue past a FAILED production
   // smoke run. Without it a smoke FAIL now ABORTS before the claim resolves
   // (claim intact); with it, the resolve proceeds and the task deliberately
@@ -266,6 +270,12 @@ async function shipMain() {
     // There is no committed diff for the subagent grader to read, so confirm
     // directly (this is the DB-only path the old --skip-grade route served).
     if (!skipGrade) skipGrade = true;
+    // task 1003950: mark WHY the grader is being skipped. A --skip-grade ship past a
+    // failing grade and a genuinely artifact-free close both reach the same archon
+    // gate below, but only the second one may be escalated automatically — the first
+    // has a diff the grader DID read and reject, and auto-filing a blocker for it
+    // would be a builder routing their own rejected work to an override queue.
+    noArtifactClose = true;
     console.log('--allow-empty: no committed diff (no-artifact / DB-only ship) — confirming directly without the subagent grader.');
   }
 
@@ -570,6 +580,19 @@ async function shipMain() {
         const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
         const floor = details.floors && details.floors['task.confirm.grade_bypass'];
         const floorNote = floor ? ` (floor: ${floor})` : '';
+        // task 1003950: these two cases used to print the same advice, and for a
+        // no-artifact close that advice was a LOOP — --regrade on an empty diff
+        // refuses and points back at --allow-empty, which lands here again. Split
+        // them: a rejected-grade bypass still has a real diff and a real remedy
+        // (fix the findings, re-grade); an artifact-free close has neither, so it
+        // gets the escalation filed for it and terminates.
+        if (noArtifactClose) {
+          const escalation = await fileNoArtifactEscalation({
+            taskId, title: ac.title, floor, summary, notes, builder: (me.data.builder || {}).github_login,
+          });
+          for (const line of noArtifactRefusalLines({ taskId, floor, escalation })) console.error(line);
+          process.exit(1);
+        }
         console.error('');
         console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floorNote}.`);
         console.error('  This is an authorization wall, not a verdict on your work.');
@@ -907,10 +930,17 @@ async function regradeMain() {
         if (confirm.status === 403 && errCode === 'permission_forbidden') {
           const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
           const floor = details.floors && details.floors['task.confirm.grade_bypass'];
-          console.error('');
-          console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floor ? ` (floor: ${floor})` : ''}.`);
-          console.error('  This is an authorization wall, not a verdict on your work.');
-          console.error(`  Ask a builder whose role holds it to POST /api/bongos/tasks/${taskId}/confirm.`);
+          // task 1003950: this branch is reached ONLY via shouldConfirmWithoutGrade,
+          // which requires both an empty committed diff and an explicit --allow-empty —
+          // so it is always a no-artifact close, and never a bypass of a failing grade.
+          // It used to end at "ask a builder whose role holds it", which is the exact
+          // dead end the bug names: a builder who knows no archon had nowhere to go.
+          const escalation = await fileNoArtifactEscalation({
+            // no `notes` on this path by design: regradeMain REFUSES --notes (see
+            // proseFlagPresent above), so the summary is the only reason the builder gave.
+            taskId, title: task && task.title, floor, summary, builder: builder.github_login,
+          });
+          for (const line of noArtifactRefusalLines({ taskId, floor, escalation })) console.error(line);
           process.exit(1);
         }
         console.error(`manual-confirm failed: ${apiErrorLine(confirm.data, confirm.status)}`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.848'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.850'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/no_artifact_escalation.mjs

@@ -0,0 +1,248 @@
+// tests/no_artifact_escalation.mjs
+//
+// Task 1003950 — a no-artifact close must TERMINATE, not loop.
+//
+// The bug: a legitimately artifact-free task (an ops verification, a DB-only close, one
+// whose premise turned out already-done) could not be closed below archon, and the two
+// documented exits advised each other:
+//
+//     --allow-empty  → 403 task.confirm.grade_bypass → "use --regrade"
+//     --regrade      → "the committed diff is empty" → "use --allow-empty"
+//
+// The fix keeps the gate where it is (`task.confirm.grade_bypass` is `system: true` —
+// one of the four trust-boundary keys ADR 0157 names; moving it is task 1004010) and
+// instead FILES the escalation for the builder, then stops.
+//
+// What these tests protect, in order of how easily each would rot:
+//   1. the loop stays closed — no refusal line may advise a command that comes back here;
+//   2. the escalation is actually WIRED at both 403 sites, not merely exported;
+//   3. only a no-artifact close is auto-escalated — a --skip-grade bypass of a FAILING
+//      grade must not be, or a builder could route their own rejected work to the
+//      override queue;
+//   4. filing is idempotent per task, and a filing failure never reads as success.
+//
+// Run:  node tests/no_artifact_escalation.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+import { shipCliSource } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const esc = require('../scripts/gds/ship-escalation.js');
+const {
+  escalationSourceRef, escalationTitle, escalationBody,
+  noArtifactRefusalLines, fileNoArtifactEscalation, NO_ARTIFACT_SOURCE,
+} = esc;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    const r = fn();
+    if (r && typeof r.then === 'function') {
+      return r.then(() => { passed++; console.log(`  ok  ${name}`); },
+        (e) => { failed++; console.error(`FAIL  ${name}\n      ${e.message}`); });
+    }
+    passed++; console.log(`  ok  ${name}`);
+  } catch (e) {
+    failed++; console.error(`FAIL  ${name}\n      ${e.message}`);
+  }
+  return Promise.resolve();
+}
+
+const text = (o) => noArtifactRefusalLines(o).join('\n');
+
+// ---- 1. THE LOOP INVARIANT ---------------------------------------------------------
+// This is the whole point of the task. Asserted as "no COMMAND that loops", not "the
+// string --regrade never appears" — the refusal deliberately says *Do NOT* re-run with
+// --regrade, and a naive absence check would forbid that warning and pass a version
+// that quietly went back to recommending it.
+
+await test('the refusal never tells the builder to run a command that returns them here', () => {
+  for (const escalation of [
+    { filed: true, id: 42 },
+    { filed: false, reason: 'already-filed' },
+    { filed: false, reason: 'POST /blockers -> 500' },
+    undefined,
+  ]) {
+    const out = text({ taskId: 1003822, floor: 'archon', escalation });
+    assert.ok(!/node scripts\/gds\/ship\.js\s+\d+\s+--regrade/.test(out),
+      'a runnable --regrade command is the exact advice that loops');
+    assert.ok(!/node scripts\/gds\/ship\.js\s+\d+\s+--allow-empty/.test(out),
+      'and re-running --allow-empty lands on this same refusal');
+    // The refusal deliberately contains "Do NOT re-run with --regrade". Drop that
+    // negated sentence, then assert nothing REMAINING recommends it. A blanket
+    // absence check would forbid the warning while still passing a version that
+    // quietly went back to advising the loop.
+    const withoutWarning = out.replace(/Do NOT re-run with --regrade[^]*/i, '');
+    assert.ok(!/(use|try|re-run with|switch to)\s+`?--regrade/i.test(withoutWarning),
+      'nor may it advise --regrade in prose');
+  }
+});
+
+await test('the refusal explicitly warns AGAINST the old advice, so the loop is closed on the record', () => {
+  const out = text({ taskId: 1003822, floor: 'archon', escalation: { filed: true, id: 42 } });
+  assert.match(out, /Do NOT re-run with --regrade/,
+    'the builder who read the old message needs to be told it was wrong');
+  assert.match(out, /nothing to read/, 'and told why, or they will assume it is a fluke');
+});
+
+await test('every refusal shape names what happens next, so none of them dead-ends', () => {
+  const filed = text({ taskId: 7, escalation: { filed: true, id: 42 } });
+  assert.match(filed, /blocker 42/, 'a filed escalation must name the blocker it filed');
+  assert.match(filed, /nothing further to re-run/i, 'and say the builder is done');
+
+  const dup = text({ taskId: 7, escalation: { filed: false, reason: 'already-filed' } });
+  assert.match(dup, /Already escalated/, 'a second run must not read as a failure');
+  assert.ok(!/Could not file/.test(dup), 'a dedupe is a success, not an error');
+
+  const broke = text({ taskId: 7, escalation: { filed: false, reason: 'POST /blockers -> 500' } });
+  assert.match(broke, /Could not file the escalation/, 'a real failure must say so');
+  assert.match(broke, /500/, 'and name the cause');
+  assert.match(broke, /by hand/, 'and give the manual fallback — the close is still blocked');
+});
+
+await test('the claim is stated as intact — a builder who thinks they lost it will not retry', () => {
+  const out = text({ taskId: 1003822, escalation: { filed: true, id: 1 } });
+  assert.match(out, /claim on task 1003822 is unchanged/);
+});
+
+await test('a missing floor degrades to a clean sentence rather than "floor: undefined"', () => {
+  const out = text({ taskId: 7, floor: undefined, escalation: { filed: true, id: 1 } });
+  assert.ok(!/undefined/.test(out), out);
+  assert.match(out, /task\.confirm\.grade_bypass\./, 'still names the atom');
+});
+
+// ---- 2. WIRED, NOT MERELY EXPORTED -------------------------------------------------
+// A pure unit can be perfect and unreachable. These read the real ship CLI source.
+
+await test('both confirm walls call the escalation — not just the one that is easy to find', () => {
+  const src = shipCliSource();
+  // `await` is what makes this count CALLS: shipCliSource globs ship-*.js, so the
+  // module's own `async function fileNoArtifactEscalation({` is in this source too.
+  const calls = src.match(/await fileNoArtifactEscalation\(\{/g) || [];
+  assert.equal(calls.length, 2,
+    `expected the escalation at BOTH 403 sites (first-ship and --regrade), found ${calls.length}`);
+  assert.match(src, /noArtifactRefusalLines\(\{ taskId, floor, escalation \}\)/,
+    'and each must print the terminating refusal, not roll its own');
+});
+
+await test('ONLY a no-artifact close is auto-escalated, never a bypass of a FAILING grade', () => {
+  // The first-ship wall is reached by --skip-grade too, where the grader DID read a real
+  // diff and rejected it. Auto-filing a blocker there would let a builder route their own
+  // rejected work onto the override queue. The `noArtifactClose` guard is what separates
+  // them, so its absence is a security-shaped regression, not a cosmetic one.
+  const src = shipCliSource();
+  assert.match(src, /if \(noArtifactClose\) \{\s*\n\s*const escalation = await fileNoArtifactEscalation/,
+    'the first-ship escalation must sit behind the noArtifactClose guard');
+  assert.match(src, /noArtifactClose = true;/,
+    'and something must actually SET it, or the branch is unreachable and the guard is a lie');
+  // Reachability: the assignment has to live in the allow-empty branch specifically.
+  const allowEmptyBranch = src.slice(src.indexOf("verdict.reason === 'allow-empty'"));
+  assert.ok(allowEmptyBranch.indexOf('noArtifactClose = true;') > -1
+    && allowEmptyBranch.indexOf('noArtifactClose = true;') < 1200,
+    'noArtifactClose must be set in the allow-empty branch, not somewhere it can never run');
+});
+
+await test('the --regrade call site passes no `notes` — that variable does not exist there', () => {
+  // Caught live while building this: regradeMain REFUSES --notes (proseFlagPresent), so
+  // `notes` is undeclared in that scope. Passing it parses fine and throws a
+  // ReferenceError at the exact moment a blocked builder needs the escalation — the one
+  // moment nothing else is going right. node --check cannot see this; only this can.
+  const src = shipCliSource();
+  const site = src.slice(src.indexOf('title: task && task.title'));
+  const call = site.slice(0, site.indexOf('})'));
+  assert.ok(!/\bnotes\b/.test(call),
+    'the --regrade escalation must not reference `notes`: ' + call);
+});
+
+// ---- 3. IDEMPOTENCY + THE FILING CONTRACT ------------------------------------------
+
+await test('the source_ref is per-TASK, so re-running files one blocker and not three', () => {
+  assert.equal(escalationSourceRef(1003822), 'no-artifact-close:1003822');
+  assert.equal(escalationSourceRef(1003822), escalationSourceRef('1003822'),
+    'a numeric and string id must dedupe to the same ref, or a re-run files a twin');
+  assert.notEqual(escalationSourceRef(1), escalationSourceRef(2), 'different tasks stay distinct');
+});
+
+await test('fileNoArtifactEscalation: posts a well-formed blocker and returns its id', async () => {
+  let seen = null;
+  const r = await fileNoArtifactEscalation(
+    { taskId: 1003822, title: 'a stale premise', floor: 'archon', summary: 'already fixed by 1003529', builder: 'a-builder' },
+    { call: async (method, path, body) => { seen = { method, path, body }; return { ok: true, data: { blocker: { id: 77 } } }; } },
+  );
+  assert.deepEqual(r, { filed: true, id: 77 });
+  assert.equal(seen.method, 'POST');
+  assert.equal(seen.path, '/api/bongos/blockers');
+  assert.equal(seen.body.source, NO_ARTIFACT_SOURCE);
+  assert.equal(seen.body.source_ref, 'no-artifact-close:1003822');
+  assert.match(seen.body.title, /task 1003822/);
+  assert.match(seen.body.body_md, /already fixed by 1003529/, "the builder's reason must reach the archon");
+  assert.match(seen.body.body_md, /a-builder/, 'and so must who declared it');
+});
+
+await test('a dedupe response is reported as already-filed, not as a failure', async () => {
+  const r = await fileNoArtifactEscalation({ taskId: 1 },
+    { call: async () => ({ ok: true, data: { skipped: true } }) });
+  assert.deepEqual(r, { filed: false, reason: 'already-filed' });
+});
+
+await test('a filing failure NEVER reads as filed — the close is still blocked', async () => {
+  const bad = await fileNoArtifactEscalation({ taskId: 1 }, { call: async () => ({ ok: false, status: 500 }) });
+  assert.equal(bad.filed, false);
+  assert.match(bad.reason, /500/);
+
+  const threw = await fileNoArtifactEscalation({ taskId: 1 },
+    { call: async () => { throw new Error('ECONNREFUSED'); } });
+  assert.equal(threw.filed, false, 'a network error must not crash the ship path');
+  assert.match(threw.reason, /ECONNREFUSED/);
+
+  const nullish = await fileNoArtifactEscalation({ taskId: 1 }, { call: async () => null });
+  assert.equal(nullish.filed, false, 'a null response is not a success');
+});
+
+await test('the blocker body carries the decision the archon has to make, both ways', () => {
+  const body = escalationBody({ taskId: 9, title: 't', floor: 'archon', summary: 'ops verify only' });
+  assert.match(body, /If yes/, 'confirm path');
+  assert.match(body, /If no/, 'and the reject path — a one-sided ask gets rubber-stamped');
+  assert.match(body, /tasks\/9\/confirm/, 'with the actual route to run');
+  assert.match(body, /not file a second copy/, 'and reassurance that re-running is harmless');
+});
+
+await test('a reasonless ship still files a legible blocker rather than a blank one', () => {
+  const body = escalationBody({ taskId: 9 });
+  assert.match(body, /none given/, 'the absent reason must be visible, not an empty section');
+  assert.ok(!/undefined|\[object Object\]/.test(body), body);
+  assert.match(escalationTitle(9, null), /task 9/, 'and the title must survive a null title');
+});
+
+await test('the call sites resolve the builder login from me.data.builder, not me.data', () => {
+  // The grade caught this: `me.data.github_login` is ALWAYS undefined — /me returns
+  // { builder, ... } (src/bongos/routes/me.js), and ship-flow.js already proves the
+  // right pattern twice elsewhere. The failure is silent: escalationBody falls back to
+  // 'the claim holder', so the blocker still looks fine while naming nobody — and the
+  // whole reason it is filed is to spare the archon an interview.
+  //
+  // Asserted against SOURCE because both call sites sit behind a live confirm 403; the
+  // direct-call tests below cannot see the field path at all, which is exactly how 14
+  // green tests shipped the bug.
+  const src = shipCliSource();
+  assert.ok(!/me\.data\.github_login/.test(src),
+    'me.data.github_login is always undefined — the login is nested under me.data.builder');
+  assert.match(src, /builder: \(me\.data\.builder \|\| \{\}\)\.github_login/,
+    'the first-ship call site must reach through me.data.builder');
+  assert.match(src, /builder: builder\.github_login/,
+    'the --regrade call site must use the `builder` binding already in scope there');
+});
+
+await test('an unresolved builder degrades to a legible line, not "undefined"', () => {
+  // The fallback above is what the bug hid behind, so it has to stay honest.
+  const body = escalationBody({ taskId: 9, builder: undefined });
+  assert.match(body, /the claim holder/, 'a missing login must read as a role, not a blank');
+  assert.ok(!/undefined/.test(body), body);
+});
+
+console.log('');
+console.log(`no_artifact_escalation: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/paste_token_session_store.mjs

@@ -0,0 +1,188 @@
+// tests/paste_token_session_store.mjs — a paste must not destroy the OTHER instance's
+// session (task 1004003, ADR 0269).
+//
+// THE BUG. `scripts/gds/paste-token.js` wrote the session with a bare
+// `fs.writeFileSync(SESSION_PATH, ...)`. SESSION_PATH is the ACTIVE POINTER and nothing
+// else. Under ADR 0269 a machine has several instances, and `saveSession()` in cli-lib is
+// the only writer that knows it: it archives the OUTGOING session into the host-keyed
+// store before overwriting the pointer, and files the incoming one there too. Writing the
+// pointer directly skipped both steps, so pasting a token for instance B while signed in
+// to instance A overwrote A with no archive. `bongos login <A>` exists precisely to switch
+// back without a fresh device flow — it reads that store, found no entry, and the switch
+// back cost a full re-auth. Nothing was recoverable, because the pointer is the very file
+// that was overwritten.
+//
+// WHY THIS IS END-TO-END AND NOT A SOURCE SCAN. The divergence between the two write paths
+// went unnoticed for a release precisely because no test ever ran a paste and then looked
+// for the other instance. A grep for `saveSession` would pass on a call that is there and
+// wrong; running the script and reading the store is the only assertion that cannot.
+// paste-token verifies the token against `<base>/api/bongos/me` before it writes anything,
+// so the "instance" below is a real local HTTP server and the flow is the real one.
+//
+// Run:  node --test tests/paste_token_session_store.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { spawn, spawnSync } from 'node:child_process';
+
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const ic = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
+const PASTE_TOKEN = path.join(REPO_ROOT, 'scripts', 'gds', 'paste-token.js');
+
+// SETTING `HOME` ALONE IS NOT ISOLATION (task 1003760, learned the expensive way in
+// tests/cli_sessions.mjs): on Windows os.homedir() reads USERPROFILE and never consults
+// HOME, so a HOME-only override writes the fixtures into the developer's REAL session
+// store and overwrites their live credentials. Override every variable a platform might
+// read, and — because the child here is paste-token itself and cannot carry an inline
+// guard — prove the relocation with a probe child BEFORE anything writes (see `sandbox`).
+function sandboxEnv(home) {
+  const { root } = path.parse(home);
+  return {
+    ...process.env,
+    HOME: home,
+    USERPROFILE: home,                          // Windows: what os.homedir() actually reads
+    HOMEDRIVE: root.replace(/[\\/]+$/, ''),     // legacy Windows fallback pair
+    HOMEPATH: home.slice(root.length - 1) || '\\',
+  };
+}
+
+// A throwaway home plus the two paths paste-token will resolve inside it. Both are read
+// from the child, not computed here: the parent's own SESSION_PATH froze at module load
+// against the REAL home, so any path this process derives would name the wrong file.
+function sandbox() {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-paste-'));
+  const probe = spawnSync(process.execPath, ['-e', `
+    const os = require('node:os');
+    if (os.homedir() !== ${JSON.stringify(home)}) { console.error('ESCAPE ' + os.homedir()); process.exit(2); }
+    const ic = require(${JSON.stringify(path.join(REPO_ROOT, 'src', 'instance-config.js').replace(/\\/g, '/'))});
+    console.log(JSON.stringify({
+      active: ic.configPath(ic.SESSION_FILENAMES[0]),
+      store: require('node:path').join(os.homedir(), '.config', ic.FALLBACK_DIR, 'instances'),
+    }));`], { encoding: 'utf8', env: sandboxEnv(home) });
+  if (probe.status !== 0) {
+    fs.rmSync(home, { recursive: true, force: true });
+    // Loud, never skipped: a test whose whole job is writing a session store must prove
+    // it cannot reach the real one rather than quietly running anyway.
+    throw new Error(`sandbox did not relocate os.homedir() on this platform: ${probe.stdout}${probe.stderr}`);
+  }
+  const { active, store } = JSON.parse(probe.stdout.trim().split('\n').pop());
+  assert.ok(active.startsWith(home), `the active pointer resolved OUTSIDE the sandbox: ${active}`);
+  assert.ok(store.startsWith(home), `the session store resolved OUTSIDE the sandbox: ${store}`);
+  return { home, active, store };
+}
+
+// One instance, as far as paste-token can tell: it only ever calls GET /api/bongos/me.
+async function withInstance(body) {
+  const server = http.createServer((req, res) => {
+    if (!req.url.startsWith('/api/bongos/me')) { res.writeHead(404).end('{}'); return; }
+    if (req.headers.authorization !== 'Bearer ' + 'B'.repeat(64)) { res.writeHead(401).end('{}'); return; }
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ builder: { id: 42, github_login: 'paster', rank: 'metic' } }));
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  try { return await body(base); } finally { await new Promise((r) => server.close(r)); }
+}
+
+// ASYNC ON PURPOSE, and it must stay that way: spawnSync blocks this process's event
+// loop, so the instance server above — which lives in THIS process — can never accept the
+// child's verify call, and the paste hangs until the suite times out. The two deadlock
+// each other, which reads exactly like a hung test rather than a wrong one.
+function runPaste(home, args) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [PASTE_TOKEN, ...args], { env: sandboxEnv(home) });
+    let out = '';
+    child.stdout.on('data', (d) => { out += d; });
+    child.stderr.on('data', (d) => { out += d; });
+    child.on('close', (status) => resolve({ status, out }));
+  });
+}
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
+}
+
+test('pasting a token for instance B PRESERVES instance A — the bug this closes', async () => {
+  const { home, active, store } = sandbox();
+  try {
+    await withInstance(async (base) => {
+      // Signed in to A, the way a builder actually is: an active pointer and nothing else
+      // — the pre-store shape saveSession's archive step exists to rescue.
+      fs.mkdirSync(path.dirname(active), { recursive: true });
+      fs.writeFileSync(active, JSON.stringify({
+        token: 'TOKEN-A', api_base: 'https://a.example.com',
+        builder: { github_login: 'someone' }, gemini_api_key: 'KEY-KEEP-ME',
+      }), { mode: 0o600 });
+
+      const r = await runPaste(home, ['B'.repeat(64), '--api-base', base]);
+      assert.equal(r.status, 0, `paste failed: ${r.out}`);
+
+      // 1. THE REGRESSION. A is archived under its own host and is still readable, so
+      //    `bongos login https://a.example.com` can switch back with no device flow.
+      const archived = readJson(path.join(store, 'a.example.com.json'));
+      assert.ok(archived, 'instance A was not archived — a paste destroyed it, the bug is back');
+      assert.equal(archived.token, 'TOKEN-A');
+      assert.equal(archived.api_base, 'https://a.example.com');
+
+      // 2. B is filed in the store too, not only at the pointer — otherwise the NEXT
+      //    paste has nothing of B's to archive and the same loss happens one step later.
+      const key = `127.0.0.1_${new URL(base).port}.json`;
+      const stored = readJson(path.join(store, key));
+      assert.ok(stored, `instance B was not filed in the store (looked for ${key})`);
+      assert.equal(stored.token, 'B'.repeat(64));
+
+      // 3. The active pointer still follows the paste, in the same place every existing
+      //    reader (skills, hooks, the dev box) looks. The fix is additive or it is a
+      //    different, quieter outage.
+      const pointer = readJson(active);
+      assert.equal(pointer.api_base, base, 'the active pointer must follow the paste');
+      assert.equal(pointer.token, 'B'.repeat(64));
+      assert.equal(pointer.builder.github_login, 'paster');
+
+      // 4. The merge contract paste-token already owed (task 1003704) survives the
+      //    reroute: a re-auth must never silently un-register a builder's art key.
+      assert.equal(pointer.gemini_api_key, 'KEY-KEEP-ME', 'the paste dropped a preserved field');
+    });
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('a rejected token writes nothing at all — not the pointer, not the store', async () => {
+  // The verify-before-write contract is what protects the session a bad paste was meant to
+  // REPLACE. Routing through saveSession must not move the write ahead of the check: that
+  // would turn a typo into the very cross-instance loss the first test closes.
+  const { home, active, store } = sandbox();
+  try {
+    await withInstance(async (base) => {
+      fs.mkdirSync(path.dirname(active), { recursive: true });
+      fs.writeFileSync(active, JSON.stringify({
+        token: 'TOKEN-A', api_base: 'https://a.example.com', builder: { github_login: 'someone' },
+      }), { mode: 0o600 });
+
+      const r = await runPaste(home, ['W'.repeat(64), '--api-base', base]);
+      assert.equal(r.status, 3, `a 401 must exit 3, got ${r.status}: ${r.out}`);
+      assert.equal(readJson(active).token, 'TOKEN-A', 'a rejected paste overwrote the live session');
+      assert.ok(!fs.existsSync(store), 'a rejected paste filed something in the store');
+    });
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('paste-token routes the write through saveSession, not a bare writeFileSync', () => {
+  // The behavioural tests above are the real assertion. This one names the mechanism, so a
+  // future edit that "simplifies" the call back to a direct write fails on the line it
+  // changed rather than on a store path three files away.
+  const src = fs.readFileSync(PASTE_TOKEN, 'utf8');
+  assert.match(src, /await saveSession\(next\)/, 'the session write must go through saveSession');
+  assert.ok(!/writeFileSync\(\s*SESSION_PATH/.test(src),
+    'SESSION_PATH is the ACTIVE POINTER — writing it directly skips the per-instance archive (ADR 0269)');
+});

package/tests/reward_gate.mjs

@@ -162,14 +162,28 @@ t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)'
 t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', () => {
   const start = dbSrc.indexOf('async function claimTask');
   assert.ok(start >= 0, 'claimTask not found');
-  // The window is a slice heuristic, not a contract: it only has to cover the
-  // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
-  // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
-  // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
-  // rank_too_low_for_task denial did the same; 7000 -> 8500 in task 1003137, when
-  // the goal-membership gate landed between the rank gates and deps. Keep it
-  // comfortably below the claimTasksBatch boundary (~16.5k chars in).
-  const body = dbSrc.slice(start, start + 8500);
+  // Scan the REAL claimTask body — from its declaration to the next top-level
+  // function (claimTasksBatch) — rather than a fixed byte window, the same fix the
+  // createTask and POST /tasks siblings below already carry.
+  //
+  // The byte window was widened four times for four UNRELATED features: 5000 -> 6000
+  // in BV1.R106 (the permission-expressed claim gate), 6000 -> 7000 in task 1002613
+  // (the enriched rank_too_low_for_task denial), 7000 -> 8500 in task 1003137 (the
+  // goal-membership gate). Each time, an edit to claimTask's PREFLIGHT pushed the
+  // reward block past the edge and red a test about rewards — and the message,
+  // "claimTask must consult the auto-assign decision", pointed the reader at the
+  // reward gate instead of at their own change. Task 1003294 paid the tax again with
+  // a five-line comment (margin was down to ~125 chars) and had to trim prose to get
+  // green. The comment above USED to name claimTasksBatch as the real bound; it was
+  // simply never what the code measured. Now it is, so the window grows with the
+  // function and this line stops needing maintenance.
+  //
+  // A missing anchor fails LOUDLY rather than falling back to a byte count: a silent
+  // fallback would reintroduce exactly the failure mode being removed here.
+  const end = dbSrc.indexOf('async function claimTasksBatch', start);
+  assert.ok(end > start,
+    'claimTasksBatch boundary not found — reward_gate can no longer bound claimTask; re-anchor this slice');
+  const body = dbSrc.slice(start, end);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.