@bongos/core 1.19.865 → 1.19.867

package/docs/module-api-changelog.md

@@ -2204,5 +2204,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.863 with no explicit bump. run 35294233113. (task 1002620)
   1.19.865 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.864 with no explicit bump. run 35295856053. (task 1002620)
+  1.19.866 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.865 with no explicit bump. run 35355019469. (task 1002620)
+  1.19.867 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.866 with no explicit bump. run 35380895321. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/builders.js

@@ -790,7 +790,7 @@
       const title = escapeHtml(t.value_summary || t.title || `task #${t.id}`);
       return `
         <tr data-acclaim-row="${tid}">
-          <td>${title}</td>
+          <td>${title}${acclaimEvidenceHtml(t)}</td>
           <td>${by}</td>
           <td class="acclaim__net ${netCls}" data-acclaim-net="${tid}">${netText}</td>
           <td>${controls}</td>
@@ -1424,7 +1424,7 @@
   // reads what this page holds NOW rather than what it held at boot. Everything
   // else is stable for the life of the page. This call sits AFTER every
   // declaration it passes — moving it earlier is a temporal-dead-zone crash.
-  const { SETUP_CONFIG_KEY, analyticsState, lbState, mountHallWidgets, onboardingBox, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey } = window.OTBHallRender({
+  const { SETUP_CONFIG_KEY, acclaimEvidenceHtml, analyticsState, lbState, mountHallWidgets, onboardingBox, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey } = window.OTBHallRender({
     API, RANK_ORDER, api, brandWorld, curLabel, emptyRow, fmtDate, mins, normalizeRank, pct, postJSON, rankLabel, rankWeight, signClasses, toast, usd,
     get instanceRepo() { return instanceRepo; },
     get lastClaimableCount() { return lastClaimableCount; },

package/modules/hall-ui/public/hall-render.js

@@ -332,6 +332,46 @@
           </div>`;
   }
 
+  // task 1002835: a karma vote on a peer's ship was a vote on a title alone.
+  // The two facts the ship already recorded — what the grader scored it and
+  // what it cost — turn it into an informed one. ABSENCE IS NOT ZERO: an
+  // ungraded ship says so, and so does an unlogged cost, because "0.0" and
+  // "$0.00" would read as measurements that were never taken.
+  function acclaimEvidenceHtml(t) {
+    const score = t.grade_score == null ? null : Number(t.grade_score);
+    const grade = score == null || !Number.isFinite(score)
+      ? '<span class="ledger__verdict--none">not graded</span>'
+      : `<span class="${t.grade_passed ? 'ledger__verdict--ok' : 'ledger__verdict--danger'}">${score.toFixed(1)} / 10</span>`;
+    // Three states, not two. The route OMITS cost_usd for a builder who may not
+    // vote, and that is not the same fact as a logged cost of nothing: a reader
+    // who is shown no figure is told nothing, never "no cost logged".
+    const parts = [grade];
+    if (Object.prototype.hasOwnProperty.call(t, 'cost_usd')) {
+      const usd = t.cost_usd == null ? null : Number(t.cost_usd);
+      parts.push(usd == null || !Number.isFinite(usd)
+        ? '<span class="ledger__verdict--none">no cost logged</span>'
+        : `<span class="acclaim__cost">$${usd.toFixed(2)}</span>`);
+    }
+    return `<span class="acclaim__evidence">${parts.join(' · ')}</span>`;
+  }
+  // The RETURNING builder's door (task 1002851). `open` and `invite_only`
+  // already render a real .landing__btn sign-in inside the primary door, so a
+  // second button there would be a third scattered path rather than a clearer
+  // one — those modes keep the prose note alone. Only the `apply` door, whose
+  // primary control is the request FORM, left signing in as a footnote link.
+  // It gets a real button: the request button's geometry so it reads as a
+  // control, a quieter fill so the request path still leads for the strangers
+  // who are most of this page's traffic.
+  function returningDoorHtml(mode) {
+    if (mode !== 'apply') return '';
+    return `
+          <div class="landing__returning" id="landing-returning">
+            <h3 class="landing__request-h">Already a member?</h3>
+            <p class="landing__request-lede">You've been approved before — sign in and pick up where you left off.</p>
+            <p class="landing__cta"><a class="landing__btn landing__btn--quiet" href="${API}/auth/web/start">Sign in with GitHub</a></p>
+          </div>`;
+  }
+
   function renderLanding() {
     // task 1723: collapse the shell nav to the signed-out minimum (Home + a
     // Sign-in button). Cosmetic — the server gates every page regardless.
@@ -343,14 +383,20 @@
     const landing = $('#landing-root');
     if (landing) {
       landing.hidden = false;
+      const mode = joinabilityMode();
+      // On the apply door the sign-in is a real button above, so the note keeps
+      // only the privacy sentence — one sign-in path per landing, never two.
+      const signInNote = mode === 'apply'
+        ? ''
+        : `Already a member? <a href="${API}/auth/web/start">Sign in with GitHub</a>. `;
       landing.innerHTML = `
         <div class="scroll landing">
           <h2 class="scroll__h">Welcome</h2>
-          ${landingDoorHtml(joinabilityMode())}
+          ${landingDoorHtml(mode)}
+          ${returningDoorHtml(mode)}
 
           <p class="landing__signin-note">
-            Already a member? <a href="${API}/auth/web/start">Sign in with GitHub</a>.
-            We store only your GitHub login, avatar, and the work you ship.
+            ${signInNote}We store only your GitHub login, avatar, and the work you ship.
           </p>
         </div>
       `;
@@ -1305,6 +1351,6 @@
     return idx === -1 ? null : { place: idx + 1, total: ranked.length };
   }
 
-    return { SETUP_CONFIG_KEY, analyticsState, lbState, mountHallWidgets, onboardingBox, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey };
+    return { SETUP_CONFIG_KEY, acclaimEvidenceHtml, analyticsState, lbState, mountHallWidgets, onboardingBox, renderCurveBody, renderGreeting, renderLanding, renderNav, renderOnboarding, renderProfile, renderRecentShips, renderWelcomeCore, shipState, shipsPager, welcomeDismissalKey };
   };
 })();

package/modules/hall-ui/public/people.css

@@ -24,5 +24,14 @@
 .dir-who__t { display: flex; flex-direction: column; gap: 1px; min-width: 132px; }
 .dir-name { font-weight: 500; color: var(--ink); overflow-wrap: anywhere; }
 .dir-login { font-family: var(--font-mono); font-size: 11.5px; color: var(--ink-faint); }
+/* The roster's place cell carries two facts: the place, and under it the
+   builder's number in the same mono/faint voice the login uses (task
+   1002837). Block display so the id never wraps up beside the place. */
+.ledger__place .ledger__id {
+  display: block;
+  font-family: var(--font-mono);
+  font-size: 11.5px;
+  color: var(--ink-faint);
+}
 .dir-crafts { display: inline-flex; flex-wrap: wrap; gap: 6px; }
 .dir-none { color: var(--ink-faint); }

package/modules/hall-ui/public/roster.js

@@ -148,9 +148,19 @@
     return fmtInt(Math.round((Number(b.tokens_used) || 0) / credits)) + ' tokens per ' + one;
   }
 
+  // task 1002837: a builder's place answers "who is ahead", their NUMBER
+  // answers "which builder is this" — the id every task row, claim and ship
+  // note already cites. It sits under the place in the same mono/faint voice
+  // the login uses, and only when the payload carries one, so an older
+  // /builders response degrades to the place alone.
+  function idHtml(b) {
+    if (b.id == null || b.id === '') return '';
+    return '<span class="ledger__id">#' + esc(String(b.id)) + '</span>';
+  }
+
   function rowHtml(b) {
     return '<tr>'
-      + '<td class="ledger__num">' + esc(String(b.__place || '—')) + '</td>'
+      + '<td class="ledger__num ledger__place">' + esc(String(b.__place || '—')) + idHtml(b) + '</td>'
       + '<td>' + whoHtml(b) + achRowHtml(b.achievements) + '</td>'
       + '<td class="ledger__rank">' + rankBadgeHtml(b.rank) + '</td>'
       + '<td class="ledger__num">' + esc(fmtInt(b.total_credits)) + '</td>'

package/modules/hall-ui/public/style.css

@@ -1536,6 +1536,16 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 .ledger__verdict--ok { color: var(--ok); font-weight: 600; }
 .ledger__verdict--danger { color: var(--danger); font-weight: 600; }
 .ledger__verdict--none { color: var(--ink-soft); }
+/* The acclaim feed's evidence line (task 1002835): the grade and the cost the
+   ship recorded, under the work it describes. Secondary to the title — this is
+   what a voter checks, not what they read first. */
+.acclaim__evidence {
+  display: block;
+  margin-top: 3px;
+  font-size: 12px;
+  color: var(--ink-faint);
+}
+.acclaim__cost { font-variant-numeric: tabular-nums; }
 .ledger th.ledger__sortable { cursor: pointer; user-select: none; }
 .ledger th.ledger__sortable:hover { color: var(--ink); }
 .ledger th.ledger__sortable[aria-sort="ascending"]::after { content: " ↑"; }
@@ -2492,6 +2502,24 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 .landing__btn--request { align-self: flex-start; }
 .landing__request-status { font-size: 13px; margin: 0; color: var(--ok); }
 .landing__request-status[data-kind="err"] { color: var(--danger); }
+/* The returning builder's door, rendered only on the `apply` landing (task
+   1002851). Same panel as the request block and the same button geometry, so
+   signing in reads as a real control rather than a footnote — but a quiet
+   fill, because the request path is what most of this page's traffic needs. */
+.landing__returning {
+  border: 0;
+  border-radius: var(--radius);
+  background: var(--surface-2);
+  padding: 18px 20px;
+  margin: 16px 0;
+}
+.landing__returning .landing__cta { margin: 0; }
+.landing__btn--quiet {
+  background: transparent;
+  color: var(--ink);
+  box-shadow: inset 0 0 0 1px var(--border-strong);
+}
+.landing__btn--quiet:hover { background: var(--surface-2); color: var(--ink); }
 .landing__signin-note { font-size: 13px; color: var(--ink-soft); }
 
 /* ---------- goals ---------- */

package/modules/lifecycle/routes/tasks.js

@@ -29,6 +29,10 @@ const api = require('../../../src/module-api');
 // depRefusalRow: the ONE shape a dependency refusal carries, shared with the claim
 // path so promote and claim describe a blocked task identically (task 1003553).
 const { depRefusalRow } = require('../dead-deps.js');
+// gradeQualityWhere: the ONE definition of a task_grades row that is an actual
+// quality verdict rather than an outage or an errored worker (task 1002652).
+// The acclaim feed reads it so a grader outage never reaches a voter as 0.0.
+const { gradeQualityWhere } = require('../db-shared');
 const auth = api;
 const db = require('../db');
 const hierarchy = require('../hierarchy');
@@ -771,9 +775,28 @@ module.exports = function buildTasksRouter() {
                 t.shipped_at, t.shipped_by,
                 b.github_login, b.display_name,
                 COALESCE(pv.net, 0)::int AS net_votes,
-                mine.vote                AS my_vote
+                mine.vote                AS my_vote,
+                -- task 1002835: a karma vote is uninformed without the two facts
+                -- the ship already recorded. BOTH stay NULL when absent — an
+                -- ungraded ship and a zero-scoring one are different claims, and
+                -- so are an unlogged cost and a free one, so neither is
+                -- COALESCEd to a number the client would print as a measurement.
+                --
+                -- BOTH JOINS ARE INDEXED LOOKUPS, not scans: task_grades.task_id
+                -- is declared UNIQUE (migrations/016_pms_task_grades.sql:14, which
+                -- gives it its own index) and cost_log.task_id carries
+                -- idx_cost_log_task (migrations/003_pms.sql:152). Neither needs a
+                -- migration here, and neither degrades as cost_log grows.
+                CASE WHEN ${gradeQualityWhere('g')} THEN g.score END  AS grade_score,
+                CASE WHEN ${gradeQualityWhere('g')} THEN g.passed END AS grade_passed,
+                cost.total_usd          AS cost_usd
            FROM tasks t
            LEFT JOIN builders b ON b.id = t.shipped_by
+           LEFT JOIN task_grades g ON g.task_id = t.id
+           LEFT JOIN LATERAL (
+             SELECT SUM(amount_usd) AS total_usd
+               FROM cost_log WHERE task_id = t.id
+           ) cost ON true
            LEFT JOIN LATERAL (
              SELECT SUM(vote) AS net
                FROM peer_votes WHERE target_task_id = t.id
@@ -788,7 +811,15 @@ module.exports = function buildTasksRouter() {
           LIMIT $2`,
         [req.builder.id, limit]
       );
-      res.json({ tasks: rows, can_vote: ['metic', 'archon'].includes(req.builder.rank) });
+      const canVote = ['metic', 'archon'].includes(req.builder.rank);
+      // The cost is INTERNAL SPEND, and it is on this feed for one reason: to
+      // inform a vote. So it reaches only the ranks that can cast one. The grade
+      // is a quality verdict rather than spend and stays readable by any builder,
+      // as it already is on the grades table. Note the field is OMITTED, not
+      // nulled: a null here means "nothing was logged", and a reader who is not
+      // shown a figure must not be told a figure is missing.
+      const tasks = canVote ? rows : rows.map(({ cost_usd, ...rest }) => rest);
+      res.json({ tasks, can_vote: canVote });
     } catch (err) {
       // Log the detail server-side; don't return err.message — a raw Postgres
       // error can leak schema internals (table/column/constraint names).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.865",
+  "version": "1.19.867",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.865",
+      "version": "1.19.867",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.865",
+  "version": "1.19.867",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -71,6 +71,11 @@ const SUPPORT_MODULES = new Set(['helpers']);
 
 // Need a live DB / server / network — run in the integration-smoke gate instead.
 const INTEGRATION = new Set([
+  // task 1004004: the acclaim feed proves a claim about SQL semantics — that a
+  // grader outage nulls rather than scoring 0.0, and that a summed cost over no
+  // rows is NULL rather than a free ship. Only a transaction engine settles
+  // those, so this runs here and the DB-free sibling covers the renderer.
+  'acclaim_feed_evidence_db',
   'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
   'box_connect_e2e', 'box_onboard', 'boxes', 'cf_tunnel', 'cli_token_reissue',
   // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live

package/scripts/gds/ship-merge-gate.js

@@ -0,0 +1,187 @@
+// scripts/gds/ship-merge-gate.js — the fitness gate on the MERGE RESULT, run
+// between the local merge and the push that makes it main (task 1004032).
+//
+// WHY THIS EXISTS. Branch protection requires the `unit` check of a PULL
+// REQUEST. The local-merge land path is not a pull request: ship-merge.js
+// merges the task branch into main inside the main checkout and pushes the
+// result straight to origin/main, so no required check is consulted at any
+// point. Until this file, the only things standing between a builder's branch
+// and a red main were the grader (which reads a diff, not the gates) and
+// runSmoke (an HTTP liveness probe against the deployed instance). Neither runs
+// fitness.js, and ship-check.js — which does — is a command the builder may
+// choose to run, not a step of the ship.
+//
+// THE INCIDENT IT CLOSES (2026-09-17). Commit 89ac9620 (task 1000862) added two
+// legacy-acronym literals to .github/workflows/integration.yml. Measured after
+// the fact, on the commits themselves:
+//
+//   89ac9620  the BRANCH TIP  legacy_gds_literals 1137, committed baseline 1135
+//                             -> fitness.js exits non-zero. Already red.
+//   272b664d  the MERGE       the same 1137 against the same 1135, since the
+//                             merge changed nothing about those two literals.
+//   41ce52d4  the main before  fitness.js passes.
+//
+// So the guess in the original bug report — that a merge-ref-evaluated ratchet
+// let a clean branch produce a red main — is WRONG, and the truth is worse: the
+// branch was red on its own, and the ship pushed it to main regardless. This
+// was never the subtle "green branch, red merge" case; nothing measured
+// anything. main went red, and three tasks (1003456, 1004014, 1004021) sat at
+// 'confirmed' with nothing able to land until the baseline was raised by hand
+// to unblock the queue.
+//
+// WHAT IT DOES NOT DO. It does not punish a builder for damage that is already
+// on main. A gate that refused every ship while main is red would have turned
+// that same incident into a total deadlock instead of a bad afternoon — so when
+// the merge result fails, the pre-merge base is measured too, and a failure
+// already present there is reported and waved through. The rule is "do not make
+// main worse", not "main must be perfect before you may ship".
+
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+// mergeGateVerdict — PURE. The whole decision, over two measurements:
+//
+//   mergeClean  did fitness pass on the merge result (the tree about to be main)
+//   baseClean   did it pass on the pre-merge base — true, false, or null for
+//               "could not be measured"
+//
+// The null case blocks on purpose. A failing merge result IS a red main
+// whatever the base was doing; an unmeasurable base means the gate cannot show
+// the failure was inherited, and the honest report is "this push makes main
+// red and I cannot prove it was already red". The builder's own next step is
+// the same either way — run fitness.js and read the failing lines.
+function mergeGateVerdict({ mergeClean, baseClean }) {
+  if (mergeClean) return { block: false, reason: 'clean' };
+  if (baseClean === false) return { block: false, reason: 'pre-existing' };
+  if (baseClean === null || baseClean === undefined) return { block: true, reason: 'unmeasured-base' };
+  return { block: true, reason: 'regression' };
+}
+
+// gateMessage — PURE. The one line printed for each verdict, in the voice of
+// the sibling bails in ship-merge.js.
+function gateMessage(reason) {
+  switch (reason) {
+    case 'clean':
+      return '  fitness on the merge result: clean';
+    case 'pre-existing':
+      return '  fitness on the merge result: FAILS, but the pre-merge main fails too — inherited, not caused by this branch; proceeding';
+    case 'regression':
+      return '  auto-merge: fitness FAILS on the merge result and PASSES on the pre-merge main — this branch would turn main red; task stays at confirmed';
+    case 'unmeasured-base':
+      return '  auto-merge: fitness FAILS on the merge result and the pre-merge main could not be measured; task stays at confirmed';
+    default:
+      return `  auto-merge: fitness gate returned an unknown verdict (${reason})`;
+  }
+}
+
+// fitnessOutcome — one fitness.js run over the tree at `treeRoot`, as a
+// TRI-STATE: 'clean', 'failing', or 'unmeasurable'.
+//
+// The three are kept apart on purpose. An earlier cut returned a boolean, which
+// made a crashed run and a genuine finding the same answer — and since a
+// FAILING base waves the ship through, a probe that merely broke would have
+// certified any regression as inherited. A control that degrades to permissive
+// under infra flakiness is not a control. 'unmeasurable' blocks instead.
+//
+// IT MUST BE THAT TREE'S OWN fitness.js, not this file's sibling copy.
+// fitness.js resolves the repo it measures from its own __dirname and ignores
+// cwd, so invoking the shipping worktree's copy with `cwd` pointed elsewhere
+// measures the shipping worktree twice and reports "clean" for whatever it was
+// asked about. That is not a hypothetical: the first cut of this gate did
+// exactly that, and replaying the 2026-09-17 incident through it returned a
+// confident pass on a tree that fails fitness. Running each tree's own gate is
+// also the honest semantics — a base commit is measured by the rules that were
+// committed with it, which is what CI would have done on that commit.
+//
+// Output is inherited so the failing lines land in the ship log where the
+// builder reads them. A non-zero exit is a FINDING; anything else that goes
+// wrong (no fitness.js in that tree, a spawn that never ran, a checker that
+// crashed) is 'unmeasurable'.
+function fitnessOutcome(treeRoot) {
+  const script = path.join(treeRoot, 'scripts', 'gds', 'fitness.js');
+  if (!fs.existsSync(script)) return 'unmeasurable';
+  try {
+    execFileSync(process.execPath, [script], { cwd: treeRoot, stdio: 'inherit', shell: false });
+    return 'clean';
+  } catch (err) {
+    // A real gate verdict is a clean non-zero exit. A spawn that never produced
+    // an exit code (ENOENT on the interpreter, a signal, a permissions refusal)
+    // is the infra case, and must not be read as "this tree fails".
+    return typeof err?.status === 'number' ? 'failing' : 'unmeasurable';
+  }
+}
+
+// runFitnessAt — the boolean face of fitnessOutcome, kept for the merge-result
+// side where "not clean" is all the caller needs: a merge result that cannot be
+// measured is one this gate will not certify either way.
+function runFitnessAt(treeRoot) {
+  return fitnessOutcome(treeRoot) === 'clean';
+}
+
+// probeBaseClean — measure the PRE-MERGE base in a throwaway detached worktree,
+// so the merge already sitting in the main checkout does not have to be unwound
+// to ask the question. Returns true (base clean), false (base genuinely fails
+// its own gate) or null (could not be measured at all).
+//
+// No `npm ci` and no node_modules junction: fitness.js reads the tree and
+// shells out to git, and runs green in a bare worktree — verified on this repo.
+// If that ever stops being true the probe reports 'unmeasurable' rather than
+// inventing a verdict, and mergeGateVerdict blocks.
+function probeBaseClean(repoRoot, baseSha) {
+  if (!baseSha) return null;
+  let dir = null;
+  try {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-merge-gate-'));
+    execFileSync('git', ['worktree', 'add', '--detach', '--quiet', dir, baseSha], {
+      cwd: repoRoot, stdio: 'ignore', shell: false,
+    });
+  } catch (_) {
+    if (dir) removeProbe(repoRoot, dir);
+    return null;
+  }
+  try {
+    const outcome = fitnessOutcome(dir);
+    if (outcome === 'clean') return true;
+    if (outcome === 'failing') return false;
+    return null;
+  } finally {
+    removeProbe(repoRoot, dir);
+  }
+}
+
+// removeProbe — best-effort teardown. A husk left in the OS temp dir is
+// untidy; a ship that dies because its cleanup threw is worse.
+function removeProbe(repoRoot, dir) {
+  try {
+    execFileSync('git', ['worktree', 'remove', '--force', dir], { cwd: repoRoot, stdio: 'ignore', shell: false });
+  } catch (_) { /* fall through to the filesystem */ }
+  try {
+    fs.rmSync(dir, { recursive: true, force: true });
+  } catch (_) { /* nothing left to do */ }
+}
+
+// gateMergeResult — the I/O half: measure, decide, print. `baseSha` is the main
+// tip as it stood BEFORE the branch was merged in (in ship-merge.js that is
+// origin/main, since the ff-only step immediately above it guarantees the two
+// are the same commit).
+function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
+  log('  fitness against post-merge state...');
+  const mergeClean = runFitnessAt(repoRoot);
+  const baseClean = mergeClean ? true : probeBaseClean(repoRoot, baseSha);
+  const verdict = mergeGateVerdict({ mergeClean, baseClean });
+  log(gateMessage(verdict.reason));
+  return verdict;
+}
+
+module.exports = {
+  fitnessOutcome,
+  gateMergeResult,
+  gateMessage,
+  mergeGateVerdict,
+  probeBaseClean,
+  runFitnessAt,
+};

package/scripts/gds/ship-merge.js

@@ -26,6 +26,7 @@ const {
   landed,
 } = require('./ship-land.js');
 const { runSmoke } = require('./ship-grade.js');
+const { gateMergeResult } = require('./ship-merge-gate.js');
 const { dbOnlyIgnoredNotice } = require('./ship-honesty.js');
 const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateCopyInventory, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
 const { REPO_ROOT } = require('./ship-state.js');
@@ -247,6 +248,12 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       return landBailed('the local main is ahead of origin/main', '/merge-mode');
     }
 
+    // The tree the merge result will be compared against (task 1004032). The
+    // ff-only step above has just proved local main IS origin/main, so this is
+    // main as the rest of the world currently sees it — read before the branch
+    // is merged in, because afterwards the commit is no longer reachable by name.
+    const baseSha = gitOk('git rev-parse HEAD', { cwd: REPO_ROOT });
+
     // #681: build the merge argv and run it WITHOUT a shell. valueSummary is
     // DB-sourced (untrusted) — passing it as a literal argv element means
     // `$(...)`/backticks in it can never be interpreted as a command.
@@ -261,6 +268,21 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       return landBailed('post-merge smoke tests failed', '/merge-mode');
     }
 
+    // task 1004032: the merge result is about to BECOME main by a direct push,
+    // which no required status check gates. Run the same fitness gate CI would
+    // have run on a PR, and refuse the push when this branch is what turns main
+    // red. A failure already present on the pre-merge base is reported and
+    // waved through — see scripts/gds/ship-merge-gate.js for why.
+    const fitnessVerdict = gateMergeResult({ repoRoot: REPO_ROOT, baseSha });
+    if (fitnessVerdict.block) {
+      return landBailed(
+        fitnessVerdict.reason === 'regression'
+          ? 'fitness fails on the merge result and passes on the pre-merge main — this branch would turn main red'
+          : 'fitness fails on the merge result and the pre-merge main could not be measured',
+        'node scripts/gds/fitness.js',
+      );
+    }
+
     console.log('  pushing merged main to origin...');
     // SEC #863: route through push-main.js, which carries the
     // OTB_ALLOW_MAIN_PUSH override so the pre-push permission gate lets THIS

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.865'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.867'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');