@bongos/core 1.20.72 → 1.20.74

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.72",
-  "core_contract": "1.20.72",
-  "source_commit": "1b8205006fdecfe57f2908b856fb0df2a5f61f6e",
+  "core_version": "1.20.74",
+  "core_contract": "1.20.74",
+  "source_commit": "eb1d4850d76f6db32a57b9dce00da1d3eb47254f",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T15:30:26.777Z",
+  "built_at": "2026-10-01T16:22:03.505Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 572,
+    "docs_redacted": 573,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2800,
+    "functional_verbatim": 2803,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3400,
-  "tree_sha256": "f0893799d3b2d94852ce0f7cfa3a4189fcd1a20481dac1b9e596f23ef8971084",
+  "file_count": 3404,
+  "tree_sha256": "1c4cce121c1de975205357e900f8071000c4bdc96266e65f2a70d5edbfde42df",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "472c0606ff4fe4e775d56e038702960834838d8767e984427f5de29d31f9cbe9"
+      "sha256": "85cd4ad5c84b8ff0607a73a22af4e75fe50f2b155f2be6cda09813472ca6bbba"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "d641fbda06eb527c39d2eabbc7afc9f9182b03d766917e9fd84d69e86e9cc397"
+      "sha256": "bf3a7bf2dcf840e6f045bfe8bde50ad27a503c3b580ea1ee7d2631e384e87806"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "73b143d7faa4d930ab82f9f31b178816cc5a8ea87754de7e0575441905d4562a"
+      "sha256": "44274ba25258fdab686c0a7cc0874ed45b985024c061719b8720bfb406224be6"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "05ba628ec9c3761d8814af291cd5b11a02dd279c6e8df232b20ca632cc1e4336"
+      "sha256": "a21a4ea4ba80966475f02785193ee0f5f5c9ce8644836073bea468bf08a21295"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "11a7eb441c5533244c695a4c60fe7b170e87eb4081af77703e796e8370e971e5"
+      "sha256": "64b14dca138ecf2e7ebc04c45354eabeff3caad37031eac547b1afe506d447fb"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2254,25 +2254,30 @@
       "mode": "0000644",
       "sha256": "378354dd5ca8a1305b0c2b5a913baa5288da0014bcff8f6fb59fc1b28b654f59"
     },
+    {
+      "path": "docs/adr/0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md",
+      "mode": "0000644",
+      "sha256": "b9861113cddb698710176c8533b07078b5b63e1995adbb3dafb537c1bc69186a"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "25fdede6b346cb7e64a91f4d9a95449f30829343c152742c1d98f99d864798ec"
+      "sha256": "f4523673c55a6528efa2589ecc997b0192e15318755f0008a82b6d49e5023eb0"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "a24995419c2daa05deca5f2ed06656801c313f7499039a739b1bfa2cbc87e595"
+      "sha256": "c8f3ce40db00caa1f508fd15e8bfff78bbc17ee50ca6968d2349379ef4a1c1f6"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "63946432b10d130a8f1749ced38bb733449ea4ed8039c9794287d3a269249b0c"
+      "sha256": "fc15bc8d73b5092c16bc0b43c173f18a7915dd67e0d96c268d677b3c2ecc4c19"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "de7c4fc7c1133b726322910dc8db8992f17c0511df4f441c47671c791f182199"
+      "sha256": "12f04eb7e79afdc31515209431664a489d189cecc890816d0abbf7d02accf2cc"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2802,7 +2807,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "35268be856fb1c445d7092f01b251ccd8c891bc4d5037548a581891151833adf"
+      "sha256": "45e9c2b5bd53525b3eca32b497de9c69da21100f6eb95fc658614bb79b7f395c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4762,7 +4767,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "f3d82f60997e944eb7108c36bafa9d9be8469c5980b5460abfdf410ffa601dea"
+      "sha256": "7892e387042b020fbfe0dc16a5ea134b67aa2abfd97d5e72e09f5e8b529a1a04"
     },
     {
       "path": "modules/government/charter.js",
@@ -4919,6 +4924,11 @@
       "mode": "0000644",
       "sha256": "6eabf8b78f84922a44bdcfacf9e5dd4c2c5ead593b81125c2cc9ca8f13f844d9"
     },
+    {
+      "path": "modules/government/migrations/government_021_module_assessment_rerun.sql",
+      "mode": "0000644",
+      "sha256": "0f1a25b6bf6d0ecfbbb5a38fc3cf41fcd5689b42943397a663581c22a9634835"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -9457,12 +9467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3c57608794638c93c7dae2ccb49459646d64d836e842a05748f0da78f57a1c90"
+      "sha256": "cdd9bc54a6d46c2bf23d2cbe2f53ab328278496636f2f589eeccc7f403e179c7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6570d6e6a26b59165f041e6bac7201b855bc0876f9ea9a45bf4733da1ab2e4ac"
+      "sha256": "bfafaf25062d15f53265ed155a90de3e640290b95145fcec676b3e62e936682e"
     },
     {
       "path": "public-docs/index.html",
@@ -9482,7 +9492,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "0f8c8e892bac50f1d519f86871c6a9eb2c93bad81984a6000546ec945d28f1bf"
+      "sha256": "14086dee98a7516d597d2232f2c0f08816e6ccc76f7eee7754f003cb86960af5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11517,7 +11527,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "c31e753d353b6c8c6b1f4e9af80a31afc995568aea9fd4ad8ab408e093a6f786"
+      "sha256": "8290d110cfcb492ac241061e8dda955b594217f39128e6685578fab27e46e969"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11602,7 +11612,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "65dcf7b704d1fa321c128b36f3147bf23f54b976f60980450b2ed8a8583a302a"
+      "sha256": "0e36ce8c06b446a7b5b78577aa3ec63b1cfa03f023963847a6eee7b8ef84e20a"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -11677,7 +11687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "54662cdfd15931333470431aefb25deff3da4015340e78448781d2909c7004cc"
+      "sha256": "941d3e63ecc3d74e53428855942c85dc9d013da1e09e0ec4d40213dcb37dbd82"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14734,6 +14744,11 @@
       "mode": "0000644",
       "sha256": "c3c74387af6972760f6701efb80aaa588634965528d79d4ca881bca051e534e5"
     },
+    {
+      "path": "tests/module_assess_price_parity.mjs",
+      "mode": "0000644",
+      "sha256": "78f36a8bbbd948c4485dfd80df55e1ee053af1b510b4d98607c0d2545bcfa66c"
+    },
     {
       "path": "tests/module_assess_score.mjs",
       "mode": "0000644",
@@ -14834,6 +14849,11 @@
       "mode": "0000644",
       "sha256": "59d14575351c6b6529c6aff8e661ce915b8159988ad13585eea752c4bde4d9b6"
     },
+    {
+      "path": "tests/module_store_reassess.mjs",
+      "mode": "0000644",
+      "sha256": "07df2a5f55e1bbe41c99e24533e3fcb008be6c6cb0d0e0a3e1160a106baefe77"
+    },
     {
       "path": "tests/module_store_registry_migration.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 486 operations across 73 resource groups
+- 487 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1085,6 +1085,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
+      postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest

package/clients/bongos-client/index.cjs

@@ -1084,6 +1084,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
+      postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest

package/clients/bongos-client/index.d.ts

@@ -471,6 +471,8 @@ export interface PostStoreModulesKeyAcquireResponse { ok: boolean; module_key: u
 export interface PostStoreModulesKeyAcquiredRequest { version: string }
 export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
 export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown }
+export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: string }
+export interface PostStoreModulesKeyVersionsVersionReassessResponse { ok: boolean; queued: boolean; module_key: unknown; version: unknown; version_id: unknown }
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
 export interface PostTaskRecommendationsResponse { ok: boolean; recommendation: unknown }
 export interface PostTasksIdAttestGateRequest { head_sha: string }
@@ -1532,6 +1534,8 @@ export interface BongosClient {
     postStoreModulesKeyVersions(args?: RequestArgs): Promise<PostStoreModulesKeyVersionsResponse>;
     /** GET /store/modules/{key}/versions/{version}/howto — rank: any-builder */
     getStoreModulesKeyVersionsVersionHowto(args?: RequestArgs): Promise<GetStoreModulesKeyVersionsVersionHowtoResponse>;
+    /** POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon */
+    postStoreModulesKeyVersionsVersionReassess(args?: RequestArgs & { body?: PostStoreModulesKeyVersionsVersionReassessRequest }): Promise<PostStoreModulesKeyVersionsVersionReassessResponse>;
     /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /store/modules/latest — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1081,6 +1081,8 @@ export function createClient(opts = {}) {
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
+      postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest

package/docs/adr/0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md

@@ -0,0 +1,40 @@
+# ADR 0359 — Nobody sets a module's score by hand; a Metic+ person can ask for a re-check
+
+- **Status:** accepted
+- **Date:** 2026-10-01
+- **Task:** [task 1003796](https://cloudbongos.com/builders#/task/1003796) (goal 1000091 — working area 5, Module distribution & economy; criterion `wa5-quality-assessed`)
+- **Amends:** [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) D6 (the Metic+ score override) and [ADR 0347](0347-every-store-module-ships-a-how-to.md) D5 ("the Metic+ override applies to Docs like any part").
+- **Keeps:** ADR 0343 D6's delist (task 1003797) and "every action is recorded"; ADR 0347 D6's "Metic+ re-runs it" for a Docs grade that could not run.
+- **Decided with:** the owner (Will, Archon), 2026-10-01: "I don't think someone should be able to override a module's score. Maybe trigger a regrade but not change it." Metic and Archon may trigger it; the permission grant migration was approved the same day.
+
+## Context
+
+ADR 0343 D6 put a Metic+ override on top of the computed score, because an automated score will sometimes be wrong and a human-review-only panel does not scale. Task 1003796 was to build it. Before any code was written the owner ruled the other way: a score a person can type in is a score a person can sell, and the reason field does not change that.
+
+## Decision
+
+### D1 — No route sets, raises or lowers a score
+
+A module version's score only ever comes from its signals, composed by `scripts/gds/module-assess-score.js`. There is no override route, and the `kind = 'override'` rows `core_265` allows for are never written. The column and its CHECKs stay (removing them is a migration with nothing to gain); a test asserts no store route writes `module_assessment_scores`.
+
+### D2 — A Metic+ person can ask for a re-check, with a reason
+
+`POST /api/bongos/store/modules/:key/versions/:version/reassess { reason }` queues the same assessment a publish runs (`assessVersion`): Tests `pending` if there is no Tests result yet, the Security gate, the Docs grader, then the score. It answers 202, or 503 when the assessment queue is full. A reason is required and nothing else is accepted in the body, so a score cannot ride along. The audit middleware records who asked and why.
+
+This is how a wrong score gets corrected: if a signal was wrong because a check failed to run (the grader was down, npm could not be reached), the re-check runs it again. If a check itself is wrong, that is a bug in the check, fixed in code for every module.
+
+### D3 — Metic and Archon, through one new atom
+
+The route is gated by `module.assessment.rerun` (floor `metic`, not a system key) in `modules/government/catalog.js`, granted to `metic` and `archon` by `government_021_module_assessment_rerun.sql`. It is Metic+ and not open to every builder because each re-check spends a Docs grader call (up to 5¢, ADR 0347 D6) and re-runs the npm audit.
+
+## Consequences
+
+- An author who thinks their score is wrong asks a Metic+ person to re-check it, or reports a bug in the check. Neither path lets anyone pick the number.
+- A re-check can lower a score as well as raise it: it is whatever the checks say now.
+- The delist (task 1003797) is unchanged: it hides a module from the store, it does not change a score.
+
+## Rejected
+
+- **The override as ADR 0343 D6 planned it.** The owner's call (above).
+- **An override that only lowers a score.** It is still a person choosing the number.
+- **Re-checks for every builder.** Each one costs money; Metic+ keeps that spend with trusted people.

package/docs/adr/README.md

@@ -477,3 +477,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0356 | [**A recruit invite expires 30 days after it is sent, decided at read time** ([task 1002969](https://cloudbongos.com/builders#/task/1002969), goal 1000110 — privacy spec D4, owner-signed). **D1:** one definition, `src/bongos/invite-expiry.js` (`INVITE_EXPIRY_DAYS` + the SQL), read by the sign-in gate, the waiting-page probe, the onboarding routes and, through the doorway's `inviteExpiry`, the hub. Nothing is stored and nothing sweeps. **D2:** only `kind='invite'` rows expire; approved applications and goal invites do not. **D3:** amends ADR 0335 D2.5: the gate reads `kind` only inside the expiry unit, which can close a door and never open one. **D4:** an expired invite is refused, marked `expired` + `expires_at` in the queues, reported `expired` by the status probe (the CLI stops), and replaced by a re-invite's fresh row. **D5:** the hub hides a `pending` notice past 30 days and a re-invite restamps it. Split out: `seen_at` (task 1004443), the decline relay (task 1004444).](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) | platform identity / admission / invites |
 | 0357 | [**The update rule set on /deploy is the one the sweep follows** ([task 1004468](https://cloudbongos.com/builders#/task/1004468), goal 1000090 — BONGOS-V2, owner's ruling 2026-09-30). Amends [ADR 0136](0136-update-channel-subscription-policy.md)'s rejected DB-column alternative. **D1:** for a roster entry whose slug matches a `provisioning_instances` row, the unattended sweep uses that row's `update_channel` (set on /deploy, task 1004445). **D2:** the roster's `channel` is only the fallback — no matching row, or the database unreadable; enrollment and topology stay in the roster. **D3:** the sweep logs each entry's channel and its source, naming an overridden roster value. **D4:** read over psql from the sweep's own `DATABASE_URL`/`PGDATABASE`, never an entry's `env`. **D5:** nothing is copied; a row never changed is `patch`. Delivery to cloudbongos.com waits on the frozen sweep checkout (task 1004307). Rejected: roster stays in charge; stricter-of-the-two; copying roster values into rows.](0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md) | distribution / updates |
 | 0358 | [**A hall wears a look, and its night takes a tint of it** ([task 1004421](https://cloudbongos.com/builders#/task/1004421), goal 1000121 — BV2.PS06; owner D2 + D8, 2026-09-30). Amends [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) (a look could not carry a dark ground) and DESIGN.md's pure-black rule, for halls only. **D1:** the night tint is a formula over the thirteen — the four dark grounds take 5–6% of the look's accent (src/night-tint.js), emitted after the sheet as both dark twins; no token added. **D2:** on by default, and only a chosen look turns it on — a hall with no look is unchanged. **D3:** the apex and hub stay pure black (ADR 0204). **D4:** a custom look is ONE accent for both modes, its lightness nudged until every pair the hall paints with it reads (lookAdjustAccent, client copy test-pinned). **D5:** look + night_tint join the provisioning settings vocabulary; the accent and logo address ride as companion env; the instance resolves the look from the style library. **D6:** a logo is PNG/JPEG/WebP ≤256 KB, magic-sniffed, never SVG, served content-addressed; it is the hall mark and the favicon. Rejected: per-look dark palettes, two custom accents, refusing an unreadable accent, sending the palette over env.](0358-a-hall-wears-a-look-and-its-night-takes-a-tint.md) | hall / branding / design world |
+| 0359 | [**Nobody sets a module's score by hand; a Metic+ person can ask for a re-check** ([task 1003796](https://cloudbongos.com/builders#/task/1003796) · goal 1000091, criterion `wa5-quality-assessed`). Amends [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) D6 and [ADR 0347](0347-every-store-module-ships-a-how-to.md) D5 on the owner's ruling: there is no score override. A score only ever comes from its signals. Instead `POST /store/modules/:key/versions/:version/reassess { reason }`, gated by the new `module.assessment.rerun` atom (metic floor, granted to metic + archon by `government_021`), queues the same assessment a publish runs. A reason is required and nothing else is accepted. The delist (task 1003797) is unchanged.](0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md) | module store / assessment / permissions |

package/docs/api/openapi.json

@@ -20132,6 +20132,81 @@
         ]
       }
     },
+    "/store/modules/{key}/versions/{version}/reassess": {
+      "post": {
+        "operationId": "post_store_modules_key_versions_version_reassess",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/versions/:version/reassess",
+        "description": "POST /api/bongos/store/modules/:key/versions/:version/reassess — a Metic+ person asks for a published version's assessment to run again: the Security gate, the Docs grader, then the score (task 1003796, ADR 0359). There is deliberately no way to SET a score: the owner ruled a person may trigger a re-check, never change the number. A reason is required; the audit middleware records it with who asked. Answers 202 — the run is queued like a publish's.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.assessment.rerun` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.assessment.rerun"
+        ],
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          },
+          {
+            "name": "version",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `version`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionReassessRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionReassessResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/versions/{version}/tarball": {
       "get": {
         "operationId": "get_store_modules_key_versions_version_tarball",
@@ -30083,6 +30158,37 @@
           "version"
         ]
       },
+      "PostStoreModulesKeyVersionsVersionReassessRequest": {
+        "type": "object",
+        "properties": {
+          "reason": {
+            "type": "string",
+            "maxLength": 2000
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostStoreModulesKeyVersionsVersionReassessResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "queued": {
+            "type": "boolean"
+          },
+          "module_key": {},
+          "version": {},
+          "version_id": {}
+        },
+        "required": [
+          "ok",
+          "queued",
+          "module_key",
+          "version",
+          "version_id"
+        ]
+      },
       "PostTaskRecommendationsRequest": {
         "type": "object",
         "properties": {
@@ -31044,9 +31150,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 486,
-  "x-schema-count": 514,
+  "x-endpoint-count": 487,
+  "x-schema-count": 516,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 344,
+  "x-response-schemas": 345,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 486 endpoints across 89 route files.
+> **Generated from the live route files** — the route file is authoritative. 487 endpoints across 89 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -769,7 +769,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (8)
+## `store` (9)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -779,6 +779,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/store/modules/:key/entitlement` | `any-builder` | — |  |
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
 | GET | `/api/bongos/store/modules/:key/versions/:version/howto` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from … |
+| POST | `/api/bongos/store/modules/:key/versions/:version/reassess` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/reassess — a Metic+ person asks for a published version's assessment to run again: … |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
 | GET | `/api/bongos/store/modules/latest` | `any-builder` | — | The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to repor… |
 

package/docs/architecture.md

@@ -273,7 +273,7 @@ module_assessment_scores(id, version_id, kind IN (computed|override), overall 0-
               -- and is a new row on the computed history, never an edit (D6)
 ```
 
-Signals that fill it: **Tests** — `scripts/gds/module-assess-tests.js <version id>` (task 1003791) unpacks the published tarball to `<core root>/.module-assess-<run>/<key>/` (gitignored, removed after), runs each `tests/*.mjs` in its own node process with a timeout and a credential-free environment — regardless of `isModuleEnabled`, which skips every default-off catalog module in the unit gate — and appends one `tests` row: `scored` = % of test files passing (sample_size = files), `no_data` = declares no tests, `not_scored` = tarball unreadable. The store path **refuses unless `MODULE_TEST_SANDBOX=1`** — a published module's tests run only in a separate testing environment with no secrets on disk, never on the control plane (owner, 2026-09-30). `--dir modules/<key>` is a DB-free dry run on your own checkout. On publish the version's Tests part is recorded `pending` until that environment runs it. **Security** — `scripts/gds/module-assess-security.js <version id>` (task 1003792, ADR 0343 D2 gate) appends one `security` row, `passed`/`failed` only: fails on a publish-denylist file, a `module.json` dependency fetched outside the registry (an allowlist: a plain npm name with a plain semver range or dist-tag, anything else fails and is never handed to npm), or a high/critical `npm audit` advisory (resolved metadata-only with `--ignore-scripts`; nothing of the module runs, so it is control-plane safe). An audit that cannot run is `not_scored` — the gate stays shut. Floating ranges and the `maintenance` posture (ADR 0166) are noted in `detail`, never failed on. **Docs** — `scripts/gds/module-assess-docs.js <version id>` (task 1004367, ADR 0347 D5/D6) grades the version's `HOWTO.md`, read from its verified tarball (never the optional `howto.artifactUrl`), with one Claude Sonnet 5 call through the `grade` port's cached `runSubagent` (no tools, the file fenced as untrusted, cut to 40,000 characters to stay under 5¢), retried once. It appends a `pending` row, then `scored` (the average of four 0–100 criteria — purpose, newcomer could use it, runnable example, limits stated — each with a reason, kept in `detail`) or `not_scored` (outage, malformed reply twice, no `HOWTO.md`, bad tarball). Each call's spend goes to `cost_log` via the `reward` port (source `module-docs-grader`). Price is never in the prompt. `--file <HOWTO.md>` is a DB-free dry run. **Score** — `scripts/gds/module-assess-score.js` (task 1003794) composes a version's newest signal per part into a `module_assessment_scores` row: `security_passed` from the gate (NULL = not run), `overall` = the plain average of the SCORED parts among Tests, Install, Reliability and Tester feedback (a part with no data is left out, never zero; none → NULL), Docs shown but never averaged, `is_new` until Install or Reliability is scored, plus the signal ids and a readable `formula`. A recompose that would repeat the current score writes nothing. All three signal CLIs recompose after recording, and the store's publish route queues `assessVersion` after answering the author (one at a time per process, at most 20 waiting; past that it is logged as not assessed): Tests `pending` (only if no Tests result exists), the Security gate, Docs, then the score. `node scripts/gds/module-assess-version.js <id>` re-runs it by hand (`scripts/gds/module-assess-version.js` holds the publish-time half, apart from the composer so the signal CLIs recompose without a require cycle).
+Signals that fill it: **Tests** — `scripts/gds/module-assess-tests.js <version id>` (task 1003791) unpacks the published tarball to `<core root>/.module-assess-<run>/<key>/` (gitignored, removed after), runs each `tests/*.mjs` in its own node process with a timeout and a credential-free environment — regardless of `isModuleEnabled`, which skips every default-off catalog module in the unit gate — and appends one `tests` row: `scored` = % of test files passing (sample_size = files), `no_data` = declares no tests, `not_scored` = tarball unreadable. The store path **refuses unless `MODULE_TEST_SANDBOX=1`** — a published module's tests run only in a separate testing environment with no secrets on disk, never on the control plane (owner, 2026-09-30). `--dir modules/<key>` is a DB-free dry run on your own checkout. On publish the version's Tests part is recorded `pending` until that environment runs it. **Security** — `scripts/gds/module-assess-security.js <version id>` (task 1003792, ADR 0343 D2 gate) appends one `security` row, `passed`/`failed` only: fails on a publish-denylist file, a `module.json` dependency fetched outside the registry (an allowlist: a plain npm name with a plain semver range or dist-tag, anything else fails and is never handed to npm), or a high/critical `npm audit` advisory (resolved metadata-only with `--ignore-scripts`; nothing of the module runs, so it is control-plane safe). An audit that cannot run is `not_scored` — the gate stays shut. Floating ranges and the `maintenance` posture (ADR 0166) are noted in `detail`, never failed on. **Docs** — `scripts/gds/module-assess-docs.js <version id>` (task 1004367, ADR 0347 D5/D6) grades the version's `HOWTO.md`, read from its verified tarball (never the optional `howto.artifactUrl`), with one Claude Sonnet 5 call through the `grade` port's cached `runSubagent` (no tools, the file fenced as untrusted, cut to 40,000 characters to stay under 5¢), retried once. It appends a `pending` row, then `scored` (the average of four 0–100 criteria — purpose, newcomer could use it, runnable example, limits stated — each with a reason, kept in `detail`) or `not_scored` (outage, malformed reply twice, no `HOWTO.md`, bad tarball). Each call's spend goes to `cost_log` via the `reward` port (source `module-docs-grader`). Price is never in the prompt. `--file <HOWTO.md>` is a DB-free dry run. **Score** — `scripts/gds/module-assess-score.js` (task 1003794) composes a version's newest signal per part into a `module_assessment_scores` row: `security_passed` from the gate (NULL = not run), `overall` = the plain average of the SCORED parts among Tests, Install, Reliability and Tester feedback (a part with no data is left out, never zero; none → NULL), Docs shown but never averaged, `is_new` until Install or Reliability is scored, plus the signal ids and a readable `formula`. A recompose that would repeat the current score writes nothing. All three signal CLIs recompose after recording, and the store's publish route queues `assessVersion` after answering the author (one at a time per process, at most 20 waiting; past that it is logged as not assessed): Tests `pending` (only if no Tests result exists), the Security gate, Docs, then the score. `node scripts/gds/module-assess-version.js <id>` re-runs it by hand (`scripts/gds/module-assess-version.js` holds the publish-time half, apart from the composer so the signal CLIs recompose without a require cycle). **No score is ever set by hand** (owner, ADR 0359): a Metic+ person can only ask for a re-check, `POST /store/modules/:key/versions/:version/reassess { reason }` (atom `module.assessment.rerun`, metic + archon via `government_021`), which queues the same `assessVersion` a publish runs and answers 202.
 
 Code: `src/bongos/module-entitlements.js` (`grantEntitlement`, `recordAcquired`, `revokeEntitlement`, `checkEntitlement`, `listEntitlements`). Read routes (own-scoped, `requireBuilder`): `GET /store/entitlements`, `GET /store/modules/:key/entitlement`. Install (task 1003785) grants a free module through `POST /store/modules/:key/acquire`; the buy action (area 8) will grant a paid one.
 

package/docs/module-api-changelog.md

@@ -2801,5 +2801,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.70 with no explicit bump. run 36881290177. (task 1002620)
   1.20.72 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.71 with no explicit bump. run 36884685441. (task 1002620)
+  1.20.73 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.72 with no explicit bump. run 36886320087. (task 1002620)
+  1.20.74 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.73 with no explicit bump. run 36891334916. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/catalog.js

@@ -216,6 +216,9 @@ const PERMISSIONS = [
   { key: 'goal.scope.widen', system: false, floor: 'metic', guards: 'POST /goals/:id/scope (same-tier; cross-tier = goal.scope.manage, system)' },
   { key: 'module.enable', system: false, floor: 'metic', guards: 'POST /modules/:key/enable' },
   { key: 'module.submit', system: false, floor: 'metic', guards: 'POST /modules/:key/submit, GET /modules/submissions' },
+  // Re-run a store version's automatic assessment (task 1003796, ADR 0359). Never a
+  // hand-set score: the owner ruled a person may ask for a re-check, not change the number.
+  { key: 'module.assessment.rerun', system: false, floor: 'metic', guards: 'POST /store/modules/:key/versions/:version/reassess' },
   { key: 'security.report.file', system: false, floor: 'metic', guards: 'POST /security/reports, GET /security/adr' },
   { key: 'llm_cache.use', system: false, floor: 'metic', guards: 'POST /llm-cache/{lookup,store}' },
   { key: 'backup.manage', system: false, floor: 'metic', guards: 'GET /backup/status, POST /backup/trigger' },

package/modules/government/migrations/government_021_module_assessment_rerun.sql

@@ -0,0 +1,36 @@
+-- government_021_module_assessment_rerun.sql — grant the new
+-- `module.assessment.rerun` atom to Metic and Archon (task 1003796, ADR 0359).
+--
+-- WHAT IT IS. A Metic+ person may ask the store to re-run a published version's
+-- automatic assessment (the Security gate, the Docs grader, then the score). It
+-- never sets a score by hand: the owner ruled (2026-10-01) that nobody may change
+-- a module's score, only trigger a re-check. A re-run costs about 5 cents (one
+-- Docs grader call), which is why it is Metic+ and not open to every builder.
+--
+-- WHY THIS FILE EXISTS. RANK_SEED is derived from the catalog's floors, and the
+-- drift guard (tests/government_seed.mjs) compares it against the union of the
+-- run-once seed plus every later grant migration, per rank. A metic-floor key is
+-- held by metic AND archon, so both are granted here.
+--
+-- Additive only: one new permission key granted to two ranks; nothing is revoked.
+-- Approved by the owner (Will, Archon) on 2026-10-01.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- scans for it literally.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'module.assessment.rerun'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'module.assessment.rerun'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.72",
+  "version": "1.20.74",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.72",
+      "version": "1.20.74",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.72",
+  "version": "1.20.74",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8561,5 +8561,17 @@
       "id": "1004367",
       "text": "Every module published to the store now gets its how-to guide read and scored by AI for clarity, with a short reason for each part so authors know what to fix. If the AI can't run, the guide shows 'not scored' rather than a ze"
     }
+  ],
+  "1.20.73": [
+    {
+      "id": "1003795",
+      "text": "There is now an automatic check that free modules are scored exactly like paid ones. If anyone ever makes price affect a module's score, the check fails and points at the line."
+    }
+  ],
+  "1.20.74": [
+    {
+      "id": "1003796",
+      "text": "Nobody can change a module's score by hand. Senior builders can ask for a module to be checked again, with a reason, and the score updates from the fresh check."
+    }
   ]
 }

package/src/bongos/route-rank-check.js

@@ -237,6 +237,9 @@ const EXPECTED_RANKS = {
   // pins above — a silent downgrade puts the defense inventory below the trust line.
   // Newly VISIBLE in BV1.R109b (declared multi-line, so previously unpinnable).
   'GET /security/adr': 'metic+archon',
+  // Re-running a store version's assessment (task 1003796, ADR 0359) spends a Docs
+  // grader call and re-opens the Security gate, so it is pinned to its own atom.
+  'POST /store/modules/:key/versions/:version/reassess': 'perm:module.assessment.rerun',
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed

package/src/bongos/routes/modules.js

@@ -402,6 +402,33 @@ module.exports = function buildModulesRouter() {
       setImmediate(() => moduleAssessVersion.queueAssessment(result.version.id, { log }));
     }));
 
+  // POST /api/bongos/store/modules/:key/versions/:version/reassess — a Metic+ person
+  // asks for a published version's assessment to run again: the Security gate, the
+  // Docs grader, then the score (task 1003796, ADR 0359). There is deliberately no
+  // way to SET a score: the owner ruled a person may trigger a re-check, never change
+  // the number. A reason is required; the audit middleware records it with who
+  // asked. Answers 202 — the run is queued like a publish's.
+  router.post('/store/modules/:key/versions/:version/reassess', auth.requireBuilder, auth.requirePermission('module.assessment.rerun'),
+    asyncHandler('POST /store/modules/:key/versions/:version/reassess', async (req, res) => {
+      if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 2000 } })) return;
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const reason = String(req.body?.reason || '').trim();
+      if (!reason) {
+        return res.fail('reason_required', { status: 400, message: 'Say why this version should be checked again, in reason. A re-check runs the automatic assessment; it never sets a score by hand.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const queued = moduleAssessVersion.queueAssessment(r.version.id, { log });
+      if (!queued) {
+        return res.fail('assessment_queue_full', { status: 503, message: 'The assessment queue is full. Try again in a few minutes.' });
+      }
+      log.info({ versionId: r.version.id, builderId: req.builder.id }, `re-assessment of ${key} ${version} queued`);
+      res.status(202).json({ ok: true, queued: true, module_key: key, version, version_id: r.version.id });
+    }));
+
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the
   // read side of the entitlement record (task 1003813, ADR 0338 D1). Own-scoped
   // like /me/sessions: the holder is ALWAYS the caller (holder_kind 'builder',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.72'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.74'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_assess_price_parity.mjs

@@ -0,0 +1,174 @@
+// tests/module_assess_price_parity.mjs — free modules are assessed identically to
+// paid ones: price neither buys nor excuses a score (task 1003795; owner decision
+// on criterion wa5-quality-assessed; ADR 0343 D6).
+//
+// Two proofs, like the update-parity test proves its own criterion:
+//   1. STATIC — no file on the assessment path (scripts/gds/module-assess-*.js)
+//      names a price, a currency amount, free/paid or an entitlement in its code
+//      (comments are allowed to explain the rule). A price-conditional branch
+//      added anywhere there fails this test, naming the file and line.
+//   2. BEHAVIOUR — the same signals give the same score for a paid version and
+//      for the three ways a module can be free: a zero price, no price set, and a
+//      core-bundled module. The fake pool holds every case's price state and
+//      refuses any query that reads it.
+//
+// Run:  node tests/module_assess_price_parity.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { composeScore, recomposeScore } = require('../scripts/gds/module-assess-score.js');
+const { assessVersion } = require('../scripts/gds/module-assess-version.js');
+
+// ---------------------------------------------------------------------------
+// 1. static — the assessment path never reads price
+// ---------------------------------------------------------------------------
+
+const PRICE_WORD = /\b(price\w*|isFree\w*|free|paid|cents|credits|store_module_prices|entitlement\w*|purchase\w*)\b/i;
+
+// The code lines of a JS source, comments blanked (line numbers kept).
+function codeLines(src) {
+  const noBlock = src.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '));
+  return noBlock.split('\n').map((l) => l.replace(/(^|[^:'"`\\])\/\/.*$/, '$1'));
+}
+function priceHits(src) {
+  return codeLines(src).flatMap((l, i) => (PRICE_WORD.test(l) ? [`${i + 1}: ${l.trim()}`] : []));
+}
+
+const ASSESS_DIR = path.join(root, 'scripts', 'gds');
+const assessFiles = fs.readdirSync(ASSESS_DIR).filter((f) => /^module-assess-.*\.js$/.test(f)).sort();
+
+test('the scan sees the whole assessment path', () => {
+  for (const f of ['module-assess-score.js', 'module-assess-security.js', 'module-assess-tests.js', 'module-assess-version.js']) {
+    assert.ok(assessFiles.includes(f), `${f} is on the assessment path`);
+  }
+});
+
+test('the scanner catches a price branch and ignores a comment about price', () => {
+  assert.equal(priceHits('// Nothing here reads price: free and paid are assessed identically\nconst x = 1;').length, 0);
+  assert.equal(priceHits('/* free modules\n are not excused */ const y = 2;').length, 0);
+  assert.deepEqual(priceHits('const a = 1;\nif (ver.price_cents === 0) score += 10;'), ['2: if (ver.price_cents === 0) score += 10;']);
+  assert.equal(priceHits("pool.query('SELECT * FROM store_module_prices')").length, 1);
+  assert.equal(priceHits('const bonus = isFreePrice(p) ? 0 : 5;').length, 1);
+  assert.equal(priceHits("const u = 'https://x.test/a'; if (paid) x();").length, 1, 'a URL in a string does not hide the rest of the line');
+});
+
+test('no assessment file names a price in its code', () => {
+  const found = assessFiles.flatMap((f) => priceHits(fs.readFileSync(path.join(ASSESS_DIR, f), 'utf8')).map((h) => `scripts/gds/${f}:${h}`));
+  assert.deepEqual(found, [], `price must never gate or excuse a score (ADR 0343 D6):\n${found.join('\n')}`);
+});
+
+// ---------------------------------------------------------------------------
+// 2. behaviour — paid, zero-price, no-price and core-bundled score the same
+// ---------------------------------------------------------------------------
+
+const CASES = [
+  { id: 1, module_key: 'paid-mod', version: '1.0.0', price: { price_cents: 500, price_credits: 50 } },
+  { id: 2, module_key: 'zero-mod', version: '1.0.0', price: { price_cents: 0, price_credits: 0 } },
+  { id: 3, module_key: 'unpriced-mod', version: '1.0.0', price: null },
+  { id: 4, module_key: 'economy', version: '1.0.0', price: null, core_bundled: true },
+];
+
+// core_265's append-only rows in memory, every case's price state alongside, and
+// a refusal for any query that reads price.
+function fakeDb() {
+  const signals = [];
+  const scores = [];
+  const sqlSeen = [];
+  let clock = 0;
+  const db = {
+    signals, scores, sqlSeen,
+    async query(sql, params = []) {
+      sqlSeen.push(sql);
+      if (PRICE_WORD.test(sql)) throw new Error(`the assessment read price: ${sql.slice(0, 120)}`);
+      if (/^SELECT id, module_key, version FROM store_module_versions WHERE id/.test(sql)) {
+        const v = CASES.find((c) => String(c.id) === String(params[0]));
+        return { rows: v ? [{ id: v.id, module_key: v.module_key, version: v.version }] : [] };
+      }
+      if (/SELECT DISTINCT ON \(part\)/.test(sql)) {
+        const cur = {};
+        for (const s of signals.filter((x) => String(x.version_id) === String(params[0]))) {
+          if (!cur[s.part] || s.t > cur[s.part].t || (s.t === cur[s.part].t && s.id > cur[s.part].id)) cur[s.part] = s;
+        }
+        return { rows: Object.values(cur) };
+      }
+      if (/FROM module_assessment_scores/.test(sql) && /^SELECT/.test(sql.trim())) {
+        const mine = scores.filter((x) => String(x.version_id) === String(params[0]) && x.kind === 'computed');
+        return { rows: mine.length ? [mine[mine.length - 1]] : [] };
+      }
+      if (/INSERT INTO module_assessment_scores/.test(sql)) {
+        const row = { id: scores.length + 1, version_id: params[0], kind: 'computed', overall: params[1], security_passed: params[2], is_new: params[3], formula: params[4], signal_ids: params[5].map(String) };
+        scores.push(row); return { rows: [row] };
+      }
+      if (/INSERT INTO module_assessment_signals/.test(sql) && /'pending'/.test(sql)) {
+        if (signals.some((s) => String(s.version_id) === String(params[0]) && s.part === 'tests')) return { rows: [] };
+        signals.push({ id: signals.length + 1, version_id: params[0], part: 'tests', outcome: 'pending', score: null, t: ++clock });
+        return { rows: [] };
+      }
+      throw new Error(`unexpected SQL: ${sql.slice(0, 80)}`);
+    },
+  };
+  db.add = (versionId, part, outcome, score = null) => {
+    const row = { id: signals.length + 1, version_id: versionId, part, outcome, score, t: ++clock };
+    signals.push(row); return row;
+  };
+  return db;
+}
+
+// The answer with the version id taken out, so cases can be compared.
+const shape = (s) => ({ overall: s.overall, security_passed: s.security_passed, is_new: s.is_new, formula: s.formula });
+
+test('composeScore takes no price: the same signals give the same score whatever is attached', () => {
+  const signals = {
+    security: { id: 1, part: 'security', outcome: 'passed', score: null },
+    tests: { id: 2, part: 'tests', outcome: 'scored', score: 70 },
+    install: { id: 3, part: 'install', outcome: 'scored', score: 90 },
+  };
+  const base = composeScore(signals);
+  for (const c of CASES) {
+    // Price riding along on the rows must change nothing.
+    const withPrice = Object.fromEntries(Object.entries(signals).map(([k, r]) => [k, { ...r, ...(c.price || {}), core_bundled: !!c.core_bundled }]));
+    assert.deepEqual(composeScore(withPrice), base, c.module_key);
+  }
+});
+
+for (const [label, signalsFor] of [
+  ['scored parts', (db, id) => { db.add(id, 'security', 'passed'); db.add(id, 'tests', 'scored', 64); db.add(id, 'reliability', 'scored', 88); }],
+  ['a failed gate', (db, id) => { db.add(id, 'security', 'failed'); db.add(id, 'tests', 'scored', 99); }],
+  ['no data yet', (db, id) => { db.add(id, 'tests', 'no_data'); }],
+]) {
+  test(`recompose: paid, zero-price, no-price and core-bundled score the same (${label})`, async () => {
+    const db = fakeDb();
+    const out = [];
+    for (const c of CASES) {
+      signalsFor(db, c.id);
+      const res = await recomposeScore(c.id, { db });
+      out.push([c.module_key, shape(res.score)]);
+    }
+    for (const [key, s] of out.slice(1)) assert.deepEqual(s, out[0][1], `${key} scores exactly like the paid module`);
+  });
+}
+
+test('assessVersion on publish runs the same steps for every case, and never reads price', async () => {
+  const db = fakeDb();
+  const steps = [];
+  const recordSecurity = async (id, { db: d }) => { steps.push(['security', id]); return { ok: true, signal: d.add(id, 'security', 'passed') }; };
+  const recordDocs = async (id, { db: d }) => { steps.push(['docs', id]); return { ok: true, signal: d.add(id, 'docs', 'scored', 50) }; };
+  const out = [];
+  for (const c of CASES) {
+    const res = await assessVersion(c.id, { db, recordSecurity, recordDocs });
+    assert.equal(res.ok, true, c.module_key);
+    out.push(shape(res.score));
+  }
+  for (const s of out.slice(1)) assert.deepEqual(s, out[0]);
+  const perCase = (id) => steps.filter(([, v]) => v === id).map(([k]) => k).join(',');
+  for (const c of CASES.slice(1)) assert.equal(perCase(c.id), perCase(CASES[0].id), `${c.module_key} goes through the same checks`);
+  assert.ok(db.sqlSeen.length > 0);
+  assert.ok(db.sqlSeen.every((q) => !PRICE_WORD.test(q)), 'no assessment query touched price');
+});

package/tests/module_store_reassess.mjs

@@ -0,0 +1,120 @@
+// tests/module_store_reassess.mjs — a Metic+ person can ask for a store version's
+// assessment to run again, and can never set a score by hand (task 1003796,
+// ADR 0359). Drives the real POST /store/modules/:key/versions/:version/reassess
+// handler off the real router (no port, no real DB — pool.js is replaced in the
+// require cache, the module_store_howto.mjs harness), with the assessment queue
+// stubbed so nothing runs npm or a model.
+//
+// Run:  node tests/module_store_reassess.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const state = { modules: { weather: { module_key: 'weather', title: 'Weather', author_id: 42, status: 'listed' } }, versions: [{ id: 7, module_key: 'weather', version: '1.2.0', tarball_sha256: 'x', artifact_path: 'weather/weather-1.2.0.tgz', published_at: '2026-09-30T00:00:00Z' }], sql: [] };
+const query = async (sql, params = []) => {
+  state.sql.push(sql);
+  if (/FROM store_modules WHERE module_key = \$1/.test(sql)) {
+    const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1 AND version = \$2/.test(sql)) {
+    return { rows: state.versions.filter((v) => v.module_key === params[0] && v.version === params[1]) };
+  }
+  return { rows: [] };
+};
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ query, release() {} }), query } } };
+
+const moduleAssessVersion = require('../scripts/gds/module-assess-version.js');
+const queued = [];
+let queueAccepts = true;
+moduleAssessVersion.queueAssessment = (id) => { queued.push(id); return queueAccepts; };
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+
+const PATH = '/store/modules/:key/versions/:version/reassess';
+function handlerFor(router) {
+  const layer = router.stack.find((l) => l.route && l.route.path === PATH && l.route.methods.post);
+  assert.ok(layer, `no POST ${PATH} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, depth: stack.length };
+}
+async function invoke(handle, { key = 'weather', version = '1.2.0', body = {} } = {}) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set() { return this; },
+    fail(code, opts, details) { const o = typeof opts === 'number' ? { status: opts, details } : (opts || {}); this.statusCode = o.status; this.body = { error: code, ...o }; return this; },
+  };
+  let nextErr = null;
+  await handle({ params: { key, version }, body, builder: { id: 3 } }, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+const { handle, depth } = handlerFor(buildModulesRouter());
+
+test('the route is gated by its own Metic+ atom, granted to metic and archon', () => {
+  assert.ok(depth >= 3, 'requireBuilder + requirePermission sit in front of the handler');
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  assert.match(src, /router\.post\('\/store\/modules\/:key\/versions\/:version\/reassess', auth\.requireBuilder, auth\.requirePermission\('module\.assessment\.rerun'\)/);
+  const { byKey } = require('../modules/government/catalog.js');
+  const p = byKey('module.assessment.rerun');
+  assert.equal(p.floor, 'metic');
+  assert.equal(p.system, false);
+  const mig = fs.readFileSync(path.join(ROOT, 'modules/government/migrations/government_021_module_assessment_rerun.sql'), 'utf8');
+  for (const rank of ['metic', 'archon']) assert.match(mig, new RegExp(`SELECT '${rank}', unnest\\(ARRAY\\[\\s*'module\\.assessment\\.rerun'`));
+});
+
+test('a re-check with a reason is queued and answers 202', async () => {
+  queued.length = 0;
+  const res = await invoke(handle, { body: { reason: 'the grader was down when this was published' } });
+  assert.equal(res.statusCode, 202);
+  assert.deepEqual(res.body, { ok: true, queued: true, module_key: 'weather', version: '1.2.0', version_id: 7 });
+  assert.deepEqual(queued, [7]);
+});
+
+test('no reason, no re-check', async () => {
+  queued.length = 0;
+  for (const body of [{}, { reason: '' }, { reason: '   ' }]) {
+    const res = await invoke(handle, { body });
+    assert.equal(res.statusCode, 400);
+    assert.equal(res.body.error, 'reason_required');
+  }
+  assert.equal(queued.length, 0);
+});
+
+test('a score can never be set by hand: a score in the body is refused, and nothing writes a score row', async () => {
+  queued.length = 0;
+  state.sql.length = 0;
+  const res = await invoke(handle, { body: { reason: 'r', overall: 100 } });
+  assert.equal(res.statusCode, 400, 'only `reason` is accepted');
+  assert.equal(queued.length, 0);
+  const ok = await invoke(handle, { body: { reason: 'r' } });
+  assert.equal(ok.statusCode, 202);
+  assert.deepEqual(queued, [7], 'it only queues the automatic assessment');
+  assert.ok(state.sql.every((q) => !/module_assessment_scores|module_assessment_signals/.test(q)), 'the route itself writes no score or signal');
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  assert.doesNotMatch(src, /module_assessment_scores/, 'no store route writes a score row');
+});
+
+test('a bad key or version, an unknown version, and a full queue are refused', async () => {
+  queued.length = 0;
+  assert.equal((await invoke(handle, { key: 'Bad_Key', body: { reason: 'r' } })).statusCode, 400);
+  assert.equal((await invoke(handle, { version: '1.2', body: { reason: 'r' } })).statusCode, 400);
+  const missing = await invoke(handle, { version: '9.9.9', body: { reason: 'r' } });
+  assert.equal(missing.statusCode, 404);
+  assert.equal(missing.body.error, 'version_not_found');
+  assert.equal(queued.length, 0);
+  queueAccepts = false;
+  const full = await invoke(handle, { body: { reason: 'r' } });
+  queueAccepts = true;
+  assert.equal(full.statusCode, 503);
+  assert.equal(full.body.error, 'assessment_queue_full');
+});