@bongos/core 1.20.73 → 1.20.75

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.73",
-  "core_contract": "1.20.73",
-  "source_commit": "801daee11330f1b0e8072594fd9d007194d82ff7",
+  "core_version": "1.20.75",
+  "core_contract": "1.20.75",
+  "source_commit": "47171580556a4db8b0bee9913c943c38d416b354",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T15:43:17.489Z",
+  "built_at": "2026-10-01T16:49:45.624Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 572,
+    "docs_redacted": 573,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2801,
+    "functional_verbatim": 2804,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3401,
-  "tree_sha256": "00438ba77e638f59bbf2b7e542f64a5651f030603d42887ba570dad90d40e7b0",
+  "file_count": 3405,
+  "tree_sha256": "741e17ba5c6027b412c9263e7fbde66a05ec0025c6e8316cb8a348082f6baad3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "472c0606ff4fe4e775d56e038702960834838d8767e984427f5de29d31f9cbe9"
+      "sha256": "4bf36ecd7ca2902d45d201a77871242c61842f882ade087c4f71d96da14bac37"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "d641fbda06eb527c39d2eabbc7afc9f9182b03d766917e9fd84d69e86e9cc397"
+      "sha256": "daf38ceea63ecdc6656b3fa9f9abd061bcd102b8093c55b476cc96f01bb8a8ec"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "73b143d7faa4d930ab82f9f31b178816cc5a8ea87754de7e0575441905d4562a"
+      "sha256": "422e9c335817f0efe3b63309ae34a5b8d09989d01a22063e6c0dcdb96fb9d650"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "05ba628ec9c3761d8814af291cd5b11a02dd279c6e8df232b20ca632cc1e4336"
+      "sha256": "1f8f7512aa121a86c11b39b9015257d9bbd0ab74ea68afd3bba783cd7c840177"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "11a7eb441c5533244c695a4c60fe7b170e87eb4081af77703e796e8370e971e5"
+      "sha256": "3c9d7a8facab420b2b6eec54469b04d95ee9e37f9447f81c7700b356d408c11c"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2254,25 +2254,30 @@
       "mode": "0000644",
       "sha256": "378354dd5ca8a1305b0c2b5a913baa5288da0014bcff8f6fb59fc1b28b654f59"
     },
+    {
+      "path": "docs/adr/0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md",
+      "mode": "0000644",
+      "sha256": "b9861113cddb698710176c8533b07078b5b63e1995adbb3dafb537c1bc69186a"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "25fdede6b346cb7e64a91f4d9a95449f30829343c152742c1d98f99d864798ec"
+      "sha256": "f4523673c55a6528efa2589ecc997b0192e15318755f0008a82b6d49e5023eb0"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "a24995419c2daa05deca5f2ed06656801c313f7499039a739b1bfa2cbc87e595"
+      "sha256": "77dcae770dc22649b8ecfffc81e06e912053d4a471cb84f9c14cc33f1ccbc342"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "63946432b10d130a8f1749ced38bb733449ea4ed8039c9794287d3a269249b0c"
+      "sha256": "2306770ff4d240498043ace210b9476065674c0a953e09f1b1fdc7ccd72ce1cb"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "de7c4fc7c1133b726322910dc8db8992f17c0511df4f441c47671c791f182199"
+      "sha256": "12f04eb7e79afdc31515209431664a489d189cecc890816d0abbf7d02accf2cc"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2292,12 +2297,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "89e2971b3e1f240fba7c1f63e06a97c135bd91e8f532f280cfbb40309c73b47c"
+      "sha256": "974f5d7a12d5629b8a6a5c8d6d3285f3b87f82bd6687866c803e6f23ac7d0ed0"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "49df590e6fa172ef2971371f6944da186c8dc12585d22080df61f97f22cbea85"
+      "sha256": "606ca0b6c9d1de48f290aeff85881d5a3a42da9612d9002d0125f72febc46550"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2802,7 +2807,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a1158e3a1bb0e3daf32f0ec0592b3956071f4eaf712a567ddb702c52392e4b69"
+      "sha256": "450e7d95569def45add3a68eaa95340c36dbf063c05de1b20570be7fddd5bd17"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2887,12 +2892,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "0265f1008ef98e820054de96ff63474302ea9ed8cbdbf4c0999922575ebf5078"
+      "sha256": "2ea24cb7659d6032498cc7bae2838afe55efddc33da3484dffe77db0952fae6f"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "119a7e0f259453ec65e5caaf5136fbed97b979b9383d6c3ad00794aa6957f1de"
+      "sha256": "dbfc823461edb6b009d1f3ca4af480759ee34123c4441dfbe6a29ccec6e9d286"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4762,7 +4767,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "f3d82f60997e944eb7108c36bafa9d9be8469c5980b5460abfdf410ffa601dea"
+      "sha256": "7892e387042b020fbfe0dc16a5ea134b67aa2abfd97d5e72e09f5e8b529a1a04"
     },
     {
       "path": "modules/government/charter.js",
@@ -4919,6 +4924,11 @@
       "mode": "0000644",
       "sha256": "6eabf8b78f84922a44bdcfacf9e5dd4c2c5ead593b81125c2cc9ca8f13f844d9"
     },
+    {
+      "path": "modules/government/migrations/government_021_module_assessment_rerun.sql",
+      "mode": "0000644",
+      "sha256": "0f1a25b6bf6d0ecfbbb5a38fc3cf41fcd5689b42943397a663581c22a9634835"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -8072,7 +8082,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "d0efd18cd1774d02434b974ee4214bb310fd2392170d3767e0e17bdc4b76cb77"
+      "sha256": "a07a5ad18a55708ade714a79e155c1dd44596b7379ce43d0405db1211d75278a"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -8387,7 +8397,7 @@
     {
       "path": "modules/public-landing/public/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "525b32944a931953cbd8c7c949c388a547489c6f930e14137da3dad4e9e2c76b"
+      "sha256": "778b28f1d35d9f6966c8bdf84daffa2ed5cf96bbc5faf5a8fdd5c1f323bc8f22"
     },
     {
       "path": "modules/public-landing/public/assets/verro-medallion.png",
@@ -8752,17 +8762,17 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "c82f4f81a22c79c82a01a965a7814f4dc93995e7ee4fd75446ed69fa0c77fa09"
+      "sha256": "438766969f1b61bf1e3da7d6df5603b0569efc4264bc20b720fb27e9c6fe2f11"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
       "mode": "0000644",
-      "sha256": "0495d05bc905faf1f0ef669d3403c4de656f9e8c2784cdae4e439a70185c8ac6"
+      "sha256": "99c3b8ea90bd81ac583a34d56f182036d573392b8f489dcb799cb31bac836f03"
     },
     {
       "path": "modules/public-landing/public/projects.states.json",
       "mode": "0000644",
-      "sha256": "73fbf81a0608fd266fd8389fcc1f6edba48eaccfd04c8b43068eaed3cc7dc8de"
+      "sha256": "5a7ce6e71227e224dc1dc09509ab0dcf738e3bd411e6a73a5e4750d81f241d93"
     },
     {
       "path": "modules/public-landing/public/terms.html",
@@ -9302,7 +9312,7 @@
     {
       "path": "modules/ui-design/kit/lib.js",
       "mode": "0000644",
-      "sha256": "4cdaadcbccaa2aa6c5e5f783723e7a10e2ddab136253a3f234a6fd3c5ab7ef10"
+      "sha256": "328b06d37869647a55d2cacef899d81b602593eb2399c1ca7c21e13cd3d9dfae"
     },
     {
       "path": "modules/ui-design/kit/png.js",
@@ -9322,7 +9332,7 @@
     {
       "path": "modules/ui-design/kit/serve.js",
       "mode": "0000644",
-      "sha256": "84115a4463d1799bad2f0b142f448ba953283e935464afed2049c44deed1744d"
+      "sha256": "12ece23ed5730bd59de0d68af75f8be08a6fc268242d7426b23878a5c9893594"
     },
     {
       "path": "modules/ui-design/kit/tells.js",
@@ -9457,12 +9467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f383e88aef6668d55f149d2df43507dbbd0596d7d91f40b2027e29588a8b7bb6"
+      "sha256": "e0595ba880a4bc113e7ffc305721d720dda4adead3cc943a0499f06fa98cc2c0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "774a78ab94f32c857b8de59046bf54910f743c6e7c2e78be80d8019029dd4cb2"
+      "sha256": "d340f2190395e8d5aec8dc6546c0c09d2da8e98719d0bda2da18eab8f884cc1e"
     },
     {
       "path": "public-docs/index.html",
@@ -9482,7 +9492,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "e63c13e0213b9008d28ee2c938a5a9ac2b280e2a20e8aec1fb8d9ce92791ed2b"
+      "sha256": "d64f4b7ed87732032b11f8b152572d303fa8fba9358e5d404c906921ee41247d"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11517,7 +11527,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "c31e753d353b6c8c6b1f4e9af80a31afc995568aea9fd4ad8ab408e093a6f786"
+      "sha256": "8290d110cfcb492ac241061e8dda955b594217f39128e6685578fab27e46e969"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11602,7 +11612,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "65dcf7b704d1fa321c128b36f3147bf23f54b976f60980450b2ed8a8583a302a"
+      "sha256": "0e36ce8c06b446a7b5b78577aa3ec63b1cfa03f023963847a6eee7b8ef84e20a"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -11677,7 +11687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "73fdbcf183fb1dd260fbb16ea0a5f1dfe053d1f06d53b31d0af695f80ec28cc8"
+      "sha256": "0292d81e99d14082adcbc9c1500a0547cf74a6e3c4c97d1ff6229bd623c89980"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14839,6 +14849,11 @@
       "mode": "0000644",
       "sha256": "59d14575351c6b6529c6aff8e661ce915b8159988ad13585eea752c4bde4d9b6"
     },
+    {
+      "path": "tests/module_store_reassess.mjs",
+      "mode": "0000644",
+      "sha256": "07df2a5f55e1bbe41c99e24533e3fcb008be6c6cb0d0e0a3e1160a106baefe77"
+    },
     {
       "path": "tests/module_store_registry_migration.mjs",
       "mode": "0000644",
@@ -15337,32 +15352,32 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "c5909e5f01df6d2f83cb29ea9b912199bd82e6e06674146734ed11d7bb838ded"
+      "sha256": "b8a6cfca70f84ed904ca6a44d1f045fd2337ea3407143ae0e1b7c05118d83668"
     },
     {
       "path": "tests/projects_hub_app_status.mjs",
       "mode": "0000644",
-      "sha256": "820ae8aea30073853b2dbd15a443bdeb9341bbc9beec6f1204432808635a01ea"
+      "sha256": "7502f3b5ad3a77ff5134875d4de0e9e76c82b956b12c22a52f32854df33ba778"
     },
     {
       "path": "tests/projects_hub_app_step.mjs",
       "mode": "0000644",
-      "sha256": "f387eaf1f5dad1ed8f5cf360bc64820f8e27e6606a507952099d8f11f1630e13"
+      "sha256": "89a3babbba90538cdbfc52673651388eee0172592bdbf8d37a9cbf507173449c"
     },
     {
       "path": "tests/projects_hub_look.mjs",
       "mode": "0000644",
-      "sha256": "02460c4082005a04c8ed12f5e70d58d6c1e29a174241cf88d4340b2e459a64c5"
+      "sha256": "2156371a4e0dc4f97536a553ba8805bb3ca4675f95d0e808c9604066186a09a5"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",
       "mode": "0000644",
-      "sha256": "9e7cc27990398c936706894e6ac6edd824a8c0a57bff9670ab863d05d876a127"
+      "sha256": "42f6e51a23db4d42414603b4e549fb4fad0b7d95ac709fc653a6f806b590d0a6"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "00f0adb1a3aa0add4d908fc41c9eb4f2925b6ee139da570e2edd2a2a6af319dc"
+      "sha256": "f65e3a53e3700aff4d45a9cbb0056560b17622ae4d1b7b5e41b565aa6c8eb2b8"
     },
     {
       "path": "tests/projects_hub_render_connect.mjs",
@@ -16962,22 +16977,27 @@
     {
       "path": "tests/wizard_demo.mjs",
       "mode": "0000644",
-      "sha256": "2654d5dad8d1d7ada929ed2107406ddc59094145a2c1d2be1598e93db692b497"
+      "sha256": "6f5945a590a851e83d388afd2e50b4c34187b153d017ed82215dc2a3e4f62ea2"
     },
     {
       "path": "tests/wizard_draft_resume.mjs",
       "mode": "0000644",
-      "sha256": "68ca5c55993203f6a4ab91ea79de4647fccae9008a1cef1a28853515396219b2"
+      "sha256": "625fa61619c02324c09afc05b71471d91a7aeb6aaf82449e0b25d36a09fde103"
     },
     {
       "path": "tests/wizard_front_door.mjs",
       "mode": "0000644",
-      "sha256": "ba94f9a0c317357facdccc94b954a388302c4983094e712c27ddff246dda3a11"
+      "sha256": "de1717a0e40cf430b5c13f7bee1f7e29f3f2d074bf20b0bf04f8d9d4a624b18e"
     },
     {
       "path": "tests/wizard_intent_resume.mjs",
       "mode": "0000644",
-      "sha256": "38843b8b0a8f5e9f907bdb99eba819a24e9f0ef39bf33be727a0074e898721b3"
+      "sha256": "976db1a1bd5290f59dd1ca7ea011478cbc503eb0466b81cb76acea3301c3fd79"
+    },
+    {
+      "path": "tests/wizard_physics.mjs",
+      "mode": "0000644",
+      "sha256": "7b96f175088a5e37940336f6eead501a0d3c72b9614674d8192e9761dd40ea74"
     },
     {
       "path": "tests/wizard_preselect_why.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 486 operations across 73 resource groups
+- 488 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -887,6 +887,8 @@ function createClient(opts = {}) {
       getProvisioningLogosFile: (args) => request("GET", "/provisioning/logos/{file}", { hasBody: false }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // POST /provisioning/physics-check — rank: any-builder — POST /provisioning/physics-check
+      postProvisioningPhysicsCheck: (args) => request("POST", "/provisioning/physics-check", { hasBody: true }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
       getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // POST /provisioning/render/lookup — rank: any-builder — POST /provisioning/render/lookup
@@ -1085,6 +1087,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
+      postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest

package/clients/bongos-client/index.cjs

@@ -886,6 +886,8 @@ function createClient(opts = {}) {
       getProvisioningLogosFile: (args) => request("GET", "/provisioning/logos/{file}", { hasBody: false }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // POST /provisioning/physics-check — rank: any-builder — POST /provisioning/physics-check
+      postProvisioningPhysicsCheck: (args) => request("POST", "/provisioning/physics-check", { hasBody: true }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
       getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // POST /provisioning/render/lookup — rank: any-builder — POST /provisioning/render/lookup
@@ -1084,6 +1086,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
+      postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest

package/clients/bongos-client/index.d.ts

@@ -423,6 +423,8 @@ export interface PostProvisioningInstancesIdRepoPrivateResponse { ok: boolean; q
 export interface PostProvisioningInstancesIdRestartResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
 export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesRequest { slug: string; target_ref?: string; hosting_shape?: string; domain?: string; no_address?: boolean; tier?: string; onboard_mode?: string; type?: string; description?: string; detail?: Record<string, unknown>; modules?: string[]; terms_acknowledged?: boolean; demo?: Record<string, unknown> }
+export interface PostProvisioningPhysicsCheckRequest { description?: string; detail?: Record<string, unknown> }
+export interface PostProvisioningPhysicsCheckResponse { stop: boolean; message: unknown; soft_limits: unknown }
 export interface PostProvisioningRenderLookupRequest { key: string; owner_id?: string }
 export interface PostRemovalProposalsIdDecideRequest { verdict: string; note?: string }
 export interface PostRenderDeployActRequest { action?: string; deployId?: string; confirm?: unknown; expectLiveDeployId?: unknown }
@@ -471,6 +473,8 @@ export interface PostStoreModulesKeyAcquireResponse { ok: boolean; module_key: u
 export interface PostStoreModulesKeyAcquiredRequest { version: string }
 export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
 export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown }
+export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: string }
+export interface PostStoreModulesKeyVersionsVersionReassessResponse { ok: boolean; queued: boolean; module_key: unknown; version: unknown; version_id: unknown }
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
 export interface PostTaskRecommendationsResponse { ok: boolean; recommendation: unknown }
 export interface PostTasksIdAttestGateRequest { head_sha: string }
@@ -1334,6 +1338,8 @@ export interface BongosClient {
     getProvisioningLogosFile(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/onboard-plan — rank: public */
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
+    /** POST /provisioning/physics-check — rank: any-builder */
+    postProvisioningPhysicsCheck(args?: RequestArgs & { body?: PostProvisioningPhysicsCheckRequest }): Promise<PostProvisioningPhysicsCheckResponse>;
     /** GET /provisioning/recommendations — rank: public */
     getProvisioningRecommendations(args?: RequestArgs): Promise<GetProvisioningRecommendationsResponse>;
     /** POST /provisioning/render/lookup — rank: any-builder */
@@ -1532,6 +1538,8 @@ export interface BongosClient {
     postStoreModulesKeyVersions(args?: RequestArgs): Promise<PostStoreModulesKeyVersionsResponse>;
     /** GET /store/modules/{key}/versions/{version}/howto — rank: any-builder */
     getStoreModulesKeyVersionsVersionHowto(args?: RequestArgs): Promise<GetStoreModulesKeyVersionsVersionHowtoResponse>;
+    /** POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon */
+    postStoreModulesKeyVersionsVersionReassess(args?: RequestArgs & { body?: PostStoreModulesKeyVersionsVersionReassessRequest }): Promise<PostStoreModulesKeyVersionsVersionReassessResponse>;
     /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /store/modules/latest — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -883,6 +883,8 @@ export function createClient(opts = {}) {
       getProvisioningLogosFile: (args) => request("GET", "/provisioning/logos/{file}", { hasBody: false }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
+      // POST /provisioning/physics-check — rank: any-builder — POST /provisioning/physics-check
+      postProvisioningPhysicsCheck: (args) => request("POST", "/provisioning/physics-check", { hasBody: true }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
       getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
       // POST /provisioning/render/lookup — rank: any-builder — POST /provisioning/render/lookup
@@ -1081,6 +1083,8 @@ export function createClient(opts = {}) {
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
+      postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest

package/docs/adr/0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md

@@ -0,0 +1,40 @@
+# ADR 0359 — Nobody sets a module's score by hand; a Metic+ person can ask for a re-check
+
+- **Status:** accepted
+- **Date:** 2026-10-01
+- **Task:** [task 1003796](https://cloudbongos.com/builders#/task/1003796) (goal 1000091 — working area 5, Module distribution & economy; criterion `wa5-quality-assessed`)
+- **Amends:** [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) D6 (the Metic+ score override) and [ADR 0347](0347-every-store-module-ships-a-how-to.md) D5 ("the Metic+ override applies to Docs like any part").
+- **Keeps:** ADR 0343 D6's delist (task 1003797) and "every action is recorded"; ADR 0347 D6's "Metic+ re-runs it" for a Docs grade that could not run.
+- **Decided with:** the owner (Will, Archon), 2026-10-01: "I don't think someone should be able to override a module's score. Maybe trigger a regrade but not change it." Metic and Archon may trigger it; the permission grant migration was approved the same day.
+
+## Context
+
+ADR 0343 D6 put a Metic+ override on top of the computed score, because an automated score will sometimes be wrong and a human-review-only panel does not scale. Task 1003796 was to build it. Before any code was written the owner ruled the other way: a score a person can type in is a score a person can sell, and the reason field does not change that.
+
+## Decision
+
+### D1 — No route sets, raises or lowers a score
+
+A module version's score only ever comes from its signals, composed by `scripts/gds/module-assess-score.js`. There is no override route, and the `kind = 'override'` rows `core_265` allows for are never written. The column and its CHECKs stay (removing them is a migration with nothing to gain); a test asserts no store route writes `module_assessment_scores`.
+
+### D2 — A Metic+ person can ask for a re-check, with a reason
+
+`POST /api/bongos/store/modules/:key/versions/:version/reassess { reason }` queues the same assessment a publish runs (`assessVersion`): Tests `pending` if there is no Tests result yet, the Security gate, the Docs grader, then the score. It answers 202, or 503 when the assessment queue is full. A reason is required and nothing else is accepted in the body, so a score cannot ride along. The audit middleware records who asked and why.
+
+This is how a wrong score gets corrected: if a signal was wrong because a check failed to run (the grader was down, npm could not be reached), the re-check runs it again. If a check itself is wrong, that is a bug in the check, fixed in code for every module.
+
+### D3 — Metic and Archon, through one new atom
+
+The route is gated by `module.assessment.rerun` (floor `metic`, not a system key) in `modules/government/catalog.js`, granted to `metic` and `archon` by `government_021_module_assessment_rerun.sql`. It is Metic+ and not open to every builder because each re-check spends a Docs grader call (up to 5¢, ADR 0347 D6) and re-runs the npm audit.
+
+## Consequences
+
+- An author who thinks their score is wrong asks a Metic+ person to re-check it, or reports a bug in the check. Neither path lets anyone pick the number.
+- A re-check can lower a score as well as raise it: it is whatever the checks say now.
+- The delist (task 1003797) is unchanged: it hides a module from the store, it does not change a score.
+
+## Rejected
+
+- **The override as ADR 0343 D6 planned it.** The owner's call (above).
+- **An override that only lowers a score.** It is still a person choosing the number.
+- **Re-checks for every builder.** Each one costs money; Metic+ keeps that spend with trusted people.

package/docs/adr/README.md

@@ -477,3 +477,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0356 | [**A recruit invite expires 30 days after it is sent, decided at read time** ([task 1002969](https://cloudbongos.com/builders#/task/1002969), goal 1000110 — privacy spec D4, owner-signed). **D1:** one definition, `src/bongos/invite-expiry.js` (`INVITE_EXPIRY_DAYS` + the SQL), read by the sign-in gate, the waiting-page probe, the onboarding routes and, through the doorway's `inviteExpiry`, the hub. Nothing is stored and nothing sweeps. **D2:** only `kind='invite'` rows expire; approved applications and goal invites do not. **D3:** amends ADR 0335 D2.5: the gate reads `kind` only inside the expiry unit, which can close a door and never open one. **D4:** an expired invite is refused, marked `expired` + `expires_at` in the queues, reported `expired` by the status probe (the CLI stops), and replaced by a re-invite's fresh row. **D5:** the hub hides a `pending` notice past 30 days and a re-invite restamps it. Split out: `seen_at` (task 1004443), the decline relay (task 1004444).](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) | platform identity / admission / invites |
 | 0357 | [**The update rule set on /deploy is the one the sweep follows** ([task 1004468](https://cloudbongos.com/builders#/task/1004468), goal 1000090 — BONGOS-V2, owner's ruling 2026-09-30). Amends [ADR 0136](0136-update-channel-subscription-policy.md)'s rejected DB-column alternative. **D1:** for a roster entry whose slug matches a `provisioning_instances` row, the unattended sweep uses that row's `update_channel` (set on /deploy, task 1004445). **D2:** the roster's `channel` is only the fallback — no matching row, or the database unreadable; enrollment and topology stay in the roster. **D3:** the sweep logs each entry's channel and its source, naming an overridden roster value. **D4:** read over psql from the sweep's own `DATABASE_URL`/`PGDATABASE`, never an entry's `env`. **D5:** nothing is copied; a row never changed is `patch`. Delivery to cloudbongos.com waits on the frozen sweep checkout (task 1004307). Rejected: roster stays in charge; stricter-of-the-two; copying roster values into rows.](0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md) | distribution / updates |
 | 0358 | [**A hall wears a look, and its night takes a tint of it** ([task 1004421](https://cloudbongos.com/builders#/task/1004421), goal 1000121 — BV2.PS06; owner D2 + D8, 2026-09-30). Amends [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) (a look could not carry a dark ground) and DESIGN.md's pure-black rule, for halls only. **D1:** the night tint is a formula over the thirteen — the four dark grounds take 5–6% of the look's accent (src/night-tint.js), emitted after the sheet as both dark twins; no token added. **D2:** on by default, and only a chosen look turns it on — a hall with no look is unchanged. **D3:** the apex and hub stay pure black (ADR 0204). **D4:** a custom look is ONE accent for both modes, its lightness nudged until every pair the hall paints with it reads (lookAdjustAccent, client copy test-pinned). **D5:** look + night_tint join the provisioning settings vocabulary; the accent and logo address ride as companion env; the instance resolves the look from the style library. **D6:** a logo is PNG/JPEG/WebP ≤256 KB, magic-sniffed, never SVG, served content-addressed; it is the hall mark and the favicon. Rejected: per-look dark palettes, two custom accents, refusing an unreadable accent, sending the palette over env.](0358-a-hall-wears-a-look-and-its-night-takes-a-tint.md) | hall / branding / design world |
+| 0359 | [**Nobody sets a module's score by hand; a Metic+ person can ask for a re-check** ([task 1003796](https://cloudbongos.com/builders#/task/1003796) · goal 1000091, criterion `wa5-quality-assessed`). Amends [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) D6 and [ADR 0347](0347-every-store-module-ships-a-how-to.md) D5 on the owner's ruling: there is no score override. A score only ever comes from its signals. Instead `POST /store/modules/:key/versions/:version/reassess { reason }`, gated by the new `module.assessment.rerun` atom (metic floor, granted to metic + archon by `government_021`), queues the same assessment a publish runs. A reason is required and nothing else is accepted. The delist (task 1003797) is unchanged.](0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md) | module store / assessment / permissions |