@bongos/core 1.21.176 → 1.21.178

package/scripts/bongos/doc-control-claims.js

@@ -77,8 +77,8 @@ const SKIP_PREFIXES = ['docs/session-logs/', 'docs/audits/', 'limitations/'];
 const ALLOW = new Map([
   ['docs/adr/0025-structured-criterion-task-link.md::scripts/bongos/seed-v3-tasks.js',
     'describes the grep a session HAD to do before this ADR; a seed script, not a control'],
-  ['docs/adr/0042-builder-self-deploy-ci-auto-merge.md::.github/workflows/grade-gate.yml',
-    'the CI grader gate this ADR designed; it was armed in the grader-off variant its own Status line records, and grading runs server-side (scripts/bongos/ci-grade.js)'],
+  ['docs/adr/0089-modular-multi-model-adversarial-grader.md::scripts/bongos/gate-review.js',
+    'ADR 0089 section 8 names the ADR 0058 gatekeeper as a surface the grading engine does not own; task 1004859 deleted it (the CI check it drove never ran) and moved its hard-floor list to scripts/bongos/hard-floor.js'],
   ['docs/adr/0111-instance-hosting-provisioning-module.md::scripts/bongos/box.js',
     'the dev-box control-plane runner, retired with dev boxes by ADR 0346 (dev-box-guard.js keeps it out)'],
   ['docs/adr/0150-box-first-boot-bringup-vendored-instances.md::scripts/bongos/box.js',

package/scripts/bongos/fitness-checks-identity.js

@@ -79,10 +79,8 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 //   * backfill-sessions.js / version-close.js — one-time operator runbook text
 //     naming the actual prod DB + a historical local directory. Describing what
 //     an operator must literally type is the correct content.
-//   * seed-*.js — the hits are PROSE INSIDE seeded task descriptions: historical
-//     records of what those tasks said when they were filed. Rewriting them would
-//     falsify the record; deleting the files would destroy it. They are inert
-//     (idempotent on source_ref) and referenced only by generated manifests.
+//   * seed-*.js — the nine one-shot seeders once listed here (prose inside seeded
+//     task descriptions) were deleted by task 1004856; the repo history keeps them.
 //   * the four *.sh entries — surfaced when `.sh` joined the extension set (task
 //     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
 //     live box's actual Postgres database/role and its actual /etc secrets dir, and
@@ -94,7 +92,7 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 //     NEW literal in any of them fails exactly like one in an unlisted file.
 //   * fitness-checks-identity.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
 //     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
-//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
+//     their job. (seed-v3-tasks.js was the third; it is gone.) All
 //     three passed pre-1002756 only by the old stripper's accidents (phantom
 //     blocks + regex-blindness); now they are seen and counted.
 const IDENTITY_SCAN_ALLOWED = {
@@ -113,19 +111,10 @@ const IDENTITY_SCAN_ALLOWED = {
   'scripts/bongos/seed-staging.sh': 4,
   'scripts/bongos/backfill-sessions.js': 2,
   'scripts/bongos/publish-manifest.js': 3,
-  'scripts/bongos/seed-bongos-coreB-tranche1-tasks.js': 1,
-  'scripts/bongos/seed-bongos-coreB-tranche2-tasks.js': 1,
-  'scripts/bongos/seed-bongos-goal-hierarchy-tasks.js': 1,
-  'scripts/bongos/seed-bongos-tasks.js': 1,
-  'scripts/bongos/seed-gds-v4-tasks.js': 1,
-  'scripts/bongos/seed-medusa-tasks.js': 7,
-  'scripts/bongos/seed-module-upstreaming.js': 1,
-  'scripts/bongos/seed-productization-tasks.js': 6,
-  'scripts/bongos/seed-provisioning-tasks.js': 2,
   'scripts/bongos/version-close.js': 1,
   // task 1002853 (the company literal joined the list): audit-authorship.sh is itself a
   // detector — its ops allowlist names the founder's commit address so it can exempt it; grade-smoke.js
-  // is a protected grader probe whose fixture task prose names the company, the seed-*.js rationale.
+  // is a protected grader probe whose fixture task prose names the company.
   'scripts/bongos/audit-authorship.sh': 1,
   'scripts/bongos/grade-smoke.js': 1,
 };

package/scripts/bongos/gen-diagrams.js

@@ -488,7 +488,7 @@ function rebuildAssertions(prev, f) {
     next.architecture = {
       diagram: '04-architecture',
       _comment:
-        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/bongos/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
+        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/bongos/gen-diagrams.js in lockstep with the diagram. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
       live_tasks: arch.live_tasks,
       pending_tasks: arch.pending_tasks,
     };
@@ -499,7 +499,7 @@ function rebuildAssertions(prev, f) {
       ...next.drachmae_karma,
       diagram: '03-drachmae-karma',
       _comment:
-        "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/bongos/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep, so this slice is a redundant backstop the drift checker verifies. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
+        "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/bongos/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
     };
     next.drachmae_karma.live_tasks = dk.live_tasks;
     next.drachmae_karma.pending_tasks = dk.pending_tasks;
@@ -589,7 +589,7 @@ const CONCEPTUAL_TARGETS = [
       // r.error (ENOENT) and r.status is null. The .mmd sources are already
       // written above and the caller (ship.js regenerateDiagrams) will commit
       // them; PNGs get re-rendered on the Linux droplet at deploy time, and the
-      // diagram-drift routine backstops any staleness. So skip the render
+      // next render-capable ship refreshes them. So skip the render
       // NON-FATALLY rather than hard-failing the whole ship on a missing bash.
       console.warn(
         `gen-diagrams: could not run the render step (${r.error.code || r.error.message}). ` +

package/scripts/bongos/government-walk.js

@@ -37,8 +37,8 @@
 // an in-memory fake with the same row shapes and the same guards (one open sitting
 // per subject, one vote per member, single-winner close, the decision-rules write
 // only from a passed decision-rules amendment), and the few writes a passed matter
-// makes into other modules are recorded in memory instead of written to a database
-// (or, for a gate approval, sent to GitHub). The table says which mode ran.
+// makes into other modules are recorded in memory instead of written to a database.
+// The table says which mode ran.
 //
 // Usage:
 //   node scripts/bongos/government-walk.js           run it and print the table
@@ -102,7 +102,6 @@ const REQUESTS = Object.freeze({
   'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
   'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
   'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
-  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
   'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
   'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
   'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],
@@ -122,7 +121,6 @@ const MATTER_PLAN = Object.freeze([
   ['automation', 'Switch unattended building off', { type: 'switch_off' }, 'fence off'],
   ['automation', 'Allow goal 77 to build unattended', { type: 'allow_goal', goal_id: 77 }, 'goal 77 allowed'],
   ['release', 'Approve override request 5', { type: 'approve_override', request_id: 5 }, 'request 5 approved'],
-  ['release', 'Clear the gate on PR 1500', { type: 'approve_gate', pr: 1500 }, 'PR 1500 cleared'],
   ['review', 'Sign off criterion 9', { type: 'satisfy_criterion', criterion_id: 9 }, 'criterion 9 satisfied'],
   ['treasury', 'Dee gets $50 a month', { type: 'set_budget', builder_id: 45, monthly_usd: 50 }, 'Dee\'s limit is $50'],
 ]);
@@ -135,7 +133,6 @@ const ROUTERS = Object.freeze([
   // no HTTP surface; it contributes the Release and Review matter acts, as at boot
   'modules/lifecycle/routes/lifecycle.js',
   'modules/lifecycle/routes/done-when.js',
-  'modules/lifecycle/routes/gate-approvals.js',
   'modules/lifecycle/routes/tasks.js',
   'modules/lifecycle/routes/goals.js',
   'modules/lifecycle/routes/versions.js',
@@ -618,7 +615,6 @@ async function runWalk() {
   const lifeDb = req('modules/lifecycle/db.js');
   const doneWhen = req('modules/lifecycle/done-when.js');
   const doneWhenRoutes = req('modules/lifecycle/routes/done-when.js');
-  const gateRoutes = req('modules/lifecycle/routes/gate-approvals.js');
   const express = require('express');
   const http = require('http');
 
@@ -634,11 +630,10 @@ async function runWalk() {
   projectSettings.setSetting = async (k, v) => { settings.set(k, String(v)); return { key: k, value: String(v) }; };
 
   // What passed matters write into other modules, recorded.
-  const effects = { fence: null, allowedGoals: [], overrides: [], gates: [], criteria: new Map([['9', false]]), budgets: new Map() };
+  const effects = { fence: null, allowedGoals: [], overrides: [], criteria: new Map([['9', false]]), budgets: new Map() };
   autoDb.setFenceEnabled = async ({ enabled }) => { effects.fence = enabled; return { enabled }; };
   autoDb.allowGoal = async ({ goalId }) => { effects.allowedGoals.push(String(goalId)); return { goal_id: goalId }; };
   lifeDb.decideOverrideRequest = async ({ requestId, decision }) => { effects.overrides.push([String(requestId), decision]); return {}; };
-  gateRoutes.approveGatePr = async ({ number }) => { effects.gates.push(String(number)); return { ok: true, body: {} }; };
   doneWhen.getCriterion = async (id) => (effects.criteria.has(String(id)) ? { id, satisfied: effects.criteria.get(String(id)) } : null);
   doneWhenRoutes.satisfyByOverride = async ({ criterionId }) => { effects.criteria.set(String(criterionId), true); return { updated: {}, goalResult: {} }; };
 
@@ -971,7 +966,6 @@ async function runWalk() {
     'automation.switch_off': () => effects.fence === false,
     'automation.allow_goal': () => effects.allowedGoals.includes('77'),
     'release.approve_override': () => effects.overrides.some(([id, d]) => id === '5' && d === 'approve'),
-    'release.approve_gate': () => effects.gates.includes('1500'),
     'review.satisfy_criterion': () => effects.criteria.get('9') === true,
     'treasury.set_budget': () => effects.budgets.get('45') === 50,
   };

package/scripts/bongos/hard-floor.js

@@ -0,0 +1,52 @@
+'use strict';
+
+// scripts/bongos/hard-floor.js — the trust-boundary HARD FLOOR: the repo paths that,
+// if a compromised or injected senior session changed them, would disable the safety
+// system itself or the deploy switch. A subset of PROTECTED_GLOBS (the protected-surface
+// registry, modules/government/protected-surfaces.json); tests/government_protected_surfaces.mjs
+// holds the subset honest.
+//
+// WHERE IT CAME FROM. This list lived in scripts/bongos/gate-review.js, the ADR 0058
+// classifier a planned gate-review CI check was meant to run. That check never ran on
+// main, and task 1004859 removed the classifier with the hall Gate page that waited on
+// it. Two live readers still need the list, so it moved here unchanged (minus the two
+// deleted drivers that named themselves):
+//   - scripts/bongos/publish-manifest.js — what the public mirror must never carry;
+//   - scripts/bongos/adopt-preflight.js  — whether an adopted repo lands on the floor.
+//
+// Imported, never re-typed: a consumer that needs the floor requires this file.
+// Kept as globs so the matcher is the one permission-path-check builds (trailing '/' =
+// subtree, case- and NFC-folded — task 1002874: a byte-exact matcher let an uppercased
+// spelling of a floor surface walk past).
+
+const { compileGlobMatcher } = require('../../src/bongos/permission-path-check');
+
+const HARD_FLOOR_GLOBS = [
+  'scripts/bongos/hard-floor.js', // self
+  'src/bongos/permission-path-check.js', // defines the protected set
+  'src/bongos/route-rank-check.js', // the route-gate auditor
+  'src/bongos/auth.js', // requireRank / requireBuilder — the enforcement point
+  'modules/grading/grader.js',       // BV1.R73: grading carved to modules/grading/
+  'modules/grading/grader-workers/',
+  'modules/grading/grader-rubric.json',
+  'scripts/bongos/grade-smoke.js', // grade-smoke driver
+  'scripts/bongos/conductor-dispatch.js', // mid-flight grader dispatch
+  'scripts/bongos/main-audit.js', // the authoritative deploy-time audit (the backstop)
+  'scripts/bongos/push-main.js', // the sanctioned main-push carrying the override
+  'scripts/bongos/run-unit-tests.js', // the unit-gate test selector
+  'scripts/bongos/install-git-hooks.js',
+  'scripts/bongos/hooks/',
+  'scripts/migrate.sh',
+  'scripts/deploy/',
+  'config/deploy.json', // the laptop/ci/bypass deploy switch
+  'infra/', // branch-protection.json + deploy substrate
+  '.github/', // CI workflows: the unit gate, secret scan, publish
+  'CODEOWNERS',
+  '.husky/', // pre-push/pre-commit gate delivery
+  '.claude/hooks/',
+  '.claude/settings.json',
+];
+
+const matchesHardFloor = compileGlobMatcher(HARD_FLOOR_GLOBS);
+
+module.exports = { HARD_FLOOR_GLOBS, matchesHardFloor };

package/scripts/bongos/publish-manifest.js

@@ -16,7 +16,7 @@
 //      that falls inside an allowlisted subtree is dropped if the denylist forbids it.
 //   isPublishable(p)  ==  matchesDeny(p) ? false : matchesAllow(p)
 //
-// REUSE, NEVER RE-TYPE (the task's explicit instruction; the gate-review.js doctrine):
+// REUSE, NEVER RE-TYPE (the task's explicit instruction; the hard-floor.js doctrine):
 //   The three canonical sensitive-surface inventories are IMPORTED, never copied —
 //   PROTECTED_GLOBS (write-protection over trust/pipeline/infra code),
 //   HARD_FLOOR_GLOBS (the rank-independent escalate subset), and
@@ -28,10 +28,10 @@
 //   cross-checks the partition against the live inventory so it cannot silently drift.
 
 // The three canonical sensitive-surface inventories — imported from their homes,
-// NEVER re-typed (the gate-review.js "imported, never hand-retyped" doctrine). All
+// NEVER re-typed (the "imported, never hand-retyped" doctrine). All
 // three are pure to require (no DB/network at load; their CLIs are require.main-guarded).
 const { PROTECTED_GLOBS, globToRegExp } = require('../../src/bongos/permission-path-check');
-const { HARD_FLOOR_GLOBS } = require('./gate-review');
+const { HARD_FLOOR_GLOBS } = require('./hard-floor');
 const { SENSITIVE_DOC_GLOBS } = require('./search-ingest-md');
 
 // ---------------------------------------------------------------------------

package/scripts/bongos/pulse.js

@@ -8,9 +8,11 @@
 //        node scripts/bongos/pulse.js --claim-id <N>
 //
 //   2) Release-stale mode (V3.R49 / #268) — scan for active claims with
-//      no pulse in N hours and auto-release them. Used by the
-//      `stale-claim-release` scheduled task (runs every 15 min on the
-//      droplet) and runnable by hand for ops.
+//      no pulse in N hours and auto-release them. Runnable by hand for ops
+//      ONLY: the scheduled `stale-claim-release` routine was retired unscheduled
+//      in task 1004878, because nothing records pulses yet (no POST /pulse route,
+//      no hook sends one), so a timed sweep would release every claim older
+//      than the threshold.
 //        node scripts/bongos/pulse.js --release-stale [--threshold-hours 6] [--dry-run]
 //
 // -------------------------------------------------------------------------

package/scripts/bongos/routine-schedule.js

@@ -51,6 +51,9 @@ const TASKS_DIR = path.join(ROOT, '.claude', 'scheduled-tasks');
 const WORKFLOWS_DIR = path.join(ROOT, '.github', 'workflows');
 
 const { parseRoutineFrontmatter } = require('./run-routine.js');
+// The routines the always-on server fires itself (task 1004878) — the second
+// scheduler this check reads, beside .github/workflows/.
+const { SERVER_ROUTINES } = require('../../modules/autonomy/server-schedule.js');
 
 // The NAMED cadences a routine may declare. The value is the period a cron
 // expression must resolve to for the two to agree. Add a name here and
@@ -189,17 +192,32 @@ function readWorkflows(dir = WORKFLOWS_DIR) {
 // `workflows === null` means "this checkout has no CI to schedule with", which
 // downgrades unscheduled routines from violations to warnings (see the two-repo
 // note in the header).
-function evaluate({ withCadence, withoutCadence }, workflows) {
+//
+// `server` is the in-process scheduler (modules/autonomy/server-schedule.js): rows
+// of { routine, cadence } the always-on server fires itself. A row there IS a
+// scheduler, at exactly its cadence — and it travels with the core, so it fires in
+// an instance checkout too, where there are no workflows. It is held to the same
+// rules as a cron: the routine must declare the cadence the server realizes, and
+// must still exist.
+function evaluate({ withCadence, withoutCadence }, workflows, server = []) {
   const violations = [];
   const warnings = [];
   const hasCI = workflows !== null;
   const wf = workflows || [];
+  const serverRow = new Map(server.map((s) => [s.routine, s]));
 
   for (const r of withCadence) {
     if (!isCadence(r.cadence)) {
       violations.push(`routine '${r.name}': unknown cadence "${r.cadence}" (want ${[...CADENCES].join('|')}, or <N>min where N divides 60)`);
       continue;
     }
+    const srv = serverRow.get(r.name);
+    if (srv) {
+      if (srv.cadence !== r.cadence) {
+        violations.push(`routine '${r.name}' declares cadence: ${r.cadence} but the server fires it ${srv.cadence} (modules/autonomy/server-schedule.js)`);
+      }
+      continue;
+    }
     const firing = wf.filter((w) => invokesRoutine(w.text, r.name, r.steps));
     if (!firing.length) {
       const msg = `routine '${r.name}' declares cadence: ${r.cadence} but NOTHING fires it — no scheduled workflow invokes it`;
@@ -242,7 +260,24 @@ function evaluate({ withCadence, withoutCadence }, workflows) {
   }
   violations.push(...dangling);
 
+  // The server-side rename rot, and a label that lies the other way: a routine the
+  // server fires on a schedule its own SKILL.md says nothing about. Skipped where
+  // there is no routine tree at all (an instance before materialization) — there
+  // every row would read as dangling, and none of them is.
+  const serverFired = new Set();
+  if (known.size) {
+    for (const s of server) {
+      if (!known.has(s.routine)) {
+        violations.push(`modules/autonomy/server-schedule.js fires routine '${s.routine}', which has no .claude/scheduled-tasks/${s.routine}/SKILL.md`);
+      } else if (withoutCadence.some((r) => r.name === s.routine)) {
+        violations.push(`routine '${s.routine}' is fired ${s.cadence} by the server but its SKILL.md declares no cadence: — add \`cadence: ${s.cadence}\``);
+        serverFired.add(s.routine);
+      }
+    }
+  }
+
   for (const r of withoutCadence) {
+    if (serverFired.has(r.name)) continue;
     warnings.push(`routine '${r.name}' declares no cadence: — it can only ever be run by hand`);
   }
   return { violations, warnings };
@@ -252,7 +287,7 @@ function evaluate({ withCadence, withoutCadence }, workflows) {
 function checkRoutineCadencesScheduled() {
   const routines = readRoutines();
   const workflows = readWorkflows();
-  const { violations, warnings } = evaluate(routines, workflows);
+  const { violations, warnings } = evaluate(routines, workflows, SERVER_ROUTINES);
   const scheduled = routines.withCadence.length - violations.filter((v) => v.startsWith("routine '")).length;
   return {
     name: 'a declared cron cadence has something that fires it (task 1003209)',
@@ -262,7 +297,7 @@ function checkRoutineCadencesScheduled() {
     warnings,
     note: violations.length
       ? 'a scheduled routine is declared but dormant — add/repair the scheduler, or drop the cadence: field and stop claiming it runs'
-      : `${scheduled}/${routines.withCadence.length} cadence-declaring routine(s) fired by a committed scheduler at the declared period; ${routines.withoutCadence.length} manual-only.`,
+      : `${scheduled}/${routines.withCadence.length} cadence-declaring routine(s) fired by a committed scheduler (a workflow or the server) at the declared period; ${routines.withoutCadence.length} manual-only.`,
   };
 }
 

package/scripts/bongos/run-unit-tests.js

@@ -258,6 +258,14 @@ const INTEGRATION = new Set([
   // branch over a fake table; only a real engine runs the one-shot DO block and
   // shows a legacy account published again and marked apart from a sign-in.
   'terms_grandfather_db',
+  // task 1004863: three database halves that no lane ran. page_notes_db (the page
+  // feedback doc schema rules; modules/page-notes is live and on by default) self-skipped
+  // in the unit lane and was in no set. howto_state_db and search_isolation_db are the
+  // database halves split out of howto_state and search_isolation, whose DB-free halves
+  // stay in the unit lane: the first runs the how-to read contract on the real schema,
+  // the second proves the search index never widens a caller past their rank or into
+  // another builder memory. Each skipped in CI before, so none had ever been gated.
+  'page_notes_db', 'howto_state_db', 'search_isolation_db',
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):
@@ -448,6 +456,15 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 // needed terms_accepted_at stamped: the public read requires both consent columns since
 // ADR 0213. If one of them reds again, check the module flag is still set first.
 //
+// FIVE LEFT THIS LIST under task 1004863, each repaired against a freshly migrated
+// database: copy_desk_flags_db, government_board_membership_db (builders.github_id is
+// NOT NULL now; their rows go through insertTestBuilders in tests/helpers.mjs, and the
+// stand-in tables that hid the drift are gone), idea_credit_streams_db and
+// session_earnings_mirror_db (fixture rows named a version status and a task discipline
+// the CHECK constraints no longer admit), and acclaim_feed_evidence_db, which now calls
+// the real feed route handler instead of a sliced copy of its SQL and owns a building
+// version rather than colliding with the seeded planning one (the oscillation above).
+//
 // consumer_layout_boot LEFT THIS LIST under task 1002863. Its "missing core tarball" was
 // package-core's fail-closed leak gate reading the lane's throwaway database password (the
 // word postgres, present in hundreds of core files) as a leaked credential and refusing to
@@ -464,11 +481,6 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 // with no blocker_ref, and db.shipTask called without the land assurance task 1002483
 // made mandatory. Each passes alone on a freshly migrated database.
 const INTEGRATION_PARKED = new Set([
-  'acclaim_feed_evidence_db',
-  'copy_desk_flags_db',
-  'government_board_membership_db',
-  'idea_credit_streams_db',
-  'session_earnings_mirror_db',
 ]);
 
 function main() {

package/scripts/bongos/ship-regen.js

@@ -22,7 +22,7 @@ function currentBranch() {
 // Task #357: keep the 3 mechanical onboarding diagrams current on every deploy.
 // Regenerate them from live facts; if any changed, commit the refresh on this
 // branch so it ships with the deploy. Non-fatal — a render/network hiccup must
-// never block a ship; the diagram-drift routine will flag any miss.
+// never block a ship; the next render-capable ship refreshes any miss.
 //
 // Returns a status string ('skipped-server' | 'regen-failed' | 'current' |
 // 'committed' | 'committed-nofatal') so the regression test (task 1046) can
@@ -35,8 +35,7 @@ function regenerateDiagrams() {
   // leaving those files UNCOMMITTED in the builder's tree (had to be reverted by
   // hand). That path must not attempt the regen at all: skip here and let a
   // render-capable ship (the laptop path, which CAN render the PNGs) refresh them
-  // as a matched .mmd+.png+assertions set; the diagram-drift routine backstops any
-  // staleness in the meantime. Skipping entirely (vs --no-render) avoids committing
+  // as a matched .mmd+.png+assertions set. Skipping entirely (vs --no-render) avoids committing
   // a .mmd/.png mismatch to main. Mirrors gen-diagrams.js's own non-fatal skip when
   // bash itself is absent (ENOENT).
   if (pushVia() === 'server') {

package/scripts/gds/{goal-names.js → hard-floor.js}

@@ -1,7 +1,6 @@
-#!/usr/bin/env node
-// scripts/gds/goal-names.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/gds/hard-floor.js — @bongos-forwarder (task 1004848). Generated by
 // scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
-// The real script is scripts/bongos/goal-names.js. This forwarder keeps callers that still name
+// The real script is scripts/bongos/hard-floor.js. This forwarder keeps callers that still name
 // the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-require('../bongos/forwarder.js').forward(module, 'goal-names.js');
+require('../bongos/forwarder.js').forward(module, 'hard-floor.js');