@bongos/core 1.21.176 → 1.21.178

package/tests/government_protected_surfaces.mjs

@@ -126,6 +126,16 @@ function carve(parent, names, why) {
 }
 
 const ADDED_SINCE_R101 = [
+  // task 1004859: the hard-floor list moved out of gate-review.js (retired below) into
+  // its own file, which keeps the self-protection gate-review.js had. Anchored on the
+  // retired entry so it lands where the list used to live.
+  {
+    after: 'scripts/bongos/gate-review.js',
+    glob: 'scripts/bongos/hard-floor.js',
+    why: 'the trust-boundary hard-floor list, moved out of the removed gate-review.js; '
+       + 'publish-manifest.js and adopt-preflight.js read it, so an edit here changes what '
+       + 'the public mirror withholds and what an adopted repo is warned about.',
+  },
   // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
   // execution roots the merge resolver runs out of a cloned branch. The audit named four
   // of them ("the three gen-* scripts and .gitattributes"); modules/lifecycle/executed-
@@ -330,6 +340,12 @@ const RENAMED_SINCE_R101 = [
 // protection from code that still runs. Applied LAST, after renames and additions,
 // so an addition anchored on a retired entry still resolves.
 const RETIRED_SINCE_R101 = [
+  ...['gate-review.js', 'ci-grade.js'].map((f) => ({
+    glob: `scripts/bongos/${f}`,
+    why: 'task 1004859 deleted the two drivers of the planned gate-review and grade-gate '
+       + 'CI checks (ADR 0058). No workflow ever ran them and branch protection requires '
+       + 'only the unit check; the hard-floor list gate-review.js held moved to hard-floor.js.',
+  })),
   ...['boxes.js', 'box-access.js', 'box-credential.js'].map((f) => ({
     glob: `modules/dev-box/${f}`,
     why: 'task 1003892 (goal 1000120) deleted the dev-box module outright — the rank floor '
@@ -446,7 +462,7 @@ test('every glob added since R101 carries a documented reason', () => {
 // floor-gating ordinary source at Metic — src/bongos/logger.js, src/branding.js and
 // src/build-info.js are all in the closure — and locking newcomers out of routine work.
 // The entrypoints are different in kind: they exist ONLY to be executed by the pipeline,
-// which is exactly what group 'pipeline' already means for ship.js and gate-review.js.
+// which is exactly what group 'pipeline' already means for ship.js and hard-floor.js.
 test('every execution root in the closure is a protected surface (MIT1 drift tripwire)', () => {
   const ec = require(path.join(ROOT, 'modules', 'lifecycle', 'executed-closure.js'));
   // ENTRYPOINTS lists both script-tree spellings across the C-series rename window; only
@@ -657,10 +673,10 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
   }
 });
 
-// ---------- the hard-floor subset: gate-review's second list may narrow, never diverge ----------
+// ---------- the hard-floor subset: the second list may narrow, never diverge ----------
 //
 // task 1002875, from idea 1000620 (raised as a major by the BV1.R101 ship grader).
-// scripts/bongos/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
+// scripts/bongos/hard-floor.js (gate-review.js until task 1004859) keeps HARD_FLOOR_GLOBS — the rank-INDEPENDENT
 // escalate-to-owner set — and the comment above it declares the array to be "A subset of
 // PROTECTED_GLOBS". That was a checkable invariant stated in prose and enforced by nothing.
 //
@@ -673,13 +689,13 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
 //
 // Checked at BOTH altitudes on purpose. The source literal is what a reviewer reads and
 // what the decision asked be parsed; the exported array is what compileGlobMatcher actually
-// compiles at gate-review.js:102. Asserting they agree means a future refactor that
+// compiles in hard-floor.js. Asserting they agree means a future refactor that
 // computes or filters the list cannot leave the visible source saying one thing while the
 // gate enforces another.
 function hardFloorGlobsFromSource() {
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'), 'utf8');
   const block = src.match(/const HARD_FLOOR_GLOBS = \[([\s\S]*?)\n\];/);
-  assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in gate-review.js — '
+  assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in hard-floor.js — '
     + 'if it was renamed or restructured, this test must be taught the new shape rather '
     + 'than deleted: it is the only thing holding the declared subset honest.');
   return [...block[1].matchAll(/'([^']+)'/g)].map((m) => m[1]);
@@ -688,21 +704,21 @@ function hardFloorGlobsFromSource() {
 test('every hard-floor glob is a protected surface (1002875 subset tripwire)', () => {
   const fromSource = hardFloorGlobsFromSource();
   assert.ok(fromSource.length >= 20,
-    `fixture sanity: parsed ${fromSource.length} hard-floor globs out of gate-review.js, `
+    `fixture sanity: parsed ${fromSource.length} hard-floor globs out of hard-floor.js, `
     + 'and the array has held about two dozen since it was written. A parse that returns '
     + 'few or none passes the subset check vacuously.');
 
-  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'));
   assert.deepEqual(fromSource, gr.HARD_FLOOR_GLOBS,
-    'the HARD_FLOOR_GLOBS literal in gate-review.js no longer matches the array the module '
+    'the HARD_FLOOR_GLOBS literal in hard-floor.js no longer matches the array the module '
     + 'exports and compiles into its matcher. The source and the enforced list must be the '
     + 'same thing, or a reviewer reading the file is reading a list the gate does not use.');
 
   const registry = new Set(ppc.PROTECTED_GLOBS);
   for (const glob of gr.HARD_FLOOR_GLOBS) {
     assert.ok(registry.has(glob),
-      `'${glob}' is a HARD FLOOR surface in scripts/bongos/gate-review.js — CI escalates any `
-      + 'edit to it to the owner regardless of rank — but it is not in '
+      `'${glob}' is a HARD FLOOR surface in scripts/bongos/hard-floor.js — a trust-boundary path `
+      + 'whatever the author\'s rank — but it is not in '
       + 'modules/government/protected-surfaces.json, so no rank floor covers it at all. '
       + 'The hard floor is declared to be a SUBSET of the protected set: it may be '
       + 'narrower (most protected paths are ordinary Metic work and should not ping the '
@@ -1290,8 +1306,8 @@ test('compileGlobMatcher folds BOTH sides', () => {
   assert.ok(!m(null), 'nor is a missing path');
 });
 
-test('gate-review classifies a CASE-VARIANT gate surface as hard-floor', () => {
-  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
+test('the hard-floor matcher folds a CASE-VARIANT gate surface', () => {
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'));
   const literal = gr.HARD_FLOOR_GLOBS.find((g) => !g.includes('*') && !g.endsWith('/'));
   assert.ok(literal, 'no literal hard-floor glob — this test is reading the wrong shape');
   assert.ok(gr.matchesHardFloor(literal), 'the exact spelling must escalate (sanity)');

package/tests/governor_docket.mjs

@@ -510,7 +510,6 @@ test('each contributed source gates on EXACTLY the atom its own list route requi
   const factories = [
     'modules/ideas/routes/blockers.js',
     'modules/lifecycle/routes/lifecycle.js',
-    'modules/lifecycle/routes/gate-approvals.js',
     'modules/onboarding/routes/access-requests.js',
     'modules/security/routes/reports.js',
     'modules/autonomy/routes/autonomy.js',
@@ -528,7 +527,6 @@ test('each contributed source gates on EXACTLY the atom its own list route requi
     override_requests: ['modules/lifecycle/routes/tasks.js', 'GET /override-requests'],
     removal_proposals: ['modules/lifecycle/routes/removal-proposals.js', 'GET /removal-proposals'],
     criteria_uat: ['modules/lifecycle/routes/done-when.js', 'GET /done-when/pending-review'],
-    gate_approvals: ['modules/lifecycle/routes/gate-approvals.js', 'GET /gate-approvals'],
     access_requests: ['modules/onboarding/routes/access-requests.js', 'GET /access-requests'],
     redteam_reports: ['modules/security/routes/reports.js', 'GET /security/reports'],
     core_update: ['src/bongos/routes/core-update.js', 'GET /core-update'],

package/tests/governor_matter_acts.mjs

@@ -24,7 +24,6 @@ const lifeActs = require(path.join(ROOT, 'modules', 'lifecycle', 'matter-acts.js
 const lifeDb = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
 const doneWhen = require(path.join(ROOT, 'modules', 'lifecycle', 'done-when.js'));
 const doneWhenRoutes = require(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'done-when.js'));
-const gateRoutes = require(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'gate-approvals.js'));
 const lifeDocket = require(path.join(ROOT, 'modules', 'lifecycle', 'governor-docket.js'));
 const buildersRoute = require(path.join(ROOT, 'src', 'bongos', 'routes', 'builders.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
@@ -47,7 +46,6 @@ test('each building\'s act is checked strictly when the matter is opened: shape,
   const v = decisionBoard.validateMatterAction;
   assert.deepEqual(v('automation', { type: 'switch_on' }), { ok: true, action: { type: 'switch_on' } });
   assert.deepEqual(v('automation', { type: 'allow_goal', goal_id: '12' }).action, { type: 'allow_goal', goal_id: 12 });
-  assert.deepEqual(v('release', { type: 'approve_gate', pr: 1500 }).action, { type: 'approve_gate', pr: 1500 });
   assert.deepEqual(v('release', { type: 'approve_override', request_id: 4 }).action, { type: 'approve_override', request_id: 4 });
   assert.deepEqual(v('review', { type: 'satisfy_criterion', criterion_id: 9 }).action, { type: 'satisfy_criterion', criterion_id: 9 });
   assert.deepEqual(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: 50 }).action, { type: 'set_budget', builder_id: 7, monthly_usd: 50 });
@@ -58,6 +56,8 @@ test('each building\'s act is checked strictly when the matter is opened: shape,
   assert.equal(v('automation', { type: 'satisfy_criterion', criterion_id: 9 }).reason, 'bad_action', 'an act from another building');
   assert.equal(v('automation', { type: 'switch_on', goal_id: 3 }).reason, 'unknown_field');
   assert.equal(v('automation', { type: 'allow_goal' }).field, 'action.goal_id');
+  // task 1004859 removed the gate-approval route, so Release no longer carries an act for it
+  assert.equal(v('release', { type: 'approve_gate', pr: 1500 }).reason, 'bad_action', 'the retired gate act is refused');
   assert.equal(v('automation', { type: 'allow_goal', goal_id: 0 }).reason, 'bad_action');
   assert.equal(v('automation', { type: 'allow_goal', goal_id: true }).reason, 'bad_action');
   assert.equal(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: -1 }).reason, 'bad_action');
@@ -161,7 +161,7 @@ test('a passed Review matter signs the criterion off by override, once', async (
   assert.match(signed[0].reason, /passed Review matter/);
 });
 
-test('a passed Release matter approves an override or clears a gate; a request already decided is said, not thrown', async () => {
+test('a passed Release matter approves an override; a request already decided is said, not thrown', async () => {
   const calls = [];
   await stub(lifeDb, {
     decideOverrideRequest: async (a) => {
@@ -169,14 +169,12 @@ test('a passed Release matter approves an override or clears a gate; a request a
       if (a.requestId === 5) throw Object.assign(new Error('closed'), { code: 'REQUEST_NOT_OPEN' });
       return {};
     },
-  }, () => stub(gateRoutes, { approveGatePr: async (a) => { calls.push(['gate', a]); return a.number === 2 ? { ok: false, code: 'pr_not_open' } : { ok: true, body: {} }; } }, async () => {
+  }, async () => {
     assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_override', request_id: 4 } })).out.acted.done, true);
     assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_override', request_id: 5 } })).out.acted.reason, 'request_not_open');
-    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_gate', pr: 1500 } })).out.acted.done, true);
-    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_gate', pr: 2 } })).out.acted.reason, 'pr_not_open');
-  }));
+  });
   assert.deepEqual(calls[0], ['override', { requestId: 4, archonId: '42', decision: 'approve', note: 'A passed Release matter (matter 8) decided it.' }]);
-  assert.equal(calls[2][1].number, 1500);
+  assert.equal(calls.length, 2);
 });
 
 test('a passed Treasury matter sets the limit through the same write as PATCH /builders/:id/budget', async () => {

package/tests/hall_city.mjs

@@ -384,7 +384,7 @@ const FEEDS = (ms, goals = [goal(1)], rollups = [rollup(1, { done: 2, active: 1
 
 test('the page reads the three feeds and draws the docket\'s pins and line', async () => {
   const soon = new Date(Date.now() + 2 * 3600000).toISOString();
-  const ms = [matter({ id: 'board:1', building: 'charter', state: 'needs', deadline: soon }), matter({ id: 'blockers:2', state: 'needs' }), matter({ id: 'blockers:4', state: 'moving' }), matter({ id: 'gate_approvals:3', building: 'release', state: 'moving' }), matter({ id: 'removal_proposals:5', building: 'disputes', state: 'settled' })];
+  const ms = [matter({ id: 'board:1', building: 'charter', state: 'needs', deadline: soon }), matter({ id: 'blockers:2', state: 'needs' }), matter({ id: 'blockers:4', state: 'moving' }), matter({ id: 'override_requests:3', building: 'release', state: 'moving' }), matter({ id: 'removal_proposals:5', building: 'disputes', state: 'settled' })];
   const p = await bootPage({ feeds: FEEDS(ms) });
   assert.deepEqual([...p.calls].sort(), ['/api/bongos/goals', '/api/bongos/goals/rollups', '/api/bongos/government/docket']);
   const pins = p.byId.get('cityPins').children;

package/tests/hall_matter_card.mjs

@@ -182,8 +182,9 @@ test('every act maps to the route that does it, with the body that route accepts
   const ov = card([{ id: 'override_requests:9', source: 'override_requests', building: 'release', state: 'needs', title: 'Release', ref: { type: 'override_request', id: '9' } }], 'override_requests:9');
   assert.deepEqual(C.request(ov, 'release'), { method: 'POST', url: '/api/bongos/override-requests/9/decide', body: { decision: 'approve' } });
   assert.equal(C.request(ov, 'hold'), null, 'holding records nothing');
+  // task 1004859 removed POST /gate-approvals/:pr/approve: a stale gate matter must send nothing
   const gate = card([{ id: 'gate_approvals:812', source: 'gate_approvals', building: 'release', state: 'needs', title: 'A PR', ref: { type: 'pull_request', id: 812 } }], 'gate_approvals:812');
-  assert.deepEqual(C.request(gate, 'release'), { method: 'POST', url: '/api/bongos/gate-approvals/812/approve', body: {} });
+  assert.equal(C.request(gate, 'release'), null, 'the retired gate route is never called');
 });
 
 // Task 1004559 moved the core update onto the Release desk, check first: the ONLY
@@ -406,7 +407,6 @@ const SOURCE_FIXTURES = () => {
     { id: 'redteam_reports:4', source: 'redteam_reports', building: 'disputes', rule: 'decide', state: 'needs', title: 'Security report: sign-in limit skipped', href: '/watch', ref: { type: 'vulnerability_report', id: '4' }, acts: [{ key: 'confirm' }, { key: 'dispute' }] },
     { id: 'criteria_uat:3', source: 'criteria_uat', building: 'review', rule: 'signoff', state: 'needs', title: 'The export runs nightly', href: '/goals#/goal/7', ref: { type: 'criterion', id: '3' }, acts: [{ key: 'signoff', options: [{ key: 'live', label: 'tested it live' }] }, { key: 'force', options: [{ key: 'tested_by_hand', label: 'tested by hand' }] }] },
     { id: 'core_update:1.21.20', source: 'core_update', building: 'release', rule: 'decide', state: 'needs', title: 'Take core 1.21.20 (running 1.21.19)', href: '/settings#software-update', ref: { type: 'core_version', id: '1.21.20' } },
-    { id: 'gate_approvals:88', source: 'gate_approvals', building: 'release', rule: 'decide', state: 'needs', title: 'PR 88 waits at the gate', href: '/gate', ref: { type: 'pull_request', id: '88' } },
     { id: 'autobongos_fence:project', source: 'autobongos_fence', building: 'automation', rule: 'decide', state: 'needs', title: 'Unattended building is off', href: '/autobongos', ref: { type: 'autonomy_fence', id: 'project' }, acts: [{ key: 'switch_on' }] },
     { id: 'module_rechecks:7', source: 'module_rechecks', building: 'release', rule: 'rule', state: 'needs', title: 'image-tools 1.2.0 failed its security check', href: '/modules', ref: { type: 'module_version', id: 'image-tools@1.2.0' }, acts: [{ key: 'recheck', options: [{ key: 'fixed', label: 'fixed since' }] }] },
     // task 1004712: a dry pot's borrow from the reserve

package/tests/hall_oversight_world.mjs

@@ -91,9 +91,9 @@ test('the shared confirm modal sits on --z-modal, closed by one hairline and no
   const modal = css.slice(css.indexOf('.ov-modal {'), css.indexOf('.ov-modal .scroll__h'));
   assert.ok(!/box-shadow/.test(modal), 'no shadow under the dialog');
   assert.match(modal, /border: var\(--line\) solid var\(--rule\)/, 'one rule hairline');
-  // task 1004829: the Gate's approve is the ask card now, and the card is its own
-  // confirmation, so the page opens no modal at all — and styles none.
-  assert.ok(!/ov-modal-bg/.test(read('gate.js')), 'gate.js opens no modal: the ask card is the confirmation');
+  // task 1004829 made the Gate's approve an ask card with no modal; task 1004859
+  // removed the approve altogether. The page still opens no modal — and styles none.
+  assert.ok(!/ov-modal-bg/.test(read('gate.js')), 'gate.js opens no modal');
   assert.ok(!/-modal-bg/.test(read('gate.css')), 'gate.css styles no modal of its own');
 });
 
@@ -303,15 +303,19 @@ test('a failed load on Watch and Sessions is said in the page body', () => {
   assert.match(read('sessions.html'), /id="ledger-status" role="status"/, 'the count and a failed page load sit on the ledger itself');
 });
 
-test('the Gate draws a held PR as the ask card only for a viewer the approve route admits', () => {
+test('the page at /gate is the Autobongos panel: no held-PR list, and a Metic is told the controls are the Archon\'s', () => {
+  // task 1004859 (owner, 2026-10-25: "Keep page, drop PR list"). The held-PR list
+  // waited on a gate-review CI check that never ran; its route is gone, so the page
+  // must not call it, and the URL stays /gate so bookmarks hold.
   const js = read('gate.js');
-  // the server's own answer, never a rank guess on the client
-  assert.match(js, /renderRow\(pr, resp\.viewer_may_approve === true\)/);
-  assert.match(js, /if \(mayApprove && !pr\.already_approved && window\.OTBAsk\)/);
-  assert.match(js, /q: `Let PR #\$\{pr\.number\} through\?`/, 'a question, not a label');
-  assert.match(js, /'data-act': 'approve'/);
-  assert.match(js, /Waiting for approval/, 'everyone else reads the facts as a plain row');
+  assert.ok(!/['\`]\/gate-approvals/.test(js), 'gate.js no longer calls the removed /gate-approvals routes');
+  assert.ok(!/renderRow\(pr|OTBAsk/.test(js), 'no held-PR row or ask card is drawn');
+  assert.match(js, /if \(rank !== 'archon'\) \{ showArchonOnly\(\); return; \}/, 'a Metic gets the note, not an empty page');
+  assert.match(js, /The Autobongos controls are for the \$\{rankLabel\('archon'\)\}/, 'the rank is named from the pack');
   const html = read('gate.html');
-  assert.ok(html.indexOf('hall-ask.js') > 0 && html.indexOf('hall-ask.js') < html.indexOf('gate.js?'), 'the card script loads before the page');
-  assert.match(html, /hall-ask\.css/);
+  assert.match(html, /<title>Autobongos — /, 'the page says what it is');
+  assert.match(html, /data-page-title="Autobongos"/);
+  assert.match(html, /id="gate-archon-only"/);
+  assert.ok(!/gate-list|hall-ask\.js/.test(html), 'the list mount and the ask-card script are gone');
+  assert.match(read('shell.js'), /\{ id: 'gate', label: 'Autobongos', icon: 'gate', href: '\/gate'/, 'the nav names it, at the same URL');
 });

package/tests/hall_street_desk.mjs

@@ -51,7 +51,7 @@ function board() {
 
 // ── a long-winded docket: every source, long words everywhere ─────────────────
 const LONG = 'The extraordinarily long-winded proposal to reorganise every single floor of the hall before winter';
-const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['gate_approvals', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
+const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
 function matter(over = {}) {
   return { id: 'blockers:1', source: 'blockers', building: 'planning', rule: 'majority', state: 'needs', title: 'A matter', short: 'a matter', where: 'Planning', opened_at: '2026-09-29T10:00:00.000Z', deadline: null, proposer: null, tally: null, href: null, ref: null, ...over };
 }
@@ -78,6 +78,9 @@ function longMatters() {
     }
   }
   out.push(matter({ id: 'board:900', source: 'board', building: 'planning', short: 'idea to ratify', title: LONG, state: 'needs' }));
+  // A second override waiting at Release: task 1004859 removed the gate-approval source that
+  // used to fill a Release floor, and the stress docket must still reach its 30 rows.
+  out.push(matter({ id: 'override_requests:901', source: 'override_requests', building: 'release', title: `${LONG} 901`, short: 'a matter with a very long short description', state: 'needs', ref: { id: 901 } }));
   return out;
 }
 const ROOM = { open: [{ id: '1', subject_type: 'constitutional_amendment', subject: { title: LONG, author_id: '7' }, votes: [] }, { id: '900', subject_type: 'full_idea', subject: { title: LONG }, votes: [] }], closed: [] };
@@ -176,7 +179,6 @@ test('a row\'s buttons are the card\'s acts under the board\'s words, and send t
     matter({ id: 'access_requests:11', source: 'access_requests', building: 'people', state: 'needs', proposer: { name: 'Ana Ruiz' }, ref: { id: 11 } }),
     matter({ id: 'goal_join_requests:12', source: 'goal_join_requests', building: 'people', state: 'needs', proposer: { name: 'Kai Mo' }, href: '/builders/goal/42', ref: { id: 12 } }),
     matter({ id: 'override_requests:13', source: 'override_requests', building: 'release', state: 'needs', ref: { id: 13 } }),
-    matter({ id: 'gate_approvals:14', source: 'gate_approvals', building: 'release', state: 'needs', ref: { id: 14 } }),
     matter({ id: 'board:1', source: 'board', building: 'charter', state: 'needs', ref: { type: 'board_item', id: '1' } }),
   ];
   const dk = docket(ms);
@@ -189,7 +191,6 @@ test('a row\'s buttons are the card\'s acts under the board\'s words, and send t
   const rel = D.rowsFor('release', 0, dk, { now: NOW });
   assert.deepEqual(rel[0].actions.map((a) => a.label), ['release', 'hold']);
   assert.equal(C.request(rel[0].card, 'release').url, '/api/bongos/override-requests/13/decide');
-  assert.equal(C.request(D.rowsFor('release', 5, dk, { now: NOW })[0].card, 'release').url, '/api/bongos/gate-approvals/14/approve');
   // a vote: yes and no, and the no's reason is a chip, never free text
   const vote = row('charter', 0);
   assert.deepEqual(vote.actions.map((a) => [a.key, a.label]), [['for', 'yes'], ['object', 'no']]);

package/tests/hall_street_inside.mjs

@@ -54,7 +54,7 @@ function proto(mode, st = {}) {
 function matter(over = {}) {
   return { id: 'blockers:1', source: 'blockers', building: 'planning', rule: 'majority', state: 'needs', title: 'A matter', short: 'a matter', where: 'Planning', opened_at: '2026-09-29T10:00:00.000Z', deadline: null, proposer: null, tally: null, href: null, ref: null, ...over };
 }
-const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['gate_approvals', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
+const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
 const READINGS = [['flow', 'review'], ['promises', 'planning'], ['money', 'treasury'], ['people', 'people'], ['fairness', 'disputes'], ['rules', 'rules']];
 function docket(matters = [], over = {}) {
   const counts = { needs: 0, moving: 0, settled: 0 };

package/tests/helpers.mjs

@@ -1136,3 +1136,37 @@ export function fakeHttpsGet(routes) {
   };
   return { get, asked };
 }
+
+// insertTestBuilders — insert throwaway `builders` rows that satisfy the MIGRATED schema
+// (task 1004863). builders.github_id became NOT NULL + UNIQUE, and the database tests
+// that each hand-wrote `INSERT INTO builders (id, github_login, …)` broke on it at once,
+// unnoticed, because the lanes that ran them were weekly or absent. One spelling here
+// fixes the drift, not just the column: a future NOT NULL column is added in one place.
+//
+// `db` is anything with `query(text, params)` (a pg Pool, or a client inside a
+// transaction). Each row is `{ id, login, ...columns }`: `github_id` defaults to
+// `test-gh-<id>` (unique per id, never a real GitHub id) and `display_name` to the login;
+// any other builders column may be named (rank, status, system_role, total_credits …).
+// A column one row names and another does not is written as DEFAULT for the other, so
+// the table's own defaults still apply. Column names come from the caller's literal
+// fixtures, never from input. `onConflict` is appended verbatim (default
+// `ON CONFLICT (id) DO NOTHING`; pass '' for none). Returns the inserted rows.
+export async function insertTestBuilders(db, rows, { onConflict = 'ON CONFLICT (id) DO NOTHING' } = {}) {
+  if (!rows.length) return [];
+  const shaped = rows.map(({ id, login, ...rest }) => {
+    if (id == null || !login) throw new Error('insertTestBuilders: every row needs an id and a login');
+    return { id, github_id: `test-gh-${id}`, github_login: login, display_name: login, ...rest };
+  });
+  const cols = [...new Set(shaped.flatMap((r) => Object.keys(r)))];
+  const params = [];
+  const tuples = shaped.map((r) => `(${cols.map((c) => {
+    if (!(c in r)) return 'DEFAULT';
+    params.push(r[c]);
+    return `$${params.length}`;
+  }).join(', ')})`);
+  const { rows: out } = await db.query(
+    `INSERT INTO builders (${cols.map((c) => `"${c}"`).join(', ')}) VALUES ${tuples.join(', ')} ${onConflict} RETURNING *`,
+    params,
+  );
+  return out;
+}

package/tests/howto_state.mjs

@@ -1,11 +1,16 @@
 // tests/howto_state.mjs — per-person read/unread state for the how-to steps (task 1004634)
 //
-// Two halves. The DB-free half drives howto-state.js against an in-memory pool that
-// honours the three statements it issues, so the contract runs everywhere: unread by
-// default, mark read, skip all, a read upgrades a skip (never the reverse), the first
-// read time is kept, reset some or all, and an id the guide does not name is refused.
-// The DB half applies the real migration and runs the same calls against Postgres; it
-// skips when no Postgres is reachable (DATABASE_URL), like copy_desk_flags_db.mjs.
+// The DB-free half. It drives howto-state.js against an in-memory pool that honours the
+// three statements it issues, so the contract runs everywhere: unread by default, mark
+// read, skip all, a read upgrades a skip (never the reverse), the first read time is
+// kept, reset some or all, and an id the guide does not name is refused.
+//
+// The SAME contract runs against Postgres in tests/howto_state_db.mjs, which imports
+// `contract` from here (task 1004863). That half used to live in this file, where it ran
+// in the DB-free unit lane against whatever database DATABASE_URL reached — creating a
+// stand-in `builders` table there if one was missing — and skipped in CI, so no lane
+// ever ran it. Split out, it is in the integration lane and uses the migrated schema.
+// The tests below run only when this file is the entry point, so importing it runs none.
 //
 // Run:  node tests/howto_state.mjs
 
@@ -60,7 +65,8 @@ function fakePool() {
   };
 }
 
-async function contract(label, deps, A, B) {
+// `test` is the caller's runner, so each file counts and reports its own cases.
+export async function contract(test, label, deps, A, B) {
   const first = guide.STEPS[0].id;
   const second = guide.STEPS[1].id;
 
@@ -126,53 +132,24 @@ async function contract(label, deps, A, B) {
   });
 }
 
-await test('shapeState ignores a stored mark for a step the guide no longer has', async () => {
-  const s = hs.shapeState([{ step_id: 'retired_step', how: 'read', read_at: new Date() }]);
-  assert.equal(s.read, 0);
-  assert.equal(s.total, guide.STEPS.length);
-});
-
-await test('the module declares its migration and the routes are mounted', async () => {
-  const mod = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/onboarding/module.json'), 'utf8'));
-  assert.equal(mod.contributes.migrations, true);
-  assert.ok(fs.existsSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql')));
-  const src = fs.readFileSync(path.join(ROOT, 'modules/onboarding/routes/onboarding.js'), 'utf8');
-  for (const r of ["router.get('/me/howto'", "router.post('/me/howto/read'", "router.post('/me/howto/reset'"]) assert.ok(src.includes(r), r);
-});
-
-await contract('in-memory', { pool: fakePool() }, 1, 2);
-
-// ── the real database ────────────────────────────────────────────────────────
-const { Pool } = require('pg');
-const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
-let dbUp = true;
-try { await pool.query('SELECT 1'); } catch (e) {
-  dbUp = false;
-  console.log(`  (db half SKIPPED — no reachable Postgres: ${e.code || e.message}. Set DATABASE_URL to run.)`);
-}
-if (dbUp) {
-  await pool.query(`
-    CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
-    CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text);
-  `);
-  await pool.query(fs.readFileSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql'), 'utf8'));
-  await pool.query(fs.readFileSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql'), 'utf8')); // idempotent
-  const A = 910000001;
-  const B = 910000002;
-  await pool.query('INSERT INTO builders (id, github_login) VALUES ($1, $2), ($3, $4) ON CONFLICT (id) DO NOTHING', [A, 'howto-a', B, 'howto-b']);
-  await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]);
-  try {
-    await contract('postgres', { pool }, A, B);
-    await test('postgres: the CHECK refuses a malformed step id and a bad how', async () => {
-      await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id) VALUES ($1, 'Bad Id')", [A]));
-      await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id, how) VALUES ($1, 'welcome', 'seen')", [A]));
-    });
-  } finally {
-    await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]).catch(() => {});
-    await pool.query('DELETE FROM builders WHERE id IN ($1, $2)', [A, B]).catch(() => {});
-  }
-}
-await pool.end().catch(() => {});
+const isMain = Boolean(process.argv[1]) && fs.realpathSync(url.fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+if (isMain) {
+  await test('shapeState ignores a stored mark for a step the guide no longer has', async () => {
+    const s = hs.shapeState([{ step_id: 'retired_step', how: 'read', read_at: new Date() }]);
+    assert.equal(s.read, 0);
+    assert.equal(s.total, guide.STEPS.length);
+  });
 
-console.log(`\n${passed} passed, ${failed} failed`);
-if (failed) process.exit(1);
+  await test('the module declares its migration and the routes are mounted', async () => {
+    const mod = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/onboarding/module.json'), 'utf8'));
+    assert.equal(mod.contributes.migrations, true);
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql')));
+    const src = fs.readFileSync(path.join(ROOT, 'modules/onboarding/routes/onboarding.js'), 'utf8');
+    for (const r of ["router.get('/me/howto'", "router.post('/me/howto/read'", "router.post('/me/howto/reset'"]) assert.ok(src.includes(r), r);
+  });
+
+  await contract(test, 'in-memory', { pool: fakePool() }, 1, 2);
+
+  console.log(`\n${passed} passed, ${failed} failed`);
+  if (failed) process.exit(1);
+}

package/tests/howto_state_db.mjs

@@ -0,0 +1,68 @@
+// tests/howto_state_db.mjs — the how-to read/unread contract against a REAL Postgres
+// (task 1004634; split out of tests/howto_state.mjs by task 1004863).
+//
+// tests/howto_state.mjs runs the contract against an in-memory pool in the DB-free unit
+// lane. This runs the SAME contract (imported, not copied) against the real migration
+// and the real CHECK constraints, in the integration lane (run-unit-tests.js INTEGRATION).
+// It used to be the second half of that file, where it ran in the unit lane against
+// whatever DATABASE_URL reached, created a stand-in `builders` table there if one was
+// missing, and skipped in CI — so no lane ever executed it, and it broke unnoticed when
+// builders.github_id became NOT NULL.
+//
+// Needs a MIGRATED database (scripts/migrate.sh). SKIPS (exit 0) with no reachable
+// Postgres, like every *_db test.
+//
+// Run:  DATABASE_URL=postgres://... node tests/howto_state_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+import { contract } from './howto_state.mjs';
+import { insertTestBuilders } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
+const { Pool } = require('pg');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`howto_state_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql'), 'utf8');
+await test('postgres: the migration re-applies cleanly over the migrated schema (idempotent)', async () => {
+  await pool.query(MIGRATION);
+  await pool.query(MIGRATION);
+});
+
+const A = 910000101;
+const B = 910000102;
+await insertTestBuilders(pool, [{ id: A, login: 'howto-a' }, { id: B, login: 'howto-b' }]);
+await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]);
+try {
+  await contract(test, 'postgres', { pool }, A, B);
+  await test('postgres: the CHECK refuses a malformed step id and a bad how', async () => {
+    await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id) VALUES ($1, 'Bad Id')", [A]), (e) => e.code === '23514');
+    await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id, how) VALUES ($1, 'welcome', 'seen')", [A]), (e) => e.code === '23514');
+  });
+} finally {
+  await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]).catch(() => {});
+  await pool.query('DELETE FROM builders WHERE id IN ($1, $2)', [A, B]).catch(() => {});
+  await pool.end().catch(() => {});
+}
+
+console.log(`\nhowto_state_db: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/idea_credit_streams_db.mjs

@@ -133,13 +133,21 @@ async function fixture(client, { completeness = 70, developed = false, taskCount
     idea_id: idea.id,
     grade: 'full',
     completeness_score: completeness,
-    ...(developer ? { developed_by: developer.id } : {}),
+    // developed_by and developed_at travel as a pair (ideas_grades_developed_pair_chk).
+    ...(developer ? { developed_by: developer.id, developed_at: new Date() } : {}),
+  });
+  // status is named, not placeholder-filled: versions_status_check admits only the
+  // lifecycle values, and 'building' is the one with no uniqueness rule of its own
+  // (versions_one_planning_idx allows exactly one 'planning' row, which the seeds own).
+  const version = await insertRow(client, 'versions', {
+    id: `IC6-${Date.now()}-${Math.random()}`.slice(0, 40), status: 'building',
   });
-  const version = await insertRow(client, 'versions', { id: `IC6-${Date.now()}-${Math.random()}`.slice(0, 40) });
   const tasks = [];
   for (let i = 0; i < taskCount; i++) {
     const task = await insertRow(client, 'tasks', {
-      version_id: version.id, title: `ic6 task ${i + 1}`, status: 'shipped',
+      // discipline is named for the same reason as the version status above:
+      // tasks_discipline_check admits only the live crafts.
+      version_id: version.id, title: `ic6 task ${i + 1}`, status: 'shipped', discipline: 'engineer',
     });
     await insertRow(client, 'ideas_task_lineage', {
       task_id: task.id, idea_id: idea.id, origin: 'promote',

package/tests/integration_parked_ratchet.mjs

@@ -51,7 +51,13 @@ const { INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING } = require('../scripts/b
 // LOWERED 11 → 6 by task 1004861: claim_gate_open_blocker, claim_gate_rebase,
 // clawback_confirmed_backlog, needs_rebase and reward_mode_cost_plus_only stopped adding a
 // second 'planning' version (and had three stale fixtures under it repaired).
-const MAX_PARKED = 6;
+// LOWERED 6 → 1 by task 1004863: acclaim_feed_evidence_db, copy_desk_flags_db,
+// government_board_membership_db, idea_credit_streams_db and session_earnings_mirror_db had
+// stale fixtures (a missing builders.github_id, retired status/discipline values, a sliced
+// copy of a route's SQL); repaired, they gate again.
+// LOWERED 1 → 0: status-probe, the last entry, was deleted with its test by task 1004858.
+// Nothing is parked; a new entry now needs this raised, deliberately.
+const MAX_PARKED = 0;
 
 // The one test that proves the PUBLISHED package works end to end: packaged, installed into
 // a consumer, installed again from its own shipped lockfile, migrated onto EMPTY databases,

package/tests/nav_permission_atoms.mjs

@@ -93,7 +93,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // says a held core version was tried and rolled back; task 1004731: the one-time
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
 // task 1004846: the new logo (its bump landed late, in task 1004852).
-const SHELL_SHA = 'bf052d6fabeb1953';
+const SHELL_SHA = '670b2f71085c13b6';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);