@bongos/core 1.21.177 → 1.21.178

package/scripts/bongos/bump-version.js

@@ -30,6 +30,8 @@
 //   node scripts/bongos/bump-version.js                # dry-run: print the plan
 //   node scripts/bongos/bump-version.js --apply        # rewrite both files
 //   node scripts/bongos/bump-version.js --apply --note "run 123456"  # extra provenance
+//   node scripts/bongos/bump-version.js --apply --taken-file versions.json
+//       # skip every version in that JSON array (`npm view @bongos/core versions --json`)
 // stdout (both modes): one JSON line { from, to, applied } for CI to capture.
 
 'use strict';
@@ -51,12 +53,18 @@ const DIVIDER = '---------------------------------------------------------------
 // entry appended too; omit it to bump the literal alone (the unit tests do).
 // Throws with a precise message on any shape it does not recognize — a silent
 // mis-edit of the version literal is the worst possible failure mode here.
-function bumpPatch(src, { note = '', changelog = null } = {}) {
+//
+// `taken` (task 1004886): versions that already exist on the registry. The bump
+// lands on the first patch past `from` that is NOT taken, because npm never lets a
+// version be published twice — and a run that "re-publishes" a taken number ships
+// nothing new while main is told it did. That is how 1.21.175 got recorded on main
+// on 2026-10-25 for a tree the registry's 1.21.175 (built 2026-10-23) never held.
+function bumpPatch(src, { note = '', changelog = null, taken = new Set() } = {}) {
   const m = src.match(CONST_RE);
   if (!m) throw new Error(`bump-version: could not find the CORE_VERSION literal in ${TARGET} (expected: const CORE_VERSION = 'x.y.z';)`);
   const [major, minor, patch] = [Number(m[1]), Number(m[2]), Number(m[3])];
   const from = `${major}.${minor}.${patch}`;
-  const to = `${major}.${minor}.${patch + 1}`;
+  const to = nextFreePatch(major, minor, patch, taken);
 
   // 1. The literal — same line shape deploy-divergence greps for.
   const newConstLine = `const CORE_VERSION = '${to}'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md`;
@@ -79,17 +87,40 @@ function bumpPatch(src, { note = '', changelog = null } = {}) {
   return { from, to, text, changelogText };
 }
 
+// The first patch after `patch` whose version is not in `taken`. Bounded, so a
+// corrupt taken-list can never spin: 10,000 consecutive taken patches is not a
+// registry, it is a bug, and it throws.
+function nextFreePatch(major, minor, patch, taken = new Set()) {
+  for (let p = patch + 1; p <= patch + 10000; p += 1) {
+    const v = `${major}.${minor}.${p}`;
+    if (!taken.has(v)) return v;
+  }
+  throw new Error(`bump-version: no free patch within 10000 of ${major}.${minor}.${patch} — the taken-list is not a registry listing`);
+}
+
+// Parse `npm view <pkg> versions --json` output into a Set of x.y.z strings. npm
+// prints a bare string (not an array) when exactly one version exists. Anything
+// that is not a strict x.y.z is dropped, so a stray line cannot become a version.
+function registryVersions(jsonText) {
+  let v;
+  try { v = JSON.parse(String(jsonText)); } catch { return new Set(); }
+  const list = Array.isArray(v) ? v : (typeof v === 'string' ? [v] : []);
+  return new Set(list.filter((x) => typeof x === 'string' && /^\d+\.\d+\.\d+$/.test(x)));
+}
+
 function main() {
   const apply = process.argv.includes('--apply');
   const noteIdx = process.argv.indexOf('--note');
   const note = noteIdx !== -1 ? (process.argv[noteIdx + 1] || '') : '';
+  const takenIdx = process.argv.indexOf('--taken-file');
+  const taken = takenIdx !== -1 ? registryVersions(fs.readFileSync(process.argv[takenIdx + 1], 'utf8')) : new Set();
 
   // Read and transform BOTH files before writing EITHER: a half-applied bump
   // (literal moved, ledger silent) is precisely the drift this script exists
   // to prevent, and it would be committed and pushed to main before anyone saw it.
   const src = fs.readFileSync(TARGET, 'utf8');
   const changelog = fs.readFileSync(CHANGELOG, 'utf8');
-  const { from, to, text, changelogText } = bumpPatch(src, { note, changelog });
+  const { from, to, text, changelogText } = bumpPatch(src, { note, changelog, taken });
   if (changelogText === null) throw new Error('bump-version: the ledger was not rewritten — refusing to write a versionless release');
   if (apply) {
     fs.writeFileSync(TARGET, text);
@@ -143,10 +174,13 @@ function isReleaseCommit(subject) {
 //   • pack or publish failed  → the bump commit was never pushed (it only ever
 //     existed on the discarded runner), so no version looks taken and the next
 //     run recomputes and retries the SAME version. No gap, nothing burned.
-//   • published, push then failed → version looks free, so the next run bumps to
-//     it and npm refuses the duplicate. publish.yml treats that refusal as
-//     success and falls through to the record step, which commits the release
-//     line main was missing. Self-healing, and nothing wrong ships.
+//   • published, push then failed → version looks free to git, but the registry
+//     listing publish.yml passes as --taken-file has it, so the next run bumps PAST
+//     it (a gap in main's ledger, harmless). Task 1003914 used to treat npm's
+//     duplicate refusal as success and record the version instead — but the push
+//     fails precisely because main MOVED, so the recorded tree was never the one on
+//     the registry. That recorded 1.21.175 for 200+ commits npm never had (task
+//     1004886). A duplicate refusal now fails the run and records nothing.
 //
 // Before that reorder the first case was the lossy one: the push landed first,
 // so a failed publish left main declaring a version the registry never had, the
@@ -196,8 +230,9 @@ function isHumanReleaseCommit(subject) {
 //
 // BOTH failure directions stay safe, which is what makes this acceptable here. A
 // subject wrongly counted → the lane bumps PAST a free version (a gap, harmless). A
-// real release missed → npm refuses the duplicate and publish.yml's already-present
-// branch records it (task 1003914). Neither direction can double-publish.
+// real release missed → the registry listing marks it taken and the lane bumps past
+// it; if even that read failed, npm refuses the duplicate and the run fails without
+// recording anything (task 1004886). Neither direction can double-publish or mislabel.
 function laneReleasedVersions(subjects = []) {
   const out = new Set();
   for (const subject of subjects) {
@@ -211,6 +246,8 @@ function laneReleasedVersions(subjects = []) {
 
 module.exports = {
   bumpPatch,
+  nextFreePatch,
+  registryVersions,
   CONST_RE,
   RELEASE_COMMIT_RE,
   HUMAN_RELEASE_COMMIT_RE,

package/scripts/bongos/doc-cli-guard.js

@@ -48,6 +48,8 @@ const DOC_CLI_ALLOW = new Map([
     'an accepted ADR recording how its evidence was measured; the spike harness was deleted once the verdict stood (task 1004857) and the ADR names the commit to recover it from.'],
   ['docs/session-logs/2026-08-28-goal-1000072-stale-timer-and-network-map-spike.md::scripts/bongos/spike-task-map.js',
     'a dated session log — the historical record, never rewritten — of the spike whose harness task 1004857 deleted; it describes what was run then, not what to run now.'],
+  ['docs/session-logs/2026-09-16-task-1003752-stranded-detector-never-ran.md::scripts/bongos/gate-review.js',
+    'a dated session log — the historical record, never rewritten — naming the gate-review classifier task 1004859 deleted (its CI check never ran); it describes what was run then, not what to run now.'],
 ]);
 
 // `node scripts/bongos/foo.js` … up to the end of the line/segment, so the flags that

package/scripts/bongos/doc-control-claims.js

@@ -77,8 +77,8 @@ const SKIP_PREFIXES = ['docs/session-logs/', 'docs/audits/', 'limitations/'];
 const ALLOW = new Map([
   ['docs/adr/0025-structured-criterion-task-link.md::scripts/bongos/seed-v3-tasks.js',
     'describes the grep a session HAD to do before this ADR; a seed script, not a control'],
-  ['docs/adr/0042-builder-self-deploy-ci-auto-merge.md::.github/workflows/grade-gate.yml',
-    'the CI grader gate this ADR designed; it was armed in the grader-off variant its own Status line records, and grading runs server-side (scripts/bongos/ci-grade.js)'],
+  ['docs/adr/0089-modular-multi-model-adversarial-grader.md::scripts/bongos/gate-review.js',
+    'ADR 0089 section 8 names the ADR 0058 gatekeeper as a surface the grading engine does not own; task 1004859 deleted it (the CI check it drove never ran) and moved its hard-floor list to scripts/bongos/hard-floor.js'],
   ['docs/adr/0111-instance-hosting-provisioning-module.md::scripts/bongos/box.js',
     'the dev-box control-plane runner, retired with dev boxes by ADR 0346 (dev-box-guard.js keeps it out)'],
   ['docs/adr/0150-box-first-boot-bringup-vendored-instances.md::scripts/bongos/box.js',

package/scripts/bongos/government-walk.js

@@ -37,8 +37,8 @@
 // an in-memory fake with the same row shapes and the same guards (one open sitting
 // per subject, one vote per member, single-winner close, the decision-rules write
 // only from a passed decision-rules amendment), and the few writes a passed matter
-// makes into other modules are recorded in memory instead of written to a database
-// (or, for a gate approval, sent to GitHub). The table says which mode ran.
+// makes into other modules are recorded in memory instead of written to a database.
+// The table says which mode ran.
 //
 // Usage:
 //   node scripts/bongos/government-walk.js           run it and print the table
@@ -102,7 +102,6 @@ const REQUESTS = Object.freeze({
   'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
   'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
   'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
-  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
   'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
   'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
   'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],
@@ -122,7 +121,6 @@ const MATTER_PLAN = Object.freeze([
   ['automation', 'Switch unattended building off', { type: 'switch_off' }, 'fence off'],
   ['automation', 'Allow goal 77 to build unattended', { type: 'allow_goal', goal_id: 77 }, 'goal 77 allowed'],
   ['release', 'Approve override request 5', { type: 'approve_override', request_id: 5 }, 'request 5 approved'],
-  ['release', 'Clear the gate on PR 1500', { type: 'approve_gate', pr: 1500 }, 'PR 1500 cleared'],
   ['review', 'Sign off criterion 9', { type: 'satisfy_criterion', criterion_id: 9 }, 'criterion 9 satisfied'],
   ['treasury', 'Dee gets $50 a month', { type: 'set_budget', builder_id: 45, monthly_usd: 50 }, 'Dee\'s limit is $50'],
 ]);
@@ -135,7 +133,6 @@ const ROUTERS = Object.freeze([
   // no HTTP surface; it contributes the Release and Review matter acts, as at boot
   'modules/lifecycle/routes/lifecycle.js',
   'modules/lifecycle/routes/done-when.js',
-  'modules/lifecycle/routes/gate-approvals.js',
   'modules/lifecycle/routes/tasks.js',
   'modules/lifecycle/routes/goals.js',
   'modules/lifecycle/routes/versions.js',
@@ -618,7 +615,6 @@ async function runWalk() {
   const lifeDb = req('modules/lifecycle/db.js');
   const doneWhen = req('modules/lifecycle/done-when.js');
   const doneWhenRoutes = req('modules/lifecycle/routes/done-when.js');
-  const gateRoutes = req('modules/lifecycle/routes/gate-approvals.js');
   const express = require('express');
   const http = require('http');
 
@@ -634,11 +630,10 @@ async function runWalk() {
   projectSettings.setSetting = async (k, v) => { settings.set(k, String(v)); return { key: k, value: String(v) }; };
 
   // What passed matters write into other modules, recorded.
-  const effects = { fence: null, allowedGoals: [], overrides: [], gates: [], criteria: new Map([['9', false]]), budgets: new Map() };
+  const effects = { fence: null, allowedGoals: [], overrides: [], criteria: new Map([['9', false]]), budgets: new Map() };
   autoDb.setFenceEnabled = async ({ enabled }) => { effects.fence = enabled; return { enabled }; };
   autoDb.allowGoal = async ({ goalId }) => { effects.allowedGoals.push(String(goalId)); return { goal_id: goalId }; };
   lifeDb.decideOverrideRequest = async ({ requestId, decision }) => { effects.overrides.push([String(requestId), decision]); return {}; };
-  gateRoutes.approveGatePr = async ({ number }) => { effects.gates.push(String(number)); return { ok: true, body: {} }; };
   doneWhen.getCriterion = async (id) => (effects.criteria.has(String(id)) ? { id, satisfied: effects.criteria.get(String(id)) } : null);
   doneWhenRoutes.satisfyByOverride = async ({ criterionId }) => { effects.criteria.set(String(criterionId), true); return { updated: {}, goalResult: {} }; };
 
@@ -971,7 +966,6 @@ async function runWalk() {
     'automation.switch_off': () => effects.fence === false,
     'automation.allow_goal': () => effects.allowedGoals.includes('77'),
     'release.approve_override': () => effects.overrides.some(([id, d]) => id === '5' && d === 'approve'),
-    'release.approve_gate': () => effects.gates.includes('1500'),
     'review.satisfy_criterion': () => effects.criteria.get('9') === true,
     'treasury.set_budget': () => effects.budgets.get('45') === 50,
   };

package/scripts/bongos/hard-floor.js

@@ -0,0 +1,52 @@
+'use strict';
+
+// scripts/bongos/hard-floor.js — the trust-boundary HARD FLOOR: the repo paths that,
+// if a compromised or injected senior session changed them, would disable the safety
+// system itself or the deploy switch. A subset of PROTECTED_GLOBS (the protected-surface
+// registry, modules/government/protected-surfaces.json); tests/government_protected_surfaces.mjs
+// holds the subset honest.
+//
+// WHERE IT CAME FROM. This list lived in scripts/bongos/gate-review.js, the ADR 0058
+// classifier a planned gate-review CI check was meant to run. That check never ran on
+// main, and task 1004859 removed the classifier with the hall Gate page that waited on
+// it. Two live readers still need the list, so it moved here unchanged (minus the two
+// deleted drivers that named themselves):
+//   - scripts/bongos/publish-manifest.js — what the public mirror must never carry;
+//   - scripts/bongos/adopt-preflight.js  — whether an adopted repo lands on the floor.
+//
+// Imported, never re-typed: a consumer that needs the floor requires this file.
+// Kept as globs so the matcher is the one permission-path-check builds (trailing '/' =
+// subtree, case- and NFC-folded — task 1002874: a byte-exact matcher let an uppercased
+// spelling of a floor surface walk past).
+
+const { compileGlobMatcher } = require('../../src/bongos/permission-path-check');
+
+const HARD_FLOOR_GLOBS = [
+  'scripts/bongos/hard-floor.js', // self
+  'src/bongos/permission-path-check.js', // defines the protected set
+  'src/bongos/route-rank-check.js', // the route-gate auditor
+  'src/bongos/auth.js', // requireRank / requireBuilder — the enforcement point
+  'modules/grading/grader.js',       // BV1.R73: grading carved to modules/grading/
+  'modules/grading/grader-workers/',
+  'modules/grading/grader-rubric.json',
+  'scripts/bongos/grade-smoke.js', // grade-smoke driver
+  'scripts/bongos/conductor-dispatch.js', // mid-flight grader dispatch
+  'scripts/bongos/main-audit.js', // the authoritative deploy-time audit (the backstop)
+  'scripts/bongos/push-main.js', // the sanctioned main-push carrying the override
+  'scripts/bongos/run-unit-tests.js', // the unit-gate test selector
+  'scripts/bongos/install-git-hooks.js',
+  'scripts/bongos/hooks/',
+  'scripts/migrate.sh',
+  'scripts/deploy/',
+  'config/deploy.json', // the laptop/ci/bypass deploy switch
+  'infra/', // branch-protection.json + deploy substrate
+  '.github/', // CI workflows: the unit gate, secret scan, publish
+  'CODEOWNERS',
+  '.husky/', // pre-push/pre-commit gate delivery
+  '.claude/hooks/',
+  '.claude/settings.json',
+];
+
+const matchesHardFloor = compileGlobMatcher(HARD_FLOOR_GLOBS);
+
+module.exports = { HARD_FLOOR_GLOBS, matchesHardFloor };

package/scripts/bongos/publish-manifest.js

@@ -16,7 +16,7 @@
 //      that falls inside an allowlisted subtree is dropped if the denylist forbids it.
 //   isPublishable(p)  ==  matchesDeny(p) ? false : matchesAllow(p)
 //
-// REUSE, NEVER RE-TYPE (the task's explicit instruction; the gate-review.js doctrine):
+// REUSE, NEVER RE-TYPE (the task's explicit instruction; the hard-floor.js doctrine):
 //   The three canonical sensitive-surface inventories are IMPORTED, never copied —
 //   PROTECTED_GLOBS (write-protection over trust/pipeline/infra code),
 //   HARD_FLOOR_GLOBS (the rank-independent escalate subset), and
@@ -28,10 +28,10 @@
 //   cross-checks the partition against the live inventory so it cannot silently drift.
 
 // The three canonical sensitive-surface inventories — imported from their homes,
-// NEVER re-typed (the gate-review.js "imported, never hand-retyped" doctrine). All
+// NEVER re-typed (the "imported, never hand-retyped" doctrine). All
 // three are pure to require (no DB/network at load; their CLIs are require.main-guarded).
 const { PROTECTED_GLOBS, globToRegExp } = require('../../src/bongos/permission-path-check');
-const { HARD_FLOOR_GLOBS } = require('./gate-review');
+const { HARD_FLOOR_GLOBS } = require('./hard-floor');
 const { SENSITIVE_DOC_GLOBS } = require('./search-ingest-md');
 
 // ---------------------------------------------------------------------------

package/scripts/bongos/run-unit-tests.js

@@ -258,6 +258,14 @@ const INTEGRATION = new Set([
   // branch over a fake table; only a real engine runs the one-shot DO block and
   // shows a legacy account published again and marked apart from a sign-in.
   'terms_grandfather_db',
+  // task 1004863: three database halves that no lane ran. page_notes_db (the page
+  // feedback doc schema rules; modules/page-notes is live and on by default) self-skipped
+  // in the unit lane and was in no set. howto_state_db and search_isolation_db are the
+  // database halves split out of howto_state and search_isolation, whose DB-free halves
+  // stay in the unit lane: the first runs the how-to read contract on the real schema,
+  // the second proves the search index never widens a caller past their rank or into
+  // another builder memory. Each skipped in CI before, so none had ever been gated.
+  'page_notes_db', 'howto_state_db', 'search_isolation_db',
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):
@@ -448,6 +456,15 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 // needed terms_accepted_at stamped: the public read requires both consent columns since
 // ADR 0213. If one of them reds again, check the module flag is still set first.
 //
+// FIVE LEFT THIS LIST under task 1004863, each repaired against a freshly migrated
+// database: copy_desk_flags_db, government_board_membership_db (builders.github_id is
+// NOT NULL now; their rows go through insertTestBuilders in tests/helpers.mjs, and the
+// stand-in tables that hid the drift are gone), idea_credit_streams_db and
+// session_earnings_mirror_db (fixture rows named a version status and a task discipline
+// the CHECK constraints no longer admit), and acclaim_feed_evidence_db, which now calls
+// the real feed route handler instead of a sliced copy of its SQL and owns a building
+// version rather than colliding with the seeded planning one (the oscillation above).
+//
 // consumer_layout_boot LEFT THIS LIST under task 1002863. Its "missing core tarball" was
 // package-core's fail-closed leak gate reading the lane's throwaway database password (the
 // word postgres, present in hundreds of core files) as a leaked credential and refusing to
@@ -464,11 +481,6 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 // with no blocker_ref, and db.shipTask called without the land assurance task 1002483
 // made mandatory. Each passes alone on a freshly migrated database.
 const INTEGRATION_PARKED = new Set([
-  'acclaim_feed_evidence_db',
-  'copy_desk_flags_db',
-  'government_board_membership_db',
-  'idea_credit_streams_db',
-  'session_earnings_mirror_db',
 ]);
 
 function main() {

package/scripts/gds/hard-floor.js

@@ -0,0 +1,6 @@
+// scripts/gds/hard-floor.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/hard-floor.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'hard-floor.js');

package/src/bongos/module-scope-map.js

@@ -93,7 +93,7 @@ const MODULE_GLOBS = {
   ],
   // --- the build state machine + ship/grade/deploy orchestration + schema ---
   // Carved into modules/lifecycle/ (BV1.R86 / ADR 0093 §1,§3): the task/claim/
-  // version/goal/done-when/dependency/gate-approvals routes + the db slice, the
+  // version/goal/done-when/dependency routes + the db slice, the
   // task-classifier + hierarchy + done-when libs, github-push + ship-card +
   // ship-preflight + merge-lock + conflict-resolve + publish-reconciler +
   // version-close, and the `lifecycle` kernel PORT — all under the
@@ -115,7 +115,7 @@ const MODULE_GLOBS = {
     'scripts/bongos/ship-regen.js', 'scripts/bongos/ship-resume.js', 'scripts/bongos/ship-session-upload.js',
     'scripts/bongos/ship-state.js', 'scripts/bongos/ship-surprise.js', 'scripts/bongos/ship-visual.js',
     'scripts/bongos/merge-mode.js', 'scripts/bongos/confirm.js', 'scripts/bongos/main-audit.js',
-    'scripts/bongos/gate-review.js', 'scripts/bongos/push-main.js', 'scripts/bongos/ci-grade.js',
+    'scripts/bongos/hard-floor.js', 'scripts/bongos/push-main.js',
     'scripts/bongos/merge-lock.js', 'scripts/bongos/version-close.js',
     'migrations/',
   

package/src/bongos/permission-path-check.js

@@ -43,7 +43,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // modules/government/protected-surfaces.json — no longer a constant baked into
 // this file. Re-mapping a floor there is a POLICY edit. It cannot move
 // enforcement into the app: the three layers above (git pre-push hook, grader
-// pre-pass, post-push main audit) plus gate-review.js and the goal-scope check
+// pre-pass, post-push main audit) plus the goal-scope check
 // read the registry out of band — no DB, no server, no HTTP — and remain the
 // authority (ADR 0043). Making the request path the enforcer is the exact
 // regression this task exists to prevent.

package/src/bongos/route-rank-check.js

@@ -220,7 +220,7 @@ const EXPECTED_RANKS = {
   'GET /builders/directory': 'any-builder',
   // (the lifecycle fleet pins — task authoring/promotion/abandonment, override
   //  adjudication, polymorphic dependency edges, goal tier + ask-to-widen,
-  //  criterion confirmation, and gate-approvals — moved to MODULE_EXPECTED_RANKS
+  //  and criterion confirmation — moved to MODULE_EXPECTED_RANKS
   //  ['lifecycle'] below in BV1.R86. They live in the lifecycle module now
   //  (modules/lifecycle/routes/…), so they're verified only when that module is in
   //  scope, not unconditionally from this core list — the pins follow the routes.)
@@ -500,13 +500,6 @@ const MODULE_EXPECTED_RANKS = {
     'POST /done-when/:criterionId/uat/recording': 'perm:criterion.review',
     'POST /done-when/:criterionId/uat': 'perm:criterion.review',
     'PUT /done-when/:criterionId/backend-only': 'perm:criterion.create',
-    // gate-surface PR approval from the hall (task 1179, ADR 0058 amendment). ADR 0157
-    // SPLIT these two: the list route is `gate_approval.read` (metic — the Gate page
-    // opens to the working rank), while APPROVING still clears the gate-review hard
-    // floor and stays `gate_approval.decide` (archon, system). The split is the reason
-    // the page is usable at all — see the atom's note in catalog.js.
-    'GET /gate-approvals': 'perm:gate_approval.read',
-    'POST /gate-approvals/:pr/approve': 'perm:gate_approval.decide',
   },
   // Ratifying a criterion proposal WRITES scope-truth (it creates a done-when
   // criterion). Metic+ may file the proposal; ADR 0157 also lets Metic ratify it

package/src/bongos/routes.js

@@ -31,7 +31,7 @@ const buildMySessionsRouter = require('./routes/my-sessions');
 const buildMyPasskeysRouter = require('./routes/my-passkeys');
 const buildBuildersRouter = require('./routes/builders');
 // The LIFECYCLE routes (tasks · claims · versions · done-when · goals ·
-// dependencies · gate-approvals · analytics) carved into modules/lifecycle/
+// dependencies · analytics) carved into modules/lifecycle/
 // (BV1.R86 / ADR 0093 §1,§3); moduleLoader.mountModuleRoutes (below) mounts them
 // via the lifecycle module's route factories — no core require. The `/tasks/:id/
 // publish-branch` body-parser bypass below STAYS (the route carries its own larger
@@ -187,7 +187,6 @@ function buildGdsRouter() {
   // and discord (with its bug-attachments route) have both graduated
   // into real modules (modules/<key>/) — they are discovered + mounted by
   // moduleLoader.mountModuleRoutes below, not here (BV1.R43 / R48 / R47 / R72).
-  // gate-approvals likewise moved to the lifecycle module (BV1.R86).
   router.use(buildLlmCacheRouter());
 
   // Loader-mounted module routers (ADR 0083 / BV1.R41). Discovers + mounts every

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.177'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.178'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/modules.js

@@ -44,7 +44,7 @@ const INSTANCE_PATH = path.join(resolveInstanceRoot(), 'config', 'modules.json')
 //
 // CORE (always on, never a module): auth, builders, tasks, claims, versions,
 // done-when, credits/cost, inbox, blockers, leaderboard, analytics,
-// audit-log, security, access-requests, sessions, gate-approvals, healthz,
+// audit-log, security, access-requests, sessions, healthz,
 // public. These mount unconditionally. The optional feature modules AND the
 // first TWO carved CORE-domain modules have graduated to modules/<key>/ (discord
 // BV1.R47, art-pipeline BV1.R48, game BV1.R49, memory BV1.R72 —

package/tests/acclaim_feed_evidence_db.mjs

@@ -16,21 +16,22 @@
 //   - a ship with several cost rows must sum them, not pick one;
 //   - the two LATERALs and the grades join must not multiply the row out.
 //
-// Runs the route's own query text — sliced out of the shipped source, never
-// retyped — so a future edit to the route is tested rather than a copy of it.
+// Calls the REAL route handler (GET /tasks/peer-votes/feed from the lifecycle
+// router) against the database, so a future edit to the route is tested rather
+// than a copy of it. It used to slice the query text out of the route's source and
+// re-interpolate it by hand; the route grew a second interpolation (the helper
+// join), the copy stopped resolving, and the test failed on its own scaffolding
+// rather than on the route (task 1004863). Driving the handler cannot drift that way.
 // Self-skips without a reachable Postgres; in the INTEGRATION set, so the
 // DB-free unit gate never runs it and .github/workflows/integration.yml does.
 //
 // Run:  DATABASE_URL=... node tests/acclaim_feed_evidence_db.mjs
 import { createRequire } from 'node:module';
 import { strict as assert } from 'node:assert';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { insertTestBuilders } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
 try {
@@ -41,18 +42,30 @@ try {
   process.exit(0);
 }
 
-// The query under test, taken from the shipped route. gradeQualityWhere is
-// interpolated by the route at call time, so interpolate it the same way.
-const { gradeQualityWhere } = require('../modules/lifecycle/db-shared.js');
-const routeSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
-const start = routeSrc.indexOf('`SELECT t.id, t.title, t.value_summary, t.version_id, t.status,');
-assert.ok(start > 0, 'the peer-votes feed query is still where this test slices it from');
-const end = routeSrc.indexOf('LIMIT $2`', start);
-assert.ok(end > start, 'the feed query still ends at its LIMIT');
-const SQL = routeSrc
-  .slice(start + 1, end + 'LIMIT $2'.length)
-  .replace(/\$\{gradeQualityWhere\('g'\)\}/g, gradeQualityWhere('g'));
-assert.ok(!SQL.includes('${'), 'every interpolation in the sliced query was resolved');
+// The handler under test: the last stack entry of the shipped route (the first is
+// auth.requireBuilder, which needs a session; the handler reads req.builder, which
+// we supply). The router's pool is the core pool, which reads DATABASE_URL — the
+// same database this file writes its fixtures to.
+const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
+const feedLayer = buildTasksRouter().stack
+  .find((l) => l.route && l.route.path === '/tasks/peer-votes/feed' && l.route.methods.get);
+assert.ok(feedLayer, 'the lifecycle router still serves GET /tasks/peer-votes/feed');
+const feedHandler = feedLayer.route.stack[feedLayer.route.stack.length - 1].handle;
+
+// Call the route as `builder` and return its JSON body; a failure surfaces as a throw.
+async function feed(builder, limit = 100) {
+  let body = null;
+  let failure = null;
+  const res = {
+    json(b) { body = b; return res; },
+    fail(code, opts) { failure = { code, opts }; return res; },
+    status() { return res; },
+  };
+  await feedHandler({ builder, query: { limit: String(limit) }, params: {}, headers: {}, get: () => undefined }, res);
+  if (failure) throw new Error(`the feed route failed: ${JSON.stringify(failure)}`);
+  assert.ok(body && Array.isArray(body.tasks), 'the feed answered with a task list');
+  return body;
+}
 
 const VOTER = 90000801;
 const SHIPPER = 90000802;
@@ -82,10 +95,13 @@ const check = (name, fn) => {
 try {
   await cleanup();
 
-  await q("INSERT INTO versions (id, name, status) VALUES ($1, 'acclaim evidence fixture', 'planning')", [VER]);
-  for (const [id, login] of [[VOTER, 'zz-acc-voter'], [SHIPPER, 'zz-acc-shipper']]) {
-    await q("INSERT INTO builders (id, github_login, display_name, rank) VALUES ($1, $2, $2, 'metic')", [id, login]);
-  }
+  // 'building', not 'planning': versions_one_planning_idx allows ONE planning row and
+  // the seeds own it — the collision that parked this test (task 1004042).
+  await q("INSERT INTO versions (id, name, status) VALUES ($1, 'acclaim evidence fixture', 'building')", [VER]);
+  await insertTestBuilders(pool, [
+    { id: VOTER, login: 'zz-acc-voter', rank: 'metic' },
+    { id: SHIPPER, login: 'zz-acc-shipper', rank: 'metic' },
+  ], { onConflict: '' });
   for (const [id, title] of [
     [T.GOOD, '__acc__ graded and costed'],
     [T.OUTAGE, '__acc__ grader outage'],
@@ -123,7 +139,10 @@ try {
   await cost(T.FREE, '0');
   // T.OUTAGE and T.UNGRADED get no cost row at all.
 
-  const rows = await q(SQL, [VOTER, 100]);
+  // A metic caller: cost reaches only the ranks that can vote, so this is the view
+  // that carries every figure under test.
+  const body = await feed({ id: VOTER, rank: 'metic' });
+  const rows = body.tasks;
   const byId = new Map(rows.map((r) => [String(r.id), r]));
   const got = (id) => {
     const row = byId.get(String(id));

package/tests/adr_0089_scope.mjs

@@ -28,9 +28,11 @@ const adr = read('docs/adr/0089-modular-multi-model-adversarial-grader.md');
 const section = adr.slice(adr.indexOf('### 8. Scope: what the engine does NOT own'), adr.indexOf('## Consequences'))
   .replaceAll('scripts/gds/', 'scripts/bongos/'); // rename-keep
 
+// §8 also names scripts/bongos/gate-review.js. Task 1004859 deleted it (the CI check it
+// drove never ran), so there is nothing left to hold to the boundary; the ADR keeps the
+// name as history.
 const SURFACES = [
   'scripts/bongos/session-eval.js',
-  'scripts/bongos/gate-review.js',
   'scripts/bongos/main-audit.js',
   'scripts/bongos/architect-audit.js',
 ];
@@ -40,7 +42,7 @@ test('ADR 0089 carries the §8 scope section, before Consequences', () => {
   assert.ok(section.length > 200, 'the section sits between §7 and Consequences');
 });
 
-test('§8 names each of the four surfaces by path, and each path exists', () => {
+test('§8 names each of the remaining surfaces by path, and each path exists', () => {
   for (const p of SURFACES) {
     assert.ok(section.includes(p), `§8 names ${p}`);
     assert.ok(fs.existsSync(new URL(`../${p}`, import.meta.url)), `${p} exists`);
@@ -56,14 +58,14 @@ test('the Architect uses exactly the three grader helpers §8 names — nothing
   for (const name of used) assert.ok(section.includes(name), `§8 names ${name}`);
 });
 
-test('session-eval, gate-review and main-audit import no grading module', () => {
+test('session-eval and main-audit import no grading module', () => {
   for (const p of SURFACES.filter((s) => !s.endsWith('architect-audit.js'))) {
     assert.doesNotMatch(read(p), /require\([^)]*modules\/grading/, `${p} must not require grading code`);
   }
 });
 
-test('main-audit and gate-review share only the rank-permission checker §8 names', () => {
-  for (const p of ['scripts/bongos/main-audit.js', 'scripts/bongos/gate-review.js']) {
+test('main-audit reads the rank-permission checker §8 names', () => {
+  for (const p of ['scripts/bongos/main-audit.js']) {
     assert.match(read(p), /permission-path-check/, `${p} reads the checker`);
   }
   assert.ok(section.includes('src/bongos/permission-path-check.js'), '§8 names the shared checker');