@bongos/core 1.21.177 → 1.21.178

package/tests/bump_version.mjs

@@ -22,7 +22,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 const bump = require(path.join(ROOT, 'scripts', 'bongos', 'bump-version.js'));
-const { bumpPatch, CONST_RE } = bump;
+const { bumpPatch, nextFreePatch, registryVersions, CONST_RE } = bump;
 // The LIVE test below reads this repo's real release history (task 1003202).
 const { execFileSync } = require('node:child_process');
 
@@ -217,25 +217,59 @@ test('the push to main happens exactly once, and not inside the bump step', () =
   assert.ok(bumpStep.includes('git commit -m'), 'the bump step still commits locally — package-core stamps the version found AT the ref');
 });
 
-test('an already-published version is success, not a wedge', () => {
-  // Publish-then-failed-push leaves a version on npm with no release commit.
-  // The next run reads it as free (laneReleasedVersions is git-based), bumps to
-  // it, and npm refuses the duplicate. Without this branch that run fails, and
-  // so does every run after it — the lane wedges with no way out but a human.
+test('an already-published version FAILS the publish and records nothing (task 1004886)', () => {
+  // Task 1003914 made a duplicate-version refusal count as success and fell through to
+  // the record step. But a version is left unrecorded only when its record push lost a
+  // race to a MOVED main, so the registry's copy is never this run's tree: on
+  // 2026-10-25 that recorded 1.21.175 on main for a tree npm's 1.21.175 (2026-10-23)
+  // never held. The refusal must now fail the step, which skips the record step.
   const pubAt = PUBLISH_YML.indexOf('id: pub');
   assert.ok(pubAt !== -1, 'the publish step must carry id: pub');
-  const pubStep = PUBLISH_YML.slice(pubAt, PUBLISH_YML.indexOf('\n      # PUBLISH VERDICT'));
-  assert.match(
-    pubStep,
-    /cannot publish over\|previously published\|EPUBLISHCONFLICT/,
-    'the publish step must recognise npm refusing a duplicate version',
-  );
-  assert.match(pubStep, /already=true/, 'and must record that it took the already-present branch');
-  assert.match(
-    pubStep,
-    /exit "\$RC"/,
-    'every OTHER publish failure must still fail the step — the tolerance is narrow on purpose',
-  );
+  const pubStep = PUBLISH_YML.slice(pubAt, PUBLISH_YML.indexOf('\n      # THE ONLY IRREVERSIBLE STEP'));
+  assert.match(pubStep, /cannot publish over\|previously published\|EPUBLISHCONFLICT/,
+    'the publish step still recognises npm refusing a duplicate — to say so plainly');
+  assert.doesNotMatch(pubStep, /already=true/, 'no already-present success branch');
+  // After a non-zero npm publish, the only way out is `exit "$RC"`: the duplicate
+  // branch must not be able to reach the "published" line.
+  const failAt = pubStep.indexOf('if [ "$RC" -ne 0 ]; then');
+  const failBlock = pubStep.slice(failAt, pubStep.indexOf('\n          fi\n          echo "published', failAt));
+  assert.ok(failAt !== -1 && failBlock.trimEnd().endsWith('exit "$RC"'), 'every publish failure, the duplicate included, exits non-zero');
+  const recAt = PUBLISH_YML.indexOf('- name: Record the release on main');
+  const recIf = PUBLISH_YML.slice(recAt, PUBLISH_YML.indexOf('\n        run:', recAt));
+  assert.doesNotMatch(recIf, /always\(\)|failure\(\)/, 'the record step must not run after a failed publish');
+  const verdict = PUBLISH_YML.slice(PUBLISH_YML.indexOf('# PUBLISH VERDICT'));
+  assert.doesNotMatch(verdict.slice(0, 1500), /ALREADY PRESENT/, 'the verdict no longer reports a recorded duplicate');
+});
+
+test('the registry listing is read and every listed version is skipped by the bump (task 1004886)', () => {
+  const verAt = PUBLISH_YML.indexOf('id: ver');
+  const verStep = PUBLISH_YML.slice(verAt, PUBLISH_YML.indexOf('\n      - name:', verAt));
+  assert.match(verStep, /npm view @bongos\/core versions --json > "\$TAKEN_FILE"/, 'the resolve step reads the registry listing');
+  assert.match(verStep, /registryVersions\(.*\)\.has\(process\.argv\[2\]\) \? 0 : 1\)" "\$TAKEN_FILE" "\$HEAD_V"; then\s+TAKEN=true/,
+    'a HEAD version already on the registry counts as taken, so it is bumped past');
+  assert.match(verStep, /echo '\[\]' > "\$TAKEN_FILE"/, 'an unreadable listing degrades to git-only, it does not stop the lane');
+  assert.match(verStep, /taken_file=/, 'the listing is handed on');
+  const bumpAt = PUBLISH_YML.indexOf('id: bump');
+  const bumpStep = PUBLISH_YML.slice(bumpAt, PUBLISH_YML.indexOf('\n      - name:', bumpAt));
+  assert.match(bumpStep, /bump-version\.js --apply .*--taken-file "\$\{\{ steps\.ver\.outputs\.taken_file \}\}"/, 'the bump skips the listed versions');
+});
+
+test('bumpPatch skips every taken version (task 1004886)', () => {
+  const src = "const CORE_VERSION = '1.21.174'; // x\n";
+  assert.equal(bumpPatch(src).to, '1.21.175', 'nothing taken → the next patch, as before');
+  assert.equal(bumpPatch(src, { taken: new Set(['1.21.175']) }).to, '1.21.176', 'the 2026-10-25 shape: 1.21.175 is on npm with an older tree');
+  assert.equal(bumpPatch(src, { taken: new Set(['1.21.175', '1.21.176', '1.21.178']) }).to, '1.21.177', 'the first free patch, not the highest');
+  assert.equal(bumpPatch(src, { taken: new Set(['1.22.0', '1.21.174']) }).to, '1.21.175', 'other minors and the current version do not matter');
+  assert.match(bumpPatch(src, { taken: new Set(['1.21.175']) }).text, /^const CORE_VERSION = '1\.21\.176';/m, 'the literal carries the skipped-to version');
+  assert.throws(() => nextFreePatch(1, 0, 0, { has: () => true }), /no free patch/, 'a taken-list that covers everything throws, never spins');
+});
+
+test('registryVersions parses npm view output and drops anything that is not x.y.z', () => {
+  assert.deepEqual([...registryVersions('["1.21.174","1.21.175"]')], ['1.21.174', '1.21.175']);
+  assert.deepEqual([...registryVersions('"1.0.0"')], ['1.0.0'], 'npm prints a bare string when one version exists');
+  assert.deepEqual([...registryVersions('["1.2.3","1.2.4-rc.1","x; rm -rf",7]')], ['1.2.3']);
+  assert.equal(registryVersions('not json').size, 0);
+  assert.equal(registryVersions('').size, 0);
 });
 
 test('the record step gates on a bump actually having been made', () => {

package/tests/copy_desk_flags_db.mjs

@@ -26,15 +26,17 @@
 //
 // Run:  DATABASE_URL=postgres://... node tests/copy_desk_flags_db.mjs
 //
-// It creates its OWN minimal `builders`/`tasks` stand-ins if they are absent, so
-// it works against a throwaway container as well as a full migrated database, and
-// it cleans up every row it writes.
+// It needs a MIGRATED database (scripts/migrate.sh), the one the integration lane
+// builds. It once created its own minimal `builders`/`tasks` stand-ins; those drifted
+// from the real schema (builders.github_id became NOT NULL) and hid it, so they are
+// gone (task 1004863). It cleans up every row it writes.
 
 import { createRequire } from 'node:module';
 import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { insertTestBuilders } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
@@ -58,21 +60,19 @@ async function test(name, fn) {
 }
 
 // --- fixtures -------------------------------------------------------------
-// Minimal stand-ins ONLY if the real tables are absent (throwaway container).
-// Against a fully migrated DB these are no-ops and the real tables are used.
-await pool.query(`
-  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
-  CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text, display_name text);
-  CREATE TABLE IF NOT EXISTS tasks (id bigserial PRIMARY KEY);
-`);
-
 // Two throwaway builders + one task, at ids far above any real row.
 const A = 900000001;
 const B = 900000002;
 const T = 900000003;
-await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES ($1,$2,$3),($4,$5,$6) ON CONFLICT (id) DO NOTHING',
-  [A, 'cdtest-a', 'Copy Desk Test A', B, 'cdtest-b', 'Copy Desk Test B']);
-await pool.query('INSERT INTO tasks (id) VALUES ($1) ON CONFLICT (id) DO NOTHING', [T]);
+await insertTestBuilders(pool, [
+  { id: A, login: 'cdtest-a', display_name: 'Copy Desk Test A' },
+  { id: B, login: 'cdtest-b', display_name: 'Copy Desk Test B' },
+]);
+// The task needs a version (tasks.version_id is NOT NULL). Its own row, at status
+// 'building': the seeds own the one 'planning' version the partial index allows.
+const VER = 'ZZZ-CDF';
+await pool.query("INSERT INTO versions (id, name, status) VALUES ($1, 'copy desk fixture', 'building') ON CONFLICT (id) DO NOTHING", [VER]);
+await pool.query("INSERT INTO tasks (id, version_id, title, discipline) VALUES ($1, $2, 'copy desk fixture', 'engineer') ON CONFLICT (id) DO NOTHING", [T, VER]);
 
 // Apply the migration verbatim — this also proves it is idempotent, since a
 // migrated DB has already run it.
@@ -248,6 +248,12 @@ await test('closeFlag returns null on a second call — the route answers 409 fr
 // --- page asks (task 1004317 / TW06, copy_desk_002) -----------------------
 // A page ask's surface IS its page id, so these use SURF as the page id and the
 // cleanup above still catches every row.
+//
+// The section starts from no rows (task 1004863): the string-flag cases above leave
+// open flags on SURF (some with a null string_id), and the one-open-per-target index
+// keys on (flagged_by, surface, string_id) — so a page ask by the same builder on the
+// same surface collided with them rather than testing anything about page asks.
+await clean();
 console.log('copy_desk_flags — page asks (copy_desk_002)');
 
 const pageIns = (o = {}) => pool.query(
@@ -299,6 +305,8 @@ await test('pageAskSummary groups open asks by page: distinct askers, the oldest
 
 // --- cleanup --------------------------------------------------------------
 await clean();
+await pool.query('DELETE FROM tasks WHERE id = $1', [T]).catch(() => {});
+await pool.query('DELETE FROM versions WHERE id = $1', [VER]).catch(() => {});
 await pool.query('DELETE FROM builders WHERE id = ANY($1)', [[A, B]]).catch(() => {});
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/gating_review_retired.mjs

@@ -43,7 +43,7 @@ test('cmdOn normalizes BOTH restore paths — a pre-retirement snapshot cannot r
 
 test('the CODEOWNERS file is gone; its GLOB guards remain where they enforce', () => {
   assert.ok(!fs.existsSync(path.join(ROOT, 'CODEOWNERS')), 'CODEOWNERS must not exist (ADR 0162)');
-  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'), 'utf8');
+  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'), 'utf8');
   assert.match(gateReview, /'CODEOWNERS'/, 'the HARD_FLOOR glob stays — reintroducing the file is itself gate-flagged');
 });
 

package/tests/government_act_alone_buildings.mjs

@@ -68,7 +68,7 @@ async function withPort(port, fn) {
 // The port the routers below are driven through (section 3); restored after
 // each gate test swaps in its own.
 const ATOMS = [
-  'autonomy.fence.manage', 'criterion.satisfy', 'criterion.unsatisfy', 'gate_approval.decide', 'override_request.decide',
+  'autonomy.fence.manage', 'criterion.satisfy', 'criterion.unsatisfy', 'override_request.decide',
   'core.pin.move', 'builder.budget.set', 'goal.create', 'goal.reorder', 'version.focus.set', 'project.settings.manage',
   'security.report.adjudicate', 'access_request.review', 'government.manage',
 ];
@@ -211,7 +211,6 @@ app.use(attachFail);
 for (const rel of [
   'modules/autonomy/routes/autonomy.js',
   'modules/lifecycle/routes/done-when.js',
-  'modules/lifecycle/routes/gate-approvals.js',
   'modules/lifecycle/routes/tasks.js',
   'modules/lifecycle/routes/goals.js',
   'modules/lifecycle/routes/versions.js',
@@ -264,7 +263,6 @@ const REQUESTS = {
   'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
   'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
   'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
-  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
   'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
   'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
   'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],

package/tests/government_board_membership_db.mjs

@@ -26,6 +26,7 @@
 // ids far above any real row, and deletes them at the end.
 
 import pg from 'pg';
+import { insertTestBuilders } from './helpers.mjs';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
@@ -45,38 +46,48 @@ async function t(name, fn) {
 }
 const assert = (await import('node:assert')).strict;
 
-// Minimal stand-ins ONLY when the real tables are absent (throwaway container);
-// against a migrated database these are no-ops and the real tables are used.
-await pool.query(`
-  CREATE TABLE IF NOT EXISTS builders (
-    id bigserial PRIMARY KEY, github_login text, display_name text,
-    status text DEFAULT 'active', system_role text);
-  CREATE TABLE IF NOT EXISTS government_builder_ranks (
-    builder_id bigint, rank_key text);
-`);
+// Needs a MIGRATED database (the integration lane's). The stand-in tables this once
+// created when the real ones were absent drifted from the schema (builders.github_id
+// became NOT NULL) and are gone (task 1004863); the builder rows go through the shared
+// helper so the next required column is added in one place.
+
+// ONE TRANSACTION, ALWAYS ROLLED BACK (task 1004863). The machine principal below needs a
+// real system_role, and system_role is UNIQUE with only two legal values — both held by
+// the seeded system builders on any migrated database. So the fixture releases the seeded
+// 'bfg' role inside this transaction, gives it to its own throwaway machine, and the
+// rollback restores everything. The library under test is pointed at the same client, so
+// it reads exactly the rows the fixture wrote.
+const db = await pool.connect();
+await db.query('BEGIN');
+await db.query("UPDATE builders SET system_role = NULL WHERE system_role = 'bfg'");
 
 // Ids far above any real row, and every login prefixed, so cleanup is exact and
 // this can never touch a real builder or a real rank assignment.
 const B = 990000000;
 const ID = { xenos: B + 1, thetes: B + 2, metic: B + 3, archon: B + 4, gone: B + 5, bot: B + 6, ops: B + 7 };
 const cleanup = async () => {
-  await pool.query('DELETE FROM government_builder_ranks WHERE builder_id >= $1', [B]);
-  await pool.query('DELETE FROM builders WHERE id >= $1', [B]);
+  await db.query('DELETE FROM government_builder_ranks WHERE builder_id >= $1', [B]);
+  await db.query('DELETE FROM builders WHERE id >= $1', [B]);
 };
 await cleanup();
-await pool.query(`INSERT INTO builders (id, github_login, display_name, status, system_role) VALUES
-  ($1,'gbmdb-x','Xenos','active',NULL),($2,'gbmdb-t','Thetes','active',NULL),
-  ($3,'gbmdb-m','Metic','active',NULL),($4,'gbmdb-a','Archon','active',NULL),
-  ($5,'gbmdb-gone','Deactivated Archon','inactive',NULL),
-  ($6,'gbmdb-bot','A Machine','active','bfg'),
-  ($7,'gbmdb-ops','Custom Ops','active',NULL)`,
-[ID.xenos, ID.thetes, ID.metic, ID.archon, ID.gone, ID.bot, ID.ops]);
-await pool.query(`INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES
+await insertTestBuilders(db, [
+  { id: ID.xenos, login: 'gbmdb-x', display_name: 'Xenos', status: 'active', system_role: null },
+  { id: ID.thetes, login: 'gbmdb-t', display_name: 'Thetes', status: 'active', system_role: null },
+  { id: ID.metic, login: 'gbmdb-m', display_name: 'Metic', status: 'active', system_role: null },
+  { id: ID.archon, login: 'gbmdb-a', display_name: 'Archon', status: 'active', system_role: null },
+  { id: ID.gone, login: 'gbmdb-gone', display_name: 'Deactivated Archon', status: 'inactive', system_role: null },
+  { id: ID.bot, login: 'gbmdb-bot', display_name: 'A Machine', status: 'active', system_role: 'bfg' },
+  { id: ID.ops, login: 'gbmdb-ops', display_name: 'Custom Ops', status: 'active', system_role: null },
+], { onConflict: '' });
+// The custom rank is a real government_ranks row: government_builder_ranks.rank_key is a
+// foreign key into it on a migrated database.
+await db.query("INSERT INTO government_ranks (rank_key, label) VALUES ('gbmdb-ops-rank', 'Custom Ops (test)')");
+await db.query(`INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES
   ($1,'xenos'),($2,'thetes'),($3,'metic'),($4,'archon'),($5,'archon'),($6,'archon'),($7,'gbmdb-ops-rank')`,
 [ID.xenos, ID.thetes, ID.metic, ID.archon, ID.gone, ID.bot, ID.ops]);
 
 const api = require(process.cwd() + '/src/module-api.js');
-api.pool.query = (...a) => pool.query(...a);
+api.pool.query = (...a) => db.query(...a);   // the library reads through the same transaction
 const { resolveBoardMembers, isBoardMember } = require(process.cwd() + '/modules/government/board-membership.js');
 
 const board = (membership) => ({ membership, pass_rule: 'consent', window_minutes: null, close_early_on_full_turnout: true });
@@ -120,13 +131,13 @@ await t('the deactivated and the machine are STILL excluded under the widened fo
 });
 
 await t('no duplicate rows when a builder matches through two keys', async () => {
-  await pool.query('INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES ($1, $2)', [ID.archon, 'gbmdb-ops-rank']);
+  await db.query('INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES ($1, $2)', [ID.archon, 'gbmdb-ops-rank']);
   try {
     const l = await logins('rank:archon,gbmdb-ops-rank');
     assert.deepEqual(l.filter((x) => x === 'a').length, 1,
       'DISTINCT holds — a double-counted member silently raises the consent bar');
   } finally {
-    await pool.query("DELETE FROM government_builder_ranks WHERE builder_id=$1 AND rank_key='gbmdb-ops-rank'", [ID.archon]);
+    await db.query("DELETE FROM government_builder_ranks WHERE builder_id=$1 AND rank_key='gbmdb-ops-rank'", [ID.archon]);
   }
 });
 
@@ -145,6 +156,8 @@ await t('an unparseable predicate still seats nobody against a real db', async (
 });
 
 await cleanup();
+await db.query('ROLLBACK');
+db.release();
 console.log(`\n${passed} passed, ${failed} failed`);
 await pool.end();
 process.exit(failed ? 1 : 0);

package/tests/government_protected_surfaces.mjs

@@ -126,6 +126,16 @@ function carve(parent, names, why) {
 }
 
 const ADDED_SINCE_R101 = [
+  // task 1004859: the hard-floor list moved out of gate-review.js (retired below) into
+  // its own file, which keeps the self-protection gate-review.js had. Anchored on the
+  // retired entry so it lands where the list used to live.
+  {
+    after: 'scripts/bongos/gate-review.js',
+    glob: 'scripts/bongos/hard-floor.js',
+    why: 'the trust-boundary hard-floor list, moved out of the removed gate-review.js; '
+       + 'publish-manifest.js and adopt-preflight.js read it, so an edit here changes what '
+       + 'the public mirror withholds and what an adopted repo is warned about.',
+  },
   // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
   // execution roots the merge resolver runs out of a cloned branch. The audit named four
   // of them ("the three gen-* scripts and .gitattributes"); modules/lifecycle/executed-
@@ -330,6 +340,12 @@ const RENAMED_SINCE_R101 = [
 // protection from code that still runs. Applied LAST, after renames and additions,
 // so an addition anchored on a retired entry still resolves.
 const RETIRED_SINCE_R101 = [
+  ...['gate-review.js', 'ci-grade.js'].map((f) => ({
+    glob: `scripts/bongos/${f}`,
+    why: 'task 1004859 deleted the two drivers of the planned gate-review and grade-gate '
+       + 'CI checks (ADR 0058). No workflow ever ran them and branch protection requires '
+       + 'only the unit check; the hard-floor list gate-review.js held moved to hard-floor.js.',
+  })),
   ...['boxes.js', 'box-access.js', 'box-credential.js'].map((f) => ({
     glob: `modules/dev-box/${f}`,
     why: 'task 1003892 (goal 1000120) deleted the dev-box module outright — the rank floor '
@@ -446,7 +462,7 @@ test('every glob added since R101 carries a documented reason', () => {
 // floor-gating ordinary source at Metic — src/bongos/logger.js, src/branding.js and
 // src/build-info.js are all in the closure — and locking newcomers out of routine work.
 // The entrypoints are different in kind: they exist ONLY to be executed by the pipeline,
-// which is exactly what group 'pipeline' already means for ship.js and gate-review.js.
+// which is exactly what group 'pipeline' already means for ship.js and hard-floor.js.
 test('every execution root in the closure is a protected surface (MIT1 drift tripwire)', () => {
   const ec = require(path.join(ROOT, 'modules', 'lifecycle', 'executed-closure.js'));
   // ENTRYPOINTS lists both script-tree spellings across the C-series rename window; only
@@ -657,10 +673,10 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
   }
 });
 
-// ---------- the hard-floor subset: gate-review's second list may narrow, never diverge ----------
+// ---------- the hard-floor subset: the second list may narrow, never diverge ----------
 //
 // task 1002875, from idea 1000620 (raised as a major by the BV1.R101 ship grader).
-// scripts/bongos/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
+// scripts/bongos/hard-floor.js (gate-review.js until task 1004859) keeps HARD_FLOOR_GLOBS — the rank-INDEPENDENT
 // escalate-to-owner set — and the comment above it declares the array to be "A subset of
 // PROTECTED_GLOBS". That was a checkable invariant stated in prose and enforced by nothing.
 //
@@ -673,13 +689,13 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
 //
 // Checked at BOTH altitudes on purpose. The source literal is what a reviewer reads and
 // what the decision asked be parsed; the exported array is what compileGlobMatcher actually
-// compiles at gate-review.js:102. Asserting they agree means a future refactor that
+// compiles in hard-floor.js. Asserting they agree means a future refactor that
 // computes or filters the list cannot leave the visible source saying one thing while the
 // gate enforces another.
 function hardFloorGlobsFromSource() {
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'), 'utf8');
   const block = src.match(/const HARD_FLOOR_GLOBS = \[([\s\S]*?)\n\];/);
-  assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in gate-review.js — '
+  assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in hard-floor.js — '
     + 'if it was renamed or restructured, this test must be taught the new shape rather '
     + 'than deleted: it is the only thing holding the declared subset honest.');
   return [...block[1].matchAll(/'([^']+)'/g)].map((m) => m[1]);
@@ -688,21 +704,21 @@ function hardFloorGlobsFromSource() {
 test('every hard-floor glob is a protected surface (1002875 subset tripwire)', () => {
   const fromSource = hardFloorGlobsFromSource();
   assert.ok(fromSource.length >= 20,
-    `fixture sanity: parsed ${fromSource.length} hard-floor globs out of gate-review.js, `
+    `fixture sanity: parsed ${fromSource.length} hard-floor globs out of hard-floor.js, `
     + 'and the array has held about two dozen since it was written. A parse that returns '
     + 'few or none passes the subset check vacuously.');
 
-  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'));
   assert.deepEqual(fromSource, gr.HARD_FLOOR_GLOBS,
-    'the HARD_FLOOR_GLOBS literal in gate-review.js no longer matches the array the module '
+    'the HARD_FLOOR_GLOBS literal in hard-floor.js no longer matches the array the module '
     + 'exports and compiles into its matcher. The source and the enforced list must be the '
     + 'same thing, or a reviewer reading the file is reading a list the gate does not use.');
 
   const registry = new Set(ppc.PROTECTED_GLOBS);
   for (const glob of gr.HARD_FLOOR_GLOBS) {
     assert.ok(registry.has(glob),
-      `'${glob}' is a HARD FLOOR surface in scripts/bongos/gate-review.js — CI escalates any `
-      + 'edit to it to the owner regardless of rank — but it is not in '
+      `'${glob}' is a HARD FLOOR surface in scripts/bongos/hard-floor.js — a trust-boundary path `
+      + 'whatever the author\'s rank — but it is not in '
       + 'modules/government/protected-surfaces.json, so no rank floor covers it at all. '
       + 'The hard floor is declared to be a SUBSET of the protected set: it may be '
       + 'narrower (most protected paths are ordinary Metic work and should not ping the '
@@ -1290,8 +1306,8 @@ test('compileGlobMatcher folds BOTH sides', () => {
   assert.ok(!m(null), 'nor is a missing path');
 });
 
-test('gate-review classifies a CASE-VARIANT gate surface as hard-floor', () => {
-  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
+test('the hard-floor matcher folds a CASE-VARIANT gate surface', () => {
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'));
   const literal = gr.HARD_FLOOR_GLOBS.find((g) => !g.includes('*') && !g.endsWith('/'));
   assert.ok(literal, 'no literal hard-floor glob — this test is reading the wrong shape');
   assert.ok(gr.matchesHardFloor(literal), 'the exact spelling must escalate (sanity)');

package/tests/governor_docket.mjs

@@ -510,7 +510,6 @@ test('each contributed source gates on EXACTLY the atom its own list route requi
   const factories = [
     'modules/ideas/routes/blockers.js',
     'modules/lifecycle/routes/lifecycle.js',
-    'modules/lifecycle/routes/gate-approvals.js',
     'modules/onboarding/routes/access-requests.js',
     'modules/security/routes/reports.js',
     'modules/autonomy/routes/autonomy.js',
@@ -528,7 +527,6 @@ test('each contributed source gates on EXACTLY the atom its own list route requi
     override_requests: ['modules/lifecycle/routes/tasks.js', 'GET /override-requests'],
     removal_proposals: ['modules/lifecycle/routes/removal-proposals.js', 'GET /removal-proposals'],
     criteria_uat: ['modules/lifecycle/routes/done-when.js', 'GET /done-when/pending-review'],
-    gate_approvals: ['modules/lifecycle/routes/gate-approvals.js', 'GET /gate-approvals'],
     access_requests: ['modules/onboarding/routes/access-requests.js', 'GET /access-requests'],
     redteam_reports: ['modules/security/routes/reports.js', 'GET /security/reports'],
     core_update: ['src/bongos/routes/core-update.js', 'GET /core-update'],

package/tests/governor_matter_acts.mjs

@@ -24,7 +24,6 @@ const lifeActs = require(path.join(ROOT, 'modules', 'lifecycle', 'matter-acts.js
 const lifeDb = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
 const doneWhen = require(path.join(ROOT, 'modules', 'lifecycle', 'done-when.js'));
 const doneWhenRoutes = require(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'done-when.js'));
-const gateRoutes = require(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'gate-approvals.js'));
 const lifeDocket = require(path.join(ROOT, 'modules', 'lifecycle', 'governor-docket.js'));
 const buildersRoute = require(path.join(ROOT, 'src', 'bongos', 'routes', 'builders.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
@@ -47,7 +46,6 @@ test('each building\'s act is checked strictly when the matter is opened: shape,
   const v = decisionBoard.validateMatterAction;
   assert.deepEqual(v('automation', { type: 'switch_on' }), { ok: true, action: { type: 'switch_on' } });
   assert.deepEqual(v('automation', { type: 'allow_goal', goal_id: '12' }).action, { type: 'allow_goal', goal_id: 12 });
-  assert.deepEqual(v('release', { type: 'approve_gate', pr: 1500 }).action, { type: 'approve_gate', pr: 1500 });
   assert.deepEqual(v('release', { type: 'approve_override', request_id: 4 }).action, { type: 'approve_override', request_id: 4 });
   assert.deepEqual(v('review', { type: 'satisfy_criterion', criterion_id: 9 }).action, { type: 'satisfy_criterion', criterion_id: 9 });
   assert.deepEqual(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: 50 }).action, { type: 'set_budget', builder_id: 7, monthly_usd: 50 });
@@ -58,6 +56,8 @@ test('each building\'s act is checked strictly when the matter is opened: shape,
   assert.equal(v('automation', { type: 'satisfy_criterion', criterion_id: 9 }).reason, 'bad_action', 'an act from another building');
   assert.equal(v('automation', { type: 'switch_on', goal_id: 3 }).reason, 'unknown_field');
   assert.equal(v('automation', { type: 'allow_goal' }).field, 'action.goal_id');
+  // task 1004859 removed the gate-approval route, so Release no longer carries an act for it
+  assert.equal(v('release', { type: 'approve_gate', pr: 1500 }).reason, 'bad_action', 'the retired gate act is refused');
   assert.equal(v('automation', { type: 'allow_goal', goal_id: 0 }).reason, 'bad_action');
   assert.equal(v('automation', { type: 'allow_goal', goal_id: true }).reason, 'bad_action');
   assert.equal(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: -1 }).reason, 'bad_action');
@@ -161,7 +161,7 @@ test('a passed Review matter signs the criterion off by override, once', async (
   assert.match(signed[0].reason, /passed Review matter/);
 });
 
-test('a passed Release matter approves an override or clears a gate; a request already decided is said, not thrown', async () => {
+test('a passed Release matter approves an override; a request already decided is said, not thrown', async () => {
   const calls = [];
   await stub(lifeDb, {
     decideOverrideRequest: async (a) => {
@@ -169,14 +169,12 @@ test('a passed Release matter approves an override or clears a gate; a request a
       if (a.requestId === 5) throw Object.assign(new Error('closed'), { code: 'REQUEST_NOT_OPEN' });
       return {};
     },
-  }, () => stub(gateRoutes, { approveGatePr: async (a) => { calls.push(['gate', a]); return a.number === 2 ? { ok: false, code: 'pr_not_open' } : { ok: true, body: {} }; } }, async () => {
+  }, async () => {
     assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_override', request_id: 4 } })).out.acted.done, true);
     assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_override', request_id: 5 } })).out.acted.reason, 'request_not_open');
-    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_gate', pr: 1500 } })).out.acted.done, true);
-    assert.equal((await closeMatter({ area: 'release', action: { type: 'approve_gate', pr: 2 } })).out.acted.reason, 'pr_not_open');
-  }));
+  });
   assert.deepEqual(calls[0], ['override', { requestId: 4, archonId: '42', decision: 'approve', note: 'A passed Release matter (matter 8) decided it.' }]);
-  assert.equal(calls[2][1].number, 1500);
+  assert.equal(calls.length, 2);
 });
 
 test('a passed Treasury matter sets the limit through the same write as PATCH /builders/:id/budget', async () => {

package/tests/hall_city.mjs

@@ -384,7 +384,7 @@ const FEEDS = (ms, goals = [goal(1)], rollups = [rollup(1, { done: 2, active: 1
 
 test('the page reads the three feeds and draws the docket\'s pins and line', async () => {
   const soon = new Date(Date.now() + 2 * 3600000).toISOString();
-  const ms = [matter({ id: 'board:1', building: 'charter', state: 'needs', deadline: soon }), matter({ id: 'blockers:2', state: 'needs' }), matter({ id: 'blockers:4', state: 'moving' }), matter({ id: 'gate_approvals:3', building: 'release', state: 'moving' }), matter({ id: 'removal_proposals:5', building: 'disputes', state: 'settled' })];
+  const ms = [matter({ id: 'board:1', building: 'charter', state: 'needs', deadline: soon }), matter({ id: 'blockers:2', state: 'needs' }), matter({ id: 'blockers:4', state: 'moving' }), matter({ id: 'override_requests:3', building: 'release', state: 'moving' }), matter({ id: 'removal_proposals:5', building: 'disputes', state: 'settled' })];
   const p = await bootPage({ feeds: FEEDS(ms) });
   assert.deepEqual([...p.calls].sort(), ['/api/bongos/goals', '/api/bongos/goals/rollups', '/api/bongos/government/docket']);
   const pins = p.byId.get('cityPins').children;

package/tests/hall_matter_card.mjs

@@ -182,8 +182,9 @@ test('every act maps to the route that does it, with the body that route accepts
   const ov = card([{ id: 'override_requests:9', source: 'override_requests', building: 'release', state: 'needs', title: 'Release', ref: { type: 'override_request', id: '9' } }], 'override_requests:9');
   assert.deepEqual(C.request(ov, 'release'), { method: 'POST', url: '/api/bongos/override-requests/9/decide', body: { decision: 'approve' } });
   assert.equal(C.request(ov, 'hold'), null, 'holding records nothing');
+  // task 1004859 removed POST /gate-approvals/:pr/approve: a stale gate matter must send nothing
   const gate = card([{ id: 'gate_approvals:812', source: 'gate_approvals', building: 'release', state: 'needs', title: 'A PR', ref: { type: 'pull_request', id: 812 } }], 'gate_approvals:812');
-  assert.deepEqual(C.request(gate, 'release'), { method: 'POST', url: '/api/bongos/gate-approvals/812/approve', body: {} });
+  assert.equal(C.request(gate, 'release'), null, 'the retired gate route is never called');
 });
 
 // Task 1004559 moved the core update onto the Release desk, check first: the ONLY
@@ -406,7 +407,6 @@ const SOURCE_FIXTURES = () => {
     { id: 'redteam_reports:4', source: 'redteam_reports', building: 'disputes', rule: 'decide', state: 'needs', title: 'Security report: sign-in limit skipped', href: '/watch', ref: { type: 'vulnerability_report', id: '4' }, acts: [{ key: 'confirm' }, { key: 'dispute' }] },
     { id: 'criteria_uat:3', source: 'criteria_uat', building: 'review', rule: 'signoff', state: 'needs', title: 'The export runs nightly', href: '/goals#/goal/7', ref: { type: 'criterion', id: '3' }, acts: [{ key: 'signoff', options: [{ key: 'live', label: 'tested it live' }] }, { key: 'force', options: [{ key: 'tested_by_hand', label: 'tested by hand' }] }] },
     { id: 'core_update:1.21.20', source: 'core_update', building: 'release', rule: 'decide', state: 'needs', title: 'Take core 1.21.20 (running 1.21.19)', href: '/settings#software-update', ref: { type: 'core_version', id: '1.21.20' } },
-    { id: 'gate_approvals:88', source: 'gate_approvals', building: 'release', rule: 'decide', state: 'needs', title: 'PR 88 waits at the gate', href: '/gate', ref: { type: 'pull_request', id: '88' } },
     { id: 'autobongos_fence:project', source: 'autobongos_fence', building: 'automation', rule: 'decide', state: 'needs', title: 'Unattended building is off', href: '/autobongos', ref: { type: 'autonomy_fence', id: 'project' }, acts: [{ key: 'switch_on' }] },
     { id: 'module_rechecks:7', source: 'module_rechecks', building: 'release', rule: 'rule', state: 'needs', title: 'image-tools 1.2.0 failed its security check', href: '/modules', ref: { type: 'module_version', id: 'image-tools@1.2.0' }, acts: [{ key: 'recheck', options: [{ key: 'fixed', label: 'fixed since' }] }] },
     // task 1004712: a dry pot's borrow from the reserve

package/tests/hall_oversight_world.mjs

@@ -91,9 +91,9 @@ test('the shared confirm modal sits on --z-modal, closed by one hairline and no
   const modal = css.slice(css.indexOf('.ov-modal {'), css.indexOf('.ov-modal .scroll__h'));
   assert.ok(!/box-shadow/.test(modal), 'no shadow under the dialog');
   assert.match(modal, /border: var\(--line\) solid var\(--rule\)/, 'one rule hairline');
-  // task 1004829: the Gate's approve is the ask card now, and the card is its own
-  // confirmation, so the page opens no modal at all — and styles none.
-  assert.ok(!/ov-modal-bg/.test(read('gate.js')), 'gate.js opens no modal: the ask card is the confirmation');
+  // task 1004829 made the Gate's approve an ask card with no modal; task 1004859
+  // removed the approve altogether. The page still opens no modal — and styles none.
+  assert.ok(!/ov-modal-bg/.test(read('gate.js')), 'gate.js opens no modal');
   assert.ok(!/-modal-bg/.test(read('gate.css')), 'gate.css styles no modal of its own');
 });
 
@@ -303,15 +303,19 @@ test('a failed load on Watch and Sessions is said in the page body', () => {
   assert.match(read('sessions.html'), /id="ledger-status" role="status"/, 'the count and a failed page load sit on the ledger itself');
 });
 
-test('the Gate draws a held PR as the ask card only for a viewer the approve route admits', () => {
+test('the page at /gate is the Autobongos panel: no held-PR list, and a Metic is told the controls are the Archon\'s', () => {
+  // task 1004859 (owner, 2026-10-25: "Keep page, drop PR list"). The held-PR list
+  // waited on a gate-review CI check that never ran; its route is gone, so the page
+  // must not call it, and the URL stays /gate so bookmarks hold.
   const js = read('gate.js');
-  // the server's own answer, never a rank guess on the client
-  assert.match(js, /renderRow\(pr, resp\.viewer_may_approve === true\)/);
-  assert.match(js, /if \(mayApprove && !pr\.already_approved && window\.OTBAsk\)/);
-  assert.match(js, /q: `Let PR #\$\{pr\.number\} through\?`/, 'a question, not a label');
-  assert.match(js, /'data-act': 'approve'/);
-  assert.match(js, /Waiting for approval/, 'everyone else reads the facts as a plain row');
+  assert.ok(!/['\`]\/gate-approvals/.test(js), 'gate.js no longer calls the removed /gate-approvals routes');
+  assert.ok(!/renderRow\(pr|OTBAsk/.test(js), 'no held-PR row or ask card is drawn');
+  assert.match(js, /if \(rank !== 'archon'\) \{ showArchonOnly\(\); return; \}/, 'a Metic gets the note, not an empty page');
+  assert.match(js, /The Autobongos controls are for the \$\{rankLabel\('archon'\)\}/, 'the rank is named from the pack');
   const html = read('gate.html');
-  assert.ok(html.indexOf('hall-ask.js') > 0 && html.indexOf('hall-ask.js') < html.indexOf('gate.js?'), 'the card script loads before the page');
-  assert.match(html, /hall-ask\.css/);
+  assert.match(html, /<title>Autobongos — /, 'the page says what it is');
+  assert.match(html, /data-page-title="Autobongos"/);
+  assert.match(html, /id="gate-archon-only"/);
+  assert.ok(!/gate-list|hall-ask\.js/.test(html), 'the list mount and the ask-card script are gone');
+  assert.match(read('shell.js'), /\{ id: 'gate', label: 'Autobongos', icon: 'gate', href: '\/gate'/, 'the nav names it, at the same URL');
 });

package/tests/hall_street_desk.mjs

@@ -51,7 +51,7 @@ function board() {
 
 // ── a long-winded docket: every source, long words everywhere ─────────────────
 const LONG = 'The extraordinarily long-winded proposal to reorganise every single floor of the hall before winter';
-const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['gate_approvals', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
+const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
 function matter(over = {}) {
   return { id: 'blockers:1', source: 'blockers', building: 'planning', rule: 'majority', state: 'needs', title: 'A matter', short: 'a matter', where: 'Planning', opened_at: '2026-09-29T10:00:00.000Z', deadline: null, proposer: null, tally: null, href: null, ref: null, ...over };
 }
@@ -78,6 +78,9 @@ function longMatters() {
     }
   }
   out.push(matter({ id: 'board:900', source: 'board', building: 'planning', short: 'idea to ratify', title: LONG, state: 'needs' }));
+  // A second override waiting at Release: task 1004859 removed the gate-approval source that
+  // used to fill a Release floor, and the stress docket must still reach its 30 rows.
+  out.push(matter({ id: 'override_requests:901', source: 'override_requests', building: 'release', title: `${LONG} 901`, short: 'a matter with a very long short description', state: 'needs', ref: { id: 901 } }));
   return out;
 }
 const ROOM = { open: [{ id: '1', subject_type: 'constitutional_amendment', subject: { title: LONG, author_id: '7' }, votes: [] }, { id: '900', subject_type: 'full_idea', subject: { title: LONG }, votes: [] }], closed: [] };
@@ -176,7 +179,6 @@ test('a row\'s buttons are the card\'s acts under the board\'s words, and send t
     matter({ id: 'access_requests:11', source: 'access_requests', building: 'people', state: 'needs', proposer: { name: 'Ana Ruiz' }, ref: { id: 11 } }),
     matter({ id: 'goal_join_requests:12', source: 'goal_join_requests', building: 'people', state: 'needs', proposer: { name: 'Kai Mo' }, href: '/builders/goal/42', ref: { id: 12 } }),
     matter({ id: 'override_requests:13', source: 'override_requests', building: 'release', state: 'needs', ref: { id: 13 } }),
-    matter({ id: 'gate_approvals:14', source: 'gate_approvals', building: 'release', state: 'needs', ref: { id: 14 } }),
     matter({ id: 'board:1', source: 'board', building: 'charter', state: 'needs', ref: { type: 'board_item', id: '1' } }),
   ];
   const dk = docket(ms);
@@ -189,7 +191,6 @@ test('a row\'s buttons are the card\'s acts under the board\'s words, and send t
   const rel = D.rowsFor('release', 0, dk, { now: NOW });
   assert.deepEqual(rel[0].actions.map((a) => a.label), ['release', 'hold']);
   assert.equal(C.request(rel[0].card, 'release').url, '/api/bongos/override-requests/13/decide');
-  assert.equal(C.request(D.rowsFor('release', 5, dk, { now: NOW })[0].card, 'release').url, '/api/bongos/gate-approvals/14/approve');
   // a vote: yes and no, and the no's reason is a chip, never free text
   const vote = row('charter', 0);
   assert.deepEqual(vote.actions.map((a) => [a.key, a.label]), [['for', 'yes'], ['object', 'no']]);