✨ kettle-jem: security floors from kettle-rb; drop dead appraisal helpers

[pboling]

Why

Follow-ups from GEMSPEC_DEV_DEPENDENCY_PLAN.md (P4.4 bugs) now that kettle-rb 0.1.14 publishes security floors:

• B7: kettle-jem carried a dead copy of kettle-jem-appraisals' matrix selection code. The appraisal_* helpers had no callers in any SM gem or in kettle-jem-appraisals, and their semver rules had drifted from the plugin's.
• B8: the sqlite3 KNOWN_GEM_CONFLICT_RESOLUTIONS reason said sqlite3 has "no modular home". kettle-jem-appraisals now generates gemfiles/modular/activerecord_support/*.gemfile for it.
• Floors in templating: workflows.framework_matrix gemfiles were written as gem "activerecord", "~> 7.1.0", which drops security floors.

Policy for series with no fixed release (decided by the maintainer): warn.

What

• Removed (B7):
  • 44 dead appraisal_* methods (540 lines) and the 6 APPRAISAL_* constants used only by them.
  • The 6 integration examples that exercised only that code.
  • The RubyGemsResolver and GemSpecReader examples stay; kettle-jem-appraisals uses both.
  • Removal was scripted with guards: every removed def had to be appraisal_*, there could be no visibility change inside the block, and no call site could remain.
• Framework matrix floors:
  • For gems tracked by Kettle::Rb::GemFloors (activemodel, activerecord, activesupport, sqlite3), a version whose requirement still admits the series' first release gets the floor: gem "activerecord", "~> 7.1.0", ">= 7.1.6".
  • Explicit requirements that already exclude it (~> 7.2.3) and labels that aren't a minor series (8.0+) are left alone.
  • When no release in the series fixes an advisory, the gemfile gets a # kettle-rb: no activerecord 7.0 release fixes … comment.
  • Untracked gems (e.g. rails) are unchanged.
• B8: the sqlite3 reason now points at a platforms: [:ruby] modular gemfile, such as kettle-jem-appraisals' support gemfiles. The (engine-incompatible; no modular home) decision placeholder is unchanged, so recorded decisions still match.
• kettle-rb: requires >= 0.1.14. Gemfile.lock was updated with bundle lock --update kettle-rb, using the env the committed lock is generated with; the diff is only the kettle-rb lines.

Verification

• Default bundle exec rake in gems/kettle-jem (the env the committed lock uses: STRUCTUREDMERGE_DEV=.../gems, K_JEM_TEMPLATING=true, KETTLE_DEV_DEV=false, coverage minimums from mise.toml): RuboCop Gradual no changes; 681 examples, 1 failure.
  • The one failure, spec/e2e/rubygems_thin_vertical_slice_spec.rb, reads ../fixtures/packaging/thin-slice-contract.json next to the repo root. My worktree had no sibling fixtures/ checkout, and a clean origin/main worktree fails the same way. With the fixtures checkout linked, it passes (1 example, 0 failures).
• New framework-matrix floors example (activerecord 7.0 floor + CVE comment, 7.1 floor, ~> 7.2.3 and 8.0+ untouched) passes along with the existing framework-matrix, appraisal and bootstrap integration specs.
• Also fixes Bundler/DuplicatedGem, introduced by 👷 Validate the Rust host bridge in CI: guards, published gem, and dep-heads #68, in all 12 Gemfiles that carry the Rust host switch:
  • Gems: ast-crispr, ast-merge-git, ast-template, bash-merge, go-merge, json-merge, kettle-jem, markdown-merge, rust-merge, tree_haver, typescript-merge, yaml-merge.
  • The two separate gem "structuredmerge_host_prototype" declarations are now one if/elsif: the local path when STRUCTUREDMERGE_RUST_DEV is set, otherwise the published gem when STRUCTUREDMERGE_RUST_HOST_PUBLISHED=true. There is no more instance_variable_get check.
  • Evaluating the Gemfile with Bundler::Dsl under each env combination (neither / dev / published / both) gives 0 / path / ~> 0.2 / path declarations, exactly once each, which matches the previous behavior.
  • The rewrite was scripted, and each Gemfile had to match the expected two-block shape exactly once.
  • None of the gems' gradual locks recorded the duplicate, so no lock changes were needed.
  • ast-crispr's gradual check still reports offenses in lib/ast/crispr/rust_host_provider.rb and its spec. Those were already failing on main (from 2026-09-11) and are not touched here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P8aveNcdgPobyMrq8DkD9r