@bongos/core 1.17.0

package/tests/asset_version.mjs

@@ -0,0 +1,94 @@
+// tests/asset_version.mjs
+//
+// Unit tests for the content-hash asset cache-busting (src/asset-version.js,
+// task #521). The property under test: a local css/js asset ref's ?v= query is
+// rewritten to a hash of the referenced file's CONTENT, so a content change
+// always changes the URL — and cross-origin / unknown / non-asset refs are left
+// untouched.
+//
+// Run:  node tests/asset_version.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { hashFile, stampHtml, buildStampedHtml } = require('../src/asset-version.js');
+
+let pass = 0;
+const ok = (label) => { console.log(`  ok - ${label}`); pass++; };
+
+// --- scratch dir with a couple of assets + an HTML page ---------------------
+const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'assetver-'));
+fs.writeFileSync(path.join(dir, 'app.js'), 'console.log("v1");\n');
+fs.writeFileSync(path.join(dir, 'style.css'), 'body{color:red}\n');
+const html = [
+  '<link rel="stylesheet" href="/builders/style.css?v=hand-typed-old">',
+  '<link rel="stylesheet" href="https://fonts.example.com/x.css?v=cdn">',
+  '<link rel="icon" href="data:image/svg+xml;utf8,<svg/>">',
+  '<script src="/builders/app.js?v=hand-typed-old" defer></script>',
+  '<script src="/builders/missing.js?v=keepme"></script>',
+].join('\n');
+
+// --- hashFile ---------------------------------------------------------------
+{
+  const h = hashFile(path.join(dir, 'app.js'));
+  assert.equal(typeof h, 'string');
+  assert.match(h, /^[0-9a-f]{12}$/, 'hash is 12 hex chars');
+  assert.equal(hashFile(path.join(dir, 'nope.js')), null, 'missing file → null');
+  ok('hashFile returns a 12-hex digest, null for missing');
+}
+
+// --- stampHtml: rewrites local asset ?v= to the content hash ----------------
+const stamped = stampHtml(html, { assetDir: dir, urlPrefix: '/builders/' });
+const jsHash = hashFile(path.join(dir, 'app.js'));
+const cssHash = hashFile(path.join(dir, 'style.css'));
+{
+  assert.ok(stamped.includes(`/builders/style.css?v=${cssHash}`), 'css stamped with content hash');
+  assert.ok(stamped.includes(`/builders/app.js?v=${jsHash}`), 'js stamped with content hash');
+  assert.ok(!stamped.includes('hand-typed-old'), 'old hand-typed version replaced');
+  ok('local css/js refs stamped with content hash, old ?v= dropped');
+}
+
+// --- leaves cross-origin, data:, and unknown/unresolvable refs alone --------
+{
+  assert.ok(stamped.includes('https://fonts.example.com/x.css?v=cdn'), 'cross-origin untouched');
+  assert.ok(stamped.includes('data:image/svg+xml;utf8,<svg/>'), 'data: icon untouched');
+  assert.ok(stamped.includes('/builders/missing.js?v=keepme'), 'unresolvable file left as-is');
+  ok('cross-origin / data: / missing-file refs left untouched');
+}
+
+// --- the whole point: a content change changes the stamped URL --------------
+{
+  fs.writeFileSync(path.join(dir, 'app.js'), 'console.log("v2 — changed!");\n');
+  const stamped2 = stampHtml(html, { assetDir: dir, urlPrefix: '/builders/' });
+  const jsHash2 = hashFile(path.join(dir, 'app.js'));
+  assert.notEqual(jsHash2, jsHash, 'hash changed with content');
+  assert.ok(stamped2.includes(`/builders/app.js?v=${jsHash2}`), 'stamped URL tracks new content');
+  assert.ok(!stamped2.includes(`/builders/app.js?v=${jsHash}`), 'old URL no longer emitted');
+  ok('changing a file changes its stamped ?v= (the bug this fixes)');
+}
+
+// --- idempotent: re-stamping already-stamped HTML is stable -----------------
+{
+  const once = stampHtml(html, { assetDir: dir, urlPrefix: '/builders/' });
+  const twice = stampHtml(once, { assetDir: dir, urlPrefix: '/builders/' });
+  assert.equal(twice, once, 're-stamping is a no-op');
+  ok('stampHtml is idempotent');
+}
+
+// --- buildStampedHtml: maps every .html file in a dir -----------------------
+{
+  fs.writeFileSync(path.join(dir, 'index.html'), html);
+  fs.writeFileSync(path.join(dir, 'other.html'), '<script src="/builders/app.js?v=x"></script>');
+  const map = buildStampedHtml(dir, '/builders/');
+  assert.ok(map['index.html'] && map['other.html'], 'both html files present');
+  assert.ok(map['index.html'].includes(`/builders/style.css?v=${cssHash}`), 'index.html stamped');
+  assert.equal(buildStampedHtml(path.join(dir, 'does-not-exist'), '/').index, undefined, 'missing dir → empty map, no throw');
+  ok('buildStampedHtml stamps every .html, tolerates a missing dir');
+}
+
+fs.rmSync(dir, { recursive: true, force: true });
+console.log(`\nasset_version: ${pass} checks passed`);

package/tests/atlas.mjs

@@ -0,0 +1,69 @@
+// tests/atlas.mjs — the Repo Atlas generator ⟷ renderer contract (ADR 0094,
+// task 1640). gen-atlas.js (scripts/) emits the data; modules/hall-ui/public/atlas.js
+// renders it (the hall surface carved to the hall-ui module in BV1.R85). This pins
+// the contract between them so a future change to either
+// side can't silently desync: every node kind the generator emits must be one
+// the renderer colours/sizes, every edge must reference a real node, every
+// legend token must resolve, and each view must have exactly one fixed centre.
+// Pure file-reads (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const atlas = require(path.join(ROOT, 'scripts', 'gds', 'gen-atlas.js'));
+
+// Must stay in lockstep with modules/hall-ui/public/atlas.js (nodeFill/sizeFor/ringFor,
+// EDGE_STYLE, TOKENS, CENTER kinds). If the renderer learns a new kind, add it
+// here; if this test fails, the renderer would draw a default/blank for it.
+const KNOWN_KINDS = { context: ['hub', 'nested', 'docs', 'db', 'generated'], modules: ['core', 'db', 'module', 'ghost'] };
+const EDGE_KINDS = ['drill', 'gov', 'live', 'drift', 'clean', 'violation', 'monolith', 'ghost', 'seam'];
+const TOKENS = ['sun', 'sky', 'coral', 'paper', 'good', 'core', 'db', 'ghost', 'danger'];
+const CENTER_KIND = { context: 'hub', modules: 'core' };
+const BADGE_KINDS = ['good', 'warn', 'danger', 'info'];
+
+const VIEWS = { context: atlas.buildContextView(), modules: atlas.buildModuleView() };
+
+for (const view of ['context', 'modules']) {
+  test(`atlas ${view} view: nodes are well-formed and renderable`, () => {
+    const v = VIEWS[view];
+    assert.ok(v && Array.isArray(v.nodes) && v.nodes.length > 0, `${view} has nodes`);
+    let centers = 0;
+    for (const n of v.nodes) {
+      assert.ok(n.id && n.kind && n.label, `node has id/kind/label: ${JSON.stringify(n).slice(0, 80)}`);
+      assert.ok(KNOWN_KINDS[view].includes(n.kind), `${view} node ${n.id}: renderer handles kind '${n.kind}'`);
+      if (n.badge) assert.ok(BADGE_KINDS.includes(n.badge.k), `${view} node ${n.id}: badge kind '${n.badge.k}'`);
+      if (n.kind === CENTER_KIND[view]) centers++;
+    }
+    assert.equal(centers, 1, `${view}: exactly one fixed centre (${CENTER_KIND[view]})`);
+  });
+
+  test(`atlas ${view} view: every edge references real nodes with a known kind`, () => {
+    const v = VIEWS[view];
+    const ids = new Set(v.nodes.map((n) => n.id));
+    for (const e of v.edges) {
+      assert.ok(ids.has(e.a), `${view}: edge.a '${e.a}' is a node`);
+      assert.ok(ids.has(e.b), `${view}: edge.b '${e.b}' is a node`);
+      assert.ok(EDGE_KINDS.includes(e.kind), `${view}: renderer handles edge kind '${e.kind}'`);
+    }
+  });
+
+  test(`atlas ${view} view: legend tokens resolve in the renderer`, () => {
+    const v = VIEWS[view];
+    assert.ok(Array.isArray(v.legend) && v.legend.length > 0, `${view} has a legend`);
+    for (const l of v.legend) {
+      const tok = l.ln || l.sw;
+      assert.ok(TOKENS.includes(tok), `${view}: legend token '${tok}' is a renderer TOKEN`);
+    }
+  });
+}
+
+test('atlas modules view: the 7 real on-disk modules are all present', () => {
+  const labels = new Set(VIEWS.modules.nodes.filter((n) => n.kind === 'module').map((n) => n.label));
+  for (const key of ['game', 'dev-box', 'discord', 'art-pipeline', 'grading', 'memory', 'character-anim']) {
+    assert.ok(labels.has(key), `module '${key}' is rendered (real on-disk module must never be dropped)`);
+  }
+});

package/tests/audit_deps.mjs

@@ -0,0 +1,74 @@
+// tests/audit_deps.mjs — pure-core coverage for the likely-missing-dependency
+// detector (task 349). Hermetic: feeds fixtures to findMissingDeps/classify; no
+// DB, no API. Run: node tests/audit_deps.mjs (also runs in the unit gate).
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { findMissingDeps, classify } = require('../scripts/gds/audit-deps.js');
+
+let passed = 0, failed = 0;
+const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
+
+t('flags an open task overlapping an unshipped non-dep on the SAME narrow file (high)', () => {
+  const tasks = [
+    { id: 1, status: 'ready', touches: ['src/bongos/routes/public.js'], dependencies: [] },
+    { id: 2, status: 'backlog', touches: ['src/bongos/routes/public.js'], dependencies: [] },
+  ];
+  const e = findMissingDeps(tasks);
+  assert.equal(e.length, 2, 'both directions surface');
+  assert.ok(e.find((x) => x.task_id === 1 && x.dep_id === 2 && x.confidence === 'high'));
+});
+
+t('does NOT flag an already-declared dependency', () => {
+  const tasks = [
+    { id: 1, status: 'ready', touches: ['src/bongos/x.js'], dependencies: ['2'] },
+    { id: 2, status: 'backlog', touches: ['src/bongos/x.js'], dependencies: [] },
+  ];
+  assert.deepEqual(findMissingDeps(tasks).filter((x) => x.task_id === 1).map((x) => x.dep_id), []);
+});
+
+t('SHIPPED blocker never gates (auto-satisfied)', () => {
+  const tasks = [
+    { id: 1, status: 'ready', touches: ['src/bongos/x.js'], dependencies: [] },
+    { id: 2, status: 'shipped', touches: ['src/bongos/x.js'], dependencies: [] },
+  ];
+  assert.deepEqual(findMissingDeps(tasks).filter((x) => x.dep_id === 2), []);
+});
+
+t('ABANDONED blocker never gates', () => {
+  const tasks = [
+    { id: 1, status: 'ready', touches: ['src/bongos/x.js'], dependencies: [] },
+    { id: 2, status: 'abandoned', touches: ['src/bongos/x.js'], dependencies: [] },
+  ];
+  assert.deepEqual(findMissingDeps(tasks).filter((x) => x.dep_id === 2), []);
+});
+
+t('shared-hotspot-only overlap is demoted to low', () => {
+  assert.equal(classify(['src/bongos/db.js'], ['src/bongos/db.js']).confidence, 'low');
+});
+
+t('bare-directory overlap is not high (parallel-safety, not a dep)', () => {
+  assert.ok(classify(['.claude/skills/'], ['.claude/skills/planning-session/']).confidence !== 'high');
+});
+
+t('narrow same-file beats hotspot when both present (high)', () => {
+  assert.equal(classify(['src/bongos/db.js', 'src/bongos/box-onboard.js'], ['src/bongos/db.js', 'src/bongos/box-onboard.js']).confidence, 'high');
+});
+
+t('empty touches never produce candidates / never throw', () => {
+  const tasks = [
+    { id: 1, status: 'ready', touches: [], dependencies: [] },
+    { id: 2, status: 'backlog', touches: ['src/bongos/x.js'], dependencies: [] },
+  ];
+  assert.deepEqual(findMissingDeps(tasks), []);
+});
+
+t('a task does not flag itself', () => {
+  const tasks = [{ id: 7, status: 'ready', touches: ['src/bongos/x.js'], dependencies: [] }];
+  assert.deepEqual(findMissingDeps(tasks), []);
+});
+
+console.log(`\naudit_deps: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/audit_middleware.mjs

@@ -0,0 +1,385 @@
+// tests/audit_middleware.mjs
+//
+// Unit + integration smoke for the audit middleware (V3.R35 / #256).
+//
+// Verifies:
+//   1. Redaction. `password`, `token`, `key`, `secret` (any case, anywhere)
+//      are replaced with '<redacted>'. Recurses into nested objects + arrays.
+//   2. GET requests are NOT logged (signal/noise rule).
+//   3. Authenticated POST → insert is called with the redacted body, route
+//      pattern, status, IP, UA.
+//   4. Unauthenticated POST (no req.builder) → insert is NOT called.
+//   5. CRITICAL fail-safe: if the insert function THROWS or REJECTS, the
+//      user request still completes with its normal response. The error is
+//      swallowed and never propagated. This is the property that protects
+//      every other write in the system from breaking when audit logging is
+//      broken.
+//
+// We exercise the middleware against a real Express instance using a fake
+// insertFn — no DB. The express() request path is the property under test;
+// the SQL is one tiny pool.query.
+//
+// Run:  node tests/audit_middleware.mjs
+
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const { auditMiddleware, redactBody, shouldRedactKey } = require('../src/bongos/middleware/audit.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  return Promise.resolve()
+    .then(() => fn())
+    .then(() => { passed++; console.log(`  PASS  ${name}`); })
+    .catch((e) => { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); });
+}
+
+// ---------------------------------------------------------------------------
+// Pure redaction tests.
+// ---------------------------------------------------------------------------
+
+await t('shouldRedactKey: token/password/key/secret match case-insensitively', () => {
+  for (const k of ['token', 'Token', 'TOKEN', 'access_token', 'tokenized']) {
+    assert.equal(shouldRedactKey(k), true, k);
+  }
+  for (const k of ['password', 'Password', 'user_password']) {
+    assert.equal(shouldRedactKey(k), true, k);
+  }
+  for (const k of ['key', 'apiKey', 'API_KEY']) {
+    assert.equal(shouldRedactKey(k), true, k);
+  }
+  for (const k of ['secret', 'client_secret', 'Secrets']) {
+    assert.equal(shouldRedactKey(k), true, k);
+  }
+  for (const k of ['title', 'body', 'name', 'route', 'method']) {
+    assert.equal(shouldRedactKey(k), false, k);
+  }
+});
+
+await t('redactBody: nested objects and arrays', () => {
+  const input = {
+    title: 'demo',
+    password: 'hunter2',
+    nested: {
+      apiKey: 'sk-live-XXX',
+      ok: 'still here',
+      deeper: { secret: 'shh', also_fine: 1 },
+    },
+    items: [
+      { token: 'abc', label: 'first' },
+      { name: 'second', SECRET_THING: 'shh', payload: { client_secret: 'ssh' } },
+    ],
+  };
+  const out = redactBody(input);
+  assert.equal(out.title, 'demo');
+  assert.equal(out.password, '<redacted>');
+  assert.equal(out.nested.apiKey, '<redacted>');
+  assert.equal(out.nested.ok, 'still here');
+  assert.equal(out.nested.deeper.secret, '<redacted>');
+  assert.equal(out.nested.deeper.also_fine, 1);
+  assert.equal(out.items[0].token, '<redacted>');
+  assert.equal(out.items[0].label, 'first');
+  assert.equal(out.items[1].SECRET_THING, '<redacted>');
+  assert.equal(out.items[1].payload.client_secret, '<redacted>');
+  // The original input must not be mutated.
+  assert.equal(input.password, 'hunter2');
+  assert.equal(input.nested.apiKey, 'sk-live-XXX');
+});
+
+await t('redactBody: primitives + null + undefined pass through', () => {
+  assert.equal(redactBody(null), null);
+  assert.equal(redactBody(undefined), undefined);
+  assert.equal(redactBody('hello'), 'hello');
+  assert.equal(redactBody(42), 42);
+  assert.equal(redactBody(true), true);
+});
+
+await t('redactBody: arrays at the top level recurse', () => {
+  const out = redactBody([{ token: 'x' }, { name: 'y' }]);
+  assert.deepEqual(out, [{ token: '<redacted>' }, { name: 'y' }]);
+});
+
+// ---------------------------------------------------------------------------
+// HTTP integration tests against a real Express app.
+// ---------------------------------------------------------------------------
+
+// Build a tiny app that mounts the audit middleware + a couple of endpoints.
+// We stub auth by attaching req.builder ourselves so we don't need GitHub.
+function buildTestApp({ insertFn, auth = true }) {
+  const app = express();
+  app.set('trust proxy', 1);
+  app.use(express.json());
+  // Stub auth: simulate requireBuilder having run (or not).
+  app.use((req, _res, next) => {
+    if (auth) req.builder = { id: 7, github_login: 'tester', rank: 'archon' };
+    next();
+  });
+  app.use(auditMiddleware({ insertFn }));
+  app.post('/tasks/:id', (req, res) => res.json({ ok: true, id: req.params.id }));
+  app.patch('/tasks/:id', (req, res) => res.json({ ok: true }));
+  app.get('/tasks', (_req, res) => res.json({ items: [] }));
+  app.delete('/tasks/:id', (_req, res) => res.status(204).end());
+  return app;
+}
+
+function listen(app) {
+  return new Promise((resolve) => {
+    const server = app.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      resolve({ server, port });
+    });
+  });
+}
+
+function send({ port, method, path, body, headers = {} }) {
+  return new Promise((resolve, reject) => {
+    const data = body !== undefined ? JSON.stringify(body) : null;
+    const req = http.request(
+      {
+        host: '127.0.0.1',
+        port,
+        method,
+        path,
+        headers: {
+          'content-type': 'application/json',
+          'user-agent': 'audit-test/1.0',
+          ...headers,
+          ...(data ? { 'content-length': Buffer.byteLength(data) } : {}),
+        },
+      },
+      (res) => {
+        const chunks = [];
+        res.on('data', (c) => chunks.push(c));
+        res.on('end', () => {
+          const text = Buffer.concat(chunks).toString('utf8');
+          resolve({ status: res.statusCode, text });
+        });
+      }
+    );
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+// Wait until N inserts have been observed (or fail after timeout).
+function waitForCalls(calls, expectedCount, timeoutMs = 1000) {
+  return new Promise((resolve, reject) => {
+    const start = Date.now();
+    const tick = () => {
+      if (calls.length >= expectedCount) return resolve();
+      if (Date.now() - start > timeoutMs) {
+        return reject(new Error(`expected ${expectedCount} insert calls, got ${calls.length}`));
+      }
+      setTimeout(tick, 10);
+    };
+    tick();
+  });
+}
+
+await t('integration: authenticated POST logs a redacted row', async () => {
+  const calls = [];
+  const insertFn = async (entry) => {
+    calls.push(entry);
+    return { id: 1, recorded_at: new Date() };
+  };
+  const app = buildTestApp({ insertFn });
+  const { server, port } = await listen(app);
+  try {
+    const r = await send({
+      port,
+      method: 'POST',
+      path: '/tasks/42',
+      body: {
+        title: 'demo',
+        password: 'hunter2',
+        nested: { apiKey: 'sk-XYZ', items: [{ token: 'tok-1', name: 'ok' }] },
+      },
+    });
+    assert.equal(r.status, 200);
+    await waitForCalls(calls, 1);
+    const entry = calls[0];
+    assert.equal(entry.builderId, 7);
+    assert.equal(entry.method, 'POST');
+    assert.equal(entry.route, '/tasks/:id');
+    assert.equal(entry.responseStatus, 200);
+    assert.equal(entry.userAgent, 'audit-test/1.0');
+    assert.equal(entry.requestBodyRedacted.password, '<redacted>');
+    assert.equal(entry.requestBodyRedacted.nested.apiKey, '<redacted>');
+    assert.equal(entry.requestBodyRedacted.nested.items[0].token, '<redacted>');
+    assert.equal(entry.requestBodyRedacted.nested.items[0].name, 'ok');
+    assert.equal(entry.requestBodyRedacted.title, 'demo');
+  } finally {
+    server.close();
+  }
+});
+
+await t('integration: an over-cap body is TRUNCATED before it reaches insert (SR-17)', async () => {
+  // A multi-MB body must not be persisted verbatim as a second copy in
+  // audit_log. The middleware caps the serialized stored body; the insert sees
+  // the bounded marker, not the raw payload.
+  const calls = [];
+  const insertFn = async (entry) => { calls.push(entry); };
+  const app = express();
+  app.set('trust proxy', 1);
+  app.use(express.json({ limit: '4mb' })); // route mounts a large parser (like /sessions)
+  app.use((req, _res, next) => { req.builder = { id: 7, rank: 'archon' }; next(); });
+  app.use(auditMiddleware({ insertFn }));
+  app.post('/sessions', (_req, res) => res.status(201).json({ ok: true }));
+  const { server, port } = await listen(app);
+  try {
+    const r = await send({
+      port, method: 'POST', path: '/sessions',
+      body: { session_id: 's', detail: [{ snippet: 'A'.repeat(2 * 1024 * 1024) }] }, // 2 MB
+    });
+    assert.equal(r.status, 201);
+    await waitForCalls(calls, 1);
+    const stored = calls[0].requestBodyRedacted;
+    assert.equal(stored._audit_truncated, true, 'a 2 MB body must be truncated');
+    const storedBytes = Buffer.byteLength(JSON.stringify(stored), 'utf8');
+    assert.ok(storedBytes < 16 * 1024, `stored audit body (${storedBytes} B) must be bounded, not the full 2 MB`);
+  } finally {
+    server.close();
+  }
+});
+
+await t('integration: GET requests are NOT logged', async () => {
+  const calls = [];
+  const insertFn = async (entry) => { calls.push(entry); };
+  const app = buildTestApp({ insertFn });
+  const { server, port } = await listen(app);
+  try {
+    const r = await send({ port, method: 'GET', path: '/tasks' });
+    assert.equal(r.status, 200);
+    // Give the event loop a few ticks in case the middleware accidentally
+    // scheduled a write.
+    await new Promise((res) => setTimeout(res, 50));
+    assert.equal(calls.length, 0, 'GET requests must not log');
+  } finally {
+    server.close();
+  }
+});
+
+await t('integration: unauthenticated write does NOT log', async () => {
+  const calls = [];
+  const insertFn = async (entry) => { calls.push(entry); };
+  const app = buildTestApp({ insertFn, auth: false });
+  const { server, port } = await listen(app);
+  try {
+    const r = await send({ port, method: 'POST', path: '/tasks/9', body: { title: 'x' } });
+    assert.equal(r.status, 200);
+    await new Promise((res) => setTimeout(res, 50));
+    assert.equal(calls.length, 0, 'unauthenticated writes must not log');
+  } finally {
+    server.close();
+  }
+});
+
+await t('integration: DELETE 204 still logs', async () => {
+  const calls = [];
+  const insertFn = async (entry) => { calls.push(entry); };
+  const app = buildTestApp({ insertFn });
+  const { server, port } = await listen(app);
+  try {
+    const r = await send({ port, method: 'DELETE', path: '/tasks/9' });
+    assert.equal(r.status, 204);
+    await waitForCalls(calls, 1);
+    assert.equal(calls[0].method, 'DELETE');
+    assert.equal(calls[0].responseStatus, 204);
+  } finally {
+    server.close();
+  }
+});
+
+// ===========================================================================
+// THE CRITICAL FAIL-SAFE TEST.
+//
+// If the audit logger throws, the user must STILL get their normal response.
+// We verify this two ways:
+//   a) Synchronous throw inside the insertFn.
+//   b) Asynchronous rejection inside the insertFn.
+// In both cases the POST must return 200 with the route's normal JSON body.
+// ===========================================================================
+
+await t('FAIL-SAFE: synchronous throw inside insertFn does not affect response', async () => {
+  const insertFn = () => { throw new Error('boom-sync'); };
+  const app = buildTestApp({ insertFn });
+  const { server, port } = await listen(app);
+  try {
+    const r = await send({
+      port,
+      method: 'POST',
+      path: '/tasks/1',
+      body: { title: 'hello' },
+    });
+    // The user got the normal response — the audit failure was swallowed.
+    assert.equal(r.status, 200);
+    const json = JSON.parse(r.text);
+    assert.equal(json.ok, true);
+    assert.equal(json.id, '1');
+  } finally {
+    server.close();
+  }
+});
+
+await t('FAIL-SAFE: async rejection inside insertFn does not affect response', async () => {
+  const insertFn = async () => { throw new Error('boom-async'); };
+  const app = buildTestApp({ insertFn });
+  const { server, port } = await listen(app);
+  try {
+    const r = await send({
+      port,
+      method: 'PATCH',
+      path: '/tasks/2',
+      body: { title: 'world', token: 'should-redact' },
+    });
+    assert.equal(r.status, 200);
+    const json = JSON.parse(r.text);
+    assert.equal(json.ok, true);
+    // Allow the rejection to flush so it can't leak across tests as an
+    // unhandled rejection.
+    await new Promise((res) => setTimeout(res, 50));
+  } finally {
+    server.close();
+  }
+});
+
+await t('FAIL-SAFE: insertFn never sees the secret values', async () => {
+  // Belt-and-braces: even if a future logger does logging->disk, our
+  // contract is that the input it gets has been redacted.
+  let captured;
+  const insertFn = async (entry) => { captured = entry; };
+  const app = buildTestApp({ insertFn });
+  const { server, port } = await listen(app);
+  try {
+    await send({
+      port,
+      method: 'PUT',
+      path: '/tasks/3',
+      body: {
+        title: 'k',
+        password: 'plaintext-PASSWORD',
+        deeper: { token: 'plaintext-TOKEN' },
+      },
+    });
+    // PUT doesn't have a defined route in our test app, so the request
+    // returns 404 — but the audit hook still fires (response went out).
+    await waitForCalls({ get length() { return captured ? 1 : 0; } }, 1).catch(() => {});
+    // Whatever was captured, the plaintext must not be there.
+    if (captured) {
+      assert.equal(JSON.stringify(captured.requestBodyRedacted).includes('plaintext-PASSWORD'), false);
+      assert.equal(JSON.stringify(captured.requestBodyRedacted).includes('plaintext-TOKEN'), false);
+    }
+  } finally {
+    server.close();
+  }
+});
+
+// ---------------------------------------------------------------------------
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);