@bongos/core 1.17.1 → 1.17.3

package/tests/hook_core_resolve.mjs

@@ -0,0 +1,125 @@
+// tests/hook_core_resolve.mjs
+//
+// Task 2139 — the materialized .claude/hooks resolve CORE modules (src/bongos/*,
+// scripts/gds/*) in BOTH layouts: the repo root today, and the pinned @bongos/core
+// package post-split (ADR 0108). Before this, conductor.js's UNGUARDED
+// require('../../src/bongos/…') MODULE_NOT_FOUND'd on EVERY UserPromptSubmit once
+// src/ left the instance root; the guarded hooks silently killed their feature.
+//
+// _core-resolve.coreModulePathFrom(instanceRoot, rel) is the whole mechanism, so
+// it takes the root as an argument and this suite diverges it against synthetic
+// trees (impossible to prove with the real single checkout, where root == core).
+// Locks:
+//   1. finds a core file inside node_modules/@bongos/core when it is NOT at the
+//      repo root — the post-split consumer layout, the point of the task;
+//   2. repo root WINS when the file exists in both (today = byte-identical);
+//   3. absent in every layout → null (fresh clone → callers degrade, never crash);
+//   4. all three published core package names resolve;
+//   5. requireCore loads a real core module today + throws a tagged error when absent;
+//   6. conductor.js, loaded in a core-LESS instance root, does NOT crash and still
+//      emits its methodology nudges (the "conductor no longer hard-crashes" done-when).
+//
+// DB-free + no network → part of the unit gate. Run:  node tests/hook_core_resolve.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, mkdirSync, cpSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const resolver = require('../.claude/hooks/_core-resolve.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// Build a throwaway instance root from { relPath: contents }.
+function makeTree(files) {
+  const root = mkdtempSync(join(tmpdir(), 'hook-core-'));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = join(root, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+  }
+  return root;
+}
+
+// 1. Post-split: the core file exists ONLY inside the installed package.
+t('resolves a core module inside node_modules/@bongos/core (post-split layout)', () => {
+  const root = makeTree({ 'node_modules/@bongos/core/src/bongos/path-match.js': 'module.exports={};' });
+  const p = resolver.coreModulePathFrom(root, 'src/bongos/path-match');
+  assert.ok(p, 'expected a resolution');
+  assert.ok(p.includes(join('node_modules', '@bongos', 'core')), `expected a node_modules path, got ${p}`);
+});
+
+// 2. Priority: repo root wins when present in both (today's single checkout — unchanged).
+t('prefers the repo root when a core file exists at both root and node_modules', () => {
+  const root = makeTree({
+    'scripts/gds/cli-lib.js': 'module.exports={root:true};',
+    'node_modules/@bongos/core/scripts/gds/cli-lib.js': 'module.exports={pkg:true};',
+  });
+  const p = resolver.coreModulePathFrom(root, 'scripts/gds/cli-lib');
+  assert.ok(p && !p.includes('node_modules'), `expected the root copy, got ${p}`);
+});
+
+// 3. Absent everywhere → null (fresh clone pre-`npm install`; callers degrade).
+t('returns null when the core file exists in no layout', () => {
+  const root = makeTree({ 'README.md': '# empty instance' });
+  assert.equal(resolver.coreModulePathFrom(root, 'src/bongos/path-match'), null);
+});
+
+// 4. Every published core package name is honored (scoped-private, scoped-public, bare).
+for (const pkg of resolver.CORE_PKG_NAMES) {
+  t(`resolves via published package name "${pkg}"`, () => {
+    const root = makeTree({ [`node_modules/${pkg}/scripts/gds/x.js`]: 'module.exports={};' });
+    const p = resolver.coreModulePathFrom(root, 'scripts/gds/x.js');
+    const frag = join('node_modules', ...pkg.split('/'));
+    assert.ok(p && p.includes(frag), `expected "${frag}" in ${p}`);
+  });
+}
+
+// 5. requireCore: loads a real core module at the repo root today; throws tagged when absent.
+t('requireCore loads a real core module at the repo root today', () => {
+  const cli = resolver.requireCore('scripts/gds/cli-lib');
+  assert.equal(typeof cli.apiCall, 'function', 'expected cli-lib.apiCall');
+});
+t('requireCore throws CORE_MODULE_NOT_FOUND when the core module is absent', () => {
+  assert.throws(
+    () => resolver.requireCore('src/bongos/__does_not_exist_2139__'),
+    (e) => e && e.code === 'CORE_MODULE_NOT_FOUND',
+  );
+});
+
+// 6. The headline done-when: conductor.js in a core-LESS instance root does not crash
+//    and still emits methodology nudges (the sensitive-surface advisory degrades off).
+//    Runs in a child process with CLAUDE_PROJECT_DIR pointed at the core-less root so
+//    _core-resolve computes that root (this process's env points at the real repo).
+t('conductor.js in a core-less instance root does not crash and still nudges', () => {
+  const root = mkdtempSync(join(tmpdir(), 'hook-coreless-'));
+  const hooks = join(root, '.claude', 'hooks');
+  mkdirSync(hooks, { recursive: true });
+  cpSync(join(ROOT, '.claude', 'hooks', 'conductor.js'), join(hooks, 'conductor.js'));
+  cpSync(join(ROOT, '.claude', 'hooks', '_core-resolve.js'), join(hooks, '_core-resolve.js'));
+  const snippet =
+    `const c = require(${JSON.stringify(join(hooks, 'conductor.js'))});` +
+    `const out = c.evaluateTriggers({ changedFiles: ['src/bongos/sensitive-surfaces.js'], prompt: 'ship it', activeClaims: [] });` +
+    `process.stdout.write(JSON.stringify(out.map((a) => a.id)));`;
+  const stdout = execFileSync(process.execPath, ['-e', snippet], {
+    encoding: 'utf8',
+    env: { ...process.env, CLAUDE_PROJECT_DIR: root },
+  });
+  const ids = JSON.parse(stdout);
+  assert.ok(ids.includes('no-claim'), 'still emits the no-claim methodology nudge without the core');
+  assert.ok(ids.includes('ship-intent'), 'still emits the ship-intent nudge without the core');
+  assert.ok(!ids.includes('sensitive-surface'), 'sensitive-surface degrades off (isSensitive fallback) when the core is absent');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/infra_exec_paths.mjs

@@ -0,0 +1,104 @@
+// tests/infra_exec_paths.mjs — task 2137 (ADR 0108 configurable-root).
+//
+// Two proofs that the host systemd units resolve their CORE scripts in a consumer layout after the
+// R89 split:
+//   A. lint-infra-exec: every infra/*.service ExecStart that runs a core script goes through
+//      infra/core-node.sh AND names a PUBLISHABLE core file (ships in @bongos/core → present at
+//      node_modules/@bongos/core post-install) that also exists at the core root today. No unit
+//      still uses the bare repo-relative `node scripts/…` form.
+//   B. core-node.sh actually resolves both layouts: it prefers the instance root (monolith) and
+//      falls back to node_modules/@bongos/core (consumer), driven by $BONGOS_INSTANCE_ROOT.
+//
+// DB-free, no network. Run: node tests/infra_exec_paths.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const { lintInfraExec } = require('../scripts/gds/lint-infra-exec.js');
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO = path.resolve(__dirname, '..');
+const LAUNCHER = path.join(REPO, 'infra', 'core-node.sh');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); console.log(`  ok  ${name}`); passed++; }
+  catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
+}
+
+// ---- A. the lint is green on the real tree, and covers all 11 core-script units ----------------
+test('lint-infra-exec: every core-script unit resolves in a consumer layout (publishable + present)', () => {
+  const r = lintInfraExec({ instanceRoot: REPO, coreRoot: REPO });
+  assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations)}`);
+  assert.ok(r.ok, 'lint should pass');
+  assert.equal(r.checked.length, 11, `expected all 11 core-script units repointed + resolving, got ${r.checked.length}`);
+  // The three core CLIs the units invoke are all covered.
+  const rels = new Set(r.checked.map((c) => c.rel));
+  for (const rel of ['scripts/gds/box.js', 'scripts/gds/provision.js', 'scripts/gds/search-ingest-db.js']) {
+    assert.ok(rels.has(rel), `expected a unit routing through ${rel}`);
+  }
+});
+
+test('lint-infra-exec: a bare repo-relative core ExecStart is flagged (counterfactual)', () => {
+  // Synthetic infra/ with the OLD form → must be reported as a violation.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'infra-lint-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'infra'), { recursive: true });
+    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'box.js'), '// probe\n');
+    fs.writeFileSync(path.join(tmp, 'infra', 'legacy.service'),
+      '[Service]\nExecStart=/usr/bin/node scripts/gds/box.js run-intents --apply\n');
+    const r = lintInfraExec({ instanceRoot: tmp, coreRoot: tmp });
+    assert.ok(!r.ok, 'a bare repo-relative core ExecStart must fail the lint');
+    assert.equal(r.violations.length, 1);
+    assert.match(r.violations[0].why, /core-node\.sh/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+// ---- B. the launcher resolves BOTH layouts ------------------------------------------------------
+function runLauncher(rel, instanceRoot) {
+  return execFileSync('bash', [LAUNCHER, rel], {
+    encoding: 'utf8',
+    env: { ...process.env, BONGOS_INSTANCE_ROOT: instanceRoot },
+  }).trim();
+}
+
+test('core-node.sh resolves the monolith layout (script at the instance root)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-mono-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'probe.js'), 'console.log("MONOLITH");\n');
+    assert.equal(runLauncher('scripts/gds/probe.js', tmp), 'MONOLITH');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('core-node.sh falls back to the consumer layout (script only under node_modules/@bongos/core)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-cons-'));
+  try {
+    const pkgDir = path.join(tmp, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(pkgDir, { recursive: true });
+    fs.writeFileSync(path.join(pkgDir, 'probe.js'), 'console.log("CONSUMER");\n');
+    // No scripts/gds/probe.js at the instance root → the resolver must reach node_modules.
+    assert.equal(runLauncher('scripts/gds/probe.js', tmp), 'CONSUMER');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('core-node.sh exits non-zero when the script is in NO layout', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-none-'));
+  let threw = false;
+  try {
+    execFileSync('bash', [LAUNCHER, 'scripts/gds/nope.js'], {
+      encoding: 'utf8', stdio: 'pipe', env: { ...process.env, BONGOS_INSTANCE_ROOT: tmp },
+    });
+  } catch (_) { threw = true; }
+  finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+  assert.ok(threw, 'expected a non-zero exit when the core script resolves in no layout');
+});
+
+console.log(`\ninfra_exec_paths: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/init.mjs

@@ -358,6 +358,53 @@ test('buildInstancePackageJson: preserves existing fields + never clobbers a cus
   assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/bongos-core-1.17.0.tgz'); // dep (re)pinned
 });
 
+// --- enabled-module dep composition (ADR 0138 / task 2160) --------------------
+
+test('enabledModuleDeps: merges only the ENABLED modules’ declared deps', () => {
+  const readDeps = (k) => ({
+    discord: { 'discord.js': '^14.26.4' },
+    game: { colyseus: '^0.16.5', phaser: '^3.87.0' },
+    'art-pipeline': { sharp: '^0.34.5' },
+  }[k] || {});
+  const merged = init.enabledModuleDeps(
+    { modules: { discord: true, game: false, 'art-pipeline': true, 'dev-box': false } },
+    { readDeps }
+  );
+  assert.deepEqual(merged, { 'discord.js': '^14.26.4', sharp: '^0.34.5' }); // game excluded (off)
+});
+
+test('enabledModuleDeps: no enabled modules → empty object', () => {
+  assert.deepEqual(init.enabledModuleDeps({ modules: { discord: false } }, { readDeps: () => ({ 'discord.js': '^14' }) }), {});
+});
+
+test('buildInstancePackageJson: composes moduleDeps (fills), but an existing pin WINS and core is always set', () => {
+  const existing = { dependencies: { 'discord.js': '^14.0.0', express: '^4' } }; // instance pinned discord.js older
+  const moduleDeps = { 'discord.js': '^14.26.4', sharp: '^0.34.5' };
+  const pkg = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz', moduleDeps });
+  assert.equal(pkg.dependencies['discord.js'], '^14.0.0');    // existing pin wins over the module range
+  assert.equal(pkg.dependencies.sharp, '^0.34.5');            // module dep fills what was missing
+  assert.equal(pkg.dependencies.express, '^4');               // untouched host dep preserved
+  assert.equal(pkg.dependencies[init.CORE_PKG], 'file:x.tgz'); // core always (re)set
+});
+
+test('buildInstancePackageJson: no moduleDeps → byte-identical to the pre-composition behavior', () => {
+  const existing = { dependencies: { express: '^4' } };
+  const a = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz' });
+  const b = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz', moduleDeps: {} });
+  assert.deepEqual(a.dependencies, b.dependencies);
+  assert.deepEqual(a.dependencies, { express: '^4', [init.CORE_PKG]: 'file:x.tgz' });
+});
+
+test('moduleDeclaredDeps: reads a module.json dependencies block; {} when absent', () => {
+  const readOk = (p) => JSON.stringify({ key: 'discord', dependencies: { 'discord.js': '^14.26.4' } });
+  assert.deepEqual(init.moduleDeclaredDeps('discord', { coreRoot: '/core', fsImpl: { readFileSync: readOk } }),
+    { 'discord.js': '^14.26.4' });
+  const readNone = () => JSON.stringify({ key: 'lifecycle', contributes: {} });
+  assert.deepEqual(init.moduleDeclaredDeps('lifecycle', { coreRoot: '/core', fsImpl: { readFileSync: readNone } }), {});
+  const readThrow = () => { throw new Error('ENOENT'); };
+  assert.deepEqual(init.moduleDeclaredDeps('ghost', { coreRoot: '/core', fsImpl: { readFileSync: readThrow } }), {});
+});
+
 test('writeConfigs (greenfield): mints package.json with the caret core dep + start/migrate scripts', () => {
   const dir = mkdtempSync(join(tmpdir(), 'greenfield-'));
   try {

package/tests/migrate_root_resolution.mjs

@@ -0,0 +1,97 @@
+// tests/migrate_root_resolution.mjs
+//
+// R89 rehearsal F6 (task 2180): after the core→consumer split, scripts/migrate.sh
+// must resolve the INSTANCE root from the INVOCATION cwd (OTB_INSTANCE_ROOT env,
+// else the invocation cwd's bongos.config.json), NOT script-relative into the
+// installed @bongos/core package. The old script-relative resolve `cd`'d into the
+// package dir first — which has no bongos.config.json — so it silently picked the
+// package as the "instance" and read the core's VANILLA module config, skipping
+// every host + flag-gated module migration (rehearsal: `npm run migrate` applied
+// 115 rows and created NO game schema; from the instance cwd it applied 121).
+//
+// This exercises migrate.sh's `--print-roots` seam (DB-free: it prints the resolved
+// roots and exits before any DB work), so no Postgres is needed. CORE_ROOT must stay
+// script-relative in every case; INSTANCE_ROOT must follow the invocation cwd.
+//
+// Run:  node tests/migrate_root_resolution.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATE = path.join(REPO_ROOT, 'scripts', 'migrate.sh');
+const REPO_REAL = realpathSync(REPO_ROOT);
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// Run `migrate.sh --print-roots` with a controlled cwd + INIT_CWD, and an env that
+// carries NO *_INSTANCE_ROOT override, so we test cwd-based resolution alone.
+function printRoots({ cwd, initCwd } = {}) {
+  const env = { ...process.env };
+  for (const k of Object.keys(env)) if (/_INSTANCE_ROOT$/.test(k)) delete env[k];
+  delete env.INIT_CWD;
+  if (initCwd) env.INIT_CWD = initCwd;
+  const out = execFileSync('bash', [MIGRATE, '--print-roots'], { cwd, env, encoding: 'utf8' });
+  const roots = {};
+  for (const line of out.split('\n')) {
+    const m = /^(INVOKE_CWD|CORE_ROOT|INSTANCE_ROOT)=(.*)$/.exec(line);
+    if (m) roots[m[1]] = m[2];
+  }
+  return roots;
+}
+
+// A synthetic consumer: a dir with a bongos.config.json pointing at itself, exactly
+// as the post-split amazonprimea repo carries (bongos.config.json { instanceRoot: "." }).
+function makeConsumer() {
+  const dir = realpathSync(mkdtempSync(path.join(tmpdir(), 'r89-consumer-')));
+  writeFileSync(path.join(dir, 'bongos.config.json'), JSON.stringify({ instanceRoot: '.' }));
+  return dir;
+}
+// A dir with NO bongos.config.json — stands in for the monolith / a stray cwd.
+function makeBare() {
+  return realpathSync(mkdtempSync(path.join(tmpdir(), 'r89-bare-')));
+}
+
+// ---- the F6 regression: instance root follows the invocation cwd ----------
+t('consumer run from its own dir: INSTANCE_ROOT resolves to the consumer (not the core)', () => {
+  const consumer = makeConsumer();
+  const r = printRoots({ cwd: consumer });
+  assert.equal(realpathSync(r.INSTANCE_ROOT), consumer, 'instance root must be the consumer dir');
+  assert.notEqual(realpathSync(r.INSTANCE_ROOT), REPO_REAL, 'must NOT fall back to the script-relative core root');
+});
+
+t('consumer via npm from elsewhere: INIT_CWD wins over the spawn cwd', () => {
+  const consumer = makeConsumer();
+  const elsewhere = makeBare();
+  // npm sets INIT_CWD to where `npm run` was invoked (the instance), even if a
+  // wrapper cd'd somewhere else first.
+  const r = printRoots({ cwd: elsewhere, initCwd: consumer });
+  assert.equal(realpathSync(r.INSTANCE_ROOT), consumer, 'INIT_CWD (the instance) must win');
+});
+
+// ---- the monolith / no-pointer fallback stays script-relative -------------
+t('no bongos.config + no env: INSTANCE_ROOT falls back to the script-relative repo root', () => {
+  const bare = makeBare();
+  const r = printRoots({ cwd: bare });
+  assert.equal(realpathSync(r.INSTANCE_ROOT), REPO_REAL, 'a stray cwd must NOT masquerade as the instance');
+});
+
+// ---- CORE root is always script-relative, regardless of cwd ---------------
+t('CORE_ROOT is always the script-relative repo root, independent of the invocation cwd', () => {
+  const consumer = makeConsumer();
+  const bare = makeBare();
+  assert.equal(realpathSync(printRoots({ cwd: consumer }).CORE_ROOT), REPO_REAL);
+  assert.equal(realpathSync(printRoots({ cwd: bare }).CORE_ROOT), REPO_REAL);
+});
+
+console.log(`\nmigrate_root_resolution: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/mirror_lineage_proof.mjs

@@ -22,6 +22,20 @@ test('migrationNumbersFromPaths picks CORE migrations only (not module/ADR numbe
   assert.deepEqual([...set].sort((a, b) => a - b), [3, 44, 60]);
 });
 
+test('migrationNumbersFromPaths excludes migrations/instance/ seeds (task 2152)', () => {
+  // migrations/instance/*.sql are this instance's host seeds (ADR 0105), excluded from
+  // the publishable mirror (task 2140). Counting them as core put every instance seed in
+  // the PRIVATE set but not the MIRROR set → a false private⇄mirror divergence that
+  // red-lined the unit gate. Only the bare top-level core migration counts.
+  const set = migrationNumbersFromPaths([
+    'migrations/080_core_thing.sql',                    // bare core → counted
+    'migrations/instance/080_gds_v4_planning_seed.sql', // instance seed → NOT core
+    'migrations/instance/186_governance_seed.sql',      // instance seed → NOT core
+    'migrations/core_192_namespaced.sql',               // core_ prefix ≠ bare NNN_ form → not counted either
+  ]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [80]);
+});
+
 test('parseEnumChecks extracts the quoted value-lists from CHECK (... IN (...))', () => {
   const sql = `
     CREATE TABLE tasks (

package/tests/module_loader.mjs

@@ -84,6 +84,48 @@ test('discoverModules: a missing modules/ root is empty, not an error', () => {
   assert.deepEqual(r, { loaded: [], skipped: [], errors: [] });
 });
 
+// --- task 2133 (R89-prereq): TWO-ROOT discovery. DEFAULT_ROOTS spans the core
+//     package's modules/ AND the consumer/instance's modules/, deduped by
+//     resolved path so a single checkout (roots coincide) never double-scans. ---
+
+test('discoverModules: UNIONs modules across two diverged roots (the post-split shape)', () => {
+  const core = fixtureRoot({ 'core-mod': { manifest: validManifest('core-mod') } });
+  const instance = fixtureRoot({ 'inst-mod': { manifest: validManifest('inst-mod') } });
+  const { loaded, errors, skipped } = loader.discoverModules({ roots: [core, instance], core: '1.0.0' });
+  assert.deepEqual(loaded.map((m) => m.key).sort(), ['core-mod', 'inst-mod'], 'both roots contribute');
+  assert.deepEqual(errors, []);
+  assert.deepEqual(skipped, []);
+});
+
+test('discoverModules: scanning the SAME root twice makes every key a duplicate-key ERROR (why dedupeRoots exists)', () => {
+  const root = fixtureRoot({ 'only-mod': { manifest: validManifest('only-mod') } });
+  const { loaded, errors } = loader.discoverModules({ roots: [root, root], core: '1.0.0' });
+  assert.equal(loaded.length, 1, 'the first scan loads it');
+  assert.equal(errors.length, 1, 'the second scan of the identical root is a duplicate-key error');
+  assert.match(errors[0].errors[0], /duplicate module key/);
+});
+
+test('dedupeRoots: collapses roots that resolve to the same path, preserving order', () => {
+  assert.deepEqual(
+    loader.dedupeRoots(['/a/modules', '/a/modules', '/b/modules']),
+    ['/a/modules', '/b/modules'],
+  );
+  assert.deepEqual(loader.dedupeRoots(['/a/modules', '/a/./modules']), ['/a/modules'], 'normalizes before comparing');
+  assert.equal(loader.dedupeRoots(['/a/modules', '/b/modules']).length, 2, 'a genuinely diverged pair is kept');
+});
+
+test('DEFAULT_ROOTS is deduped → the single checkout scans no root twice (zero dup-key errors)', () => {
+  // In a single checkout resolveInstanceRoot() falls back to cwd === resolveCoreRoot(),
+  // so the two candidate roots are identical and MUST collapse to one (a diverged
+  // consumer repo keeps both). The invariant: no resolved path appears twice.
+  const resolved = loader.DEFAULT_ROOTS.map((r) => path.resolve(r));
+  assert.equal(new Set(resolved).size, resolved.length, 'DEFAULT_ROOTS has no duplicate resolved paths');
+  loader._reset();
+  const snap = loader.loaderSnapshot();
+  assert.deepEqual(snap.errors, [], 'default-root discovery yields zero errors (no duplicate-key)');
+  loader._reset();
+});
+
 test('discoveredRegistry: shapes a loaded manifest like a MODULE_REGISTRY entry', () => {
   loader._reset();
   const root = fixtureRoot({ econ: { manifest: validManifest('econ', { default: true, provides: ['reward'], contributes: { disciplines: ['x'] } }) } });

package/tests/module_manifest.mjs

@@ -192,3 +192,22 @@ test('an empty-string attribution field is rejected', () => {
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => e.startsWith('author')));
 });
+
+// --- optional runtime dependencies (ADR 0138 / task 2160) ---
+
+test('dependencies: a valid { name: range } object passes', () => {
+  const r = validateManifest({ ...baseManifest(), dependencies: { 'discord.js': '^14.26.4' } });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('dependencies: omitted is fine (optional)', () => {
+  assert.equal(validateManifest(baseManifest()).valid, true);
+});
+
+test('dependencies: a non-object, or a non-string range, is rejected', () => {
+  for (const bad of [['discord.js'], 'discord.js@14', { 'discord.js': 14 }, { '': '^1' }]) {
+    const r = validateManifest({ ...baseManifest(), dependencies: bad });
+    assert.equal(r.valid, false, `should reject ${JSON.stringify(bad)}`);
+    assert.ok(r.errors.some((e) => e.startsWith('dependencies')), `error should mention dependencies: ${r.errors}`);
+  }
+});

package/tests/onboard.mjs

@@ -117,3 +117,16 @@ test('the web forms (/create + hall wizard) declare EXACTLY the canonical human
     assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
   }
 });
+
+test('the one-click GitHub-App manifest path surfaces the CLI-only Enable-Device-Flow step (task 2129)', () => {
+  // GitHub defaults Device Flow OFF and the manifest can't enable it, but `bongos login` needs
+  // it — so BOTH manifest surfaces must tell the owner to enable it after the one-click approval.
+  // Assert on a phrase DISTINCT to the one-click caveat: the manual OAuth path already mentions
+  // Device Flow (task 2127), so a bare "Device Flow" match wouldn't prove the manifest path carries it.
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const onboardSrc = readFileSync(path.join(import.meta.dirname, '..', 'scripts/gds/onboard.js'), 'utf8');
+  const wizardSrc = readFileSync(path.join(import.meta.dirname, '..', 'modules/hall-ui/public/new-project-wizard.js'), 'utf8');
+  assert.match(onboardSrc, /cannot enable Device Flow via the manifest/i, 'bongos onboard one-click caveat missing');
+  assert.match(wizardSrc, /Terminal CLI only: after approving, enable/i, 'hall wizard one-click caveat missing');
+});

package/tests/package_core.mjs

@@ -366,6 +366,14 @@ t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici
   assert.equal(pkg.exports['.'], './src/platform-server.js');
   assert.equal(pkg.exports['./serve-internal'], './src/bongos/serve-internal.js');
   assert.equal(pkg.exports['./module-api'], './src/module-api.js');
+  // rehearsal F3 / task 2161 — the game-host kit: the core internals a game-bearing
+  // instance's own entrypoint (server.js) wires. The cutover codemod rewrites server.js's
+  // relative ./src/* requires to exactly these subpaths, so they MUST be exported.
+  assert.equal(pkg.exports['./bongos/api-path-404'], './src/bongos/api-path-404.js');
+  assert.equal(pkg.exports['./bongos/uptime-poller'], './src/bongos/uptime-poller.js');
+  assert.equal(pkg.exports['./module-loader/loader'], './src/module-loader/loader.js');
+  assert.equal(pkg.exports['./modules'], './src/modules.js');
+  assert.equal(pkg.exports['./module-seams'], './src/module-seams.js');
   // task 2089 / ADR 0134 — the synthesized package publishes PRIVATE by default.
   assert.deepEqual(pkg.publishConfig, { access: 'restricted' });
 });

package/tests/provisioning_github_app_routes.mjs

@@ -71,6 +71,21 @@ console.log('POST /provisioning/instances/:id/github-app (mint the one-click lin
   t('the attempt row was persisted with the minted state', !!(stored && stored.instanceId === 42 && stored.state === j.state && stored.requestedBy === 7));
 }
 
+console.log('\nprovisioningOrigin override (task 2101 — customer App carries the PLATFORM brand, not the game domain):');
+{
+  // A control plane that co-hosts a game (OTB = customer 0) has a GAME-branded publicOrigin.
+  // provisioningOrigin is the dedicated front door the customer's GitHub App must point at,
+  // so mothershipOrigin() must prefer it over publicOrigin. mothershipOrigin() calls
+  // api.branding() (module-api captured the fn ref at require-time), so override THAT.
+  const prevBranding = api.branding;
+  api.branding = () => ({ ...realBranding(), identity: { productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://amazonprimea.com', provisioningOrigin: 'https://get.cloudbongos.com' } });
+  const res = await fetch(`${base}/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+  const j = await res.json();
+  t('redirect_url uses provisioningOrigin, not the game publicOrigin', j.manifest && j.manifest.redirect_url === 'https://get.cloudbongos.com/api/bongos/provisioning/github-app/callback', j.manifest && j.manifest.redirect_url);
+  t('webhook hook_attributes.url also uses provisioningOrigin', j.manifest && j.manifest.hook_attributes && j.manifest.hook_attributes.url === 'https://get.cloudbongos.com/api/bongos/provisioning/github-app/webhook', j.manifest && j.manifest.hook_attributes && j.manifest.hook_attributes.url);
+  api.branding = prevBranding;
+}
+
 console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect):');
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=GHCODE123&state=GOODSTATE`);

package/tests/publish_manifest.mjs

@@ -44,13 +44,13 @@ const PUBLISH = [
   'scripts/gds/ship.js',                   // the ship/grade pipeline publishes (sans secrets)
   'scripts/gds/publish-manifest.js',
   'scripts/migrate.sh',
-  'server.js',
   'migrations/182_some_change.sql',
   'tests/publish_manifest.mjs',
   'modules/lifecycle/db.js',
   'modules/grading/grader.js',
   'modules/hall-ui/public/work.js',
   'modules/dev-box/boxes.js',
+  'modules/provisioning/provisioning.js',  // instance-hosting control plane — CORE like its sibling dev-box (task 2135)
   // served-at-runtime surfaces a standalone must carry (task 2078) — their absence
   // from the packaged core 404'd the hall UI + /docs on demo.cloudbongos.com
   'clients/bongos-client/bongos-client.global.js', // /lib/bongos-client.js (window.BongosClient)
@@ -91,8 +91,19 @@ const EXCLUDE = [
   'src/world/terrain.js',
   'src/rooms/WorldRoom.js',
   'src/preview-server.js',
+  'server.js',                             // repo-root game+platform entry (top-level require('colyseus')); the core boots via src/platform-server.js (task 2134)
   'scripts/art/orchestrate.js',            // art-feature tooling under scripts/ (legacy location)
+  'scripts/gds/art-stage.js',              // art sandbox-staging CLI (requires modules/art-pipeline); excluded with the art feature (task 2135)
   'scripts/tile-add.js',
+  // host-feature tests that statically import an excluded module's source: shipped in the
+  // core package they'd MODULE_NOT_FOUND; excluded with the feature they cover (task 2147)
+  'tests/walkability.mjs',
+  'tests/terrain_picker.mjs',
+  'tests/snapshot_picker.mjs',
+  'tests/sprite_facing.mjs',
+  'tests/turn_in_place.mjs',
+  'tests/day_cycle.mjs',
+  'tests/art_key.mjs',
   // instance identity + history
   'config/branding.json',
   'config/modules.json',
@@ -106,6 +117,7 @@ const EXCLUDE = [
   'blockers/blockers.md',
   'limitations/v1-shipped.md',
   'generative-ideas.md',
+  'migrations/instance/018_pms_v3_planning_seed.sql',   // instance seed migrations = host scope-truth (ADR 0105, task 2140)
   '.env.local',
   // topology / deploy / CI / local gate hooks / secrets — read-sensitive docs
   'infra/Caddyfile',
@@ -180,5 +192,44 @@ t('allowlist + denylist are non-empty arrays of strings', () => {
   for (const g of [...PUBLISH_ALLOWLIST, ...PUBLISH_DENYLIST]) assert.equal(typeof g, 'string');
 });
 
+// ── R89 split guard: no PUBLISHABLE test may statically import an EXCLUDED module ─────
+// tests/ is allowlisted, but a test that imports host-module source (game / art-pipeline)
+// would ship inside the @bongos/core package WITHOUT that module → MODULE_NOT_FOUND when a
+// core CI/consumer runs it, and the cutover would delete OTB's own host tests. Every such
+// test must be host-excluded (see CONTENT_EXCLUDE). This DERIVES the set from disk so a NEW
+// host-module test can't slip in unlisted (the enumerated assertions above would miss it).
+// Static relative-literal imports only — temp-dir fixtures (modules/alpha, …) use path.join,
+// so they never match; a module name appearing only as string DATA (this file's own arrays)
+// isn't in a require()/import statement, so it never matches either. (task 2147)
+t('no publishable test statically imports an excluded module (R89 boundary)', () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { fileURLToPath } = require('node:url');
+  const testsDir = path.dirname(fileURLToPath(import.meta.url));
+  const IMPORT_RE = /(?:require|import)\s*\(\s*["'](\.\.?\/[^"']*?)modules\/([a-z0-9][a-z0-9-]*)\/[^"']*["']|from\s+["'](\.\.?\/[^"']*?)modules\/([a-z0-9][a-z0-9-]*)\/[^"']*["']/g;
+  const detected = [];   // test files that import ANY excluded module (non-vacuous check)
+  const offenders = [];  // …and are still publishable (the actual failure)
+  for (const name of fs.readdirSync(testsDir)) {
+    if (!/\.(mjs|js|cjs)$/.test(name)) continue;
+    const rel = `tests/${name}`;
+    const bad = new Set();
+    let m; IMPORT_RE.lastIndex = 0;
+    const src = fs.readFileSync(path.join(testsDir, name), 'utf8');
+    while ((m = IMPORT_RE.exec(src))) {
+      const key = m[2] || m[4];
+      if (key && !isPublishable(`modules/${key}/module.json`)) bad.add(key);
+    }
+    if (bad.size === 0) continue;
+    detected.push(rel);
+    if (isPublishable(rel)) {
+      offenders.push(`${rel} imports excluded module(s) [${[...bad].sort().join(', ')}] but is still PUBLISHABLE — add it to CONTENT_EXCLUDE (task 2147)`);
+    }
+  }
+  // non-vacuous: the scan must actually SEE the known host tests (a broken regex that
+  // matched nothing would otherwise pass silently). The 7 game/art tests are the floor.
+  assert.ok(detected.length >= 7, `expected ≥7 host-module tests detected, saw ${detected.length} — the import scan may be broken`);
+  assert.equal(offenders.length, 0, '\n        ' + offenders.join('\n        '));
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);