@bongos/core 1.18.19 → 1.19.2

package/tests/provisioning_onboard_mode.mjs

@@ -0,0 +1,180 @@
+// tests/provisioning_onboard_mode.mjs
+//
+// The onboard_mode leg of brownfield onboarding (ADR 0121, task 1002562, migration
+// provisioning_004). Before this, greenfield-vs-adopt existed ONLY as a query param on
+// GET /provisioning/onboard-plan that chose which checklist TEXT to render — it was never
+// persisted, so the control-plane runner ran the greenfield scaffold unconditionally and
+// adopting an existing repo always failed as an unrelated-history non-fast-forward.
+//
+// Covers the two layers that carry the mode from the browser to the runner:
+//   • createInstance   — normalization (unknown/absent → greenfield) + what reaches SQL
+//   • POST /instances  — validation + threading, driven over a real mounted router
+//   • publicInstance   — the mode is readable back out (coalesced for pre-004 rows)
+//
+// DB-free: the pool is a recording fake and the data-access fns the route needs are
+// stubbed on the cached module object. No network.
+//
+// Run:  node tests/provisioning_onboard_mode.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const ROOT = new URL('..', import.meta.url).pathname;
+
+const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── createInstance: normalization + what actually reaches SQL ─────────────────────
+// A recording pool: capture the INSERT's params so we assert the STORED value, not just
+// the returned row (a normalization bug that only shows up in the column is the one that
+// would silently mislabel a row forever).
+function recordingDb(returnRow = {}) {
+  const calls = [];
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text, params });
+      return { rows: [{ id: 1, owner_builder_id: 7, slug: 'demo', ...returnRow }] };
+    },
+  };
+}
+
+await ta('createInstance: onboardMode "adopt" is persisted', async () => {
+  const db = recordingDb();
+  await provisioning.createInstance(db, {
+    ownerBuilderId: 7, slug: 'demo', targetRef: 'lars589/demo',
+    hostingShape: 'standalone', onboardMode: 'adopt',
+  });
+  const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
+  assert.ok(insert, 'issued an INSERT');
+  assert.match(insert.text, /onboard_mode/, 'the column is in the INSERT');
+  assert.ok(insert.params.includes('adopt'), `'adopt' reached the INSERT params (got ${JSON.stringify(insert.params)})`);
+});
+
+await ta('createInstance: absent / unknown onboardMode → greenfield, the SAFE default', async () => {
+  // Greenfield refuses to push over existing history (no --force anywhere), so an
+  // unrecognized value must land there. Defaulting to 'adopt' would put the layering path
+  // on a repo nobody declared as pre-existing.
+  for (const mode of [undefined, null, '', 'ADOPT', 'brownfield', 'nonsense']) {
+    const db = recordingDb();
+    await provisioning.createInstance(db, {
+      ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', onboardMode: mode,
+    });
+    const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
+    assert.ok(insert.params.includes('greenfield'), `onboardMode=${JSON.stringify(mode)} → greenfield`);
+    assert.ok(!insert.params.includes('adopt'), `onboardMode=${JSON.stringify(mode)} must NOT become adopt`);
+  }
+});
+
+t('ONBOARD_MODES matches the provisioning_004 CHECK constraint', () => {
+  assert.deepEqual(provisioning.ONBOARD_MODES, ['greenfield', 'adopt']);
+});
+
+t('publicInstance: surfaces onboard_mode, coalescing a pre-004 row to greenfield', () => {
+  assert.equal(provisioning.publicInstance({ id: 1, onboard_mode: 'adopt' }).onboard_mode, 'adopt');
+  // A row read before the column existed (or a NULL) reads as greenfield — which is what
+  // it was, by construction: there was no other scaffold path.
+  assert.equal(provisioning.publicInstance({ id: 1 }).onboard_mode, 'greenfield');
+  assert.equal(provisioning.publicInstance({ id: 1, onboard_mode: null }).onboard_mode, 'greenfield');
+});
+
+// ── POST /provisioning/instances over a real mounted router ───────────────────────
+let lastCreateArgs = null;
+provisioning.createInstance = async (_db, args) => {
+  lastCreateArgs = args;
+  return { instance: { id: 42, owner_builder_id: 7, slug: args.slug, onboard_mode: args.onboardMode }, created: true };
+};
+provisioning.enqueueIntent = async () => ({ intent: { id: 1, state: 'pending' }, created: true });
+provisioning.recordEvent = async () => {};
+provisioning.getInstanceBySlug = async () => null;
+
+const api = require(`${ROOT}/src/module-api.js`);
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+
+const express = require('express');
+const provisioningRoutes = require(`${ROOT}/modules/provisioning/routes/provisioning.js`);
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+await ta('POST /instances: onboard_mode=adopt is threaded through to createInstance', async () => {
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', {
+    slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', onboard_mode: 'adopt',
+  });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'adopt');
+});
+
+await ta('POST /instances: onboard_mode absent → greenfield (unchanged behavior for every existing caller)', async () => {
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone' });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'greenfield');
+});
+
+await ta('POST /instances: an unknown onboard_mode is REFUSED (never silently coerced)', async () => {
+  // Coercing here would be worse than refusing: the caller believes it asked for one thing
+  // and the runner does another. The route names the valid set so the client can fix itself.
+  const res = await post('/provisioning/instances', {
+    slug: 'demo', hosting_shape: 'standalone', target_ref: 'a/b', onboard_mode: 'brownfield',
+  });
+  assert.equal(res.status, 400);
+  assert.equal(res.body.error.code, 'bad_onboard_mode');
+  assert.deepEqual(res.body.error.valid, ['greenfield', 'adopt']);
+});
+
+await ta('POST /instances: adopt WITHOUT target_ref is refused — there is no repo to layer onto', async () => {
+  // Without target_ref the runner would fall back to greenfield behavior on a row labelled
+  // adopt. Refuse at the door rather than store a lie.
+  for (const body of [
+    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt' },
+    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt', target_ref: '   ' },
+  ]) {
+    const res = await post('/provisioning/instances', body);
+    assert.equal(res.status, 400, `expected 400 for ${JSON.stringify(body)}`);
+    assert.equal(res.body.error.code, 'target_ref_required_for_adopt');
+  }
+});
+
+server.close();
+console.log(`\nprovisioning_onboard_mode: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/publish_manifest.mjs

@@ -211,6 +211,9 @@ t('no publishable test statically imports an excluded module (R89 boundary)', ()
   const offenders = [];  // …and are still publishable (the actual failure)
   for (const name of fs.readdirSync(testsDir)) {
     if (!/\.(mjs|js|cjs)$/.test(name)) continue;
+    // Skip self: the regex specimens below are deliberate full import forms;
+    // this file's real imports pull scripts/gds code only, never modules/.
+    if (name === 'publish_manifest.mjs') continue;
     const rel = `tests/${name}`;
     const bad = new Set();
     let m; IMPORT_RE.lastIndex = 0;
@@ -225,9 +228,19 @@ t('no publishable test statically imports an excluded module (R89 boundary)', ()
       offenders.push(`${rel} imports excluded module(s) [${[...bad].sort().join(', ')}] but is still PUBLISHABLE — add it to CONTENT_EXCLUDE (task 2147)`);
     }
   }
-  // non-vacuous: the scan must actually SEE the known host tests (a broken regex that
-  // matched nothing would otherwise pass silently). The 7 game/art tests are the floor.
-  assert.ok(detected.length >= 7, `expected ≥7 host-module tests detected, saw ${detected.length} — the import scan may be broken`);
+  // non-vacuous: prove the regex itself extracts a module key from every import
+  // form it claims to cover. A repo-state floor ("must see ≥7 host tests") went
+  // stale the moment the host-module tests moved to modules/<key>/tests/ under
+  // ADR 0107 — tests/ can legitimately contain zero live specimens (task 1002611).
+  for (const [specimen, key] of [
+    [`const x = require('../modules/game/db.js')`, 'game'],
+    [`import x from '../../modules/art-pipeline/pipeline/palette.js'`, 'art-pipeline'],
+    [`const y = await import('./modules/some-key/loader.js')`, 'some-key'],
+  ]) {
+    IMPORT_RE.lastIndex = 0;
+    const m = IMPORT_RE.exec(specimen);
+    assert.ok(m && (m[2] || m[4]) === key, `import scan no longer matches: ${specimen}`);
+  }
   assert.equal(offenders.length, 0, '\n        ' + offenders.join('\n        '));
 });
 

package/tests/publish_reconciler.mjs

@@ -58,7 +58,7 @@ function mkDeps({
   refreshStaleImpl,
   healAttempts = new Map(),
 } = {}) {
-  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], logs: [], errors: [] };
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], events: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
   // option-like / traversal refs); we use the REAL module so the contract can't drift.
   const githubPush = require('../modules/lifecycle/github-push.js');
@@ -108,23 +108,33 @@ function mkDeps({
         return !!a;
       },
       // task 1547 per-task land proof. Mirrors the real github-push.landProvenForTask
-      // shape but routes its ONE network hop (the ancestry compare) through the mock
+      // shape but routes its network hops (the ancestry compares) through the mock
       // above so the sweep stays DB/network-free, and reuses the REAL prReferencesTask
       // so that pure check can't drift. publishedSha (the server-pushed tip) is the
-      // robust proof; the matched-PR-references-this-task fallback covers a legacy /
-      // in-flight row with no recorded tip.
+      // robust proof; task 1002615 adds the merged-PR merge-commit proof (out-of-band /
+      // squash land) and gates the no-tip reference fallback on merged:true, because
+      // the sweep now consults this proof even while a PR is still in flight.
       landProvenForTask: async ({ taskId, publishedSha, status }) => {
-        if (publishedSha && /^[0-9a-f]{7,64}$/.test(String(publishedSha))) {
+        const hasTip = !!(publishedSha && /^[0-9a-f]{7,64}$/.test(String(publishedSha)));
+        if (hasTip) {
           calls.ancestry.push(publishedSha);
           const a = ancestryBySha[publishedSha];
           if (a instanceof Error) throw a;
-          return a
-            ? { proven: true, reason: `published tip ${publishedSha.slice(0, 8)} in main` }
-            : { proven: false, reason: `published tip ${publishedSha.slice(0, 8)} not in main` };
+          if (a) return { proven: true, reason: `published tip ${publishedSha.slice(0, 8)} in main` };
         }
-        return githubPush.prReferencesTask(status, taskId)
+        if (status && status.merged === true && githubPush.prReferencesTask(status, taskId)
+            && status.merge_sha && /^[0-9a-f]{7,64}$/.test(String(status.merge_sha))) {
+          calls.ancestry.push(status.merge_sha);
+          const m = ancestryBySha[status.merge_sha];
+          if (m instanceof Error) throw m;
+          if (m) return { proven: true, reason: `merged PR for task ${taskId} — merge in main (out-of-band/squash land)` };
+        }
+        if (hasTip) {
+          return { proven: false, reason: `published tip ${publishedSha.slice(0, 8)} not in main` };
+        }
+        return (status && status.merged === true && githubPush.prReferencesTask(status, taskId))
           ? { proven: true, reason: `matched PR references task ${taskId}` }
-          : { proven: false, reason: `no published tip and matched PR does not reference task ${taskId}` };
+          : { proven: false, reason: `no published tip and no merged PR references task ${taskId}` };
       },
     },
     // task.shipped is emitted on the kernel seam now; the discord module's listener
@@ -133,6 +143,9 @@ function mkDeps({
     // broadcastImpl REPLACES the default push (the throwing-broadcast test relies
     // on that to prove the reconcile stands even when the listener throws).
     emit: async (event, task) => {
+      // task 1002606: record EVERY seam event so the strand push channel
+      // (task.strand-flagged) is observable alongside task.shipped.
+      calls.events.push({ event, payload: task });
       if (event !== 'task.shipped') return;
       if (broadcastImpl) return broadcastImpl(task);
       calls.broadcast.push(task.id);
@@ -307,6 +320,50 @@ test('1002472 merged + deploy unconfigured but tip NOT in main → NO ship (1547
   assert.equal(deps._calls.ship.length, 0);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002615 (idea 1000613) — a land made OUT-OF-BAND must still ship.
+// The 2026-07-29 reproduction: ship → confirmed → PR merged by the owner through
+// the web UI → the work verified on main → the task sat at 'confirmed' for 9+ min
+// (forever), builder unpaid, until a manual POST /ship.
+// ---------------------------------------------------------------------------
+const MERGE_SHA = 'c'.repeat(40);
+
+test('1002615 web-UI squash merge (tip rewritten, PR merged) → ships via the merge-commit proof', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 80, builder_id: 3, worktree_name: 'wt-squash', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-squash': { ...landedPrFor(80), deploy_status: 'unconfigured', merge_sha: MERGE_SHA } },
+    ancestryBySha: { [NOT_ON_MAIN]: false, [MERGE_SHA]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'a squash-rewritten land must not strand unpaid');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 80, builderId: 3 }]);
+  assert.deepEqual(deps._calls.broadcast, [80]);
+});
+
+test('1002615 manual git merge to main, PR closed un-merged → tip ancestry ships it (prNotLanded no longer suppresses the proof)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 81, builder_id: 3, worktree_name: 'wt-oob', published_head_sha: ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-oob': { pr_state: 'closed', merged: false, merge_sha: null, deploy_status: 'pending' } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'work on main behind a dead PR must still land');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 81, builderId: 3 }]);
+});
+
+test('1002615 the reuse guard holds: merged PR for a DIFFERENT task + tip not in main → NO ship', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 82, builder_id: 3, worktree_name: 'wt-reused', published_head_sha: NOT_ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-reused': { ...landedPrFor(999), deploy_status: 'unconfigured', merge_sha: MERGE_SHA } },
+    ancestryBySha: { [NOT_ON_MAIN]: false, [MERGE_SHA]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'the merge-commit proof must bind to THIS task');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
 test('getPublishStatus throws (transient) → swallowed, sweep continues to the next task', async () => {
   const deps = mkDeps({
     rows: [
@@ -906,6 +963,120 @@ test('1002461 the WARN re-arms once a credential appears and then disappears aga
   assert.equal(badAgain._calls.errors.length, 1, 'a credential LOSS after a healthy period must warn again');
 });
 
+// ---------------------------------------------------------------------------
+// task 1002606 (finding P-3, the DETECTION half) — a strand reaches its builder
+// when it is DETECTED, not at the 30-minute stale WARN. Definitive shapes flag
+// needs_rebase on the sweep that sees them AND emit task.strand-flagged (the
+// push channel Discord listens on); ambiguous shapes keep the 30-min grace.
+// ---------------------------------------------------------------------------
+
+test('1002606 a hand-written conflict flags needs_rebase IMMEDIATELY (not at the 30-min WARN), with the file list', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 500, builder_id: 6, worktree_name: 'wt-hand', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }], // FRESH — no stale grace involved
+    mergeByBranch: { 'claude/wt-hand': { merged: false, merged_now: false, number: 500, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: false, skipped: 'unresolvable_conflict', conflicted: ['src/bongos/db.js'] }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 1, 'flagged on THIS sweep, minutes after the conflict — not 30 later');
+  assert.equal(deps._calls.flag[0].taskId, 500);
+  assert.match(deps._calls.flag[0].reason, /^strand:unresolvable_conflict:src\/bongos\/db\.js/, 'the reason names the conflicted file so /builder-start says WHERE');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 500/.test(m) && /hand-written conflict/.test(m)), 'WARN\'d with the concrete cause');
+  assert.equal(r.strandsFlagged, 1);
+  assert.equal(r.reconciled, 0, 'a conflicted PR still never ships');
+});
+
+test('1002606 every NEW needs_rebase flag emits task.strand-flagged (the push channel)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 501, builder_id: 6, worktree_name: 'wt-hand2', title: 'the title', security_sensitive: true,
+             confirmed_at: new Date().toISOString() }],
+    mergeByBranch: { 'claude/wt-hand2': { merged: false, merged_now: false, number: 501, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: false, skipped: 'unresolvable_conflict', conflicted: ['a.js'] }),
+  });
+  await reconciler.runSweep(deps);
+  const strandEvents = deps._calls.events.filter((e) => e.event === 'task.strand-flagged');
+  assert.equal(strandEvents.length, 1, 'exactly one push event per new flag');
+  assert.equal(strandEvents[0].payload.id, 501);
+  assert.equal(strandEvents[0].payload.builder_id, 6);
+  assert.equal(strandEvents[0].payload.security_sensitive, true, 'the security flag rides along so the listener can route safely');
+  assert.match(strandEvents[0].payload.reason, /^strand:unresolvable_conflict/);
+});
+
+test('1002606 an ALREADY-flagged strand does not re-emit (flagTaskNeedsRebase idempotence gates the event)', async () => {
+  const old = new Date(Date.now() - 50 * 3_600_000).toISOString();
+  const deps = mkDeps({
+    rows: [{ task_id: 502, builder_id: 6, worktree_name: null, published_head_sha: null, confirmed_at: old }],
+  });
+  deps.db.flagTaskNeedsRebase = async () => false; // already flagged on a prior sweep
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.events.filter((e) => e.event === 'task.strand-flagged').length, 0,
+    'a re-sweep of a flagged strand must not spam the channel');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 502/.test(m) && /needs_rebase already set/.test(m)),
+    'the WARN line still fires for journal visibility');
+});
+
+test('1002606 a PR CLOSED without merging is DEFINITIVE — flagged fresh, no 30-min grace', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 503, builder_id: 8, worktree_name: 'wt-deadpr', published_head_sha: NOT_ON_MAIN,
+             confirmed_at: new Date().toISOString() }], // FRESH
+    statusByBranch: { 'claude/wt-deadpr': { pr_state: 'closed', merged: false, merge_sha: null, deploy_status: 'none' } },
+    ancestryBySha: { [NOT_ON_MAIN]: false }, // and the work is NOT on main out-of-band
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.flag, [{ taskId: 503, reason: 'strand:pr_closed_unmerged' }],
+    'a dead PR will never land on its own — the builder is told now');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 503/.test(m) && /closed without merging/.test(m)));
+  assert.equal(r.strandsFlagged, 1);
+  assert.equal(r.staleStrands, 0, 'not an AGED strand — this is the immediate path');
+});
+
+test('1002606 the 1002615 out-of-band land still wins over the dead-PR flag (proof runs first)', async () => {
+  // Same closed-unmerged PR shape, but the work IS on main — it must ship, not flag.
+  const deps = mkDeps({
+    rows: [{ task_id: 504, builder_id: 8, worktree_name: 'wt-oob2', published_head_sha: ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-oob2': { pr_state: 'closed', merged: false, merge_sha: null, deploy_status: 'none' } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'landed work behind a dead PR ships (1002615)');
+  assert.equal(deps._calls.flag.length, 0, 'a landed task is never flagged');
+});
+
+test('1002606 an OPEN PR still gets the grace — fresh, not flagged (CI may be legitimately running)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 505, builder_id: 8, worktree_name: 'wt-open2', confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-open2': PENDING },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0, 'an in-flight open PR is not a definitive strand');
+  assert.equal(r.strandsFlagged, 0);
+});
+
+test('1002606 a MERGED PR mid-deploy keeps the grace (merged=true never hits the dead-PR path)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 506, builder_id: 8, worktree_name: 'wt-middeploy', published_head_sha: ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-middeploy': { pr_state: 'closed', merged: true, merge_sha: 'cafe1234', deploy_status: 'pending' } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0, 'a merge whose deploy is finishing is the NORMAL landing window');
+  assert.equal(r.reconciled, 0, 'the deploy gate still governs (1002615 exception intact)');
+});
+
+test('1002606 the aged stale strand now ALSO emits task.strand-flagged', async () => {
+  const old = new Date(Date.now() - 50 * 3_600_000).toISOString();
+  const deps = mkDeps({
+    rows: [{ task_id: 507, builder_id: 9, worktree_name: null, published_head_sha: null, confirmed_at: old }],
+  });
+  await reconciler.runSweep(deps);
+  const strandEvents = deps._calls.events.filter((e) => e.event === 'task.strand-flagged');
+  assert.equal(strandEvents.length, 1);
+  assert.equal(strandEvents[0].payload.id, 507);
+  assert.match(strandEvents[0].payload.reason, /^strand:no_branch_no_tip/);
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);

package/tests/rank_tier_single_source.mjs

@@ -0,0 +1,205 @@
+// tests/rank_tier_single_source.mjs — the rank-tier single-source guard (BV1.R108).
+//
+// The canonical rank → tier map is db-kernel.RANK_TIER, DERIVED from
+// LIVE_RANK_LADDER and exposed on the doorway (api.RANK_TIER). This guard makes
+// the collapse hold three ways:
+//
+//   1. IMPORTABLE code holds the SAME OBJECT, not a copy — modules/lifecycle/db.js
+//      (the claim-floor brain) and the doorway getter are Object.is-identical to
+//      the kernel map.
+//   2. Every DELIBERATELY-LOCAL copy is pinned byte-equivalent. These exist for
+//      documented reasons and may not be force-merged (the D1 decision,
+//      modules/discord/discord-channels.js): dependency-free substrate
+//      (permission-path-check runs in a bare git hook), source-parsed literals
+//      (src/bongos/db.js — gate-review.js + diagram-facts.js regex its text),
+//      standalone CLIs (sequence, box-connect-lib), the require-free dev-box
+//      module template (boxes.js), zero-dep catalog + its text-parsing auditor
+//      (route-rank-check), and the hall browser statics.
+//   3. NO NEW parallel map can land: a repo scan flags any rank→number map or
+//      rank-ladder array literal outside the allowlist below, both directions —
+//      an unlisted literal fails, and a stale allowlist entry fails too.
+//
+// Run:  node tests/rank_tier_single_source.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const kernel = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const coreDb = require(path.join(ROOT, 'src', 'bongos', 'db.js'));
+const lifecycleDb = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
+const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
+const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+const sequence = require(path.join(ROOT, 'scripts', 'gds', 'sequence.js'));
+const boxConnect = require(path.join(ROOT, 'scripts', 'gds', 'box-connect-lib.js'));
+const boxes = require(path.join(ROOT, 'modules', 'dev-box', 'boxes.js'));
+const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+
+const LADDER = kernel.LIVE_RANK_LADDER;
+const TIER = kernel.RANK_TIER;
+const RANK_KEYS = ['xenos', 'thetes', 'metic', 'archon'];
+
+// ===========================================================================
+// 1 — the canonical derivation
+// ===========================================================================
+
+test('RANK_TIER is derived from LIVE_RANK_LADDER (1-based) and frozen', () => {
+  assert.deepEqual(LADDER, RANK_KEYS, 'the live ladder itself changed — update this guard deliberately');
+  assert.ok(Object.isFrozen(TIER));
+  assert.deepEqual(TIER, Object.fromEntries(LADDER.map((r, i) => [r, i + 1])));
+});
+
+test('the doorway and the lifecycle brain hold the SAME object, not copies', () => {
+  assert.ok(Object.is(api.RANK_TIER, TIER), 'api.RANK_TIER must be the kernel map itself');
+  assert.ok(Object.is(api.LIVE_RANK_LADDER, LADDER));
+  assert.ok(Object.is(lifecycleDb.REQUIRES_RANK_TIER, TIER),
+    'modules/lifecycle/db.js must derive from the doorway, never hand-copy');
+});
+
+// ===========================================================================
+// 2 — every deliberately-local copy is pinned
+// ===========================================================================
+
+test('src/bongos/db.js literal (the source-parsed brain) matches the kernel map', () => {
+  assert.deepEqual(coreDb.REQUIRES_RANK_TIER, TIER);
+  // The literal must stay PARSEABLE TEXT — gate-review.js's root-of-trust region
+  // watch and diagram-facts.js both regex it out of the source.
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'db.js'), 'utf8');
+  const m = /REQUIRES_RANK_TIER\s*=\s*\{([^}]*)\}/.exec(src);
+  assert.ok(m, 'db.js must keep an inline REQUIRES_RANK_TIER object literal');
+  assert.deepEqual(parsePairs(m[1]), TIER, 'the db.js literal text drifted from the kernel map');
+});
+
+test('1-based local copies match: permission-path-check, sequence CLI', () => {
+  assert.deepEqual(ppc.RANK_TIER, TIER, 'permission-path-check drifted — the #863 failure class');
+  assert.deepEqual(sequence.RANK_TIER, TIER, 'sequence.js CLI copy drifted');
+});
+
+test('0-based local copies match: box-connect-lib CLI, dev-box boxes.js', () => {
+  for (const [name, map] of [['box-connect-lib', boxConnect.RANK_ORDER], ['boxes', boxes.RANK_ORDER]]) {
+    assert.deepEqual(Object.keys(map).sort(), [...RANK_KEYS].sort(), `${name} keys drifted`);
+    for (const r of RANK_KEYS) {
+      assert.equal(map[r], TIER[r] - 1, `${name}.RANK_ORDER.${r} must be tier-1 (0-based)`);
+    }
+  }
+});
+
+test('ladder mirrors match: governance catalog, route-rank-check', () => {
+  assert.deepEqual([...catalog.RANK_ORDER], [...LADDER]);
+  assert.deepEqual([...rrc.PERMISSION_RANK_ORDER], [...LADDER]);
+});
+
+// Files that cannot require server code (browser statics, dependency-free
+// module CLIs) — their literal must be EXACTLY the canonical form. The loose
+// scanner below flags any rank-ish literal in these files; this exact check is
+// what turns "flagged but allowlisted" into "provably not drifted".
+const EXACT_LADDER_RE = /\[\s*'xenos',\s*'thetes',\s*'metic',\s*'archon'\s*\]/;
+const STATIC_LADDER_FILES = [
+  'modules/discord/discord-channels.js',
+  'modules/memory/search.js',
+  'modules/hall-ui/public/ranks.js',
+  'modules/hall-ui/public/profile.js',
+  'modules/hall-ui/public/watch.js',
+];
+test('static ladder copies carry the exact canonical ladder', () => {
+  for (const rel of STATIC_LADDER_FILES) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    assert.ok(EXACT_LADDER_RE.test(src), `${rel}: ladder literal missing or drifted from canonical order`);
+  }
+});
+
+const STATIC_MAP_FILES = ['modules/hall-ui/public/builders.js', 'modules/hall-ui/public/goals-page.js'];
+test('hall static tier maps match the kernel map', () => {
+  for (const rel of STATIC_MAP_FILES) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    const maps = extractRankMaps(src);
+    assert.ok(maps.length > 0, `${rel}: expected a rank tier map`);
+    for (const map of maps) assert.deepEqual(map, TIER, `${rel}: tier map drifted`);
+  }
+});
+
+// ===========================================================================
+// 3 — the reintroduction scanner (both directions vs the allowlist)
+// ===========================================================================
+
+// Where a rank→number map literal is allowed to exist (each is pinned above).
+const MAP_ALLOWLIST = new Set([
+  'src/bongos/db.js',
+  'src/bongos/permission-path-check.js',
+  'scripts/gds/sequence.js',
+  'scripts/gds/box-connect-lib.js',
+  'modules/dev-box/boxes.js',
+  'modules/hall-ui/public/builders.js',
+  'modules/hall-ui/public/goals-page.js',
+]);
+// Where a rank-ladder array literal is allowed to exist.
+const LADDER_ALLOWLIST = new Set([
+  'src/bongos/db-kernel.js', // the canonical source itself
+  'modules/governance/catalog.js',
+  'src/bongos/route-rank-check.js',
+  ...STATIC_LADDER_FILES,
+]);
+
+// A rank→digit pair inside an object block. Hex values (RANK_COLORS) never
+// match: \d+ must run straight into , or }.
+const pairRe = (rank) => new RegExp(`(?:^|[{,\\s'"])${rank}['"]?\\s*:\\s*\\d+\\s*[,}]`);
+// ≥3 rank keys with digit values in one object literal = a tier map — including
+// the drifted 3-key shape that caused #863 (a rank silently missing).
+function hasRankMap(src) {
+  for (const m of src.matchAll(/\{[^{}]*\}/g)) {
+    if (RANK_KEYS.filter((r) => pairRe(r).test(m[0])).length >= 3) return true;
+  }
+  return false;
+}
+function parsePairs(inner) {
+  const out = {};
+  for (const m of inner.matchAll(/([a-z]+)['"]?\s*:\s*(\d+)/g)) out[m[1]] = Number(m[2]);
+  return out;
+}
+function extractRankMaps(src) {
+  const out = [];
+  for (const m of src.matchAll(/\{[^{}]*\}/g)) {
+    if (RANK_KEYS.filter((r) => pairRe(r).test(m[0])).length >= 3) {
+      out.push(parsePairs(m[0].slice(1, -1)));
+    }
+  }
+  return out;
+}
+// ≥3 CONSECUTIVE live-rank strings in one array literal = a ladder copy.
+const LOOSE_LADDER_RE = /\[\s*(?:['"](?:xenos|thetes|metic|archon)['"]\s*,?\s*){3,}\]/;
+
+test('no rank map or ladder literal exists outside the allowlist (and none is stale)', () => {
+  const tracked = execFileSync('git', ['-C', ROOT, 'ls-files', 'src', 'modules', 'scripts'], { encoding: 'utf8' })
+    .split('\n').map((l) => l.trim())
+    .filter((f) => f.endsWith('.js') && !f.includes('/tests/') && !f.endsWith('.test.js'));
+  assert.ok(tracked.length > 50, `suspiciously few tracked files (${tracked.length}) — scanner broken?`);
+
+  const mapHits = new Set();
+  const ladderHits = new Set();
+  for (const rel of tracked) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    if (hasRankMap(src)) mapHits.add(rel);
+    if (LOOSE_LADDER_RE.test(src)) ladderHits.add(rel);
+  }
+  for (const f of mapHits) {
+    assert.ok(MAP_ALLOWLIST.has(f),
+      `${f} declares a rank→tier map literal. Derive it from api.RANK_TIER / db-kernel.RANK_TIER instead — or, if it genuinely cannot require server code, add it here WITH a pinning assertion above.`);
+  }
+  for (const f of ladderHits) {
+    assert.ok(LADDER_ALLOWLIST.has(f),
+      `${f} declares a rank-ladder array literal. Derive it from api.LIVE_RANK_LADDER instead — or, if it genuinely cannot require server code, add it here WITH a pinning assertion above.`);
+  }
+  for (const f of MAP_ALLOWLIST) {
+    assert.ok(mapHits.has(f), `allowlist entry ${f} no longer contains a rank map — prune it`);
+  }
+  for (const f of LADDER_ALLOWLIST) {
+    assert.ok(ladderHits.has(f), `allowlist entry ${f} no longer contains a ladder literal — prune it`);
+  }
+});