@bongos/core 1.18.3 → 1.18.18

package/tests/publish_reconciler.mjs

@@ -58,11 +58,14 @@ function mkDeps({
   refreshStaleImpl,
   healAttempts = new Map(),
 } = {}) {
-  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], logs: [], errors: [] };
-  const realLandConfirmed = (s) => !!s && s.merged === true && s.deploy_status === 'success';
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
   // option-like / traversal refs); we use the REAL module so the contract can't drift.
   const githubPush = require('../modules/lifecycle/github-push.js');
+  // task 1002472: this was a hand-rolled copy of landConfirmed's rule, so a change to
+  // the real gate could not fail this suite. Use the real one — the whole point of a
+  // sweep test is that it exercises the sweep's ACTUAL land decision.
+  const realLandConfirmed = githubPush.landConfirmed;
   return {
     db: {
       listConfirmedTasksForReconcile: async () => rows,
@@ -70,6 +73,12 @@ function mkDeps({
         calls.ship.push({ taskId, builderId });
         return { id: taskId, value_summary: `task ${taskId}`, security_sensitive: false };
       }),
+      // ADR 0120 part 2: the reconciler flags an unlandable confirmed task for
+      // its builder. Recording spy — returns true (newly flagged) by default.
+      flagTaskNeedsRebase: async (taskId, reason) => {
+        calls.flag.push({ taskId, reason });
+        return true;
+      },
     },
     githubPush: {
       isConfigured: () => configured,
@@ -175,6 +184,29 @@ test('a landed branch → shipTask + broadcast fire, reconciled=1, attributed to
   assert.deepEqual(deps._calls.broadcast, [1096]);
 });
 
+test('ADR 0120: an aged-out unprovable strand → flagged needs_rebase for its builder, NOT shipped', async () => {
+  // No branch, no published tip, confirmed long ago → unprovable + stale.
+  const deps = mkDeps({
+    rows: [{ task_id: 700, builder_id: 25, worktree_name: null, published_head_sha: null,
+             confirmed_at: '2020-01-01T00:00:00Z' }],
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'a strand does not ship');
+  assert.equal(deps._calls.ship.length, 0, 'shipTask must not run for an unlandable strand');
+  assert.equal(deps._calls.flag.length, 1, 'the strand is flagged needs_rebase exactly once');
+  assert.equal(deps._calls.flag[0].taskId, 700, 'flagged the right task');
+  assert.match(deps._calls.flag[0].reason, /^strand:/, "reason records it as a strand (attribution is shipped_by = claim holder)");
+});
+
+test('ADR 0120: a recent unprovable confirmed task is NOT yet flagged (still within the land grace)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 701, builder_id: 25, worktree_name: null, published_head_sha: null,
+             confirmed_at: new Date().toISOString() }],
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0, 'a fresh confirmed task is given its grace before needs_rebase');
+});
+
 test('a not-yet-landed branch (open PR / pending deploy) → no ship', async () => {
   const deps = mkDeps({
     rows: [{ task_id: 5, builder_id: 1, worktree_name: 'wt-open' }],
@@ -195,6 +227,86 @@ test('merged but deploy NOT yet success → no ship (landConfirmed requires both
   assert.equal(r.reconciled, 0);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002472 — the sweep's give-up path must never be silent again.
+//
+// The `continue` that fired when a PR existed but had not fully landed sat BEFORE
+// the unprovable counter, the STALE WARN, and flagTaskNeedsRebase — so a merged-PR
+// task strand produced no log line, no counter, and no flag. That is why tasks
+// 1002427/1002428 sat 50h at 'confirmed' reporting needs_rebase: false.
+// ---------------------------------------------------------------------------
+test('1002472 an un-landed PR is COUNTED in unprovable, not silently skipped', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 60, builder_id: 1, worktree_name: 'wt-openpr',
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-openpr': PENDING },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'still must not ship an open PR');
+  assert.equal(deps._calls.ship.length, 0);
+  assert.equal(r.unprovable, 1, 'the miss is counted — this was the silent continue');
+});
+
+test('1002472 an AGED un-landed PR gets the STALE WARN + needs_rebase flag', async () => {
+  const old = new Date(Date.now() - 50 * 3_600_000).toISOString(); // 50h, like 1002427/1002428
+  const deps = mkDeps({
+    rows: [{ task_id: 61, builder_id: 7, worktree_name: 'wt-stale-pr', confirmed_at: old }],
+    statusByBranch: { 'claude/wt-stale-pr': { ...LANDED, deploy_status: 'pending' } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'a pending deploy still never ships');
+  assert.equal(r.staleStrands, 1, 'an aged merged-but-unlanded task is a strand');
+  assert.deepEqual(deps._calls.flag, [{ taskId: 61, reason: 'strand:pr_not_landed' }]);
+  assert.ok(
+    deps._calls.errors.some((e) => /STRAND task 61/.test(e)),
+    'the strand must be WARN\'d, not swallowed'
+  );
+});
+
+test('1002472 an un-landed PR does NOT ship even when the PR body references the task', async () => {
+  // The guard that matters: falling through to the observability block must not let
+  // landProvenForTask's no-published-tip fallback ship a PR that is still OPEN.
+  const deps = mkDeps({
+    rows: [{ task_id: 62, builder_id: 1, worktree_name: 'wt-open-selfref',
+             published_head_sha: null, confirmed_at: new Date().toISOString() }],
+    statusByBranch: {
+      'claude/wt-open-selfref': { ...PENDING, pr_number: 9, pr_title: 'task 62: x', pr_body: 'for task 62' },
+    },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.ship.length, 0, 'an OPEN PR referencing this task is still NOT a land');
+  assert.equal(r.unprovable, 1);
+});
+
+// ---------------------------------------------------------------------------
+// task 1002472 — an instance with no deploy-prod.yml (deploy_status 'unconfigured')
+// lands on the merge alone, but STILL only with per-task proof (task 1547).
+// ---------------------------------------------------------------------------
+const LANDED_NO_WORKFLOW = { ...LANDED, deploy_status: 'unconfigured' };
+
+test('1002472 merged + deploy unconfigured + published tip in main → ships', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 63, builder_id: 4, worktree_name: 'wt-nowf', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-nowf': LANDED_NO_WORKFLOW },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'no deploy workflow must not pin a real land at confirmed forever');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 63, builderId: 4 }]);
+  assert.deepEqual(deps._calls.broadcast, [63]);
+});
+
+test('1002472 merged + deploy unconfigured but tip NOT in main → NO ship (1547 proof intact)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 64, builder_id: 4, worktree_name: 'wt-nowf-reuse', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-nowf-reuse': LANDED_NO_WORKFLOW },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'relaxing the deploy gate must NOT relax the branch-reuse proof');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
 test('getPublishStatus throws (transient) → swallowed, sweep continues to the next task', async () => {
   const deps = mkDeps({
     rows: [
@@ -721,6 +833,79 @@ test('1915 the heal path never runs when the module lacks refreshStaleGenerated
   assert.equal(r.refreshedStale, 0, 'a missing heal fn is a clean no-op, not a crash');
 });
 
+// ---------------------------------------------------------------------------
+// task 1002461 — the silent-poller cure.
+//
+// runSweep's no-credential path returned {skipped:'unconfigured'} with NO log,
+// while start() unconditionally logged "started — sweeping confirmed→shipped
+// every Ns". The journal therefore showed a healthy poller that could never do
+// anything, and the stranding went unnoticed for 6+ days. Two fixes: say so
+// (once — per-tick would be spam), and name the RESOLVED owner/repo so a WRONG
+// repo bind is visible without owner access.
+// ---------------------------------------------------------------------------
+const REPO_OK = { owner: 'lars589', repo: 'cloud-bongos', branch: 'main' };
+const REPO_ERR = { error: 'no_repo_info', detail: 'git remote origin not parseable' };
+
+test('1002461 describeTarget names the resolved owner/repo and the credential state', () => {
+  const s = reconciler.describeTarget({ configured: true, repo: REPO_OK });
+  assert.match(s, /lars589\/cloud-bongos/, 'the resolved repo must be visible');
+  assert.match(s, /main/);
+  assert.match(s, /credential present/i);
+});
+
+test('1002461 describeTarget shouts when there is no credential', () => {
+  const s = reconciler.describeTarget({ configured: false, repo: REPO_OK });
+  assert.match(s, /NO PUSH CREDENTIAL/, 'the missing credential must be unmissable');
+  assert.match(s, /lars589\/cloud-bongos/, 'still names the repo — a wrong bind and a missing credential are separate faults');
+});
+
+test('1002461 describeTarget reports an unresolved repo instead of pretending', () => {
+  const s = reconciler.describeTarget({ configured: true, repo: REPO_ERR });
+  assert.match(s, /UNRESOLVED/);
+  assert.match(s, /git remote origin not parseable/, 'the detail is what makes it diagnosable');
+});
+
+// warnState is injected per test for the same reason healAttempts is: these tests
+// run concurrently, so a shared module-level latch would leak across them.
+test('1002461 an unconfigured sweep WARNs — the skip is no longer silent', async () => {
+  const deps = mkDeps({ configured: false, rows: [{ task_id: 1, builder_id: 9, worktree_name: 'wt' }] });
+  Object.assign(deps, { repoInfo: REPO_OK, warnState: { unconfigured: false } });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.skipped, 'unconfigured', 'still a no-op — this task only adds the log');
+  assert.equal(deps._calls.errors.length, 1, 'the skip must say so');
+  assert.match(deps._calls.errors[0], /NO PUSH CREDENTIAL/);
+  assert.match(deps._calls.errors[0], /lars589\/cloud-bongos/, 'names the repo it would have used');
+});
+
+test('1002461 the unconfigured WARN fires ONCE, not once per tick (no log spam)', async () => {
+  const deps = mkDeps({ configured: false, rows: [] });
+  Object.assign(deps, { repoInfo: REPO_OK, warnState: { unconfigured: false } });
+  await reconciler.runSweep(deps);
+  await reconciler.runSweep(deps);
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.errors.length, 1, '3 sweeps → 1 WARN; a 5-min poller would otherwise spam the journal');
+});
+
+test('1002461 the WARN re-arms once a credential appears and then disappears again', async () => {
+  const shared = { unconfigured: false }; // one latch across the three sweeps, as in production
+  const bad = mkDeps({ configured: false, rows: [] });
+  Object.assign(bad, { repoInfo: REPO_OK, warnState: shared });
+  await reconciler.runSweep(bad);
+  assert.equal(bad._calls.errors.length, 1);
+
+  // credential arrives → a sweep proceeds; the warn must re-arm so a LATER loss
+  // is reported instead of being swallowed by the first one.
+  const good = mkDeps({ configured: true, rows: [] });
+  Object.assign(good, { repoInfo: REPO_OK, warnState: shared });
+  await reconciler.runSweep(good);
+  assert.equal(shared.unconfigured, false, 'a healthy sweep re-arms the latch');
+
+  const badAgain = mkDeps({ configured: false, rows: [] });
+  Object.assign(badAgain, { repoInfo: REPO_OK, warnState: shared });
+  await reconciler.runSweep(badAgain);
+  assert.equal(badAgain._calls.errors.length, 1, 'a credential LOSS after a healthy period must warn again');
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);

package/tests/repo_info_binding.mjs

@@ -0,0 +1,248 @@
+// tests/repo_info_binding.mjs
+//
+// Unit tests for src/bongos/repo-info.js — which GitHub repo this instance binds.
+//
+// loadFromGit ran `git remote get-url origin` with cwd = path.resolve(__dirname,'..','..').
+// In the core dev checkout that is the repo root and the answer is right. On a live
+// instance under ADR 0140 the hub runs from node_modules/@bongos/core, which is NOT a git
+// repo, so git discovery walked UP the filesystem, found the INSTANCE repo, and returned
+// its origin — silently binding a repo whose every API call 404s.
+//
+// This file had NO predecessor — repo-info.js shipped with zero test coverage, which is
+// how the misbind survived. Every case injects the exec seam, so they run with no git and
+// no network; the one end-to-end canary at the bottom is explicitly guarded and skips
+// when git is unavailable (a container / git-less CI runner).
+//
+// Run:  node tests/repo_info_binding.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ri = require('../src/bongos/repo-info.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+// Neutral fixture identity. Implementation code under tests/ must not hardcode any real
+// owner's identity (V3.R12, enforced by scripts/gds/audit-authorship.sh) — and the
+// assertions care only that the parsed pair round-trips, so a synthetic pair is strictly
+// better.
+const FIXTURE_OWNER = 'testowner';
+const FIXTURE_REPO = 'test-repo';
+const REMOTE = `https://github.com/${FIXTURE_OWNER}/${FIXTURE_REPO}.git\n`;
+
+// A scripted `git` — returns whatever the scenario says for each subcommand, and
+// records the cwd every call was made with so we can prove the probe is anchored.
+function mkExec({ toplevel, remote = REMOTE, throwOn = null }) {
+  const calls = [];
+  const exec = (cmd, opts) => {
+    calls.push({ cmd, cwd: opts && opts.cwd });
+    if (throwOn && cmd.includes(throwOn)) throw new Error('git not available');
+    if (cmd.includes('rev-parse')) {
+      if (toplevel == null) throw new Error('not a git repository');
+      return `${toplevel}\n`;
+    }
+    if (cmd.includes('remote get-url')) return remote;
+    throw new Error(`unexpected git call: ${cmd}`);
+  };
+  exec.calls = calls;
+  return exec;
+}
+
+// ---- the case that WORKS today and must not regress ------------------------
+
+test('package root IS the repo root → binds that remote (the core dev checkout)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = mkExec({ toplevel: root });
+  assert.deepEqual(ri.loadFromGit({ execSync, packageRoot: root }), {
+    owner: FIXTURE_OWNER,
+    repo: FIXTURE_REPO,
+  });
+});
+
+test('a git worktree of the core checkout still binds (toplevel == the probed root)', () => {
+  const root = path.resolve('/srv/cloud-bongos/.claude/worktrees/task-1');
+  const execSync = mkExec({ toplevel: root });
+  assert.ok(ri.loadFromGit({ execSync, packageRoot: root }), 'a worktree must keep working');
+});
+
+// ---- the bug ---------------------------------------------------------------
+
+test('B2: toplevel is an ANCESTOR of the probed root → REFUSES to bind', () => {
+  // The live shape: probing node_modules/@bongos/core, git walks up to the instance repo.
+  const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+  const execSync = mkExec({ toplevel: path.resolve('/srv/instance') });
+  assert.equal(
+    ri.loadFromGit({ execSync, packageRoot: root }),
+    null,
+    'a repo found by walking OUT of our own package is not our repo'
+  );
+  assert.ok(
+    !execSync.calls.some((c) => c.cmd.includes('remote get-url')),
+    'must not even ask for the remote once the anchor check fails'
+  );
+});
+
+test('B2: the probe is anchored at the package root, not process.cwd()', () => {
+  const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+  const execSync = mkExec({ toplevel: root });
+  ri.loadFromGit({ execSync, packageRoot: root });
+  assert.ok(execSync.calls.length > 0);
+  for (const c of execSync.calls) {
+    assert.equal(c.cwd, root, 'every git call must be pinned to the probed root');
+  }
+});
+
+// ---- path normalization ----------------------------------------------------
+
+test('git\'s forward slashes match a Windows backslash root (same directory)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  // git prints POSIX separators even on Windows.
+  const execSync = mkExec({ toplevel: root.split(path.sep).join('/') });
+  assert.ok(
+    ri.loadFromGit({ execSync, packageRoot: root }),
+    'separator style must not be read as a different directory'
+  );
+});
+
+test('a trailing newline/whitespace from git does not break the comparison', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = (cmd) => {
+    if (cmd.includes('rev-parse')) return `  ${root}  \n\n`;
+    return REMOTE;
+  };
+  assert.ok(ri.loadFromGit({ execSync, packageRoot: root }));
+});
+
+if (process.platform === 'win32') {
+  test('win32: drive-letter/case differences still match (case-insensitive FS)', () => {
+    const root = path.resolve('C:/Srv/Cloud-Bongos');
+    const execSync = mkExec({ toplevel: 'c:/srv/cloud-bongos' });
+    assert.ok(ri.loadFromGit({ execSync, packageRoot: root }), 'win32 paths are case-insensitive');
+  });
+} else {
+  test('posix: case differences are DIFFERENT directories (case-sensitive FS)', () => {
+    const root = path.resolve('/srv/cloud-bongos');
+    const execSync = mkExec({ toplevel: '/srv/Cloud-Bongos' });
+    assert.equal(ri.loadFromGit({ execSync, packageRoot: root }), null);
+  });
+}
+
+// ---- failure modes that must stay unchanged --------------------------------
+
+test('git absent / rev-parse throws → null (unchanged, caught)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  assert.equal(ri.loadFromGit({ execSync: mkExec({ toplevel: null }), packageRoot: root }), null);
+});
+
+test('remote get-url throws after a good anchor → null (unchanged, caught)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = mkExec({ toplevel: root, throwOn: 'remote get-url' });
+  assert.equal(ri.loadFromGit({ execSync, packageRoot: root }), null);
+});
+
+test('an unparseable remote → null', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = mkExec({ toplevel: root, remote: 'not-a-remote\n' });
+  assert.equal(ri.loadFromGit({ execSync, packageRoot: root }), null);
+});
+
+// ---- loadRepoInfo: precedence + the diagnosable failure --------------------
+
+test('the env pin still WINS over git (unchanged precedence)', () => {
+  ri._resetCacheForTests();
+  process.env.OTB_GITHUB_OWNER = 'envowner';
+  process.env.OTB_GITHUB_REPO = 'envrepo';
+  try {
+    const root = path.resolve('/srv/cloud-bongos');
+    const info = ri.loadRepoInfo({ execSync: mkExec({ toplevel: root }), packageRoot: root });
+    assert.equal(info.owner, 'envowner');
+    assert.equal(info.repo, 'envrepo');
+  } finally {
+    delete process.env.OTB_GITHUB_OWNER;
+    delete process.env.OTB_GITHUB_REPO;
+    ri._resetCacheForTests();
+  }
+});
+
+test('B2: a packaged instance with no env pin reports an ERROR, not a wrong repo', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: path.resolve('/srv/instance') }),
+      packageRoot: root,
+    });
+    assert.equal(info.error, 'no_repo_info', 'an explicit error is diagnosable; a wrong repo 404s silently');
+    assert.equal(info.owner, undefined, 'must not hand back the instance repo it walked up into');
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+test('a good bind still produces the blob/tree bases callers rely on', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/cloud-bongos');
+    const info = ri.loadRepoInfo({ execSync: mkExec({ toplevel: root }), packageRoot: root });
+    const base = `https://github.com/${FIXTURE_OWNER}/${FIXTURE_REPO}`;
+    assert.equal(info.blob_base, `${base}/blob/main`);
+    assert.equal(info.tree_base, `${base}/tree/main`);
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+// ---- end-to-end canary: the regression this must never cause ---------------
+//
+// The only case that touches real git. It earns its place — an anchor rule that is too
+// TIGHT would bind nothing at all, and every hermetic case above would still pass. But it
+// cannot be unconditional: a git-less CI runner or container has nothing to check, so it
+// is guarded and skips rather than failing for an unrelated reason.
+
+function gitAvailableHere() {
+  try {
+    execSync('git rev-parse --show-toplevel', {
+      cwd: path.resolve(fileURLToPath(import.meta.url), '..', '..'),
+      encoding: 'utf8',
+      timeout: 2000,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+if (gitAvailableHere()) {
+  test('CANARY (real git): this checkout still binds itself — the rule is not over-tight', () => {
+    ri._resetCacheForTests();
+    try {
+      const info = ri.loadRepoInfo();
+      assert.ok(!info.error, `the core checkout must still resolve, got ${JSON.stringify(info)}`);
+      assert.ok(info.owner && info.repo, 'owner/repo must be present in a normal dev checkout');
+    } finally {
+      ri._resetCacheForTests();
+    }
+  });
+} else {
+  console.log('  skip  CANARY (real git): no git available here — hermetic cases above still cover the rule');
+}
+
+console.log(`\nrepo-info binding tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/reward_gate.mjs

@@ -138,7 +138,12 @@ const migration178 = readFileSync(join(root, 'migrations/178_reward_gate_auto_as
 t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)', () => {
   const start = tasksRouteSrc.indexOf("router.post('/tasks/:id/promote'");
   assert.ok(start >= 0, 'promote route not found');
-  const body = tasksRouteSrc.slice(start, start + 1600);
+  // Slice to the START OF THE NEXT ROUTE, not a fixed byte window: /promote grew a
+  // second source state (abandoned → backlog, ADR 0152) and a fixed 1600-char slice
+  // silently cut the ready flip out of view, failing the ordering assert below for a
+  // reason that had nothing to do with the reward gate.
+  const nextRoute = tasksRouteSrc.indexOf('router.post(', start + 1);
+  const body = tasksRouteSrc.slice(start, nextRoute > start ? nextRoute : undefined);
   assert.match(body, /rewardGateAssignment/, 'promote route must consult the auto-assign decision');
   assert.match(body, /setCreditsReward/, 'promote route must persist the assigned reward');
   // it must assign BEFORE flipping to ready, and still flip to ready.
@@ -154,7 +159,11 @@ t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)'
 t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', () => {
   const start = dbSrc.indexOf('async function claimTask');
   assert.ok(start >= 0, 'claimTask not found');
-  const body = dbSrc.slice(start, start + 5000);
+  // The window is a slice heuristic, not a contract: it only has to cover the
+  // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
+  // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
+  // past the old edge. Keep it comfortably below the claimTasksBatch boundary.
+  const body = dbSrc.slice(start, start + 6000);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.

package/tests/reward_mode_cost_plus_only.mjs

@@ -0,0 +1,116 @@
+// tests/reward_mode_cost_plus_only.mjs — task 1002270 / ADR 0146 (real DB).
+//
+// End-to-end proof that the per-instance reward MODE actually flips the LIVE
+// ship path — not just the pure helper. With branding config
+// reward.mode='cost-plus-only', db.shipTask awards NO per-task estimate credit
+// (no 'task.shipped' credit_log row) and no idea-promotion slice, while the
+// task's credits_reward stays on the row (shown at claim time + the no-zero
+// claim gate). The cost-plus session reward is a separate path (the sessions
+// upload) and is unaffected here.
+//
+// This is the integration seam the DB-free credit_grant.mjs cases can't reach:
+// the REAL awardLandingCredit → reward port → rewardConfig() → branding() wire.
+//
+// Real-DB (self-skips without Postgres; in the INTEGRATION set so the DB-free
+// lane never runs it).
+//
+// Run:  DATABASE_URL=... node tests/reward_mode_cost_plus_only.mjs
+
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
+
+// The branding override MUST be set before anything calls the memoized
+// branding() — so before the first app require below. A partial instance file
+// deep-merges over neutral, so we override only the reward block. PID-suffixed
+// so a parallel process can't collide (Date.now/random are unavailable here).
+const brandingFile = path.join(os.tmpdir(), `bongos-reward-cpo-${process.pid}.json`);
+fs.writeFileSync(brandingFile, JSON.stringify({ reward: { mode: 'cost-plus-only', marginPct: 20, usdPeg: 1 } }));
+process.env.GDS_BRANDING_FILE = brandingFile;
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`reward_mode_cost_plus_only.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  fs.rmSync(brandingFile, { force: true });
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const credits = require('../modules/economy/credits.js');
+const db = require('../modules/lifecycle/db.js');
+
+const VER = 'ZZZ-RM', WORKER = 90000301, TASK = 90000310;
+const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
+
+async function cleanup() {
+  await q(`DELETE FROM builder_achievements WHERE builder_id=$1`, [WORKER]).catch(() => {});
+  await q(`DELETE FROM credit_log WHERE builder_id=$1 OR task_id=$2`, [WORKER, TASK]).catch(() => {});
+  await q(`DELETE FROM claims WHERE task_id=$1`, [TASK]).catch(() => {});
+  await q(`DELETE FROM tasks WHERE id=$1`, [TASK]).catch(() => {});
+  await q(`DELETE FROM builders WHERE id=$1`, [WORKER]).catch(() => {});
+  await q(`DELETE FROM versions WHERE id=$1`, [VER]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); console.log(`  ok  ${msg}`); pass++; };
+
+try {
+  // Precondition: the branding override actually resolved to cost-plus-only. If
+  // this fails, the env/cache ordering broke and the rest is meaningless — so we
+  // assert it up front rather than let a silent default mask a real regression.
+  ok(credits.rewardConfig().mode === 'cost-plus-only',
+    'branding override resolved (GDS_BRANDING_FILE read before branding() memoized)');
+  ok(credits.rewardConfig().perTaskCredit === false,
+    'cost-plus-only ⇒ perTaskCredit is off');
+
+  await cleanup();
+  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'rm','planning','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
+  // Archon so no rank/newcomer gate interferes with the ship.
+  await q(`INSERT INTO builders (id,github_id,github_login,display_name,rank) VALUES ($1,'rm-w','rm-worker','RM Worker','archon')`, [WORKER]);
+  // A confirmed task owned by WORKER with a real estimate. In DEFAULT mode this
+  // would pay 60 × 1.0 (feature) at ship; in cost-plus-only it must pay nothing.
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by) VALUES ($1,$2,'rm task','confirmed',60,'feature',$3)`, [TASK, VER, WORKER]);
+  await q(`INSERT INTO claims (task_id,builder_id,claimed_at) VALUES ($1,$2, now())`, [TASK, WORKER]);
+
+  // Drive the REAL ship transition (the same call the reconciler/ship.js use).
+  await db.shipTask({ taskId: String(TASK), builderId: String(WORKER) });
+
+  const status = (await q(`SELECT status FROM tasks WHERE id=$1`, [TASK]))[0].status;
+  ok(status === 'shipped', `the task shipped (status=${status})`);
+
+  const shippedCredit = await q(
+    `SELECT delta FROM credit_log WHERE task_id=$1 AND reason='task.shipped'`, [TASK]);
+  ok(shippedCredit.length === 0,
+    'cost-plus-only: NO per-task estimate credit_log row was written at ship');
+
+  // Belt-and-suspenders: no per-task estimate row under EITHER pay-on-land reason,
+  // and no idea-promotion slice (it cascades from the 0 base credit). Achievement
+  // rewards are a separate stream and intentionally out of scope (not asserted).
+  const anyTaskCredit = await q(
+    `SELECT reason FROM credit_log
+      WHERE task_id=$1 AND reason IN ('task.shipped','task.confirmed','idea_promotion_bonus')`, [TASK]);
+  ok(anyTaskCredit.length === 0,
+    'no per-task estimate credit nor idea-promotion slice was paid');
+
+  const est = (await q(`SELECT credits_reward FROM tasks WHERE id=$1`, [TASK]))[0].credits_reward;
+  ok(Number(est) === 60,
+    'the estimate (credits_reward=60) stays on the row — shown at claim time, just not paid');
+
+  console.log(`\nreward_mode_cost_plus_only (task 1002270 / ADR 0146): ${pass} passed, 0 failed`);
+} catch (e) {
+  console.error('reward_mode_cost_plus_only.mjs FAILED:', e.stack || e.message);
+  process.exitCode = 1;
+} finally {
+  await cleanup();
+  fs.rmSync(brandingFile, { force: true });
+  await pool.end();
+}