@bongos/core 1.18.3 → 1.18.18

package/tests/smoke_target.mjs

@@ -0,0 +1,233 @@
+// tests/smoke_target.mjs
+//
+// Task 1002418 — smoke-gds.js must verify THIS instance, never a hardcoded one.
+//
+// The bug: `BASE = GDS_API_BASE || PMS_API_BASE || 'https://amazonprimea.com'`.
+// A builder signed into any other instance who shipped without an env override
+// smoked the founder's box, which is healthy, so the ship reported
+// "smoke=clean" about a system it never touched. resolveSmokeTarget replaces the
+// literal with the ship.js precedence chain and fails closed.
+//
+// These tests pin the three things that make the fix real: the precedence order,
+// the mismatch warning, and the nothing-resolves case. Pure over injected inputs
+// — no fs, no env mutation, no network.
+//
+// Run:  node tests/smoke_target.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { resolveSmokeTarget, formatTargetReport, buildChecks } = require('../scripts/gds/smoke-gds.js');
+const ic = require('../src/instance-config.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const SESSION = 'https://cloudbongos.com';
+const BRAND = { domains: { publicOrigin: 'https://brand.example' } };
+// Explicit empty env: the real process.env must never leak into a precedence test.
+const NO_ENV = {};
+
+// ---- precedence: env → session → branding → null ----
+
+test('env override wins over session and branding', () => {
+  const t = resolveSmokeTarget({
+    env: { GDS_API_BASE: 'http://localhost:3000' },
+    sessionApiBase: SESSION,
+    branding: BRAND,
+  });
+  assert.equal(t.base, 'http://localhost:3000');
+  assert.equal(t.source, 'env');
+});
+
+test('GDS_API_BASE specifically still works (local dev relies on it)', () => {
+  const t = resolveSmokeTarget({ env: { GDS_API_BASE: 'http://localhost:3000' }, sessionApiBase: null, branding: {} });
+  assert.equal(t.base, 'http://localhost:3000');
+  assert.equal(t.envVar, 'GDS_API_BASE');
+});
+
+test('legacy PMS_API_BASE and OTB_API_BASE still work', () => {
+  assert.equal(resolveSmokeTarget({ env: { PMS_API_BASE: 'http://localhost:4000' }, sessionApiBase: null, branding: {} }).base, 'http://localhost:4000');
+  assert.equal(resolveSmokeTarget({ env: { OTB_API_BASE: 'http://localhost:4001' }, sessionApiBase: null, branding: {} }).base, 'http://localhost:4001');
+});
+
+// The CONFIGURED prefix is the leg the old code never had: it read GDS_/PMS_ only.
+// Without this, reverting resolveEnv() to `env.GDS_API_BASE || env.PMS_API_BASE`
+// would leave the whole suite green. Derived from instance-config rather than
+// hardcoded 'CLOUDBONGOS_' so the test follows a rebranded instance.
+test('the configured <PREFIX>_API_BASE is honored, not just the legacy names', () => {
+  const key = `${ic.envPrefix()}_API_BASE`;
+  const t = resolveSmokeTarget({ env: { [key]: 'http://localhost:5000' }, sessionApiBase: SESSION, branding: BRAND });
+  assert.equal(t.base, 'http://localhost:5000', `${key} should win`);
+  assert.equal(t.envVar, key);
+});
+
+test('the configured prefix outranks the legacy ones', () => {
+  const key = `${ic.envPrefix()}_API_BASE`;
+  if (key === 'GDS_API_BASE') return; // same var; nothing to order
+  const t = resolveSmokeTarget({
+    env: { [key]: 'http://configured:1', GDS_API_BASE: 'http://legacy:2' },
+    sessionApiBase: null,
+    branding: {},
+  });
+  assert.equal(t.base, 'http://configured:1');
+});
+
+test('session api_base wins over branding when no env override', () => {
+  const t = resolveSmokeTarget({ env: NO_ENV, sessionApiBase: SESSION, branding: BRAND });
+  assert.equal(t.base, SESSION);
+  assert.equal(t.source, 'session');
+});
+
+test('branding publicOrigin is the last resort, not a foreign instance', () => {
+  const t = resolveSmokeTarget({ env: NO_ENV, sessionApiBase: null, branding: BRAND });
+  assert.equal(t.base, 'https://brand.example');
+  assert.equal(t.source, 'branding');
+});
+
+// The regression that started this: signed into cloudbongos.com, no env override.
+// Pre-fix this resolved to the hardcoded amazonprimea.com and passed.
+test('signed into another instance with no env override → that instance, never amazonprimea', () => {
+  const t = resolveSmokeTarget({ env: NO_ENV, sessionApiBase: SESSION, branding: BRAND });
+  assert.equal(t.base, SESSION);
+  assert.doesNotMatch(t.base, /amazonprimea/);
+});
+
+test('no hardcoded host survives anywhere in the resolution', () => {
+  for (const t of [
+    resolveSmokeTarget({ env: NO_ENV, sessionApiBase: SESSION, branding: BRAND }),
+    resolveSmokeTarget({ env: NO_ENV, sessionApiBase: null, branding: BRAND }),
+    resolveSmokeTarget({ env: NO_ENV, sessionApiBase: null, branding: {} }),
+  ]) {
+    assert.doesNotMatch(String(t.base), /amazonprimea/);
+  }
+});
+
+test('trailing slashes are normalized away', () => {
+  const t = resolveSmokeTarget({ env: NO_ENV, sessionApiBase: 'https://cloudbongos.com//', branding: {} });
+  assert.equal(t.base, SESSION);
+});
+
+test('blank/whitespace values are skipped, not treated as a target', () => {
+  const t = resolveSmokeTarget({ env: { GDS_API_BASE: '   ' }, sessionApiBase: SESSION, branding: BRAND });
+  assert.equal(t.base, SESSION);
+  assert.equal(t.source, 'session');
+});
+
+// ---- nothing resolves → fail closed ----
+
+test('nothing resolves → null base + null source (caller must fail, not guess)', () => {
+  const t = resolveSmokeTarget({ env: NO_ENV, sessionApiBase: null, branding: {} });
+  assert.equal(t.base, null);
+  assert.equal(t.source, null);
+  assert.equal(t.mismatch, false);
+});
+
+test('unreadable branding (no domains key) still resolves to null, never a default host', () => {
+  const t = resolveSmokeTarget({ env: NO_ENV, sessionApiBase: null, branding: { domains: {} } });
+  assert.equal(t.base, null);
+});
+
+// ---- mismatch detection + the loud warning ----
+
+test('mismatch is true when the env override disagrees with the session', () => {
+  const t = resolveSmokeTarget({ env: { GDS_API_BASE: 'http://localhost:3000' }, sessionApiBase: SESSION, branding: BRAND });
+  assert.equal(t.mismatch, true);
+  assert.equal(t.sessionApiBase, SESSION);
+});
+
+test('mismatch is false when the target IS the session', () => {
+  assert.equal(resolveSmokeTarget({ env: NO_ENV, sessionApiBase: SESSION, branding: BRAND }).mismatch, false);
+  assert.equal(resolveSmokeTarget({ env: { GDS_API_BASE: SESSION }, sessionApiBase: SESSION, branding: BRAND }).mismatch, false);
+});
+
+test('mismatch ignores trailing-slash and case differences (no false alarms)', () => {
+  const t = resolveSmokeTarget({ env: { GDS_API_BASE: 'https://CloudBongos.com/' }, sessionApiBase: SESSION, branding: BRAND });
+  assert.equal(t.mismatch, false);
+});
+
+test('mismatch is false when not signed in (nothing to disagree with)', () => {
+  assert.equal(resolveSmokeTarget({ env: NO_ENV, sessionApiBase: null, branding: BRAND }).mismatch, false);
+});
+
+test('report always states the resolved target and its source', () => {
+  const lines = formatTargetReport(resolveSmokeTarget({ env: NO_ENV, sessionApiBase: SESSION, branding: BRAND }));
+  assert.equal(lines.length, 1, 'no warning when target matches the session');
+  assert.match(lines[0], /https:\/\/cloudbongos\.com/);
+  assert.match(lines[0], /session api_base/);
+});
+
+test('report shouts BOTH origins when they disagree — the silence that made this dangerous', () => {
+  const t = resolveSmokeTarget({ env: { GDS_API_BASE: 'http://localhost:3000' }, sessionApiBase: SESSION, branding: BRAND });
+  const text = formatTargetReport(t).join('\n');
+  assert.match(text, /WARNING/);
+  assert.match(text, /http:\/\/localhost:3000/, 'names the target actually being verified');
+  assert.match(text, /https:\/\/cloudbongos\.com/, 'names the session it disagrees with');
+  assert.ok(text.split('\n').length > 5, 'a one-liner is not loud enough to be noticed');
+});
+
+// ---- main() actually fails closed (the pure function alone can't prove this) ----
+//
+// Everything above tests resolveSmokeTarget. A hardcoded fallback reintroduced
+// INSIDE main() — `const BASE = target.base || 'https://amazonprimea.com'` — would
+// leave all of it green. So run the real script with nothing resolvable: no
+// session (HOME/USERPROFILE point at an empty dir, covering both platforms'
+// os.homedir()), no *_API_BASE, and a branding pack with an empty publicOrigin.
+
+function runScript(env) {
+  const script = path.resolve(process.cwd(), 'scripts', 'gds', 'smoke-gds.js');
+  try {
+    const stdout = execFileSync(process.execPath, [script], { env, encoding: 'utf8', timeout: 30_000 });
+    return { code: 0, stdout };
+  } catch (err) {
+    return { code: err.status, stdout: (err.stdout || '') + (err.stderr || '') };
+  }
+}
+
+test('main() exits 1 and names no host when nothing resolves', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'smoke-target-'));
+  const brandPack = path.join(tmp, 'branding.json');
+  fs.writeFileSync(brandPack, JSON.stringify({ domains: { publicOrigin: '' } }));
+
+  const env = { ...process.env, HOME: tmp, USERPROFILE: tmp, GDS_BRANDING_FILE: brandPack };
+  for (const k of Object.keys(env)) if (k.endsWith('_API_BASE')) delete env[k];
+
+  try {
+    const { code, stdout } = runScript(env);
+    assert.equal(code, 1, `expected exit 1, got ${code}\n${stdout}`);
+    assert.match(stdout, /no target/i);
+    // The whole point: it must not have picked a host to verify.
+    assert.doesNotMatch(stdout, /smoke target: http/i, 'resolved a target it should not have');
+    assert.doesNotMatch(stdout, /amazonprimea/, 'the hardcoded fallback is back');
+    assert.doesNotMatch(stdout, /passed, \d+ failed/, 'it ran checks against something');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// ---- the checks are built from the resolved base, not a baked-in one ----
+
+test('every check URL is built from the resolved base', () => {
+  const urls = buildChecks(SESSION).map(([, url]) => url);
+  assert.ok(urls.length >= 17, `expected the full check set, got ${urls.length}`);
+  for (const u of urls) assert.ok(u.startsWith(`${SESSION}/`), `${u} is not on the resolved base`);
+});
+
+console.log(`\nsmoke_target: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/start_env_guard.mjs

@@ -0,0 +1,87 @@
+// tests/start_env_guard.mjs
+//
+// task 1002403 (goal 1000052, first-run onboarding) — /builder-start is often the
+// FIRST command run in a freshly-cloned instance, before the local server is up.
+// This exercises the pure helpers start.js exports for that guard (isConnectionError
+// / instanceNotRunningCard) DB-free — no live server, mirroring start_rebase_warning.
+// Invariants under test:
+//   - isConnectionError recognizes the network-failure shapes fetch throws
+//     (code, cause.code, and message forms) and ignores non-network errors
+//   - the guided card names `bongos dev` + the re-run, and only mentions
+//     `npm install` when deps are actually missing
+//   - the card is MARKDOWN (never leads with `<`) so the builder-start skill
+//     relays it verbatim even in --widget mode, and carries no bare "#N"
+//
+// Run:  node tests/start_env_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { isConnectionError, instanceNotRunningCard } = require('../scripts/gds/start.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// --- isConnectionError: the network-failure classifier --------------------
+t('true for a direct connection-refused code', () => {
+  assert.equal(isConnectionError({ code: 'ECONNREFUSED' }), true);
+});
+
+t('true for the node fetch shape (TypeError with a cause carrying the code)', () => {
+  // `await fetch()` to a dead port throws exactly this: TypeError('fetch failed')
+  // with an AggregateError cause whose code is ECONNREFUSED.
+  const err = new TypeError('fetch failed');
+  err.cause = Object.assign(new Error('connect ECONNREFUSED'), { code: 'ECONNREFUSED' });
+  assert.equal(isConnectionError(err), true);
+});
+
+t('true for DNS failure (ENOTFOUND) and message-only signals', () => {
+  assert.equal(isConnectionError({ code: 'ENOTFOUND' }), true);
+  assert.equal(isConnectionError(new Error('fetch failed')), true);
+  assert.equal(isConnectionError(new Error('socket hang up')), true);
+});
+
+t('false for null and for a non-network error', () => {
+  assert.equal(isConnectionError(null), false);
+  assert.equal(isConnectionError(undefined), false);
+  assert.equal(isConnectionError(new Error('something unrelated blew up')), false);
+  // An HTTP-ish error object with no network signal must NOT be misread as a
+  // connection failure (those are handled as normal { ok:false } results).
+  assert.equal(isConnectionError({ status: 500, message: 'internal error' }), false);
+});
+
+// --- instanceNotRunningCard: the guided bring-up card ---------------------
+t('always points at bongos dev and the re-run', () => {
+  const card = instanceNotRunningCard({ origin: 'http://localhost:3007', depsMissing: false });
+  assert.ok(card.includes('bongos dev'), 'names the one-command bring-up');
+  assert.ok(/re-run/i.test(card) && card.includes('/builder-start'), 'tells them to re-run /builder-start');
+  assert.ok(card.includes('localhost:3007'), 'names the unreachable origin when known');
+});
+
+t('mentions npm install ONLY when deps are missing', () => {
+  const missing = instanceNotRunningCard({ origin: 'http://x', depsMissing: true });
+  const present = instanceNotRunningCard({ origin: 'http://x', depsMissing: false });
+  assert.ok(missing.includes('npm install'), 'fresh clone (no deps) → npm install step');
+  assert.ok(!present.includes('npm install'), 'deps present → skip the npm install step');
+});
+
+t('is markdown (never leads with `<`) so the skill relays it verbatim', () => {
+  for (const deps of [true, false]) {
+    const card = instanceNotRunningCard({ origin: '', depsMissing: deps });
+    assert.notEqual(card.trimStart()[0], '<', 'must not start with `<` (that would trigger show_widget)');
+    assert.ok(!/#\d/.test(card), 'no bare #N (the linkify rule)');
+  }
+});
+
+t('offers the wrong-instance escape hatch (bongos login)', () => {
+  const card = instanceNotRunningCard({ origin: 'http://x', depsMissing: false });
+  assert.ok(/bongos login/.test(card), 'points at bongos login for a different running instance');
+});
+
+console.log(`\nstart_env_guard: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exitCode = 1;

package/tests/start_rebase_warning.mjs

@@ -0,0 +1,103 @@
+// tests/start_rebase_warning.mjs
+//
+// ADR 0120 part 5 — /builder-start surfaces a builder's OWED REBASES (the
+// un-landed confirmed tasks that GATE new claims). This exercises the pure
+// render helpers start.js exports (rebaseWarningModel / rebaseWarningMarkdown /
+// rebaseWarningWidget) DB-free — no live server, mirroring claim_error_surface.
+// The invariants under test:
+//   - nothing owed → no warning (null / '')
+//   - the count + singular/plural agreement
+//   - refs use the `task N` form, NEVER a bare "#N" (the CLAUDE.md linkify rule:
+//     a bare #N in relayed chat autolinks to GitHub issues and 404s)
+//   - the widget block is HTML-safe and carries the danger-tinted alert markup
+//
+// Run:  node tests/start_rebase_warning.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { rebaseWarningModel, rebaseWarningMarkdown, rebaseWarningWidget } =
+  require('../scripts/gds/start.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// --- rebaseWarningModel: the normalized render model ----------------------
+t('model is null when nothing is owed (empty / null / undefined / junk)', () => {
+  for (const input of [[], null, undefined, 'nope', 42, {}]) {
+    assert.equal(rebaseWarningModel(input), null, `expected null for ${JSON.stringify(input)}`);
+  }
+});
+
+t('model drops entries with no id, and is null if none remain', () => {
+  assert.equal(rebaseWarningModel([{ title: 'x' }, null, { id: null }]), null);
+  const m = rebaseWarningModel([{ id: 7 }, { title: 'noid' }]);
+  assert.equal(m.count, 1, 'only the id-bearing row counts');
+  assert.equal(m.refs, 'task 7');
+});
+
+t('model: singular vs plural agreement', () => {
+  const one = rebaseWarningModel([{ id: 123, title: 'a' }]);
+  assert.equal(one.count, 1);
+  assert.equal(one.noun, 'task');
+  assert.equal(one.pronoun, 'it');
+  assert.equal(one.refs, 'task 123');
+
+  const two = rebaseWarningModel([{ id: 123 }, { id: 456 }]);
+  assert.equal(two.count, 2);
+  assert.equal(two.noun, 'tasks');
+  assert.equal(two.pronoun, 'them');
+  assert.equal(two.refs, 'task 123, task 456');
+});
+
+// --- rebaseWarningMarkdown: the card line ---------------------------------
+t('markdown is null when nothing is owed', () => {
+  assert.equal(rebaseWarningMarkdown([]), null);
+  assert.equal(rebaseWarningMarkdown(null), null);
+});
+
+t('markdown names the gate, the fix, and every owed task', () => {
+  const md = rebaseWarningMarkdown([{ id: 123, title: 'a' }, { id: 456, title: 'b' }]);
+  assert.ok(md.includes('GATED'), 'signals the queue is gated');
+  assert.ok(/2 tasks/.test(md), 'shows the count with plural agreement');
+  assert.ok(md.includes('/builder-release'), 'points at the release escape hatch');
+  assert.ok(md.includes('task 123') && md.includes('task 456'), 'names each owed task');
+});
+
+t('markdown uses the `task N` form, never a bare #N (linkify rule)', () => {
+  for (const input of [[{ id: 1 }], [{ id: 1 }, { id: 2 }, { id: 3 }]]) {
+    const md = rebaseWarningMarkdown(input);
+    assert.ok(!/#\d/.test(md), `must not emit a bare #N: ${md}`);
+    assert.ok(/task \d/.test(md), 'uses the task N form');
+  }
+});
+
+// --- rebaseWarningWidget: the HTML block ----------------------------------
+t('widget is empty string when nothing is owed', () => {
+  assert.equal(rebaseWarningWidget([]), '');
+  assert.equal(rebaseWarningWidget(null), '');
+});
+
+t('widget renders the danger-tinted alert block with the owed tasks', () => {
+  const html = rebaseWarningWidget([{ id: 123 }, { id: 456 }]);
+  assert.ok(html.includes('class="bs-warn"'), 'uses the bs-warn danger block');
+  assert.ok(html.includes('ti-alert-triangle'), 'carries the alert icon');
+  assert.ok(html.includes('task 123') && html.includes('task 456'), 'names each owed task');
+  assert.ok(!/#\d/.test(html), 'no bare #N in the widget either');
+});
+
+t('widget HTML-escapes the refs (no raw angle brackets from ids)', () => {
+  // ids are numeric in practice, but the renderer must not trust that — a
+  // crafted id string must be escaped, never injected raw.
+  const html = rebaseWarningWidget([{ id: '<b>x</b>' }]);
+  assert.ok(!html.includes('<b>x</b>'), 'raw markup from an id must be escaped');
+  assert.ok(html.includes('&lt;b&gt;'), 'the id is HTML-escaped');
+});
+
+console.log(`\nstart_rebase_warning: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exitCode = 1;

package/tests/status_mirror_sync.mjs

@@ -0,0 +1,122 @@
+// tests/status_mirror_sync.mjs — the off-box status-mirror publisher (task 1002510,
+// slice of parent 1000594). Covers the PURE index transform only; the CLI half
+// (disk copies, `git add/commit/push` into a real external checkout) is never
+// invoked from here.
+//
+// This file importing at all is the load-bearing regression: before task 1002510 the
+// CLI body ran at require-time, so `import`ing the module printed the usage banner and
+// exited 2. The `require.main === module` guard is what makes the transform testable.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import mirror from '../scripts/status-mirror-sync.js';
+
+const { buildMirrorIndex, injectOnce, brandTokens } = mirror;
+
+// Obviously-fake values: a regression back to a baked-in host literal fails here.
+const API_BASE = 'https://api.example.test';
+const STATUS_DATA_URL = 'https://data.example.test/status-data/status.json';
+const BRAND = {
+  identity: { productName: 'Acme Rockets', worldName: 'Acme' },
+  currency: { label: 'tokens' },
+};
+
+const STATUS_SCRIPT = '<script src="/status.js?v=test"></script>';
+
+// An in-test fixture — no dependency on the real modules/status-ui/public/index.html,
+// so an edit to the dashboard can never make this file spuriously red. Any of the
+// three anchors can be dropped to prove the abort path.
+function fixture({ headClose = '</head>', bodyOpen = '<body>', statusScript = STATUS_SCRIPT } = {}) {
+  return [
+    '<!doctype html>',
+    '<html>',
+    '<head>',
+    '<title>{{worldName}} status</title>',
+    headClose,
+    bodyOpen,
+    '<h1>{{productName}} — {{Currency}} ({{currency}}) at {{publicOrigin}}</h1>',
+    statusScript,
+    '</body>',
+    '</html>',
+    '',
+  ].join('\n');
+}
+
+const build = (over = {}) => buildMirrorIndex({
+  srcHtml: fixture(),
+  apiBase: API_BASE,
+  statusDataUrl: STATUS_DATA_URL,
+  brand: BRAND,
+  ...over,
+});
+
+test('the head script emits the apiBase that was passed in (no baked-in host)', () => {
+  const out = build();
+  assert.ok(out.includes(`window.STATUS_API_BASE = ${JSON.stringify(API_BASE)};`), 'STATUS_API_BASE carries the injected origin');
+  assert.ok(out.indexOf('window.STATUS_API_BASE') < out.indexOf('</head>'), 'lands in <head>');
+  // and the client-safe brand pack rides along, as serve-internal does on the droplet
+  assert.ok(out.includes(`window.__BRANDING__ = ${JSON.stringify(BRAND)};`));
+});
+
+test('the banner driver emits the statusDataUrl that was passed in, and names the configured site', () => {
+  const out = build();
+  assert.ok(out.includes(`var OFFBOX_URL = ${JSON.stringify(STATUS_DATA_URL)};`), 'the prober URL is the injected one');
+  // the up/down copy names the host derived from apiBase, not a hardcoded domain
+  assert.ok(out.includes("'\\uD83D\\uDFE2 api.example.test is operational"));
+  assert.ok(out.includes("'\\uD83D\\uDD34 api.example.test is DOWN"));
+});
+
+test('the banner div lands immediately after <body>, and the driver before status.js', () => {
+  const out = build();
+  const afterBody = out.slice(out.indexOf('<body>') + '<body>'.length);
+  assert.ok(afterBody.startsWith('\n<!-- Off-box availability banner (ADR 0029)'), 'banner block opens right after <body>');
+  assert.ok(afterBody.includes('<div id="offbox-status" role="status" aria-live="polite"></div>'));
+  assert.ok(afterBody.indexOf('<div id="offbox-status"') < afterBody.indexOf('<h1>'), 'banner precedes the page content');
+  assert.ok(out.indexOf('var OFFBOX_URL') < out.indexOf('<script src="/status.js'), 'driver loads before the dashboard script');
+});
+
+test('a fixture missing any one anchor ABORTS — a silent mis-publish is worse than a failed run', () => {
+  assert.throws(() => build({ srcHtml: fixture({ headClose: '' }) }), /anchor not found.*<\/head>/s);
+  assert.throws(() => build({ srcHtml: fixture({ bodyOpen: '' }) }), /anchor not found.*<body>/s);
+  assert.throws(() => build({ srcHtml: fixture({ statusScript: '' }) }), /anchor not found.*status\.js/s);
+});
+
+test('injectOnce places before/after, and throws rather than skipping a missing anchor', () => {
+  assert.equal(injectOnce('ab', 'a', 'X', 'after'), 'aXb');
+  assert.equal(injectOnce('ab', 'b', 'X', 'before'), 'aXb');
+  assert.throws(() => injectOnce('ab', 'zz', 'X', 'before'), /refusing a silent mis-publish/);
+});
+
+test('a source that already carries the offbox markup is refused (it must be the droplet copy)', () => {
+  const alreadyMirrored = build();
+  assert.throws(() => build({ srcHtml: alreadyMirrored }), /already contains offbox markup/);
+});
+
+test('an empty statusDataUrl throws and names the config key, instead of publishing a dead banner', () => {
+  assert.throws(() => build({ statusDataUrl: '' }), /domains\.statusDataUrl/);
+  assert.throws(() => build({ statusDataUrl: undefined }), /domains\.statusDataUrl/);
+});
+
+test('brand tokens resolve from the INJECTED brand, not ambient config', () => {
+  const out = build();
+  assert.ok(out.includes('<title>Acme status</title>'));
+  assert.ok(out.includes('<h1>Acme Rockets — Tokens (tokens) at https://api.example.test</h1>'));
+  assert.doesNotMatch(out, /\{\{(worldName|productName|Currency|currency|publicOrigin)\}\}/);
+  // pure: an empty brand blanks the tokens rather than reaching for branding()
+  assert.equal(brandTokens('[{{worldName}}][{{currency}}][{{publicOrigin}}]', {}, ''), '[][credits][]');
+});
+
+test('the publisher source hardcodes no host identity (the ratchet this slice installs)', () => {
+  // Mirrors scripts/gds/fitness.js stripCommentsForIdentity: block comments, then
+  // `://`-safe line comments split on /\r?\n/ — NOT '\n'. On this CRLF checkout a
+  // '\n' split leaves a trailing \r that `.*$` can never cross, so no line comment
+  // would strip and rationale prose would scan as code (the task 1002428 bug).
+  const src = readFileSync(new URL('../scripts/status-mirror-sync.js', import.meta.url), 'utf8');
+  const stripped = src
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .split(/\r?\n/)
+    .map((l) => l.replace(/(^|[^:])\/\/.*$/, '$1'))
+    .join('\n');
+  const hit = stripped.match(/amazonprimea|lars589|off the boats/i);
+  assert.equal(hit, null, `scripts/status-mirror-sync.js hardcodes the host identity "${hit && hit[0]}" — resolve it from branding() instead`);
+});

package/tests/stop_refcheck.mjs

@@ -16,7 +16,25 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { evaluate, buildReason, lastAssistantText, RESOLVER_BASE } = require('../.claude/hooks/stop-refcheck.js');
+// The Stop hook lives in .claude/hooks/, which the neutral core does NOT carry:
+// it's instance-materialized and package-excluded (PROTECTED_TOPOLOGY_EXCLUDE in
+// scripts/gds/publish-manifest.js). A clean core checkout therefore has no hook to
+// require — an unconditional require() threw MODULE_NOT_FOUND and CRASHED this file
+// at load (uncaught, printing a requireStack), red-Xing the unit gate (task 1002234).
+// Skip cleanly when the hook is absent; the suite still runs in full on an instance
+// whose .claude/hooks/stop-refcheck.js is materialized.
+let hook;
+try {
+  hook = require('../.claude/hooks/stop-refcheck.js');
+} catch (err) {
+  if (err && err.code === 'MODULE_NOT_FOUND') {
+    console.log('stop_refcheck: SKIP — .claude/hooks/stop-refcheck.js is not present in this checkout');
+    console.log('  (instance-materialized + package-excluded; the neutral core carries no copy to test).');
+    process.exit(0);
+  }
+  throw err;
+}
+const { evaluate, buildReason, lastAssistantText, RESOLVER_BASE } = hook;
 
 let passed = 0;
 let failed = 0;

package/tests/task_goal_link.mjs

@@ -62,10 +62,14 @@ await test('a version with a general goal → returns its id via one SELECT on t
   assert.equal(out, 3, 'returns the general goal id');
   assert.equal(pool.queries.length, 1, 'exactly one SELECT');
   const q = pool.queries[0];
-  assert.match(q.sql, /SELECT id FROM goals WHERE version_id = \$1 AND title = \$1 \|\| ' — general'/,
-    'keyed on version_id + the spaced em-dash "<version> — general" (must match migration 160)');
+  // task 1002539: the title is no longer inlined in SQL — it is BOUND, built by the
+  // shared goal-advisory.generalGoalTitle so this lookup and the orphan advisory that
+  // names the same goal cannot drift apart.
+  assert.match(q.sql, /SELECT id FROM goals WHERE version_id = \$1 AND title = \$2/,
+    'keyed on version_id + a BOUND title (one definition, in goal-advisory.js)');
   assert.match(q.sql, /LIMIT 1/, 'single row');
-  assert.deepEqual(q.params, ['BONGOS-V1'], 'binds [versionId] — title is built in SQL, not interpolated');
+  assert.deepEqual(q.params, ['BONGOS-V1', 'BONGOS-V1 — general'],
+    'binds [versionId, "<version> — general"] — the spaced em-dash from migration 160');
 });
 
 await test('a version with no general goal → null (caller leaves goal_id NULL, never fails the create)', async () => {
@@ -73,14 +77,19 @@ await test('a version with no general goal → null (caller leaves goal_id NULL,
   const out = await generalGoalIdForVersion('SOME-VERSION', { pool });
   assert.equal(out, null, 'no general goal → null fallback');
   assert.equal(pool.queries.length, 1, 'it did query — just found nothing');
-  assert.deepEqual(pool.queries[0].params, ['SOME-VERSION']);
+  assert.deepEqual(pool.queries[0].params, ['SOME-VERSION', 'SOME-VERSION — general']);
 });
 
 await test('the em-dash in the title match is U+2014 (not a hyphen/en-dash) — or the backfill silently matches nothing', async () => {
   const pool = fakePool([{ id: 9 }]);
   await generalGoalIdForVersion('V2', { pool });
-  assert.ok(pool.queries[0].sql.includes('—'), 'SQL contains an em-dash (U+2014)');
-  assert.ok(!pool.queries[0].sql.includes(" - general"), 'not a hyphen');
+  // The em-dash moved from the SQL text into the BOUND param (task 1002539); assert
+  // it there, which is stricter — the exact string Postgres compares.
+  const title = pool.queries[0].params[1];
+  assert.ok(title.includes('—'), 'the bound title contains an em-dash (U+2014)');
+  assert.equal(title.charCodeAt(title.indexOf('—')), 0x2014, 'U+2014 exactly');
+  assert.ok(!title.includes(' - general'), 'not a hyphen');
+  assert.ok(!title.includes(' – general'), 'not an en dash');
 });
 
 // -------------------------------------------------------------------------