@bongos/core 1.18.3 → 1.18.19

package/tests/session_reward_reconcile.mjs

@@ -0,0 +1,229 @@
+// tests/session_reward_reconcile.mjs
+//
+// Guards reconcileUnbookedSessionRewards — the STATE-BASED safety net for the
+// deferred cost-plus session-token reward (ADR 0120). The two live triggers
+// (upload-time gate + the in-process task.shipped listener) miss a task that
+// reaches status='shipped' OUT OF BAND (direct-SQL / hotpatch / another process),
+// stranding that session's drachmae forever. This sweep finds every session whose
+// task is now genuinely 'shipped' but carries no session.token_reward row, and
+// books it — idempotently, and STRICTLY only for shipped tasks (never 'confirmed').
+//
+// Same DB-free harness as session_reward_on_land.mjs: patch api.withTx to hand the
+// fn a SQL-aware fake client, register the REAL economy `reward` port so the real
+// awardSessionTokenReward SQL runs against the fake, and a guarded real-DB block
+// proves the partial-unique index enforces exactly-once end-to-end.
+//
+// Run:  node tests/session_reward_reconcile.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const api = require('../src/module-api.js');
+const db = require('../modules/sessions/db.js');
+
+const { test, summary } = makeRunner();
+
+// Opus 110k input tokens → $0.55 true cost → $0.55 × 1.20 = 1 drachma (the same
+// priceable fixture the reward tests use). A non-zero payout is what lets the
+// idempotency SELECT + INSERT even run (awardSessionTokenReward short-circuits $0).
+const MODEL_USAGE = { 'claude-opus-4-8': { input: 110_000 } };
+
+const norm = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
+const find = (queries, re) => queries.find((q) => re.test(norm(q)));
+const all = (queries, re) => queries.filter((q) => re.test(norm(q)));
+
+// Drive reconcileUnbookedSessionRewards (which opens api.withTx(fn)) against a
+// fake client whose query() answers come from `handler(normalizedSql)`.
+async function withFakeTx(handler, run) {
+  const fake = makeSqlAwareClient(handler);
+  const prev = api.withTx;
+  api.withTx = (fn) => fn(fake._client);
+  try {
+    const result = await run();
+    return { result, queries: fake.queries };
+  } finally {
+    api.withTx = prev;
+  }
+}
+
+const SCAN_RE = /SELECT DISTINCT sr\.session_id.*JOIN tasks t.*status = 'shipped'/;
+// task 1002474: the existence probe became a watermark SUM, so the fake answers
+// with { paid, legacy } instead of row-present / row-absent.
+const IDEMP_RE = /COALESCE\(SUM\(delta\)/;
+const INSERT_RE = /INSERT INTO credit_log/;
+
+// =========================================================================
+// (1) Books a stranded reward for an already-shipped, unbooked session.
+// =========================================================================
+
+await test('reconcile: shipped session with no reward row → books exactly one reward', async () => {
+  const { result, queries } = await withFakeTx(
+    (s) => {
+      if (SCAN_RE.test(s)) {
+        return { rows: [{ session_id: 'sess-oob', builder_id: 7, model_usage: MODEL_USAGE, total_tokens: 5000 }] };
+      }
+      if (IDEMP_RE.test(s)) return { rows: [{ paid: 0, legacy: 0 }] }; // not yet booked
+      if (INSERT_RE.test(s)) return { rows: [{ id: 555 }] }; // insert won the row
+      return null;                                          // UPDATE session_records mirror → {rows:[]}
+    },
+    () => db.reconcileUnbookedSessionRewards()
+  );
+
+  assert.ok(find(queries, SCAN_RE), 'the state-based scan (JOIN tasks status=shipped) must run');
+  assert.equal(all(queries, INSERT_RE).length, 1, 'exactly one session.token_reward INSERT booked');
+  assert.equal(result.scanned, 1, 'one unbooked shipped session scanned');
+  assert.equal(result.awarded, 1, 'one reward freshly booked');
+  // The mirror UPDATE ran (observability column), keyed on the same session.
+  assert.ok(find(queries, /UPDATE session_records\s+SET token_reward_drachmae/), 'the drachmae is mirrored onto the row');
+});
+
+// =========================================================================
+// (2) Nothing to do — no unbooked shipped sessions.
+// =========================================================================
+
+await test('reconcile: no unbooked shipped sessions → no INSERT, awarded 0', async () => {
+  const { result, queries } = await withFakeTx(
+    (s) => (SCAN_RE.test(s) ? { rows: [] } : null),
+    () => db.reconcileUnbookedSessionRewards()
+  );
+  assert.equal(all(queries, INSERT_RE).length, 0, 'nothing shipped-and-unbooked → no reward booked');
+  assert.equal(result.scanned, 0);
+  assert.equal(result.awarded, 0);
+});
+
+// =========================================================================
+// (3) Idempotency backstop — a stale scan that races a live trigger must not
+//     double-pay. Even if the scan hands back a session, the per-session_id
+//     guard inside awardSessionTokenReward sees the existing row and no-ops.
+// =========================================================================
+
+await test('reconcile: scan races a live award (row already exists) → no second INSERT', async () => {
+  const { result, queries } = await withFakeTx(
+    (s) => {
+      if (SCAN_RE.test(s)) {
+        return { rows: [{ session_id: 'sess-race', builder_id: 7, model_usage: MODEL_USAGE, total_tokens: 5000 }] };
+      }
+      if (IDEMP_RE.test(s)) return { rows: [{ paid: 999_999, legacy: 0 }] }; // ALREADY booked between scan + award
+      return null;
+    },
+    () => db.reconcileUnbookedSessionRewards()
+  );
+  assert.equal(all(queries, INSERT_RE).length, 0, 'the per-session_id guard blocks a double payout');
+  assert.equal(result.scanned, 1, 'the stale row was still scanned');
+  assert.equal(result.awarded, 0, 'but nothing was freshly booked');
+});
+
+// =========================================================================
+// (4) The scan is bounded — a garbage/huge limit is clamped, never an
+//     unbounded table scan (params[0] is the clamped LIMIT).
+// =========================================================================
+
+await test('reconcile: limit is clamped to [1, 1000]', async () => {
+  for (const [input, expected] of [[99999, 1000], [0, 1], [-5, 1], [undefined, 200], ['50', 50]]) {
+    const { queries } = await withFakeTx(
+      (s) => (SCAN_RE.test(s) ? { rows: [] } : null),
+      () => db.reconcileUnbookedSessionRewards(input === undefined ? undefined : { limit: input })
+    );
+    const scan = find(queries, SCAN_RE);
+    assert.ok(scan, 'the scan ran');
+    assert.equal(scan.params[0], expected, `limit ${input} → clamped to ${expected}`);
+  }
+});
+
+// =========================================================================
+// (5) real-DB — proves the sweep books once, is idempotent (partial index),
+//     and NEVER pays a task that is only 'confirmed' (ADR 0120 pay-on-land).
+//     Requires DATABASE_URL; skipped cleanly otherwise.
+// =========================================================================
+
+if (process.env.DATABASE_URL) {
+  const pool = api.pool;
+  const suffix = `srr_${Date.now()}_${Math.floor(Math.random() * 1e6)}`;
+  const ctx = { builderId: null, versionId: `ver_${suffix}`, shippedTaskId: null, confirmedTaskId: null };
+  let setupOk = false;
+  try {
+    const b = await pool.query(
+      `INSERT INTO builders (github_id, github_login, display_name) VALUES ($1,$2,$3) RETURNING id`,
+      [`gh_${suffix}`, `login_${suffix}`, `Test ${suffix}`]
+    );
+    ctx.builderId = Number(b.rows[0].id);
+    await pool.query(
+      `INSERT INTO versions (id, name, track, status) VALUES ($1,$2,'internal','planning')`,
+      [ctx.versionId, `V ${suffix}`]
+    );
+    const shipped = await pool.query(
+      `INSERT INTO tasks (version_id, title, status) VALUES ($1,$2,'shipped') RETURNING id`,
+      [ctx.versionId, `shipped ${suffix}`]
+    );
+    ctx.shippedTaskId = Number(shipped.rows[0].id);
+    const confirmed = await pool.query(
+      `INSERT INTO tasks (version_id, title, status) VALUES ($1,$2,'confirmed') RETURNING id`,
+      [ctx.versionId, `confirmed ${suffix}`]
+    );
+    ctx.confirmedTaskId = Number(confirmed.rows[0].id);
+    setupOk = true;
+  } catch (e) {
+    console.log(`  SKIP  real-DB block (setup failed: ${e.message})`);
+  }
+
+  if (setupOk) {
+    const rewardRows = (sessionId) => pool.query(
+      `SELECT delta FROM credit_log WHERE session_id = $1 AND reason = 'session.token_reward'`,
+      [sessionId]
+    );
+    const sidShipped = `sess-recon-shipped-${suffix}`;
+    const sidConfirmed = `sess-recon-confirmed-${suffix}`;
+    try {
+      await test('real-DB: reconcile books a stranded shipped session once, idempotently', async () => {
+        // A session whose task is shipped but which never booked (the out-of-band case).
+        await pool.query(
+          `INSERT INTO session_records (session_id, builder_id, task_ids, total_tokens, model_usage)
+           VALUES ($1, $2, ARRAY[$3]::bigint[], $4, $5::jsonb)`,
+          [sidShipped, ctx.builderId, ctx.shippedTaskId, 5000, JSON.stringify(MODEL_USAGE)]
+        );
+        assert.equal((await rewardRows(sidShipped)).rows.length, 0, 'precondition: no reward yet');
+
+        const first = await db.reconcileUnbookedSessionRewards();
+        assert.ok(first.awarded >= 1, 'the sweep booked at least the shipped session');
+        assert.equal((await rewardRows(sidShipped)).rows.length, 1, 'exactly one reward row for the shipped session');
+
+        const second = await db.reconcileUnbookedSessionRewards();
+        // second sweep may scan 0 (already booked) — the invariant is no double-pay.
+        assert.equal((await rewardRows(sidShipped)).rows.length, 1, 'still exactly one — the partial index held');
+        assert.ok(second.awarded === 0 || second.scanned === 0, 're-sweep never double-pays');
+      });
+
+      await test('real-DB: reconcile NEVER pays a task that is only confirmed (pay-on-land)', async () => {
+        await pool.query(
+          `INSERT INTO session_records (session_id, builder_id, task_ids, total_tokens, model_usage)
+           VALUES ($1, $2, ARRAY[$3]::bigint[], $4, $5::jsonb)`,
+          [sidConfirmed, ctx.builderId, ctx.confirmedTaskId, 5000, JSON.stringify(MODEL_USAGE)]
+        );
+        await db.reconcileUnbookedSessionRewards();
+        assert.equal((await rewardRows(sidConfirmed)).rows.length, 0,
+          'a confirmed-only task is never paid — the reward waits for a genuine shipped');
+      });
+    } finally {
+      try {
+        await pool.query(`DELETE FROM credit_log WHERE builder_id = $1`, [ctx.builderId]);
+        await pool.query(`DELETE FROM session_records WHERE builder_id = $1`, [ctx.builderId]);
+        await pool.query(`DELETE FROM tasks WHERE version_id = $1`, [ctx.versionId]);
+        await pool.query(`DELETE FROM versions WHERE id = $1`, [ctx.versionId]);
+        await pool.query(`DELETE FROM builders WHERE id = $1`, [ctx.builderId]);
+      } catch (e) {
+        console.log(`  WARN  real-DB teardown left rows (${e.message})`);
+      }
+    }
+  }
+} else {
+  console.log('  SKIP  real-DB block (no DATABASE_URL)');
+}
+
+// -------------------------------------------------------------------------
+summary();

package/tests/ship_api_client_pathspec.mjs

@@ -0,0 +1,100 @@
+// tests/ship_api_client_pathspec.mjs
+//
+// Unit tests for task 1002417 — ship.js named a git path that could not exist,
+// and it broke EVERY ship.
+//
+// regenerateApiClient() stages the regenerated typed client plus the devbox
+// Electron app's vendored CJS copy. After the app moved from a top-level
+// devbox-app/ to modules/dev-box/app/ (ADR 0145) the vendored path went stale.
+// The failure was asymmetric and therefore silent for a long time:
+//
+//   git status --porcelain <missing path>  → exit 0   (tolerated, so no signal)
+//   git add               <missing path>  → exit 128 (aborts the WHOLE stage)
+//
+// Because the `git add` aborts, the freshly regenerated clients/bongos-client is
+// never staged, the worktree stays dirty, and the ship's auto-merge then bails
+// with "main worktree busy" — stranding the task at `confirmed` with no PR.
+//
+// apiClientPathspec is the pure rule behind that: never name a path `git add`
+// cannot match. Proven here with an injected existsSync — no git, no fs.
+//
+// Run:  node tests/ship_api_client_pathspec.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+const { apiClientPathspec, VENDORED_CLIENT_REL } = ship;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const ROOT = path.join('/repo');
+const never = () => false;
+const always = () => true;
+
+test('the vendored copy lives inside the dev-box module, not at the old top level', () => {
+  assert.equal(VENDORED_CLIENT_REL, 'modules/dev-box/app/src/vendor/bongos-client.cjs');
+  assert.ok(!VENDORED_CLIENT_REL.startsWith('devbox-app/'), 'must not use the pre-ADR-0145 path');
+});
+
+test('the generated client is always staged', () => {
+  assert.ok(apiClientPathspec({ worktreeRoot: ROOT, existsSync: never }).includes('clients/bongos-client'));
+  assert.ok(apiClientPathspec({ worktreeRoot: ROOT, existsSync: always }).includes('clients/bongos-client'));
+});
+
+test('vendored copy present → it is staged too', () => {
+  const p = apiClientPathspec({ worktreeRoot: ROOT, existsSync: always });
+  assert.deepEqual(p, ['clients/bongos-client', VENDORED_CLIENT_REL]);
+});
+
+// The regression. Before the fix this returned the vendored path unconditionally,
+// so `git add` exited 128 and left the worktree dirty.
+test('vendored copy ABSENT → it is omitted (git add would abort on it)', () => {
+  const p = apiClientPathspec({ worktreeRoot: ROOT, existsSync: never });
+  assert.deepEqual(p, ['clients/bongos-client']);
+  assert.ok(!p.some((x) => x.includes('vendor')), 'no unmatched pathspec may reach git add');
+});
+
+test('existence is probed at the vendored path under the given worktree root', () => {
+  const seen = [];
+  apiClientPathspec({
+    worktreeRoot: ROOT,
+    existsSync: (p) => { seen.push(p); return false; },
+  });
+  assert.equal(seen.length, 1);
+  assert.equal(seen[0], path.join(ROOT, VENDORED_CLIENT_REL));
+});
+
+// A ship can run from a linked worktree, where the main checkout is a different
+// tree (the task-2060 rationale). The probe must follow the root it is handed.
+test('probes the worktree it was handed, not a fixed root', () => {
+  const seen = [];
+  apiClientPathspec({
+    worktreeRoot: path.join('/linked-worktree'),
+    existsSync: (p) => { seen.push(p); return false; },
+  });
+  assert.equal(seen[0], path.join('/linked-worktree', VENDORED_CLIENT_REL));
+});
+
+test('every returned entry is repo-relative (git pathspecs, not absolute paths)', () => {
+  for (const p of apiClientPathspec({ worktreeRoot: ROOT, existsSync: always })) {
+    assert.ok(!path.isAbsolute(p), `${p} must be repo-relative`);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/ship_base_flag.mjs

@@ -0,0 +1,93 @@
+// tests/ship_base_flag.mjs — task 1002422 (blocker 1000082).
+//
+// ship.js --base <ref>: grade a task whose commits ALREADY landed on main via the
+// RANK-OPEN graded path, instead of dead-ending at --allow-empty (which forces
+// skip-grade → the Archon-only /confirm no sub-Archon builder can finish). These
+// are DB-free unit tests of the two pure pieces: the ref validator (resolveBaseRef)
+// and the baseline override (computeGraderBaseline).
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+const { resolveBaseRef, computeGraderBaseline, baseRefShipGuard } = ship;
+
+test('resolveBaseRef: rejects empty / whitespace-only refs before touching git', () => {
+  // No git runner passed → if these reached git the test would hit a real repo.
+  // They must short-circuit on validation instead.
+  assert.equal(resolveBaseRef('').ok, false);
+  assert.equal(resolveBaseRef('   ').ok, false);
+  assert.equal(resolveBaseRef(null).ok, false);
+  assert.equal(resolveBaseRef(undefined).ok, false);
+});
+
+test('resolveBaseRef: rejects injection / flag-like / malformed refs (no shell reaches git)', () => {
+  for (const bad of ['-rf', '--upload-pack=evil', 'a b', 'a;rm -rf /', '$(evil)', '`evil`', 'a|b', 'a&&b', 'a>b', "a'b", 'a"b', '.hidden']) {
+    const r = resolveBaseRef(bad);
+    assert.equal(r.ok, false, `expected reject for ${JSON.stringify(bad)}`);
+    assert.match(r.reason, /invalid ref syntax/);
+  }
+});
+
+test('resolveBaseRef: a syntactically-valid ref git cannot resolve is rejected', () => {
+  const r = resolveBaseRef('deadbeef', { revParse: () => null, isAncestor: () => true });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /not a commit/);
+});
+
+test('resolveBaseRef: a valid commit that is NOT an ancestor of HEAD is rejected', () => {
+  // Guards against grading against a sibling/unrelated branch tip.
+  let sawSha = null;
+  const r = resolveBaseRef('some-branch', {
+    revParse: () => 'abc123def4567890',
+    isAncestor: (s) => { sawSha = s; return false; },
+  });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /not an ancestor of HEAD/);
+  assert.equal(sawSha, 'abc123def4567890', 'ancestry is checked against the RESOLVED sha, not the raw ref');
+});
+
+test('resolveBaseRef: a valid ancestor commit resolves to its sha', () => {
+  const r = resolveBaseRef('HEAD~1', {
+    revParse: () => 'fedcba9876543210',
+    isAncestor: () => true,
+  });
+  assert.deepEqual(r, { ok: true, sha: 'fedcba9876543210' });
+});
+
+test('resolveBaseRef: accepts normal ref shapes (sha, branch/slash, HEAD~n)', () => {
+  const stub = { revParse: () => 'cafebabecafebabe', isAncestor: () => true };
+  for (const good of ['ddace22', 'ddace226dcf13111', 'main', 'origin/main', 'HEAD~3', 'v1.18.15', 'release/1.18']) {
+    assert.equal(resolveBaseRef(good, stub).ok, true, `expected accept for ${good}`);
+  }
+});
+
+test('baseRefShipGuard: --base allowed ONLY when HEAD is 0 commits ahead of origin/main', () => {
+  // The security invariant. --base grades <base>...HEAD, but autoMerge lands the
+  // WHOLE branch — so if HEAD is ahead of main, unreviewed commits before <base>
+  // could reach main. Anything but exactly '0' ahead must refuse.
+  assert.equal(baseRefShipGuard('0').ok, true);
+  for (const ahead of ['1', '2', '17', '']) {
+    const g = baseRefShipGuard(ahead);
+    assert.equal(g.ok, false, `expected refuse at ahead=${JSON.stringify(ahead)}`);
+    assert.match(g.reason, /ahead of origin\/main/);
+  }
+  // Fail-safe: an unknown count (git rev-list failed / origin/main absent) refuses,
+  // never default-allows.
+  assert.equal(baseRefShipGuard(null).ok, false);
+  assert.equal(baseRefShipGuard(undefined).ok, false);
+});
+
+test('computeGraderBaseline: an explicit baseSha overrides merge-base (no git call)', () => {
+  // The --base override path: given a resolved sha, the baseline is that sha —
+  // computeGraderBaseline must NOT fall through to git merge-base. Passing a
+  // bogus claim proves it never reads claim.head_sha when baseSha is set. This is
+  // the whole point of --base: a real, non-empty <base>...HEAD diff for the grader.
+  assert.equal(computeGraderBaseline({ head_sha: 'IGNORED' }, 'MYBASESHA'), 'MYBASESHA');
+  // A falsy override does NOT short-circuit — it falls through to the normal
+  // merge-base logic (exercised against the live repo, so we only assert it did
+  // not wrongly echo the override sentinel back).
+  assert.notEqual(computeGraderBaseline({ head_sha: 'CLAIMSHA' }, null), 'MYBASESHA');
+});

package/tests/ship_ci_deploy.mjs

@@ -131,6 +131,60 @@ test('resolveDeployTarget: blank/whitespace config values are treated as unset',
   assert.equal(r.healthzUrl, null);
 });
 
+// ---- 1c. resolveInstanceBase precedence + the "no hardcoded host" guarantee (task 1002232) ----
+// The ci-land /version + /healthz probes, the ci PR-body deploy note, and the
+// manual-confirm curl guidance all baked in `https://amazonprimea.com`, so a
+// ci-land / manual-confirm on a migrated instance pointed at the WRONG box. The
+// helper derives the origin: env → session api_base → branding publicOrigin → null.
+// Every case injects env/sessionApiBase/branding so the machine's own env + session
+// file can't leak in (the resolveDeployTarget test convention).
+
+const { resolveInstanceBase } = ship;
+
+test('resolveInstanceBase: env <PREFIX>_API_BASE wins over session + branding', () => {
+  assert.equal(
+    resolveInstanceBase({
+      env: { GDS_API_BASE: 'https://env.example' },
+      sessionApiBase: 'https://session.example',
+      branding: { domains: { publicOrigin: 'https://brand.example' } },
+    }),
+    'https://env.example');
+});
+
+test('resolveInstanceBase: session api_base wins over branding when no env override', () => {
+  assert.equal(
+    resolveInstanceBase({
+      env: {},
+      sessionApiBase: 'https://session.example',
+      branding: { domains: { publicOrigin: 'https://brand.example' } },
+    }),
+    'https://session.example');
+});
+
+test('resolveInstanceBase: falls back to branding publicOrigin when no env + no session', () => {
+  assert.equal(
+    resolveInstanceBase({ env: {}, sessionApiBase: null, branding: { domains: { publicOrigin: 'https://cloudbongos.com' } } }),
+    'https://cloudbongos.com');
+});
+
+test('resolveInstanceBase: NO hardcoded host — nothing resolvable → null (never a founder default)', () => {
+  assert.equal(resolveInstanceBase({ env: {}, sessionApiBase: null, branding: null }), null);
+  assert.equal(resolveInstanceBase({ env: {}, sessionApiBase: null, branding: {} }), null);
+});
+
+test('resolveInstanceBase: trailing slashes are trimmed to a bare origin', () => {
+  assert.equal(
+    resolveInstanceBase({ env: {}, sessionApiBase: 'https://session.example/', branding: null }),
+    'https://session.example');
+  assert.equal(
+    resolveInstanceBase({ env: {}, sessionApiBase: null, branding: { domains: { publicOrigin: 'https://brand.example//' } } }),
+    'https://brand.example');
+});
+
+test('resolveInstanceBase: blank/whitespace session + branding values are treated as unset', () => {
+  assert.equal(resolveInstanceBase({ env: {}, sessionApiBase: '   ', branding: { domains: { publicOrigin: '' } } }), null);
+});
+
 test('parseDeployMode: SAFE DEFAULT laptop on malformed config JSON', () => {
   assert.equal(parseDeployMode(undefined, '{not json'), 'laptop');
 });
@@ -243,10 +297,20 @@ test('deployRunSucceeded: false on empty/missing inputs', () => {
 
 // ---- 5. the committed switch is LIVE on 'ci' (cutover landed: task 859, ADR 0042) ----
 
-test('config/deploy.json ships as ci (builder self-deploy cutover is ON)', () => {
-  const raw = fs.readFileSync(path.join(__dirname, '..', 'config', 'deploy.json'), 'utf8');
+test('config/deploy.json — when present ships as ci; absent is fine on the neutral core', () => {
+  // The neutral core carries NO config/deploy.json (it's an instance-owned switch;
+  // in the PUBLISH_ALLOWLIST so an instance CAN ship one, but the core has none).
+  // Reading it unconditionally ENOENT-failed on a clean core checkout (task 1002232);
+  // tolerate absence — when the file is missing, deploy mode resolves from env /
+  // effectiveDeployMode at runtime, which is correct, not a failure.
+  const p = path.join(__dirname, '..', 'config', 'deploy.json');
+  if (!fs.existsSync(p)) {
+    console.log('     (skip — no config/deploy.json in this checkout; neutral-core default)');
+    return;
+  }
+  const raw = fs.readFileSync(p, 'utf8');
   assert.equal(parseDeployMode(undefined, raw), 'ci',
-    'config/deploy.json ships as ci — builders self-deploy via PR auto-merge + Actions (task 859). ' +
+    'config/deploy.json, when present, ships as ci — builders self-deploy via PR auto-merge + Actions (task 859). ' +
     'To roll back to operator-laptop deploys, set mode "laptop" AND disarm the PROD_DEPLOY_VIA_CI repo var.');
 });
 
@@ -309,6 +373,19 @@ test('classifyLandOutcome: empty/none status → pending (never a false failure)
   assert.equal(classifyLandOutcome({ pr_state: 'none', merged: false, deploy_status: 'none' }), 'pending');
 });
 
+// task 1002472 — an instance with no deploy-prod.yml reports deploy_status
+// 'unconfigured'. Without this, the ship's own in-session poll reports 'pending'
+// forever on such an instance even after the server-side reconciler was fixed.
+// Must stay in step with github-push.landConfirmed (this CLI can't import it).
+test('classifyLandOutcome: merged + deploy unconfigured → shipped (no deploy workflow to wait for)', () => {
+  assert.equal(classifyLandOutcome({ pr_state: 'closed', merged: true, deploy_status: 'unconfigured' }), 'shipped');
+});
+
+test('classifyLandOutcome: NOT merged + deploy unconfigured → pending, never shipped', () => {
+  assert.equal(classifyLandOutcome({ pr_state: 'open', merged: false, deploy_status: 'unconfigured' }), 'pending');
+  assert.equal(classifyLandOutcome({ pr_state: 'closed', merged: false, deploy_status: 'unconfigured' }), 'failed');
+});
+
 // ---- 8. strandNextStep: box-aware recovery guidance, never gh-only /merge-mode on a box (task 1052) ----
 // The #1027 retrospective: a confirmed-strand on a dev box pointed the builder at
 // /merge-mode, which needs gh + a main checkout a box lacks — a dead end.

package/tests/ship_upstream_deletion.mjs

@@ -0,0 +1,57 @@
+// tests/ship_upstream_deletion.mjs
+//
+// task 1002475 — preflight's WARN-ONLY upstream-deletion step (step (d)): main
+// can delete or relocate a surface a claim branch's diff still touches (the R89
+// hall-ui-cutover class). The git I/O (fetch, `git log --diff-filter=D`) is
+// covered by the live ship smoke; here we pin down the pure seam that turns the
+// raw `git log --diff-filter=D --name-only --pretty=format:` output into the
+// deduped path list the warning is built from — the only part that can
+// silently drop or duplicate a hit.
+//
+// Pure function — no git, no filesystem, no network.
+//
+// Run:  node tests/ship_upstream_deletion.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { parseDeletedUpstreamPaths } = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('null / empty input → [] (no fetch, or nothing deleted)', () => {
+  assert.deepEqual(parseDeletedUpstreamPaths(null), []);
+  assert.deepEqual(parseDeletedUpstreamPaths(''), []);
+});
+
+t('a single deleted path', () => {
+  assert.deepEqual(parseDeletedUpstreamPaths('public-builders/index.html'), ['public-builders/index.html']);
+});
+
+t('multiple commits: blank lines between them are dropped', () => {
+  const raw = '\npublic-builders/index.html\npublic-builders/style.css\n\nold/thing.js\n';
+  assert.deepEqual(parseDeletedUpstreamPaths(raw), [
+    'public-builders/index.html',
+    'public-builders/style.css',
+    'old/thing.js',
+  ]);
+});
+
+t('the same path deleted across multiple commits dedupes, order preserved', () => {
+  const raw = 'a.js\nb.js\na.js\n';
+  assert.deepEqual(parseDeletedUpstreamPaths(raw), ['a.js', 'b.js']);
+});
+
+t('whitespace-only lines are dropped alongside blanks', () => {
+  const raw = 'a.js\n   \nb.js\n';
+  assert.deepEqual(parseDeletedUpstreamPaths(raw), ['a.js', 'b.js']);
+});
+
+console.log(`\nship.js upstream-deletion preflight (task 1002475) tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);