@bongos/core 1.19.1033 → 1.19.1035

package/tests/consumer_layout_boot.mjs

@@ -5,6 +5,11 @@
 // (config / modules / .claude) sitting at a DIFFERENT root — and prove the two-root
 // module loader (task 2133) discovers modules from BOTH roots.
 //
+// PLUS THE DATABASE HALF (task 1002863, audit H2 — "PROVE PUBLISH"): the same installed
+// package must also install from its OWN shipped lockfile, migrate a brand-new EMPTY
+// database, and serve a route that reads it. Before this, a core that installed and
+// answered /healthz but could not migrate would have passed every gate there was.
+//
 // WHY THIS EXISTS. Every existing gate runs the SOURCE tree with all deps present:
 //   - tests/platform_boot.mjs imports src/platform-server.js straight from the repo;
 //   - tests/fitness_two_root.mjs diverges resolveInstanceRoot() to a temp dir but
@@ -29,40 +34,205 @@
 //   6. fitness  — the packaged fitness.js discoveredModuleKeys() spans both roots.
 //   7. gen-file-map — reads the INSTANCE root (lists the consumer's .claude/skills).
 //   8. gen-repo-map — maps CORE code (scripts/gds/fitness.js) from node_modules.
+//   9. npm ci   — the lockfile SHIPPED inside the package (package-core prunes it to the
+//                 core's own dependency closure) installs with `npm ci` on its own: in step
+//                 with the package.json it ships beside, and every integrity hash verifies.
+//                 It is how the self-host image installs an unpacked core (its Dockerfile
+//                 runs `npm ci --omit=dev`), and the R88 break — integrity hashes blanked by
+//                 redaction — is exactly what `npm ci` refuses.
+//  10. migrate  — `npm run migrate` from the consumer root (the script `bongos init`
+//                 scaffolds and `bongos upgrade` runs) applies, to a brand-new EMPTY
+//                 database, every core migration and every migration of the modules a
+//                 default install enables — and none of a module it leaves off.
+//  11. db route — the installed server, booted against that database, serves a route that
+//                 reads it: a sentinel row written into the fresh database comes back out of
+//                 GET /api/bongos/public/versions, so the answer provably came from THIS
+//                 database and not from a cache, a fallback or some other database.
+//  12. modules  — a SECOND empty database, migrated with every optional module the package
+//                 ships switched on, applies every one of their migrations too. A default
+//                 install never runs those files, so a defect in one is invisible to check 10
+//                 — the gap the task-1004030 foreign-key break hid in.
+//
+// WHERE IT RUNS. This is an INTEGRATION harness (a package build, two installs, live boots
+// and a Postgres), so it sits in the INTEGRATION set of scripts/gds/run-unit-tests.js — the
+// per-PR unit gate never pays for it — and the `integration` job of
+// .github/workflows/integration.yml runs it on every push to main via
+// `run-unit-tests.js --integration`. That job's Postgres service supplies checks 10-12, but
+// NOT the job's own database: the lane has already migrated it and the suite mutates it, so
+// "migrates cleanly" asked there would be answered against a schema that already exists.
+// Each database leg CREATEs its own uniquely named empty database on the same server and
+// DROPs it afterwards, which also keeps the proof honest when it runs anywhere else.
 //
-// This is an INTEGRATION harness (a package build + `npm install` + a live boot), so
-// it is EXCLUDED from the DB-free unit gate (scripts/gds/run-unit-tests.js INTEGRATION
-// set) and driven by .github/workflows/consumer-layout-boot.yml. It needs NO Postgres
-// (/healthz, the loader, fitness, and the generators are all DB-free). Re-runnable:
+// WITHOUT A POSTGRES. Under CI (CI=true, which GitHub Actions sets) the database leg is
+// MANDATORY and an unreachable server FAILS the run: a leg that may skip in CI is a leg
+// that can rot there unseen. Anywhere else — a laptop, `package-core.js --self-verify-boot`
+// — checks 10-12 print SKIP lines (the runner surfaces them in its roll-up) and checks 1-9
+// still run. Re-runnable:
 //   node tests/consumer_layout_boot.mjs                                  # builds a fresh core .tgz
 //   CORE_TGZ=/abs/path/bongos-core-x.y.z.tgz node tests/consumer_layout_boot.mjs   # reuse a prebuilt one
+// The database leg uses the caller's own libpq settings (PGHOST / PGPORT / PGUSER /
+// PGPASSWORD, else the local socket); the role needs CREATEDB.
+//
+// THE CHILD PROCESSES GET A DELIBERATE ENVIRONMENT, never simply the caller's:
+//   - The PACKAGER gets no database settings. package-core's fail-closed leak gate treats
+//     every secret-named env value as a credential that must not appear in the artifact,
+//     and the integration lane's throwaway password is the literal word `postgres` — which
+//     is in hundreds of core files. So in that lane the packager refused to build and this
+//     harness died at check 1 with "cannot continue without a core tarball" (the failure
+//     task 1004034 parked it for). The packager needs no database; this artifact is thrown
+//     away, never published; and the publishing lane carries no database env at all, so
+//     its gate is exactly as strict as before.
+//   - The INSTANCE processes (migrate, and the server booted against the fresh database)
+//     get an ALLOWLIST — PATH, HOME, locale, and the connection to their own database —
+//     the way a provisioned instance's service unit does. Inheriting the lane's environment
+//     would point the server at the lane's own database (pool.js prefers DATABASE_URL to
+//     PGDATABASE), opt the migration into the source repo's instance seeds, and let any
+//     module flag set on the runner change which schema a "default install" produces.
 
 import assert from 'node:assert/strict';
 import http from 'node:http';
 import net from 'node:net';
 import { spawn, spawnSync } from 'node:child_process';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, realpathSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, realpathSync, readdirSync, statSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
+import { join, dirname, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const NPM_BIN = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 const CORE_VERSION_RANGE = '^1.0.0'; // consumer-probe's coreVersion — satisfied by any 1.x core.
+// The consumer's package.json is scaffolded by the SAME function `bongos init` uses for a
+// greenfield instance, so its `migrate` script is the real one rather than a copy that could drift.
+const { buildInstancePackageJson } = createRequire(import.meta.url)(join(REPO_ROOT, 'scripts', 'gds', 'init.js'));
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
 function check(name, fn) {
   try { fn(); passed++; console.log(`  PASS  ${name}`); }
   catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e && e.message ? e.message : e}`); }
 }
+// A check that could not run HERE. Printed as a SKIP line, which run-unit-tests.js counts and
+// names in its roll-up — a skipped check must never read as a passing one.
+function skip(name, reason) {
+  skipped++;
+  console.log(`  SKIP  ${name}\n        ${reason}`);
+}
+
+// ---------------------------------------------------------------------------
+// Child-process environments (see "THE CHILD PROCESSES GET A DELIBERATE ENVIRONMENT" above).
+// ---------------------------------------------------------------------------
+
+// Every variable that points a process at a database or authenticates it to one: libpq's PG*
+// family, plus the DSN pool.js prefers over all of them.
+const isDbEnvKey = (k) => k === 'DATABASE_URL' || /^PG[A-Z_]*$/.test(k);
+
+// The caller's environment minus every database setting — for the packager, and for the boot
+// that is meant to prove the package comes up with NO database at all.
+function withoutDbEnv(env = process.env) {
+  const out = {};
+  for (const [k, v] of Object.entries(env)) if (!isDbEnvKey(k)) out[k] = v;
+  return out;
+}
+
+// What an INSTANCE process inherits: the basics a shell, npm and node need, and nothing that
+// could choose its database, its seeds or its modules for it. The Windows names are there so a
+// builder on Windows can run this too; they are simply absent elsewhere.
+const INSTANCE_ENV_PASSTHROUGH = [
+  'PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'TMPDIR', 'TMP', 'TEMP', 'LANG', 'LC_ALL', 'NODE_ENV',
+  'SystemRoot', 'ComSpec', 'PATHEXT', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA',
+  'PGSSLMODE', 'PGPASSFILE',
+];
+function instanceEnv(conn, database, extra = {}) {
+  const env = {};
+  for (const k of INSTANCE_ENV_PASSTHROUGH) if (process.env[k] !== undefined) env[k] = process.env[k];
+  return { ...env, ...conn, PGDATABASE: database, ...extra };
+}
+
+// ---------------------------------------------------------------------------
+// The database leg's plumbing: psql with the CALLER's connection settings. -X skips ~/.psqlrc,
+// so a developer's own display settings cannot change the output parsed here.
+// ---------------------------------------------------------------------------
+function psql(sql, { database = 'postgres' } = {}) {
+  const r = spawnSync('psql', ['-X', '-q', '-v', 'ON_ERROR_STOP=1', '-tA', '-F', '|', '-d', database, '-c', sql], {
+    encoding: 'utf8',
+    env: { ...process.env, PGCONNECT_TIMEOUT: process.env.PGCONNECT_TIMEOUT || '5' },
+  });
+  if (r.error) return { ok: false, out: '', err: r.error.message };
+  return { ok: r.status === 0, out: (r.stdout || '').trim(), err: (r.stderr || '').trim() };
+}
+
+// Can this process reach a Postgres, and how exactly did it connect? The answer is handed to
+// the instance processes verbatim, so migrate.sh (psql) and the booted server (node-postgres)
+// reach the same server as the same role. That has to be spelled out: with no PGHOST, psql
+// uses its own compiled-in socket directory while pool.js assumes /var/run/postgresql, and
+// on a Homebrew install those differ.
+function probePostgres() {
+  const r = psql("SELECT current_user, current_setting('port'), coalesce(host(inet_server_addr()), ''), current_setting('unix_socket_directories')");
+  if (!r.ok) return { ok: false, reason: r.err || 'psql exited non-zero' };
+  const [user, port, serverAddr, socketDirs] = r.out.split('|');
+  const host = process.env.PGHOST || serverAddr || String(socketDirs || '').split(',')[0].trim();
+  const conn = { PGUSER: user, PGPORT: process.env.PGPORT || port };
+  if (host) conn.PGHOST = host;
+  if (process.env.PGPASSWORD) conn.PGPASSWORD = process.env.PGPASSWORD;
+  return { ok: true, conn };
+}
+
+// Every database this run creates, so the finally block can drop them whatever failed.
+const createdDatabases = [];
+function createEmptyDatabase(tag) {
+  const name = `consumer_boot_${tag}_${process.pid}_${randomBytes(3).toString('hex')}`;
+  const r = psql(`CREATE DATABASE ${name}`);
+  if (!r.ok) throw new Error(`CREATE DATABASE ${name} failed: ${r.err}`);
+  createdDatabases.push(name);
+  return name;
+}
+function dropCreatedDatabases() {
+  for (const name of createdDatabases) {
+    // FORCE (Postgres 13+) ends any connection a crashed server left behind; the plain form
+    // is the fallback for an older server.
+    if (!psql(`DROP DATABASE IF EXISTS ${name} WITH (FORCE)`).ok) psql(`DROP DATABASE IF EXISTS ${name}`);
+  }
+}
+
+// The migration files the INSTALLED package carries, as schema_migrations records them (by
+// filename stem). Walked the way migrate.sh's globs walk them — `*.sql` and `modules/*/` never
+// match a dot-file — the core root first, then the instance root, each module key once.
+const globVisible = (name) => !name.startsWith('.');
+function sqlStems(dir) {
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).filter((f) => globVisible(f) && f.endsWith('.sql')).map((f) => f.slice(0, -'.sql'.length)).sort();
+}
+function migrationInventory(coreRoot, instanceRoot) {
+  const byModule = {};
+  const seen = new Set();
+  for (const root of [coreRoot, instanceRoot]) {
+    const modulesDir = join(root, 'modules');
+    if (!existsSync(modulesDir)) continue;
+    for (const key of readdirSync(modulesDir).filter(globVisible).sort()) {
+      if (seen.has(key) || !statSync(join(modulesDir, key)).isDirectory()) continue;
+      seen.add(key);
+      const stems = sqlStems(join(modulesDir, key, 'migrations'));
+      if (stems.length) byModule[key] = stems;
+    }
+  }
+  return { core: sqlStems(join(coreRoot, 'migrations')), byModule };
+}
+function appliedStems(database) {
+  const r = psql('SELECT version FROM schema_migrations', { database });
+  if (!r.ok) throw new Error(`could not read schema_migrations from ${database}: ${r.err}`);
+  return new Set(r.out.split('\n').map((s) => s.trim()).filter(Boolean));
+}
 
 // Run a node snippet in `cwd` and parse its stdout as JSON. Used to introspect the
 // INSTALLED core (its loader / fitness / generators) exactly as a consumer process
 // would resolve them — absolute paths are injected so the snippet never depends on
-// the snippet file's own location (mirrors tests/fitness_two_root.mjs).
-function runNodeJSON(snippet, cwd) {
-  const r = spawnSync(process.execPath, ['-e', snippet], { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+// the snippet file's own location (mirrors tests/fitness_two_root.mjs). `env` defaults to
+// the caller's; the database leg passes an instance environment instead.
+function runNodeJSON(snippet, cwd, env = process.env) {
+  const r = spawnSync(process.execPath, ['-e', snippet], { cwd, env, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
   if (r.status !== 0) {
     throw new Error(`node snippet exited ${r.status}\n--- stdout ---\n${r.stdout}\n--- stderr ---\n${r.stderr}`);
   }
@@ -81,9 +251,10 @@ function freePort() {
   });
 }
 
-function getHealthz(port) {
+// GET a path on a local listener → { status, body }, or null when nothing answered.
+function httpGet(port, path, timeout = 2000) {
   return new Promise((resolve) => {
-    const req = http.get({ host: '127.0.0.1', port, path: '/healthz', timeout: 2000 }, (res) => {
+    const req = http.get({ host: '127.0.0.1', port, path, timeout }, (res) => {
       let body = '';
       res.on('data', (c) => (body += c));
       res.on('end', () => resolve({ status: res.statusCode, body }));
@@ -96,30 +267,51 @@ function getHealthz(port) {
 async function waitForHealthz(port, timeoutMs = 20000) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    const res = await getHealthz(port);
+    const res = await httpGet(port, '/healthz');
     if (res) return res;
     await new Promise((r) => setTimeout(r, 300));
   }
   return null;
 }
 
+// Start the INSTALLED server from the consumer root on a free port and wait for /healthz.
+// Returns { child, port, health, stderr() } — the caller owns killing the child.
+async function bootInstalledServer(coreDir, consumer, env) {
+  const port = await freePort();
+  const child = spawn(process.execPath, [join(coreDir, 'src', 'platform-server.js')], {
+    cwd: consumer,
+    env: { ...env, PORT: String(port), HOST: '127.0.0.1' },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  let err = '';
+  child.stderr.on('data', (c) => { err += c; });
+  child.stdout.on('data', () => {});
+  const health = await waitForHealthz(port);
+  return { child, port, health, stderr: () => err.slice(-2000) };
+}
+function stopServer(child) {
+  if (child && child.exitCode === null) { try { child.kill('SIGTERM'); } catch { /* already gone */ } }
+}
+
 async function main() {
-  console.log('=== consumer-layout boot proof (task 2142): install @bongos/core, boot it, assert two-root module load ===');
+  console.log('=== consumer-layout boot proof (tasks 2142 + 1002863): install @bongos/core, boot it, assert two-root module load, migrate an empty database, serve a database-backed route ===');
 
   const workRoot = mkdtempSync(join(tmpdir(), 'consumer-layout-'));
   const consumer = join(workRoot, 'consumer');
   let child = null;
+  let dbChild = null;
 
   try {
     // --- 1. package -----------------------------------------------------------
     // Build the installable core .tgz from HEAD (the committed tree — so on a PR the
     // job packages exactly the code under review). Reuse a prebuilt one via CORE_TGZ.
+    // No database settings reach the packager (header: THE CHILD PROCESSES ...).
     let tgz = process.env.CORE_TGZ || '';
     check('package: scripts/gds/package-core.js builds an installable .tgz', () => {
       if (tgz) { assert.ok(existsSync(tgz), `CORE_TGZ does not exist: ${tgz}`); return; }
       const outDir = join(workRoot, 'dist');
       const r = spawnSync(process.execPath, [join(REPO_ROOT, 'scripts/gds/package-core.js'), '--out-dir', outDir],
-        { cwd: REPO_ROOT, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+        { cwd: REPO_ROOT, env: withoutDbEnv(), encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
       assert.equal(r.status, 0, `package-core exited ${r.status}\n${r.stderr}`);
       const pinLine = r.stdout.trim().split('\n').filter(Boolean).pop();
       const pin = JSON.parse(pinLine);
@@ -135,13 +327,14 @@ async function main() {
     // crux: it can only be discovered via resolveInstanceRoot(), so finding it proves
     // the second root is scanned.
     mkdirSync(consumer, { recursive: true });
-    writeFileSync(join(consumer, 'package.json'), `${JSON.stringify({
+    // Scaffolded by init.js's own builder, so the consumer carries the exact start/migrate
+    // scripts a greenfield instance gets; `file:` pins the tarball the way a vendored core is.
+    writeFileSync(join(consumer, 'package.json'), `${JSON.stringify(buildInstancePackageJson({
       name: 'consumer-layout-probe',
       version: '0.0.0',
       private: true,
-      description: 'Ephemeral @bongos/core consumer used by the R89 two-root CI proof (task 2142).',
-      dependencies: { '@bongos/core': `file:${tgz}` },
-    }, null, 2)}\n`);
+      description: 'Ephemeral @bongos/core consumer used by the R89 two-root CI proof (task 2142) and its database leg (task 1002863).',
+    }, { coreDep: `file:${tgz}` }), null, 2)}\n`);
     writeFileSync(join(consumer, 'bongos.config.json'), `${JSON.stringify({ instanceRoot: '.' }, null, 2)}\n`);
     // A tiny instance CLAUDE.md (the charter heading keeps fitness's budget check happy
     // if anything reads it) — makes the tree a realistic instance, not load-bearing here.
@@ -198,21 +391,18 @@ async function main() {
     });
 
     // --- 4. boot + /healthz ---------------------------------------------------
-    const port = await freePort();
-    child = spawn(process.execPath, [join(coreDir, 'src', 'platform-server.js')], {
-      cwd: consumer,
-      env: { ...process.env, PORT: String(port), HOST: '127.0.0.1' },
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let childErr = '';
-    child.stderr.on('data', (c) => { childErr += c; });
-    child.stdout.on('data', () => {});
-    const health = await waitForHealthz(port);
+    // With NO database settings at all, so this asks the same question everywhere: does
+    // the package come up and answer /healthz before any database exists (the self-host
+    // image's HEALTHCHECK relies on exactly that)? Check 11 boots it against a real one.
+    const booted = await bootInstalledServer(coreDir, consumer, withoutDbEnv());
+    child = booted.child;
+    const health = booted.health;
     check('boot: node node_modules/@bongos/core/src/platform-server.js serves /healthz 200', () => {
-      assert.ok(health, `/healthz never came up on port ${port}\n--- server stderr ---\n${childErr.slice(-2000)}`);
+      assert.ok(health, `/healthz never came up on port ${booted.port}\n--- server stderr ---\n${booted.stderr()}`);
       assert.equal(health.status, 200, `/healthz status ${health.status}`);
       assert.equal(health.body.trim(), 'ok', `/healthz body was "${health.body}"`);
     });
+    stopServer(child); // nothing below needs this one; check 11 boots its own
 
     // --- 5. two-root module load (the task-2133 done-when) --------------------
     // The real default scan (DEFAULT_ROOTS) PLUS an explicit single-root scan that
@@ -290,13 +480,155 @@ async function main() {
       assert.ok(model.files > 50, `core scan found too few files (${model.files}) — core root not resolved to the package?`);
       assert.equal(model.hasFitness, true, 'gen-repo-map did not map the core file scripts/gds/fitness.js');
     });
+
+    // --- 9. npm ci from the SHIPPED, pruned lockfile --------------------------
+    // Unpack the tarball exactly as published and install it from its own lockfile — the
+    // end-to-end form of tests/pruned_lockfile_integrity.mjs, the network-free guard for the
+    // same R88 break. The resolved paths must land in THIS install, so a dependency found by
+    // walking up into some other node_modules cannot pass for one the lockfile provided.
+    check('npm ci: the pruned lockfile shipped inside the package installs its runtime dependencies', () => {
+      const unpacked = join(workRoot, 'unpacked');
+      mkdirSync(unpacked, { recursive: true });
+      const x = spawnSync('tar', ['-xzf', tgz, '-C', unpacked], { encoding: 'utf8' });
+      assert.equal(x.status, 0, `could not unpack ${tgz}: ${x.error ? x.error.message : x.stderr}`);
+      const pkgRoot = join(unpacked, 'package');
+      assert.ok(existsSync(join(pkgRoot, 'package-lock.json')), 'the package ships no package-lock.json to install from');
+      const r = spawnSync(NPM_BIN, ['ci', '--omit=dev', '--no-audit', '--no-fund', '--loglevel=error'],
+        { cwd: pkgRoot, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+      assert.equal(r.status, 0, `npm ci from the shipped lockfile exited ${r.status}\n${tail(r.stderr)}`);
+      const deps = runNodeJSON(`
+        const pkg = require('./package.json');
+        process.stdout.write(JSON.stringify(Object.keys(pkg.dependencies || {}).map((d) => [d, require.resolve(d)])));
+      `, pkgRoot);
+      assert.ok(deps.length > 0, 'the shipped package.json declares no dependencies, so nothing was proven installable');
+      const ownModules = join(realpathSync(pkgRoot), 'node_modules') + sep;
+      const elsewhere = deps.filter(([, p]) => !p.startsWith(ownModules)).map(([d, p]) => `${d} -> ${p}`);
+      assertNone(elsewhere, `resolved from OUTSIDE ${ownModules}`);
+    });
+
+    // --- 10-12. the database leg ----------------------------------------------
+    const DB_CHECKS = [
+      'migrate: npm run migrate applies every core + default-module migration to an EMPTY database, and nothing of a default-off module',
+      'db route: the installed server, booted against that database, serves GET /api/bongos/public/versions from it',
+      'modules: with every optional module switched on, an EMPTY database takes all of their migrations too',
+    ];
+    const pg = probePostgres();
+    if (!pg.ok) {
+      const why = `no usable Postgres (${pg.reason.split('\n')[0]}). Point PGHOST / PGPORT / PGUSER / PGPASSWORD at a server whose role may CREATE DATABASE.`;
+      if (process.env.CI) check('db: a Postgres is reachable for the database leg (MANDATORY under CI)', () => assert.fail(why));
+      else for (const name of DB_CHECKS) skip(name, why);
+    } else {
+      const inventory = migrationInventory(coreDir, consumer);
+      // Which modules the INSTALLED core enables, asked from the environment the migration
+      // gets — so the expectation and the run can never be answering different questions.
+      const moduleState = (env) => runNodeJSON(`
+        const mods = require(${A('src/modules.js')});
+        const ic = require(${A('src/instance-config.js')});
+        process.stdout.write(JSON.stringify({ enabled: mods.enabledModules(), envPrefix: ic.envPrefix() }));
+      `, consumer, env);
+      const migrate = (env) => spawnSync(NPM_BIN, ['run', 'migrate'],
+        { cwd: consumer, env, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+      const migrateFailure = (r) => `npm run migrate exited ${r.status}${r.error ? ` (${r.error.message})` : ''}\n`
+        + `--- stdout (tail) ---\n${tail(r.stdout)}\n--- stderr (tail) ---\n${tail(r.stderr)}`;
+
+      // 10. A DEFAULT install — the modules the package switches on by itself, nothing more.
+      let defaultsDb = null;
+      let defaultsMigrated = false;
+      check(DB_CHECKS[0], () => {
+        assert.ok(inventory.core.length > 0, 'the installed package ships no core migrations at all');
+        defaultsDb = createEmptyDatabase('defaults');
+        const env = instanceEnv(pg.conn, defaultsDb);
+        const on = new Set(moduleState(env).enabled);
+        const r = migrate(env);
+        assert.equal(r.status, 0, migrateFailure(r));
+        const applied = appliedStems(defaultsDb);
+        assertNone(inventory.core.filter((s) => !applied.has(s)), 'core migration(s) the package ships were not recorded');
+        const missing = [];
+        const leaked = [];
+        for (const [key, stems] of Object.entries(inventory.byModule)) {
+          if (on.has(key)) missing.push(...stems.filter((s) => !applied.has(s)).map((s) => `${key}/${s}`));
+          else leaked.push(...stems.filter((s) => applied.has(s)).map((s) => `${key}/${s}`));
+        }
+        assertNone(missing, 'migration(s) of a default-on module were not recorded');
+        assertNone(leaked, 'migration(s) of a module a default install leaves OFF were applied, so this was not a default install');
+        defaultsMigrated = true;
+      });
+
+      // 11. The server, booted against that database, answers from it. The sentinel row is
+      // written straight into the fresh database, so finding it in the HTTP response proves
+      // the route really read this database through the installed code.
+      if (defaultsMigrated) {
+        const sentinelId = `CONSUMER-PROBE-${randomBytes(4).toString('hex').toUpperCase()}`;
+        const ins = psql(`INSERT INTO versions (id, name, status) VALUES ('${sentinelId}', 'consumer_layout_boot sentinel (task 1002863)', 'shipped')`, { database: defaultsDb });
+        const boot = ins.ok ? await bootInstalledServer(coreDir, consumer, instanceEnv(pg.conn, defaultsDb)) : null;
+        dbChild = boot ? boot.child : null;
+        const route = boot && boot.health ? await httpGet(boot.port, '/api/bongos/public/versions', 5000) : null;
+        check(DB_CHECKS[1], () => {
+          assert.ok(ins.ok, `could not write the sentinel version row into ${defaultsDb}: ${ins.err}`);
+          assert.ok(boot.health, `/healthz never came up against the migrated database\n--- server stderr ---\n${boot.stderr()}`);
+          assert.equal(boot.health.status, 200, `/healthz status ${boot.health.status}`);
+          assert.ok(route, 'GET /api/bongos/public/versions got no answer at all');
+          assert.equal(route.status, 200,
+            `GET /api/bongos/public/versions -> ${route.status}: ${route.body.slice(0, 500)}\n--- server stderr ---\n${boot.stderr()}`);
+          const ids = (JSON.parse(route.body).versions || []).map((v) => v.id);
+          assert.ok(ids.includes(sentinelId),
+            `the sentinel ${sentinelId} written into ${defaultsDb} is not in the response (${JSON.stringify(ids)}), so the server did not read the database that was migrated`);
+        });
+        stopServer(dbChild);
+      } else {
+        check(DB_CHECKS[1], () => assert.fail('not attempted: the default-install migration (check 10) failed, so there is no migrated database to boot against'));
+      }
+
+      // 12. Every optional module on. Migration only: booting with all of them on is a
+      // different question, since a module may need an npm dependency the core does not
+      // carry (discord needs discord.js, which an instance that enables it installs itself).
+      const probeEnv = instanceEnv(pg.conn, 'postgres');
+      const defaults = moduleState(probeEnv);
+      const optional = Object.keys(inventory.byModule).filter((k) => !defaults.enabled.includes(k));
+      if (optional.length === 0) {
+        skip(DB_CHECKS[2], 'every module that ships migrations is already on by default, so check 10 covered them all');
+      } else {
+        check(DB_CHECKS[2], () => {
+          const modulesDb = createEmptyDatabase('modules');
+          // <PREFIX>_MODULE_<KEY> is the documented per-module switch (src/modules.js). The
+          // spelling is checked below against the installed core itself, so a changed rule or
+          // a refused module fails here loudly instead of quietly testing a default install.
+          const flags = Object.fromEntries(optional.map((k) => [`${defaults.envPrefix}_MODULE_${k.toUpperCase().replace(/-/g, '_')}`, '1']));
+          const env = { ...instanceEnv(pg.conn, modulesDb), ...flags };
+          const nowOn = new Set(moduleState(env).enabled);
+          assertNone(optional.filter((k) => !nowOn.has(k)), `module(s) did not switch on with ${Object.keys(flags).join(', ')}`);
+          const r = migrate(env);
+          assert.equal(r.status, 0, `${migrateFailure(r)}\n(modules switched on: ${optional.join(', ')})`);
+          const applied = appliedStems(modulesDb);
+          assertNone(inventory.core.filter((s) => !applied.has(s)), 'core migration(s) the package ships were not recorded');
+          const missing = [];
+          for (const [key, stems] of Object.entries(inventory.byModule)) {
+            missing.push(...stems.filter((s) => !applied.has(s)).map((s) => `${key}/${s}`));
+          }
+          assertNone(missing, 'module migration(s) were not recorded with every module switched on');
+        });
+      }
+    }
   } finally {
-    if (child && child.exitCode === null) { try { child.kill('SIGTERM'); } catch { /* already gone */ } }
+    stopServer(child);
+    stopServer(dbChild);
+    dropCreatedDatabases();
     try { rmSync(workRoot, { recursive: true, force: true }); } catch { /* best-effort */ }
   }
 
-  console.log(`\nconsumer_layout_boot: ${passed} passed, ${failed} failed`);
+  console.log(`\nconsumer_layout_boot: ${passed} passed, ${failed} failed${skipped ? `, ${skipped} skipped` : ''}`);
   process.exit(failed ? 1 : 0);
 }
 
+// The last lines of a child's output — enough to read a failure, bounded so a 300-migration
+// log cannot bury it.
+function tail(text, lines = 40) {
+  return String(text || '').trim().split('\n').slice(-lines).join('\n');
+}
+
+// Fail with the offending entries NAMED. assert.deepEqual(list, [], msg) would print only msg.
+function assertNone(list, what) {
+  if (list.length) assert.fail(`${list.length} ${what}: ${list.slice(0, 25).join(', ')}${list.length > 25 ? ', ...' : ''}`);
+}
+
 main().catch((e) => { console.error(e); process.exit(1); });

package/tests/core_upgrade_door.mjs

@@ -18,6 +18,7 @@ import { createRequire } from 'node:module';
 import { readFileSync, readdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
+import { parseRepoNote } from '../modules/provisioning/core-upgrade.js';
 
 const require = createRequire(import.meta.url);
 const P = require('../modules/provisioning/provisioning.js');
@@ -537,12 +538,11 @@ await t('a guard refusal reaches the owner as ITS OWN sentence, not "internal er
   // was shown as a 500 "internal error" while the real sentence sat in the journal —
   // which is how the preview refusal stayed invisible until it was pressed live.
   // Elsewhere in this file we already assert that sentence is well-formed; nothing
-  // asserted it ARRIVED.
+  // asserted it ARRIVED. The refusal is the guard's REAL one: a look-alike carrying the
+  // same three fields is deliberately not forwarded any more (task 1004126).
   const h = validatorHarness();
-  const refusal = Object.assign(new Error('blocked'), {
-    code: 'control_plane_protected', status: 409,
-    publicMessage: 'That action cannot be aimed at the machine the platform itself runs on.',
-  });
+  const selfRow = { query: async () => ({ rows: [{ hosting_shape: 'control-plane' }] }) };
+  const refusal = await G.assertIntentAllowed(selfRow, 7, 'teardown').then(() => null, (e) => e);
   h.provisioning.enqueueIntent = async () => { throw refusal; };
   await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.926' } }, h.res);
   const { body } = h.read();
@@ -553,7 +553,7 @@ await t('a guard refusal reaches the owner as ITS OWN sentence, not "internal er
 
 await t('an UNEXPECTED throw is still opaque — this is not a blanket error passthrough', async () => {
   // Forwarding every error would leak internals. Only an error that declared itself
-  // public (code + status + publicMessage) is forwarded.
+  // public (a PublicRefusal, modules/provisioning/public-refusal.js) is forwarded.
   const h = validatorHarness();
   h.provisioning.enqueueIntent = async () => { throw new Error('connection terminated: relation "secrets" does not exist'); };
   await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.926' } }, h.res);
@@ -732,6 +732,40 @@ await t('a SUCCESSFUL move is attributable, not merely finished', () => {
   assert.equal(p.last_move.error, null);
 });
 
+await t('a move that LANDED but could not update GitHub carries a warning, never an error (task 1004065)', () => {
+  // The runner resolves such a move `done` — the site really runs the new core — with
+  // a note in last_error. Reading that note as an error would paint a working upgrade
+  // as a failed one; dropping it is the silence this task exists to end.
+  const done = { action: 'core-upgrade', state: 'done', target_version: '1.19.949', resolved_at: new Date().toISOString(),
+    last_error: 'repo_not_updated:no_access: The hub had no permission to write to the project\'s GitHub repository.' };
+  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, served_version: '1.19.949', recommended: null }, null, done);
+  assert.equal(p.last_move.state, 'done');
+  assert.equal(p.last_move.error, null, 'not an error — the move worked');
+  assert.deepEqual(p.last_move.warning, { code: 'no_access', text: 'The hub had no permission to write to the project\'s GitHub repository.' });
+});
+
+await t('an ERROR move keeps its error and carries no warning', () => {
+  const failed = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'working tree not clean' };
+  const p = CU.previewFromSnapshot(ACTIVE, SNAP, null, failed);
+  assert.match(p.last_move.error, /working tree not clean/);
+  assert.equal(p.last_move.warning, null);
+});
+
+await t('a clean move has neither', () => {
+  const done = { action: 'core-upgrade', state: 'done', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: null };
+  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, served_version: '1.19.949', recommended: null }, null, done);
+  assert.equal(p.last_move.error, null);
+  assert.equal(p.last_move.warning, null);
+});
+
+await t('only the runner\'s own note shape is read as a repo warning — anything else is not invented into one', () => {
+  assert.equal(parseRepoNote(null), null);
+  assert.equal(parseRepoNote('working tree not clean'), null);
+  assert.equal(parseRepoNote('repo_not_updated:Bad Code: x'), null, 'a code is a fixed lower-case word');
+  assert.deepEqual(parseRepoNote('repo_not_updated:behind: GitHub has changes.'), { code: 'behind', text: 'GitHub has changes.' });
+  assert.ok(parseRepoNote(`repo_not_updated:failed: ${'x'.repeat(5000)}`).text.length <= 600, 'bounded — it reaches a DOM');
+});
+
 await t('a long refusal is truncated — it reaches a DOM', () => {
   // The dirty-tree refusal carries a whole `git status`; test4's ran to dozens of lines.
   const huge = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'x'.repeat(5000) };