@bongos/core 1.19.1033 → 1.19.1035

package/tests/integration_parked_ratchet.mjs

@@ -41,7 +41,18 @@ const { INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING } = require('../scripts/g
 // Two later readings — 2/2 locally on a clean database, and the first CI run after
 // the parking landed — showed the pass was the anomaly. No new breakage was parked
 // here; one straggler joined the cohort it always belonged to.
-const MAX_PARKED = 24;
+//
+// LOWERED 24 → 23 by task 1002863: consumer_layout_boot was fixed and un-parked, and the
+// ceiling follows it down so the freed slot cannot quietly be spent on a new failure.
+const MAX_PARKED = 23;
+
+// The one test that proves the PUBLISHED package works end to end: packaged, installed into
+// a consumer, installed again from its own shipped lockfile, migrated onto EMPTY databases,
+// and serving a database-backed route (tasks 2142 + 1002863 — "PROVE PUBLISH"). Every other
+// test runs the source tree; none installs the package and runs it. So while this one is
+// parked or unselected that guarantee silently does not exist — which is exactly how it sat,
+// parked, from task 1004034 until task 1002863 found out why it failed.
+const PUBLISH_PROOF = 'consumer_layout_boot';
 
 test('every parked entry names a test file that exists', () => {
   const ghosts = [...INTEGRATION_PARKED]
@@ -71,6 +82,18 @@ test('no test is parked in both INTEGRATION_PARKED and KNOWN_FAILING', () => {
     'parked in two places at once — pick the mechanism that owns each test.');
 });
 
+test('the packaged-core proof is selected by the integration lane and parked nowhere', () => {
+  assert.ok(fs.existsSync(path.join(TESTS_DIR, `${PUBLISH_PROOF}.mjs`)),
+    `tests/${PUBLISH_PROOF}.mjs is gone — nothing proves the published package installs, migrates and serves any more.`);
+  assert.ok(INTEGRATION.has(PUBLISH_PROOF),
+    `${PUBLISH_PROOF} is not in the INTEGRATION set, so either the DB-free unit gate would try to run it `
+    + '(it needs npm, a network and a Postgres) or no lane selects it at all.');
+  assert.ok(!INTEGRATION_PARKED.has(PUBLISH_PROOF) && !KNOWN_FAILING.has(PUBLISH_PROOF),
+    `${PUBLISH_PROOF} is parked. It is the only proof that the PUBLISHED core installs, migrates an `
+    + 'empty database and serves from it; parking it re-opens that gap without a single red check. '
+    + 'Fix the failure instead — or, if parking is truly the call, make it deliberately by editing this guard.');
+});
+
 test('the parked count is ratcheted and cannot grow silently', () => {
   const n = INTEGRATION_PARKED.size;
   assert.ok(n <= MAX_PARKED,

package/tests/provisioning_public_refusal.mjs

@@ -0,0 +1,195 @@
+// tests/provisioning_public_refusal.mjs — a refusal reaches the person as its own sentence,
+// and nothing else ever does (task 1004126).
+//
+// THE BUG. The control-plane guard refuses a destructive action on the platform's own row
+// with a code, a 409 and a sentence written for the owner. Every catch in the provisioning
+// module answered a blanket 500 "internal error" instead, so an owner who pressed Take
+// offline or Disconnect on that row read "internal error" while the real sentence went only
+// to the journal. Task 1004125 fixed ONE catch by duck-typing three fields; twenty-three more
+// had the same shape.
+//
+// WHAT THESE PIN.
+//   • failFrom forwards a declared PublicRefusal, and ONLY that: a look-alike carrying the
+//     same three fields and a Postgres error naming a table both get the opaque 500.
+//   • the guard throws a PublicRefusal, so there is one definition of "public", not one per catch.
+//   • the three routes that can reach the guard today (owner teardown, force-teardown,
+//     disconnect) answer 409 with the guard's sentence, driven through the REAL router, the
+//     REAL enqueue helper and the REAL guard; an unexpected error on the same routes still
+//     answers 500 and leaks nothing.
+//   • the ratchet: no catch in the module answers a 5xx except through failFrom.
+//
+// DB-free: the shared pool's query is stubbed and auth is faked. No network.
+//
+// Run:  node --test tests/provisioning_public_refusal.mjs
+
+import assert from 'node:assert/strict';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { PublicRefusal, isPublicRefusal, failFrom } = require('../modules/provisioning/public-refusal.js');
+const guard = require('../modules/provisioning/control-plane-guard.js');
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+// A res that records what failFrom answered, through the same envelope a route uses.
+function recorder() {
+  const out = {};
+  return { out, fail: (code, opts) => { Object.assign(out, { code, ...opts }); } };
+}
+const selfRowDb = { query: async () => ({ rows: [{ hosting_shape: 'control-plane' }] }) };
+const guardRefusal = () => guard.assertIntentAllowed(selfRowDb, 1, 'teardown').then(() => null, (e) => e);
+
+// ---- the helper -----------------------------------------------------------------
+
+test('failFrom forwards a PublicRefusal as its own code, status and PUBLIC sentence', () => {
+  const r = recorder();
+  failFrom(r, new PublicRefusal({ code: 'nope', status: 409, publicMessage: 'You cannot do that here.', message: 'journal: row 7 is special' }), 'x_failed');
+  assert.deepEqual(r.out, { code: 'nope', status: 409, message: 'You cannot do that here.' }, 'the journal sentence stays in the journal');
+});
+
+test('a look-alike with the same three fields is NOT public — only a declared refusal is', () => {
+  // Task 1004125's catch duck-typed on code && status && publicMessage. Anything can carry
+  // those; only the class says it was written for a person.
+  const r = recorder();
+  failFrom(r, Object.assign(new Error('x'), { code: 'lookalike', status: 409, publicMessage: 'leaked' }), 'x_failed');
+  assert.deepEqual(r.out, { code: 'x_failed', status: 500, message: 'internal error' });
+});
+
+test('an unexpected error is opaque — a Postgres error naming a table never reaches the client', () => {
+  const r = recorder();
+  const pg = Object.assign(new Error('relation "provisioning_intents" does not exist'), { code: '42P01', status: 500 });
+  failFrom(r, pg, 'teardown_failed');
+  assert.deepEqual(r.out, { code: 'teardown_failed', status: 500, message: 'internal error' });
+  assert.equal(isPublicRefusal(pg), false);
+});
+
+test('a refusal is never an outage: PublicRefusal will not carry a non-4xx status', () => {
+  assert.throws(() => new PublicRefusal({ code: 'boom', status: 500, publicMessage: 'x' }), /4xx/);
+  assert.throws(() => new PublicRefusal({ code: 'boom', status: 409 }), /publicMessage/);
+});
+
+test('the control-plane guard throws a PublicRefusal: the owner sentence public, the journal one not', async () => {
+  const err = await guardRefusal();
+  assert.ok(isPublicRefusal(err), 'the guard declares its refusal public');
+  assert.equal(err.code, 'control_plane_protected');
+  assert.equal(err.status, 409);
+  assert.match(err.publicMessage, /cannot be aimed at the machine the platform itself runs on/);
+  assert.match(err.message, /'teardown' cannot be aimed at the control plane/, 'the journal keeps the action it refused');
+  assert.equal(await guard.assertIntentAllowed(selfRowDb, 1, 'restart'), undefined, 'an allowed action is still allowed');
+});
+
+// ---- the routes, through the real router, enqueue helper and guard --------------
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner', rank: 'archon' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+const selfRow = { id: 1, slug: 'platform', owner_builder_id: 7, status: 'active', hosting_shape: 'control-plane' };
+provisioning.getInstanceById = async () => ({ ...selfRow });
+provisioning.recordEvent = async () => {};
+
+// The shared pool: the guard's shape lookup answers 'control-plane'; every other read and
+// the teardown's supersede UPDATE answer nothing. `fault` makes every query throw instead.
+let fault = null;
+api.pool.query = async (sql) => {
+  if (fault) throw fault;
+  if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) return { rows: [{ hosting_shape: 'control-plane' }] };
+  return { rows: [] };
+};
+
+const express = require('express');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', require('../modules/provisioning/routes/provisioning.js')());
+app.use('/api/bongos', require('../modules/provisioning/routes/disconnect.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+after(() => server.close());
+
+function post(p, body = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`http://127.0.0.1:${server.address().port}/api/bongos${p}`, {
+      method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d), raw: d }));
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+const REACHABLE = [
+  ['owner teardown', '/provisioning/instances/1/teardown', {}, 'teardown_failed'],
+  ['force-teardown', '/provisioning/instances/1/force-teardown', {}, 'teardown_failed'],
+  ['disconnect', '/provisioning/instances/1/disconnect', { confirm_slug: 'platform' }, 'disconnect_failed'],
+];
+
+for (const [name, p, body, fallback] of REACHABLE) {
+  test(`${name} on the platform's own row answers 409 with the guard's sentence, not "internal error"`, async () => {
+    fault = null;
+    const r = await post(p, body);
+    assert.equal(r.status, 409, r.raw);
+    assert.equal(r.body.error.code, 'control_plane_protected');
+    assert.equal(r.body.error.message, (await guardRefusal()).publicMessage);
+  });
+
+  test(`${name}: an unexpected failure is still an opaque 500 (${fallback}) that leaks nothing`, async () => {
+    fault = new Error('relation "provisioning_intents" does not exist');
+    const r = await post(p, body);
+    fault = null;
+    assert.equal(r.status, 500, r.raw);
+    assert.deepEqual(r.body.error, { code: fallback, message: 'internal error' });
+  });
+}
+
+// ---- the ratchet ------------------------------------------------------------------
+
+// Every `catch (e) { … }` / `catch { … }` body in a file, with the line it opens on. A
+// promise's `.catch(() => …)` is not a catch block and is not matched.
+function catchBodies(src) {
+  const out = [];
+  const re = /\bcatch\s*(?:\(\s*\w*\s*\))?\s*\{/g;
+  for (let m = re.exec(src); m; m = re.exec(src)) {
+    let depth = 1;
+    let i = re.lastIndex;
+    for (; i < src.length && depth; i++) depth += src[i] === '{' ? 1 : src[i] === '}' ? -1 : 0;
+    out.push({ line: src.slice(0, m.index).split('\n').length, body: src.slice(re.lastIndex, i - 1) });
+  }
+  return out;
+}
+
+test('no catch in the provisioning module answers a 5xx except through failFrom', () => {
+  const dir = path.join(ROOT, 'modules', 'provisioning');
+  const files = fs.readdirSync(dir, { recursive: true }).map(String)
+    .filter((f) => f.endsWith('.js') && !f.split(path.sep).includes('tests'));
+  const HAND_ROLLED_5XX = /res\.fail\([^;]*?(status:\s*5\d\d|,\s*5\d\d\s*[,)])/;
+  const offenders = [];
+  let viaHelper = 0;
+  for (const f of files) {
+    for (const c of catchBodies(fs.readFileSync(path.join(dir, f), 'utf8'))) {
+      if (HAND_ROLLED_5XX.test(c.body)) offenders.push(`${f}:${c.line}`);
+      if (/\bfailFrom\(res, /.test(c.body)) viaHelper++;
+    }
+  }
+  assert.deepEqual(offenders, [], 'answer with failFrom(res, err, <code>) so a declared refusal can reach the person');
+  assert.ok(viaHelper >= 20, `the scan must reach the converted catches (24 at task 1004126), saw ${viaHelper}`);
+});
+
+test('the ratchet reads a hand-rolled 500 in a catch, and not one outside a catch', () => {
+  const src = "try { a(); } catch (err) {\n  log.error('x', err);\n  res.fail('x_failed', { status: 500, message: 'internal error' });\n}\nres.fail('config_unset', { status: 500, message: 'no origin' });\n"
+    + "p.catch(() => {});\ntry { b(); } catch { res.fail('y_failed', 500); }";
+  const bodies = catchBodies(src);
+  assert.equal(bodies.length, 2, 'a catch with no binding counts; a promise .catch does not');
+  assert.match(bodies[1].body, /y_failed/);
+  assert.match(bodies[0].body, /x_failed/);
+  assert.doesNotMatch(bodies[0].body, /config_unset/, 'a config refusal outside a catch is a real sentence, not a swallowed error');
+});

package/tests/publish_status_branch.mjs

@@ -0,0 +1,128 @@
+// tests/publish_status_branch.mjs — GET /tasks/:id/publish-status finds the task's
+// branch itself when the caller names none (task 1003764, gap 1).
+//
+// WHY. This route is the diagnostic every agent is told to use INSTEAD of raw git
+// probes (push-path-brief.js, the stuck-strike nudge), and it required ?branch=. Called
+// the way those briefs spell it — no query — it answered 400 bad_branch for task
+// 1003747 while origin carried its live, server-pushed branch and PR 673 sat open. The
+// sanctioned diagnostic was the one thing that could not diagnose a live publish.
+//
+// Drives the real route handler with fake req/res and stubbed github-push reads: no
+// DB, no server, no network. Run:  node tests/publish_status_branch.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+
+const gp = require('../modules/lifecycle/github-push.js');
+const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
+
+let pass = 0;
+let fail = 0;
+const t = async (name, fn) => {
+  try { await fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
+};
+
+const CRED_KEYS = ['GITHUB_PUSH_TOKEN', 'GITHUB_APP_ID', 'GITHUB_APP_INSTALLATION_ID', 'GITHUB_APP_PRIVATE_KEY'];
+
+// Stub the github-push reads the route makes, run the handler once, restore everything.
+// `calls` records what the route asked GitHub for, so a test can prove what it did NOT do.
+async function callRoute(query, stubs = {}) {
+  const saved = {};
+  for (const k of ['findTaskPullRequest', 'getPublishStatus', 'mergeIfGreen']) saved[k] = gp[k];
+  const savedEnv = CRED_KEYS.map((k) => [k, process.env[k]]);
+  const calls = { findTaskPullRequest: [], getPublishStatus: [], mergeIfGreen: [] };
+  gp.findTaskPullRequest = async (a) => { calls.findTaskPullRequest.push(a); return stubs.taskPr === undefined ? null : stubs.taskPr; };
+  gp.getPublishStatus = async (a) => {
+    calls.getPublishStatus.push(a);
+    return stubs.status || { pr_state: 'open', merged: false, merge_sha: null, deploy_status: 'pending', pr_url: 'https://github.test/pr/673', pr_number: 673 };
+  };
+  gp.mergeIfGreen = async (a) => { calls.mergeIfGreen.push(a); return stubs.mergeDriver || { reason: 'failing_check:unit', failing_tests: '1 failed: fitness' }; };
+  for (const k of CRED_KEYS) delete process.env[k];
+  process.env.GITHUB_PUSH_TOKEN = 'ghp_fake_for_isConfigured';
+  try {
+    const router = buildTasksRouter();
+    const layer = router.stack.find((l) => l.route && l.route.path === '/tasks/:id/publish-status' && l.route.methods.get);
+    const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+    const out = { failCode: null, failOpts: null, body: null };
+    const res = {
+      status() { return this; },
+      json(b) { out.body = b; return this; },
+      fail(code, opts) { out.failCode = code; out.failOpts = opts; return this; },
+    };
+    // rank archon → gateTaskOwnership passes without a DB lookup, keeping this hermetic.
+    await handler({ params: { id: '1003747' }, query, builder: { id: 25, rank: 'archon' } }, res);
+    return { ...out, calls };
+  } finally {
+    Object.assign(gp, saved);
+    for (const [k, v] of savedEnv) { if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+  }
+}
+
+await t('no ?branch= → the route finds the task\'s own PR branch instead of answering 400 (the task 1003747 repro)', async () => {
+  const r = await callRoute({}, { taskPr: { branch: 'task-1003747', pr_number: 673, pr_state: 'open', merged: false } });
+  assert.equal(r.failCode, null, `must not refuse — got ${r.failCode}`);
+  assert.equal(r.body.ok, true);
+  assert.equal(r.body.branch, 'task-1003747', 'reports which branch it answered about');
+  assert.equal(r.body.branch_source, 'task_pr', 'and how it found it');
+  assert.deepEqual(r.calls.findTaskPullRequest, [{ taskId: 1003747 }], 'looked the PR up by THIS task id');
+  assert.deepEqual(r.calls.getPublishStatus, [{ branch: 'task-1003747' }]);
+  assert.equal(r.body.pr_number, 673);
+  // The whole point: the red check is now one call away, not twenty minutes of git.
+  assert.equal(r.body.merge_driver.failing_tests, '1 failed: fitness');
+  assert.deepEqual(r.calls.mergeIfGreen, [{ branch: 'task-1003747' }]);
+});
+
+await t('no ?branch= and no PR for the task → 200 "none" with a hint, never a 400, and nothing else is probed', async () => {
+  const r = await callRoute({}, { taskPr: null });
+  assert.equal(r.failCode, null);
+  assert.equal(r.body.ok, true);
+  assert.equal(r.body.pr_state, 'none');
+  assert.equal(r.body.merged, false);
+  assert.equal(r.body.branch, null);
+  assert.equal(r.body.branch_source, null);
+  assert.match(r.body.branch_hint, /\?branch=/, 'says how to ask about a specific branch');
+  assert.equal(r.body.reconciled, false);
+  assert.equal(r.body.merge_driver, null);
+  assert.deepEqual(r.calls.getPublishStatus, [], 'no branch → no branch-status read');
+  assert.deepEqual(r.calls.mergeIfGreen, [], 'no PR → the merge driver never runs');
+});
+
+await t('an empty ?branch= is treated as absent, not as a bad branch', async () => {
+  const r = await callRoute({ branch: '' }, { taskPr: { branch: 'task-1003747', pr_number: 673 } });
+  assert.equal(r.failCode, null);
+  assert.equal(r.body.branch_source, 'task_pr');
+});
+
+await t('an explicit ?branch= still wins, and the task-PR lookup is skipped', async () => {
+  const r = await callRoute({ branch: 'claude/some-worktree' });
+  assert.equal(r.failCode, null);
+  assert.equal(r.body.branch, 'claude/some-worktree');
+  assert.equal(r.body.branch_source, 'query');
+  assert.deepEqual(r.calls.findTaskPullRequest, [], 'the caller named the branch; nothing to look up');
+  assert.deepEqual(r.calls.getPublishStatus, [{ branch: 'claude/some-worktree' }]);
+});
+
+await t('a fully-qualified refs/heads/<branch> names the same branch and is accepted', async () => {
+  const r = await callRoute({ branch: 'refs/heads/task-1003747' });
+  assert.equal(r.failCode, null);
+  assert.equal(r.body.branch, 'task-1003747');
+  assert.deepEqual(r.calls.getPublishStatus, [{ branch: 'task-1003747' }]);
+});
+
+await t('a genuinely unsafe branch is still refused 400 — in a sentence, before any GitHub call', async () => {
+  for (const branch of ['-rf', 'a/../../etc', 'refs/tags/x', ['a', 'b']]) {
+    const r = await callRoute({ branch });
+    assert.equal(r.failCode, 'bad_branch', `${JSON.stringify(branch)} must be refused`);
+    assert.equal(r.failOpts.status, 400);
+    assert.match(r.failOpts.message, /left out/, 'the refusal says the branch can simply be omitted');
+    assert.deepEqual(r.calls.findTaskPullRequest, []);
+    assert.deepEqual(r.calls.getPublishStatus, []);
+  }
+});
+
+console.log(`\npublish-status branch resolution (task 1003764): ${pass} passed, ${fail} failed`);
+process.exitCode = fail > 0 ? 1 : 0;

package/tests/routine_observability_api.mjs

@@ -0,0 +1,195 @@
+// tests/routine_observability_api.mjs — the unattended routines are diagnosable from off
+// the box (task 1002669).
+//
+// Every autonomy-gate decision already lands in `autonomy_runs` and every core upgrade in
+// `core_upgrades`, but no route read either, so "did the routine fire, what did it
+// decide, and when did the pin last move" needed an SSH session (blocker 1000106). Two
+// read-only routes answer it now:
+//   GET /api/bongos/autonomy/runs    — behind `autonomy.precheck` (Metic+), the atom the
+//                                      precheck itself uses
+//   GET /api/bongos/core-upgrades    — behind `core.pin.move` (Archon), the atom the
+//                                      upgrade banner and the deploy door use
+// No new atom, so no migration. These tests drive REAL requests through the assembled
+// routers with only the two auth gates stubbed (the core_update_banner precedent: an
+// arity-mangled handler 500s, and only a real request sees that), read the atom each
+// gate was built with off the router stack, and pin the SQL against a stubbed pool.
+//
+// DB-free, no network. Run:  node --test tests/routine_observability_api.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+// A permission stub that remembers which atom it was built with, so the test can read
+// the gate's authority off the router instead of grepping the source for it.
+const permStub = (key) => {
+  const mw = (_req, _res, next) => next();
+  mw.permKey = key;
+  return mw;
+};
+const passBuilder = (reqq, _res, next) => { reqq.builder = { id: 3, rank: 'archon' }; next(); };
+
+async function serve(router) {
+  const app = express();
+  app.use(attachFail);
+  app.use(router);
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  return { base, close: () => server.close() };
+}
+
+function layerFor(router, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p);
+  assert.ok(layer, `${p} is registered`);
+  return layer;
+}
+
+// ── GET /autonomy/runs ──────────────────────────────────────────────────────────────
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = passBuilder;
+  api.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)();
+  } finally {
+    api.requireBuilder = saved.b;
+    api.requirePermission = saved.p;
+  }
+}
+
+test('GET /autonomy/runs is gated by requireBuilder + the precheck\'s own atom', () => {
+  const layer = layerFor(autonomyRouter(), '/autonomy/runs');
+  assert.equal(layer.route.methods.get, true);
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.precheck');
+});
+
+test('GET /autonomy/runs returns the decisions, narrowed by routine and a clamped limit', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.readAutonomyRuns;
+  const seen = [];
+  const rows = [{ id: '7', routine: 'overnight-builder', decision: 'no-go', reason: 'no claimable work', head_sha: 'abc', claimable_count: 0, enabled: true, created_at: '2026-09-25T02:00:00.000Z' }];
+  db.readAutonomyRuns = async (args) => { seen.push(args); return rows; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await fetch(`${s.base}/autonomy/runs?routine=overnight-builder&limit=500`);
+    assert.equal(r.status, 200);
+    assert.deepEqual(await r.json(), { routine: 'overnight-builder', limit: 100, runs: rows });
+    assert.deepEqual(seen.pop(), { routine: 'overnight-builder', limit: 100 }, 'a limit above 100 is clamped, not refused');
+
+    r = await fetch(`${s.base}/autonomy/runs`);
+    assert.equal(r.status, 200);
+    assert.deepEqual(seen.pop(), { routine: null, limit: 20 }, 'no routine = every routine; the default limit is 20');
+
+    await fetch(`${s.base}/autonomy/runs?limit=banana`);
+    assert.equal(seen.pop().limit, 20, 'a non-number falls back to the default');
+    await fetch(`${s.base}/autonomy/runs?limit=0`);
+    assert.equal(seen.pop().limit, 1);
+
+    db.readAutonomyRuns = async () => { throw new Error('relation "autonomy_runs" does not exist'); };
+    r = await fetch(`${s.base}/autonomy/runs`);
+    assert.equal(r.status, 503, 'an unreadable table is a 503 that says so, never an empty list');
+    const body = await r.json();
+    assert.equal(body.error.code, 'autonomy_runs_unreadable');
+    assert.ok(!JSON.stringify(body).includes('does not exist'), 'the database error text stays in the log');
+  } finally {
+    s.close();
+    db.readAutonomyRuns = saved;
+  }
+});
+
+test('readAutonomyRuns: newest first, one routine or all, ids as strings', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 42, routine: 'bfg', decision: 'go' }] }; };
+  try {
+    const out = await db.readAutonomyRuns({ routine: 'bfg', limit: 5 });
+    assert.deepEqual(out, [{ id: '42', routine: 'bfg', decision: 'go' }]);
+    assert.match(calls[0].sql, /FROM autonomy_runs/);
+    assert.match(calls[0].sql, /\$1::text IS NULL OR routine = \$1/);
+    assert.match(calls[0].sql, /ORDER BY created_at DESC/);
+    assert.deepEqual(calls[0].params, ['bfg', 5]);
+    await db.readAutonomyRuns();
+    assert.deepEqual(calls[1].params, [null, 20]);
+    assert.doesNotMatch(calls[0].sql, /\b(INSERT|UPDATE|DELETE)\b/i, 'read-only');
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+// ── GET /core-upgrades ──────────────────────────────────────────────────────────────
+
+function coreUpdateRouter(deps) {
+  const auth = req(path.join(ROOT, 'src/bongos/auth.js'));
+  const saved = { b: auth.requireBuilder, p: auth.requirePermission };
+  auth.requireBuilder = passBuilder;
+  auth.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)(deps);
+  } finally {
+    auth.requireBuilder = saved.b;
+    auth.requirePermission = saved.p;
+    delete req.cache[routePath];
+  }
+}
+
+test('GET /core-upgrades is gated by requireBuilder + core.pin.move, like the banner beside it', () => {
+  const router = coreUpdateRouter();
+  const layer = layerFor(router, '/core-upgrades');
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'core.pin.move');
+  assert.equal(layerFor(router, '/core-update').route.stack[1].handle.permKey, 'core.pin.move', 'the existing route is untouched');
+});
+
+test('GET /core-upgrades answers "when did the pin last move", newest first', async () => {
+  const seen = [];
+  const ledger = [
+    { id: '12', from_version: '1.19.1022', to_version: '1.19.1023', source_commit: 'b50d32f1', note: null, applied_at: '2026-09-24T10:00:00.000Z', source: 'door', requested_by_builder_id: '3' },
+    { id: '11', from_version: '1.19.1010', to_version: '1.19.1022', source_commit: null, note: 'auto-subscription (patch)', applied_at: '2026-09-23T10:00:00.000Z', source: 'cli', requested_by_builder_id: null },
+  ];
+  const s = await serve(coreUpdateRouter({ upgrades: async (args) => { seen.push(args); return ledger; } }));
+  try {
+    const r = await fetch(`${s.base}/core-upgrades?limit=2`);
+    assert.equal(r.status, 200, 'the handler runs — a 500 here is the asyncHandler arity bug');
+    const body = await r.json();
+    assert.equal(body.ok, true);
+    assert.equal(body.limit, 2);
+    assert.deepEqual(body.upgrades, ledger);
+    assert.equal(body.upgrades[0].applied_at, '2026-09-24T10:00:00.000Z', 'the first row is the last pin move');
+    assert.ok('running' in body, 'the running core version rides along, so behind-or-not is one read');
+    assert.deepEqual(seen, [{ limit: 2 }]);
+  } finally {
+    s.close();
+  }
+});
+
+test('readCoreUpgrades: the ledger, newest first, read-only, ids as strings', async () => {
+  const { readCoreUpgrades } = req(path.join(ROOT, 'src/bongos/core-update.js'));
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 5, to_version: '1.19.1023', requested_by_builder_id: 3 }, { id: 4, to_version: '1.19.1022', requested_by_builder_id: null }] }; } };
+  const out = await readCoreUpgrades({ limit: 7, pool });
+  assert.deepEqual(out, [
+    { id: '5', to_version: '1.19.1023', requested_by_builder_id: '3' },
+    { id: '4', to_version: '1.19.1022', requested_by_builder_id: null },
+  ]);
+  assert.match(calls[0].sql, /FROM core_upgrades/);
+  assert.match(calls[0].sql, /ORDER BY applied_at DESC/);
+  assert.deepEqual(calls[0].params, [7]);
+  assert.doesNotMatch(calls[0].sql, /\b(INSERT|UPDATE|DELETE)\b/i, 'read-only');
+});