@bongos/core 1.19.1072 → 1.19.1074

package/tests/sandbox_stage.mjs

@@ -1,13 +1,12 @@
 // tests/sandbox_stage.mjs
 //
 // Hermetic unit smoke for scripts/gds/sandbox-stage.js — the sandbox-first
-// review step (#927, ADR 0046) that ship.js runs before resolving a claim, on a
-// dev box (ADR 0044) OR a local full clone (task 1056). Covers: box detection,
-// BOX_PREVIEW_HOSTNAME parsing, previewable-surface matching, the decideShipGate
-// decision table, resolvePreviewContext (box/local/none), marker round-trip +
-// tree-stamp freshness (real temp git repo), the runShipGate composition with
-// injected fs/exec/prompt, and the recorded self-approval (#1048) for box AND
-// local. NO network, NO systemd, NO real box.
+// review step (#927, ADR 0046) that ship.js runs before resolving a claim on a
+// local full clone (task 1056). Covers: previewable-surface matching, the
+// decideShipGate decision table, resolvePreviewContext (local/none), marker
+// round-trip + tree-stamp freshness (real temp git repo), the runShipGate
+// composition with an injected preview context + exec/prompt, and the recorded
+// self-approval (#1048). NO network, NO spawned preview.
 //
 // Run:  node tests/sandbox_stage.mjs
 
@@ -32,35 +31,12 @@ async function ta(name, fn) {
   catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
 }
 
-// ---------- isDevBox ----------
-t('isDevBox: true only when box.env exists', () => {
-  assert.equal(sbx.isDevBox({ fs: { existsSync: (p) => p === '/etc/otb/box.env' } }), true);
-  assert.equal(sbx.isDevBox({ fs: { existsSync: () => false } }), false);
-});
-
-// ---------- readPreviewHostname ----------
-t('readPreviewHostname: plain, quoted, export-prefixed, missing, empty', () => {
-  assert.equal(sbx.readPreviewHostname('BOX_PREVIEW_HOSTNAME=sandbox-somebuilder.example.com\n'), 'sandbox-somebuilder.example.com');
-  assert.equal(sbx.readPreviewHostname('A=1\nBOX_PREVIEW_HOSTNAME="sandbox-x.example.com"\nB=2'), 'sandbox-x.example.com');
-  assert.equal(sbx.readPreviewHostname("export BOX_PREVIEW_HOSTNAME='sandbox-y.example.com'"), 'sandbox-y.example.com');
-  assert.equal(sbx.readPreviewHostname('BOX_TERMINAL_HOSTNAME=term-x.example.com'), null);
-  assert.equal(sbx.readPreviewHostname('BOX_PREVIEW_HOSTNAME='), null);
-  assert.equal(sbx.readPreviewHostname(''), null);
-  assert.equal(sbx.readPreviewHostname(null), null);
-});
-
-t('previewUrl: reads box.env via injected fs; null when unreadable', () => {
-  const deps = { fs: { readFileSync: () => 'BOX_PREVIEW_HOSTNAME=sandbox-z.example.com\n' } };
-  assert.equal(sbx.previewUrl(deps), 'https://sandbox-z.example.com');
-  assert.equal(sbx.previewUrl({ fs: { readFileSync: () => { throw new Error('ENOENT'); } } }), null);
-});
-
 // ---------- previewable surfaces ----------
 t('isPreviewableFile: game surfaces yes, internal surfaces no', () => {
   for (const f of ['modules/game/public/game/main.js', 'modules/game/world/terrain.js', 'modules/game/rooms/WorldRoom.js', 'server.js']) {
     assert.equal(sbx.isPreviewableFile(f), true, `${f} should be previewable`);
   }
-  for (const f of ['scripts/gds/ship.js', 'modules/dev-box/routes/box.js', 'docs/adr/0046.md', 'modules/status-ui/public/index.html', 'modules/hall-ui/public/hall.js', 'migrations/075.sql', 'tests/sandbox_stage.mjs', 'server.js.bak']) {
+  for (const f of ['scripts/gds/ship.js', 'modules/lifecycle/routes/tasks.js', 'docs/adr/0046.md', 'modules/status-ui/public/index.html', 'modules/hall-ui/public/hall.js', 'migrations/075.sql', 'tests/sandbox_stage.mjs', 'server.js.bak']) {
     assert.equal(sbx.isPreviewableFile(f), false, `${f} should NOT be previewable`);
   }
 });
@@ -74,9 +50,8 @@ t('anyPreviewable: mixed diff counts as previewable; empty/none does not', () =>
 
 // ---------- decideShipGate decision table ----------
 t('decideShipGate: full decision table', () => {
-  // gateActive = a sandbox exists here (a dev box OR a local game preview). The
-  // table is identical for both; only HOW we stage + the URL differ downstream.
-  const base = { gateActive: true, previewUrl: 'https://sandbox-x', previewable: true, stagedFresh: false, tty: true, skipStage: false };
+  // gateActive = a sandbox exists here (a local game preview).
+  const base = { gateActive: true, previewUrl: 'http://localhost:3100', previewable: true, stagedFresh: false, tty: true, skipStage: false };
   assert.equal(sbx.decideShipGate({ ...base, skipStage: true }).action, 'skip');
   assert.equal(sbx.decideShipGate({ ...base, gateActive: false }).action, 'skip');
   assert.equal(sbx.decideShipGate({ ...base, previewable: false }).action, 'skip');
@@ -90,20 +65,9 @@ t('decideShipGate: full decision table', () => {
   assert.equal(sbx.decideShipGate({ ...base, skipStage: true, stagedFresh: true }).action, 'skip');
 });
 
-// ---------- resolvePreviewContext: box vs local vs none (task 1056) ----------
-t('resolvePreviewContext: dev box → box kind with the named-tunnel URL', () => {
-  const ctx = sbx.resolvePreviewContext({
-    fs: {
-      existsSync: (p) => p === sbx.BOX_ENV_PATH,
-      readFileSync: () => 'BOX_PREVIEW_HOSTNAME=sandbox-x.example.com\n',
-    },
-  });
-  assert.equal(ctx.kind, 'box');
-  assert.equal(ctx.url, 'https://sandbox-x.example.com');
-});
-
-t('resolvePreviewContext: local full clone (no box, game entry present) → local kind at localhost', () => {
-  const gameEntryFs = { existsSync: (p) => p !== sbx.BOX_ENV_PATH && /preview-server\.js$/.test(String(p)) };
+// ---------- resolvePreviewContext: local vs none (task 1056) ----------
+t('resolvePreviewContext: local full clone (game entry present) → local kind at localhost', () => {
+  const gameEntryFs = { existsSync: (p) => /preview-server\.js$/.test(String(p)) };
   const ctx = sbx.resolvePreviewContext({ env: {}, fs: gameEntryFs });
   assert.equal(ctx.kind, 'local');
   assert.equal(ctx.url, 'http://localhost:3100');
@@ -112,51 +76,14 @@ t('resolvePreviewContext: local full clone (no box, game entry present) → loca
   assert.equal(ctx2.url, 'http://localhost:4200');
 });
 
-t('resolvePreviewContext: partial clone (no box, no game entry) → null (no sandbox)', () => {
+t('resolvePreviewContext: a checkout with no game entry → null (no sandbox)', () => {
   assert.equal(sbx.resolvePreviewContext({ fs: { existsSync: () => false } }), null);
 });
 
-// task 1443: a box whose box.env is missing/unreadable must STILL be detected as
-// a box (via the box-preview wrapper or the service unit) and must NEVER fall
-// through to the localhost local-preview branch — localhost is unreachable from
-// the builder's browser on a remote box.
-t('resolvePreviewContext: box via the box-preview wrapper + unreadable box.env → box kind, NEVER localhost', () => {
-  const ctx = sbx.resolvePreviewContext({
-    fs: {
-      // wrapper present (a box) + game entry present (a box has the game), but box.env unreadable
-      existsSync: (p) => p === '/usr/local/bin/box-preview' || /preview-server\.js$/.test(String(p)),
-      readFileSync: () => { throw new Error('EACCES'); },
-    },
-  });
-  assert.equal(ctx.kind, 'box', 'a box marker wins over hasGameEntry → box branch, not local');
-  assert.equal(ctx.url, null, 'no readable hostname → null url (stage gives a clear message), never a localhost URL');
-});
-
-t('resolvePreviewContext: box via the box-game-preview.service unit → box kind', () => {
-  const ctx = sbx.resolvePreviewContext({
-    fs: {
-      existsSync: (p) => p === '/etc/systemd/system/box-game-preview.service',
-      readFileSync: () => { throw new Error('ENOENT'); },
-    },
-  });
-  assert.equal(ctx.kind, 'box');
-  assert.equal(ctx.url, null);
-});
-
-await ta('stage: box with no readable hostname → clear "no sandbox hostname" message, not a localhost link', async () => {
-  const staged = await sbx.stage({ taskId: 1443 }, {
-    fs: { existsSync: (p) => p === '/usr/local/bin/box-preview', readFileSync: () => { throw new Error('EACCES'); } },
-  });
-  assert.equal(staged.ok, false);
-  assert.match(staged.reason, /no sandbox hostname/i);
-  assert.match(staged.reason, /box-preview status/);
-  assert.doesNotMatch(staged.reason, /http:\/\/localhost/, 'must not hand back a localhost URL on a box');
-});
-
 // ---------- tree stamp + marker (real temp git repo) ----------
 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-sbx-test-'));
-// Markers live OUTSIDE the repo — on a real box the marker is in /tmp, not
-// /workspace, so it must never perturb the tree stamp it certifies.
+// Markers live OUTSIDE the repo (the OS temp dir), so they must never perturb the
+// tree stamp they certify.
 const markerDir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-sbx-markers-'));
 function git(...args) { execFileSync('git', args, { cwd: tmp, encoding: 'utf8' }); }
 git('init', '-q');
@@ -224,46 +151,40 @@ t('marker: round-trip via injected path; unreadable → null', () => {
   assert.equal(m.task_id, 927);
 });
 
-// ---------- runShipGate composition (BOX) ----------
-// Fake "box" deps: box.env exists + carries a preview hostname; restart is a
-// no-op; health answers 200 immediately; marker lives in the temp dir.
-function boxDeps(markerFile, overrides = {}) {
+// ---------- runShipGate composition ----------
+// Inject the local preview context directly so there is NO real spawn / network:
+// restart is a no-op, health answers like a real preview, git is real on the
+// temp repo, and the marker lives in the temp dir.
+const PREVIEW_URL = 'http://localhost:3100';
+function gateDeps(markerFile, overrides = {}) {
   return {
+    previewContext: {
+      kind: 'local',
+      url: PREVIEW_URL,
+      healthUrl: 'http://127.0.0.1:3100/healthz',
+      restart: () => { /* pretend the local preview (re)started */ },
+    },
     fs: {
-      existsSync: (p) => p === '/etc/otb/box.env' || fs.existsSync(p),
-      readFileSync: (p, enc) => p === '/etc/otb/box.env'
-        ? 'BOX_PREVIEW_HOSTNAME=sandbox-test.example.com\n'
-        : fs.readFileSync(p, enc),
+      existsSync: (p) => fs.existsSync(p),
+      readFileSync: (p, enc) => fs.readFileSync(p, enc),
       writeFileSync: (p, d) => fs.writeFileSync(p, d),
     },
-    execFileSync: (cmd, args, opts) => {
-      // git goes through for real (the temp repo); systemctl/box-preview no-op.
-      if (cmd === 'git') return execFileSync(cmd, args, opts);
-      return '';
-    },
+    execFileSync: (cmd, args, opts) => (cmd === 'git' ? execFileSync(cmd, args, opts) : ''),
     // task 1002607: emulate a real PREVIEW — 200 on the health URL, 404 on the
     // /api/bongos/healthz discriminator (the game-only entry mounts no /api/bongos).
-    // A flat always-200 mock would now read as "the MAIN server answered".
+    // A flat always-200 mock would read as "the MAIN server answered".
     fetchImpl: async (url) => ({ status: String(url).includes('/api/bongos/healthz') ? 404 : 200 }),
     markerPath: markerFile,
     cwd: tmp,
     pollMs: 1,
     timeoutMs: 1000,
-    previewWrapper: '/nonexistent-box-preview',
-    // #1068: the box stage() now syncs the worktree into /workspace + verifies
-    // the served bytes. Inject no-ops here so the gate-composition tests don't
-    // touch the real /workspace or need a text()-capable fetch mock — the real
-    // syncWorktreeToServed / verifyServedFresh get their OWN dedicated tests.
-    syncWorktreeToServed: () => ({ ok: true, synced: false }),
-    verifyServedFresh: async () => ({ ok: true, skipped: true }),
     ...overrides,
   };
 }
 
-await ta('runShipGate: no sandbox available (not a box, no local game entry) → ok, no staging', async () => {
-  // existsSync()=>false means neither /etc/otb/box.env NOR src/preview-server.js
-  // is present — a partial clone with no game. (A full local clone WITH the game
-  // is covered by the LOCAL tests below, where it DOES stage.)
+await ta('runShipGate: no sandbox available (no local game entry) → ok, no staging', async () => {
+  // existsSync()=>false means src/preview-server.js is absent — a checkout with
+  // no game. (A clone WITH the game is covered by the tests below, where it stages.)
   const r = await sbx.runShipGate(
     { taskId: 1, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true },
     { fs: { existsSync: () => false } }
@@ -271,30 +192,31 @@ await ta('runShipGate: no sandbox available (not a box, no local game entry) →
   assert.equal(r.ok, true);
 });
 
-await ta('runShipGate: box + non-game diff → ok, no staging', async () => {
+await ta('runShipGate: non-game diff → ok, no staging', async () => {
   const mp = path.join(markerDir, 'm1.json');
-  const r = await sbx.runShipGate({ taskId: 1, files: ['docs/x.md'], skipStage: false, tty: true }, boxDeps(mp));
+  const r = await sbx.runShipGate({ taskId: 1, files: ['docs/x.md'], skipStage: false, tty: true }, gateDeps(mp));
   assert.equal(r.ok, true);
   assert.equal(fs.existsSync(mp), false, 'no marker written — nothing staged');
 });
 
-await ta('runShipGate: box + game diff + TTY, reviewer says yes → stages then ok, records tty sign-off', async () => {
+await ta('runShipGate: game diff + TTY, reviewer says yes → stages then ok, records tty sign-off', async () => {
   const mp = path.join(markerDir, 'm2.json');
-  const deps = boxDeps(mp, { promptYesNo: async () => true });
+  const deps = gateDeps(mp, { promptYesNo: async () => true });
   const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/world/terrain.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, true);
   const m = JSON.parse(fs.readFileSync(mp, 'utf8'));
-  assert.equal(m.url, 'https://sandbox-test.example.com');
+  assert.equal(m.url, PREVIEW_URL);
+  assert.equal(m.kind, 'local');
   assert.ok(m.stamp, 'marker carries the staged tree stamp');
   // #1048: a TTY 'y' IS the explicit sign-off → recorded as method 'tty'.
   assert.equal(r.sandboxReview.method, 'tty', 'TTY yes records a tty sign-off');
-  assert.equal(r.sandboxReview.url, 'https://sandbox-test.example.com');
+  assert.equal(r.sandboxReview.url, PREVIEW_URL);
   assert.ok(r.sandboxReview.stamp, 'approval record carries the reviewed tree stamp');
 });
 
 await ta('runShipGate: reviewer says NO → aborts with claim-preserving reason', async () => {
   const mp = path.join(markerDir, 'm3.json');
-  const deps = boxDeps(mp, { promptYesNo: async () => false });
+  const deps = gateDeps(mp, { promptYesNo: async () => false });
   const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, false);
   assert.match(r.reason, /sandbox review declined/);
@@ -302,8 +224,8 @@ await ta('runShipGate: reviewer says NO → aborts with claim-preserving reason'
 
 await ta('runShipGate: fresh marker → pass without prompting', async () => {
   const mp = path.join(markerDir, 'm4.json');
-  const deps = boxDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
-  sbx.writeMarker({ stamp: sbx.computeTreeStamp({ cwd: tmp }), url: 'https://sandbox-test.example.com' }, deps);
+  const deps = gateDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
+  sbx.writeMarker({ stamp: sbx.computeTreeStamp({ cwd: tmp }), url: PREVIEW_URL }, deps);
   const r = await sbx.runShipGate({ taskId: 927, files: ['server.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, true);
 });
@@ -311,8 +233,8 @@ await ta('runShipGate: fresh marker → pass without prompting', async () => {
 await ta('runShipGate: stale marker forces a re-stage (stamp mismatch)', async () => {
   const mp = path.join(markerDir, 'm5.json');
   let prompted = false;
-  const deps = boxDeps(mp, { promptYesNo: async () => { prompted = true; return true; } });
-  sbx.writeMarker({ stamp: 'stale-stamp', url: 'https://sandbox-test.example.com' }, deps);
+  const deps = gateDeps(mp, { promptYesNo: async () => { prompted = true; return true; } });
+  sbx.writeMarker({ stamp: 'stale-stamp', url: PREVIEW_URL }, deps);
   const r = await sbx.runShipGate({ taskId: 927, files: ['server.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, true);
   assert.equal(prompted, true, 'stale stamp must re-stage + re-prompt');
@@ -320,11 +242,11 @@ await ta('runShipGate: stale marker forces a re-stage (stamp mismatch)', async (
 
 await ta('runShipGate: non-TTY → stages then ABORTS with the review URL (no prompt, no hang)', async () => {
   const mp = path.join(markerDir, 'm6.json');
-  const deps = boxDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
+  const deps = gateDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
   const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: false, tty: false }, deps);
   assert.equal(r.ok, false, 'unreviewed game work must not ship non-interactively');
   assert.equal(r.review, true, 'abort is flagged as a review pause');
-  assert.match(r.reason, /staged at https:\/\/sandbox-test\.example\.com/i);
+  assert.match(r.reason, /staged at http:\/\/localhost:3100/i);
   assert.ok(fs.existsSync(mp), 'work is staged so the human can review at the URL');
   // ...and after the (notional) review, a bare re-run passes on the fresh marker
   // but records NO sign-off (no --approved) — back-compat / failure-open.
@@ -335,7 +257,7 @@ await ta('runShipGate: non-TTY → stages then ABORTS with the review URL (no pr
 
 await ta('runShipGate: uncommitted game edit counts as previewable even when committed diff does not', async () => {
   const mp = path.join(markerDir, 'm9.json');
-  const deps = boxDeps(mp, { promptYesNo: async () => true });
+  const deps = gateDeps(mp, { promptYesNo: async () => true });
   fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'dirty working tree\n');
   const r = await sbx.runShipGate({ taskId: 927, files: ['docs/x.md'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, true);
@@ -345,7 +267,7 @@ await ta('runShipGate: uncommitted game edit counts as previewable even when com
 
 await ta('runShipGate: --skip-stage → ok, untouched', async () => {
   const mp = path.join(markerDir, 'm7.json');
-  const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: true, tty: true }, boxDeps(mp));
+  const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: true, tty: true }, gateDeps(mp));
   assert.equal(r.ok, true);
   assert.equal(fs.existsSync(mp), false);
 });
@@ -356,7 +278,7 @@ await ta('runShipGate: --skip-stage → ok, untouched', async () => {
 // as the explicit bypass, and the reason says plainly the review DID NOT run.
 await ta('1002607 runShipGate: staging failure (health never green) ABORTS — review gate cannot silently turn itself off', async () => {
   const mp = path.join(markerDir, 'm8.json');
-  const deps = boxDeps(mp, { fetchImpl: async () => ({ status: 502 }), timeoutMs: 10 });
+  const deps = gateDeps(mp, { fetchImpl: async () => ({ status: 502 }), timeoutMs: 10 });
   const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, false, 'a failed stage must not ship as if the review happened');
   assert.equal(r.review, undefined, 'a failure to present is NOT a calm review pause');
@@ -365,23 +287,23 @@ await ta('1002607 runShipGate: staging failure (health never green) ABORTS — r
   assert.match(r.reason, /claim is still active/i, 'claim-preserving');
 });
 
-// ---------- recorded self-approval (#1048), box ----------
+// ---------- recorded self-approval (#1048) ----------
 await ta('runShipGate: --approved re-run on a fresh stage records a flag sign-off (#1048)', async () => {
   const mp = path.join(markerDir, 'm10.json');
-  const deps = boxDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
+  const deps = gateDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
   // Simulate "already staged + reviewed on a prior run": fresh marker, then the
   // builder approves via the flag on the re-run.
-  sbx.writeMarker({ stamp: sbx.computeTreeStamp({ cwd: tmp }), url: 'https://sandbox-test.example.com' }, deps);
+  sbx.writeMarker({ stamp: sbx.computeTreeStamp({ cwd: tmp }), url: PREVIEW_URL }, deps);
   const r = await sbx.runShipGate({ taskId: 1048, files: ['server.js'], skipStage: false, tty: false, approved: true }, deps);
   assert.equal(r.ok, true);
   assert.equal(r.sandboxReview.method, 'flag', 'approved re-run records a flag sign-off');
-  assert.equal(r.sandboxReview.url, 'https://sandbox-test.example.com');
+  assert.equal(r.sandboxReview.url, PREVIEW_URL);
   assert.ok(r.sandboxReview.stamp, 'record carries the reviewed tree stamp');
 });
 
 await ta('runShipGate: --approved cannot pre-approve an UNstaged change (still stage_aborts)', async () => {
   const mp = path.join(markerDir, 'm11.json');
-  const deps = boxDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
+  const deps = gateDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
   // No marker → not staged-fresh → --approved is ignored; the gate still stages
   // + aborts for review. You cannot sign off on something never shown.
   const r = await sbx.runShipGate({ taskId: 1048, files: ['modules/game/public/game/a.js'], skipStage: false, tty: false, approved: true }, deps);
@@ -390,147 +312,6 @@ await ta('runShipGate: --approved cannot pre-approve an UNstaged change (still s
   assert.equal(r.sandboxReview, undefined, 'nothing recorded — nothing was staged to approve');
 });
 
-// ---------- #1068: worktree → served sync + freshness verify ----------
-
-// A box serves /workspace (the MAIN checkout), but a session edits a linked
-// worktree. syncWorktreeToServed must materialize the branch's previewable
-// content into the served root. Build a real main checkout + a `git worktree`
-// off a feature branch that changed public/game.js, then assert the served copy
-// gets the branch content.
-await ta('syncWorktreeToServed: brings the branch content into the served checkout', async () => {
-  const served = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-served-'));
-  const g = (...a) => execFileSync('git', a, { cwd: served, encoding: 'utf8' });
-  g('init', '-q');
-  g('config', 'user.email', 't@e.com'); g('config', 'user.name', 't');
-  fs.mkdirSync(path.join(served, 'modules', 'game', 'public'), { recursive: true });
-  fs.writeFileSync(path.join(served, 'modules', 'game', 'public', 'game.js'), 'MAIN content\n');
-  g('add', '.'); g('commit', '-qm', 'main');
-  // a linked worktree on a feature branch with different game content
-  const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-wt-')) + '/co';
-  g('worktree', 'add', '-q', '-b', 'claude/feat', wt);
-  fs.writeFileSync(path.join(wt, 'modules', 'game', 'public', 'game.js'), 'BRANCH content\n');
-  execFileSync('git', ['add', '.'], { cwd: wt });
-  execFileSync('git', ['commit', '-qm', 'branch edit'], { cwd: wt });
-
-  const r = sbx.syncWorktreeToServed({ cwd: wt, servedRoot: served });
-  assert.equal(r.ok, true);
-  assert.equal(r.synced, true);
-  assert.equal(r.branch, 'claude/feat');
-  // The claim is WHICH content landed, not how its lines end: git checks the fixture
-  // out under the machine's own autocrlf, so on Windows the file comes back CRLF and a
-  // byte-exact compare failed for a reason unrelated to the sync (task 1003529).
-  assert.ok(sameContent(fs.readFileSync(path.join(served, 'modules', 'game', 'public', 'game.js'), 'utf8'), 'BRANCH content\n'),
-    'served /workspace now shows the SESSION branch content, not stale main');
-
-  g('worktree', 'remove', '--force', wt);
-  fs.rmSync(served, { recursive: true, force: true });
-});
-
-t('syncWorktreeToServed: no-op when the session checkout IS the served root', () => {
-  const r = sbx.syncWorktreeToServed({ cwd: tmp, servedRoot: tmp });
-  assert.equal(r.ok, true);
-  assert.equal(r.synced, false);
-});
-
-t('syncWorktreeToServed: a SYMLINKED servedRoot pointing at the session checkout is a no-op (idea #278)', () => {
-  // The macOS footgun: `git rev-parse --show-toplevel` returns the REAL path,
-  // but servedRoot may be reached through a symlink (macOS /tmp -> /private/var,
-  // or any symlinked served path). A raw path.resolve comparison false-negatives
-  // "same dir" and the code would wrongly try to git-sync the checkout onto
-  // itself. realPathOr fixes it. This test builds an EXPLICIT symlink so it holds
-  // on any OS (it FAILS against the old path.resolve code, PASSES with realpath).
-  const linkDir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-served-link-'));
-  const link = path.join(linkDir, 'served');
-  // A 'dir' symlink needs elevation (or Developer Mode) on Windows and threw EPERM,
-  // taking the case out on every Windows checkout. A JUNCTION is the unprivileged
-  // Windows equivalent for a directory and realpath resolves it the same way — the
-  // spelling scripts/gds/worktree.js already uses for exactly this reason (task 1003529).
-  fs.symlinkSync(fs.realpathSync(tmp), link, process.platform === 'win32' ? 'junction' : 'dir');
-  try {
-    const r = sbx.syncWorktreeToServed({ cwd: tmp, servedRoot: link });
-    assert.equal(r.ok, true);
-    assert.equal(r.synced, false, 'a symlinked served root pointing at the session checkout must be recognized as the same dir, not synced as stale');
-  } finally {
-    fs.rmSync(linkDir, { recursive: true, force: true });
-  }
-});
-
-t('syncWorktreeToServed: detached HEAD / unresolvable branch → not ok', () => {
-  // execFileSync stub: toplevel resolves, but rev-parse --abbrev-ref returns HEAD
-  const stub = (cmd, args) => {
-    if (args.includes('--show-toplevel')) return '/some/worktree\n';
-    if (args.includes('--abbrev-ref')) return 'HEAD\n';
-    return '';
-  };
-  const r = sbx.syncWorktreeToServed({ execFileSync: stub, servedRoot: '/served' });
-  assert.equal(r.ok, false);
-  assert.match(r.reason, /could not resolve the session branch/);
-});
-
-await ta('verifyServedFresh: served bytes match worktree → ok/verified', async () => {
-  // dirty a tracked game file so pickVerifyTarget selects it
-  fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'served-match\n');
-  const r = await sbx.verifyServedFresh({
-    cwd: tmp,
-    healthUrl: 'http://127.0.0.1:3000/',
-    fetchImpl: async (url) => { assert.match(url, /\/game\.js$/); return { status: 200, text: async () => 'served-match\n' }; },
-  });
-  assert.equal(r.ok, true);
-  assert.equal(r.verified, 'modules/game/public/game.js');
-  execFileSync('git', ['checkout', '--', 'modules/game/public/game.js'], { cwd: tmp });
-});
-
-await ta('verifyServedFresh: served bytes DIFFER → not ok (serving stale code)', async () => {
-  fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'worktree-new\n');
-  const r = await sbx.verifyServedFresh({
-    cwd: tmp,
-    fetchImpl: async () => ({ status: 200, text: async () => 'stale-old\n' }),
-  });
-  assert.equal(r.ok, false);
-  assert.match(r.reason, /serving stale code/);
-  execFileSync('git', ['checkout', '--', 'modules/game/public/game.js'], { cwd: tmp });
-});
-
-await ta('verifyServedFresh: no served static change → skipped (ok)', async () => {
-  // clean tree, no origin/main ref in the temp repo → pickVerifyTarget null
-  const r = await sbx.verifyServedFresh({ cwd: tmp, fetchImpl: async () => { throw new Error('must not fetch'); } });
-  assert.equal(r.ok, true);
-  assert.equal(r.skipped, true);
-});
-
-await ta('stage(box): a HARD sync failure → {ok:false,hard:true}, no marker; runShipGate ABORTS', async () => {
-  const mp = path.join(markerDir, 'hard1.json');
-  const deps = boxDeps(mp, { syncWorktreeToServed: () => ({ ok: false, reason: 'checkout failed' }) });
-  const staged = await sbx.stage({ taskId: 1068 }, deps);
-  assert.equal(staged.ok, false);
-  assert.equal(staged.hard, true);
-  assert.equal(fs.existsSync(mp), false, 'no marker on a hard sync failure');
-  // and the gate turns a hard failure into a claim-preserving abort
-  const r = await sbx.runShipGate({ taskId: 1068, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
-  assert.equal(r.ok, false);
-  assert.equal(r.review, true);
-  assert.match(r.reason, /could not be trusted/);
-});
-
-await ta('stage(box): a HARD verify failure → {ok:false,hard:true}, no marker', async () => {
-  const mp = path.join(markerDir, 'hard2.json');
-  const deps = boxDeps(mp, { verifyServedFresh: async () => ({ ok: false, reason: 'served stale' }) });
-  const staged = await sbx.stage({ taskId: 1068 }, deps);
-  assert.equal(staged.ok, false);
-  assert.equal(staged.hard, true);
-  assert.equal(fs.existsSync(mp), false, 'no marker on a hard verify failure');
-});
-
-await ta('1002607 runShipGate(box): a SOFT failure (preview never healthy) now fails closed — abort, claim intact', async () => {
-  const mp = path.join(markerDir, 'soft1.json');
-  // sync ok (injected), but health never green → the ship must NOT continue
-  // as if the review ran (that was the silent-disable defect).
-  const deps = boxDeps(mp, { fetchImpl: async () => ({ status: 502 }), timeoutMs: 10 });
-  const r = await sbx.runShipGate({ taskId: 1068, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
-  assert.equal(r.ok, false, 'the soft failure aborts instead of silently skipping the review');
-  assert.match(r.reason, /sandbox staging failed/);
-});
-
 // ---------- task 1002607: waitHealthy truth table ----------
 
 await ta('1002607 waitHealthy: 404 at the health URL is NOT healthy (was: anything < 500 passed)', async () => {
@@ -579,73 +360,6 @@ t('1002607 NO_SANDBOX_MSG: names what is actually missing, not the builder\'s cl
   assert.doesNotMatch(sbx.NO_SANDBOX_MSG, /this clone has no game preview entry/, 'the old your-clone-is-at-fault phrasing is gone');
 });
 
-// ---------- runShipGate: LOCAL preview context + recorded approval (task 1056) ----------
-// A full local clone (laptop) gets the SAME enforced gate + recorded-approval as
-// a box (#1048), but staged at http://localhost:<port>. Inject the local context
-// directly so there is NO real spawn / network: restart is a no-op, health
-// answers 200, git is real on the temp repo, marker lives in the temp dir.
-function localDeps(markerFile, overrides = {}) {
-  return {
-    previewContext: {
-      kind: 'local',
-      url: 'http://localhost:3100',
-      healthUrl: 'http://127.0.0.1:3100/healthz',
-      restart: () => { /* pretend the local preview (re)started */ },
-    },
-    fs: {
-      existsSync: (p) => fs.existsSync(p),
-      readFileSync: (p, enc) => fs.readFileSync(p, enc),
-      writeFileSync: (p, d) => fs.writeFileSync(p, d),
-    },
-    execFileSync: (cmd, args, opts) => (cmd === 'git' ? execFileSync(cmd, args, opts) : ''),
-    // task 1002607: preview-shaped mock — health 200, API-healthz discriminator 404.
-    fetchImpl: async (url) => ({ status: String(url).includes('/api/bongos/healthz') ? 404 : 200 }),
-    markerPath: markerFile,
-    cwd: tmp,
-    pollMs: 1,
-    timeoutMs: 1000,
-    ...overrides,
-  };
-}
-
-await ta('runShipGate(local): game diff + non-TTY → stages then ABORTS with the localhost URL', async () => {
-  const mp = path.join(markerDir, 'lm1.json');
-  const r = await sbx.runShipGate({ taskId: 1056, files: ['modules/game/public/game/a.js'], skipStage: false, tty: false }, localDeps(mp));
-  assert.equal(r.ok, false, 'unreviewed game work must not ship non-interactively on a laptop');
-  assert.equal(r.review, true);
-  assert.match(r.reason, /staged at http:\/\/localhost:3100/i);
-  assert.ok(fs.existsSync(mp), 'work is staged so the human can review at localhost');
-});
-
-await ta('runShipGate(local): TTY yes → records a tty sign-off with the localhost URL + kind=local marker', async () => {
-  const mp = path.join(markerDir, 'lm2.json');
-  const r = await sbx.runShipGate({ taskId: 1056, files: ['modules/game/world/terrain.js'], skipStage: false, tty: true }, localDeps(mp, { promptYesNo: async () => true }));
-  assert.equal(r.ok, true);
-  assert.equal(r.sandboxReview.method, 'tty');
-  assert.equal(r.sandboxReview.url, 'http://localhost:3100');
-  assert.ok(r.sandboxReview.stamp);
-  const m = JSON.parse(fs.readFileSync(mp, 'utf8'));
-  assert.equal(m.url, 'http://localhost:3100');
-  assert.equal(m.kind, 'local');
-});
-
-await ta('runShipGate(local): --approved re-run on a fresh stage records a flag sign-off', async () => {
-  const mp = path.join(markerDir, 'lm3.json');
-  const deps = localDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
-  sbx.writeMarker({ stamp: sbx.computeTreeStamp({ cwd: tmp }), url: 'http://localhost:3100' }, deps);
-  const r = await sbx.runShipGate({ taskId: 1056, files: ['server.js'], skipStage: false, tty: false, approved: true }, deps);
-  assert.equal(r.ok, true);
-  assert.equal(r.sandboxReview.method, 'flag');
-  assert.equal(r.sandboxReview.url, 'http://localhost:3100');
-});
-
-await ta('runShipGate(local): non-game diff (clean tree) → skip, no staging', async () => {
-  const mp = path.join(markerDir, 'lm4.json');
-  const r = await sbx.runShipGate({ taskId: 1056, files: ['docs/x.md'], skipStage: false, tty: true }, localDeps(mp));
-  assert.equal(r.ok, true);
-  assert.equal(fs.existsSync(mp), false, 'no marker — nothing previewable');
-});
-
 fs.rmSync(tmp, { recursive: true, force: true });
 
 // ---------- 1002062: the surface list must describe a REAL tree ----------
@@ -653,7 +367,7 @@ fs.rmSync(tmp, { recursive: true, force: true });
 // WHY THESE EXIST. Every case above feeds sandbox-stage its own fixture paths,
 // so the previewable list matched NOTHING in the real repo for 69 days and all
 // 47 tests stayed green. A suite that supplies the paths it tests cannot notice
-// that the paths are wrong. These four look at the real thing instead.
+// that the paths are wrong. These two look at the real thing instead.
 
 t('1002062 the three surface spellings are DERIVED, so they cannot drift apart', () => {
   // They used to be three hand-maintained copies. The module carve updated none
@@ -680,53 +394,6 @@ t('1002062 no PRE-CARVE relic survives in the surface list', () => {
       `${relic} is the pre-carve spelling and matches nothing — it must not be back`
     );
   }
-  assert.ok(sbx.PREVIEWABLE_STATIC_DIR.startsWith('modules/'), 'the served static dir is module-carved');
-});
-
-t('1002062 a client directory that matched NOTHING is reported, not swallowed', () => {
-  // THE ACTUAL BUG. The sync collapsed to one boolean, so a run that synced only
-  // the entrypoints and missed every client dir reported plain success — the
-  // reporter saw "synced previewable surfaces" and got a stale sandbox.
-  const served = fs.mkdtempSync(path.join(os.tmpdir(), "sbx-missed-"));
-  const session = fs.mkdtempSync(path.join(os.tmpdir(), "sbx-sess-"));
-  const calls = [];
-  const execFileSyncStub = (bin, args) => {
-    const a = args.join(" ");
-    if (a.includes("rev-parse")) return "feature-branch\n";
-    // Entrypoints resolve; every client directory is absent from the branch.
-    const ps = args[args.length - 1];
-    if (sbx.PREVIEWABLE_DIRS.includes(ps) && a.includes("feature-branch")) {
-      throw new Error(`pathspec ${ps} did not match any file(s) known to git`);
-    }
-    calls.push(a);
-    return "";
-  };
-  const r = sbx.syncWorktreeToServed({
-    execFileSync: execFileSyncStub,
-    servedRoot: served,
-    sessionRoot: session,
-    cwd: session,
-  });
-  assert.equal(r.ok, true, "the entrypoints synced, so the sync itself is not a hard failure");
-  assert.deepEqual(
-    r.missedDirs, sbx.PREVIEWABLE_DIRS,
-    "every client directory missed, and the caller must be told which"
-  );
-});
-
-t('1002062 pickVerifyTarget maps the CARVED static dir onto the served URL', () => {
-  // modules/game/public/game.js is served at /game.js. The old code stripped a
-  // hardcoded "public/" prefix, which post-carve would have left the whole
-  // modules/game/ path in the URL.
-  const rel = `${sbx.PREVIEWABLE_STATIC_DIR}/game.js`;
-  const target = sbx.pickVerifyTarget({
-    cwd: "/nowhere",
-    fs: { existsSync: () => true },
-    execFileSync: (bin, args) => (args.includes("--porcelain") ? ` M ${rel}\n` : ""),
-  });
-  assert.ok(target, "a changed file under the static dir must be pickable");
-  assert.equal(target.relPath, rel);
-  assert.equal(target.urlPath, "/game.js", "the carved prefix is stripped, not just \"public/\"");
 });
 
 console.log(`\nsandbox_stage: ${passed} passed, ${failed} failed`);