@bongos/core 1.19.1075 → 1.19.1076

package/tests/core_258_box_session_claims_db.mjs

@@ -0,0 +1,180 @@
+// tests/core_258_box_session_claims_db.mjs
+//
+// task 1004362 — core_258 must apply on a database holding a claim created from a
+// dev-box session.
+//
+// WHAT BROKE. core_258 (task 1003895) deletes every builder_sessions row with source
+// 'box'. claims.creator_session_id (migration 013) references builder_sessions with no
+// ON DELETE, so on the live database, which had one such claim, the DELETE failed the
+// foreign key, the whole migration rolled back, and so did every core upgrade carrying
+// it. The fix nulls the link first; NULL is what a web claim already carries.
+//
+// HOW THIS PROVES IT. The lane database is already migrated, so core_258 has run and the
+// source CHECK no longer admits 'box'. Inside ONE transaction that is ALWAYS rolled back,
+// the test widens the CHECK back the way migration 090 had it, seeds a box session and a
+// claim created from it, then runs core_258's own statements (its BEGIN and COMMIT
+// stripped so they join this transaction). Every table core_258 drops is already gone,
+// and each DROP is IF EXISTS, so they are no-ops here. Nothing is committed or truncated.
+//
+// Real-DB (self-skips without Postgres; belongs in the INTEGRATION set).
+//
+// Run:  DATABASE_URL=postgres://... node tests/core_258_box_session_claims_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const migrationText = readFileSync(join(root, 'migrations/core_258_drop_dev_box_tables.sql'), 'utf8');
+
+// The migration's own statements, minus its transaction wrapper. The count check keeps
+// the strip honest: if the file stopped using BEGIN/COMMIT this would silently be a
+// different migration, so say so instead.
+const wrapper = /^\s*(BEGIN|COMMIT);\s*$/gm;
+assert.equal((migrationText.match(wrapper) || []).length, 2, 'core_258 is expected to carry exactly one BEGIN and one COMMIT');
+const migrationBody = migrationText.replace(wrapper, '');
+// The pre-fix body: the same statements without the unlinking UPDATE, so the bug stays
+// executable rather than described.
+const preFixBody = migrationBody.replace(/UPDATE claims SET creator_session_id = NULL[\s\S]*?;/, '');
+assert.notEqual(preFixBody, migrationBody, 'core_258 no longer unlinks claims before deleting box sessions');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+let passed = 0;
+let failed = 0;
+let client;
+async function test(name, fn) {
+  await client.query('SAVEPOINT t');
+  try {
+    await fn();
+    passed++; console.log(`  ok  ${name}`);
+    await client.query('RELEASE SAVEPOINT t');
+  } catch (err) {
+    failed++; console.error(`  FAIL ${name}\n    ${err.message}`);
+    await client.query('ROLLBACK TO SAVEPOINT t');
+  }
+}
+
+// Schema-driven insert (the helper of tests/session_earnings_mirror_db.mjs): fills any
+// NOT NULL column with no default. Identifiers come from this file or information_schema.
+const schemaCache = new Map();
+async function insertRow(table, explicit = {}) {
+  if (!schemaCache.has(table)) {
+    const { rows } = await client.query(
+      `SELECT column_name, data_type, is_nullable, column_default, is_identity
+         FROM information_schema.columns WHERE table_schema = 'public' AND table_name = $1`, [table]);
+    schemaCache.set(table, rows);
+  }
+  const cols = schemaCache.get(table);
+  if (cols.length === 0) throw new Error(`table ${table} not found — is this database migrated?`);
+  const values = { ...explicit };
+  for (const c of cols) {
+    if (c.column_name in values || c.is_nullable === 'YES' || c.column_default !== null || c.is_identity === 'YES') continue;
+    switch (c.data_type) {
+      case 'integer': case 'bigint': case 'smallint': case 'numeric': case 'real': case 'double precision':
+        values[c.column_name] = 0; break;
+      case 'boolean': values[c.column_name] = false; break;
+      case 'timestamp with time zone': case 'timestamp without time zone': case 'date':
+        values[c.column_name] = new Date(); break;
+      case 'json': case 'jsonb': values[c.column_name] = {}; break;
+      case 'ARRAY': values[c.column_name] = []; break;
+      default: values[c.column_name] = `c258-${c.column_name}`;
+    }
+  }
+  const names = Object.keys(values);
+  const { rows } = await client.query(
+    `INSERT INTO ${table} (${names.map((n) => `"${n}"`).join(', ')})
+     VALUES (${names.map((_, i) => `$${i + 1}`).join(', ')}) RETURNING *`,
+    names.map((n) => values[n]));
+  return rows[0];
+}
+
+// A builder with one box session and one cli session, and a released claim from each.
+async function fixture() {
+  const tag = `c258-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const builder = await insertRow('builders', { github_id: `${tag}-gh`, github_login: tag, display_name: tag, total_credits: 0 });
+  const version = await insertRow('versions', { id: `${tag}-v`, status: 'building' });
+  const claimFrom = async (source) => {
+    const session = await insertRow('builder_sessions', { builder_id: builder.id, token_hash: `${tag}-${source}`, source });
+    // discipline + kind: core_247's CHECK refuses the column default (task 1004363).
+    const task = await insertRow('tasks', { title: `${tag} ${source} task`, status: 'shipped', version_id: version.id, discipline: 'engineer', kind: 'feature' });
+    const claim = await insertRow('claims', {
+      task_id: task.id, builder_id: builder.id, creator_session_id: session.id,
+      worktree_name: `${tag}-${source}`, released_at: new Date(), outcome: 'shipped',
+    });
+    return { session, claim };
+  };
+  return { box: await claimFrom('box'), cli: await claimFrom('cli') };
+}
+
+async function main() {
+  try {
+    client = await pool.connect();
+  } catch {
+    console.log('core_258_box_session_claims_db: no Postgres (DATABASE_URL unset/unreachable) — skipping');
+    process.exit(0);
+  }
+
+  await client.query('BEGIN');
+  try {
+    // The source CHECK as migration 090 left it, so a box session can be seeded.
+    await client.query('ALTER TABLE builder_sessions DROP CONSTRAINT IF EXISTS builder_sessions_source_check');
+    await client.query(`ALTER TABLE builder_sessions ADD CONSTRAINT builder_sessions_source_check CHECK (source IN ('cli', 'web', 'box'))`);
+
+    await test('without the unlink, the box-session DELETE fails the claims foreign key (the bug)', async () => {
+      await fixture();
+      await client.query('SAVEPOINT pre');
+      let err = null;
+      try { await client.query(preFixBody); } catch (e) { err = e; }
+      await client.query('ROLLBACK TO SAVEPOINT pre');
+      assert.ok(err, 'the pre-fix body should have failed');
+      assert.equal(err.code, '23503', `expected a foreign-key violation, got ${err.code}: ${err.message}`);
+      assert.match(err.message, /claims_creator_session_id_fkey/);
+    });
+
+    await test('core_258 applies, unlinks the box claim, keeps it, and leaves the cli claim alone', async () => {
+      const { box, cli } = await fixture();
+      // Case 1 passed and released its savepoint, so its box session and claim are still
+      // here too; this run unlinks and deletes those as well. That is harmless and even
+      // realistic (more than one box claim), and every assertion below is scoped by id.
+      await client.query(migrationBody);
+
+      const { rows: claims } = await client.query(
+        'SELECT id, creator_session_id, worktree_name, outcome FROM claims WHERE id = ANY($1::bigint[]) ORDER BY id',
+        [[box.claim.id, cli.claim.id]]);
+      assert.equal(claims.length, 2, 'both claims must survive the migration');
+      const boxClaim = claims.find((c) => String(c.id) === String(box.claim.id));
+      const cliClaim = claims.find((c) => String(c.id) === String(cli.claim.id));
+      assert.equal(boxClaim.creator_session_id, null, 'the box claim must be unlinked');
+      assert.equal(boxClaim.outcome, 'shipped', 'the box claim keeps its history');
+      assert.equal(String(cliClaim.creator_session_id), String(cli.session.id), 'a cli claim must keep its session');
+
+      const { rows: boxSessions } = await client.query(`SELECT count(*)::int AS n FROM builder_sessions WHERE source = 'box'`);
+      assert.equal(boxSessions[0].n, 0, 'every box session must be deleted');
+      const { rows: cliSession } = await client.query('SELECT id FROM builder_sessions WHERE id = $1', [cli.session.id]);
+      assert.equal(cliSession.length, 1, 'a cli session must survive');
+
+      await client.query('SAVEPOINT chk');
+      let err = null;
+      try { await insertRow('builder_sessions', { builder_id: cli.session.builder_id, token_hash: `${cli.session.token_hash}-again`, source: 'box' }); } catch (e) { err = e; }
+      await client.query('ROLLBACK TO SAVEPOINT chk');
+      assert.equal(err && err.code, '23514', 'the narrowed CHECK must refuse a new box session');
+    });
+  } finally {
+    await client.query('ROLLBACK');
+    client.release();
+    await pool.end();
+  }
+
+  console.log(`\ncore_258_box_session_claims_db: ${passed} passed, ${failed} failed`);
+  // Let the socket close before exiting (a libuv abort otherwise on some boxes).
+  await new Promise((r) => setTimeout(r, 100));
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch((err) => { console.error(err); process.exit(1); });

package/tests/fitness.mjs

@@ -973,3 +973,92 @@ test('KERNEL_FILES is exported exactly ONCE and still resolves (task 1002795)',
   assert.ok(Array.isArray(fitness.KERNEL_FILES), 'and it still resolves to an array');
   assert.ok(fitness.KERNEL_FILES.length > 0, 'with the real kernel roster in it');
 });
+
+// ---- the dev box stays retired (task 1003899, ADR 0346) ---------------------
+//
+// scripts/gds/dev-box-guard.js fails CI when a retired dev-box name reappears.
+// Each rule is proven by PLANTING a violation through the injectable files/read
+// seam, never by assuming the regex is right. The retired names are assembled at
+// runtime (KEY = 'dev' + '-box', …) so this file never contains them literally and
+// needs no exemption of its own.
+const devBoxGuard = require(path.join(ROOT, 'scripts', 'gds', 'dev-box-guard.js'));
+const KEY = 'dev' + '-box';
+const TABLE = 'builder' + '_boxes';
+const COLUMN = 'box' + '_blocked_reason';
+const PERM = 'box' + '.fleet.manage';
+const BOX = 'b' + 'ox';
+
+function plant(rel, text) {
+  return devBoxGuard.checkNoDevBox({ files: [rel], read: () => text });
+}
+
+test('dev-box guard: the clean tree passes, and it scans the real tracked files', () => {
+  const r = devBoxGuard.checkNoDevBox();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  assert.match(r.note, /(\d{4,}) tracked file/, 'a real enumeration, not an empty one');
+});
+
+test('dev-box guard: it is wired into the fitness CHECKS that CI runs', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'fitness.js'), 'utf8');
+  assert.match(src, /require\('\.\/dev-box-guard\.js'\)\.checkNoDevBox/);
+  const names = fitness.runAll().map((r) => r.name);
+  assert.ok(names.includes('the dev box stays retired (ADR 0346)'), 'runAll() includes the guard');
+});
+
+test('dev-box guard: each rule FAILS on a planted violation', () => {
+  const cases = [
+    ['module-key (quoted)', 'src/x.js', `enable('${KEY}');`],
+    ['module-key (path)', 'src/y.js', `require('../modules/${KEY}/boxes.js');`],
+    ['module-key (json key)', 'config/modules.neutral.json', `{ "modules": { "${KEY}": true } }`],
+    ['identifier (table)', 'src/z.js', `await q('SELECT * FROM ${TABLE}');`],
+    ['identifier (column)', 'src/w.js', `SELECT ${COLUMN} FROM builders`],
+    ['permission', 'modules/government/catalog.js', `{ key: '${PERM}', floor: 'metic' },`],
+    ['session-source', 'src/bongos/auth.js', `if (session.source === '${BOX}') return;`],
+  ];
+  for (const [label, rel, text] of cases) {
+    const r = plant(rel, text);
+    assert.equal(r.hardFail, true, `${label}: a planted violation must fail the check`);
+    assert.match(r.violations[0], /ADR 0346/, `${label}: the failure names the ADR`);
+    assert.match(r.note, /DEV_BOX_EXEMPT in scripts\/gds\/dev-box-guard\.js/, `${label}: and the one exemption list`);
+  }
+});
+
+test('dev-box guard: a retired PATH fails even with harmless contents', () => {
+  for (const rel of [`scripts/gds/${BOX}.js`, `infra/${BOX}-provision.sh`, `modules/${KEY}/module.json`, '.devcontainer/devcontainer.json']) {
+    const r = plant(rel, '{}');
+    assert.equal(r.hardFail, true, `${rel} must fail`);
+    assert.match(r.violations.join('\n'), /path: a retired dev-box location/);
+  }
+});
+
+test('dev-box guard: near misses do NOT fire (plurals, filenames, prose, a server box)', () => {
+  const clean = [
+    `resolveModules({ modules: { '${KEY}es': true } })`, // the typo guard's test input
+    `see docs/adr/0072-${KEY}-code-staleness-visibility.md`, // an ADR filename
+    `the ${KEY} removal is recorded in ADR 0346`, // prose, not a key
+    `ENV_FILE=/etc/cloudbongos/${BOX}.env`, // box.env is the control-plane runner's env file
+    `ssh into the co-hosting ${BOX}`, // a server
+    `const secret = require('./secret-${BOX}.js');`, // crypto, unrelated
+    `if (session.source === 'cli') return;`,
+  ];
+  for (const text of clean) {
+    const r = plant('src/near-miss.js', text);
+    assert.equal(r.hardFail, false, `should not fire: ${text}\n${r.violations.join('\n')}`);
+  }
+});
+
+test('dev-box guard: the exemption list is honoured, and it is the only way out', () => {
+  const text = `const RETIRED = { '${KEY}': 'gone' };`;
+  assert.equal(plant('src/modules.js', text).hardFail, false, 'the retirement guard file is exempt');
+  assert.equal(plant('docs/adr/0999-anything.md', text).hardFail, false, 'the historical record is exempt by prefix');
+  assert.equal(plant('src/other.js', text).hardFail, true, 'the same text anywhere else fails');
+  for (const [entry, why] of devBoxGuard.DEV_BOX_EXEMPT) {
+    assert.ok(typeof why === 'string' && why.length >= 12, `${entry} carries a reason`);
+  }
+});
+
+test('dev-box guard: an empty enumeration is a scan defect, not a pass', () => {
+  const r = devBoxGuard.checkNoDevBox({ files: [], read: () => '' });
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations[0], /scan defect/);
+});

package/tests/hall_palette.mjs

@@ -28,21 +28,41 @@ const SHELL_SRC = read('shell.js');
 
 // Boot palette.js against a DOM stub whose sidebar carries `navItems`, and whose
 // `visibleIds` decide which section groups are on offer. Returns window.OTBPalette.
-function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work', 'shell-user'] } = {}) {
+//
+// `registry` memoizes querySelector by selector string (keyed globally within one
+// boot, same as a real single-instance-id contract) so `build()`'s one-time
+// `root.querySelector('#palette-input')` / `'#palette-list'` calls hand back the
+// SAME stub every time — real enough to fire DOM events at and read innerHTML
+// back from, which the pure-compute-only harness never needed before task 1003460
+// wired a real fetch() into the input handler.
+function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work', 'shell-user'], modules = null, fetchImpl = undefined } = {}) {
+  const registry = {};
   const makeNav = (it) => ({
     hidden: !!it.hidden,
     target: it.external ? '_blank' : '',
     getAttribute: (n) => (n === 'href' ? it.href : null),
     querySelector: (sel) => (sel === '.nav-item__label' ? { textContent: it.label } : null),
   });
-  const stubEl = () => ({
-    hidden: false, dataset: {}, textContent: '', value: '', className: '',
-    classList: { add() {}, remove() {}, contains() { return false; }, toggle() { return false; } },
-    setAttribute() {}, getAttribute() { return null; },
-    addEventListener() {}, appendChild() {}, focus() {}, querySelector() { return stubEl(); },
-    querySelectorAll() { return []; },
-    set innerHTML(_v) {}, get innerHTML() { return ''; },
-  });
+  const stubEl = (sel) => {
+    const listeners = {};
+    const el = {
+      hidden: false, dataset: {}, textContent: '', value: '', className: '',
+      classList: { add() {}, remove() {}, contains() { return false; }, toggle() { return false; } },
+      setAttribute() {}, getAttribute() { return null; },
+      addEventListener(type, fn) { (listeners[type] = listeners[type] || []).push(fn); },
+      fire(type, ev) { (listeners[type] || []).forEach((fn) => fn(ev || {})); },
+      appendChild() {}, focus() {},
+      querySelector(childSel) {
+        if (!registry[childSel]) registry[childSel] = stubEl(childSel);
+        return registry[childSel];
+      },
+      querySelectorAll() { return []; },
+      set innerHTML(v) { this._html = v; },
+      get innerHTML() { return this._html || ''; },
+    };
+    if (sel) registry[sel] = el;
+    return el;
+  };
 
   const documentObj = {
     body: { dataset: { page: 'home' }, appendChild() {} },
@@ -62,17 +82,34 @@ function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work',
   const windowObj = { location: { hash: '', assign() {} }, addEventListener() {}, open() {} };
   const sandbox = {
     window: windowObj, document: documentObj, navigator: { platform: 'Win32', userAgent: 'test' },
-    console,
+    console, setTimeout, clearTimeout, Promise, JSON, Number, String, Array, Object,
   };
+  if (fetchImpl) sandbox.fetch = fetchImpl;
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(PALETTE_SRC, sandbox, { filename: 'palette.js' });
   // Copy results across the realm boundary — a vm-created array has the sandbox's
   // Array.prototype, which deepStrictEqual rejects even when the values match.
   const P = windowObj.OTBPalette;
-  return { compute: (q) => Array.from(P.compute(q), (e) => ({ ...e })) };
+  return {
+    compute: (q) => Array.from(P.compute(q), (e) => ({ ...e })),
+    contentEntry: (hit) => { const e = P.contentEntry(hit); return e ? { ...e } : e; },
+    open: () => P.open(),
+    close: () => P.close(),
+    listEl: () => registry['#palette-list'],
+    type(value) {
+      const el = registry['#palette-input'];
+      el.value = value;
+      el.fire('input');
+    },
+  };
 }
 
+const tick = (ms = 0) => new Promise((r) => setTimeout(r, ms));
+// Real timers (palette.js's debounce is a real setTimeout) — settle past the
+// 300ms debounce plus a few microtask/macrotask turns for the fetch chain.
+async function settleSearch() { await tick(400); }
+
 const NAV_FIXTURE = [
   { label: 'Home', href: '/' },
   { label: 'Tasks', href: '/work' },
@@ -207,3 +244,179 @@ test('every page that loads the shell also loads the palette', () => {
   const missing = withShell.filter((f) => !/src="\/builders\/palette\.js/.test(read(f)));
   assert.deepEqual(missing, [], 'Ctrl-K must work on every hall page');
 });
+
+// ---- server-backed content search (task 1003460) ---------------------------
+
+const TASK_HIT = { id: 1, source_kind: 'db', source_ref: 'task:1003460', title: "Ctrl-K searches the project's memory", heading_path: null };
+const IDEA_HIT = { id: 2, source_kind: 'db', source_ref: 'idea:42', title: 'A homeless idea' };
+const BLOCKER_HIT = { id: 3, source_kind: 'db', source_ref: 'blocker:7', title: 'Needs the owner' };
+const DOC_HIT = { id: 4, source_kind: 'doc', source_ref: 'docs/adr/0060-gds-retrieval-layer.md', title: 'ADR 0060' };
+const SESSION_LOG_HIT = { id: 5, source_kind: 'db', source_ref: 'session_log:9', title: 'Session log 9 · task 1003460' };
+
+test('contentEntry resolves task/idea/blocker hits to real hall destinations', () => {
+  const P = bootPalette({ navItems: NAV_FIXTURE });
+  assert.deepEqual(
+    { label: P.contentEntry(TASK_HIT).label, href: P.contentEntry(TASK_HIT).href, overlay: !!P.contentEntry(TASK_HIT).overlay },
+    { label: "Ctrl-K searches the project's memory", href: '/task/1003460', overlay: false },
+  );
+  assert.deepEqual(
+    { href: P.contentEntry(IDEA_HIT).href, overlay: P.contentEntry(IDEA_HIT).overlay },
+    { href: '#/idea/42', overlay: true },
+  );
+  assert.deepEqual(
+    { href: P.contentEntry(BLOCKER_HIT).href, overlay: P.contentEntry(BLOCKER_HIT).overlay },
+    { href: '#/blocker/7', overlay: true },
+  );
+});
+
+test('contentEntry drops hits the hall has no page for (doc/session-log/etc)', () => {
+  const P = bootPalette({ navItems: NAV_FIXTURE });
+  assert.equal(P.contentEntry(DOC_HIT), null, 'a repo doc chunk has no hall page to jump to');
+  assert.equal(P.contentEntry(SESSION_LOG_HIT), null, 'a session-log chunk has no hall page to jump to');
+  assert.equal(P.contentEntry(null), null);
+  assert.equal(P.contentEntry({ source_kind: 'db', source_ref: 'commit:abc123' }), null, 'an unrecognized db ref resolves to nothing, not a crash');
+});
+
+test('contentEntry normalizes a dash the way cleanTitle() does everywhere else (V4, docs/voice.md)', () => {
+  // A task/idea/blocker title is quoted ledger data, not copy this project
+  // authored — V4 binds the dash ban to exactly that, enforced at render.
+  const P = bootPalette({ navItems: NAV_FIXTURE });
+  const hit = { source_kind: 'db', source_ref: 'task:99', title: 'V4.R18 — Ctrl-K searches the memory (follow-up)' };
+  assert.equal(P.contentEntry(hit).label, 'V4.R18, Ctrl-K searches the memory');
+});
+
+test('contentEntry truncates a pathologically long indexed title before it becomes markup', () => {
+  const P = bootPalette({ navItems: NAV_FIXTURE });
+  const longTitle = 'x'.repeat(400);
+  const hit = { source_kind: 'db', source_ref: 'task:1', title: longTitle };
+  const label = P.contentEntry(hit).label;
+  assert.ok(label.length <= 120, `label must be capped, got ${label.length} chars`);
+  assert.ok(label.endsWith('…'), 'a truncated label is marked as such');
+});
+
+test('typing prose merges in content matches from POST /api/bongos/search, on top of local matches', async () => {
+  const calls = [];
+  const fetchImpl = async (url, init) => {
+    calls.push({ url, body: JSON.parse(init.body) });
+    return { ok: true, json: async () => ({ query: 'ctrl-k memory', count: 1, results: [TASK_HIT] }) };
+  };
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  P.type('ctrl-k memory');
+  // Local compute() ran synchronously — pages/sections still searchable immediately.
+  assert.deepEqual(P.compute('ctrl-k memory'), [], 'sanity: no local page/section matches this prose');
+
+  await settleSearch();
+
+  assert.equal(calls.length, 1, 'exactly one debounced request, not one per keystroke');
+  assert.equal(calls[0].url, '/api/bongos/search');
+  assert.equal(calls[0].body.q, 'ctrl-k memory');
+  assert.equal(calls[0].body.source_kind, 'db', 'a doc/session-log/etc hit would only ever be dropped by contentEntry — ask the server to not spend the result budget on it');
+  assert.match(P.listEl().innerHTML, /Content/, 'the merged row carries the Content group');
+  assert.match(P.listEl().innerHTML, /Ctrl-K searches the project&#39;s memory/, 'and the task title from the server hit');
+});
+
+test('killing the search endpoint leaves the palette exactly as useful as today', async () => {
+  const fetchImpl = async () => { throw new Error('endpoint is down'); };
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  P.type('economy');
+  const beforeHtml = P.listEl().innerHTML;
+  assert.match(beforeHtml, /Economy/, 'the local page match rendered synchronously');
+
+  await settleSearch();
+
+  assert.equal(P.listEl().innerHTML, beforeHtml, 'a failed fetch changes nothing — no error row, no crash');
+});
+
+test('a 404 (endpoint removed) degrades the same as a network failure', async () => {
+  const fetchImpl = async () => ({ ok: false, status: 404, json: async () => ({ error: 'not_found' }) });
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  P.type('economy');
+  const beforeHtml = P.listEl().innerHTML;
+
+  await settleSearch();
+
+  assert.equal(P.listEl().innerHTML, beforeHtml);
+});
+
+test('a query under SEARCH_MIN_LEN never calls the endpoint at all', async () => {
+  let called = false;
+  const fetchImpl = async () => { called = true; return { ok: true, json: async () => ({ results: [] }) }; };
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  // 2 chars, not 1: the endpoint's least-selective case (falls through FTS to an
+  // unindexed trigram scan plus a zero-result corpusHealth() probe) is exactly
+  // the length this gate exists to keep off the wire.
+  P.type('ab');
+
+  await settleSearch();
+
+  assert.equal(called, false, 'two characters is not worth the endpoint\'s worst-case query plan');
+});
+
+test('closing the palette invalidates an in-flight search — it cannot land after close', async () => {
+  let resolveFetch;
+  const fetchImpl = () => new Promise((resolve) => { resolveFetch = resolve; });
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  P.type('ctrl-k memory');
+  await tick(350); // past the debounce — the request is now in flight
+  P.close();
+  resolveFetch({ ok: true, json: async () => ({ results: [TASK_HIT] }) });
+  await tick(20);
+
+  // isOpen() is false, so runSearch's own guard must have thrown the response away.
+  // (compute() is pure/local and would never carry a remote hit either way — the
+  // rendered DOM is the only place a landed-too-late merge could show up.)
+  assert.ok(!/Ctrl-K searches/.test(P.listEl().innerHTML), 'a response that lands after close must not render');
+});
+
+test('a duplicate destination (already resolved locally) is not appended twice', async () => {
+  const fetchImpl = async () => ({ ok: true, json: async () => ({ results: [TASK_HIT] }) });
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  P.type('1003460'); // id syntax already resolves this to the same /task/1003460 href
+  await settleSearch();
+
+  const rows = P.listEl().innerHTML.match(/data-i="\d+"/g) || [];
+  assert.equal(rows.length, 1, 'the server hit for the same task must not add a second row for the same href');
+  assert.match(P.listEl().innerHTML, /Task 1003460/, 'the id-syntax row is the one that stays');
+});
+
+test('a repeated query within one open() replays the cache instead of re-fetching', async () => {
+  const calls = [];
+  const fetchImpl = async () => { calls.push(1); return { ok: true, json: async () => ({ results: [TASK_HIT] }) }; };
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  P.type('ctrl-k memory');
+  await settleSearch();
+  assert.equal(calls.length, 1);
+
+  // Backspace, then retype back to the exact same query (the common case: a
+  // reader pauses mid-edit and returns to what they had).
+  P.type('ctrl-k mem');
+  P.type('ctrl-k memory');
+  await settleSearch();
+
+  assert.equal(calls.length, 1, 'the identical query was served from the per-open cache, not re-fetched');
+  assert.match(P.listEl().innerHTML, /Ctrl-K searches the project&#39;s memory/, 'the cached hit still renders');
+});
+
+test('closing and reopening clears the cache — a fresh open may see new DB state', async () => {
+  const calls = [];
+  const fetchImpl = async () => { calls.push(1); return { ok: true, json: async () => ({ results: [TASK_HIT] }) }; };
+  const P = bootPalette({ navItems: NAV_FIXTURE, fetchImpl });
+  P.open();
+  P.type('ctrl-k memory');
+  await settleSearch();
+  assert.equal(calls.length, 1);
+
+  P.close();
+  P.open();
+  P.type('ctrl-k memory');
+  await settleSearch();
+
+  assert.equal(calls.length, 2, 'a fresh open must not trust a memo carried over from the previous one');
+});

package/tests/provisioning_recommendations.mjs

@@ -103,7 +103,7 @@ test('an open community adds somewhere to gather to a bundle that lacks one', ()
 
 test('a community adds the gathering place to a bundle that lacks it', () => {
   // The surviving bundle rule's ADD path. The two rules that added and removed
-  // `dev-box` by team shape went with the module (task 1003886), which leaves
+  // the dev box by team shape went with the module (task 1003886), which leaves
   // `effect: 'remove'` declared in adjustBundle but named by no live rule - it is
   // kept for the next rule that needs it, not because anything exercises it today.
   // Arrange - the research bundle is `agents` alone, so the addition bites.