@bongos/core 1.19.1080 → 1.20.1

package/tests/autonomy_gauge.mjs

@@ -398,3 +398,65 @@ test('a derived seven-day window is NOT paced against a boundary we invented', (
   assert.equal(d.derived, true);
   assert.equal(d.go, true);
 });
+
+// --- a derived mark must be in the CURRENT window (task 1004376) ------------
+//
+// Regression from the 1004178 fix, found on the host the moment the runner was
+// restarted onto it. derivedSince reported the RETIRED reading's resets_at,
+// which on an unattended host is days old — so the caller's cap counted work
+// done days earlier, arrived pre-exhausted, and the runner held forever having
+// correctly derived headroom. Exactly the state 1004178 existed to end.
+
+test('a week-old retired reading yields a mark inside the CURRENT window', () => {
+  const now = 10_000_000;
+  const weekAgoReset = now - 7 * 24 * HOUR;          // the retired boundary
+  const d = decideCapacity({
+    gauge: {
+      written_at: weekAgoReset - HOUR,
+      five_hour: { used_percentage: 90, resets_at: weekAgoReset, observed_at: weekAgoReset - HOUR },
+    },
+    now,
+  });
+  assert.equal(d.derived, true);
+  assert.notEqual(d.derivedSince, weekAgoReset, 'the retired boundary is exactly what must NOT come back');
+  assert.ok(now - d.derivedSince < 5 * HOUR, 'the mark must sit inside the current five-hour window');
+  assert.ok(d.derivedSince <= now, 'and never in the future');
+});
+
+test('the advanced mark lands on a whole number of periods from the observed one', () => {
+  const now = 10_000_000;
+  const reset = now - (3 * 5 * HOUR) - HOUR;   // three full windows, plus an hour
+  const d = decideCapacity({
+    gauge: { written_at: reset - 60, five_hour: { used_percentage: 80, resets_at: reset, observed_at: reset - 60 } },
+    now,
+  });
+  assert.equal(d.derivedSince, reset + 3 * 5 * HOUR, 'stepped forward by whole periods, not guessed');
+});
+
+test('derivedSince takes the MOST RECENT boundary when both windows derive', () => {
+  const now = 10_000_000;
+  const d = decideCapacity({
+    gauge: {
+      written_at: now - 8 * 24 * HOUR,
+      five_hour: { used_percentage: 50, resets_at: now - 6 * HOUR, observed_at: now - 8 * 24 * HOUR },
+      seven_day: { used_percentage: 50, resets_at: now - 8 * 24 * HOUR, observed_at: now - 8 * 24 * HOUR },
+    },
+    now,
+  });
+  assert.equal(d.derived, true);
+  assert.ok(now - d.derivedSince < 5 * HOUR,
+    'the seven-day boundary would make the cap a one-time budget that never refills');
+});
+
+test('a reading whose window is still running is unaffected by the advance', () => {
+  const now = 10_000_000;
+  const d = decideCapacity({
+    gauge: {
+      written_at: now - 10 * HOUR,
+      five_hour: { used_percentage: 92, resets_at: now + HOUR, observed_at: now - 10 * HOUR },
+    },
+    now,
+  });
+  assert.equal(d.go, false, 'still unknown — usage only grows inside a live window');
+  assert.equal(d.unknown, true);
+});

package/tests/blocker_hall_live_proof.mjs

@@ -0,0 +1,275 @@
+// tests/blocker_hall_live_proof.mjs — task 1003457 (BONGOS-V2, goal 1000089).
+//
+// CLAUDE.md states that resolving a blocker auto-promotes any linked `blocked`
+// task back to `ready`, via a DB TRIGGER (migration 009, tightened by core_223).
+// Nothing had ever driven that trigger through the HALL'S OWN PATH: the real
+// HTTP routes modules/hall-ui/public/blockers.js calls (POST /blockers,
+// POST /blockers/:id/link, POST /blockers/:id/resolve). The existing coverage
+// is real but narrower — blocker_resolve_guard.mjs and blocker_unlink.mjs pin
+// the migrations' SQL TEXT statically (no live trigger ever fires), and
+// blocker_link.mjs unit-tests the pure `blocksOnLink` predicate the route's
+// SQL is built from (its own header: "The SQL itself is exercised by the
+// post-deploy smoke run"). None of them prove the trigger actually fires when
+// a write arrives through the real router, its own middleware stack and its
+// own pooled connection — prove it end to end rather than reasoning about it.
+//
+// So this: real Postgres, the real buildGdsRouter() booted in-process (the
+// government_live_proof.mjs pattern), mounted at the CANONICAL prefix
+// (src/bongos/api-prefix.js API_PREFIX = '/api/bongos') so the path is
+// byte-identical to what the hall UI calls — '/api/gds' is only a permanent
+// alias for older clients, and using it here would leave open exactly the
+// "same handlers, different path" gap this proof exists to close. Real HTTP
+// calls with a real bearer session — file a blocker, link it to a real
+// `ready` task (parking it `blocked`), resolve the blocker THROUGH THE ROUTE,
+// then independently re-read the task's status straight from the database.
+// If the trigger is ever dropped, disconnected from this write path, or fired
+// on a different transaction than the one the route actually commits, the
+// task stays `blocked` and the assertion below fails loudly — not a skip,
+// not a stub.
+//
+// WHY THIS CANNOT BE THE "always rolled back" CLASS (idea_credit_streams_db.mjs,
+// core_258_box_session_claims_db.mjs): those call a module function directly
+// with an injected client, so the whole test IS one transaction. Here the
+// three acts are three separate HTTP requests, and the route handler opens
+// ITS OWN connection from the real pool — a connection that can only see
+// COMMITTED rows on another connection. Proving the trigger fires on the
+// hall's real, independent connection therefore requires the fixture rows to
+// really be committed; there is no transaction this file could wrap around
+// three separate request/response round trips that would still let the
+// server see them. The mitigation is scope and speed, not a rollback:
+// high, unmistakably-synthetic fixture ids; the single most sensitive row
+// (the live bearer session) is deleted FIRST in cleanup, before anything
+// else, so the shortest possible cleanup still revokes it; and cleanup runs
+// via a tight id/source_ref match, never a free-text title scan.
+//
+// Real-DB integration test (the needs_rebase.mjs class): SELF-SKIPS (exit 0)
+// when DATABASE_URL is unset/unreachable or the schema it needs is missing,
+// and is listed in run-unit-tests.js's INTEGRATION set so the DB-free lane
+// never runs it. DATABASE_URL is what the sibling integration tests in this
+// set (claim_gate_open_blocker.mjs, government_live_proof.mjs) already treat
+// as "this is a throwaway CI/dev Postgres" — production never sets it
+// (src/bongos/pool.js resolves an unset DATABASE_URL to the peer-auth local
+// socket instead), so the same assumption applies here.
+//
+// Run:  DATABASE_URL=... node tests/blocker_hall_live_proof.mjs
+
+import { strict as assert } from 'node:assert';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = process.env.NODE_ENV || 'test';
+const require = createRequire(import.meta.url);
+
+if (!process.env.DATABASE_URL) {
+  console.log('blocker_hall_live_proof.mjs SKIPPED — DATABASE_URL not set.');
+  process.exit(0);
+}
+
+const { Pool } = require('pg');
+const { sessionTokenHash } = require('../src/bongos/db-kernel.js');
+const { API_PREFIX } = require('../src/bongos/api-prefix.js');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+
+// ── readiness guard (government_live_proof.mjs's shape, task 1003091's lesson:
+// a schema this file cannot recognise must FAIL naming the tables, never skip
+// silently as though there were simply no Postgres here) ────────────────────
+const REQUIRED_TABLES = [
+  'builders', 'builder_sessions', 'versions', 'tasks',
+  'blockers', 'task_blockers',
+  'government_builder_ranks', 'government_rank_permissions',
+];
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`blocker_hall_live_proof.mjs SKIPPED — Postgres unreachable (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+{
+  const { rows } = await pool.query(
+    `SELECT table_name FROM information_schema.tables
+      WHERE table_schema = 'public' AND table_name = ANY($1::text[])`,
+    [REQUIRED_TABLES],
+  );
+  const present = new Set(rows.map((r) => r.table_name));
+  const missing = REQUIRED_TABLES.filter((t) => !present.has(t));
+  if (missing.length === REQUIRED_TABLES.length) {
+    console.log('blocker_hall_live_proof.mjs SKIPPED — reachable Postgres with no instance schema (run scripts/migrate.sh).');
+    await pool.end().catch(() => {});
+    process.exit(0);
+  }
+  if (missing.length) {
+    await pool.end().catch(() => {});
+    throw new Error(
+      `blocker_hall_live_proof.mjs CANNOT RUN: this database is migrated but is missing ${missing.join(', ')}. `
+      + 'Either the schema was renamed under this proof or the target is not a Cloud Bongos instance database.'
+    );
+  }
+}
+
+// ── fixtures (high-ID range; cleaned before AND after so reruns are safe) ────
+const VER = 'ZZZ-BLK';
+const BUILDER = 90000801;
+const TASK = 90000802;
+const RANK_KEY = 'metic'; // the seeded floor for blocker.review (catalog.js)
+// A stable source/source_ref pair, never a free-text title, is what cleanup
+// keys the blocker fixture on — a title match could reach any real blocker
+// anyone else ever happened to file with the same words.
+const BLOCKER_SOURCE = 'blocker_hall_live_proof';
+const BLOCKER_SOURCE_REF = 'fixture';
+const TOKEN = 'bhlp' + crypto.randomBytes(24).toString('hex');
+
+const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
+
+// Ordered so the single most sensitive row — the LIVE bearer session — goes
+// first: even a cleanup that dies partway through has already revoked it.
+// Every step is ATTEMPTED regardless of an earlier failure (collect, don't
+// abort), and then a combined error is thrown if anything failed — so a
+// cleanup failure surfaces loudly (naming what actually blocked it, matching
+// government_live_proof.mjs's shape) without one bad DELETE stranding every
+// row after it.
+async function cleanup() {
+  const steps = [
+    ['builder_sessions', () => q(`DELETE FROM builder_sessions WHERE builder_id = $1`, [BUILDER])],
+    ['task_blockers', () => q(`DELETE FROM task_blockers WHERE task_id = $1`, [TASK])],
+    ['blockers', () => q(`DELETE FROM blockers WHERE source = $1 AND source_ref = $2`, [BLOCKER_SOURCE, BLOCKER_SOURCE_REF])],
+    ['tasks', () => q(`DELETE FROM tasks WHERE id = $1`, [TASK])],
+    ['government_builder_ranks', () => q(`DELETE FROM government_builder_ranks WHERE builder_id = $1`, [BUILDER])],
+    ['audit_log', () => q(`DELETE FROM audit_log WHERE builder_id = $1`, [BUILDER])],
+    ['builders', () => q(`DELETE FROM builders WHERE id = $1`, [BUILDER])],
+    ['versions', () => q(`DELETE FROM versions WHERE id = $1`, [VER])],
+  ];
+  const failures = [];
+  for (const [name, run] of steps) {
+    try { await run(); } catch (e) { failures.push(`${name}: ${e.message}`); }
+  }
+  if (failures.length) throw new Error(`cleanup: ${failures.length} step(s) failed — ${failures.join('; ')}`);
+}
+
+async function seed() {
+  // `shipped`, deliberately not `planning` — the task's own row only needs a
+  // version_id FK target, and versions_one_planning_idx (core_233) is a
+  // partial UNIQUE index allowing exactly one `planning` row in the whole
+  // table. `ON CONFLICT (id)` guards only the primary key, not that second
+  // index, so seeding `planning` here would 23505 on any database that
+  // already has one in progress (nearly every real dev/CI database does).
+  // `shipped` carries no such cardinality constraint.
+  await q(
+    `INSERT INTO versions (id,name,status,track) VALUES ($1,'blk','shipped','internal')
+       ON CONFLICT (id) DO NOTHING`,
+    [VER],
+  );
+  await q(
+    `INSERT INTO builders (id,github_id,github_login,display_name,rank,status)
+     VALUES ($1,'bhlp-builder','bhlp-builder','BHLP Fixture Builder','metic','active')`,
+    [BUILDER],
+  );
+  // R95b: the resolver reads government_builder_ranks, not builders.rank — a
+  // direct seed has to mirror the rank-role sync the same way
+  // government_live_proof.mjs does, or the fixture builder resolves ZERO
+  // permissions and 403s its own /resolve and /link calls.
+  await q(
+    `INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES ($1,$2)`,
+    [BUILDER, RANK_KEY],
+  );
+  await q(
+    `INSERT INTO builder_sessions (builder_id, token_hash, source) VALUES ($1,$2,'web')`,
+    [BUILDER, sessionTokenHash(TOKEN)],
+  );
+  // A `ready` task — the one status blockers.linkBlockerToTask actually parks
+  // as `blocked` (LINK_BLOCKABLE_STATUSES), so the resolve trigger has
+  // something real to promote back. The discipline is named because the column
+  // default is still 'unclassified', which tasks_discipline_check has refused
+  // since core_247 (task 1002988); every real create path resolves one.
+  await q(
+    `INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline)
+     VALUES ($1,$2,'bhlp fixture task','ready',10,'feature','engineer')`,
+    [TASK, VER],
+  );
+}
+
+// ── the server: the real router, in-process, at the CANONICAL prefix ────────
+const express = require('express');
+const { buildGdsRouter } = require('../src/bongos/routes.js');
+const app = express();
+app.use(API_PREFIX, buildGdsRouter());
+const server = await new Promise((resolve) => {
+  const s = app.listen(0, '127.0.0.1', () => resolve(s));
+});
+const base = `http://127.0.0.1:${server.address().port}`;
+
+const call = async (method, path, body) => {
+  const res = await fetch(`${base}${API_PREFIX}${path}`, {
+    method,
+    headers: {
+      authorization: `Bearer ${TOKEN}`,
+      ...(body ? { 'content-type': 'application/json' } : {}),
+    },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const json = await res.json().catch(() => ({}));
+  // Status + error code only — never the body, so an auth-failure response
+  // can never print session material into this test's own log.
+  const code = json?.error?.code || json?.error || '';
+  console.log(`  ${method.padEnd(6)} ${path}  →  ${res.status}${code ? ` ${code}` : ''}`);
+  return { status: res.status, body: json };
+};
+
+const taskStatus = async () => {
+  const rows = await q(`SELECT status FROM tasks WHERE id = $1`, [TASK]);
+  return rows[0]?.status;
+};
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); console.log(`  ok  ${msg}`); pass++; };
+
+try {
+  await cleanup();
+  await seed();
+  console.log(`blocker_hall_live_proof against ${base}${API_PREFIX} (task fixture #${TASK})`);
+
+  ok((await taskStatus()) === 'ready', 'BEFORE: the fixture task starts ready');
+
+  // Act 1 — file the blocker, through the route (any builder may file).
+  let r = await call('POST', '/blockers', {
+    title: 'blocker_hall_live_proof fixture blocker',
+    source: BLOCKER_SOURCE,
+    source_ref: BLOCKER_SOURCE_REF,
+  });
+  ok(r.status === 201 && r.body?.blocker?.id, 'POST /blockers files the blocker (201)');
+  const blockerId = r.body.blocker.id;
+
+  // Act 2 — link it to the task, through the route. This is what parks the
+  // task `blocked` — the state the resolve-side trigger has to release it from.
+  r = await call('POST', `/blockers/${blockerId}/link`, { task_id: TASK });
+  ok(r.status === 200 && r.body?.blocked === true, 'POST /blockers/:id/link blocks the task (200, blocked:true)');
+  ok((await taskStatus()) === 'blocked', 'the task is independently confirmed BLOCKED after the link');
+
+  // Act 3 — resolve it, through the route. THE PROOF: no code here ever issues
+  // `UPDATE tasks SET status = 'ready'` — only the DB trigger can move it.
+  r = await call('POST', `/blockers/${blockerId}/resolve`, { resolution_note: 'live proof' });
+  ok(r.status === 200, 'POST /blockers/:id/resolve succeeds (200)');
+  ok(Array.isArray(r.body?.promoted_tasks) && r.body.promoted_tasks.some((t) => Number(t.id) === TASK),
+    'the resolve response itself reports the task as promoted');
+
+  // Act 4 — THE independent proof: re-read straight from Postgres, off the
+  // route entirely. If the trigger never fired on this write path — wrong
+  // transaction, wrong connection, dropped migration — this is where it shows.
+  ok((await taskStatus()) === 'ready',
+    'AFTER: the linked task is independently confirmed READY — the DB trigger fired on the hall path');
+
+  console.log(`\nblocker_hall_live_proof (task 1003457): ${pass} assertions passed`);
+} catch (e) {
+  console.error('blocker_hall_live_proof.mjs FAILED:', e.stack || e.message);
+  process.exitCode = 1;
+} finally {
+  // A failed final cleanup can strand the fixture builder/session for the
+  // NEXT run — that is a real problem for this test, not a footnote, so it
+  // fails the run rather than only logging.
+  await cleanup().catch((e) => {
+    console.error('cleanup failed:', e.message);
+    process.exitCode = 1;
+  });
+  await new Promise((resolve) => server.close(resolve));
+  await pool.end().catch(() => {});
+}

package/tests/claim_gate_ci_unblock.mjs

@@ -0,0 +1,116 @@
+// tests/claim_gate_ci_unblock.mjs — the owed-rebase gate's one exemption (task 1004370).
+//
+// When main's CI goes red for a reason outside every branch, no confirmed task can
+// land, so ADR 0120 part 3's gate refuses the builder every new claim — including
+// the fix that would let their confirmed task land. A P1 kind=infra task (the shape
+// a CI-unblock is filed in) passes the gate; nothing else does.
+//
+// Two altitudes: the pure rule is RUN here, and the wiring into claimTask is driven
+// through the real function with a fake pool whose dispatch is exact per statement,
+// so a gate that stopped consulting the rule (or consulted it for the wrong task)
+// reds here without a Postgres. The real-DB proof is in tests/claim_gate_rebase.mjs.
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
+}
+
+const { isRebaseGateExempt } = require('../modules/lifecycle/db-claims.js');
+
+await t('a P1 infra task is exempt', () => {
+  assert.equal(isRebaseGateExempt({ kind: 'infra', priority: 1 }), true);
+});
+
+await t('the DB hands priority back as a string sometimes, and that still counts', () => {
+  assert.equal(isRebaseGateExempt({ kind: 'infra', priority: '1' }), true);
+});
+
+await t('both halves are required: infra at any other priority stays gated', () => {
+  for (const priority of [2, 3, 5, null, undefined]) {
+    assert.equal(isRebaseGateExempt({ kind: 'infra', priority }), false, `infra P${priority}`);
+  }
+});
+
+await t('both halves are required: a P1 of any other kind stays gated', () => {
+  for (const kind of ['bug', 'feature', 'refactor', 'decision', 'spike', null]) {
+    assert.equal(isRebaseGateExempt({ kind, priority: 1 }), false, `P1 ${kind}`);
+  }
+});
+
+await t('a missing task row is never exempt', () => {
+  assert.equal(isRebaseGateExempt(undefined), false);
+  assert.equal(isRebaseGateExempt(null), false);
+});
+
+// ---- the wiring: claimTask actually consults the rule ------------------------
+// The gate throws before claimTask reaches anything else, so the fake only has to
+// answer the queries up to that point. An unexpected statement throws, which is
+// what makes a green here mean the path really ran.
+const dbPath = require.resolve('../src/module-api.js');
+function fakeClientFor(task) {
+  const seen = [];
+  const client = {
+    seen,
+    async query(sql, params) {
+      const s = String(sql).replace(/\s+/g, ' ').trim();
+      seen.push(s);
+      if (s === 'BEGIN' || s === 'ROLLBACK' || s === 'COMMIT') return { rows: [] };
+      if (s.startsWith('SELECT status, rank FROM builders')) return { rows: [{ status: 'active', rank: 'archon' }] };
+      if (s.startsWith('SELECT id, title, needs_rebase_reason, needs_rebase_at FROM tasks WHERE needs_rebase = true')) {
+        return { rows: [{ id: '900', title: 'stalled', needs_rebase_reason: 'strand:pr_not_landed', needs_rebase_at: new Date() }] };
+      }
+      if (s === 'SELECT kind, priority FROM tasks WHERE id = $1') {
+        assert.equal(String(params[0]), '901', 'the rule is asked about the task being CLAIMED, not the stalled one');
+        return { rows: task ? [task] : [] };
+      }
+      // Past the gate: an exempt claim reaches the task read. Stop there, loudly
+      // and recognisably, so the test can tell "passed the gate" from any error.
+      if (s.startsWith('SELECT id, status, touches')) throw Object.assign(new Error('past the gate'), { code: 'PAST_GATE' });
+      throw new Error(`unexpected statement: ${s.slice(0, 120)}`);
+    },
+    release() {},
+  };
+  return client;
+}
+
+async function claimWith(task) {
+  const client = fakeClientFor(task);
+  const poolMod = require(dbPath);
+  const saved = poolMod.pool.connect;
+  poolMod.pool.connect = async () => client;
+  try {
+    const { claimTask } = require('../modules/lifecycle/db-claims.js');
+    await claimTask({ taskId: '901', builderId: '77', worktreeName: 'wt' });
+    return { client, err: null };
+  } catch (err) {
+    return { client, err };
+  } finally {
+    poolMod.pool.connect = saved;
+  }
+}
+
+await t('a gated builder claiming an ordinary task is refused REBASE_REQUIRED', async () => {
+  const { err } = await claimWith({ kind: 'feature', priority: 1 });
+  assert.equal(err && err.code, 'REBASE_REQUIRED');
+  assert.ok(err.rebaseTasks.some((r) => String(r.id) === '900'), 'and the refusal still names what is owed');
+});
+
+await t('a gated builder claiming a P1 infra task goes PAST the gate', async () => {
+  const { err, client } = await claimWith({ kind: 'infra', priority: 1 });
+  assert.equal(err && err.code, 'PAST_GATE', `expected to reach the task read, got ${err && (err.code || err.message)}`);
+  assert.ok(client.seen.includes('SELECT kind, priority FROM tasks WHERE id = $1'), 'the rule was consulted');
+});
+
+await t('a gated builder claiming a task that does not exist still meets the gate first', async () => {
+  const { err } = await claimWith(null);
+  assert.equal(err && err.code, 'REBASE_REQUIRED');
+});
+
+console.log(`\nclaim_gate_ci_unblock: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/claim_gate_rebase.mjs

@@ -30,13 +30,15 @@ const db = require('../modules/lifecycle/db.js');
 const VER = 'ZZZ-CG', WORKER = 90000201, STALLED = 90000201, FRESH = 90000202;
 // task 1003294 — the unprovable-strand cases below use their own rows.
 const AGED = 90000203, FRESH2 = 90000204, AGED_OTHER = 90000205;
+// task 1004370 — the CI-unblock exemption.
+const CIFIX = 90000206;
 const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
 
 async function cleanup() {
   await q(`DELETE FROM builder_achievements WHERE builder_id=$1`, [WORKER]).catch(() => {});
-  await q(`DELETE FROM credit_log WHERE builder_id=$1 OR task_id = ANY($2::bigint[])`, [WORKER, [STALLED, FRESH, AGED, FRESH2, AGED_OTHER]]).catch(() => {});
-  await q(`DELETE FROM claims WHERE task_id = ANY($1::bigint[])`, [[STALLED, FRESH, AGED, FRESH2, AGED_OTHER]]).catch(() => {});
-  await q(`DELETE FROM tasks WHERE id = ANY($1::bigint[])`, [[STALLED, FRESH, AGED, FRESH2, AGED_OTHER]]).catch(() => {});
+  await q(`DELETE FROM credit_log WHERE builder_id=$1 OR task_id = ANY($2::bigint[])`, [WORKER, [STALLED, FRESH, AGED, FRESH2, AGED_OTHER, CIFIX]]).catch(() => {});
+  await q(`DELETE FROM claims WHERE task_id = ANY($1::bigint[])`, [[STALLED, FRESH, AGED, FRESH2, AGED_OTHER, CIFIX]]).catch(() => {});
+  await q(`DELETE FROM tasks WHERE id = ANY($1::bigint[])`, [[STALLED, FRESH, AGED, FRESH2, AGED_OTHER, CIFIX]]).catch(() => {});
   await q(`DELETE FROM builders WHERE id=$1`, [WORKER]).catch(() => {});
   await q(`DELETE FROM versions WHERE id=$1`, [VER]).catch(() => {});
 }
@@ -139,6 +141,16 @@ try {
   ok(threw2 && threw2.code === 'REBASE_REQUIRED',
     'an aged pr_not_landed strand still gates — the builder CAN fix that one');
 
+  // 7) task 1004370 — the one task the gate lets through: a P1 kind=infra fix,
+  //    the shape a CI-unblock is filed in. With AGED_OTHER still gating, claiming
+  //    it succeeds; FRESH2 (a P1 feature) was refused in 6), so both halves count.
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,priority) VALUES ($1,$2,'ci fix','ready',10,'infra',1)`, [CIFIX, VER]);
+  const ciClaim = await db.claimTask({ taskId: String(CIFIX), builderId: String(WORKER), worktreeName: 'cg-cifix' });
+  ok(ciClaim && Number(ciClaim.task_id) === CIFIX,
+    'a P1 infra task is claimable while a rebase is owed — the CI-unblock fix is never gated out');
+  ok((await db.needsRebaseTasksForBuilder(String(WORKER))).some((t) => Number(t.id) === AGED_OTHER),
+    'and the owed rebase is still reported: the exemption lets one claim through, it clears nothing');
+
   console.log(`\nclaim_gate_rebase (ADR 0120 part 3): ${pass} passed, 0 failed`);
 } catch (e) {
   console.error('claim_gate_rebase.mjs FAILED:', e.stack || e.message);

package/tests/collab_page.mjs

@@ -590,6 +590,16 @@ test('an ask can be answered — and the answer surface stops well short of a ch
   assert.ok(!/parent_reply|data-reply-to|@mention|mentions/i.test(js), 'no nesting and no mentions');
 });
 
+// Task 1004234: the reply box once hinted with a leftover reply from one
+// thread, which every reader took for a real message about something they had
+// never heard of. The hint says what the box is for, and nothing more.
+test('the reply box hint is neutral, not a stray reply from some thread', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  const m = js.match(/class="cb-reply-input"[^>]*placeholder="([^"]*)"/);
+  assert.ok(m, 'the reply box carries a placeholder');
+  assert.equal(m[1], 'Write a reply…');
+});
+
 // RUN, not grepped — this file's own convention for everything in collab-lib.js,
 // and the grader was right that the first pass broke it. canClose in particular
 // decides whether a close control is drawn at all, so each branch of it needs a

package/tests/conductor_main_e2e.mjs

@@ -0,0 +1,97 @@
+// tests/conductor_main_e2e.mjs — the Conductor hook, run END TO END as
+// settings.json runs it (task 1004398).
+//
+// Every other Conductor test drives evaluateTriggers() with hand-built inputs.
+// That is how task 1003855 shipped a main() that passed an undeclared
+// `specialities` into it: the hook threw ReferenceError on every prompt,
+// `main().catch(() => {})` swallowed it, and for thirteen days no session got
+// its interaction profile, its focus contract, the no-claim warning or the
+// Hacker dispatch — with every Conductor test green. This file runs the real
+// hook as a child process against a stub GET /me, so a crash anywhere between
+// the fetch and the render shows up as missing output.
+//
+// Run:  node tests/conductor_main_e2e.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawn } from 'node:child_process';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HOOK = path.join(ROOT, '.claude', 'hooks', 'conductor.js');
+const ic = require('../src/instance-config.js');
+const { test, summary } = makeRunner();
+
+const INTERACTION = 'PROFILE-CONTRACT: pitch replies for a non-technical reader.';
+const SPECIALITY = 'SPECIALITY-CONTRACT: the engineer expert contract.';
+const ARTIST_SPECIALITY = 'ARTIST-CONTRACT: must not appear in an engineering session.';
+
+// The /me payload the hook consumes, in the route's own shape.
+function mePayload({ discipline = 'engineer' } = {}) {
+  return {
+    builder: { id: 4242, rank: 'metic' },
+    active_claims: [{ task_id: 77, title: 'a claimed task', touches: [], worktree_name: 'task-77', discipline }],
+    wandering: { effective_level: 'normal', inject: false, contract: '' },
+    interaction: { inject: true, contract: INTERACTION },
+    specialities: [
+      { discipline: 'engineer', inject: true, contract: SPECIALITY },
+      { discipline: 'artist', inject: true, contract: ARTIST_SPECIALITY },
+    ],
+  };
+}
+
+// Run the hook once in a throwaway HOME whose session points at `base`.
+async function runHook(me) {
+  const server = http.createServer((req, res) => {
+    if (req.url.startsWith('/api/bongos/me')) { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(me)); return; }
+    res.writeHead(404); res.end('{}');
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'conductor-e2e-'));
+  // The session lives where the CLI looks for it, re-rooted under the fake home.
+  const rel = path.relative(os.homedir(), ic.configPath('gds-session.json'));
+  const sessionPath = path.join(home, rel);
+  fs.mkdirSync(path.dirname(sessionPath), { recursive: true });
+  fs.writeFileSync(sessionPath, JSON.stringify({ token: 'test-token', api_base: base, builder: { id: 4242 } }));
+  const env = { ...process.env, HOME: home, USERPROFILE: home };
+  for (const k of Object.keys(env)) if (/_API_BASE$/.test(k) || k === 'OTB_CONDUCTOR_OFF' || k === 'OTB_SUBAGENT') delete env[k];
+  try {
+    const child = spawn(process.execPath, [HOOK], { env, cwd: home, stdio: ['pipe', 'pipe', 'pipe'] });
+    let out = ''; let err = '';
+    child.stdout.on('data', (d) => { out += d; });
+    child.stderr.on('data', (d) => { err += d; });
+    child.stdin.end(JSON.stringify({ session_id: 'e2e-' + Date.now(), prompt: 'hello', cwd: home }));
+    const code = await new Promise((r) => child.on('close', r));
+    return { out, err, code };
+  } finally {
+    await new Promise((r) => server.close(r));
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+await test('the hook, run as settings.json runs it, injects the interaction profile (task 1004398)', async () => {
+  const r = await runHook(mePayload());
+  assert.equal(r.code, 0, 'the hook never fails the prompt');
+  assert.ok(r.out.includes(INTERACTION), `the interaction contract reaches the session; stdout was: ${JSON.stringify(r.out.slice(0, 300))}`);
+});
+
+await test('the speciality contract for the CLAIMED craft reaches the session, and no other craft\'s', async () => {
+  const r = await runHook(mePayload({ discipline: 'engineer' }));
+  assert.ok(r.out.includes(SPECIALITY), 'the engineer speciality is injected for an engineering claim');
+  assert.ok(!r.out.includes(ARTIST_SPECIALITY), 'the artist contract is not');
+});
+
+await test('with an artist claim, the artist contract is the one injected', async () => {
+  const r = await runHook(mePayload({ discipline: 'artist' }));
+  assert.ok(r.out.includes(ARTIST_SPECIALITY));
+  assert.ok(!r.out.includes(SPECIALITY));
+});
+
+summary();