@bongos/core 1.19.1081 → 1.20.2

package/src/platform-server.js

@@ -57,6 +57,7 @@ const { isModuleEnabled } = require('./modules');
 const { refreshOverrides } = require('./bongos/module-overrides');
 const { schemaPending } = require('./bongos/schema-lag');
 const { logger, requestIdMiddleware } = require('./bongos/logger');
+const seams = require('./module-seams');
 
 const PORT = Number(process.env.PORT) || 3000;
 const HOST = process.env.HOST || '127.0.0.1';
@@ -199,6 +200,32 @@ function buildPlatformApp() {
   // same reqId. Mounted before any surface so nothing logs uncorrelated.
   app.use(requestIdMiddleware);
 
+  // THE request.divert SEAM (task 1004300, ADR 0349). A module may register a provider that
+  // takes a request BEFORE any surface answers and either handles it or passes it on —
+  // today the npm-release module's version preview, which hands a browser holding its
+  // cookie to a second process. The provider is looked up on EVERY request, not once at
+  // build: modules mount inside mountInternalSurfaces below, after this line runs, so a
+  // lookup here at build time would always find nothing.
+  //
+  // WITH NO PROVIDER THIS IS ONE MAP LOOKUP AND next(): an instance that does not have such
+  // a module is served exactly as it was. A provider that throws is treated as absent for
+  // that request, never as a failed request — a broken preview must not take the live hall
+  // down with it — unless it had already started answering.
+  app.use((req, res, next) => {
+    const divert = seams.resolveOptional('request.divert');
+    if (!divert) return next();
+    let passed = false;
+    const pass = (e) => { passed = true; next(e); };
+    Promise.resolve()
+      .then(() => divert(req, res, pass))
+      .catch((err) => {
+        logger.error({ err }, 'request.divert provider failed — serving the request normally');
+        if (passed) return;
+        if (res.headersSent) { res.destroy(); return; }
+        pass();
+      });
+  });
+
   // The whole internal surface — shared verbatim with server.js (ADR 0062 R51).
   mountInternalSurfaces(app);
 
@@ -266,6 +293,18 @@ function buildPlatformApp() {
       res.type('html').send(html);
     });
   }
+  // THE ACCOUNT PAGE (task 1004259, ADR 0337 D4.3): where a person edits what
+  // belongs to their platform account rather than to one project — handle, name,
+  // bio, links, and who can find them. Hub-only, unlike the doors above: every
+  // read and write it makes is a platform-identity route, and that module IS the
+  // hub flag (the stripApexOnly note above), so a child instance serves no such
+  // page rather than one whose every request 404s.
+  app.get('/account', (req, res, next) => {
+    if (!isApexHost(req) || !isModuleEnabled('platform-identity')) return next();
+    const html = landingPage('account.html');
+    if (!html) return next();
+    res.type('html').send(html);
+  });
   // Assets fall through to the 404 tail when no module claims the apex root — the
   // handler is not mounted at all rather than pointed at a missing directory.
   const landingAssets = landingDir() && express.static(landingDir(), { index: false, fallthrough: true });

package/tests/account_privacy_flags.mjs

@@ -335,9 +335,13 @@ const GRANT_WORDS = {
   active_recently: /active in the last 30 days/,
 };
 
+// The toggles live on the hub's account page since task 1004259 (ADR 0337 D4.3) —
+// one inline-script page, so the copy and the markup are read from the same file.
+const ACCOUNT_PAGE = join(ROOT, 'modules/public-landing/public/account.html');
+
 test('the discoverable toggle names EXACTLY what it grants — checked against SLIVER_KEYS itself', () => {
-  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
-  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  const js = readFileSync(ACCOUNT_PAGE, 'utf8');
+  const html = js;
   // Privacy spec D3 makes this a MUST: "The discoverable toggle's settings copy
   // must state exactly this grant." It was checked against three transcribed
   // phrases, and the transcription had gone stale in the direction that matters:
@@ -363,13 +367,13 @@ test('the discoverable toggle names EXACTLY what it grants — checked against S
     'and the copy says what it does NOT grant');
   assert.match(js, /the one thing a recruiter can see while your profile page is private/,
     'a private account is told the sliver is the exception to "not found to every visitor" — the surprising half of D2/D3');
-  assert.match(html, /<section[^>]*id="privacy-scroll"[^>]*hidden>/,
-    'the section ships hidden — it reveals only where the hub module answers');
+  assert.match(html, /<div id="acctBody" hidden>/,
+    'the controls ship hidden — they reveal only once the hub module answers for this account');
 });
 
 test('each toggle claims exactly what is enforced — and BOTH are now in force', () => {
-  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
-  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  const js = readFileSync(ACCOUNT_PAGE, 'utf8');
+  const html = js;
   // A toggle may promise only what a read path actually enforces. The two rows
   // reached that point one task apart. Task 1002967 wired VISIBILITY into every
   // public read, so its row moved to the present tense — and it must also say

package/tests/agents_authoring.mjs

@@ -113,8 +113,10 @@ t('FAIL-CLOSED: a throwing matcher is a hit, and only an explicit false clears a
 
 t('this wall is STRICTER than the validator, which is the point', () => {
   // An Archon clears validate.js's Metic+ rank floor on a protected scope...
+  // Through mergeForValidation, as the PATCH route does: the validator refuses
+  // a stored row's server-owned columns as unknown fields (task 1004007).
   const verdict = validate.validateAgentDefinition(
-    { ...DB_ROW, scope_modules: ['government'] },
+    authoring.mergeForValidation(DB_ROW, { scope_modules: ['government'] }),
     { authorRank: 'archon', allowedModules: ['government'], protectedModules: PROTECTED_MODULES, isProtectedPath: () => false },
   );
   assert.equal(verdict.ok, true, 'the rank floor admits an Archon');
@@ -126,6 +128,18 @@ t('this wall is STRICTER than the validator, which is the point', () => {
   );
 });
 
+t('the fields the routes let through are exactly the fields the validator accepts (task 1004007)', () => {
+  // The validator refuses any key outside its list; the routes project onto
+  // AUTHORABLE_FIELDS. If the two drift, either an authorable field is refused
+  // on every write, or the validator's list names something no route can set.
+  const v = validate.validateAgentDefinition(
+    authoring.mergeForValidation(DB_ROW, {}),
+    { authorRank: 'metic', allowedModules: [], protectedModules: [] },
+  );
+  assert.equal(v.ok, true, JSON.stringify(v.errors));
+  assert.deepEqual([...Object.keys(v.value)].sort(), [...authoring.AUTHORABLE_FIELDS].sort());
+});
+
 console.log('\nrule 4 — the sync owns its own rows:');
 
 t('a file-sourced definition is not editable here, and the reason names the file', () => {

package/tests/agents_sync.mjs

@@ -140,12 +140,22 @@ t('a file claiming author_rank cannot promote itself', () => {
   const p = sync.planOne(claiming, {
     authorRank: 'xenos', allowedModules: ['government'], protectedModules: ['government'],
   });
-  assert.equal(p.action, 'flagged', 'the declared rank did not open the protected scope');
+  // Since task 1004007 the file is not even imported: author_rank is not a field
+  // of a definition, so the validator refuses it BY NAME rather than dropping it.
+  // That is a stronger form of this rule than the flagged import it used to be.
+  assert.equal(p.action, 'skip', 'a file claiming author_rank is refused, not imported');
+  assert.match(p.reason, /author_rank/);
   // NULL, not 'xenos': this definition reaches a protected module, so no
-  // git-derived rank is stamped at all (stampableAuthorRank). The file's claim
-  // loses, and so does the spoofable git value — both by the same rule.
-  assert.equal(p.authorRank, null, 'nothing git-derived is stamped on a protected-scope row');
-  assert.match(p.scopeViolation, /metic\+ author/i);
+  // git-derived rank is stamped at all (stampableAuthorRank).
+  assert.equal(p.authorRank ?? null, null, 'nothing git-derived is stamped on a protected-scope row');
+  // And without the claim, the same scope still imports only flagged: the
+  // protected wall is what holds, not the refusal above.
+  const plain = sync.planOne(
+    sync.parseAgentFile('---\nname: x\ntrigger: on-demand\nscope_modules: [government]\n---\nbody', {}),
+    { authorRank: 'xenos', allowedModules: ['government'], protectedModules: ['government'] },
+  );
+  assert.equal(plain.action, 'flagged');
+  assert.match(plain.scopeViolation, /metic\+ author/i);
 });
 
 t('THE ESCALATION PATH: a spoofed git identity cannot arm a protected scope', () => {
@@ -447,5 +457,96 @@ t('migrate.sh invokes agents-sync, module-gated and fail-open', () => {
   assert.doesNotMatch(call.slice(0, 200), /exit 1/, 'no exit 1 on the agents-sync path');
 });
 
+// ---- task 1004007: a file-declared filter and sink SURVIVE the round trip ----
+//
+// Tested at the round-trip altitude on purpose: file text in, the VALIDATOR's
+// normalized row out, and then the event router's own reading of that row. A
+// test over parseAgentFile alone stayed green through the whole bug, because
+// the parser kept `touches` — it was the validator that dropped it.
+{
+  const router = require('../modules/agents/pollers/event-router.js');
+  const compile = (globs) => (file) => globs.some((g) => file.startsWith(g.replace(/\*\*.*$/, '')));
+  const roundTrip = (text, name = 'review-lens') => validate.validateAgentDefinition(
+    sync.parseAgentFile(text, { name }),
+    { authorRank: 'archon', allowedModules: [], protectedModules: [], isProtectedPath: () => false },
+  );
+  const LINES = [
+    '---', 'title: Review lens', 'trigger: event', 'event: task.shipped',
+    'touches:', '  - docs/**', '  - modules/hall-ui/**', 'sink: discord', '---',
+    'You review what shipped.', '',
+  ];
+  const FILE = LINES.join('\n');
+  const without = (...drop) => LINES.filter((l) => !drop.includes(l)).join('\n');
+
+  t('a file-declared touches[] filter reaches trigger_spec and the router reads it (task 1004007)', () => {
+    const v = roundTrip(FILE);
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.deepEqual(v.value.trigger_spec.touches, ['docs/**', 'modules/hall-ui/**']);
+    assert.deepEqual(router.declaredGlobs(v.value), ['docs/**', 'modules/hall-ui/**']);
+    // The point: a ship that touched nothing in scope must NOT fire.
+    assert.equal(router.matchesTouches(v.value, ['src/bongos/db.js'], compile).match, false);
+    assert.equal(router.matchesTouches(v.value, ['docs/voice.md'], compile).match, true);
+  });
+
+  t('a file-declared sink reaches trigger_spec and the router routes to it (task 1004007)', () => {
+    const v = roundTrip(FILE);
+    assert.equal(v.value.trigger_spec.sink, 'discord');
+    assert.equal(router.sinkNameFor(v.value), 'discord');
+  });
+
+  t('touches_globs is the same filter as touches (the router reads both spellings)', () => {
+    const v = roundTrip(FILE.replace('touches:', 'touches_globs:'));
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.deepEqual(router.declaredGlobs(v.value), ['docs/**', 'modules/hall-ui/**']);
+  });
+
+  t('a file-declared cadence reaches trigger_spec, so a cron agent can be written as a file', () => {
+    const v = roundTrip(['---', 'trigger: cron', 'cadence: daily', '---', 'A digest.'].join('\n'), 'digest');
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.equal(v.value.trigger_spec.cadence, 'daily');
+  });
+
+  t('a definition with no filter still means every ship: the default is unchanged', () => {
+    const v = roundTrip(without('touches:', '  - docs/**', '  - modules/hall-ui/**'));
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.equal(v.value.trigger_spec.touches, undefined);
+    assert.equal(router.matchesTouches(v.value, ['src/bongos/db.js'], compile).reason, 'no_filter_declared');
+  });
+
+  t('a malformed filter is REFUSED, never widened silently to fire on every ship', () => {
+    // A scalar is what "touches: docs/**" parses to. The router treats a non-list
+    // as ABSENT, i.e. every ship, so it has to be caught at authoring time.
+    const text = without('  - docs/**', '  - modules/hall-ui/**').replace('touches:', 'touches: docs/**');
+    const v = roundTrip(text);
+    assert.equal(v.ok, false);
+    assert.ok(v.errors.some((e) => e.code === 'trigger_touches_invalid'), JSON.stringify(v.errors));
+  });
+
+  t('an unknown top-level key is refused, not dropped: a typo is an error, not a default', () => {
+    const v = roundTrip(FILE.replace('sink: discord', 'sink: discord\ntouchess: [docs/**]'));
+    assert.equal(v.ok, false);
+    const e = v.errors.find((x) => x.code === 'unknown_field');
+    assert.ok(e, JSON.stringify(v.errors));
+    assert.match(e.message, /touchess/);
+    // and the exact probe from the task: a top-level touches on a row handed to
+    // the validator directly no longer returns ok with the filter gone.
+    const direct = validate.validateAgentDefinition(
+      { name: 'x', persona: 'p', trigger_type: 'event', trigger_spec: { event: 'task.shipped' }, touches: ['src/**'] },
+      { authorRank: 'archon', allowedModules: [], protectedModules: [] },
+    );
+    assert.equal(direct.ok, false, 'a touches that lands nowhere must not pass silently');
+  });
+
+  t('every agent file this repo ships still validates under the stricter check', () => {
+    const dir = path.join(process.cwd(), '.claude', 'agents');
+    const files = fs.readdirSync(dir).filter((x) => x.endsWith('.md'));
+    assert.ok(files.length >= 3, 'expected the shipped agent files');
+    for (const x of files) {
+      const v = roundTrip(fs.readFileSync(path.join(dir, x), 'utf8'), x.replace(/\.md$/, ''));
+      assert.equal(v.ok, true, x + ': ' + JSON.stringify(v.errors));
+    }
+  });
+}
+
 console.log(`\nagents_sync: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/agents_validate.mjs

@@ -477,6 +477,51 @@ await test('a hostile getter cannot escape the validator', () => {
   assert.equal(r.ok, false);
 });
 
+await test('an unknown top-level key is refused by name, not dropped (task 1004007)', () => {
+  // The validator's normalized row names a fixed set of fields, so an extra key
+  // used to pass with ok:true and vanish, which is how a file's top-level
+  // touches: filter became "fires on every ship".
+  const r = validateAgentDefinition(
+    { name: 'historian', persona: 'x', trigger_type: 'event', trigger_spec: { event: 'task.shipped' }, touches: ['src/**'] },
+    OPTS,
+  );
+  assert.equal(r.ok, false);
+  const e = r.errors.find((x) => x.code === 'unknown_field');
+  assert.ok(e, JSON.stringify(codes(r)));
+  assert.equal(e.field, 'touches');
+  assert.equal(r.value, null);
+});
+
+await test('a malformed touches filter is refused, because the router reads it as "every ship" (task 1004007)', () => {
+  for (const bad of ['docs/**', [], [''], [3], { a: 1 }]) {
+    const r = validateAgentDefinition(
+      { name: 'historian', persona: 'x', trigger_type: 'event', trigger_spec: { event: 'task.shipped', touches: bad } },
+      OPTS,
+    );
+    assert.equal(r.ok, false, JSON.stringify(bad));
+    assert.ok(codes(r).includes('trigger_touches_invalid'), JSON.stringify(bad) + ' ' + JSON.stringify(codes(r)));
+  }
+  const good = validateAgentDefinition(
+    { name: 'historian', persona: 'x', trigger_type: 'event', trigger_spec: { event: 'task.shipped', touches_globs: ['docs/**'] } },
+    OPTS,
+  );
+  assert.equal(good.ok, true, JSON.stringify(codes(good)));
+});
+
+await test('a Proxy whose ownKeys trap throws cannot escape the validator (task 1004007)', () => {
+  // The unknown-field check is the one place the validator enumerates the
+  // definition, so it is the one place a throwing ownKeys trap could escape.
+  const hostile = new Proxy(
+    { name: 'historian', persona: 'x', trigger_type: 'on-demand' },
+    { ownKeys() { throw new Error('boom'); } },
+  );
+  let r;
+  assert.doesNotThrow(() => { r = validateAgentDefinition(hostile, OPTS); });
+  assert.equal(r.ok, false);
+  assert.ok(codes(r).includes('keys_unreadable'), JSON.stringify(codes(r)));
+  assert.equal(r.value, null);
+});
+
 await test('EVERY error carries a code, a field and a human message', () => {
   const r = validateAgentDefinition(
     { name: 'BAD NAME', trigger_type: 'webhook', trigger_spec: 'nope', scope_modules: ['government'] },

package/tests/api_path_404.mjs

@@ -172,5 +172,11 @@ t('rebaseRequiredHint: still leads with /strand-fix — merge is the manual fall
     'the command that works on any machine must still come first (task 1003768)');
 });
 
+// task 1004370: when main's CI is red for a reason outside every branch, the gated
+// builder must learn from the refusal itself that the fix is still claimable.
+t('rebaseRequiredHint: names the CI-unblock exit the gate lets through', () => {
+  assert.match(rebaseRequiredHint([{ id: 7 }]), /P1 kind=infra task passes this gate/);
+});
+
 console.log(`\napi_path_404: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/autobongos_cadence.mjs

@@ -270,6 +270,13 @@ function loopHarness({ rows, maxLoops = 6 }) {
     // network call is not a unit suite, it is a flake waiting for a slow day.
     writeHeartbeat: () => true,
     postHeartbeat: async () => true,
+    // These tests drive the BACKOFF LADDER, not the upgrade path (task 1004374).
+    // forever() checks for code drift once a loop, and the generic run() stub
+    // above answers rev-parse and ls-remote with different output — which reads
+    // as "main moved" and exits the loop before it can ever reach probing.
+    // Declaring no drift keeps each test about the one thing it is testing;
+    // tests/autobongos_loop.mjs covers the drift exit itself.
+    codeDrifted: async () => false,
   };
   return { deps, waits: emitted, recorded, opts: { goals: [], maxTasks: 3, maxLoops } };
 }

package/tests/autobongos_loop.mjs

@@ -664,7 +664,7 @@ test('workerEnv passes Claude auth through, and still refuses the rest', () => {
 // cap has to work, and it has to survive a restart: the count comes from the
 // run log, not from memory.
 
-import { mkdtempSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, writeFileSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -768,3 +768,138 @@ test('countWorkedSince stops at the first row older than the mark', () => {
   assert.equal(runner.countWorkedSince(8000), 1);
   delete process.env.AUTOBONGOS_LOG_FILE;
 });
+
+// --- a --forever runner must be able to take a fix (task 1004374) -----------
+//
+// autobongos-service.cmd refreshes the checkout only BEFORE launching node, and
+// --forever never returns (task 1003904). Together: a process never re-reads its
+// code, a shipped fix never reaches the runner, and nothing restarts it. On the
+// host this ran week-old code for four days across three landed fixes while the
+// heartbeat reported it alive and the hall showed a healthy runner.
+
+test('codeDrifted reports a drift when main has moved past the loaded head', async () => {
+  const calls = [];
+  const run = async (bin, args) => {
+    calls.push(args.join(' '));
+    if (args[0] === 'rev-parse') return { ok: true, stdout: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n' };
+    return { ok: true, stdout: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\trefs/heads/main\n' };
+  };
+  const d = await runner.codeDrifted({ run });
+  assert.ok(d, 'a moved main is a drift');
+  assert.equal(d.from, 'aaaaaaaa');
+  assert.equal(d.to, 'bbbbbbbb');
+});
+
+test('codeDrifted is false when the loaded head IS the tip', async () => {
+  const loadedHead = async () => 'cccccccccccccccccccccccccccccccccccccccc';
+  const run = async (bin, args) => (args[0] === 'rev-parse'
+    ? { ok: true, stdout: 'cccccccccccccccccccccccccccccccccccccccc\n' }
+    : { ok: true, stdout: 'cccccccccccccccccccccccccccccccccccccccc\trefs/heads/main\n' });
+  assert.equal(await runner.codeDrifted({ run, loadedHead }), false);
+});
+
+test('codeDrifted returns null when the LOCAL head cannot be read', async () => {
+  // Injected rather than stubbed through run(): loadedHead caches into a
+  // module-level, and an earlier test in this file already populated it — so a
+  // run() stub that fails rev-parse is never consulted, and the case passes for
+  // an unrelated reason. That is exactly what the first cut of this test did.
+  const okTip = async () => ({ ok: true, stdout: 'dddddddddddddddddddddddddddddddddddddddd refs/heads/main' });
+  assert.equal(await runner.codeDrifted({ loadedHead: async () => null, run: okTip }), null,
+    'no local head means we cannot tell, and cannot-tell must never cycle the runner');
+});
+
+test('codeDrifted returns null when ORIGIN cannot be reached', async () => {
+  assert.equal(await runner.codeDrifted({ loadedHead: async () => 'eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee', run: async () => ({ ok: false }) }), null);
+});
+
+test('codeDrifted returns null when the git call throws outright', async () => {
+  const thrown = async () => { throw new Error('no network'); };
+  assert.equal(await runner.codeDrifted({ loadedHead: async () => 'eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee', run: thrown }), null);
+});
+
+test('forever EXITS with the upgrade code on drift, and logs why', async () => {
+  const rows = [];
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 3 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => { rows.push(r); return r; },
+    now: () => Date.now() + runner.MIN_UPTIME_BEFORE_UPGRADE_MS + 1000,
+    codeDrifted: async () => ({ from: '1111aaaa', to: '2222bbbb' }),
+  });
+  assert.equal(code, runner.UPGRADE_EXIT_CODE, 'the wrapper loops on exactly this code');
+  const exit = rows.find((r) => r.event === 'upgrade_exit');
+  assert.ok(exit, 'a silent exit is the failure mode task 1003904 forbids — it must say why');
+  assert.match(exit.reason, /main moved from 1111aaaa to 2222bbbb/);
+});
+
+test('forever does NOT exit while the code is current', async () => {
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => r,
+    codeDrifted: async () => false,
+  });
+  assert.equal(code, 0, 'the no-terminal-stop rule still holds for every other case');
+});
+
+test('the wrapper loops on the upgrade code and only on that code', () => {
+  const raw = readFileSync(new URL('../scripts/gds/autobongos-service.cmd', import.meta.url), 'utf8');
+  // LIVE lines only, and no regex here on purpose. A first cut of this test
+  // matched the raw file text and passed happily against a commented-out
+  // "REM goto run" — which is precisely the regression it exists to catch.
+  const live = raw
+    .split('\n')
+    .map((l) => l.replace('\r', '').trim())
+    .filter((l) => l && !l.toUpperCase().startsWith('REM ') && !l.startsWith('::'));
+  const joined = live.join('\n');
+  assert.ok(live.includes(':run'), 'there must be a live label to go back to');
+  assert.ok(live.some((l) => l.startsWith('if "%EXITCODE%"=="75"')), 'and a live branch on the upgrade code');
+  assert.ok(live.includes('goto run'), 'and a live relaunch, not a commented-out one');
+  // Ordering: the relaunch must precede the final exit, or it can never run.
+  assert.ok(joined.indexOf('goto run') < joined.indexOf('exit /b %EXITCODE%'));
+  // And the refresh must sit INSIDE the loop, or a relaunch re-runs the old code,
+  // which is the entire bug.
+  assert.ok(joined.indexOf(':run') < joined.indexOf('git reset --quiet --hard origin/main'));
+});
+
+test('a runner that just started will NOT upgrade-exit, so a failed fetch cannot spin', async () => {
+  // The wrapper's reset is best-effort by design. Without this guard, starting
+  // behind means: see drift, exit, relaunch into the same state, forever.
+  let askedForDrift = false;
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => r,
+    now: () => Date.now(),   // uptime is ~0, well under the floor
+    codeDrifted: async () => { askedForDrift = true; return { from: 'aaaa1111', to: 'bbbb2222' }; },
+  });
+  assert.equal(code, 0, 'it must keep running rather than bounce');
+  assert.equal(askedForDrift, false, 'and not even ask — the check costs a network call');
+});
+
+test('past the uptime floor, a drift still exits', async () => {
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => r,
+    now: () => Date.now() + runner.MIN_UPTIME_BEFORE_UPGRADE_MS + 1000,
+    codeDrifted: async () => ({ from: 'aaaa1111', to: 'bbbb2222' }),
+  });
+  assert.equal(code, runner.UPGRADE_EXIT_CODE);
+});

package/tests/autonomy_gauge.mjs

@@ -398,3 +398,65 @@ test('a derived seven-day window is NOT paced against a boundary we invented', (
   assert.equal(d.derived, true);
   assert.equal(d.go, true);
 });
+
+// --- a derived mark must be in the CURRENT window (task 1004376) ------------
+//
+// Regression from the 1004178 fix, found on the host the moment the runner was
+// restarted onto it. derivedSince reported the RETIRED reading's resets_at,
+// which on an unattended host is days old — so the caller's cap counted work
+// done days earlier, arrived pre-exhausted, and the runner held forever having
+// correctly derived headroom. Exactly the state 1004178 existed to end.
+
+test('a week-old retired reading yields a mark inside the CURRENT window', () => {
+  const now = 10_000_000;
+  const weekAgoReset = now - 7 * 24 * HOUR;          // the retired boundary
+  const d = decideCapacity({
+    gauge: {
+      written_at: weekAgoReset - HOUR,
+      five_hour: { used_percentage: 90, resets_at: weekAgoReset, observed_at: weekAgoReset - HOUR },
+    },
+    now,
+  });
+  assert.equal(d.derived, true);
+  assert.notEqual(d.derivedSince, weekAgoReset, 'the retired boundary is exactly what must NOT come back');
+  assert.ok(now - d.derivedSince < 5 * HOUR, 'the mark must sit inside the current five-hour window');
+  assert.ok(d.derivedSince <= now, 'and never in the future');
+});
+
+test('the advanced mark lands on a whole number of periods from the observed one', () => {
+  const now = 10_000_000;
+  const reset = now - (3 * 5 * HOUR) - HOUR;   // three full windows, plus an hour
+  const d = decideCapacity({
+    gauge: { written_at: reset - 60, five_hour: { used_percentage: 80, resets_at: reset, observed_at: reset - 60 } },
+    now,
+  });
+  assert.equal(d.derivedSince, reset + 3 * 5 * HOUR, 'stepped forward by whole periods, not guessed');
+});
+
+test('derivedSince takes the MOST RECENT boundary when both windows derive', () => {
+  const now = 10_000_000;
+  const d = decideCapacity({
+    gauge: {
+      written_at: now - 8 * 24 * HOUR,
+      five_hour: { used_percentage: 50, resets_at: now - 6 * HOUR, observed_at: now - 8 * 24 * HOUR },
+      seven_day: { used_percentage: 50, resets_at: now - 8 * 24 * HOUR, observed_at: now - 8 * 24 * HOUR },
+    },
+    now,
+  });
+  assert.equal(d.derived, true);
+  assert.ok(now - d.derivedSince < 5 * HOUR,
+    'the seven-day boundary would make the cap a one-time budget that never refills');
+});
+
+test('a reading whose window is still running is unaffected by the advance', () => {
+  const now = 10_000_000;
+  const d = decideCapacity({
+    gauge: {
+      written_at: now - 10 * HOUR,
+      five_hour: { used_percentage: 92, resets_at: now + HOUR, observed_at: now - 10 * HOUR },
+    },
+    now,
+  });
+  assert.equal(d.go, false, 'still unknown — usage only grows inside a live window');
+  assert.equal(d.unknown, true);
+});