@bongos/core 1.19.27 → 1.19.29

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.27",
-  "core_contract": "1.19.27",
-  "source_commit": "a8f09266a4b9cdbdf70ea92de3c2a26553aacab2",
+  "core_version": "1.19.29",
+  "core_contract": "1.19.29",
+  "source_commit": "653afa8efb0b5167d51ed1510c45977a56a575dd",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T13:38:48.421Z",
+  "built_at": "2026-08-11T14:19:03.503Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1511,
-  "tree_sha256": "b85699092f300b5bab1ab32e95763e4f032d2ee8f688466f4c4dc939048174bd",
+  "tree_sha256": "0076ae91d3bb7f715ca250d05367d1eae9a660b5c015b88c0a6687d7a01a9794",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2882,7 +2882,7 @@
     {
       "path": "modules/grading/grader.js",
       "mode": "0000644",
-      "sha256": "bc2b580d2be98f5b2acb9a0dd9416dd3c2cad387bbe61a6823e37102d3468675"
+      "sha256": "3461862dc1af26875958697291128fbf4d914fff9b00b7920e5f25dae73f6ba4"
     },
     {
       "path": "modules/grading/module.json",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "c8f356746096a6fe39e456b12367d29b6bbf4e39df1515c09144c95e239f1b49"
+      "sha256": "60b9338ed47d01e9f38fe3fa9f2f2cde6ff241b8e47efcb8fcf4c4f19d32c766"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a32cc5b3e33b39013ebe6508049b2ce0dac4c6ac8edce2adf396af265a0c4df8"
+      "sha256": "7a14171b353dbfb6da83df462c031ecce9d4c97b085504845035072e5e97bbfa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "aea4f2f3266f8107e00346fb410bb214997bc0cda76e7ecba36b7f2210b9b661"
+      "sha256": "3ff6057a4a6120421ce79d9593bdf54e424fdd143bd0a20fc616ba92582ee910"
     },
     {
       "path": "public-docs/index.html",
@@ -5042,7 +5042,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "85712b5cd1e20a2d84646b117cbaadf0ee4903f278ca904eb863da4612ee937b"
+      "sha256": "7f0ad4e54c0e5c251f00c78c7a6065d4a8db7bc88f0492c75bc63f8929108203"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f75a298d5c776e9bb7ba33c75061ca193c73b0004eea7c0f6706f02b8daad0f0"
+      "sha256": "576d6afdcdf097366f36831d4b56ba300f71beefdc29c853605f9c0788cd260c"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6357,7 +6357,7 @@
     {
       "path": "tests/gate_approvals.mjs",
       "mode": "0000644",
-      "sha256": "900923ab39dee11de4c59ec977555346aa52ba875d12e2b4ca27013bf99e51c2"
+      "sha256": "df503f198853f6fe3497a2e0317d90bee69cc275f024027ad569ee1cef0155b6"
     },
     {
       "path": "tests/gate_review.mjs",
@@ -6597,7 +6597,7 @@
     {
       "path": "tests/grader.mjs",
       "mode": "0000644",
-      "sha256": "380ef7c395dea5ba988a1b0f9492451c621ebc01ba5e04c2674ebb54fe32cddd"
+      "sha256": "4832bcffc7385cdd8deb0c1ff9bb44542190a3da106d2f00ccacd823c90103ec"
     },
     {
       "path": "tests/grader_bypass.mjs",

package/modules/grading/grader.js

@@ -365,6 +365,19 @@ function isNum(n) {
   return Number.isFinite(n);
 }
 
+// #1002653 corroboration helpers for validateAndScore's null-ff lens branch.
+// A worker entry is untrusted input — w.issues may be any shape. Absent issues
+// on an errored worker is the normal outage shape (treated as none); a truthy
+// NON-ARRAY issues is malformed and must DISQUALIFY corroboration (fail-closed
+// schema_error downstream), never TypeError into a 500 on grade submission.
+const isNarcErroredClean = (w) => {
+  if (!w || w.kind !== 'narc' || !w.error) return false;
+  const issues = w.issues == null ? [] : w.issues;
+  if (!Array.isArray(issues)) return false;
+  return !issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
+};
+const isNarcHealthy = (w) => !!w && w.kind === 'narc' && !w.error;
+
 // Validates ONE shot's subagent JSON and produces a per-shot grade-result.
 // Never throws — malformed inputs produce a passed=false result with notes_md.
 // The downstream aggregateShots collapses N of these into a final verdict.
@@ -394,7 +407,25 @@ function validateAndScore(rawSubagent, meta = {}) {
     };
   }
 
-  const ff = Number(parsed.functional_fidelity);
+  // #1002653: Number(null) === 0, so an errored ADVISORY Narc forwarding an
+  // EXPLICIT ff:null fabricated "FAIL — functional_fidelity below 6" at
+  // (0+cq)/2. Explicit null = the lens did not run (the #395 confidence
+  // precedent): gate/score on the axes that ran. A bare null is NOT enough —
+  // a prompt-injected Narc emitting null must stay fail-closed — so the branch
+  // needs POSITIVE corroboration: workers[] carries an errored
+  // no-substantive-finding Narc (#473 missing-signal semantics) and no healthy
+  // Narc. Empty/narc-less/absent workers, ABSENT ff, and every other shape
+  // fall through to the fail-closed schema_error below. Quality has no such
+  // branch — gating lens, absence stays fail-closed.
+  // Trust note: workers[] is client-supplied like every SR-9 grade input — a
+  // forger gains nothing here they cannot get by sending ff:9 directly; the
+  // server-derivable-signals redesign is tracked separately (SR-9 residual).
+  const metaWorkers = Array.isArray(meta.workers) ? meta.workers : null;
+  const narcMissingSignal = !!metaWorkers &&
+    metaWorkers.some(isNarcErroredClean) && !metaWorkers.some(isNarcHealthy);
+  const ffExplicitNull = parsed.functional_fidelity === null;
+  const ffLensUnavailable = ffExplicitNull && narcMissingSignal;
+  const ff = ffExplicitNull ? null : Number(parsed.functional_fidelity);
   const cq = Number(parsed.code_quality);
   const economyRaw = Number(parsed.economy);
   const economy =
@@ -427,8 +458,9 @@ function validateAndScore(rawSubagent, meta = {}) {
 
   signals.confidence = confidence;
   signals.issue_count = issues.length;
+  if (ffLensUnavailable) signals.ff_lens_unavailable = true;
 
-  if (!isNum(ff) || !isNum(cq) || ff < 0 || ff > 10 || cq < 0 || cq > 10) {
+  if ((!ffLensUnavailable && (!isNum(ff) || ff < 0 || ff > 10)) || !isNum(cq) || cq < 0 || cq > 10) {
     return {
       score: 0,
       passed: false,
@@ -437,12 +469,15 @@ function validateAndScore(rawSubagent, meta = {}) {
       grader_version: VERSION,
       rubric_scores: {},
       signals: { ...signals, schema_error: true },
-      notes_md: `Subagent grader ${VERSION}: subagent returned scores outside [0,10] or non-numeric. Got functional_fidelity=${parsed.functional_fidelity}, code_quality=${parsed.code_quality}.`,
+      notes_md: `Subagent grader ${VERSION}: subagent returned scores outside [0,10] or non-numeric. Got functional_fidelity=${parsed.functional_fidelity}, code_quality=${parsed.code_quality}.`
+        + (ffExplicitNull && !narcMissingSignal
+          ? ' Explicit null functional_fidelity without a corroborated Narc outage in signals.workers is fail-closed.'
+          : ''),
       issues,
     };
   }
 
-  const ffR = r1(clamp(ff, 0, 10));
+  const ffR = ffLensUnavailable ? null : r1(clamp(ff, 0, 10));
   const cqR = r1(clamp(cq, 0, 10));
   const economyR = economy != null ? r1(clamp(economy, 0, 10)) : null;
   const securityR = securityScore != null ? r1(clamp(securityScore, 0, 10)) : null;
@@ -450,7 +485,9 @@ function validateAndScore(rawSubagent, meta = {}) {
   const economyPenalty =
     economyR != null ? Math.max(0, (THRESHOLD - economyR) / 2) : 0;
   const cqEffective = economyR != null ? r1(clamp(cqR - economyPenalty, 0, 10)) : cqR;
-  const blended = r1((ffR + cqR) / 2);
+  // With the ff lens out, the score reflects only the axis that ran — never a
+  // blend with a synthetic 0 (the fabricated 4.5/10) or a synthetic threshold.
+  const blended = ffLensUnavailable ? cqR : r1((ffR + cqR) / 2);
 
   // confidence must be present (not null) for a PASS. A subagent that omits
   // confidence entirely silently bypassed the low-confidence gate under the
@@ -461,7 +498,11 @@ function validateAndScore(rawSubagent, meta = {}) {
   // so aggregateShots can never reach unanimousPASS with a null confidenceMedian.
   const confidenceAbsent = confidence === null;
   const lowConfidence = !confidenceAbsent && confidence < LOW_CONFIDENCE;
-  const bothPass = ffR >= THRESHOLD && cqR >= THRESHOLD;
+  // ffR is null when the lens is unavailable — it must not fail the gate
+  // (null < THRESHOLD is true via JS coercion), and must not appear in the
+  // verdict's below-threshold branches.
+  const ffBelow = !ffLensUnavailable && ffR < THRESHOLD;
+  const bothPass = !ffBelow && cqR >= THRESHOLD;
   const passed = bothPass && !lowConfidence && !confidenceAbsent;
 
   const verdict = passed
@@ -472,15 +513,15 @@ function validateAndScore(rawSubagent, meta = {}) {
         ? 'FAIL — low confidence'
         : bothPass
           ? 'FAIL'
-          : ffR < THRESHOLD && cqR < THRESHOLD
+          : ffBelow && cqR < THRESHOLD
             ? `FAIL — both axes below ${THRESHOLD}`
-            : ffR < THRESHOLD
+            : ffBelow
               ? `FAIL — functional_fidelity below ${THRESHOLD}`
               : `FAIL — code_quality below ${THRESHOLD}`;
 
   const notesLines = [];
   notesLines.push(`Shot ${signals.shot_index != null ? signals.shot_index : '?'} (${signals.model}) — ${verdict}`);
-  notesLines.push(`  ff=${ffR}/10  cq=${cqR}/10${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
+  notesLines.push(`  ff=${ffLensUnavailable ? 'n/a (lens unavailable)' : `${ffR}/10`}  cq=${cqR}/10${economyR != null ? `  econ=${economyR}/10 (advisory)` : ''}  conf=${confidence ?? '?'}`);
   if (notesFromSubagent) {
     notesLines.push('');
     notesLines.push(notesFromSubagent.trim());

package/modules/lifecycle/github-push.js

@@ -1002,6 +1002,10 @@ async function recheckPullRequest({ number }, deps = {}) {
   const { owner, repo } = repoInfo;
   const doFetch = deps.fetchImpl || fetch;
   const reopenDelayMs = Number.isFinite(deps.reopenDelayMs) ? deps.reopenDelayMs : RECHECK_REOPEN_DELAY_MS;
+  // task 1002644: injectable so the unit test pins the sleep's PLACE in the
+  // close→reopen sequence without a real timer — a wall-clock elapsed assertion
+  // around a real sleep flaked the unit lane (the only required merge check).
+  const doSleep = deps.sleepImpl || sleep;
   const api = `https://api.github.com/repos/${owner}/${repo}`;
   const patchState = async (state) => {
     const res = await doFetch(`${api}/pulls/${number}`, {
@@ -1018,7 +1022,7 @@ async function recheckPullRequest({ number }, deps = {}) {
   await patchState('closed');
   // Let GitHub register the close as a distinct state transition before reopening, so
   // the reopen actually dispatches a `pull_request: reopened` event (task 1241).
-  if (reopenDelayMs > 0) await sleep(reopenDelayMs);
+  if (reopenDelayMs > 0) await doSleep(reopenDelayMs);
   const reopened = await patchState('open');
   let autoMerge = false;
   try {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.27",
+  "version": "1.19.29",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.27",
+      "version": "1.19.29",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.27",
+  "version": "1.19.29",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -184,16 +184,31 @@ function main() {
   const runOne = (displayName, filePath) => {
     try {
       execFileSync(process.execPath, [filePath], {
-        stdio: ['ignore', 'ignore', 'pipe'],
+        // task 1002644: stdout used to be IGNORED, so the failing assertion (test
+        // files print their FAIL lines to stdout) was discarded and the only
+        // context shown was the last 3 STDERR lines — often stale diagnostic
+        // noise from an EARLIER, PASSING test. The live example: gate_approvals'
+        // route-catch console.error dump made every failure in that file read as
+        // a GraphQL/network outage, and the real flaky assertion was invisible.
+        stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: 16 * 1024 * 1024,
         timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
       console.log(`  ok    ${displayName}`);
     } catch (err) {
       const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
-      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
       console.log(`  FAIL  ${displayName} (${why})`);
-      if (stderr) console.log(`      ${stderr}`);
+      const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
+      // The actual failures first: the file's own FAIL lines, then its stdout
+      // tail (the last failure's assertion detail + summary), both bounded.
+      const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
+      for (const l of failLines) console.log(`      ${l.trim()}`);
+      if (stdoutText) {
+        for (const l of stdoutText.split('\n').slice(-5)) console.log(`      ${l}`);
+      }
+      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
+      if (stderr) console.log(`      stderr: ${stderr}`);
       failures.push(displayName);
     }
   };

package/src/module-api.js

@@ -481,8 +481,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.25 with no explicit bump. run 31495996665. (task 1002620)
 //   1.19.27 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.26 with no explicit bump. run 31497212656. (task 1002620)
+//   1.19.28 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.27 with no explicit bump. run 31499228797. (task 1002620)
+//   1.19.29 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.28 with no explicit bump. run 31500810303. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.27'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.29'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/gate_approvals.mjs

@@ -208,21 +208,26 @@ await t('recheckPullRequest: waits between close and reopen so GitHub fires a di
   // into no net change and dispatches no `pull_request: reopened` event, so the
   // gate-review run never re-fires. recheckPullRequest must sleep BETWEEN the close
   // PATCH and the reopen PATCH (deps.reopenDelayMs, default 4s in prod) so the reopen
-  // lands as a distinct state transition. We assert the delay elapses strictly between
-  // the two PATCHes and not before the close / after the reopen.
+  // lands as a distinct state transition.
+  //
+  // task 1002644: this used to sleep a REAL 30ms and assert wall-clock elapsed >=
+  // 30 — Date.now() truncation + NTP slew on CI runners can read a punctual timer
+  // as 29ms, which flaked the unit lane (the ONLY required merge check, ADR 0162).
+  // Inject the sleep and assert its PLACE in the event sequence instead — strictly
+  // stronger (total elapsed never proved the wait sat BETWEEN the two PATCHes) and
+  // fully deterministic.
   const events = [];
-  const delayMs = 30;
+  const delayMs = 4000; // the prod-default shape — never actually slept (injected)
   const fetchImpl = async (url, opts) => {
     const method = (opts && opts.method) || 'GET';
     if (method === 'PATCH') { events.push('patch:' + JSON.parse(opts.body).state); return jsonRes(200, { node_id: 'N1', state: JSON.parse(opts.body).state }); }
     if (url === 'https://api.github.com/graphql') { events.push('automerge'); return jsonRes(200, { data: { enablePullRequestAutoMerge: {} } }); }
     throw new Error('unexpected ' + url + ' ' + method);
   };
-  const t0 = Date.now();
-  await gp.recheckPullRequest({ number: 202 }, { token: 'T', repoInfo: REPO, fetchImpl, reopenDelayMs: delayMs });
-  const elapsed = Date.now() - t0;
-  assert.deepEqual(events, ['patch:closed', 'patch:open', 'automerge'], 'close then (after a wait) reopen then re-arm');
-  assert.ok(elapsed >= delayMs, `total elapsed (${elapsed}ms) must be at least the configured reopen delay (${delayMs}ms)`);
+  const sleepImpl = async (ms) => { events.push(`sleep:${ms}`); };
+  await gp.recheckPullRequest({ number: 202 }, { token: 'T', repoInfo: REPO, fetchImpl, sleepImpl, reopenDelayMs: delayMs });
+  assert.deepEqual(events, ['patch:closed', `sleep:${delayMs}`, 'patch:open', 'automerge'],
+    'the wait happens BETWEEN the close and the reopen — a coalesced close+reopen dispatches no reopened event');
 });
 
 // ===========================================================================

package/tests/grader.mjs

@@ -415,6 +415,165 @@ test('#489 validateAndScore: explicit null confidence → FAIL (same as absent)'
   assert.match(r.notes_md, /confidence absent/i);
 });
 
+// Task 1002653: an errored ADVISORY Narc forwards an EXPLICIT
+// functional_fidelity: null on an otherwise-passing panel (advisory since
+// #481). Number(null) === 0 used to fabricate "FAIL — functional_fidelity
+// below 6" at (0+cq)/2. Explicit null = the ff lens did not run: gate + score
+// on the axes that DID run — but ONLY when signals.workers corroborates the
+// Narc as missing-signal (errored, no substantive finding). A bare null with a
+// healthy Narc (the prompt-injection shape this ship's own Hacker flagged), an
+// ABSENT ff, or no workers signal at all stays fail-closed.
+const NARC_ERRORED_META = {
+  workers: [
+    { kind: 'narc', verdict: 'fail', error: 'subprocess_error', issues: [] },
+    { kind: 'quality', verdict: 'pass', scores: { code_quality: 8 }, issues: [] },
+  ],
+};
+
+test('#1002653 validateAndScore: null ff + corroborated Narc outage + passing cq → PASS on the axes that ran', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: 'narc errored; quality passed',
+    confidence: 0.8,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, true);
+  assert.equal(r.score, 8); // cq only — never blended with a synthetic 0
+  assert.equal(r.rubric_scores.functional_fidelity, null);
+  assert.equal(r.signals.ff_lens_unavailable, true);
+  assert.match(r.notes_md, /lens unavailable/);
+  assert.doesNotMatch(r.notes_md, /functional_fidelity below/);
+});
+
+test('#1002653 validateAndScore: null ff with a HEALTHY Narc in signals → fail-closed (injection shape)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 9,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [],
+  }, { workers: [
+    { kind: 'narc', verdict: 'pass', scores: { functional_fidelity: null }, issues: [] },
+    { kind: 'quality', verdict: 'pass', scores: { code_quality: 9 }, issues: [] },
+  ] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+  assert.match(r.notes_md, /without a corroborated Narc outage/);
+});
+
+test('#1002653 validateAndScore: null ff with NO workers signal at all → fail-closed', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: null ff with EMPTY workers array → fail-closed (no vacuous truth)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: null ff with a narc-less workers array → fail-closed (positive corroboration only)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [{ kind: 'quality', verdict: 'pass', scores: { code_quality: 8 }, issues: [] }] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: malformed issues shape on the errored narc → fail-closed, no throw', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [{ kind: 'narc', verdict: 'fail', error: 'subprocess_error', issues: 'none' }] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: an errored narc alongside a HEALTHY narc does not excuse null ff', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 8,
+    notes_md: '',
+    confidence: 0.8,
+    issues: [],
+  }, { workers: [
+    { kind: 'narc', verdict: 'fail', error: 'subprocess_error', issues: [] },
+    { kind: 'narc', verdict: 'pass', scores: { functional_fidelity: 8 }, issues: [] },
+  ] });
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: null ff does NOT rescue a failing cq (verdict names cq alone)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 4,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [{ severity: 'major', file: 'x.js', summary: 'real problem' }],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /code_quality below/);
+  assert.doesNotMatch(r.notes_md, /both axes below/);
+});
+
+test('#1002653 validateAndScore: ABSENT ff stays a schema_error FAIL (omission cannot dodge the gate)', () => {
+  const r = grader.validateAndScore({
+    code_quality: 9,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.schema_error, true);
+});
+
+test('#1002653 validateAndScore: a judged ff of 0 is still a real FAIL (only corroborated null is a lens outage)', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: 0,
+    code_quality: 9,
+    notes_md: '',
+    confidence: 0.9,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /functional_fidelity below/);
+  assert.notEqual(r.signals.ff_lens_unavailable, true);
+});
+
+test('#1002653 validateAndScore: null ff + null confidence still FAILs on confidence', () => {
+  const r = grader.validateAndScore({
+    functional_fidelity: null,
+    code_quality: 9,
+    notes_md: '',
+    confidence: null,
+    issues: [],
+  }, NARC_ERRORED_META);
+  assert.equal(r.passed, false);
+  assert.match(r.notes_md, /confidence absent/i);
+});
+
 // #489 aggregateShots safety: a unanimousPASS result can never produce a null
 // confidenceMedian, because any shot that passes must now have non-null confidence.
 test('#489 aggregateShots unanimousPASS always has non-null median confidence', () => {