@bongos/core 1.19.485 → 1.19.487

package/tests/rot_inbox.mjs

@@ -0,0 +1,532 @@
+// tests/rot_inbox.mjs
+//
+// task 1003279 (goal 1000072, criterion legibility-sort-and-staleness) — a goal or
+// task left untouched past the project's rot timer raises ONE actionable line in the
+// hall's needs-attention inbox, with working verbs, and acting on it removes the line.
+//
+// What this pins, in the order it matters:
+//
+//   1. THE ANTI-DRIFT GUARDS. Two numbers and one SQL expression in this feature
+//      exist in more than one file by necessity, and each pairing is asserted rather
+//      than trusted:
+//        • the rot clock is spelled in rot.js AND in the index expressions of
+//          migration core_231 — if they diverge the query silently stops using the
+//          index, which nothing else would ever notice;
+//        • the clock's first two terms must equal the definition of "touched" that
+//          modules/hall-ui/public/task-lib.js already publishes for the boards
+//          (task 1003278), or the board and the inbox disagree about which rows are
+//          stale — the 6h-vs-24h failure of ADR 0226, one tier up;
+//        • every verb the server declares must name a route that actually exists.
+//   2. The rot SET: what can rot, and — more importantly — what cannot. 'active' is
+//      excluded because the CLAIM timer owns it; a regression that re-includes it
+//      would put the same rot in two inboxes with two different numbers.
+//   3. Idempotency by construction: there is no items table, so the line is derived,
+//      and watering/acting removes it. Proven by the SQL predicate, not by a sweep.
+//   4. The timer resolver's precedence and its REPORTING fail posture: a bad value
+//      degrades to the default WITH a receipt, and an unreachable DB never takes the
+//      inbox down.
+//   5. The gates: the read is own-scoped from the session; watering is refused to a
+//      stranger; a finished thing has no clock to reset.
+//
+// Pure — recording fake pools over the real domain and the real router, no Postgres,
+// no network beyond a loopback listener. Runs in the DB-free unit gate.
+//
+// Run:  node tests/rot_inbox.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATION_SRC = readFileSync(join(ROOT, 'migrations/core_231_project_settings_and_attention_water.sql'), 'utf8');
+const TASK_LIB_SRC = readFileSync(join(ROOT, 'modules/hall-ui/public/task-lib.js'), 'utf8');
+const GOAL_INBOX_SRC = readFileSync(join(ROOT, 'modules/hall-ui/public/goal-inbox.js'), 'utf8');
+
+// ---- the recording fake pool ----------------------------------------------
+let queued = [];
+let calls = [];
+let poolThrows = null;
+const pool = {
+  query: async (text, params) => {
+    if (poolThrows) throw poolThrows;
+    calls.push({ text: String(text), params: params || [] });
+    return queued.shift() || { rows: [], rowCount: 0 };
+  },
+};
+function expect(...responses) { queued = responses; calls = []; poolThrows = null; }
+const lastCall = () => calls[calls.length - 1];
+const sqlOf = (c) => c.text.replace(/\s+/g, ' ').trim();
+const squash = (s) => String(s).replace(/\s+/g, ' ').trim();
+
+// ---- core pinned BEFORE anything requires it -------------------------------
+//
+// project-settings reaches the pool through src/bongos/pool.js; the lifecycle rot
+// domain reaches it through the published doorway. Both are pinned to the SAME fake
+// object so one queue drives both halves of the feature.
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true,
+  exports: { pool, instanceDbName: () => 'test' },
+};
+
+// Destructured rather than namespaced for the same reason src/module-api.js is:
+// knip attributes a named export to a destructured binding, not to a property read
+// off a required namespace, and this file is one of its entry points.
+const {
+  SETTING_KEYS, DEFAULT_ROT_DAYS, MIN_ROT_DAYS, MAX_ROT_DAYS,
+  parseDays, getSetting, setSetting, resolveRotDays, describeRotTimer,
+} = require('../src/bongos/project-settings.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+
+const SESSION = { id: 77, github_login: 'octo', rank: 'xenos' };
+let seeAllGranted = false;   // flipped per test — the roster-read atom
+let governancePresent = true;
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    parsePagination: helpers.parsePagination,
+    pageMeta: helpers.pageMeta,
+    parseId: helpers.parseId,
+    requireBuilder: (req, _res, next) => { req.builder = { ...SESSION }; next(); },
+    resolveRotDays: resolveRotDays,
+    projectSettings: {
+      KEYS: SETTING_KEYS,
+      get: getSetting,
+      set: setSetting,
+      describeRotTimer: describeRotTimer,
+    },
+    // The namespaced logger the route takes at require time. A no-op here so a
+    // deliberately-provoked error path (the fail-closed permission resolve, the 500
+    // handlers) does not spray pino JSON through the test output.
+    logger: () => ({ error() {}, warn() {}, info() {}, debug() {} }),
+    // The governance port, controllable — so the refusal is proven, not assumed.
+    resolveOptional: (name) => (
+      name === 'government' && governancePresent
+        ? { builderHasPermissions: async () => seeAllGranted }
+        : null
+    ),
+  },
+};
+
+const rot = require('../modules/lifecycle/rot.js');
+const buildRotRouter = require('../modules/lifecycle/routes/rot.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildRotRouter());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method, path }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const OLD = '2026-01-01T00:00:00.000Z';
+const rotRow = (over = {}) => ({
+  tier: 'task', id: '5', title: 'a quiet task', status: 'backlog',
+  goal_id: '1000072', goal_title: 'Human legibility', created_by: '77',
+  last_touched_at: OLD, ever_watered: false, ...over,
+});
+
+// ---- 1. the anti-drift guards ----------------------------------------------
+
+test('the rot clock in the domain is the SAME expression the migration indexes', () => {
+  // rot.js aliases the table as t / g; the migration indexes the bare columns. Strip
+  // the alias and compare the shapes — this is the pairing that silently stops using
+  // the index if it drifts, so it is asserted, not trusted.
+  const domainTask = squash(rot.TASK_ROT_CLOCK).replace(/\bt\./g, '');
+  const domainGoal = squash(rot.GOAL_ROT_CLOCK).replace(/\bg\./g, '');
+  const migration = squash(MIGRATION_SRC);
+  assert.ok(
+    migration.includes(domainTask),
+    `migration core_231 does not index the task rot clock the domain queries.\n  domain:    ${domainTask}\n  migration: (not found)`
+  );
+  assert.ok(
+    migration.includes(domainGoal),
+    `migration core_231 does not index the goal rot clock the domain queries.\n  domain:    ${domainGoal}`
+  );
+});
+
+test("the clock's first terms ARE task-lib's published definition of touched, not a second one", () => {
+  // task-lib.js: taskActivityMs = Math.max(msOf(t.updated_at), msOf(t.shipped_at)).
+  // If that ever stops folding in shipped_at, or the server stops matching it, the
+  // board and the inbox disagree about which rows are stale.
+  assert.match(
+    TASK_LIB_SRC,
+    /taskActivityMs\s*=\s*\(t\)\s*=>\s*Math\.max\(\s*msOf\(t\.updated_at\)\s*,\s*msOf\(t\.shipped_at\)\s*\)/,
+    'task-lib.js no longer defines "touched" as max(updated_at, shipped_at) — the server clock in rot.js must be changed with it'
+  );
+  const clock = squash(rot.TASK_ROT_CLOCK);
+  assert.ok(clock.includes('t.updated_at'), 'the task clock must read updated_at');
+  assert.ok(clock.includes('t.shipped_at'), 'the task clock must fold in shipped_at, exactly as task-lib.js does');
+  assert.ok(clock.includes('t.attention_watered_at'), 'the task clock must fold in the water mark — that is what this task adds');
+});
+
+test('every verb the server declares names a route that exists', () => {
+  const ROUTER_SRC = readFileSync(join(ROOT, 'modules/lifecycle/routes/rot.js'), 'utf8');
+  const TASKS_SRC = readFileSync(join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+  const GOALS_SRC = readFileSync(join(ROOT, 'modules/lifecycle/routes/goals.js'), 'utf8');
+  const haystack = ROUTER_SRC + TASKS_SRC + GOALS_SRC;
+  for (const v of [...rot.TASK_VERBS, ...rot.GOAL_VERBS]) {
+    assert.ok(
+      haystack.includes(`'${v.path}'`),
+      `verb '${v.verb}' advertises ${v.method} ${v.path}, but no router declares that path — the inbox would render a button the server 404s`
+    );
+  }
+});
+
+test('water is the ONLY verb this feature adds — the other three reuse existing routes', () => {
+  const ROUTER_SRC = readFileSync(join(ROOT, 'modules/lifecycle/routes/rot.js'), 'utf8');
+  const declaredHere = [...ROUTER_SRC.matchAll(/router\.(get|post)\('([^']+)'/g)].map((m) => m[2]);
+  assert.deepEqual(
+    declaredHere.sort(),
+    ['/goals/:id/water', '/inbox/rotting', '/tasks/:id/water'],
+    'rot.js grew a route beyond the one read and the two waters — the other verbs must reuse the routes that already do those jobs (the task-1003066 precedent)'
+  );
+});
+
+// ---- 2. the rot set: what can rot, and what deliberately cannot -------------
+
+test("'active' is NOT rottable — the claim timer owns a claim that went silent", () => {
+  assert.ok(!rot.TASK_ROTTABLE_STATUSES.includes('active'),
+    'a claimed-but-quiet task is the stale-CLAIM timer\'s question (src/stale-timer.js); reporting it here too is two inboxes with two different numbers');
+});
+
+test('the rottable set is the queue nobody picked up — nothing terminal, nothing in flight', () => {
+  assert.deepEqual([...rot.TASK_ROTTABLE_STATUSES].sort(), ['backlog', 'ready']);
+  assert.deepEqual([...rot.GOAL_ROTTABLE_STATUSES], ['open']);
+  for (const terminal of ['shipped', 'abandoned', 'blocked', 'completed', 'confirmed']) {
+    assert.ok(!rot.TASK_ROTTABLE_STATUSES.includes(terminal), `${terminal} must not rot — another surface owns it`);
+  }
+});
+
+test('the query filters on exactly that set, on both tiers', async () => {
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, rotDays: 30 });
+  const c = lastCall();
+  assert.deepEqual(c.params[1], rot.TASK_ROTTABLE_STATUSES);
+  assert.deepEqual(c.params[4], rot.GOAL_ROTTABLE_STATUSES);
+  assert.match(sqlOf(c), /t\.status = ANY\(\$2::text\[\]\)/);
+  assert.match(sqlOf(c), /g\.status = ANY\(\$5::text\[\]\)/);
+});
+
+// ---- 3. derived, not swept: idempotency by construction ---------------------
+
+test('the line is DERIVED — the read compares the clock to a cutoff, it does not read an items table', async () => {
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, rotDays: 30 });
+  const sql = sqlOf(lastCall());
+  assert.match(sql, /make_interval\(days => \$1::int\)/, 'the cutoff must come from the timer, not a hardcoded interval');
+  assert.ok(!/attention_items|rot_items|INSERT/i.test(sql),
+    'there must be no items table and no write on the read path — that is what makes "one line per stale thing, not one per sweep" true by construction');
+});
+
+test('the cutoff is the timer, so watering or editing removes the line with no sweep to run', async () => {
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, rotDays: 7 });
+  assert.equal(lastCall().params[0], 7);
+  const sql = sqlOf(lastCall());
+  // The clock includes the water mark on both arms, which is the whole mechanism:
+  // push the mark forward and the row stops satisfying the predicate.
+  assert.ok(sql.includes('t.attention_watered_at'), 'watering a task must move it out of the result');
+  assert.ok(sql.includes('g.attention_watered_at'), 'watering a goal must move it out of the result');
+});
+
+test('oldest first — the thing that has rotted longest is the first thing you see', async () => {
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, rotDays: 30 });
+  assert.match(sqlOf(lastCall()), /ORDER BY last_touched_at ASC/);
+});
+
+test('the page is capped — an unbounded rot list is a wall nobody reads', async () => {
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, rotDays: 30, limit: 99999 });
+  assert.equal(lastCall().params[5], rot.MAX_ROT_ROWS);
+});
+
+test('a non-positive builder never reaches SQL', async () => {
+  expect({ rows: [rotRow()] });
+  const got = await rot.rottingFor({ builderId: 0, rotDays: 30 });
+  assert.deepEqual(got.rows, []);
+  assert.equal(calls.length, 0);
+});
+
+test('a non-integer timer is refused rather than silently becoming a cutoff of NaN', async () => {
+  await assert.rejects(() => rot.rottingFor({ builderId: 77, rotDays: 'soon' }), /positive whole number/);
+});
+
+// ---- 4. scope: who a rot line is addressed to ------------------------------
+
+test('a plain builder sees only what they created', async () => {
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, canSeeAll: false, rotDays: 30 });
+  const c = lastCall();
+  assert.equal(c.params[2], 77);
+  assert.equal(c.params[3], false);
+  assert.match(sqlOf(c), /\$4::boolean OR t\.created_by = \$3::bigint/);
+});
+
+test('canSeeAll widens the read without naming a builder in the request', async () => {
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, canSeeAll: true, rotDays: 30 });
+  assert.equal(lastCall().params[3], true);
+});
+
+test('an unattributed thing is visible ONLY to canSeeAll — it has no creator to address', async () => {
+  // created_by IS NULL never satisfies `created_by = $3`, so the ownership arm
+  // excludes it and only the boolean arm can let it through. Pinning the predicate
+  // shape is what keeps orphaned rot from becoming everyone's problem.
+  expect({ rows: [] });
+  await rot.rottingFor({ builderId: 77, canSeeAll: false, rotDays: 30 });
+  const sql = sqlOf(lastCall());
+  assert.ok(!/created_by IS NULL/.test(sql),
+    'a NULL creator must not be OR-ed into every builder\'s inbox');
+});
+
+test('each row carries the verbs for ITS tier, so the client never hardcodes the mapping', async () => {
+  expect({ rows: [rotRow(), rotRow({ tier: 'goal', id: '9' })] });
+  const got = await rot.rottingFor({ builderId: 77, rotDays: 30 });
+  assert.deepEqual(got.rows[0].verbs.map((v) => v.verb), ['prioritise', 'prune', 'kill', 'water']);
+  assert.deepEqual(got.rows[1].verbs.map((v) => v.verb), ['kill', 'water']);
+});
+
+// ---- 5. the timer resolver: precedence + the reporting fail posture ---------
+
+test('no row anywhere = the documented default, and it says so', async () => {
+  expect({ rows: [] });
+  const got = await resolveRotDays();
+  assert.equal(got.days, DEFAULT_ROT_DAYS);
+  assert.equal(got.source, 'default');
+  assert.equal(got.invalid, null);
+});
+
+test('a configured row IS the project answer, and the receipt names the store', async () => {
+  expect({ rows: [{ key: 'attention.rot_days', value: '45', updated_at: OLD, updated_by: '1' }] });
+  const got = await resolveRotDays();
+  assert.equal(got.days, 45);
+  assert.equal(got.source, 'project_settings');
+  assert.match(describeRotTimer(got), /45d \(project_settings\)/);
+});
+
+test('an override is a LENS — it wins, and it never reads the store at all', async () => {
+  expect({ rows: [{ key: 'attention.rot_days', value: '45' }] });
+  const got = await resolveRotDays({ override: '7' });
+  assert.equal(got.days, 7);
+  assert.equal(got.source, 'override');
+  assert.equal(calls.length, 0, 'an override must not even query the store');
+});
+
+test('REPORTING DEGRADES: an unusable configured value falls back WITH a receipt, it does not throw', async () => {
+  expect({ rows: [{ key: 'attention.rot_days', value: '0' }] });
+  const got = await resolveRotDays();
+  assert.equal(got.days, DEFAULT_ROT_DAYS);
+  assert.equal(got.source, 'default');
+  assert.equal(got.invalid.reason, 'must be positive');
+  assert.match(describeRotTimer(got), /ignoring project_settings\['attention\.rot_days'\]="0"/);
+});
+
+test('the range is enforced at BOTH ends, and a fractional day is refused', () => {
+  assert.equal(parseDays(String(MIN_ROT_DAYS)).days, MIN_ROT_DAYS);
+  assert.equal(parseDays(String(MAX_ROT_DAYS)).days, MAX_ROT_DAYS);
+  assert.match(parseDays(String(MAX_ROT_DAYS + 1)).reason, /out of range/);
+  assert.match(parseDays('1.5').reason, /whole number/);
+  assert.match(parseDays('soon').reason, /not a number/);
+  assert.equal(parseDays('').reason, 'empty');
+});
+
+test('an unreachable database is not an invalid value — it degrades to the default, not a 500', async () => {
+  expect();
+  poolThrows = new Error('ECONNREFUSED');
+  const got = await resolveRotDays();
+  assert.equal(got.days, DEFAULT_ROT_DAYS);
+  assert.equal(got.source, 'default');
+  assert.equal(got.invalid, null, 'a read failure is not a misconfiguration — do not blame the operator for it');
+});
+
+test('absence is meaningful: a never-set key reads back null rather than a seeded default', async () => {
+  expect({ rows: [] });
+  assert.equal(await getSetting('attention.rot_days'), null);
+});
+
+test('setSetting upserts on the key so a knob has exactly one row', async () => {
+  expect({ rows: [{ key: 'attention.rot_days', value: '14' }] });
+  await setSetting('attention.rot_days', 14, 77);
+  const sql = sqlOf(lastCall());
+  assert.match(sql, /ON CONFLICT \(key\) DO UPDATE/);
+  assert.deepEqual(lastCall().params, ['attention.rot_days', '14', 77]);
+});
+
+// ---- 6. the routes: gates and refusals -------------------------------------
+
+test('GET /inbox/rotting takes its builder from the SESSION and reports the timer', async () => {
+  seeAllGranted = false;
+  expect({ rows: [] }, { rows: [rotRow()] });   // settings read, then the rot read
+  const res = await call('GET', '/api/gds/inbox/rotting');
+  assert.equal(res.status, 200);
+  assert.equal(res.json.scope, 'mine');
+  assert.equal(res.json.count, 1);
+  assert.equal(res.json.timer.rot_days, DEFAULT_ROT_DAYS);
+  assert.equal(res.json.timer.source, 'default');
+  assert.equal(res.json.cutoff != null, true, 'the cutoff is echoed so a reader can tell WHY a row is here');
+});
+
+test('holding the roster-read atom widens the scope to all', async () => {
+  seeAllGranted = true;
+  expect({ rows: [] }, { rows: [] });
+  const res = await call('GET', '/api/gds/inbox/rotting');
+  assert.equal(res.json.scope, 'all');
+  seeAllGranted = false;
+});
+
+test('a rot read is never cached — a stale rot list is a wrong one the moment somebody waters a row', async () => {
+  expect({ rows: [] }, { rows: [] });
+  const res = await new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: '/api/gds/inbox/rotting' },
+      (r) => { r.resume(); r.on('end', () => resolve(r)); });
+    req.on('error', reject); req.end();
+  });
+  assert.equal(res.headers['cache-control'], 'no-store');
+});
+
+test('the creator can water their own rotting task', async () => {
+  seeAllGranted = false;
+  expect(
+    { rows: [{ created_by: '77', status: 'backlog' }] },
+    { rows: [{ id: '5', attention_watered_at: '2026-09-02T00:00:00.000Z', attention_watered_by: '77' }] }
+  );
+  const res = await call('POST', '/api/gds/tasks/5/water');
+  assert.equal(res.status, 200);
+  assert.equal(res.json.ok, true);
+  assert.equal(res.json.watered_at, '2026-09-02T00:00:00.000Z');
+});
+
+test('a stranger without the atom cannot water someone else\'s task — and nothing is written', async () => {
+  seeAllGranted = false;
+  expect({ rows: [{ created_by: '999', status: 'backlog' }] });
+  const res = await call('POST', '/api/gds/tasks/5/water');
+  assert.equal(res.status, 403);
+  assert.equal(res.json.error.code, 'permission_forbidden');
+  assert.equal(calls.length, 1, 'the refusal must come BEFORE the UPDATE, not after it');
+});
+
+test('a builder holding the atom can water a task they did not create', async () => {
+  seeAllGranted = true;
+  expect(
+    { rows: [{ created_by: '999', status: 'backlog' }] },
+    { rows: [{ id: '5', attention_watered_at: OLD, attention_watered_by: '77' }] }
+  );
+  const res = await call('POST', '/api/gds/tasks/5/water');
+  assert.equal(res.status, 200);
+  seeAllGranted = false;
+});
+
+test('authority that cannot be established is a denial — a missing governance port refuses', async () => {
+  governancePresent = false;
+  expect({ rows: [{ created_by: '999', status: 'backlog' }] });
+  const res = await call('POST', '/api/gds/tasks/5/water');
+  assert.equal(res.status, 403, 'ADR 0016 fail-closed: no port means no permission, never a pass');
+  governancePresent = true;
+});
+
+test('watering a finished thing is a 409, not a vacuous 200', async () => {
+  seeAllGranted = false;
+  expect(
+    { rows: [{ created_by: '77', status: 'shipped' }] },
+    { rows: [] }                                  // the status-filtered UPDATE matches nothing
+  );
+  const res = await call('POST', '/api/gds/tasks/5/water');
+  assert.equal(res.status, 409);
+  assert.equal(res.json.error.code, 'not_rottable');
+});
+
+test('watering something that does not exist is a 404', async () => {
+  expect({ rows: [] });
+  const res = await call('POST', '/api/gds/tasks/5/water');
+  assert.equal(res.status, 404);
+  assert.equal(res.json.error.code, 'task_not_found');
+});
+
+test('a non-numeric id is refused before any lookup', async () => {
+  expect();
+  const res = await call('POST', '/api/gds/tasks/me/water');
+  assert.equal(res.status, 400);
+  assert.equal(calls.length, 0);
+});
+
+test('the goal water route exists and refuses a stranger the same way', async () => {
+  seeAllGranted = false;
+  expect({ rows: [{ created_by: '999', status: 'open' }] });
+  const res = await call('POST', '/api/gds/goals/9/water');
+  assert.equal(res.status, 403);
+});
+
+test('the UPDATE is status-filtered, so a finished thing can never have its clock reset', async () => {
+  expect({ rows: [{ id: '5', attention_watered_at: OLD }] });
+  await rot.water('task', 5, 77);
+  const c = lastCall();
+  assert.match(sqlOf(c), /UPDATE tasks SET attention_watered_at = now\(\), attention_watered_by = \$2 WHERE id = \$1 AND status = ANY\(\$3::text\[\]\)/);
+  assert.deepEqual(c.params[2], rot.TASK_ROTTABLE_STATUSES);
+});
+
+test('watering twice is not an error — a second look is a sensible thing for a human to do', async () => {
+  expect(
+    { rows: [{ id: '5', attention_watered_at: '2026-09-01T00:00:00.000Z' }] },
+    { rows: [{ id: '5', attention_watered_at: '2026-09-02T00:00:00.000Z' }] }
+  );
+  const first = await rot.water('task', 5, 77);
+  const second = await rot.water('task', 5, 77);
+  assert.ok(first && second, 'an already-watered thing waters again, it does not 409');
+});
+
+// ---- 7. the client renders the card's contract, not its own ----------------
+
+test('the slice lands in the EXISTING attention card — never a new Home card', () => {
+  assert.ok(GOAL_INBOX_SRC.includes("'<div id=\"attention-rot\"></div>'"),
+    'the rot slice must be a div inside the needs-attention card (hall-ui/CLAUDE.md: a second inbox splits attention)');
+  assert.ok(!/contributeHallWidget\([\s\S]*attention-rot/.test(GOAL_INBOX_SRC),
+    'the rot slice must not register a widget of its own');
+  assert.equal((GOAL_INBOX_SRC.match(/contributeHallWidget\(/g) || []).length, 1,
+    'goal-inbox.js still contributes exactly one widget');
+});
+
+test('rot rows carry .ginbox__item, so the card\'s count-pill and visibility include them', () => {
+  assert.match(GOAL_INBOX_SRC, /function rotRowHtml[\s\S]*?class="ginbox__item"/,
+    'a rot row that does not carry the shared item class would be invisible to OTBAttention.refresh()');
+});
+
+test('the client renders SERVER-declared verbs rather than a hardcoded button list', () => {
+  assert.match(GOAL_INBOX_SRC, /\(Array\.isArray\(r\.verbs\) \? r\.verbs : \[\]\)\.map/,
+    'the buttons must come from the row\'s verbs array — a hardcoded list is a second copy of the tier→verb mapping');
+  assert.match(GOAL_INBOX_SRC, /data-rot-path=/, 'each button carries the server-declared path');
+});
+
+test('acting on a rot line refreshes the ROT slice, not the goals list', () => {
+  assert.match(GOAL_INBOX_SRC, /ROT_TOASTS\[verb\] \|\| 'Done\.', loadRot\)/,
+    'refreshing the wrong slice leaves the acted-on row sitting there — the task-1003066 lesson');
+});