@bongos/core 1.19.622 → 1.19.624

package/tests/government_board_hash_redirect.mjs

@@ -0,0 +1,129 @@
+// tests/government_board_hash_redirect.mjs — the `#board-room` compatibility
+// redirect (ADR 0266, task 1003735).
+//
+// WHY THIS FILE EXISTS. ADR 0266 carved the Board Room out of the /government
+// tab strip onto its own page, and named this redirect load-bearing for a reason
+// that does not expire: Discord's window-open announcement deep-links
+// `?item=<id>#board-room` (ADR 0175 §8 makes that mention the "vote within X"
+// notice), and every one of those messages already sitting in channel history
+// carries the old form forever. If the redirect breaks, a member clicking the
+// notification lands on the Permissions page with no way to the sitting.
+//
+// AND WHY IT CANNOT BE A SERVER TEST. A URL fragment is never sent to the
+// server, so `#board-room` cannot be caught by a route in serve-internal.js —
+// adding a regex there looks like the obvious fix and silently never fires. That
+// makes this browser function the ONLY thing standing between an old link and a
+// dead end, which is exactly the shape that deserves a pin.
+//
+// It is extracted and RUN, not grepped: the interesting behaviour is the
+// branch (which hashes trigger) and the query-preservation (encodeURIComponent
+// on a value that came off the URL), and a source match would pass on a
+// function that returns the wrong string.
+//
+// Pure file-read + vm (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const GOV_SRC = fs.readFileSync(path.join(HALL, 'government.js'), 'utf8');
+
+// Lift the function out of the page's IIFE and run it against a fake location.
+// `sliceFn` counts braces rather than matching a closing line, so a nested block
+// inside the body cannot end the slice early.
+function sliceFn(src, name) {
+  const start = src.indexOf(`function ${name}`);
+  assert.notEqual(start, -1, `${name} not found in government.js`);
+  const open = src.indexOf('{', start);
+  let depth = 0;
+  for (let i = open; i < src.length; i += 1) {
+    if (src[i] === '{') depth += 1;
+    else if (src[i] === '}') {
+      depth -= 1;
+      if (depth === 0) return src.slice(start, i + 1);
+    }
+  }
+  throw new Error(`${name} is unbalanced`);
+}
+
+// Returns { result, replaced } — `replaced` is the URL location.replace was
+// called with, or null if it was never called.
+function runRedirect({ hash, search = '' }) {
+  let replaced = null;
+  const sandbox = {
+    URLSearchParams,
+    window: {
+      location: {
+        hash,
+        search,
+        replace(url) { replaced = url; },
+      },
+    },
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(`${sliceFn(GOV_SRC, 'redirectLegacyBoardHash')}
+    globalThis.__out = redirectLegacyBoardHash();`, sandbox, { filename: 'government.js' });
+  return { result: sandbox.__out, replaced };
+}
+
+test('the old hash lands on the room, and says it navigated', () => {
+  const { result, replaced } = runRedirect({ hash: '#board-room' });
+  assert.equal(replaced, '/board-room');
+  assert.equal(result, true,
+    'init() returns early on true — a falsy answer would let the government page paint over the navigation');
+});
+
+test('?item=N is carried across — that is the whole point of the Discord link', () => {
+  const { replaced } = runRedirect({ hash: '#board-room', search: '?item=12' });
+  assert.equal(replaced, '/board-room?item=12');
+});
+
+test('the item is re-encoded, never pasted through raw', () => {
+  // The value arrives off a URL a stranger can author, and goes straight back
+  // into one. Board item ids are numeric, so this is defence rather than a live
+  // case — which is why it is pinned instead of assumed.
+  const { replaced } = runRedirect({ hash: '#board-room', search: '?item=1%202%263' });
+  assert.equal(replaced, '/board-room?item=1%202%263',
+    'a space and an ampersand survive as escapes rather than splitting the query');
+});
+
+test('an item that is absent or empty produces a bare URL, not a dangling ?item=', () => {
+  assert.equal(runRedirect({ hash: '#board-room', search: '?other=1' }).replaced, '/board-room');
+  assert.equal(runRedirect({ hash: '#board-room', search: '?item=' }).replaced, '/board-room',
+    'an empty value is falsy, so no query is appended');
+});
+
+test('every OTHER hash is left alone — the two surviving tabs still work', () => {
+  // The government page kept #constitution and #ranks. A redirect that fired on
+  // those would make the page unreachable, which is a worse failure than the one
+  // this function exists to prevent.
+  for (const hash of ['#constitution', '#ranks', '', '#board-room-extra', '#Board-Room']) {
+    const { result, replaced } = runRedirect({ hash, search: '?item=12' });
+    assert.equal(replaced, null, `${hash || '(no hash)'} must not navigate`);
+    assert.equal(result, false, `${hash || '(no hash)'} must let init() continue`);
+  }
+});
+
+test('init() consults it FIRST and returns on true', () => {
+  // The order is the behaviour: called after the /me fetch, the reader would see
+  // the government page paint and then jump. Asserted on the source because it is
+  // a statement about sequence, not a value.
+  const init = sliceFn(GOV_SRC, 'init');
+  const guard = init.indexOf('redirectLegacyBoardHash()');
+  assert.notEqual(guard, -1, 'init() must consult the redirect');
+  assert.match(init.slice(guard - 30, guard + 60), /if \(redirectLegacyBoardHash\(\)\) return;/,
+    'it must be an early return, not a fire-and-continue');
+  const meFetch = init.indexOf("fetchJson('/me')");
+  assert.ok(guard < meFetch, 'the redirect must run BEFORE the /me read and any paint');
+});
+
+test('the government page no longer declares a board-room tab to redirect INTO', () => {
+  // If #board-room came back as a tab id, this redirect would fight makeTabs for
+  // the same hash and the room would exist in two places.
+  const ids = [...GOV_SRC.matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
+  assert.ok(!ids.includes('board-room'), `board-room is a page, not a tab (found ${ids})`);
+});

package/tests/government_board_room_copy.mjs

@@ -26,20 +26,28 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+// TWO SOURCES SINCE ADR 0266. The Board Room was the `#board-room` tab of the
+// government page and is now its own page, so the sitting card, its copy and the
+// vote form live in board-room.js / board-room.html. `CLIENT` and `HTML` stay
+// pointed at the government page for the two assertions that are genuinely about
+// what STAYED there — the Constitution's own membership sentence, and the short
+// pass-rule name its change-history line reads.
 const CLIENT = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
 const HTML = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.html'), 'utf8');
+const BOARD = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.js'), 'utf8');
+const BOARD_HTML = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.html'), 'utf8');
 const { PASS_RULES } = require(path.join(ROOT, 'modules', 'government', 'config.js'));
 
-const card = () => CLIENT.slice(CLIENT.indexOf('function itemCard'), CLIENT.indexOf('async function loadBoard'));
+const card = () => BOARD.slice(BOARD.indexOf('function itemCard'), BOARD.indexOf('async function loadBoard'));
 
 // Deleted copy is asserted against the RENDERING source only. The comments in
-// government.js deliberately quote what was removed and why — that history is
+// board-room.js deliberately quote what was removed and why — that history is
 // the point of them, and a test that forbade it would push the record out of
 // the file it explains.
-const CODE = CLIENT.split(/\r?\n/).filter((l) => !/^\s*\/\//.test(l)).join('\n');
+const CODE = BOARD.split(/\r?\n/).filter((l) => !/^\s*\/\//.test(l)).join('\n');
 
 test('every pass rule the server can hold has a plain-language sentence', () => {
-  const block = CLIENT.slice(CLIENT.indexOf('const PASS_RULE_PLAIN'), CLIENT.indexOf('function decidedByHtml'));
+  const block = BOARD.slice(BOARD.indexOf('const PASS_RULE_PLAIN'), BOARD.indexOf('function decidedByHtml'));
   assert.ok(PASS_RULES.length >= 3, `sanity: found the real rule set (${PASS_RULES})`);
   for (const rule of PASS_RULES) {
     assert.ok(block.includes(`${rule}:`), `PASS_RULE_PLAIN must explain '${rule}' — a rule with no copy renders its enum key`);
@@ -52,14 +60,23 @@ test('every pass rule the server can hold has a plain-language sentence', () =>
 });
 
 test('the short name map covers the same rule set (the history line)', () => {
-  const block = CLIENT.slice(CLIENT.indexOf('const PASS_RULE_NAME'), CLIENT.indexOf('const PASS_RULE_PLAIN'));
+  // Its reader (historyRow, the amendment change-history) stayed on the
+  // government page when ADR 0266 carved the room out, so this map stayed with
+  // it. The slice therefore ends at a landmark that is still IN government.js —
+  // it used to end at `const PASS_RULE_PLAIN`, which has moved to board-room.js,
+  // and an indexOf that misses returns -1: `slice(start, -1)` would have handed
+  // this assertion most of the file and passed for the wrong reason.
+  const start = CLIENT.indexOf('const PASS_RULE_NAME');
+  const end = CLIENT.indexOf('function dialRow');
+  assert.ok(start !== -1 && end > start, 'PASS_RULE_NAME sits above dialRow in government.js');
+  const block = CLIENT.slice(start, end);
   for (const rule of PASS_RULES) {
     assert.ok(block.includes(`${rule}:`), `PASS_RULE_NAME must name '${rule}'`);
   }
 });
 
 test('a rank reaches the reader as a LABEL, never as the enum key', () => {
-  assert.match(CLIENT, /function rankNames\(keys\)[\s\S]*?window\.OTB\.rankLabel\(k\)/,
+  assert.match(BOARD, /function rankNames\(keys\)[\s\S]*?window\.OTB\.rankLabel\(k\)/,
     'the board card resolves rank keys through the branding pack');
   const membership = CLIENT.slice(CLIENT.indexOf('function membershipSentence'), CLIENT.indexOf('function passRuleSentence'));
   assert.match(membership, /window\.OTB\.rankLabel\(k\)/,
@@ -84,7 +101,7 @@ test('the card order is title → action → the idea → the apparatus', () =>
 });
 
 test('the idea renders OPEN — never behind a summary', () => {
-  const sections = CLIENT.slice(CLIENT.indexOf('function ideaSectionsHtml'), CLIENT.indexOf('function rankNames'));
+  const sections = BOARD.slice(BOARD.indexOf('function ideaSectionsHtml'), BOARD.indexOf('function rankNames'));
   assert.ok(!/<details/.test(sections),
     'the substance of the vote is not a disclosure — that was the reported bug');
   assert.match(sections, /gov-idea__body/, 'and it is set as prose, not as a config row');
@@ -99,12 +116,12 @@ test('the tally stays visible without a click (ADR 0175 §9)', () => {
 test('the self-explaining copy is DELETED, not reworded', () => {
   assert.ok(!/Casting arrives with the vote form/.test(CODE),
     'the sentence that explained the UI to itself — and the form it promised has shipped');
-  assert.ok(!/tally: \$\{yes\} yes/.test(CLIENT), 'the raw-config tally line is gone');
+  assert.ok(!/tally: \$\{yes\} yes/.test(BOARD), 'the raw-config tally line is gone');
   assert.ok(!/The idea, in full/.test(CODE), 'so is the summary that hid the idea');
 });
 
 test('the section a voter faults is shown by NAME, in the ballot and the picker', () => {
-  const ballot = CLIENT.slice(CLIENT.indexOf('function ballotHtml'), CLIENT.indexOf('// ---- the vote form'));
+  const ballot = BOARD.slice(BOARD.indexOf('function ballotHtml'), BOARD.indexOf('// ---- the vote form'));
   assert.match(ballot, /SECTION_LABELS\[v\.section_key\]/,
     '`why_matters` is a jsonb key; the objector picked a named section and the reader should see that name');
 });
@@ -112,18 +129,27 @@ test('the section a voter faults is shown by NAME, in the ballot and the picker'
 test('the objection still carries a reason AND one section (ADR 0175 §8)', () => {
   // The requirement simplifying may not weaken: it is why voting lives in the
   // hall instead of on a chat reaction.
-  const form = CLIENT.slice(CLIENT.indexOf('function voteFormHtml'), CLIENT.indexOf('async function castVoteFromRoom'));
+  const form = BOARD.slice(BOARD.indexOf('function voteFormHtml'), BOARD.indexOf('async function castVoteFromRoom'));
   assert.match(form, /data-vote-reason/, 'the reason box survives');
   assert.match(form, /gov-vote__sections/, 'so does the five-way section picker');
   assert.match(form, /Object\.keys\(SECTION_LABELS\)\.map/, 'with one radio per declared section');
 });
 
-test('the page frames its panels in one line each, not a paragraph', () => {
+test('each room frames itself in one line, not a paragraph', () => {
   // The two intros used to run ~60 and ~50 words before anything actionable.
-  for (const heading of ['Constitution', 'Board Room']) {
-    const i = HTML.indexOf(`<h2 class="gov-h">${heading}</h2>`);
-    assert.notEqual(i, -1, `${heading} panel heading missing`);
-    const note = /<p class="gov-grid-note">([\s\S]*?)<\/p>/.exec(HTML.slice(i));
+  //
+  // They now live on two pages (ADR 0266), and the Board Room's heading is its
+  // page's own <h1> rather than a panel <h2> — a second "Board Room" heading
+  // under the page head would be the copy-that-explains-the-UI-to-itself this
+  // file exists to keep out. So the landmark differs per room; the RULE does not.
+  const rooms = [
+    { heading: 'Constitution', src: HTML, at: '<h2 class="gov-h">Constitution</h2>' },
+    { heading: 'Board Room', src: BOARD_HTML, at: '<h1 class="page-head__h">Board Room</h1>' },
+  ];
+  for (const { heading, src, at } of rooms) {
+    const i = src.indexOf(at);
+    assert.notEqual(i, -1, `${heading} heading missing (${at})`);
+    const note = /<p class="gov-grid-note">([\s\S]*?)<\/p>/.exec(src.slice(i));
     assert.ok(note, `${heading} has no framing line`);
     const words = note[1].replace(/<[^>]+>/g, ' ').trim().split(/\s+/).length;
     assert.ok(words <= 30, `${heading}'s intro is ${words} words — a reader meets it before anything actionable`);

package/tests/government_board_vote_ui.mjs

@@ -16,7 +16,11 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const CLIENT = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
+// board-room.js since ADR 0266, not government.js: every assertion in this file
+// is about the sitting card, the ballot and the vote form, and all three moved
+// with the room onto its own page. The name stays `CLIENT` because that is what
+// each assertion below reads — this file has exactly one source.
+const CLIENT = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.js'), 'utf8');
 const { BASE_TEMPLATE } = require(path.join(ROOT, 'modules', 'ideas', 'templates.js'));
 const board = require(path.join(ROOT, 'modules', 'government', 'board.js'));
 

package/tests/hall_nav.mjs

@@ -177,7 +177,11 @@ test('sidebar groups read by audience, in order', () => {
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
   // 'project-settings' joins the Government group at the metic floor (task 1003280,
   // goal 1000072) — it sits before 'government', which is the one archon-only item.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
+  // 'board-room' leads the group since ADR 0266: it is the one page here you ACT
+  // on (a sitting waits on a decision; the rest is monitoring), the same ordering
+  // rule the Community group's first item follows. Before that carve it had no
+  // item at all — it was a tab behind the one labelled "Permissions".
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['board-room', 'watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {

package/tests/hall_page_gate_map.mjs

@@ -38,6 +38,7 @@ const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'ut
 //   requireGovernmentPage       page.view.government  metic+   (ADR 0157)
 //   requireProjectCuratePage    project.curate        metic+
 //   requireGovernmentManagePage government.manage     archon
+//   requireBoardVotePage        board.vote.cast       xenos+   (ADR 0266)
 const ORACLE = {
   // Any signed-in builder — no rank floor.
   '/builders/work': 'requireBuilderPage',
@@ -93,6 +94,16 @@ const ORACLE = {
   // tab seals itself for non-archons.
   '/builders/government': 'requireGovernmentPage',
 
+  // ADR 0266: the Board Room, carved out of the tab strip above onto its own
+  // page. It is the ONE hall page whose gate is deliberately WIDER than the
+  // group it sits in — `board.vote.cast` floors at xenos, on purpose, so that a
+  // constitution widening its board below Metic gets members who can reach the
+  // room rather than members who can only vote by curl. The floor is the coarse
+  // gate; membership is checked in-handler per item against that item's own
+  // snapshotted constitution, so a holder who sits on no board sees the room and
+  // no ballot (ADR 0175 §9 made the ballot open on purpose).
+  '/builders/board-room': 'requireBoardVotePage',
+
   // Deliberately UNGATED — the landing card, the rank ladder, the reward
   // schedule and a builder's public portfolio all render for a stranger.
   //

package/tests/hall_palette.mjs

@@ -113,11 +113,17 @@ test('Tasks tab anchors exist in work.js makeTabs', () => {
   }
 });
 
-test('Government section anchors exist in government.js makeTabs (the R15 three-section IA)', () => {
+// TWO rooms since ADR 0266 (was three): the Board Room became its own page at
+// /board-room, so `#board-room` is no longer a tab id here and the palette must
+// not declare it as a sub-destination — it is read live from the sidebar like
+// every other page. The counts stay exact rather than becoming `>= 2`, because
+// the whole point of this test is that a tab and its jump cannot drift apart.
+test('Government section anchors exist in government.js makeTabs', () => {
   const ids = [...read('government.js').matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
-  assert.ok(ids.length === 3, `sanity: found the three government tabs (${ids})`);
+  assert.ok(ids.length === 2, `sanity: found the two government tabs (${ids})`);
+  assert.ok(!ids.includes('board-room'), 'the Board Room is a page, not a tab (ADR 0266)');
   const declared = declaredHrefs((x) => x.startsWith('/government#'));
-  assert.ok(declared.length === 3, 'palette declares the three Government sections');
+  assert.ok(declared.length === 2, 'palette declares the two Government sections');
   for (const h of declared) {
     assert.ok(ids.includes(h.split('#')[1]), `${h} must be a real government.js tab id`);
   }

package/tests/rank_tier_single_source.mjs

@@ -116,6 +116,14 @@ const STATIC_LADDER_FILES = [
   // which holds it against catalog.RANK_ORDER and holds the whole browser parser
   // equal to the server one.
   'modules/hall-ui/public/government.js',
+  // ADR 0266: the Board Room moved off the government page onto its own, and the
+  // sitting card's `decidedByHtml` expands the same `rank:<key>+` membership form
+  // to say who may vote on THAT sitting — so the carve took a copy of the ladder
+  // with it. Same reason as the row above (browser code cannot require the server
+  // module), and the same pinning: `tests/government_board_vote_ui.mjs` reads
+  // board-room.js and holds its predicate parser equal to the server's, and the
+  // pin below in this file holds the array itself against LIVE_RANK_LADDER.
+  'modules/hall-ui/public/board-room.js',
   // task 1002487: the pure agent-definition validator applies the ADR 0043
   // sub-Metic floor to an agent's declared scope, so it needs the ladder to
   // compare against. It is one of the "dependency-free" cases this array exists

package/tests/session_earnings_mirror_db.mjs

@@ -0,0 +1,250 @@
+// tests/session_earnings_mirror_db.mjs
+//
+// task 1003634 — the session earnings mirror, against a REAL Postgres.
+//
+// WHAT IS BEING PROVEN, and why a fake cannot prove it. The defect was never in
+// JavaScript arithmetic; it was in which credit_log rows a WHERE clause can
+// reach. credit_log pays a builder by two different keys — the per-task streams
+// key on `task_id` and leave session_id NULL, the cost-plus session reward
+// (ADR 0054) keys on `session_id` and leaves task_id NULL — and the mirror
+// summed only the first. A stubbed client would answer whatever the stub was
+// written to answer, which is exactly the assumption under test. So the SQL has
+// to meet a real planner over real columns.
+//
+// NON-DESTRUCTIVE BY CONSTRUCTION: every fixture and credit row is written inside
+// ONE transaction that is ALWAYS rolled back. It never TRUNCATEs, never commits,
+// and is safe to point at a dev database holding real rows. (The precedent and
+// the schema-driven insertRow helper are tests/idea_credit_streams_db.mjs's.)
+//
+// Real-DB (self-skips without Postgres; belongs in the INTEGRATION set).
+//
+// Run:  DATABASE_URL=postgres://... node tests/session_earnings_mirror_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const credits = require('../modules/economy/credits.js');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+let passed = 0;
+let failed = 0;
+// Each test runs inside its own SAVEPOINT: a failure rolls back to it, so one
+// broken assertion cannot abort the transaction and cascade into every test
+// after it.
+let client;
+async function test(name, fn) {
+  await client.query('SAVEPOINT t');
+  try {
+    await fn();
+    passed++; console.log(`  ok  ${name}`);
+    await client.query('RELEASE SAVEPOINT t');
+  } catch (err) {
+    failed++; console.error(`  FAIL ${name}\n    ${err.message}`);
+    await client.query('ROLLBACK TO SAVEPOINT t');
+  }
+}
+
+const schemaCache = new Map();
+async function columnsOf(client, table) {
+  if (schemaCache.has(table)) return schemaCache.get(table);
+  const { rows } = await client.query(
+    `SELECT column_name, data_type, is_nullable, column_default, is_identity
+       FROM information_schema.columns
+      WHERE table_schema = 'public' AND table_name = $1`,
+    [table]
+  );
+  schemaCache.set(table, rows);
+  return rows;
+}
+
+function placeholderFor(dataType, columnName) {
+  switch (dataType) {
+    case 'integer': case 'bigint': case 'smallint':
+    case 'numeric': case 'real': case 'double precision':
+      return 0;
+    case 'boolean': return false;
+    case 'timestamp with time zone': case 'timestamp without time zone': case 'date':
+      return new Date();
+    case 'json': case 'jsonb': return {};
+    case 'ARRAY': return [];
+    default: return `sem-${columnName}`;
+  }
+}
+
+// Identifiers are interpolated because SQL cannot parameterise them. Both are
+// trusted by construction: `table` is a literal from this file, and the column
+// names come from information_schema for that table — never from input.
+async function insertRow(client, table, explicit = {}) {
+  const cols = await columnsOf(client, table);
+  if (cols.length === 0) throw new Error(`table ${table} not found — is this database migrated?`);
+  const values = { ...explicit };
+  for (const c of cols) {
+    if (c.column_name in values) continue;
+    if (c.is_nullable === 'YES') continue;
+    if (c.column_default !== null) continue;
+    if (c.is_identity === 'YES') continue;
+    values[c.column_name] = placeholderFor(c.data_type, c.column_name);
+  }
+  const names = Object.keys(values);
+  const params = names.map((_, i) => `$${i + 1}`);
+  const { rows } = await client.query(
+    `INSERT INTO ${table} (${names.map((n) => `"${n}"`).join(', ')})
+     VALUES (${params.join(', ')}) RETURNING *`,
+    names.map((n) => values[n])
+  );
+  return rows[0];
+}
+
+// The query the mirror used BEFORE this fix — sumCreditsForTasks's predicate,
+// inlined so the bug itself is asserted rather than described. It cannot use
+// credits.sumCreditsForTasks() directly: that reads the module's own pool and so
+// cannot see this transaction's uncommitted rows.
+async function taskKeyedSumOnly(client, builderId, taskIds) {
+  const { rows } = await client.query(
+    `SELECT COALESCE(SUM(delta), 0)::int AS total
+       FROM credit_log WHERE builder_id = $1 AND task_id = ANY($2::bigint[])`,
+    [builderId, taskIds]
+  );
+  return rows[0].total;
+}
+
+// One builder, one shipped task, one session_record linking them.
+async function fixture(client) {
+  const tag = `sem-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const builder = await insertRow(client, 'builders', {
+    github_id: `${tag}-gh`,
+    github_login: tag,
+    display_name: tag,
+    total_credits: 0,
+  });
+  const version = await insertRow(client, 'versions', { id: `${tag}-v`, status: 'building' });
+  const task = await insertRow(client, 'tasks', {
+    title: `${tag} task`,
+    status: 'shipped',
+    version_id: version.id,
+  });
+  const sessionId = `${tag}-session`;
+  await insertRow(client, 'session_records', {
+    session_id: sessionId,
+    builder_id: builder.id,
+    task_ids: [task.id],
+    drachmae_earned: 0,
+    total_tokens: 7823777,
+  });
+  return { builder, task, sessionId };
+}
+
+// Book a cost-plus session reward the way credits.js does: keyed on session_id,
+// with task_id deliberately NULL.
+function sessionReward(client, builderId, sessionId, delta, basis) {
+  return client.query(
+    `INSERT INTO credit_log (builder_id, task_id, delta, reason, description, session_id, reward_basis)
+     VALUES ($1, NULL, $2, 'session.token_reward', $3, $4, $5)`,
+    [builderId, delta, `$${delta} test`, sessionId, basis]
+  );
+}
+
+async function main() {
+  try {
+    client = await pool.connect();
+  } catch {
+    console.log('session_earnings_mirror_db: no Postgres (DATABASE_URL unset/unreachable) — skipping');
+    process.exit(0);
+  }
+
+  await client.query('BEGIN');
+  try {
+    // 1. THE BUG, executable. A session paid purely on cost-plus reads as zero
+    //    through the old predicate — the exact state a builder reported as
+    //    missing pay while the ledger showed them paid.
+    await test('the task-keyed sum alone cannot see a cost-plus session reward (the bug)', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 7, 581);
+
+      assert.equal(await taskKeyedSumOnly(client, builder.id, [task.id]), 0,
+        'the old predicate should report 0 — this is the defect being fixed');
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 7,
+        'the two-key sum must find the 7 drachmae actually paid');
+    });
+
+    // 2. Neither key may be lost when both streams pay the same session.
+    await test('both attribution keys are summed together', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 7, 581);
+      await client.query(
+        `INSERT INTO credit_log (builder_id, task_id, delta, reason, session_id)
+         VALUES ($1, $2, 60, 'task.ship', NULL)`,
+        [builder.id, task.id]
+      );
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 67,
+        'a session paid on both streams must total both');
+    });
+
+    // 3. The OR is one predicate over one scan. A row carrying BOTH keys must be
+    //    summed once — if it were summed per-key, every fix would over-report.
+    await test('a row carrying both keys is counted once, not twice', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await client.query(
+        `INSERT INTO credit_log (builder_id, task_id, delta, reason, session_id)
+         VALUES ($1, $2, 5, 'idea.credit.task_ship:1:2', $3)`,
+        [builder.id, task.id, sessionId]
+      );
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 5,
+        'the doubly-keyed row must contribute 5, not 10');
+    });
+
+    // 4. The figure is SET from ledger state, so re-deriving is a no-op. This is
+    //    what lets every pay-on-land trigger call the sync and lets a re-attempt
+    //    repair a stale row instead of inflating a correct one.
+    await test('re-deriving is idempotent across a top-up', async () => {
+      const { builder, task, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 18, 1496);
+      const first = await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId);
+      const again = await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId);
+      assert.equal(first, 18);
+      assert.equal(again, 18, 'the same ledger state must yield the same figure');
+
+      // A second ship in the same session tops the reward up at a higher basis.
+      await sessionReward(client, builder.id, sessionId, 35, 4403);
+      assert.equal(
+        await credits.sumSessionEarnings(client, builder.id, [task.id], sessionId), 53,
+        'a top-up must be reflected in full, not added to a stale total');
+    });
+
+    // 5. Degenerate inputs must not become an unfiltered scan of the ledger.
+    await test('no keys means zero, never an unscoped sum', async () => {
+      const { builder, sessionId } = await fixture(client);
+      await sessionReward(client, builder.id, sessionId, 9, 750);
+      assert.equal(await credits.sumSessionEarnings(client, builder.id, [], null), 0);
+      assert.equal(await credits.sumSessionEarnings(client, builder.id, null, null), 0);
+      // A session key alone is enough — the cost-plus-only case.
+      assert.equal(await credits.sumSessionEarnings(client, builder.id, [], sessionId), 9);
+    });
+
+    // 6. Another builder's rows are never reachable, whichever key matches.
+    await test('the sum stays scoped to one builder', async () => {
+      const a = await fixture(client);
+      const b = await fixture(client);
+      await sessionReward(client, a.builder.id, a.sessionId, 7, 581);
+      await sessionReward(client, b.builder.id, b.sessionId, 99, 8250);
+      assert.equal(
+        await credits.sumSessionEarnings(client, a.builder.id, [a.task.id, b.task.id], a.sessionId), 7,
+        "another builder's credits must not leak in via a shared task id");
+    });
+  } finally {
+    await client.query('ROLLBACK');
+    client.release();
+    await pool.end();
+  }
+
+  console.log(`\nsession_earnings_mirror_db: ${passed} passed, ${failed} failed`);
+  process.exit(failed === 0 ? 0 : 1);
+}
+
+main().catch((err) => { console.error(err); process.exit(1); });