@bongos/core 1.19.699 → 1.19.701

package/tests/agents_routes.mjs

@@ -0,0 +1,194 @@
+// tests/agents_routes.mjs — the agent registry's read surface (task 1002488,
+// goal 1000038 Phase 1).
+//
+// WHY THIS LIVES IN tests/ AND NOT modules/agents/tests/. The `agents` module is
+// `default: false`, and run-unit-tests.js discovers a module's own tests only
+// when that module is ENABLED ("it isn't mounted, so its tests don't run
+// either"). On this instance agents is disabled, so a module-local file here
+// would be silently skipped forever — coverage in name only. tests/ always runs.
+// Same call task 1002487 made for tests/agents_validate.mjs; this follows it.
+//
+// No database, no fixtures, no HTTP. The projection is a pure function and the
+// gate is a property of the mounted router, so both are checked directly.
+//
+// Run:  node tests/agents_routes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const routes = require('../modules/agents/routes/agents.js');
+const validate = require('../modules/agents/lib/validate.js');
+const api = require('../src/module-api.js');
+
+const { serializeDefinition } = routes;
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); console.log(`  PASS  ${name}`); passed += 1; }
+  catch (err) { console.log(`  FAIL  ${name}\n        ${err.message}`); failed += 1; }
+}
+
+// A full row as agents-sync would have written it — every column the serializer
+// reads, including the two it must never emit.
+function row(over = {}) {
+  return {
+    id: 7,
+    name: 'historian',
+    title: 'The Historian',
+    persona: 'PERSONA BODY',
+    trigger_type: 'event',
+    trigger_spec: { event: 'task.shipped' },
+    model_tier: 'routine',
+    scope_modules: ['lifecycle'],
+    scope_paths: [],
+    scope_violation: null,
+    source: 'file',
+    provenance: 'built-in',
+    author_rank: 'archon',
+    author_builder_id: 4242,
+    source_path: '.claude/agents/historian.md',
+    last_synced_at: '2026-09-01T00:00:00.000Z',
+    enabled: true,
+    created_at: '2026-08-01T00:00:00.000Z',
+    updated_at: '2026-09-01T00:00:00.000Z',
+    ...over,
+  };
+}
+
+console.log('\nthe projection — what a registry read may and may not carry:');
+
+t('the LIST omits persona; the DETAIL route serves it', () => {
+  assert.ok(!('persona' in serializeDefinition(row())), 'a 32KB body per row must not ride the list');
+  assert.equal(serializeDefinition(row(), { includePersona: true }).persona, 'PERSONA BODY');
+});
+
+t('author_builder_id is NEVER served, on either route', () => {
+  // The rank is the fact the spawn gate consults; the id would turn a registry
+  // read into a people-directory read, which has its own gate (GET /scouting).
+  for (const opts of [{}, { includePersona: true }]) {
+    const json = JSON.stringify(serializeDefinition(row(), opts));
+    assert.doesNotMatch(json, /4242/, 'the author id leaked into the response');
+    assert.doesNotMatch(json, /author_builder_id/, 'the author id key leaked into the response');
+  }
+  assert.equal(serializeDefinition(row()).author_rank, 'archon', 'the rank IS served — it is the gate-relevant fact');
+});
+
+t('model_tier is served as the TIER, never a resolved model id', () => {
+  // The id a tier resolves to is a deployment fact that changes under the row.
+  // A registry answering with a stale model name is worse than one answering
+  // with the tier, so this asserts the absence of any model-shaped string.
+  const o = serializeDefinition(row());
+  assert.equal(o.model_tier, 'routine');
+  assert.ok(validate.MODEL_TIERS.includes(o.model_tier));
+  assert.doesNotMatch(JSON.stringify(o), /claude-|sonnet|opus|haiku/i, 'a concrete model id must not appear');
+});
+
+console.log('\n`armed` is DERIVED, because two CHECKs make `enabled` narrower than it reads:');
+
+t('a scope-violating row reads as disarmed AND says why', () => {
+  // agents_definitions_flagged_not_armed_chk forces enabled=false when a
+  // violation is recorded. A caller asking "why did this not fire?" gets the
+  // answer in the same object rather than having to know that CHECK exists.
+  const o = serializeDefinition(row({ enabled: false, scope_violation: 'scope_paths exceeds module' }));
+  assert.equal(o.armed, false);
+  assert.equal(o.disarmed_reason, 'scope_violation');
+  assert.equal(o.scope.violation, 'scope_paths exceeds module');
+});
+
+t('an ordinary disabled row is disarmed with no invented reason', () => {
+  const o = serializeDefinition(row({ enabled: false }));
+  assert.equal(o.armed, false);
+  assert.equal(o.disarmed_reason, null, 'absence of a reason must not be reported as a violation');
+});
+
+t('armed is a strict boolean, not a truthy passthrough', () => {
+  assert.equal(serializeDefinition(row({ enabled: true })).armed, true);
+  // A driver returning 't'/1 for a boolean column must not read as armed by
+  // accident — the fail-safe direction for "is this thing allowed to fire" is
+  // false, so the check is `=== true`.
+  assert.equal(serializeDefinition(row({ enabled: 1 })).armed, false);
+});
+
+console.log('\nshape tolerance — a hand-written db row is still a row:');
+
+t('a null/odd trigger_spec degrades to {} instead of throwing', () => {
+  assert.deepEqual(serializeDefinition(row({ trigger_spec: null })).trigger.spec, {});
+  assert.deepEqual(serializeDefinition(row({ trigger_spec: 'nope' })).trigger.spec, {});
+  assert.equal(serializeDefinition(row({ trigger_type: 'on-demand' })).trigger.event, null,
+    'an on-demand agent has no event, even when a spec carries one');
+});
+
+t('null arrays degrade to [], and a missing row serializes to null', () => {
+  const o = serializeDefinition(row({ scope_modules: null, scope_paths: null }));
+  assert.deepEqual(o.scope.modules, []);
+  assert.deepEqual(o.scope.paths, []);
+  assert.equal(serializeDefinition(null), null);
+  assert.equal(serializeDefinition(undefined), null);
+});
+
+console.log('\nthe gate — self-gated means requireBuilder, on EVERY route:');
+
+t('both routes mount requireBuilder, and neither is left ungated', () => {
+  const router = routes();
+  const mounted = router.stack.filter((l) => l.route);
+  assert.equal(mounted.length, 2, 'exactly two routes — a third needs its own gate and its own row here');
+  const paths = mounted.map((l) => l.route.path).sort();
+  assert.deepEqual(paths, ['/agents', '/agents/:name']);
+  for (const layer of mounted) {
+    const handlers = layer.route.stack.map((s) => s.handle);
+    assert.ok(handlers.includes(api.requireBuilder),
+      `${layer.route.path} does not mount requireBuilder — a registry read must not be anonymous`);
+    assert.ok(handlers.length >= 2, `${layer.route.path} has no handler behind its gate`);
+  }
+});
+
+t('every mounted route is a GET — this surface writes nothing', () => {
+  // The read half is a separate task from authoring on purpose. A write verb
+  // appearing here would carry no author-rank clamp and no scope wall.
+  for (const layer of routes().stack.filter((l) => l.route)) {
+    assert.deepEqual(Object.keys(layer.route.methods), ['get'],
+      `${layer.route.path} exposes a non-GET verb on the read surface`);
+  }
+});
+
+console.log('\nthe vocabulary is SERVED, not copied into the client:');
+
+t('the route file spells no enum of its own', () => {
+  // Task 1003453's lesson, applied before the bug rather than after: a filter
+  // built from a client-side copy goes stale against the validator and the DB
+  // CHECK. The list response carries the enums, and they come from validate.js.
+  const src = require('node:fs').readFileSync(new URL('../modules/agents/routes/agents.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(src, /\[\s*'event'\s*,\s*'on-demand'\s*\]/, 'trigger types re-spelled in the route');
+  assert.doesNotMatch(src, /\[\s*'default'\s*,\s*'routine'\s*\]/, 'model tiers re-spelled in the route');
+  assert.match(src, /validate\.TRIGGER_TYPES/);
+  assert.match(src, /validate\.MODEL_TIERS/);
+  assert.match(src, /validate\.EVENT_CATALOG/);
+});
+
+t('the name guard reuses the validator regex, not a third copy of it', () => {
+  // The pattern already exists twice — in validate.js and in the schema's
+  // agents_definitions_name_fmt_chk. The route makes a third place to drift.
+  assert.ok(validate.NAME_RE instanceof RegExp, 'NAME_RE is exported for the route to share');
+  assert.equal(typeof validate.NAME_MAX, 'number');
+  assert.ok(validate.NAME_RE.test('historian'));
+  assert.equal(validate.NAME_RE.test('Historian'), false, 'the CHECK is lowercase-anchored');
+  assert.equal(validate.NAME_RE.test('9lives'), false, 'must start with a letter');
+  const src = require('node:fs').readFileSync(new URL('../modules/agents/routes/agents.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(src, /\/\^\[a-z\]\[a-z0-9-\]\*\$\//, 'the name regex was re-spelled in the route');
+});
+
+console.log('\nthe module declares the routes it now ships:');
+
+t('module.json contributes the agents route file', () => {
+  const manifest = require('../modules/agents/module.json');
+  assert.ok(Array.isArray(manifest.contributes.routes), 'contributes.routes is declared');
+  assert.ok(manifest.contributes.routes.includes('agents'),
+    'the loader mounts modules/agents/routes/<name>.js from this list — without it the file is dead');
+  assert.equal(manifest.contributes.migrations, true, 'the existing migrations contribution survives');
+  assert.equal(manifest.default, false, 'shipped is not enabled — an instance opts in (ADR 0083)');
+});
+
+console.log(`\nagents_routes: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/executed_closure.mjs

@@ -0,0 +1,257 @@
+// tests/executed_closure.mjs — task 1003367, audit ref B1 (2026-08-29 security audit).
+//
+// THE DEFECT. resolveBranchConflicts and refreshStaleGenerated clone a builder's branch
+// and run code out of it with the live server's environment. The audit prescribed
+// restoring scripts/gds/ and .gitattributes from origin/main after the merge and before
+// runGenerators. Building it that way would have left the hole open TWICE, and both of
+// those are what these tests pin:
+//
+//   TOO NARROW — the generators require ../../src/instance-config, and gen-api-docs also
+//     requires src/bongos/route-rank-check, api-prefix and routes/_helpers. A restore
+//     scoped to scripts/gds/ leaves those builder-controlled and still executed.
+//   TOO LATE   — `git merge` runs the otb-regen driver, whose registered command is
+//     `node scripts/gds/git-merge-regen.js` by RELATIVE path with cwd at the clone root.
+//     That is the clone's copy, and it runs at the merge, before any post-merge step.
+//
+// So the assertions below care about two things: that the closure reaches past
+// scripts/, and that the refusal happens BEFORE git merge is ever issued.
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ec = require('../modules/lifecycle/executed-closure.js');
+const cr = require('../modules/lifecycle/conflict-resolve.js');
+
+// fileURLToPath, not URL.pathname: the latter percent-encodes spaces and leaves a Windows
+// drive behind a leading slash (tests/test_path_guard.mjs fails the build on it).
+const REPO_ROOT = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const CLOSURE = ec.computeExecutedClosure();
+
+// ---- what the closure must reach ------------------------------------------
+
+test('the closure reaches the src/ files a scripts/-only restore would have missed', () => {
+  // The exact four the audit's prescription would have left builder-writable. If this
+  // ever goes quiet it means the generators stopped requiring them, which is a reason to
+  // re-derive the fix, not to delete the test.
+  for (const rel of [
+    'src/instance-config.js',
+    'src/bongos/route-rank-check.js',
+    'src/bongos/api-prefix.js',
+    'src/bongos/routes/_helpers.js',
+  ]) {
+    assert.ok(CLOSURE.includes(rel),
+      `${rel} is require()d by a generator the resolver executes, so a branch editing it `
+      + 'runs code as the server — it must be in the executed closure');
+  }
+});
+
+test('the closure includes the MERGE DRIVER, not just the generators', () => {
+  // The half the audit's "after the merge" framing missed entirely.
+  const driver = CLOSURE.filter((f) => /git-merge-regen\.js$/.test(f));
+  assert.ok(driver.length > 0,
+    'git-merge-regen.js runs DURING git merge as the clone\'s own copy — omitting it '
+    + 'would leave the earliest execution vector unguarded');
+});
+
+test('the closure is deep, not just the entrypoints', () => {
+  // A static walk that silently failed to follow requires would still "pass" the two
+  // tests above if it happened to list them. Depth is the evidence it actually walked:
+  // the entrypoints alone are a dozen files.
+  assert.ok(CLOSURE.length > 40,
+    `closure has only ${CLOSURE.length} files — the require walk is probably not recursing`);
+});
+
+test('.gitattributes is guarded even though nothing requires it', () => {
+  assert.ok(CLOSURE.includes('.gitattributes'),
+    'it decides which paths the otb-regen driver is applied to, so it changes what runs');
+});
+
+// ---- holding the static analysis to its own assumption ---------------------
+
+test('every computed require inside the closure is one we have accounted for', () => {
+  // computeExecutedClosure follows string-literal requires only, so it is sound exactly
+  // as far as that assumption holds. Rather than assert the assumption (it is false —
+  // there are computed requires in here), pin the KNOWN set with a reason each, and fail
+  // on anything new. A computed require that appears later is the case where the closure
+  // would silently under-report what a branch can make the server execute.
+  //
+  // Why each known one does not widen the closure IN PRACTICE: all of them sit inside a
+  // function body, so they resolve when that function is CALLED, and nothing on the
+  // generator path calls them. src/module-loader/loader.js is the one worth naming —
+  // it is reachable (gen-file-map -> claude-materialize -> bin/bongos.js -> init.js ->
+  // module-api -> modules.js -> loader.js) and it computed-requires every module's route
+  // file, but only from loadModules(), which generation never invokes. If a generator
+  // ever loads modules, this closure must grow to cover modules/**/routes/*.js.
+  const ACCOUNTED = new Map([
+    ['src/module-loader/loader.js', 2],   // routes/<key>.js + pollerPath, from loadModules()
+    ['scripts/gds/onboard.js', 3],        // provision/oauth-secret/onboardPlan, inside the verb
+    ['scripts/gds/package-core.js', 5],   // publish-manifest/mirror-redact/secret-scrub/…
+    ['scripts/gds/upgrade.js', 1],        // a `node -e` child, not a require in this process
+    ['scripts/gds/gen-api-docs.js', 1],   // require(path.join(CORE_ROOT,'package.json')) — JSON
+  ]);
+
+  // Strip line comments and single/double-quoted strings first: prose and message strings
+  // that merely CONTAIN the word were the bulk of the first run's hits.
+  const strip = (src) => src
+    .split('\n')
+    .map((l) => l.replace(/\/\/.*$/, ''))
+    .join('\n')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''")
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/`(?:[^`\\]|\\.)*`/g, '``');
+
+  const found = new Map();
+  for (const rel of CLOSURE) {
+    if (!rel.endsWith('.js')) continue;
+    let src;
+    try { src = fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'); } catch { continue; }
+    const hits = (strip(src).match(/\brequire\(\s*[^'")\s]/g) || []).length;
+    if (hits) found.set(rel, hits);
+  }
+
+  const unexpected = [...found.keys()].filter((f) => !ACCOUNTED.has(f)).sort();
+  assert.deepEqual(unexpected, [],
+    'a NEW computed require appeared inside the executed closure — decide whether it can '
+    + 'load code out of a cloned branch before adding it to ACCOUNTED');
+
+  for (const [file, n] of ACCOUNTED) {
+    if (!found.has(file)) continue; // the file left the closure; the next assertion covers that
+    assert.equal(found.get(file), n,
+      `${file} now has ${found.get(file)} computed require(s), not ${n} — re-check whether `
+      + 'the new one runs on the generator path');
+  }
+});
+
+test('ENTRYPOINTS covers every generator the resolver actually runs', () => {
+  // Two hand-maintained lists in two files is how a new generator gets executed without
+  // ever entering the closure. Read conflict-resolve's own list and compare by NAME.
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'modules/lifecycle/conflict-resolve.js'), 'utf8');
+  const block = src.match(/const GENERATOR_SCRIPTS = \[([\s\S]*?)\];/);
+  assert.ok(block, 'could not read GENERATOR_SCRIPTS out of conflict-resolve.js');
+  const listed = [...block[1].matchAll(/'([^']+)'/g)].map((m) => m[1]);
+  assert.ok(listed.length > 0, 'GENERATOR_SCRIPTS parsed empty');
+
+  const basenames = new Set(ec.ENTRYPOINTS.map((p) => p.split('/').pop()));
+  for (const rel of listed) {
+    assert.ok(basenames.has(rel.split('/').pop()),
+      `${rel} is executed by the resolver but is not an executed-closure entrypoint`);
+  }
+});
+
+test('both script-tree spellings are entrypoints while the compat shim exists', () => {
+  // Task 1003705 moves these to scripts/bongos/ and leaves scripts/gds/ holding WORKING
+  // forwarders. The driver command is a relative path, so the old spelling still
+  // executes; a guard that knew only one name would stop seeing edits to live code.
+  for (const tree of ['scripts/gds', 'scripts/bongos']) {
+    assert.ok(ec.ENTRYPOINTS.some((p) => p === `${tree}/git-merge-regen.js`),
+      `${tree}/git-merge-regen.js must be an entrypoint while both trees can execute`);
+  }
+});
+
+// ---- the predicate ---------------------------------------------------------
+
+test('branchTouchesExecutedCode returns the sorted, deduped intersection', () => {
+  const closure = ['.gitattributes', 'src/a.js', 'src/b.js'];
+  assert.deepEqual(
+    ec.branchTouchesExecutedCode(['src/b.js', 'docs/x.md', 'src/a.js', 'src/b.js'], closure),
+    ['src/a.js', 'src/b.js'],
+    'the caller names the offending files in its skip reason, so order and dupes matter');
+  assert.deepEqual(ec.branchTouchesExecutedCode(['docs/x.md', 'README.md'], closure), [],
+    'an ordinary branch must not be refused');
+  assert.deepEqual(ec.branchTouchesExecutedCode(['', '  ', null], closure), [],
+    'blank lines from git output are not matches');
+});
+
+// ---- the guard, and WHEN it fires ------------------------------------------
+
+// Minimal git seam. Records every command so the ORDER can be asserted -- that is the
+// whole point of this fix, not merely that a refusal happened.
+function mkExec(touched) {
+  const calls = [];
+  const exec = async (args) => {
+    calls.push(args);
+    let a = args;
+    if (a[0] === '-C') a = a.slice(2);
+    const sub = a.join(' ');
+    if (a[0] === 'diff' && sub.includes('origin/main...HEAD')) {
+      return { code: 0, stdout: `${touched.join('\n')}\n`, stderr: '' };
+    }
+    if (a[0] === 'rev-parse') return { code: 0, stdout: 'aaaaaaa\n', stderr: '' };
+    if (a[0] === 'grep') return { code: 1, stdout: '', stderr: '' };
+    return { code: 0, stdout: '', stderr: '' };
+  };
+  exec.calls = calls;
+  return exec;
+}
+
+function mkDeps(touched, over = {}) {
+  const exec = mkExec(touched);
+  return {
+    exec,
+    executedClosure: ['.gitattributes', 'src/instance-config.js', 'scripts/gds/git-merge-regen.js'],
+    runGenerators: async () => ({ code: 0 }),
+    githubPush: {
+      isConfigured: () => true,
+      isSafeBranch: () => true,
+      resolveToken: async () => 'tok',
+      buildAuthUrl: () => 'https://x-access-token:REDACTED@github.com/o/r.git',
+    },
+    repoInfo: { owner: 'o', repo: 'r' },
+    registerMergeDriver: () => {},
+    repoRoot: '/srv/repo',
+    mkdtemp: () => '/tmp/otb-closure-test',
+    rmtmp: () => {},
+    ...over,
+    _exec: exec,
+  };
+}
+
+const ranMerge = (exec) => exec.calls.some((c) => {
+  const a = c[0] === '-C' ? c.slice(2) : c;
+  return a[0] === 'merge' && a[1] !== '--abort';
+});
+
+for (const [label, fn, okKey] of [
+  ['resolveBranchConflicts', (d) => cr.resolveBranchConflicts({ branch: 'task-1' }, d), 'resolved'],
+  ['refreshStaleGenerated', (d) => cr.refreshStaleGenerated({ branch: 'task-1' }, d), 'refreshed'],
+]) {
+  test(`${label} refuses a branch that edits code it would execute`, async () => {
+    const deps = mkDeps(['docs/x.md', 'src/instance-config.js']);
+    const r = await fn(deps);
+    assert.equal(r[okKey], false);
+    assert.equal(r.skipped, 'branch_modifies_executed_code');
+    assert.deepEqual(r.executes, ['src/instance-config.js'],
+      'the refusal must name the file, or nobody can act on it');
+  });
+
+  test(`${label} refuses BEFORE running git merge`, async () => {
+    // The assertion that distinguishes this fix from the one the audit prescribed. A
+    // post-merge restore would already have run the branch's merge driver by now.
+    const deps = mkDeps(['scripts/gds/git-merge-regen.js']);
+    const r = await fn(deps);
+    assert.equal(r.skipped, 'branch_modifies_executed_code');
+    assert.equal(ranMerge(deps._exec), false,
+      'git merge ran despite the refusal — the clone\'s own merge driver would have '
+      + 'executed, which is the earlier of the two vectors this task closes');
+  });
+
+  test(`${label} still proceeds for an ordinary branch`, async () => {
+    // Red-capability for the two above: if the guard refused everything, they would pass
+    // for the wrong reason.
+    const deps = mkDeps(['docs/x.md', 'modules/hall-ui/public/shell.js']);
+    const r = await fn(deps);
+    assert.notEqual(r.skipped, 'branch_modifies_executed_code');
+    assert.equal(ranMerge(deps._exec), true, 'an ordinary branch must still be merged');
+  });
+
+  test(`${label} refuses on a .gitattributes edit`, async () => {
+    const deps = mkDeps(['.gitattributes']);
+    const r = await fn(deps);
+    assert.equal(r.skipped, 'branch_modifies_executed_code');
+  });
+}

package/tests/publish_reconciler.mjs

@@ -1763,3 +1763,61 @@ test('1003217 an older deps bundle with no `raised` key still logs on reconciled
   assert.equal(logs.length, 1);
   assert.doesNotMatch(logs[0], /raised/, 'no phantom "raised 0" noise when the key is absent');
 });
+
+// ---------------------------------------------------------------------------
+// task 1003367 (audit B1) — the resolver's new refusal must REACH someone.
+//
+// Round 1 of this task's grade failed on exactly this: the guard was written, its
+// comment said "hand the merge to a human", and no call site told anyone. The skip
+// reason fell through both if/else chains with no log line and no strand flag, so a
+// PR stuck on it retried silently every ~5 min forever. These pin the announcement,
+// not the refusal — the refusal itself lives in tests/executed_closure.mjs.
+// ---------------------------------------------------------------------------
+
+test('1003367 a branch that edits resolver-executed code flags the strand immediately, naming the file', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 620, builder_id: 6, worktree_name: 'wt-exec', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }],
+    mergeByBranch: { 'claude/wt-exec': { merged: false, merged_now: false, number: 620, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({
+      resolved: false, skipped: 'branch_modifies_executed_code', executes: ['src/instance-config.js'],
+    }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 1, 'a definitive refusal is flagged on THIS sweep, not left to the stale WARN');
+  assert.equal(deps._calls.flag[0].taskId, 620);
+  assert.match(deps._calls.flag[0].reason, /^strand:branch_modifies_executed_code:src\/instance-config\.js/,
+    'the reason names the offending file, so the builder knows what to take out of the branch');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 620/.test(m)),
+    'and it WARNs — an unannounced refusal is indistinguishable from a resolver that quietly stopped');
+  assert.equal(r.reconciled, 0, 'such a PR still never ships');
+});
+
+test('1003367 the regen-heal path announces the same refusal rather than retrying it forever', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 621, builder_id: 6, worktree_name: 'wt-exec2', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-exec2': PENDING },
+    mergeByBranch: { 'claude/wt-exec2': mergeableRed('failing_check:unit') },
+    refreshStaleImpl: async () => ({
+      refreshed: false, skipped: 'branch_modifies_executed_code', executes: ['.gitattributes'],
+    }),
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 1, 'the second heal path must not be the silent one');
+  assert.match(deps._calls.flag[0].reason, /^strand:branch_modifies_executed_code:\.gitattributes/);
+});
+
+test('1003367 an ordinary skip on either path still announces NOTHING', async () => {
+  // Red-capability for the two above: if every skip reason announced, they would pass
+  // for the wrong reason and the "definitive vs transient" distinction would be gone.
+  const deps = mkDeps({
+    rows: [{ task_id: 622, builder_id: 6, worktree_name: 'wt-ok', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }],
+    mergeByBranch: { 'claude/wt-ok': { merged: false, merged_now: false, number: 622, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: false, skipped: 'clone_failed' }),
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0,
+    'a transient infra miss must keep retrying quietly, not flag the builder');
+});