@bongos/core 1.19.714 → 1.19.724

package/tests/artist_gate.mjs

@@ -0,0 +1,234 @@
+// tests/artist_gate.mjs
+//
+// The artist gate (ADR 0241, task 1003575) — src/bongos/artist-gate.js.
+//
+// WHAT IS ACTUALLY WORTH PINNING HERE is not that the filter filters. It is the
+// four properties ADR 0241 spends its whole argument on, each of which is a way
+// this gate could quietly become the gate ADR 0162 retired:
+//
+//   1. IT READS A STATE, NEVER A VERDICT. Nothing here may consult who reviewed,
+//      what they thought, or whether they approved — only whether the review task
+//      is still open. A verdict-reading gate is pinned to a person and stalls when
+//      that person is away.
+//   2. IT NEVER HOLDS ANYTHING BUT AT 'strict'. `off` and `advisory` must be
+//      incapable of producing a halt, however many reviews are open.
+//   3. TIGHTENING IS NOT RETROACTIVE (§5). A review filed before the gate was
+//      raised must not hold, or raising the setting means inheriting a backlog for
+//      work nobody remembers — which is what makes a setting frightening to raise.
+//   4. THE REFUSAL EXPLAINS ITSELF (§4). It names what holds the deploy and which
+//      control releases it. ADR 0162's incident was made worse by a blocked state
+//      that did not say either.
+//
+// Pure: the module's read half is injectable, so nothing here needs a branding
+// pack, an env or a database.
+//
+// Run:  node --test tests/artist_gate.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+// Static named imports, not createRequire: the same shape tests/project_join_door.mjs
+// uses on the sibling kernel classifier. It reads better, and it is also what lets the
+// dead-code ratchet SEE these exports being exercised — a createRequire call is opaque
+// to it, so a fully-tested module reads as ten unused exports.
+import {
+  ARTIST_GATE_LEVELS,
+  RESOLVED_REVIEW_STATUSES,
+  ARTIST_REVIEW_SOURCE,
+  ARTIST_REVIEW_REF_PREFIX,
+  isArtistReview,
+  isReviewResolved,
+  unresolvedArtistReviews,
+  artistGateHalt,
+  artistGateMode,
+  artistGateSince,
+} from '../src/bongos/artist-gate.js';
+
+const gate = {
+  ARTIST_GATE_LEVELS,
+  RESOLVED_REVIEW_STATUSES,
+  ARTIST_REVIEW_SOURCE,
+  ARTIST_REVIEW_REF_PREFIX,
+  isArtistReview,
+  isReviewResolved,
+  unresolvedArtistReviews,
+  artistGateHalt,
+  artistGateMode,
+  artistGateSince,
+};
+
+// A cascade-filed artist review row, as the board holds it.
+const review = (over = {}) => ({
+  id: '9001',
+  title: 'Artist review: the copy and visuals that shipped in task 7001',
+  status: 'backlog',
+  source: 'cascade',
+  source_ref: 'cascade-artist-review-on-ship-7001',
+  created_at: '2026-09-10T00:00:00.000Z',
+  merged_into_task_id: null,
+  ...over,
+});
+
+// A pack reader, as branding().project would answer.
+const pack = (project) => () => ({ project });
+
+// ---------------------------------------------------------------------------
+// What counts as a review at all
+// ---------------------------------------------------------------------------
+
+test('only a CASCADE-filed artist review counts — a hand-filed task with a similar title does not', () => {
+  assert.equal(gate.isArtistReview(review()), true);
+  // Same source, different rule: another cascade must never hold a deploy this
+  // gate was not given authority over.
+  assert.equal(gate.isArtistReview(review({ source_ref: 'cascade-some-other-rule-7001' })), false);
+  // Same ref shape, not the cascade's source.
+  assert.equal(gate.isArtistReview(review({ source: 'manual' })), false);
+  assert.equal(gate.isArtistReview({ title: 'Artist review: please look at this' }), false);
+  assert.equal(gate.isArtistReview(null), false);
+});
+
+test('RESOLVED is a status, never a judgement — the two ways a task leaves the board, plus a merge', () => {
+  assert.equal(gate.isReviewResolved(review({ status: 'shipped' })), true);
+  assert.equal(gate.isReviewResolved(review({ status: 'abandoned' })), true, "triage's dismiss");
+  // A row merged into another is resolved even at an open status: its successor
+  // carries the work, and holding a deploy on a row nobody will action again is
+  // exactly the indefinite stall this gate must not have.
+  assert.equal(gate.isReviewResolved(review({ status: 'backlog', merged_into_task_id: '9100' })), true);
+  for (const status of ['backlog', 'ready', 'active', 'completed', 'confirmed']) {
+    assert.equal(gate.isReviewResolved(review({ status })), false, status);
+  }
+  assert.equal(gate.isReviewResolved(null), true, 'nothing is not an open request');
+});
+
+// ---------------------------------------------------------------------------
+// §5 — tightening is not retroactive
+// ---------------------------------------------------------------------------
+
+test('a review filed BEFORE the gate was raised does not hold; one filed after does', () => {
+  const older = review({ id: '9001', created_at: '2026-09-01T00:00:00.000Z' });
+  const newer = review({ id: '9002', created_at: '2026-09-12T00:00:00.000Z' });
+  const held = gate.unresolvedArtistReviews([older, newer], { since: '2026-09-10T00:00:00.000Z' });
+  assert.deepEqual(held.map((t) => t.id), ['9002']);
+});
+
+test('no cutoff means every open review counts — absent must not read as a licence to ignore', () => {
+  const rows = [review({ id: '9001' }), review({ id: '9002', created_at: '2020-01-01T00:00:00.000Z' })];
+  assert.equal(gate.unresolvedArtistReviews(rows, {}).length, 2);
+  assert.equal(gate.unresolvedArtistReviews(rows, { since: null }).length, 2);
+  assert.equal(gate.unresolvedArtistReviews(rows, { since: 'not a date' }).length, 2, 'junk is no cutoff, not no gate');
+});
+
+test('a review with an unreadable filing date is KEPT — the cutoff spares work, it does not excuse it', () => {
+  const held = gate.unresolvedArtistReviews([review({ created_at: null })], { since: '2026-09-10T00:00:00.000Z' });
+  assert.equal(held.length, 1);
+});
+
+test('resolved reviews are filtered out before the cutoff is even consulted', () => {
+  const rows = [review({ id: '9001', status: 'shipped' }), review({ id: '9002', status: 'abandoned' })];
+  assert.deepEqual(gate.unresolvedArtistReviews(rows, {}), []);
+});
+
+// ---------------------------------------------------------------------------
+// §2 / §4 — what holds, and what the refusal says
+// ---------------------------------------------------------------------------
+
+test("only 'strict' can hold — off and advisory are incapable of it, however many are open", () => {
+  const open = [review({ id: '9001' }), review({ id: '9002' })];
+  assert.equal(gate.artistGateHalt({ mode: 'off', reviews: open }), null);
+  assert.equal(gate.artistGateHalt({ mode: 'advisory', reviews: open }), null);
+  assert.ok(gate.artistGateHalt({ mode: 'strict', reviews: open }));
+});
+
+test("'strict' with nothing open holds nothing — the gate reads state, so no state is no hold", () => {
+  assert.equal(gate.artistGateHalt({ mode: 'strict', reviews: [] }), null);
+  assert.equal(gate.artistGateHalt({ mode: 'strict' }), null);
+});
+
+test('the refusal names WHAT holds the deploy and WHICH control releases it', () => {
+  const halt = gate.artistGateHalt({ mode: 'strict', reviews: [review({ id: '9001' }), review({ id: '9002' })] });
+  assert.equal(halt.code, 'ARTIST_REVIEW_UNRESOLVED');
+  assert.match(halt.message, /2 unresolved artist reviews/);
+  assert.match(halt.message, /strict/, 'and why it is holding at all');
+  // The two real ways out, and neither is "wait for someone".
+  assert.match(halt.detail, /task 9001, task 9002/);
+  assert.match(halt.detail, /resolve or dismiss/i);
+  assert.match(halt.detail, /override-request/);
+  assert.match(halt.detail, /OWNER/, 'the escape hatch is the owner, not any Metic+ (ADR 0241 §3)');
+  assert.match(halt.detail, /advisory/, 'and the setting that stops this happening again');
+  assert.deepEqual(halt.reviewIds, ['9001', '9002']);
+});
+
+test('the refusal never writes a bare #id — that autolinks to a GitHub issue that does not exist', () => {
+  const halt = gate.artistGateHalt({ mode: 'strict', reviews: [review()] });
+  assert.doesNotMatch(`${halt.message} ${halt.detail}`, /#\d/);
+});
+
+test('a TRUNCATED read reports a floor, and truncation can never change the verdict', () => {
+  const many = Array.from({ length: 3 }, (_, i) => review({ id: String(9000 + i) }));
+  const halt = artistGateHalt({ mode: 'strict', reviews: many, truncated: true });
+  assert.match(halt.message, /^3\+ unresolved artist reviews/, 'a floor, not a count it cannot stand behind');
+  // The verdict is identical either way: every row handed in is a holder, so one
+  // is enough and a capped read still holds.
+  assert.equal(artistGateHalt({ mode: 'strict', reviews: many }).code, halt.code);
+  // A single truncated row is still plural — "1+ review" would read as exactly one.
+  assert.match(artistGateHalt({ mode: 'strict', reviews: [review()], truncated: true }).message, /^1\+ unresolved artist reviews/);
+  assert.match(artistGateHalt({ mode: 'strict', reviews: [review()] }).message, /^1 unresolved artist review /);
+  // And truncation cannot manufacture a hold out of nothing.
+  assert.equal(artistGateHalt({ mode: 'strict', reviews: [], truncated: true }), null);
+});
+
+test('a long queue is summarised rather than dumped — five named, the rest counted', () => {
+  const many = Array.from({ length: 9 }, (_, i) => review({ id: String(9000 + i) }));
+  const halt = gate.artistGateHalt({ mode: 'strict', reviews: many });
+  assert.match(halt.detail, /and 4 more/);
+  assert.equal(halt.reviewIds.length, 9, 'but the machine-readable list is complete');
+});
+
+// ---------------------------------------------------------------------------
+// The reader — fail-closed in the direction the default already points
+// ---------------------------------------------------------------------------
+
+test('the level is read from the pack, and only the three declared levels are accepted', () => {
+  assert.equal(gate.artistGateMode(pack({ artistGate: 'off' })), 'off');
+  assert.equal(gate.artistGateMode(pack({ artistGate: 'advisory' })), 'advisory');
+  assert.equal(gate.artistGateMode(pack({ artistGate: 'strict' })), 'strict');
+});
+
+test("an absent, unreadable or unrecognised level resolves to 'strict' — the platform default", () => {
+  // Absent is the honest case for a self-hosted instance nobody ever pushed a
+  // setting to; it takes the default rather than dropping the policy.
+  assert.equal(gate.artistGateMode(pack({})), 'strict');
+  assert.equal(gate.artistGateMode(pack({ artistGate: '' })), 'strict');
+  // A value this core cannot read is a policy it does not know — and the safe
+  // direction here is the strict one, because strict only ever delays a pin move.
+  assert.equal(gate.artistGateMode(pack({ artistGate: 'Strict' })), 'strict');
+  assert.equal(gate.artistGateMode(pack({ artistGate: 'sort-of' })), 'strict');
+  assert.equal(gate.artistGateMode(() => { throw new Error('no pack'); }), 'strict');
+});
+
+test('the cutoff is read from the pack too, and junk reads as no cutoff', () => {
+  assert.equal(gate.artistGateSince(pack({ artistGateSince: '2026-09-10T00:00:00.000Z' })), '2026-09-10T00:00:00.000Z');
+  assert.equal(gate.artistGateSince(pack({ artistGateSince: '' })), null, 'the empty env value the transport always writes');
+  assert.equal(gate.artistGateSince(pack({ artistGateSince: 'whenever' })), null);
+  assert.equal(gate.artistGateSince(pack({})), null);
+  assert.equal(gate.artistGateSince(() => { throw new Error('no pack'); }), null);
+});
+
+// ---------------------------------------------------------------------------
+// The property the whole ADR turns on
+// ---------------------------------------------------------------------------
+
+test('NOTHING in the gate reads a verdict — only source, ref, status, merge and date', () => {
+  // A row carrying every judgement-shaped field the board could hand it must
+  // behave identically to one carrying none: if this ever fails, the gate has
+  // started reading an opinion and ADR 0162's objection applies again.
+  const opinionated = review({
+    grade: 'fail', verdict: 'rejected', approved_by: null, review_outcome: 'needs-work', artist_says: 'this is slop',
+  });
+  assert.deepEqual(
+    gate.unresolvedArtistReviews([opinionated], {}).map((t) => t.id),
+    gate.unresolvedArtistReviews([review()], {}).map((t) => t.id)
+  );
+  const a = gate.artistGateHalt({ mode: 'strict', reviews: [opinionated] });
+  const b = gate.artistGateHalt({ mode: 'strict', reviews: [review()] });
+  assert.deepEqual(a, b, 'an approving artist releases nothing; a disapproving one holds nothing extra');
+});

package/tests/artist_gate_release.mjs

@@ -0,0 +1,283 @@
+// tests/artist_gate_release.mjs
+//
+// THE ESCAPE HATCH (task 1003575, ADR 0241 §3) — releasing a deploy that an
+// unresolved artist review is holding.
+//
+// ADR 0241 was explicit that this must be the mechanism that already exists —
+// the override request — and NOT a second authority path. So a release is the
+// same table, the same request flow and the same decide endpoint as the grader
+// bypass, and everything worth pinning here is where the two DIVERGE:
+//
+//   • a release may be opened on a task that is NOT 'completed'. An artist review
+//     sits at `backlog`, and ADR 0241 guard #4 calls a strict project with no
+//     artist "the normal case" for a new instance — so a completed-only gate
+//     would make the one documented hatch unusable for exactly the case it was
+//     written for. (This is what the first cut of this task got wrong.)
+//   • only the PROJECT OWNER may decide it — narrower than the grader bypass's
+//     Archon floor, and enforced in the data layer so no second caller inherits
+//     the wider one.
+//   • approving it CONFIRMS NOTHING and PAYS NOTHING. The review stays open on
+//     the board; what stops is its hold on the pin.
+//   • it is never quiet: a self-release is permitted (a solo project would
+//     otherwise deadlock) and recorded as a self-override.
+//
+// DB-free: decideOverrideRequest's #538 `deps.pool` seam drives the txn with a
+// SQL-aware fake, and the module pool is stubbed on the doorway for the reads.
+//
+// Run:  node --test tests/artist_gate_release.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+
+// The reward port must be registered before decideOverrideRequest is driven
+// (the grader-bypass branch resolves it) — the override_attribution.mjs setup.
+const achievements = require('../modules/economy/achievements.js');
+achievements.evaluateAfterShip = async () => [];
+achievements.evaluateAfterCreditAward = async () => [];
+achievements.evaluateAfterClaim = async () => [];
+achievements.reconcileBuilderAchievements = async () => [];
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+
+const api = require('../src/module-api.js');
+
+// The module-level pool createOverrideRequest reads through. Stubbed BEFORE the
+// db facade is required, because db-overrides.js destructures it at load.
+let poolRows = [];
+let poolQueries = [];
+api.pool = { query: async (sql, params) => { poolQueries.push({ sql, params }); return { rows: poolRows }; } };
+
+const db = require('../modules/lifecycle/db.js');
+const overrides = require('../modules/lifecycle/db-overrides.js');
+
+const { test, summary } = makeRunner();
+
+const OWNER = 7;
+const ARCHON = 42;
+const ARTIST = 99;
+
+const review = (over = {}) => ({
+  id: 9001, status: 'backlog', source: 'cascade',
+  source_ref: 'cascade-artist-review-on-ship-7001', merged_into_task_id: null, ...over,
+});
+const ordinary = (over = {}) => ({ id: 555, status: 'backlog', source: 'manual', source_ref: null, merged_into_task_id: null, ...over });
+
+const flat = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
+const find = (queries, re) => queries.find((q) => re.test(flat(q)));
+const all = (queries, re) => queries.filter((q) => re.test(flat(q)));
+
+// =========================================================================
+// Which tasks are in the release class
+// =========================================================================
+
+await test('the release class is exactly "an artist review that is still open" — asked of core\'s one reader', () => {
+  assert.equal(overrides.gateReleaseTarget(review()), true);
+  // Resolved reviews are not held, so there is nothing to release.
+  assert.equal(overrides.gateReleaseTarget(review({ status: 'shipped' })), false);
+  assert.equal(overrides.gateReleaseTarget(review({ status: 'abandoned' })), false);
+  assert.equal(overrides.gateReleaseTarget(review({ merged_into_task_id: 9100 })), false);
+  // And an ordinary task never is — a release must not become a second way to
+  // wave a graded ship through at any status.
+  assert.equal(overrides.gateReleaseTarget(ordinary()), false);
+  assert.equal(overrides.gateReleaseTarget(ordinary({ status: 'completed' })), false);
+});
+
+// =========================================================================
+// Opening one
+// =========================================================================
+
+await test('a request MAY be opened on a backlog artist review — the case the hatch exists for', async () => {
+  poolRows = [review()]; poolQueries = [];
+  // The INSERT returns the created row; the fake answers every statement with
+  // poolRows, which is enough to prove the completed-check did not refuse.
+  const row = await db.createOverrideRequest({ taskId: 9001, requesterId: ARTIST, rationale: 'x'.repeat(30) });
+  assert.ok(row, 'the request was created rather than refused');
+  assert.ok(find(poolQueries, /^INSERT INTO task_override_requests/), 'it reached the insert');
+});
+
+await test('an ordinary task at backlog is STILL refused — the class is narrow, not an open door', async () => {
+  poolRows = [ordinary()]; poolQueries = [];
+  await assert.rejects(
+    () => db.createOverrideRequest({ taskId: 555, requesterId: ARTIST, rationale: 'x'.repeat(30) }),
+    (e) => e.code === 'TASK_NOT_COMPLETED' && e.currentStatus === 'backlog'
+  );
+  assert.equal(all(poolQueries, /^INSERT INTO task_override_requests/).length, 0, 'nothing was written');
+});
+
+await test('a RESOLVED artist review is refused too — a dismissed review holds nothing to release', async () => {
+  poolRows = [review({ status: 'shipped' })]; poolQueries = [];
+  await assert.rejects(
+    () => db.createOverrideRequest({ taskId: 9001, requesterId: ARTIST, rationale: 'x'.repeat(30) }),
+    (e) => e.code === 'TASK_NOT_COMPLETED'
+  );
+});
+
+// =========================================================================
+// Deciding one
+// =========================================================================
+
+// The txn fake: answers the target-task SELECT with `target`, the request UPDATE
+// with an approved row, and everything else with nothing.
+function txPool({ target, requesterId = ARTIST, decision = 'approve' }) {
+  return makeSqlAwareClient((s) => {
+    if (/FROM tasks WHERE id = \(SELECT task_id/.test(s)) return { rows: target ? [target] : [] };
+    if (/^UPDATE task_override_requests/.test(s)) {
+      return { rows: [{ id: 1, task_id: target ? target.id : 0, status: decision === 'approve' ? 'approved' : 'denied', requested_by_builder_id: requesterId }] };
+    }
+    if (/^UPDATE tasks/.test(s)) return { rows: [{ id: target.id, title: 't', credits_reward: 10, kind: 'feature' }] };
+    return { rows: [] };
+  });
+}
+
+const owner = async () => ({ id: OWNER });
+
+await test('an ARCHON who is not the owner cannot release — and the refusal costs the review nothing', async () => {
+  const pool = txPool({ target: review() });
+  await assert.rejects(
+    () => db.decideOverrideRequest(
+      { requestId: 1, archonId: ARCHON, decision: 'approve' },
+      { pool, getFoundingBuilder: owner, insertAuditLog: async () => {} }
+    ),
+    (e) => e.code === 'OVERRIDE_OWNER_ONLY'
+  );
+  assert.equal(all(pool._client.queries, /^UPDATE task_override_requests/).length, 0, 'the request stays open');
+  assert.ok(find(pool._client.queries, /^ROLLBACK/), 'and the txn rolls back');
+});
+
+await test('the OWNER releases it — and the release confirms nothing and pays nothing', async () => {
+  const audits = [];
+  const pool = txPool({ target: review() });
+  const out = await db.decideOverrideRequest(
+    { requestId: 1, archonId: OWNER, decision: 'approve' },
+    { pool, getFoundingBuilder: owner, insertAuditLog: async (a) => { audits.push(a); } }
+  );
+
+  assert.equal(out.request.status, 'approved');
+  assert.equal(out.gateRelease.taskId, '9001');
+  // The three things a grader bypass does that a release must NOT.
+  assert.equal(out.confirmResult, null, 'no confirm result — nothing was confirmed');
+  assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0, 'the review is NOT flipped to confirmed');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'and nothing is paid for work nobody did');
+  assert.ok(find(pool._client.queries, /^COMMIT/), 'the release commits');
+});
+
+await test('a SELF-release is permitted and is recorded as a self-override — never quiet (ADR 0241 §3)', async () => {
+  const audits = [];
+  const pool = txPool({ target: review(), requesterId: OWNER });
+  const out = await db.decideOverrideRequest(
+    { requestId: 1, archonId: OWNER, decision: 'approve' },
+    { pool, getFoundingBuilder: owner, insertAuditLog: async (a) => { audits.push(a); } }
+  );
+  // Permitted: a solo instance where the owner is also the builder and the artist
+  // would otherwise deadlock, which ADR 0241 §3 rules out explicitly.
+  assert.equal(out.gateRelease.selfOverride, true);
+  assert.equal(audits.length, 1, 'exactly one audit line for the act');
+  assert.equal(audits[0].builderId, OWNER);
+  assert.equal(audits[0].requestBodyRedacted.override_kind, 'artist_gate_release');
+  assert.equal(audits[0].requestBodyRedacted.self_override, true, 'the ledger says WHO waved through their OWN work');
+  assert.equal(audits[0].requestBodyRedacted.task_id, '9001');
+});
+
+await test('a release of SOMEONE ELSE\'S review is audited too, and marked as not a self-override', async () => {
+  const audits = [];
+  const pool = txPool({ target: review(), requesterId: ARTIST });
+  const out = await db.decideOverrideRequest(
+    { requestId: 1, archonId: OWNER, decision: 'approve' },
+    { pool, getFoundingBuilder: owner, insertAuditLog: async (a) => { audits.push(a); } }
+  );
+  assert.equal(out.gateRelease.selfOverride, false);
+  assert.equal(audits.length, 1, 'every release is on the record, self or not');
+});
+
+await test('an audit write that FAILS does not roll back a decision the owner made', async () => {
+  const pool = txPool({ target: review() });
+  const out = await db.decideOverrideRequest(
+    { requestId: 1, archonId: OWNER, decision: 'approve' },
+    { pool, getFoundingBuilder: owner, insertAuditLog: async () => { throw new Error('audit table down'); } }
+  );
+  assert.equal(out.request.status, 'approved', 'the release is durable in the request row');
+  assert.ok(find(pool._client.queries, /^COMMIT/));
+});
+
+await test('DENYING a release changes nothing — the review goes on holding the pin', async () => {
+  const pool = txPool({ target: review(), decision: 'deny' });
+  const out = await db.decideOverrideRequest(
+    { requestId: 1, archonId: OWNER, decision: 'deny' },
+    { pool, getFoundingBuilder: owner, insertAuditLog: async () => {} }
+  );
+  assert.equal(out.request.status, 'denied');
+  assert.equal(out.gateRelease, null, 'nothing was released');
+  assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0);
+});
+
+await test('the GRADER BYPASS is untouched: a completed ordinary task still needs only an Archon', async () => {
+  // The owner check must not have leaked onto the path it does not belong to —
+  // that would be a silent tightening of an unrelated authority.
+  const pool = txPool({ target: ordinary({ status: 'completed' }) });
+  const out = await db.decideOverrideRequest(
+    { requestId: 1, archonId: ARCHON, decision: 'approve' },
+    { pool, getFoundingBuilder: owner, insertAuditLog: async () => {} }
+  );
+  assert.equal(out.gateRelease, null, 'not a release');
+  assert.ok(out.confirmResult, 'the ordinary bypass still confirms');
+  assert.ok(find(pool._client.queries, /^UPDATE tasks/), 'and still flips the task');
+});
+
+// =========================================================================
+// The gate READS the release
+// =========================================================================
+
+await test('an approved override is excluded by the gate\'s own read — a released review stops holding', async () => {
+  poolRows = []; poolQueries = [];
+  await db.listOpenArtistReviews({ source: 'cascade', refPrefix: 'cascade-artist-review-on-ship-', resolvedStatuses: ['shipped', 'abandoned'] });
+  const q = flat(poolQueries[0]);
+  // The exclusion has to be IN THE QUERY: the release is not a status change, so
+  // nothing downstream would notice it otherwise — which is precisely how the
+  // first cut of this task shipped an escape hatch that released nothing.
+  assert.match(q, /NOT EXISTS \( SELECT 1 FROM task_override_requests r WHERE r\.task_id = t\.id AND r\.status = 'approved'\)/);
+  assert.deepEqual(poolQueries[0].params.slice(0, 3), ['cascade', 'cascade-artist-review-on-ship-%', ['shipped', 'abandoned']]);
+});
+
+await test('the scan asks for ONE row past its cap, so "there are more" needs no second COUNT', async () => {
+  poolRows = []; poolQueries = [];
+  const out = await db.listOpenArtistReviews({ source: 'cascade', refPrefix: 'p-', resolvedStatuses: [], limit: 3 });
+  assert.equal(poolQueries[0].params[3], 4, 'cap + 1');
+  assert.deepEqual(out, { reviews: [], truncated: false });
+
+  // With cap+1 rows back, the extra one is dropped and truncation is declared —
+  // a COUNT that could disagree with the page it describes is what this avoids.
+  poolRows = [{ id: 1 }, { id: 2 }, { id: 3 }, { id: 4 }]; poolQueries = [];
+  const full = await db.listOpenArtistReviews({ source: 'cascade', refPrefix: 'p-', resolvedStatuses: [], limit: 3 });
+  assert.equal(full.reviews.length, 3);
+  assert.equal(full.truncated, true);
+});
+
+await test('the owner-check seam is NODE_ENV-gated like deps.pool — it cannot be swapped in production', () => {
+  // The one check deciding who may release a deploy-blocking review must not be
+  // overridable by an options object that happens to carry the key: a batch decide
+  // path or a careless options-forwarding refactor would otherwise hand an
+  // attacker-shaped `{ getFoundingBuilder: () => me }` straight past the gate.
+  //
+  // Asserted on the RESOLVER rather than through decideOverrideRequest, because
+  // the deps.pool seam is gated the same way — so a "production" run of the whole
+  // function fails on a real database connection long before it reaches this
+  // check, and a test that passed on THAT would be proving nothing.
+  const injected = async () => ({ id: ARCHON });
+  const doorway = api.getFoundingBuilder;
+
+  assert.equal(overrides.resolveOwnerReader({ getFoundingBuilder: injected }, { NODE_ENV: 'test' }), injected,
+    'a test keeps its seam');
+  for (const NODE_ENV of ['production', 'development', undefined]) {
+    assert.equal(overrides.resolveOwnerReader({ getFoundingBuilder: injected }, { NODE_ENV }), doorway,
+      `NODE_ENV=${NODE_ENV}: the injected reader is ignored and the doorway decides`);
+  }
+  // And with nothing injected it is the doorway either way.
+  assert.equal(overrides.resolveOwnerReader({}, { NODE_ENV: 'test' }), doorway);
+});
+
+summary();