@bongos/core 1.19.715 → 1.19.725

package/tests/claim_error_surface.mjs

@@ -13,8 +13,10 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
+import { readFileSync } from 'node:fs';
+
 const require = createRequire(import.meta.url);
-const { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan } = require('../scripts/gds/claim.js');
+const { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, worktreeDetectionNote } = require('../scripts/gds/claim.js');
 
 let passed = 0;
 let failed = 0;
@@ -29,6 +31,12 @@ const envelope = (code, details = {}, message = code, status = 409) => ({
 });
 const text = (r) => r.lines.join('\n');
 
+// task 1002592 — populated by the guard test below, then checked against the
+// codes the server can actually refuse a claim with. Declared here so the drift
+// guard reads the SAME array the coverage test exercises rather than a second
+// hand-typed copy that could itself drift.
+const CLAIM_REFUSAL_CODES_UNDER_TEST = [];
+
 // The regression guard: no refusal may ever render a raw object.
 t('never dumps [object Object] for any known code', () => {
   const codes = [
@@ -37,8 +45,16 @@ t('never dumps [object Object] for any known code', () => {
     'newcomer_must_ship_first', 'ALREADY_CLAIMED', 'MODULE_CONFLICT',
     'TOUCHES_CONFLICT', 'TASK_NOT_READY', 'TASK_NOT_FOUND', 'DEPS_NOT_SHIPPED',
     'OPEN_BLOCKER', 'GOAL_MEMBERSHIP_REQUIRED',
+    // task 1002592: REBASE_REQUIRED was missing from this list for its whole
+    // life, which is exactly why its rendering gap survived — the guard that
+    // looked like it covered every refusal only covered the ones someone
+    // remembered to type. The drift guard at the bottom of this file now checks
+    // this array against what the server can actually throw.
+    'REBASE_REQUIRED', 'REWARD_REQUIRED', 'BUILDER_INACTIVE', 'INSUFFICIENT_RANK',
+    'XENOS_RESTRICTED', 'rank_too_low_for_task',
     'some_unmapped_future_code',
   ];
+  CLAIM_REFUSAL_CODES_UNDER_TEST.push(...codes);
   for (const c of codes) {
     const out = text(formatClaimFailure(envelope(c, { active_task_id: 5 }, 'msg'), 12));
     assert.ok(!out.includes('[object Object]'), `${c} produced a raw object dump`);
@@ -191,5 +207,151 @@ t('claimErrorInfo: reads envelope and flat shapes identically', () => {
   assert.equal(flat.code, 'X'); assert.equal(flat.d.a, 1);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002592 — three measured defects in this surface.
+// ---------------------------------------------------------------------------
+
+// 1. REBASE_REQUIRED. ADR 0120 part 3's gate refuses EVERY new claim, so it is
+// the refusal a builder is most stuck behind, and it was the only one with no
+// branch: it printed `Claim failed (409) [REBASE_REQUIRED]: REBASE_REQUIRED.`
+// while a fully-formed remediation menu sat unread in the body.
+const REBASE_HINT = 'Your queue is gated: 1 confirmed task(s) await your rebase (task 1003575). Clear it with /strand-fix N (works on any machine), or rebase the branch and re-ship — /merge-mode only if this machine has a GitHub push credential.';
+
+t('REBASE_REQUIRED: names the owed tasks and relays the server hint', () => {
+  const out = text(formatClaimFailure(envelope('REBASE_REQUIRED', {
+    hint: REBASE_HINT,
+    rebaseTasks: [{ id: 1003575, title: 'The artist deploy gate', reason: 'strand:unresolvable_conflict:docs/module-api-changelog.md' }],
+  }), 1002592));
+  assert.match(out, /task 1003575/, 'must name the owed task id');
+  assert.match(out, /The artist deploy gate/, 'must name the owed task title');
+  assert.match(out, /strand:unresolvable_conflict/, 'must surface why it was flagged');
+  assert.match(out, /strand-fix/, 'must relay the hint, which leads with the universally-available exit');
+  // The regression proper: the old output was ONLY the bare code echo.
+  assert.ok(!/^Claim failed \(409\) \[REBASE_REQUIRED\]: REBASE_REQUIRED\.$/m.test(out),
+    'must not fall through to the bare code echo');
+});
+
+t('REBASE_REQUIRED: still guides when the server sends no hint and no task list', () => {
+  const out = text(formatClaimFailure(envelope('REBASE_REQUIRED', {}), 5));
+  assert.match(out, /gated/i, 'must say the queue is gated');
+  assert.match(out, /strand-fix|builder-release/, 'must name a way out even with an empty body');
+});
+
+t('REBASE_REQUIRED: server prose is clipped, flattened and capped before it hits the terminal', () => {
+  const out = text(formatClaimFailure(envelope('REBASE_REQUIRED', {
+    hint: 'H'.repeat(2000),
+    rebaseTasks: Array.from({ length: 50 }, (_, i) => ({
+      id: 1000 + i,
+      title: `T${'i'.repeat(400)}`,
+      reason: 'line oneline two\nline three',
+    })),
+  }), 5));
+  assert.ok(!//.test(out), 'escape sequences must never reach the terminal verbatim');
+  assert.ok(!/line one.*\n.*line two/.test(out), 'a multi-line reason must be flattened onto its own single line');
+  for (const line of out.split('\n')) {
+    assert.ok(line.length <= 620, `a rendered line ran to ${line.length} chars — the cap is not holding`);
+  }
+  const listed = out.split('\n').filter((l) => /^ {2}- task /.test(l)).length;
+  assert.ok(listed > 0 && listed <= 20, `expected a bounded task list, got ${listed} rows`);
+});
+
+// 2. The fallback floor. Any code the server sends a hint for must print it,
+// so the NEXT unmapped code cannot be mute the way REBASE_REQUIRED was.
+t('fallback: an unmapped code still prints the server hint when one is supplied', () => {
+  const out = text(formatClaimFailure(
+    envelope('some_future_gate', { hint: 'Do the thing, then retry.' }, 'nope', 409), 3));
+  assert.match(out, /some_future_gate/, 'still names the code');
+  assert.match(out, /Do the thing, then retry\./, 'and prints the way forward');
+});
+
+t('fallback: no hint means no invented guidance', () => {
+  const out = text(formatClaimFailure(envelope('some_future_gate', {}, 'nope', 409), 3));
+  assert.match(out, /some_future_gate/);
+  assert.ok(!/undefined/.test(out), 'must not print a stray undefined when no hint exists');
+});
+
+// 3. The original bug report: a failed worktree DETECTION arrives disguised as a
+// claim CONFLICT. The note must fire when null is WRONG and stay silent when
+// null is the correct answer — that distinction is the whole fix.
+t('worktreeDetectionNote: silent when the worktree WAS named (the refusal is genuine)', () => {
+  assert.deepEqual(worktreeDetectionNote({ worktree: 'task-42', isMainCheckout: false }, 42), []);
+});
+
+t('worktreeDetectionNote: silent in the MAIN CHECKOUT, where a null name is correct', () => {
+  assert.deepEqual(worktreeDetectionNote({ worktree: null, isMainCheckout: true }, 42), [],
+    'blaming path detection here would send the reader down exactly the wrong path');
+});
+
+t('worktreeDetectionNote: fires on a LINKED worktree with no name, and offers --worktree', () => {
+  const out = worktreeDetectionNote({ worktree: null, isMainCheckout: false }, 42).join('\n');
+  assert.match(out, /could not name its worktree/i);
+  assert.match(out, /linked worktree, so a name was expected/i, 'must say a name was expected here');
+  assert.match(out, /--worktree/, 'must print the explicit fallback');
+  assert.match(out, /claim\.js 42 --worktree/, 'the fallback must be runnable as printed');
+  assert.match(out, /not a claim conflict/i, 'must correct the misreading the report describes');
+});
+
+t('worktreeDetectionNote: fires when the tree kind is UNKNOWN, and hedges rather than asserts', () => {
+  const out = worktreeDetectionNote({ worktree: null, isMainCheckout: null }, 42).join('\n');
+  assert.match(out, /--worktree/);
+  assert.match(out, /not recognisable as the main checkout/i);
+  assert.ok(!/linked worktree, so a name was expected/i.test(out),
+    'must not claim this IS a linked worktree when the probe could not tell');
+});
+
+t('worktreeDetectionNote: a missing ctx is silent, never a crash', () => {
+  assert.deepEqual(worktreeDetectionNote(undefined, 42), []);
+  assert.deepEqual(worktreeDetectionNote({}, 42), [], 'an empty ctx knows nothing — say nothing');
+});
+
+t('session_already_has_active_claim: carries the detection note only when ctx warrants it', () => {
+  const e = envelope('session_already_has_active_claim', { active_task_id: 7, active_task_title: 'Other' });
+  const withNote = text(formatClaimFailure(e, 42, { worktree: null, isMainCheckout: false }));
+  assert.match(withNote, /--worktree/, 'an unnamed linked worktree must get the note');
+  const named = text(formatClaimFailure(e, 42, { worktree: 'task-42', isMainCheckout: false }));
+  assert.ok(!/--worktree/.test(named), 'a named worktree means the conflict is real — no note');
+  const mainCheckout = text(formatClaimFailure(e, 42, { worktree: null, isMainCheckout: true }));
+  assert.ok(!/--worktree/.test(mainCheckout), 'the main checkout must stay silent');
+  const noCtx = text(formatClaimFailure(e, 42));
+  assert.ok(!/--worktree/.test(noCtx), 'no ctx (every pre-existing caller) must behave as before');
+  assert.match(noCtx, /#7/, 'and must still render the original guidance');
+});
+
+// ---------------------------------------------------------------------------
+// The drift guard. REBASE_REQUIRED was thrown by the server and absent from the
+// coverage list above for its whole life, which is how a mute refusal survived a
+// test that looked like it covered every refusal. Derive the truth from the
+// server source instead of trusting a hand-typed array.
+//
+// A static scan fails SILENT — finding nothing looks identical to finding no
+// problem — so this asserts the extraction actually worked before it asserts
+// anything about the result.
+// ---------------------------------------------------------------------------
+t('drift guard: every code claimTask can throw is covered above (or consciously excluded)', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/db-claims.js', import.meta.url), 'utf8');
+  const start = src.indexOf('async function claimTask');
+  assert.ok(start !== -1, 'could not find claimTask in db-claims.js — the guard is reading the wrong file');
+  const thrown = new Set(
+    [...src.slice(start).matchAll(/throw \{\s*code: '([A-Za-z_]+)'/g)].map((m) => m[1])
+  );
+
+  // Fail loudly on a scan that found nothing, and on one that lost its canary.
+  assert.ok(thrown.size >= 8, `extracted only ${thrown.size} codes — the regex has drifted off the source shape`);
+  assert.ok(thrown.has('REBASE_REQUIRED'), 'canary missing: the extraction is not seeing real throws');
+  assert.ok(thrown.has('TASK_NOT_FOUND'), 'canary missing: the extraction is not seeing real throws');
+
+  // Codes that exist on the claim path but can never reach the single-claim CLI.
+  // Listed explicitly so adding a server code forces a decision rather than
+  // silently widening this exemption.
+  const NOT_A_SINGLE_CLAIM_REFUSAL = new Set([
+    'BATCH_EMPTY', 'BATCH_DUPLICATE_IDS', 'BATCH_FAILED', // the hall's bulk-claim route
+  ]);
+
+  const covered = new Set(CLAIM_REFUSAL_CODES_UNDER_TEST);
+  const missing = [...thrown].filter((c) => !covered.has(c) && !NOT_A_SINGLE_CLAIM_REFUSAL.has(c));
+  assert.deepEqual(missing, [],
+    `these server codes are refusable but untested here — add them to the codes[] array above (or to NOT_A_SINGLE_CLAIM_REFUSAL with a reason): ${missing.join(', ')}`);
+});
+
 console.log(`\nclaim_error_surface: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/claude_materialize.mjs

@@ -510,6 +510,15 @@ t('renderInstanceClaudeMd: brand-substituted — names the instance + its hall/c
   assert.ok(!md.toLowerCase().includes('amazonprimea') && !md.includes('~/.config/otb'), 'no founder literal in the starter');
 });
 
+t('renderInstanceClaudeMd: the first-run bootstrap precedes every bongos instruction', () => {
+  const md = tmpl.renderInstanceClaudeMd({ identity: { productName: 'Acme' } });
+  const iNpm = md.indexOf('npm install');
+  const iStart = md.indexOf('bongos start');
+  assert.ok(iNpm > 0, 'names npm install at all — without it a fresh clone has no bongos command');
+  assert.ok(iStart > iNpm, 'npm install comes BEFORE the first bongos instruction, or the agent hits command not found');
+  assert.ok(/@bongos\/core/.test(md), 'explains WHY: the CLI ships inside the dependency');
+});
+
 t('renderInstanceClaudeMd: degrades cleanly on a minimal branding (no world dup, defaults currency)', () => {
   const md = tmpl.renderInstanceClaudeMd({ identity: { productName: 'Solo', worldName: 'Solo' } });
   assert.ok(md.startsWith('# Solo — Project Memory'));

package/tests/cli_exit_no_abort.mjs

@@ -32,6 +32,7 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { spawnSync, spawn } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
@@ -40,6 +41,10 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const API = path.join(ROOT, 'scripts', 'gds', 'api.js');
 const MAIN_AUDIT = path.join(ROOT, 'scripts', 'gds', 'main-audit.js');
 const CLI_LIB = path.join(ROOT, 'scripts', 'gds', 'cli-lib.js');
+// task 1002592 — the next two CLIs found ABORTING, converted under task 1002734's
+// standing rule (evidence, not a blanket sweep).
+const CLAIM = path.join(ROOT, 'scripts', 'gds', 'claim.js');
+const LAND_WATCH = path.join(ROOT, 'scripts', 'gds', 'land-watch.js');
 const DEAD_BASE = 'http://127.0.0.1:9'; // discard port — connection refused, instantly
 
 // Point a CLI at a base URL. DERIVED, not hardcoded: instance-config resolves
@@ -47,8 +52,14 @@ const DEAD_BASE = 'http://127.0.0.1:9'; // discard port — connection refused,
 // literal here would (a) add to the legacy-GDS ratchet the rename is retiring and
 // (b) silently stop steering the CLI on any instance whose brand pack sets a
 // different prefix — the test would then hit the REAL API instead of the stub.
-const { envPrefix } = createRequire(import.meta.url)(path.join(ROOT, 'src', 'instance-config.js'));
+const ic = createRequire(import.meta.url)(path.join(ROOT, 'src', 'instance-config.js'));
+const { envPrefix } = ic;
 const API_BASE_ENV = `${envPrefix()}_API_BASE`;
+// Derived for the same reason the base env is: a literal would stop steering the
+// CLI on any instance whose brand pack renames the config dir, and the test would
+// then read the operator's REAL session instead of the throwaway one.
+const CONFIG_DIR_NAME = ic.configDirName();
+const SESSION_FILENAME = ic.SESSION_FILENAMES[0];
 const atBase = (url) => ({ [API_BASE_ENV]: url });
 
 // The native abort prints this and nothing else can be relied on; it is NOT a
@@ -104,8 +115,79 @@ const s = http.createServer((q, r) => {
 s.listen(0, '127.0.0.1', () => console.log('PORT=' + s.address().port));
 `;
 
-function startStub() {
-  const proc = spawn(process.execPath, ['-e', STUB_SRC], { stdio: ['ignore', 'pipe', 'ignore'] });
+// task 1002592 — claim.js needs a stub that ROUTES: the claim POST decides which
+// path is under test, while every other call it makes (learnings, recall, /me, the
+// task fetch land-watch does) is best-effort and only has to answer something
+// parseable. `status` picks the path: 409 serves the real REBASE_REQUIRED envelope
+// so the refusal rendering is proved end-to-end, 201 serves a claim so the heavier
+// success teardown runs.
+const claimStubSrc = (status) => `
+const http = require('node:http');
+const REFUSAL = ${JSON.stringify({
+  error: {
+    code: 'REBASE_REQUIRED',
+    message: 'REBASE_REQUIRED',
+    details: {
+      hint: 'Your queue is gated: 1 confirmed task(s) await your rebase (task 1003575). Clear it with /strand-fix N (works on any machine).',
+      rebaseTasks: [{ id: 1003575, title: 'Stub owed task', reason: 'strand:unresolvable_conflict:stub.md' }],
+    },
+  },
+})};
+const CLAIMED = ${JSON.stringify({
+  claim: { id: 9001 },
+  task: {
+    id: 4242, title: 'Stub task', version_id: 'BONGOS-V2', touches: [],
+    credits_reward: 0, priority: 1, description: '', parallel_safe: false,
+  },
+  reward: { mode: 'cost-plus-only', perTaskCredit: false },
+})};
+const s = http.createServer((q, r) => {
+  let body = '';
+  q.on('data', (c) => { body += c; });
+  q.on('end', () => {
+    const isClaim = q.method === 'POST' && /\\/claims$/.test(q.url.split('?')[0]);
+    const code = isClaim ? ${status} : 200;
+    const payload = isClaim ? (${status} === 201 ? CLAIMED : REFUSAL) : {};
+    r.writeHead(code, { 'Content-Type': 'application/json' });
+    r.end(JSON.stringify(payload));
+  });
+});
+s.listen(0, '127.0.0.1', () => console.log('PORT=' + s.address().port));
+`;
+
+// task 1002592 — claim.js and land-watch.js read a SESSION and (for land-watch) a
+// breadcrumb directory, both under the config home, which instance-config derives
+// from os.homedir(). Node resolves that from HOME / USERPROFILE, so overriding both
+// gives each test a throwaway config tree: the developer's real session is never
+// read, their real breadcrumb dir is never written, and a test can plant exactly
+// the state it needs. Without this, planting a breadcrumb would mean writing into
+// the operator's own ~/.config and racing whatever land-watch is genuinely tracking.
+function makeHome({ apiBase = DEAD_BASE, breadcrumbTaskId = null } = {}) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'cli-exit-home-'));
+  const cfg = path.join(home, '.config', CONFIG_DIR_NAME);
+  fs.mkdirSync(cfg, { recursive: true });
+  fs.writeFileSync(
+    path.join(cfg, SESSION_FILENAME),
+    JSON.stringify({ token: 'stub-token-not-a-real-credential', api_base: apiBase }),
+    'utf8'
+  );
+  if (breadcrumbTaskId) {
+    const pending = path.join(cfg, 'pending-land');
+    fs.mkdirSync(pending, { recursive: true });
+    fs.writeFileSync(
+      path.join(pending, `${breadcrumbTaskId}.json`),
+      JSON.stringify({ taskId: String(breadcrumbTaskId), at: new Date().toISOString() }),
+      'utf8'
+    );
+  }
+  return home;
+}
+
+const isolatedHome = (home) => ({ HOME: home, USERPROFILE: home });
+
+function startStub(opts = {}) {
+  const src = opts.claimStatus ? claimStubSrc(opts.claimStatus) : STUB_SRC;
+  const proc = spawn(process.execPath, ['-e', src], { stdio: ['ignore', 'pipe', 'ignore'] });
   return new Promise((resolve, reject) => {
     let buf = '';
     const timer = setTimeout(() => { proc.kill(); reject(new Error('stub server did not report a port')); }, 10_000);
@@ -152,6 +234,177 @@ test('api.js routes its post-request exits through cliExit, not process.exit', (
   assert.match(afterRequest, /cliExit\(/, 'the post-request paths must set the exit code via cliExit');
 });
 
+// ---- claim.js + land-watch.js (task 1002592) -------------------------------
+//
+// WHAT EACH KIND OF TEST BELOW ACTUALLY GUARDS — measured, not assumed, because
+// claiming otherwise is how a suite comes to look like coverage it does not have.
+// With the hard exits deliberately restored in both scripts, the STATIC checks
+// went red and every behavioural test below stayed GREEN, including the ones that
+// make a real HTTP round trip to the local stub. That reproduces, for these two
+// CLIs, what task 1003772 found for main-audit.js: a localhost stub tears down too
+// little machinery to trip the abort. The aborts these tests exist for were all
+// measured against the REAL API over TLS.
+//
+// So: the static checks are the net for the ABORT. The behavioural tests are still
+// worth their runtime — they pin the exit CODES callers branch on (claim 0 vs 1,
+// land-watch 0 on every path), they prove the scripts TERMINATE rather than hang,
+// which is the documented conversion trap, and the refusal case proves the
+// REBASE_REQUIRED rendering reaches a terminal end-to-end.
+// Both were MEASURED aborting 3/3 on Windows 11 / Node v24.19.0 before the
+// conversion, and 5/5 clean after — claim.js on its refusal path (exit 127 where
+// it computed 1) and land-watch.js on its network path (exit 127 where it always
+// intends 0). Task 1002734 deliberately left the wider CLI surface alone and set
+// the bar at "found ABORTING, not merely fetching-then-exiting"; these two cleared
+// it. Neither file arms a timer, so the documented conversion trap — a hard exit
+// masking a leak, turning the crash into a HANG — does not apply here; the
+// behavioural runs below still assert termination rather than assuming it.
+
+test('claim.js routes its post-request exits through cliExit, not process.exit', () => {
+  const src = fs.readFileSync(CLAIM, 'utf8');
+  // The pre-request guards stay as hard exits, exactly as api.js kept its two:
+  // the worktree guard and the usage banner both run before any network work.
+  // Everything from the claim POST onward must drain instead.
+  // Anchor on the CLAIM request itself, not on `cliClient()` — the client is also
+  // built inside best-effort helpers defined near the top of the file, so that
+  // string would slice from the wrong place and quietly measure nothing.
+  const marker = 'let r = await postClaim();';
+  const i = src.indexOf(marker);
+  assert.ok(i !== -1, 'could not find the claim request site in claim.js — this guard is reading the wrong shape');
+  assert.equal(src.split(marker).length - 1, 1, 'the anchor must be unique or the slice is arbitrary');
+  const afterRequest = src.slice(i).replace(/\/\/[^\n]*/g, '');
+  assert.ok(
+    !/process\.exit\s*\(/.test(afterRequest),
+    'no process.exit() may remain after the claim request is issued — that is what aborts node on Windows '
+    + 'and turns a refusal\'s exit 1 into 127'
+  );
+  assert.match(afterRequest, /cliExit\(/, 'the post-request paths must set the exit code via cliExit');
+});
+
+test('claim.js keeps its PRE-request guards as hard exits', () => {
+  const src = fs.readFileSync(CLAIM, 'utf8');
+  const beforeRequest = src.slice(0, src.indexOf('let r = await postClaim();'));
+  assert.match(
+    beforeRequest, /process\.exit\s*\(/,
+    'the usage + worktree guards run before any network work; converting them buys nothing '
+    + 'and a cliExit there would let execution continue past a refusal'
+  );
+});
+
+test('land-watch.js routes every exit through cliExit, not process.exit', () => {
+  const src = fs.readFileSync(LAND_WATCH, 'utf8');
+  const stripped = src.replace(/\/\/[^\n]*/g, '');
+  assert.ok(
+    !/process\.exit\s*\(/.test(stripped),
+    'no process.exit() may remain in land-watch.js — it is HOOK-INVOKED and exits 0 on every path '
+    + 'on purpose, so the abort made the one script written never to fail always report 127'
+  );
+  assert.match(src, /cliExit\(/, 'the exit paths must set the exit code via cliExit');
+});
+
+test('land-watch.js exits 0 and TERMINATES with no pending lands (fast path, no network)', () => {
+  const r = spawnSync(process.execPath, [LAND_WATCH], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    timeout: 60_000, // dropping a hard exit trades a crash for a HANG if a handle leaks
+    env: { ...process.env, ...atBase(DEAD_BASE), ...isolatedHome(makeHome()) },
+  });
+  assert.notEqual(r.signal, 'SIGTERM', 'timed out — draining left a handle armed');
+  assert.doesNotMatch(r.stderr || '', ABORT_RE, `native abort on the land-watch path:\n${r.stderr}`);
+  assert.equal(r.status, 0, `land-watch must exit 0 on every path, got ${r.status} (127 = the abort)`);
+});
+
+// THE PATH THAT ACTUALLY ABORTED. The fast path above returns before any network
+// work, so on its own it proves nothing about this bug: the measured 3/3 aborts
+// were on the NETWORK path (breadcrumb present → watch() → fetchTask() → a real
+// round trip → exit). Plant a breadcrumb in an isolated HOME and serve a real 200
+// so the full teardown runs, exactly as api.js's stub-server test does.
+test('land-watch.js exits 0 after a REAL request — the teardown that aborted 3/3', async () => {
+  const { proc, port } = await startStub();
+  try {
+    for (let i = 0; i < 3; i++) {
+      // classifyLand drops a non-shipped breadcrumb after one pass, so re-plant it.
+      const home = makeHome({ apiBase: `http://127.0.0.1:${port}`, breadcrumbTaskId: '4242' });
+      const r = spawnSync(process.execPath, [LAND_WATCH], {
+        cwd: ROOT,
+        encoding: 'utf8',
+        timeout: 60_000,
+        env: { ...process.env, ...atBase(`http://127.0.0.1:${port}`), ...isolatedHome(home) },
+      });
+      assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — draining left a handle armed`);
+      assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively on the network path:\n${r.stderr}`);
+      assert.equal(r.status, 0, `run ${i + 1} exited ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+      // Prove the run really took the network path rather than the idle fast-path,
+      // or this test would silently degrade into the one above.
+      assert.doesNotMatch(r.stderr || '', /no pending lands/,
+        `run ${i + 1} took the idle fast path — the breadcrumb was not seen, so the network teardown was never exercised`);
+    }
+  } finally {
+    proc.kill();
+  }
+});
+
+// claim.js. Its exits are post-request and it was measured aborting 3/3 on the
+// refusal path. Both paths below run against the stub in an isolated HOME with a
+// throwaway session, so no real API is touched and the developer's own config is
+// never read or written. `--here` because CI may check out the MAIN checkout,
+// where the worktree guard would refuse at exit 2 before any request is made.
+test('claim.js exits 1 without aborting on a REFUSED claim — measured 3/3 aborting before', async () => {
+  const { proc, port } = await startStub({ claimStatus: 409 });
+  try {
+    const home = makeHome({ apiBase: `http://127.0.0.1:${port}` });
+    for (let i = 0; i < 3; i++) {
+      const r = spawnSync(process.execPath, [CLAIM, '4242', '--here'], {
+        cwd: ROOT,
+        encoding: 'utf8',
+        timeout: 60_000,
+        env: { ...process.env, ...atBase(`http://127.0.0.1:${port}`), ...isolatedHome(home) },
+      });
+      assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — draining left a handle armed`);
+      assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively:\n${r.stderr}`);
+      assert.equal(r.status, 1, `a refused claim must exit 1, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+      // End-to-end proof that the new REBASE_REQUIRED rendering reaches a terminal,
+      // not just the unit test: the stub refuses with that exact envelope.
+      //
+      // Assert on wording only the BRANCH produces. Matching the hint text alone
+      // would pass with the branch disabled, because the generic fallback also
+      // prints d.hint now — measured, not assumed: a probe that disabled the branch
+      // kept this test green until these two assertions replaced it.
+      assert.match(r.stderr, /queue is gated/i, 'the REBASE_REQUIRED branch must render, not the bare fallback');
+      assert.match(r.stderr, /flagged: strand:unresolvable_conflict/, 'the branch must surface why the task was flagged');
+      assert.match(r.stderr, /strand-fix/, 'the server hint must reach the builder, not be dropped on the floor');
+      assert.match(r.stderr, /task 1003575/, 'the owed task must be named');
+    }
+  } finally {
+    proc.kill();
+  }
+});
+
+// THE OPEN QUESTION THE TASK FLAGGED, now answered rather than assumed: a
+// SUCCESSFUL claim leaves main() by `return` with no explicit exit, so it was never
+// covered by the refusal measurement above. It is also the heavier teardown — the
+// success path makes several further best-effort calls after the claim — which is
+// exactly the shape that aborted for api.js. Measured here: clean, exit 0.
+test('claim.js exits 0 without aborting on a SUCCESSFUL claim — the heavier teardown', async () => {
+  const { proc, port } = await startStub({ claimStatus: 201 });
+  try {
+    const home = makeHome({ apiBase: `http://127.0.0.1:${port}` });
+    for (let i = 0; i < 3; i++) {
+      const r = spawnSync(process.execPath, [CLAIM, '4242', '--here'], {
+        cwd: ROOT,
+        encoding: 'utf8',
+        timeout: 60_000,
+        env: { ...process.env, ...atBase(`http://127.0.0.1:${port}`), ...isolatedHome(home) },
+      });
+      assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — draining left a handle armed`);
+      assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively on the success path:\n${r.stderr}`);
+      assert.equal(r.status, 0, `a successful claim must exit 0, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+      assert.match(r.stdout, /Claimed task/, 'the success output must still be produced');
+    }
+  } finally {
+    proc.kill();
+  }
+});
+
 // ---- main-audit.js — the deploy gate (task 1003772) ------------------------
 // Ranges are always HEAD..HEAD: it resolves on every checkout including a shallow
 // CI clone, audits zero commits, and still runs the WHOLE pipeline — fetchRankMap

package/tests/currency_label.mjs

@@ -51,11 +51,14 @@ test('clientBranding exposes project policy — the settings read-back (task 100
   // `visibility` — the join door — joined the block in task 1002324 (ADR 0182 D1);
   // `joinGrant` — what a PUBLIC join grants — in task 1002331 (ADR 0247), defaulting
   // to `full`, the value that narrows nothing, so an un-pushed instance is unchanged
+  // `artistGate` joined in task 1003575 (ADR 0241) and is the ONE key here whose
+  // fallback is not today's behaviour: 'strict' is the owner's ruling, safe as a
+  // default because it can only ever delay a pin move, never a builder's ship.
   assert.deepEqual(clientBranding({}).project,
-    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full' });
+    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'strict' });
   assert.deepEqual(
-    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view' } }).project,
-    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view' },
+    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off' } }).project,
+    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off' },
     'what the instance actually resolved (env override included) is what it publishes');
 });
 
@@ -74,7 +77,11 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // `project` joined the allow-list in task 1003140: the per-project policy is public
   // by nature and is the settings read-back a manage page needs (see clientBranding).
   assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'project', 'rankLabels', 'reward', 'theme']);
-  assert.deepEqual(Object.keys(projected.project).sort(), ['joinGrant', 'joinability', 'platformVisibility', 'visibility']);
+  // `artistGate` joined in task 1003575 (ADR 0241) — the project's artist strictness,
+  // public for the same read-back reason as its neighbours. Its companion stamp
+  // (artistGateSince) deliberately does NOT: that is platform bookkeeping the server
+  // reads, and no browser surface has a question it answers.
+  assert.deepEqual(Object.keys(projected.project).sort(), ['artistGate', 'joinGrant', 'joinability', 'platformVisibility', 'visibility']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }

package/tests/discord_approvals.mjs

@@ -170,5 +170,50 @@ await t('a DB error returns {error}, never throws', async () => {
   assert.equal(r.outcome, 'error');
 });
 
+// ---- the outbound half must not outlive the inbound half (task 1003400) ----
+//
+// The 👍 this line invites is applied ONLY by discord-approvals.js, which lives in the
+// `discord` module. onboarding (which posts) is default-ON; discord is default-OFF; and
+// nothing gated one on the other. A default instance therefore posted a working-looking
+// approve/decline control into a channel where no handler was listening — an Archon
+// reacts, sees it land, and believes they admitted a builder who is still locked out.
+
+await t('discord module OFF → the control is NOT posted', async () => {
+  let posted = false;
+  const r = await bcast.postMemberApprovalRequest(
+    { id: 7, github_login: 'carol' },
+    { postWebhook: async () => { posted = true; }, log: () => {}, isModuleEnabled: () => false },
+  );
+  assert.equal(posted, false, 'a 👍 nobody applies must never be invited');
+  assert.equal(r.skipped, 'discord_module_off');
+  assert.equal(r.posted, false);
+});
+
+await t('discord module ON → the control posts exactly as before', async () => {
+  let line = null;
+  const r = await bcast.postMemberApprovalRequest(
+    { id: 7, github_login: 'carol' },
+    { postWebhook: async (_ch, l) => { line = l; }, log: () => {}, isModuleEnabled: () => true },
+  );
+  assert.equal(r.posted, true, 'the working path is untouched');
+  assert.deepEqual(ap.parseApprovalMarker(line), { kind: 'member', id: 7 }, 'and still round-trips');
+});
+
+await t('enablement unresolvable → fails CLOSED (no post)', async () => {
+  let posted = false;
+  const r = await bcast.postMemberApprovalRequest(
+    { id: 7, github_login: 'carol' },
+    { postWebhook: async () => { posted = true; }, log: () => {}, isModuleEnabled: () => { throw new Error('config unreadable'); } },
+  );
+  assert.equal(posted, false, 'a state we cannot vouch for is not a state we post into');
+  assert.equal(r.skipped, 'discord_module_off');
+});
+
+await t('the gate is reachable through the published doorway, not a direct core require', async () => {
+  const doorway = require('../src/module-api.js');
+  assert.equal(typeof doorway.isModuleEnabled, 'function', 'ADR 0083: modules read enablement here');
+  assert.throws(() => doorway.isModuleEnabled('no-such-module'), /unknown module/, 'a typo must be a bug, not a silent false');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);