@bongos/core 1.19.773 → 1.19.774

package/tests/hub_disconnect_ui.mjs

@@ -0,0 +1,105 @@
+// tests/hub_disconnect_ui.mjs
+//
+// The manage page's "Disconnect from Bongos entirely" card (task 1003249, ADR 0290).
+//
+// "Take it offline" is reversible and says so; this is the owner's TRUE delete, so it lives in
+// its own card after the ender — never folded into it, where the reversible control could read
+// as the destructive one. What these pins hold:
+//   • the card is real markup, after "Take it offline", with its fold a SIBLING of the volatile
+//     slot (the #mDelWhat shape), itemising what is erased and what is kept, and saying it
+//     cannot be undone — with no wall-clock promise
+//   • the ask is the name typed back; the act re-checks it at click time and SENDS it, because
+//     the route checks it again (confirm_slug)
+//   • the minute tick never repaints over a half-typed name (a project-scoped guard), and an open
+//     run is named rather than offering a button the server would refuse
+//   • the copy that said nothing on this page erases a project was true until this card: it now
+//     scopes that promise to "Take it offline", and the fold points at the card
+//   • the design kit's stub answers the ask, so the probe drives it end to end
+//
+// Run:  node tests/hub_disconnect_ui.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+const fn = (name) => (SCRIPT.match(new RegExp(`function ${name}\\([^)]*\\)\\s*\\{([\\s\\S]*?)\\n  \\}`)) || [, ''])[1];
+const PROMISE = /shortly|briefly|minute|second|soon\b/i;
+
+test('the card is real markup, after "Take it offline", with the fold outside the volatile slot', () => {
+  const del = HUB.indexOf('id="mDelete"');
+  const card = (HUB.match(/<div class="card mSec" id="mDisconnect">[\s\S]*?<\/details>\s*<\/div>/) || [''])[0];
+  assert.ok(card, '#mDisconnect must be extractable');
+  assert.ok(del > 0 && HUB.indexOf('id="mDisconnect"') > del, 'the true delete comes after the reversible ender');
+  assert.match(card, /<h2>Disconnect from Bongos entirely<\/h2>/);
+  const slot = card.indexOf('id="mDisc"'), fold = card.indexOf('id="mDiscWhat"');
+  assert.ok(slot > 0 && fold > slot, 'the fold is a sibling after the slot, so no re-render can drop it');
+});
+
+test('the fold itemises what is erased and what is kept, says it cannot be undone, and promises no time', () => {
+  const fold = (HUB.match(/<details class="finePrint" id="mDiscWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(fold);
+  assert.match(fold, /<summary>What this erases — and what it keeps<\/summary>/);
+  for (const erased of [/database/, /nightly backup/, /place on the map/, /members/, /name and web address are released/]) {
+    assert.match(fold, erased, `names what is erased: ${erased}`);
+  }
+  assert.match(fold, /<b>Kept:<\/b> your repository on GitHub/);
+  assert.match(fold, /GitHub sign-in app/, 'the one thing GitHub will not let the platform remove is named, with where to remove it');
+  assert.match(fold, /cannot be undone/);
+  assert.match(fold, /<b>Take it offline<\/b> above/, 'the reversible alternative is pointed at');
+  assert.doesNotMatch(fold, PROMISE);
+});
+
+test('the ask is the name typed back, and the act re-checks it and SENDS it for the server to check again', () => {
+  const ask = fn('askDisconnect');
+  assert.ok(ask, 'askDisconnect() must be extractable');
+  assert.match(ask, /mDiscAsking = inst\.slug;/);
+  assert.match(ask, /Type the project’s name to confirm/);
+  assert.match(ask, /id="mDiscName"/);
+  assert.match(ask, /data-disc-yes disabled/);
+  assert.match(ask, /data-disc-no/);
+  assert.match(ask, /cannot be undone/);
+  const act = fn('doDisconnect');
+  assert.match(act, /if \(!inst \|\| !discTypedMatches\(\)\) return;/, 'an enabled-LOOKING button cannot act');
+  assert.match(act, /'\/disconnect'/);
+  assert.match(act, /JSON\.stringify\(\{ confirm_slug: /, 'the typed name travels as confirm_slug');
+  assert.match(act, /loadManage\(true\)/, 'the page re-reads the project so the queued run shows');
+});
+
+test('the render guards a half-typed name per project, names an open run, and offers the button otherwise', () => {
+  const render = fn('renderDisconnect');
+  assert.ok(render, 'renderDisconnect() must be extractable');
+  assert.match(render, /if \(mDiscAsking && mDiscAsking === inst\.slug\) return;/);
+  assert.match(render, /open\.action === 'disconnect'/);
+  assert.match(render, /This project is being disconnected\./);
+  assert.match(render, /Disconnecting waits for the current /, 'another open run is named, no button the server would refuse');
+  assert.match(render, /data-disc-ask/);
+  assert.doesNotMatch(render, PROMISE);
+  assert.match(SCRIPT, /renderDelete\(inst\);\n[\s\S]{0,200}renderDisconnect\(inst\);/, 'rendered on the same fetch-free tick as the ender');
+});
+
+test('the ender no longer claims nothing on the page erases — it scopes that to itself and points at the card', () => {
+  const truth = fn('teardownTruth');
+  assert.equal((truth.match(/until you bring it back\. Taking it offline erases nothing\.'/g) || []).length, 2, 'both shapes');
+  assert.doesNotMatch(HUB, /Nothing here erases a project/);
+  const delFold = (HUB.match(/<details class="finePrint" id="mDelWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.doesNotMatch(delFold, /no permanent-delete button/i, 'the capability exists now');
+  assert.match(delFold, /<b>Disconnect from Bongos entirely<\/b> below/);
+  assert.match(fn('renderDelete'), /open_intent\.action === 'disconnect'/, 'a queued disconnect is not offered a teardown the server would refuse');
+});
+
+test('the design kit stub answers the ask, and a probe drives it end to end', () => {
+  const stub = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'serve.js'), 'utf8');
+  assert.match(stub, /\(teardown\|restart\|domain\|disconnect\)/);
+  assert.match(stub, /disconnect: \{ queued: true, message: /);
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes;
+  const p = probes.find((x) => /disconnect/.test(x.name));
+  assert.ok(p, 'a disconnect probe exists');
+  assert.ok(p.steps.some((s) => s[0] === 'fill' && s[1] === '#mDiscName'));
+  assert.ok(p.steps.some((s) => s[0] === 'click' && s[1] === '[data-disc-yes]'));
+});

package/tests/land_watch.mjs

@@ -89,6 +89,50 @@ t('falls back to the task row for title/value when the crumb lacks them', () =>
   assert.ok(/From task row/.test(env.html), 'title should come from the fresh task row');
 });
 
+// ── the card-richness rung survives the async land (task 1002518) ────────────────────
+//
+// This is the path the ladder is easiest to lose on. The card a CI land renders is
+// built minutes later, in another process, from the breadcrumb alone — so if the
+// crumb does not carry the rung the shipping session resolved, the shipped card
+// silently reverts to the default rendering and the builder's choice is honoured
+// everywhere EXCEPT the one card that says the work actually landed.
+
+t('a crumb carrying cardFlags renders at that rung — rich opens the summary', () => {
+  const flags = { level: 'rich', showCard: true, showWidget: true, expanded: true };
+  const env = buildShippedEnvelope({ ...CRUMB, cardFlags: flags }, { status: 'shipped' });
+  assert.equal(env.widgets_enabled, true);
+  assert.match(env.html, /<div style="display:block;margin-top:0\.6rem/, 'the rich rung opens the summary on arrival');
+});
+
+t('cardFlags at a non-widget rung writes no widget, whatever the legacy boolean says', () => {
+  // widgetsEnabled:true is left on the crumb deliberately — cardFlags must WIN.
+  // A crumb written by this CLI carries both, so the precedence is what decides
+  // the render, not which field happens to be present.
+  const flags = { level: 'text', showCard: true, showWidget: false, expanded: false };
+  const env = buildShippedEnvelope({ ...CRUMB, widgetsEnabled: true, cardFlags: flags }, { status: 'shipped' });
+  assert.equal(env.widgets_enabled, false, 'the rung decides, not the legacy boolean');
+  assert.ok(env.markdown && /Shipped/.test(env.markdown), 'the monospace card still carries the land');
+});
+
+t('the standard rung leaves the summary folded — expanded is not assumed from showWidget', () => {
+  const flags = { level: 'standard', showCard: true, showWidget: true, expanded: false };
+  const env = buildShippedEnvelope({ ...CRUMB, cardFlags: flags }, { status: 'shipped' });
+  assert.equal(env.widgets_enabled, true);
+  assert.match(env.html, /<div style="display:none;margin-top:0\.6rem/, 'folded, as the standard rung means');
+});
+
+t('a crumb WITHOUT cardFlags still reads the legacy boolean — older crumbs on disk', () => {
+  // A breadcrumb written before this shipped is sitting on someone's machine right
+  // now, and land-watch will read it. It must render exactly as it always did.
+  for (const widgetsEnabled of [true, false]) {
+    const env = buildShippedEnvelope({ ...CRUMB, widgetsEnabled, cardFlags: undefined }, { status: 'shipped' });
+    assert.equal(env.widgets_enabled, widgetsEnabled, `legacy crumb (${widgetsEnabled}) keeps its meaning`);
+    if (widgetsEnabled) {
+      assert.match(env.html, /<div style="display:none;margin-top:0\.6rem/, 'a legacy crumb never renders expanded');
+    }
+  }
+});
+
 // ── watch() orchestration (injected deps — no disk, no network) ──────────────────────
 await ta('emits the NEWEST shipped card, keeps confirmed, drops the rest — one card per run', async () => {
   const removed = [];

package/tests/membership_kind_lockstep.mjs

@@ -91,45 +91,104 @@ for (const m of EXPAND_MIGRATIONS) {
   });
 }
 
-test('the value mapping is one shared function, not repeated inline', () => {
-  // Route, sender and trigger must agree that 'builder' ⇄ 'member'; three copies of a
-  // ternary is how they would stop agreeing.
-  const pi = read('modules/platform-identity/platform-identity.js');
-  assert.match(pi, /function membershipKindFromLegacy\(/);
-  assert.match(pi, /function legacyRoleFromKind\(/);
-  const sso = read('modules/platform-identity/routes/sso.js');
-  assert.match(sso, /pi\.membershipKindFromLegacy\(role\)/,
-    'the check-in translates the legacy field through the shared mapping');
+test('the expand-phase trigger mapped the value pair in BOTH directions (history, still readable)', () => {
+  // 010 is history now — 021 dropped the trigger — but the expand migration stays
+  // in the tree (a from-scratch replay must still match), so its shape stays pinned:
+  // this is the trigger the no-DEFAULT rule above exists for.
   const sql = read('modules/platform-identity/migrations/platform_identity_010_membership_kind.sql');
-  assert.match(sql, /CASE WHEN NEW\.role = 'builder' THEN 'member'/, 'the trigger maps the same pair');
-  assert.match(sql, /CASE WHEN NEW\.membership_kind = 'member' THEN 'builder'/);
+  assert.match(sql, /CASE WHEN NEW\.role = 'builder' THEN 'member'/, 'the trigger maps the legacy value in');
+  assert.match(sql, /CASE WHEN NEW\.membership_kind = 'member' THEN 'builder'/, 'and the new value out');
 });
 
-test('the sender writes BOTH spellings, computing the kind once (the cross-version window)', () => {
+test('the sender writes ONE spelling, computing the kind once (the window is closed)', () => {
   // task 1003206: the auth flows are auth.js + auth-*.js now — read the family.
+  // During the window (task 1003090) this body carried BOTH spellings; task 1003092
+  // closed it. The legacy field must not come back: the hub schema is strict, so
+  // re-adding it would turn every federated check-in into a 400.
   const auth = authSource();
   const body = auth.slice(auth.indexOf('async function reportMembershipCheckIn'), auth.indexOf('async function reportMembershipCheckIn') + 2400);
-  assert.match(body, /membership_kind: kind/, 'the new field goes on the wire');
-  assert.match(body, /role: kind === 'member' \? 'builder' : kind/,
-    'and the legacy field too — an un-upgraded hub would otherwise drop the owner flag');
+  assert.match(body, /membership_kind: kind/, 'the field goes on the wire');
+  assert.ok(!/\brole:/.test(body),
+    'the legacy field is gone from the wire — the hub no longer accepts it (task 1003092)');
   assert.equal((body.match(/membershipKind\(\{ githubLogin \}\)/g) || []).length, 1,
-    'the kind is computed ONCE per check-in, not per field');
+    'the kind is computed ONCE per check-in');
+});
+
+test('the translator functions are gone from the domain module (nothing left to translate)', () => {
+  const pi = read('modules/platform-identity/platform-identity.js');
+  assert.ok(!/membershipKindFromLegacy/.test(pi), 'membershipKindFromLegacy was the window; the window is closed');
+  assert.ok(!/legacyRoleFromKind/.test(pi), 'legacyRoleFromKind likewise');
+  const sso = read('modules/platform-identity/routes/sso.js');
+  assert.ok(!/membershipKindFromLegacy/.test(sso), 'the route no longer translates anything');
 });
 
-// ── THE CONTRACT PHASE — the test of the shim's own removal (task 1003089) ─────
+// ── THE CONTRACT PHASES — the tests of the shims' own removal ──────────────────
 //
 // ADR 0174's Lineage lesson: a time-boxed shim outlives its release unless its
-// removal ships with the test that says it is gone. core_240 closed the GOAL
-// membership window — the trigger, the function and `goal_members.role` are all
-// dropped, and `membership_kind` carries NOT NULL + DEFAULT itself rather than
-// resting on a trigger surviving.
-//
-// The PROJECT membership half (platform_identity_010) is deliberately NOT here:
-// it is still inside its cross-version federation window, its contract phase is
-// task 1003092, and the expand-phase block above is what still guards it. Do not
-// merge the two — the whole point of the pair is that they close on different
-// schedules.
+// removal ships with the test that says it is gone. The two windows closed on
+// DIFFERENT schedules, which is the whole point of the pair:
+//   • core_240 (task 1003089) closed the GOAL membership window one release later;
+//   • platform_identity_021 (task 1003092) closed the PROJECT membership window
+//     only once every federated instance that can check in was past core 1.19.241,
+//     because its writer is another instance (ADR 0177 §"the window closed").
+// In both, the trigger, the function and the legacy column are dropped, and
+// `membership_kind` carries NOT NULL + DEFAULT itself rather than resting on a
+// trigger surviving.
 const CONTRACT = 'migrations/core_240_goal_members_drop_legacy_role.sql';
+const PI_CONTRACT = 'modules/platform-identity/migrations/platform_identity_021_drop_legacy_role.sql';
+
+test('platform_identity_021: the contract phase drops the trigger, the function AND the column', () => {
+  const sql = read(PI_CONTRACT);
+  assert.match(sql, /DROP TRIGGER IF EXISTS platform_identity_membership_kind_lockstep\s+ON platform_identity_project_memberships/);
+  assert.match(sql, /DROP FUNCTION IF EXISTS platform_identity_membership_kind_lockstep\(\)/,
+    'the FUNCTION outlives the trigger unless it is dropped by name');
+  assert.match(sql, /ALTER TABLE platform_identity_project_memberships DROP COLUMN IF EXISTS role/);
+  assert.match(sql, /ALTER TABLE platform_identity_project_memberships ALTER COLUMN membership_kind SET NOT NULL/,
+    'the guarantee 010 deferred to step 2 arrives here, or the column never gets one');
+  assert.match(sql, /ALTER TABLE platform_identity_project_memberships ALTER COLUMN membership_kind SET DEFAULT 'member'/,
+    'safe only NOW: a default while the legacy column was still written is the task-1003090 bug');
+  // The last backfill must carry the VALUE rename too — a stray legacy 'builder'
+  // must never land in membership_kind, whose CHECK does not admit it.
+  assert.match(sql, /CASE WHEN role = ''builder'' THEN ''member'' ELSE role END/,
+    'the guarded backfill maps the craft name, not just copies the column');
+  const trigDrop = sql.indexOf('DROP TRIGGER IF EXISTS platform_identity_membership_kind_lockstep');
+  const colDrop = sql.indexOf('DROP COLUMN IF EXISTS role');
+  assert.ok(trigDrop > -1 && trigDrop < colDrop,
+    'the trigger goes BEFORE the column: plpgsql bodies are not dependency-tracked, so a survivor fails at the next write');
+});
+
+test('platform_identity_021: the forward-unsafe pragma is present, and its FIRST line carries the gating fact', () => {
+  const scan = lint.scanMigrationSql(read(PI_CONTRACT));
+  assert.deepEqual([...scan.unsafe].sort(), ['drop-column', 'set-not-null'],
+    'the linter must still SEE both operations — an acknowledged migration is not an exempt one');
+  assert.ok(scan.acknowledged, 'a drop-column with no pragma is unacknowledged forward-unsafety');
+  // The one fact that makes THIS drop safe is not a hub release alone — it is that
+  // every federated sender is past the release carrying the expand phase.
+  assert.match(scan.ackReason, /1\.19\.241/,
+    'the pragma must name the release the senders had to be past, not merely assert safety');
+  assert.match(scan.ackReason, /federated instance/i,
+    'and say the condition was about the SENDERS — the cross-version window is what made this one different');
+});
+
+test('no platform-identity migration outside the three that own its lifecycle still names project_memberships.role', () => {
+  // Comments are stripped first: the history may DISCUSS the old column; this rule
+  // is about statements. The exemptions are the migrations that created the column,
+  // expanded away from it, and dropped it.
+  const OWNS_ITS_LIFECYCLE = new Set([
+    'platform_identity_003_project_memberships.sql',  // created it
+    'platform_identity_010_membership_kind.sql',      // expand: backfilled from it; the trigger kept it in step
+    'platform_identity_021_drop_legacy_role.sql',     // contract: dropped it
+  ]);
+  const dir = path.join(ROOT, 'modules', 'platform-identity', 'migrations');
+  const offenders = [];
+  for (const f of fs.readdirSync(dir)) {
+    if (!f.endsWith('.sql') || OWNS_ITS_LIFECYCLE.has(f)) continue;
+    const code = lint.stripSqlComments(fs.readFileSync(path.join(dir, f), 'utf8'));
+    if (/project_memberships/.test(code) && /\brole\b/.test(code)) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `these migrations touch project_memberships and still name the dropped column: ${offenders.join(', ')}`);
+});
 
 test('core_240: the contract phase drops the trigger, the function AND the column', () => {
   const sql = read(CONTRACT);

package/tests/module-scope-map.mjs

@@ -252,3 +252,42 @@ test('methodology joined the roster (task 1002989) — the instruction surfaces
   assert.equal(covers('scripts/gds/fitness.js'), false, 'the fitness tool stayed with devsecops (task 1003124)');
   assert.equal(covers('scripts/gds/ship.js'), false, 'the ship pipeline belongs to lifecycle');
 });
+
+test('SHARED_GLOBS: the ownerless floor every goal wall includes (task 1003655, ADR 0288)', () => {
+  // `tests/` is the whole floor and the bar for joining it is high: no module can
+  // honestly own the path AND every task legitimately writes it.
+  assert.deepEqual([...scope.SHARED_GLOBS], ['tests/']);
+  // It is SHARED, not OWNED — no module key may claim it, or the floor would be a
+  // second list drifting against the roster.
+  for (const k of scope.moduleKeys()) {
+    const globs = scope.scopeForModule(k).globs;
+    assert.ok(!globs.includes('tests/'), `module "${k}" must not own the shared root tests/`);
+  }
+  // Module-owned suites keep their own module's key — they are not part of the floor.
+  assert.equal(gsc.scopeSubset(['lifecycle'], ['modules/lifecycle/tests/ship.mjs']).ok, true);
+  assert.equal(gsc.scopeSubset(['art-pipeline'], ['modules/lifecycle/tests/ship.mjs']).ok, false);
+});
+
+test('SHARED_GLOBS is DERIVED against PROTECTED_GLOBS, never a trusted literal', () => {
+  // Same contract as `protected` (ADR 0086 §7): a protected path listed here would
+  // widen EVERY goal's wall into the trust core in one line, so the export filters
+  // its own literal rather than trusting it.
+  for (const g of scope.SHARED_GLOBS) {
+    assert.equal(scope.isProtected([g]), false, `shared glob ${g} overlaps the protected core`);
+  }
+  assert.deepEqual(
+    [...scope.SHARED_GLOBS],
+    scope.SHARED_GLOBS_RAW.filter((g) => !scope.isProtected([g])),
+    'the exported floor must be the faithful filter of its literal',
+  );
+  // Prove the filter actually filters, rather than passing because the literal is clean.
+  assert.deepEqual(['tests/', 'migrations/'].filter((g) => !scope.isProtected([g])), ['tests/']);
+});
+
+test('the gap this closed: an honest task declaring its own test is now authorizable', () => {
+  // Before task 1003655 this was refused out_of_scope under EVERY goal, because
+  // tests/ resolved to no module — so the wall was only passable by under-declaring
+  // touches[] (idea 1000816). Asserted through the real consumer.
+  const r = gsc.check(['ideas'], ['modules/ideas/inbox.js', 'tests/idea_routing.mjs'], 'thetes');
+  assert.equal(r.ok, true, r.reason);
+});

package/tests/module_exports_unique_keys.mjs

@@ -0,0 +1,70 @@
+// tests/module_exports_unique_keys.mjs
+//
+// No `module.exports = { … }` shorthand literal may name the same key twice (task 1003922).
+//
+// modules/provisioning/provisioning.js carried two adjacent export lines that repeated
+// createInstance, setInstanceStatus, updateInstanceDomain and updateInstanceSettings, a
+// merge residue. JavaScript accepts it silently, which is the hazard: a later edit that
+// removes or renames a key on ONE line leaves the other copy exporting it, so the edit
+// looks applied and is not. This scans every server-side .js file's trailing shorthand
+// export literal, so the next one fails here instead of in review.
+//
+// Run:  node tests/module_exports_unique_keys.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKIP_DIRS = new Set(['node_modules', 'vendor', '.git', 'public']);
+
+function jsFiles(dir, out = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) { if (!SKIP_DIRS.has(entry.name)) jsFiles(path.join(dir, entry.name), out); }
+    else if (entry.name.endsWith('.js')) out.push(path.join(dir, entry.name));
+  }
+  return out;
+}
+
+// The trailing `module.exports = { … };` — only when it is pure shorthand (no `key: value`,
+// calls, spreads or strings), since that is the form a duplicated line hides in.
+function duplicateExportKeys(src) {
+  const at = src.lastIndexOf('module.exports = {');
+  if (at < 0) return [];
+  const end = src.indexOf('\n};', at);
+  if (end < 0) return [];
+  const body = src.slice(at + 'module.exports = {'.length, end)
+    .replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/.*$/gm, '');
+  if (/[:(){}[\]'"`.]/.test(body)) return [];
+  const counts = new Map();
+  for (const key of body.split(',').map((s) => s.trim()).filter(Boolean)) counts.set(key, (counts.get(key) || 0) + 1);
+  return [...counts].filter(([, n]) => n > 1).map(([key]) => key);
+}
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('the detector finds a repeated key across two export lines, and ignores a clean or non-shorthand literal', () => {
+  assert.deepEqual(duplicateExportKeys('module.exports = {\n  a, b,\n  a, c,\n};\n'), ['a']);
+  assert.deepEqual(duplicateExportKeys('module.exports = {\n  a, b, // a\n  c,\n};\n'), []);
+  assert.deepEqual(duplicateExportKeys('module.exports = {\n  a: 1, a: 2,\n};\n'), []);
+});
+
+t('no server-side module.exports shorthand literal repeats a key', () => {
+  const files = ['src', 'modules', 'scripts'].flatMap((d) => jsFiles(path.join(ROOT, d)));
+  files.push(path.join(ROOT, 'server.js'));
+  assert.ok(files.length > 100, `scanned too few files (${files.length}) — the walk is broken`);
+  const offenders = files
+    .filter((f) => fs.existsSync(f))
+    .map((f) => [path.relative(ROOT, f).replace(/\\/g, '/'), duplicateExportKeys(fs.readFileSync(f, 'utf8').replace(/\r\n/g, '\n'))])
+    .filter(([, keys]) => keys.length)
+    .map(([f, keys]) => `${f}: ${keys.join(', ')}`);
+  assert.deepEqual(offenders, [], `a key exported twice is a merge hazard — merge the lines:\n${offenders.join('\n')}`);
+});
+
+console.log(`\nmodule_exports_unique_keys: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/module_manifest.mjs

@@ -276,3 +276,88 @@ test('every bundled module declares a maintenance posture (the catalog has no un
     });
   assert.deepEqual(undeclared, [], `these modules declare no maintenance.status: ${undeclared.join(', ')}`);
 });
+
+// --- declarativeSeams: the seam-wiring guard's exemption list (task 1003819) ---
+//
+// The exemption is validated AGAINST `contributes` because this is the one place
+// holding both. A typo'd exemption that validated clean would exempt nothing while
+// reading as though it exempted something — the failure mode in the direction that
+// HIDES a defect, which is exactly what the guard exists to catch.
+
+test('declarativeSeams: a valid exemption naming a declared seam + entry passes', () => {
+  const r = validateManifest({
+    ...baseManifest(),
+    declarativeSeams: { pollers: ['box-lifecycle'], uiSections: ['boxes'] },
+  });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('declarativeSeams: an exemption for a seam the module does not declare is an ERROR', () => {
+  const r = validateManifest({
+    ...baseManifest(),
+    contributes: { routes: ['box'] }, // no pollers declared
+    declarativeSeams: { pollers: ['box-lifecycle'] },
+  });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => /does not declare contributes\.pollers/.test(e)), r.errors.join('; '));
+});
+
+test('declarativeSeams: an exemption naming an ENTRY the module does not list is an ERROR (the typo case)', () => {
+  const r = validateManifest({
+    ...baseManifest(),
+    declarativeSeams: { pollers: ['box-lifecyle'] }, // transposed letters
+  });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => /"box-lifecyle" is not in contributes\.pollers/.test(e)), r.errors.join('; '));
+});
+
+test('declarativeSeams: the per-entry check spans EVERY seam, not just bare string arrays', () => {
+  // webSurfaces declares OBJECTS and `migrations: true` is implicit, so an earlier cut
+  // that compared exemptions against raw strings bailed on both (`if (!isStrArray…)
+  // continue`) and let a bogus exemption validate clean — 2 of the 8 allowed keys
+  // silently outside acceptance criterion 3. The comparison is against the LABELS now.
+  const base = { ...baseManifest(), contributes: { webSurfaces: [{ host: 'status.', dir: 'public' }] } };
+  const bad = validateManifest({ ...base, declarativeSeams: { webSurfaces: ['bogus'] } });
+  assert.equal(bad.valid, false, 'a bogus webSurfaces exemption must not validate');
+  assert.ok(bad.errors.some((e) => /"bogus" is not in contributes\.webSurfaces/.test(e)), bad.errors.join('; '));
+  assert.equal(validateManifest({ ...base, declarativeSeams: { webSurfaces: ['status.(public)'] } }).valid, true);
+
+  const mig = { ...baseManifest(), contributes: { migrations: true } };
+  assert.equal(validateManifest({ ...mig, declarativeSeams: { migrations: ['bogus'] } }).valid, false);
+  assert.equal(validateManifest({ ...mig, declarativeSeams: { migrations: ['migrations/'] } }).valid, true);
+});
+
+test('declarativeSeams: an unknown seam key is an ERROR, not a silent no-op', () => {
+  const r = validateManifest({ ...baseManifest(), declarativeSeams: { pollerz: ['x'] } });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => /declarativeSeams\.pollerz: unknown seam/.test(e)), r.errors.join('; '));
+});
+
+test('declarativeSeams: shape errors — non-object block, non-string-array entries', () => {
+  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: ['pollers'] }).valid, false);
+  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: { pollers: 'box-lifecycle' } }).valid, false);
+  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: { pollers: [''] } }).valid, false);
+});
+
+test('declarativeSeams is OPTIONAL — a manifest without it still validates', () => {
+  const m = baseManifest();
+  assert.ok(!('declarativeSeams' in m));
+  assert.equal(validateManifest(m).valid, true);
+});
+
+test('every bundled module with a declarativeSeams block validates against its own contributes', async () => {
+  // The live manifests are the real regression surface: an exemption that drifts from
+  // the contributes block it exempts is the defect this field is here to prevent.
+  const fsm = (await import('node:fs')).default;
+  const modulesDir = path.join(ROOT, 'modules');
+  const bad = [];
+  for (const k of fsm.readdirSync(modulesDir)) {
+    const mp = path.join(modulesDir, k, 'module.json');
+    if (!fsm.existsSync(mp)) continue;
+    const m = JSON.parse(fsm.readFileSync(mp, 'utf8'));
+    if (!m.declarativeSeams) continue;
+    const r = validateManifest(m);
+    if (!r.valid) bad.push(`${k}: ${r.errors.join('; ')}`);
+  }
+  assert.deepEqual(bad, [], bad.join('\n'));
+});

package/tests/project_catalog_forget.mjs

@@ -0,0 +1,83 @@
+// tests/project_catalog_forget.mjs
+//
+// The catalog's half of "Disconnect from Bongos entirely" (task 1003249, ADR 0290): a
+// disconnected project leaves the map for good — its catalog row, its catalog client and the
+// membership rows keyed on that client are DELETED, not hidden.
+//
+// It writes rows keyed on values an owner supplies (a slug, an address), so it keeps the two
+// claim rules the publish path keeps (project-catalog.js header):
+//   1. the PROJECT row goes only when its owner is this instance's owner;
+//   2. the CLIENT (and its memberships) goes only when it is bound to this origin or was never
+//      credentialed — a slug that collides with a real, credentialed client elsewhere is not
+//      ours to delete.
+//
+// DB-free: a recording pool answers by statement shape.
+//
+// Run:  node tests/project_catalog_forget.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const catalog = require('../modules/platform-identity/project-catalog.js');
+
+function pool({ client = null } = {}) {
+  const calls = [];
+  return {
+    calls,
+    query: async (sql, params) => {
+      calls.push({ sql: sql.replace(/\s+/g, ' ').trim(), params });
+      if (/^SELECT .* FROM platform_identity_sso_clients/.test(sql.replace(/\s+/g, ' ').trim())) return { rows: client ? [client] : [] };
+      if (/^DELETE FROM platform_identity_projects/.test(sql.replace(/\s+/g, ' ').trim())) return { rowCount: 1, rows: [] };
+      if (/^DELETE FROM platform_identity_project_memberships/.test(sql.replace(/\s+/g, ' ').trim())) return { rowCount: 3, rows: [] };
+      if (/^DELETE FROM platform_identity_sso_clients/.test(sql.replace(/\s+/g, ' ').trim())) return { rowCount: 1, rows: [] };
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+}
+const TARGET = { clientId: 'lantern', origin: 'https://lantern.example.com/', ownerGithubId: 4242 };
+const deletes = (p) => p.calls.filter((c) => /^DELETE/.test(c.sql));
+
+test('an uncredentialed catalog-only client: the project row, the client and its memberships all go', async () => {
+  const p = pool({ client: { origin: 'https://lantern.example.com', secret_hash: '' } });
+  const out = await catalog.forgetOwnedProject(TARGET, { pool: p });
+  assert.deepEqual(out, { project: 1, client: 1, memberships: 3 });
+  const d = deletes(p);
+  assert.match(d[0].sql, /DELETE FROM platform_identity_projects WHERE origin = \$1 AND owner_github_id = \$2/);
+  assert.deepEqual(d[0].params, ['https://lantern.example.com', 4242], 'origin normalised, owner-scoped (claim rule 2)');
+  assert.deepEqual(d[1].params, ['lantern']);
+  assert.match(d[1].sql, /platform_identity_project_memberships/);
+  assert.match(d[2].sql, /platform_identity_sso_clients/, 'memberships go before the client they key on');
+});
+
+test('a credentialed client bound to THIS origin is this project\'s — it goes too', async () => {
+  const p = pool({ client: { origin: 'https://lantern.example.com', secret_hash: 'abc123' } });
+  const out = await catalog.forgetOwnedProject(TARGET, { pool: p });
+  assert.equal(out.client, 1);
+});
+
+test('a credentialed client at ANOTHER origin shares only the slug — it and its memberships are left alone (claim rule 1)', async () => {
+  const p = pool({ client: { origin: 'https://someone-else.example.org', secret_hash: 'abc123' } });
+  const out = await catalog.forgetOwnedProject(TARGET, { pool: p });
+  assert.deepEqual(out, { project: 1, client: 0, memberships: 0 });
+  assert.equal(deletes(p).length, 1, 'only the owner-scoped project row');
+});
+
+test('no client row: the project row still goes', async () => {
+  const p = pool();
+  assert.deepEqual(await catalog.forgetOwnedProject(TARGET, { pool: p }), { project: 1, client: 0, memberships: 0 });
+});
+
+test('no address or no owner identity: nothing is touched', async () => {
+  for (const t of [{ ...TARGET, origin: '' }, { ...TARGET, ownerGithubId: null }, { ...TARGET, clientId: '' }]) {
+    const p = pool({ client: { origin: 'https://lantern.example.com', secret_hash: '' } });
+    assert.deepEqual(await catalog.forgetOwnedProject(t, { pool: p }), { project: 0, client: 0, memberships: 0 });
+    assert.equal(p.calls.length, 0);
+  }
+});
+
+test('the kernel port exposes it as `forget`, beside publish and catalogued', () => {
+  assert.equal(typeof catalog.projectCatalogPort.forget, 'function');
+  assert.deepEqual(Object.keys(catalog.projectCatalogPort).sort(), ['catalogued', 'forget', 'publish']);
+});

package/tests/projects_hub.mjs

@@ -1305,7 +1305,8 @@ test('"delete" never claims to erase — the fold states what is kept', () => {
   assert.match(fold, /does <b>not<\/b> erase the project/i, 'the distinction is stated, not implied');
   assert.match(fold, /torn down/, 'it names the state the project actually lands in');
   assert.match(fold, /repository on GitHub is untouched/, 'and what survives');
-  assert.match(fold, /no permanent-delete button/i, 'the absent capability is admitted, not faked');
+  // the true delete exists since task 1003249 — the fold points at it rather than admitting its absence
+  assert.match(fold, /use <b>Disconnect from Bongos entirely<\/b> below/, 'the erase lives in its own card, and the fold says where');
 });
 
 test('tearing a project down asks for its NAME — the page\'s heaviest control', () => {
@@ -1350,12 +1351,17 @@ test('the delete section mirrors the server gate — every state but torn_down',
     'and the sentence is dropped where no such button rendered');
 });
 
-test('a teardown does not silence the address — the copy says what the runner does', () => {
+test('a teardown keeps the address reserved and says nothing answers there — the copy says what the runner does', () => {
   const fn = (SCRIPT.match(/function teardownTruth\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
   assert.ok(fn, 'teardownTruth() must be extractable');
-  // the runner has NO DNS or Caddy leg, so the hostname keeps resolving and 502s
+  // the runner parks the hostname and removes its Caddy block (task 1002897), but the
+  // row keeps the address, so the copy says "reserved", never "goes away"
   assert.doesNotMatch(fn, /the address stops answering/,
-    'the old claim was untrue — teardown releases neither the DNS record nor the Caddy block');
+    'the address is held for a revive, not released');
+  assert.match(fn, /nothing answers there until you bring it back/,
+    'what a visitor now meets at the parked address');
+  assert.doesNotMatch(fn, /shows an error page/,
+    'the pre-park 502 promise is gone');
   assert.match(fn, /stays reserved for this project/,
     'the honest word, and the accurate one — a revive re-uses exactly this hostname');
   assert.match(fn, /repository is untouched/, 'what survives is still stated in both shapes');