@bongos/core 1.19.773 → 1.19.774

package/tests/seam_wiring_guard.mjs

@@ -0,0 +1,234 @@
+// tests/seam_wiring_guard.mjs — the declared-seam-is-consumed guard (task 1003819,
+// ADR 0289; fitness Check 33, successor to abandoned task 1002464).
+//
+// The scanner is the tested surface, driven over SYNTHETIC manifests with an injected
+// `exists` — the scanScopeMapSource / scanDeterministicBody precedent. That keeps every
+// case hermetic (no tmp dirs, no fixture modules) AND lets a case prove the guard
+// actually catches a violation, which a suite that only runs it over the real tree
+// cannot: a clean tree passes whether the check works or is a stub.
+//
+// The three properties that make this guard worth having, each pinned below:
+//   1. a declared entry whose consumer's artifact is absent is REPORTED, naming the
+//      module key and the seam;
+//   2. a legitimately declarative-only entry is DISTINGUISHED from that, and a STALE
+//      exemption (the artifact exists now) is itself reported;
+//   3. the wired set is reported on the PASS path too — a guard that is silent when
+//      it passes leaves no evidence it ran.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const guard = require(path.join(ROOT, 'scripts', 'gds', 'seam-wiring-guard.js'));
+const { scanSeamWiring, SEAM_CONSUMERS, declaredEntries, entryLabel } = guard;
+
+// A synthetic module. `dir` is a bare key — the scanner only ever hands it to
+// SEAM_CONSUMERS.artifact() and to `exists`, both of which we control here.
+const mod = (key, contributes, declarativeSeams) => ({
+  key,
+  dir: `modules/${key}`,
+  manifest: { key, contributes, ...(declarativeSeams ? { declarativeSeams } : {}) },
+});
+
+// An `exists` that answers true for exactly the paths listed (forward-slashed).
+const only = (...paths) => {
+  const set = new Set(paths);
+  return (p) => set.has(String(p).split(path.sep).join('/'));
+};
+const nothingExists = () => false;
+
+// ---------------------------------------------------------------------------
+// 1. a declared seam with no consumer artifact is reported
+// ---------------------------------------------------------------------------
+
+test('reports a declared poller whose file was never shipped, naming module + seam', () => {
+  const r = scanSeamWiring([mod('dev-box', { pollers: ['ghost'] })], { exists: nothingExists });
+  assert.equal(r.ok, false);
+  assert.equal(r.findings.length, 1);
+  assert.match(r.findings[0], /module "dev-box"/);
+  assert.match(r.findings[0], /contributes\.pollers: "ghost"/);
+  assert.match(r.findings[0], /modules\/dev-box\/pollers\/ghost\.js does not exist/);
+  // and it says what to do about it — the three legitimate resolutions
+  assert.match(r.findings[0], /Ship the artifact, drop the declaration, or record it in declarativeSeams\.pollers/);
+});
+
+test('every seam kind is covered: file, per-module file, dir, and the webSurfaces object', () => {
+  const r = scanSeamWiring([
+    mod('a', { routes: ['missing'] }),
+    mod('b', { uiSections: ['sec'] }),
+    mod('c', { skills: ['sk'] }),
+    mod('d', { webSurfaces: [{ host: 'x.', dir: 'public' }] }),
+    mod('e', { migrations: true }),
+  ], { exists: nothingExists });
+  assert.equal(r.findings.length, 5, r.findings.join('\n'));
+  for (const [key, frag] of [
+    ['a', 'modules/a/routes/missing.js'],
+    ['b', 'modules/b/public/hall-widget.js'],
+    ['c', 'modules/c/skills/sk'],
+    ['d', 'modules/d/public'],
+    ['e', 'modules/e/migrations'],
+  ]) {
+    assert.ok(r.findings.some((f) => f.includes(`module "${key}"`) && f.includes(frag)),
+      `no finding for ${key} naming ${frag}:\n${r.findings.join('\n')}`);
+  }
+});
+
+test('a seam NOTHING consumes is reported on sight — the strongest form of the defect', () => {
+  // `rooms` is allowed by the manifest schema but read by no code in the tree.
+  assert.equal(SEAM_CONSUMERS.rooms.consumer, null);
+  // …and shipping the file does not help, because nothing would load it.
+  const r = scanSeamWiring([mod('game', { rooms: ['WorldRoom'] })], { exists: only('modules/game/rooms/WorldRoom.js') });
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /NOTHING in the tree consumes the rooms seam at all/);
+});
+
+test('a disciplines entry absent from the registry is reported', () => {
+  const r = scanSeamWiring([mod('ui-design', { disciplines: ['nope'] })], { registryKeys: new Set(['ui']) });
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /has no such entry/);
+  // a null registry leaves the seam UNCHECKED rather than failing it
+  assert.equal(scanSeamWiring([mod('ui-design', { disciplines: ['nope'] })], { registryKeys: null }).ok, true);
+});
+
+// ---------------------------------------------------------------------------
+// 2. declarative-only is distinguished, and a stale exemption is caught
+// ---------------------------------------------------------------------------
+
+test('a declarative-only entry is recorded, not reported — the load-bearing nuance', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
+    { exists: nothingExists },
+  );
+  assert.equal(r.ok, true, r.findings.join('; '));
+  assert.deepEqual(r.declarative, [{ key: 'dev-box', seam: 'pollers', entry: 'box-lifecycle' }]);
+  assert.deepEqual(r.wired, []);
+});
+
+test('the exemption is per-ENTRY, not a blanket skip of the seam', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['box-lifecycle', 'ghost'] }, { pollers: ['box-lifecycle'] })],
+    { exists: nothingExists },
+  );
+  assert.equal(r.ok, false);
+  assert.equal(r.findings.length, 1);
+  assert.match(r.findings[0], /"ghost"/);
+  assert.deepEqual(r.declarative.map((d) => d.entry), ['box-lifecycle']);
+});
+
+test('a STALE exemption — the artifact exists now — is itself reported', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['box-lifecycle'] }, { pollers: ['box-lifecycle'] })],
+    { exists: only('modules/dev-box/pollers/box-lifecycle.js') },
+  );
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /exempts pollers "box-lifecycle" as declarative-only, but modules\/dev-box\/pollers\/box-lifecycle\.js exists/);
+  assert.match(r.findings[0], /drop the stale declarativeSeams\.pollers entry/);
+  assert.deepEqual(r.declarative, [], 'a stale exemption must not also count as declarative-only');
+});
+
+test('an exemption on one seam does not leak to another seam of the same module', () => {
+  const r = scanSeamWiring(
+    [mod('dev-box', { pollers: ['x'], uiSections: ['x'] }, { pollers: ['x'] })],
+    { exists: nothingExists },
+  );
+  assert.equal(r.findings.length, 1);
+  assert.match(r.findings[0], /contributes\.uiSections/);
+});
+
+test('a skill counts as wired from the module tree OR its vendor/ subdir', () => {
+  const own = scanSeamWiring([mod('ui-design', { skills: ['style'] })], { exists: only('modules/ui-design/skills/style/SKILL.md') });
+  assert.equal(own.ok, true, own.findings.join('; '));
+  const vendored = scanSeamWiring([mod('ui-design', { skills: ['style'] })], { exists: only('modules/ui-design/skills/vendor/style/SKILL.md') });
+  assert.equal(vendored.ok, true, vendored.findings.join('; '));
+});
+
+test('a skills/<name>/ dir with NO SKILL.md is unwired — the consumer requires the file', () => {
+  // moduleSkillSources tests `fs.existsSync(path.join(p, 'SKILL.md'))`, so a bare dir
+  // is not a skill to it. Probing the directory would call such an entry wired while
+  // the real consumer skipped it — this guard's own version of the defect it catches.
+  const r = scanSeamWiring([mod('ui-design', { skills: ['style'] })], { exists: only('modules/ui-design/skills/style') });
+  assert.equal(r.ok, false, 'a dir without SKILL.md must not count as wired');
+  assert.match(r.findings[0], /modules\/ui-design\/skills\/style\/SKILL\.md does not exist/);
+});
+
+test('an entry that reaches outside its own module dir is reported, never probed', () => {
+  // Only routes/pollers/rooms/uiSections/skills are constrained to non-empty strings
+  // by the schema, so an entry could carry '..'. The probe is an existence test over
+  // repo-committed content, but a declaration reaching out of its module is a finding.
+  let probed = 0;
+  const r = scanSeamWiring([mod('a', { routes: ['../../etc/passwd'] })], { exists: () => { probed += 1; return true; } });
+  assert.equal(r.ok, false);
+  assert.match(r.findings[0], /outside the module's own directory/);
+  assert.equal(probed, 0, 'the escaping path must not be probed at all');
+});
+
+// ---------------------------------------------------------------------------
+// 3. the wired set is reported on the PASS path too
+// ---------------------------------------------------------------------------
+
+test('a fully wired module reports its wired entries, so a pass is evidence the guard ran', () => {
+  const r = scanSeamWiring(
+    [mod('economy', { routes: ['cost', 'credits'], migrations: true })],
+    { exists: only('modules/economy/routes/cost.js', 'modules/economy/routes/credits.js', 'modules/economy/migrations') },
+  );
+  assert.equal(r.ok, true, r.findings.join('; '));
+  assert.equal(r.wired.length, 3);
+  assert.deepEqual(r.wired.map((w) => w.entry).sort(), ['cost', 'credits', 'migrations/']);
+  for (const w of r.wired) assert.ok(w.via, 'each wired entry names the consumer that wires it');
+});
+
+test('an empty array and an absent contributes declare nothing at all', () => {
+  const r = scanSeamWiring([mod('discord', { uiSections: [] }), mod('quiet', {})], { exists: nothingExists });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.wired, []);
+  assert.deepEqual(r.declarative, []);
+});
+
+test('an unknown contributes key is validateManifest\'s error, not this guard\'s', () => {
+  const r = scanSeamWiring([mod('x', { pollerz: ['a'] })], { exists: nothingExists });
+  assert.equal(r.ok, true, 'the guard must not double-report a shape error');
+});
+
+test('the guard and the schema share ONE enumerator + labeller, not two copies', () => {
+  // The exemption cross-check (validateManifest) and the wiring check (this guard)
+  // must agree on what a contributes block declares and what each entry is called.
+  // Two copies would drift, and the drift would land on whether an exemption is honoured.
+  const schema = require(path.join(ROOT, 'src', 'module-loader', 'manifest-schema.js'));
+  assert.equal(declaredEntries, schema.declaredEntries);
+  assert.equal(entryLabel, schema.entryLabel);
+});
+
+test('declaredEntries + entryLabel: migrations true/array, and the two webSurface shapes', () => {
+  assert.deepEqual(declaredEntries('migrations', true), [true]);
+  assert.deepEqual(declaredEntries('migrations', ['001_x.sql']), ['001_x.sql']);
+  assert.deepEqual(declaredEntries('migrations', false), []);
+  assert.deepEqual(declaredEntries('routes', undefined), []);
+  assert.equal(entryLabel('migrations', true), 'migrations/');
+  assert.equal(entryLabel('webSurfaces', { host: 'status.', dir: 'public' }), 'status.(public)');
+  assert.equal(entryLabel('webSurfaces', { apexRoot: true, dir: 'public' }), 'apexRoot:public');
+});
+
+// ---------------------------------------------------------------------------
+// the live tree — the regression the guard exists to hold
+// ---------------------------------------------------------------------------
+
+test('the real module set is clean: every declared seam is wired or recorded declarative-only', () => {
+  const r = guard.checkSeamWiring();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+  assert.equal(r.hardFail, false);
+  // the pass note carries the evidence, not just "ok"
+  assert.match(r.note, /WIRED across \d+ seam\(s\)/);
+  assert.match(r.note, /recorded declarative-only/);
+});
+
+test('every seam the manifest schema allows has an entry in SEAM_CONSUMERS', () => {
+  // Otherwise a new contributes key would be silently unchecked — the same gap in a
+  // new place. The schema's list is the source; this guard must span all of it.
+  const { ALLOWED_CONTRIBUTES } = require(path.join(ROOT, 'src', 'module-loader', 'manifest-schema.js'));
+  const missing = ALLOWED_CONTRIBUTES.filter((k) => !(k in SEAM_CONSUMERS));
+  assert.deepEqual(missing, [], `SEAM_CONSUMERS has no entry for: ${missing.join(', ')}`);
+});

package/tests/ship_card.mjs

@@ -291,7 +291,73 @@ test('emitCard with widgetsEnabled:false: monospace only, no HTML, off-marker',
   assert.equal(file, null, 'no HTML file written when widgets are off');
   assert.match(out, /Example World · task #1266/); // the monospace card still printed
   assert.ok(!out.includes('[otb-card-html]'), 'no [otb-card-html] marker emitted');
-  assert.match(out, /widgets are off/); // off-marker tells the skill not to call show_widget
+  assert.match(out, /rich cards are off/); // off-marker tells the skill not to call show_widget
+});
+
+// ---- the card-richness ladder (task 1002518) --------------------------------
+// emitCard receives the resolved rung as FLAGS, never as a level string: the
+// ladder lives in modules/builder-settings/render-prefs.js and a module may not
+// require a sibling module (ADR 0083). These pin what each rung draws.
+
+test('flags.expanded opens the widget summary; without it the summary stays folded', () => {
+  const model = card.buildCardModel(shippedInput);
+  const folded = card.renderCardHtml(model);
+  const open = card.renderCardHtml(model, { expanded: true });
+  // The summary body is the LAST div; folded hides it, expanded shows it.
+  assert.match(folded, /<div style="display:none;margin-top:0\.6rem/, 'default card folds its summary');
+  assert.match(open, /<div style="display:block;margin-top:0\.6rem/, 'expanded card opens its summary');
+  // The toggle still works either way — expanded only picks the starting state.
+  assert.match(open, /Toggle task summary/);
+  assert.match(open, /rotate\(90deg\)/, 'chevron points down when it starts open');
+});
+
+test('minimal rung: no monospace card at all, but the confirmation line survives', () => {
+  const lines = [];
+  const file = card.emitCard(card.buildCardModel(shippedInput), 99997, {
+    log: (s) => lines.push(String(s)),
+    flags: { showCard: false, showWidget: false, expanded: false },
+  });
+  const out = lines.join('\n');
+  assert.equal(file, null, 'no HTML written at the minimal rung');
+  assert.ok(!out.includes('Example World · task #1266'), 'the monospace card is NOT printed');
+  assert.ok(!out.includes('[otb-card-html]'), 'no widget marker emitted');
+  // task 1001730's floor holds at every rung — this is the whole reason the
+  // confirm line is emitted before the card branches.
+  assert.match(out, /\[otb-confirm\] shipped: task 1266/, 'the guaranteed line still prints');
+  assert.match(out, /minimal cards/, 'the directive tells the skill to relay only that line');
+});
+
+test('rich rung: the widget is written AND its summary starts open', () => {
+  const lines = [];
+  const file = card.emitCard(card.buildCardModel(shippedInput), 99996, {
+    log: (s) => lines.push(String(s)),
+    flags: { showCard: true, showWidget: true, expanded: true },
+  });
+  assert.ok(file, 'HTML file written at the rich rung');
+  const html = fs.readFileSync(file, 'utf8');
+  assert.match(html, /<div style="display:block;margin-top:0\.6rem/, 'summary open on arrival');
+  const out = lines.join('\n');
+  assert.match(out, /Example World · task #1266/, 'monospace card still printed');
+  assert.match(out, /\[otb-card-html\]/, 'widget marker emitted');
+  fs.unlinkSync(file);
+});
+
+test('flags absent falls back to the historical boolean meaning', () => {
+  // A caller that has not learned the ladder yet (an older script, a test) keeps
+  // exactly the behaviour it had: monospace always, widget iff true, never open.
+  for (const widgetsEnabled of [true, false]) {
+    const lines = [];
+    const file = card.emitCard(card.buildCardModel(shippedInput), 99995, {
+      log: (s) => lines.push(String(s)), widgetsEnabled,
+    });
+    const out = lines.join('\n');
+    assert.match(out, /Example World · task #1266/, `boolean ${widgetsEnabled} still prints the monospace card`);
+    assert.equal(!!file, widgetsEnabled, `boolean ${widgetsEnabled} decides the widget`);
+    if (file) {
+      assert.match(fs.readFileSync(file, 'utf8'), /<div style="display:none;margin-top:0\.6rem/, 'never expanded via the boolean');
+      fs.unlinkSync(file);
+    }
+  }
 });
 
 // ---- lifecycle trail: full journey on every card (tasks 1487 + 1489) ----

package/tests/sso_checkin_legacy_field_gone.mjs

@@ -0,0 +1,246 @@
+// tests/sso_checkin_legacy_field_gone.mjs — the test of the shim's ABSENCE: the
+// legacy `role` field on POST /sso/membership/check-in is gone (task 1003092,
+// ADR 0177 §"the window closed"; the Lineage lesson of ADR 0174).
+//
+// WHY THIS FILE EXISTS, AND WHY IT LANDED WITH THE REMOVAL AND NOT BEFORE. Task
+// 1003090 renamed the coarse project membership from `role` to `membership_kind`
+// but kept accepting the legacy field for a cross-version window, because the
+// callers are OTHER instances on their own upgrade schedule. For as long as an
+// un-upgraded instance could still send `role: 'builder'`, the field was
+// load-bearing — dropping it would have silently defaulted that instance's owner
+// to 'member' (the owner flag vanishing from My Projects). Only once every
+// federated instance that can check in was past core 1.19.241 could the hub
+// stop understanding it — and the moment it does, THIS test is what keeps the
+// shim from quietly coming back.
+//
+// Three things are pinned, at three altitudes:
+//   1. ROUTE — a body carrying `role` is refused by the strict schema (400,
+//      unknown_field) and touches the database NOT AT ALL: no client lookup, no
+//      membership statement. "Must no longer set the membership" is proven by the
+//      absence of any SQL, not by inspecting a value it might have written.
+//   2. CONTROL — the same body with `membership_kind` instead still lands, and
+//      the UPDATE carries the kind it named. The removal is a wall, not a leak.
+//   3. CONTRACT — the generated OpenAPI + reference no longer list the field, so
+//      a typed client regenerated from them cannot offer it.
+//
+// DB-free: a recording fake pool, the REAL sso router, the REAL domain module,
+// core pinned through the doorway (the tests/sso_checkin_identity_spoof.mjs
+// harness). Runs in the default unit gate.
+//
+// Run:  node --test tests/sso_checkin_legacy_field_gone.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// ---- the recording fake pool ----------------------------------------------
+let queued = [];
+let calls = [];
+const pool = {
+  query: async (text, params) => {
+    calls.push({ text: String(text).replace(/\s+/g, ' ').trim(), params: params || [] });
+    return queued.shift() || { rows: [], rowCount: 0 };
+  },
+};
+function expect(...responses) { queued = responses; calls = []; }
+const sqlFor = (re) => calls.filter((c) => re.test(c.text));
+
+// ---- the real routes over the real domain, with core pinned ----------------
+const noopLog = { info() {}, warn() {}, error() {}, debug() {} };
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    resolveSession: async () => null,
+    logger: () => noopLog,
+    hasProvider: () => true,
+    registerProvider: () => {},
+    on: () => () => {},
+    resolveEnv: () => null,
+    userAgent: () => 'cloud-bongos-tests',
+    LIVE_RANK_LADDER: ['xenos', 'thetes', 'metic', 'archon'],
+  },
+};
+
+const pi = require('../modules/platform-identity/platform-identity.js');
+const buildSsoRoutes = require('../modules/platform-identity/routes/sso.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildSsoRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// ---- fixtures: a legitimate federated instance, checking in its own OWNER -----
+//
+// The owner is the case that made the window load-bearing: a legacy-only sender
+// said `role: 'owner'`, and a hub that ignored the field would have defaulted the
+// row to 'member'. Now that the hub REFUSES the field instead, nothing is written
+// at all — which is the correct failure, because it is loud on the sender's side.
+const CLIENT_ID = 't1003092-instance';
+const CLIENT_SECRET = 't1003092-secret';
+const OWNER = 7100309200;
+
+const clientRow = () => ({
+  client_id: CLIENT_ID,
+  secret_hash: pi.sha256hex(CLIENT_SECRET),
+  name: 'Federated Project',
+  redirect_uris: ['https://federated.example/api/gds/auth/web/callback'],
+  origin: 'https://federated.example',
+  owner_github_id: String(OWNER),
+  status: 'active',
+});
+const membershipRow = (over = {}) => ({
+  id: '5', client_id: CLIENT_ID, github_id: String(OWNER),
+  membership_kind: 'owner', joined_at: 'T0', last_active: 'T0',
+  signin_verified_at: '2026-09-01T00:00:00.000Z', ...over,
+});
+const baseBody = () => ({
+  client_id: CLIENT_ID,
+  client_secret: CLIENT_SECRET,
+  github_id: OWNER,
+  github_login: 'federated-owner',
+  display_name: 'Federated Owner',
+  avatar_url: 'https://federated.example/av.png',
+});
+
+const errorCode = (r) => r.json?.error?.code ?? r.json?.error;
+const unknownFields = (r) => (r.json?.error?.details ?? r.json?.details ?? [])
+  .filter((d) => d.reason === 'unknown_field').map((d) => d.field);
+
+// ── 1. ROUTE: the legacy field is refused, and refused BEFORE any SQL ──────────
+
+test('a check-in carrying ONLY the legacy field is refused 400 and sets no membership', async () => {
+  expect({ rows: [clientRow()] }, { rows: [membershipRow()] });
+  const r = await call('POST', '/sso/membership/check-in', { ...baseBody(), role: 'owner' });
+  assert.equal(r.status, 400, `legacy-only body must be refused, got ${r.status}: ${r.text}`);
+  assert.equal(errorCode(r), 'validation_failed');
+  assert.deepEqual(unknownFields(r), ['role'], 'and the refusal names the field, so the sender can see why');
+  assert.equal(calls.length, 0,
+    'strict validation runs before the client lookup — a legacy body must not even authenticate, let alone write');
+  assert.equal(sqlFor(/platform_identity_project_memberships/).length, 0,
+    'no membership statement of any kind: this is the "must no longer set the membership" the task asked for');
+});
+
+test('a check-in carrying BOTH spellings is refused too — the window admitted the pair, the wall admits neither', async () => {
+  // A sender inside the window sent both deliberately (task 1003090). No shipped
+  // core does any more (tests/membership_kind_lockstep.mjs pins the sender), so a
+  // body with both is by definition an un-upgraded sender, and it is refused rather
+  // than half-honoured: honouring `membership_kind` while ignoring `role` would make
+  // the legacy field look accepted when it is not.
+  expect({ rows: [clientRow()] }, { rows: [membershipRow()] });
+  const r = await call('POST', '/sso/membership/check-in', { ...baseBody(), membership_kind: 'owner', role: 'owner' });
+  assert.equal(r.status, 400);
+  assert.deepEqual(unknownFields(r), ['role']);
+  assert.equal(calls.length, 0);
+});
+
+test('the legacy VALUE is no longer a recognised kind: "builder" is clamped like any unknown value, not translated', async () => {
+  // The translator that turned 'builder' into 'member' is gone with the field. What
+  // remains is the domain's GENERIC clamp — touchMembership writes 'member' for any
+  // value outside MEMBERSHIP_KINDS, whether that is the old craft word or a rank
+  // name. The two must land identically: if 'builder' were still special-cased
+  // anywhere on the path, this is where it would show as a difference.
+  const landed = async (kind) => {
+    expect({ rows: [clientRow()] }, { rows: [membershipRow()] }, { rows: [{ id: '9', handle: 'federated-owner' }] });
+    await call('POST', '/sso/membership/check-in', { ...baseBody(), membership_kind: kind });
+    const membership = sqlFor(/platform_identity_project_memberships/);
+    assert.equal(membership.length, 1, `one membership statement for kind=${kind}`);
+    return membership[0].params[2];
+  };
+  assert.equal(await landed('builder'), 'member', 'the craft word is not a kind — clamped');
+  assert.equal(await landed('archon'), 'member', 'a rank name is not a kind — clamped the same way');
+  assert.equal(await landed('visitor'), 'visitor', 'CONTROL: a real kind passes through untouched');
+});
+
+// ── 2. CONTROL: the one spelling still lands, and lands the kind it named ──────
+
+test('CONTROL: the same check-in with membership_kind lands, and the UPDATE carries the owner kind', async () => {
+  expect(
+    { rows: [clientRow()] },
+    { rows: [membershipRow()] },
+    { rows: [{ id: '9', handle: 'federated-owner' }] },
+  );
+  const r = await call('POST', '/sso/membership/check-in', { ...baseBody(), membership_kind: 'owner' });
+  assert.equal(r.status, 200, `control must still pass, got ${r.status}: ${r.text}`);
+  const membership = sqlFor(/platform_identity_project_memberships/);
+  assert.equal(membership.length, 1, 'exactly one membership statement');
+  assert.match(membership[0].text, /^UPDATE platform_identity_project_memberships/);
+  assert.ok(membership[0].params.includes('owner'),
+    'the kind the sender named is the kind written — the owner flag survives the window closing');
+  assert.equal(membership[0].params[0], CLIENT_ID, 'keyed to the AUTHENTICATED client');
+});
+
+test('CONTROL: a check-in naming no kind at all still defaults to member (the sender-side default is unchanged)', async () => {
+  expect({ rows: [clientRow()] }, { rows: [membershipRow({ membership_kind: 'member' })] }, { rows: [{ id: '9', handle: 'x' }] });
+  const r = await call('POST', '/sso/membership/check-in', baseBody());
+  assert.equal(r.status, 200);
+  const membership = sqlFor(/platform_identity_project_memberships/);
+  assert.equal(membership.length, 1);
+  assert.ok(membership[0].params.includes('member'), 'no kind → member, exactly as inside the window');
+});
+
+// ── 3. CONTRACT: the generated API surface no longer offers the field ──────────
+
+test('the generated OpenAPI request schema for the check-in has no `role` property', () => {
+  const spec = JSON.parse(readFileSync(join(ROOT, 'docs', 'api', 'openapi.json'), 'utf8'));
+  const key = Object.keys(spec.paths).find((p) => p.endsWith('/sso/membership/check-in'));
+  assert.ok(key, 'the check-in route is in the spec');
+  const ref = spec.paths[key].post.requestBody.content['application/json'].schema.$ref;
+  const schema = spec.components.schemas[ref.split('/').pop()];
+  const props = Object.keys(schema.properties || {});
+  assert.ok(props.includes('membership_kind'), `membership_kind is the field (got ${props.join(', ')})`);
+  assert.ok(!props.includes('role'),
+    'the legacy field is gone from the contract — a client regenerated from this spec cannot offer it');
+});
+
+test('the generated API reference row for the check-in lists one spelling', () => {
+  const md = readFileSync(join(ROOT, 'docs', 'api-reference.md'), 'utf8');
+  const row = md.split('\n').find((l) => l.includes('`/api/bongos/sso/membership/check-in`'));
+  assert.ok(row, 'the check-in row is in the reference');
+  const fields = row.split('|')[4];
+  assert.match(fields, /`membership_kind`/);
+  assert.ok(!/`role`/.test(fields), 'the reference is generated from the route schema, so it drops the field with it');
+});
+
+test('the route source itself declares no `role` rule (the schema is the wall, so the wall must be in the schema)', () => {
+  const src = readFileSync(join(ROOT, 'modules', 'platform-identity', 'routes', 'sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/membership/check-in'"), src.indexOf("router.post('/sso/activity/rollup'"));
+  assert.ok(!/^\s*role:\s*\{/m.test(route), 'no `role:` rule in the check-in schema');
+  assert.ok(!/membershipKindFromLegacy/.test(route), 'and no translator call — the mapping left with the field');
+});