@bongos/core 1.19.782 → 1.19.784

package/tests/artifact_audit.mjs

@@ -0,0 +1,210 @@
+// tests/artifact_audit.mjs — the check that asks whether a task's claimed work exists
+// (task 1003200). Hermetic: pure fixtures, no DB, no API, no git.
+//
+// THE FIXTURES ARE THE THREE REAL CASES. On 2026-08-23 three tasks were found, one at a time
+// and all by accident, to be finished-on-paper and absent from the remote. The task that asked
+// for this check said it is only worth having if it would have caught all three, so they are
+// the fixtures, in their 2026-08-23 shape:
+//
+//   1003158  "BUILT, tested and committed, 33 tests green" — branch absent from origin
+//   1002459  confirmed, verified and CREDITED — no branch anywhere
+//   1002792  completed — the validator it claimed to change was untouched
+//
+// (All three have since been recovered and are evidenced on main today, which is exactly why
+// the fixtures are frozen here rather than read live: a regression test whose subject can be
+// fixed underneath it stops testing anything.)
+//
+// The fourth fixture is the one that makes this check trustworthy rather than merely loud:
+// 1003212's fix IS on main and is cited in a code comment, but the commit that carried it
+// never named the task. A message-only index calls that stranded. It must not.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const {
+  auditArtifacts, declaresArtifact, taskIdsIn,
+  AUDITED_STATUSES, ASSURANCE_GATE_DATE, fetchAuditedTasks,
+  fileBlocker, blockerSourceRef,
+} = require('../scripts/gds/artifact-audit.js');
+
+let passed = 0, failed = 0;
+const t = async (n, f) => {
+  try { await f(); passed++; console.log(`  PASS  ${n}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); }
+};
+
+const NONE = { messageIds: new Set(), contentIds: new Set() };
+
+// The three, in the shape they had on the day they were found.
+const SEEDS = [
+  { id: '1003158', status: 'shipped', shipped_at: '2026-08-25T00:00:00Z', title: 'auto-upgrade loud', touches: ['scripts/gds/deploy-divergence.js'] },
+  { id: '1002459', status: 'confirmed', shipped_at: '2026-09-04T00:00:00Z', title: 'blocker detail hydration', touches: ['modules/ideas/blockers.js'] },
+  { id: '1002792', status: 'completed', shipped_at: '2026-08-27T00:00:00Z', title: 'PATCH /tasks/:id title', touches: ['modules/lifecycle/routes/tasks.js'] },
+];
+
+// ---------------------------------------------------------------- the three real cases
+
+await t('catches all THREE of the 2026-08-23 cases — the bar this check was asked to clear', () => {
+  const { stranded } = auditArtifacts(SEEDS, NONE);
+  const ids = stranded.map((s) => s.id).sort();
+  assert.deepEqual(ids, ['1002459', '1002792', '1003158'],
+    'every one of the three finished-on-paper tasks must surface');
+});
+
+await t('catches them across all three audited statuses, not just confirmed', () => {
+  // The reconciler only ever sweeps `confirmed`. `shipped` is the dangerous one: credit is
+  // booked and nothing will look again.
+  const seen = new Set(auditArtifacts(SEEDS, NONE).stranded.map((s) => s.status));
+  assert.deepEqual([...seen].sort(), ['completed', 'confirmed', 'shipped']);
+  assert.ok(AUDITED_STATUSES.includes('shipped'), 'shipped must be audited');
+});
+
+// ------------------------------------------------------- the false-positive that matters
+
+await t('a task landed under ANOTHER branch is proven by file content, not called stranded', () => {
+  // task 1003212: the fix is on main, cited in a comment; no commit message names the task.
+  const t1 = { id: '1003212', status: 'shipped', shipped_at: '2026-08-23T00:00:00Z', touches: ['.claude/scheduled-tasks/core-update-subscription/subscribe.js'] };
+  const only = auditArtifacts([t1], { messageIds: new Set(), contentIds: new Set(['1003212']) });
+  assert.equal(only.stranded.length, 0, 'content evidence must clear it');
+  assert.equal(only.evidenced[0].how, 'file-content', 'and the report must say HOW it was proven');
+});
+
+await t('commit-message evidence is reported as such', () => {
+  const r = auditArtifacts([SEEDS[0]], { messageIds: new Set(['1003158']), contentIds: new Set() });
+  assert.equal(r.stranded.length, 0);
+  assert.equal(r.evidenced[0].how, 'commit-message');
+});
+
+// --------------------------------------------------------------- the three-way distinction
+
+await t('a ship that declares NO artifact is codeless, never stranded', () => {
+  const gov = { id: '1003726', status: 'shipped', shipped_at: '2026-09-09T00:00:00Z', title: 'Release the stale July claim', touches: [] };
+  const r = auditArtifacts([gov], NONE);
+  assert.equal(r.stranded.length, 0, 'a goal edit / claim release has no code artifact to find');
+  assert.equal(r.codeless.length, 1);
+});
+
+await t('touches[] of empty strings is not a declaration', () => {
+  assert.equal(declaresArtifact({ touches: ['', '  '] }), false);
+  assert.equal(declaresArtifact({ touches: [] }), false);
+  assert.equal(declaresArtifact({}), false);
+  assert.equal(declaresArtifact({ touches: ['src/a.js'] }), true);
+});
+
+await t('a PRE-gate ship is unprovable by design and is never an alarm', () => {
+  // Before 2026-08-19 a DB-only ship recorded no declaration, so silence means nothing.
+  // 1469 older ships would otherwise drown the three that matter.
+  const old = { id: '1000001', status: 'shipped', shipped_at: '2026-07-01T00:00:00Z', touches: ['src/a.js'] };
+  const r = auditArtifacts([old], NONE);
+  assert.equal(r.stranded.length, 0);
+  assert.equal(r.preGate.length, 1);
+});
+
+await t('the gate boundary is inclusive of the gate day itself', () => {
+  const onGate = { id: '1003133', status: 'shipped', shipped_at: `${ASSURANCE_GATE_DATE}T00:00:00Z`, touches: ['src/a.js'] };
+  assert.equal(auditArtifacts([onGate], NONE).stranded.length, 1, 'the gate day is audited');
+});
+
+await t('a ship with no date at all is treated as pre-gate, not as a strand', () => {
+  const undated = { id: '1000002', status: 'shipped', shipped_at: null, touches: ['src/a.js'] };
+  const r = auditArtifacts([undated], NONE);
+  assert.equal(r.stranded.length, 0);
+  assert.equal(r.preGate.length, 1);
+});
+
+await t('statuses outside the audited set are ignored entirely', () => {
+  const ready = { id: '1000003', status: 'ready', shipped_at: '2026-09-01T00:00:00Z', touches: ['src/a.js'] };
+  const r = auditArtifacts([ready], NONE);
+  assert.equal(r.stranded.length + r.codeless.length + r.preGate.length + r.evidenced.length, 0);
+});
+
+// ------------------------------------------------------------------------- the id parser
+
+await t('task ids are recognised in every form the repo writes them', () => {
+  const ids = taskIdsIn('fix(x): thing (task 1003200)\n\nsee task-1002459 and task #1003158');
+  assert.deepEqual([...ids].sort(), ['1002459', '1003158', '1003200']);
+});
+
+await t('a PR or issue number is NOT read as a task id', () => {
+  // `PR #847` and `#123` must not evidence anything — ids are 6-7 digits.
+  assert.equal(taskIdsIn('Merge pull request #847 from acme/task-1003942').has('847'), false);
+  assert.deepEqual([...taskIdsIn('Merge pull request #847 from acme/task-1003942')], ['1003942']);
+  assert.equal(taskIdsIn('fixes #1234').size, 0, 'four digits is not a task id');
+});
+
+await t('an empty evidence set never throws and never proves anything', () => {
+  assert.equal(auditArtifacts(SEEDS, { messageIds: undefined, contentIds: undefined }).stranded.length, 3);
+  assert.deepEqual(auditArtifacts(null, NONE).stranded, []);
+});
+
+// ------------------------------------------------------------------------ the paging read
+
+await t('the audited read PAGES, and asks for no more than the route allows', async () => {
+  // The corpus is past one page; asking for more than the cap is a 400 (task 1003752).
+  const calls = [];
+  const many = (n, from) => Array.from({ length: n }, (_, i) => ({ id: from + i, status: 'shipped' }));
+  const call = async (method, path) => {
+    calls.push(path);
+    const u = new URL(path, 'http://x');
+    const limit = Number(u.searchParams.get('limit'));
+    const offset = Number(u.searchParams.get('offset') || 0);
+    assert.ok(limit <= 1000, `page asked for limit=${limit}`);
+    assert.notEqual(u.searchParams.get('offset'), '0', 'offset=0 is a 400 — omit it');
+    if (u.searchParams.get('status') !== 'shipped') return { ok: true, status: 200, data: { tasks: [] } };
+    return { ok: true, status: 200, data: { tasks: many(Math.max(0, Math.min(1000, 2500 - offset)), offset + 1) } };
+  };
+  const rows = await fetchAuditedTasks({ call });
+  assert.equal(rows.length, 2500, 'every page is read');
+  assert.ok(calls.length >= 3);
+});
+
+await t('a failed page THROWS rather than returning a short corpus', async () => {
+  const call = async () => ({ ok: false, status: 500, data: {} });
+  await assert.rejects(() => fetchAuditedTasks({ call }), /500/);
+});
+
+// ------------------------------------------------------------------- the human surface
+
+await t('a finding is filed to the blocker surface, not only printed', async () => {
+  const sent = [];
+  const call = async (method, path, body) => { sent.push({ method, path, body }); return { ok: true, status: 201, data: { blocker: { id: 42 } } }; };
+  const r = await fileBlocker([{ id: '1003188', status: 'shipped', shipped_at: '2026-08-23', title: 'Go-live', touches: ['package.json'] }], { call });
+  assert.equal(r.filed, true);
+  assert.equal(sent[0].path, '/api/gds/blockers');
+  assert.equal(sent[0].body.source, 'artifact-audit');
+  assert.match(sent[0].body.body_md, /task 1003188/);
+});
+
+await t('the same finding set does not file a second blocker', async () => {
+  // POST /blockers dedupes on (source, source_ref) and answers 200 {skipped}. A check that
+  // files a fresh blocker every run is a check somebody mutes within a week.
+  const call = async () => ({ ok: true, status: 200, data: { skipped: true, reason: 'duplicate_source_ref' } });
+  const r = await fileBlocker([{ id: '1', status: 'shipped', shipped_at: '2026-09-01', title: 'x', touches: ['a.js'] }], { call });
+  assert.equal(r.filed, false);
+  assert.match(r.reason, /already filed/);
+});
+
+await t('source_ref keys on the finding SET, so a NEW strand still gets through', () => {
+  const a = [{ id: '1003188' }, { id: '1003230' }];
+  const b = [{ id: '1003188' }, { id: '1003230' }, { id: '1003999' }];
+  assert.equal(blockerSourceRef(a), blockerSourceRef([...a].reverse()), 'order must not matter');
+  assert.notEqual(blockerSourceRef(a), blockerSourceRef(b), 'a new finding must file a new blocker');
+});
+
+await t('nothing to report files nothing at all', async () => {
+  let called = false;
+  const r = await fileBlocker([], { call: async () => { called = true; return { ok: true, status: 201, data: {} }; } });
+  assert.equal(r.filed, false);
+  assert.equal(called, false, 'a clean board must not touch the API');
+});
+
+await t('a failed POST is reported, never swallowed as success', async () => {
+  const r = await fileBlocker([{ id: '1', status: 'shipped', shipped_at: '2026-09-01', title: 'x', touches: ['a.js'] }],
+    { call: async () => ({ ok: false, status: 503, data: {} }) });
+  assert.equal(r.filed, false);
+  assert.match(r.reason, /503/);
+});
+
+console.log(`\nartifact_audit: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/auto_merge_diagnosis.mjs

@@ -0,0 +1,313 @@
+// tests/auto_merge_diagnosis.mjs
+//
+// task 1003511 — an auto-merge arming failure must leave a TRACE, not just a false.
+//
+// task 1001431 already gave enableAutoMergeDetailed a { ok, reason } and surfaced
+// that reason in the publish-branch 201. But the reason travelled in exactly one
+// direction. Nothing was logged, so:
+//   - an operator asking "why did seven PRs in a row need a manual merge?" had
+//     nothing to read; the cause existed only in response bodies already thrown away
+//   - recheckPullRequest (the owner-approval re-arm) called the BOOLEAN façade and
+//     dropped the reason on the floor, and its bare `catch (_)` swallowed the throw
+//     as well — no log AND no response field, the quietest of the four shapes
+//
+// A cause the server computes and then discards is the same outage as one it never
+// computed. These assertions pin that every failure shape is both REPORTED and
+// LOGGED, and that the success path stays quiet.
+//
+// DB-free: the GitHub call is deps.fetchImpl and the log sink is deps.logImpl, the
+// file's existing injection idiom. Nothing here touches a network or a database.
+//
+// Run:  node tests/auto_merge_diagnosis.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const gp = require('../modules/lifecycle/github-push.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// A sink that records what the module logged.
+function spy() {
+  const lines = [];
+  return { lines, warn: (msg, fields) => lines.push({ msg, ...fields }) };
+}
+
+const okFetch = async () => ({ ok: true, json: async () => ({ data: {} }) });
+const graphqlErr = (message) => async () => ({
+  ok: true, json: async () => ({ errors: [{ message }] }),
+});
+const httpErr = (status) => async () => ({ ok: false, status, json: async () => ({}) });
+const throwFetch = async () => { throw new Error('socket hang up'); };
+
+// --- the success path stays quiet ------------------------------------------
+
+await t('arming successfully logs NOTHING (the log is for failures only)', async () => {
+  const log = spy();
+  const r = await gp.enableAutoMergeDetailed({ nodeId: 'N1' }, { token: 'TT', fetchImpl: okFetch, logImpl: log });
+  assert.equal(r.ok, true);
+  assert.equal(r.reason, null);
+  assert.equal(log.lines.length, 0, 'a green arming must not log');
+});
+
+// --- all four failure shapes are reported AND logged -----------------------
+
+await t('repo forbids auto-merge: GitHub\'s own message is reported and logged', async () => {
+  const log = spy();
+  const msg = 'Auto-merge is not allowed for this repository';
+  const r = await gp.enableAutoMergeDetailed(
+    { nodeId: 'N1' }, { token: 'TT', fetchImpl: graphqlErr(msg), logImpl: log });
+  assert.equal(r.ok, false);
+  assert.equal(r.reason, msg, 'the actionable message must survive to the caller');
+  assert.equal(log.lines.length, 1, 'exactly one log line per failure');
+  assert.equal(log.lines[0].reason, msg);
+});
+
+await t('HTTP failure: the status is carried, not discarded', async () => {
+  const log = spy();
+  const r = await gp.enableAutoMergeDetailed(
+    { nodeId: 'N1' }, { token: 'TT', fetchImpl: httpErr(502), logImpl: log });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /502/, 'the HTTP status is the whole diagnosis here');
+  assert.equal(log.lines.length, 1);
+  assert.match(log.lines[0].reason, /502/);
+});
+
+await t('a thrown request is reported and logged, not swallowed', async () => {
+  const log = spy();
+  const r = await gp.enableAutoMergeDetailed(
+    { nodeId: 'N1' }, { token: 'TT', fetchImpl: throwFetch, logImpl: log });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /socket hang up/);
+  assert.equal(log.lines.length, 1);
+});
+
+await t('no credential is a distinct, logged reason — not the same false as the rest', async () => {
+  const log = spy();
+  const r = await gp.enableAutoMergeDetailed({ nodeId: 'N1' }, { fetchImpl: okFetch, logImpl: log });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /token/i);
+  assert.equal(log.lines.length, 1);
+});
+
+await t('the four failure shapes are mutually DISTINGUISHABLE (the whole point)', async () => {
+  const log = spy();
+  const reasons = [];
+  for (const deps of [
+    { token: 'TT', fetchImpl: graphqlErr('Auto-merge is not allowed for this repository') },
+    { token: 'TT', fetchImpl: httpErr(502) },
+    { token: 'TT', fetchImpl: throwFetch },
+    { fetchImpl: okFetch },
+  ]) {
+    const r = await gp.enableAutoMergeDetailed({ nodeId: 'N1' }, { ...deps, logImpl: log });
+    reasons.push(r.reason);
+  }
+  assert.equal(new Set(reasons).size, 4, 'all four causes must read differently');
+  assert.equal(log.lines.length, 4, 'and each must have left its own log line');
+});
+
+// --- no credential may reach the log ---------------------------------------
+
+await t('the token never appears in the reason or the log line', async () => {
+  const log = spy();
+  const TOKEN = 'ghs_LIVECREDENTIALDONOTLOG0123456789';
+  const leaky = async () => { throw new Error(`request failed with header token ${TOKEN}`); };
+  const r = await gp.enableAutoMergeDetailed(
+    { nodeId: 'N1' }, { token: TOKEN, fetchImpl: leaky, logImpl: log });
+  assert.equal(r.ok, false);
+  assert.ok(!String(r.reason).includes(TOKEN), 'the reason must be credential-scrubbed');
+  assert.ok(!JSON.stringify(log.lines).includes(TOKEN), 'and so must the log line');
+});
+
+// --- the re-arm path: the quietest shape ------------------------------------
+
+await t('recheckPullRequest reports WHY the re-arm failed instead of a bare false', async () => {
+  const log = spy();
+  const msg = 'Auto-merge is not allowed for this repository';
+  let graphqlCalls = 0;
+  const fetchImpl = async (url, opts) => {
+    if (String(url).includes('/graphql')) {
+      graphqlCalls++;
+      return { ok: true, json: async () => ({ errors: [{ message: msg }] }) };
+    }
+    // the close / reopen PATCHes
+    assert.equal(opts.method, 'PATCH');
+    return { ok: true, json: async () => ({ node_id: 'N9' }) };
+  };
+  const r = await gp.recheckPullRequest({ number: 847 }, {
+    token: 'TT', fetchImpl, logImpl: log, repoInfo: { owner: 'o', repo: 'r' },
+    reopenDelayMs: 0, sleepImpl: async () => {},
+  });
+  assert.equal(graphqlCalls, 1, 'the re-arm was actually attempted');
+  assert.equal(r.reopened, true, 'the recheck itself still succeeded');
+  assert.equal(r.auto_merge, false);
+  assert.equal(r.auto_merge_reason, msg, 'the reason must no longer be dropped on the floor');
+  assert.equal(log.lines.length, 1, 'and it must be logged');
+  assert.match(log.lines[0].context, /847/, 'the log line names the PR it is about');
+});
+
+await t('a successful re-arm carries NO reason field and logs nothing', async () => {
+  const log = spy();
+  const fetchImpl = async (url) => (String(url).includes('/graphql')
+    ? { ok: true, json: async () => ({ data: {} }) }
+    : { ok: true, json: async () => ({ node_id: 'N9' }) });
+  const r = await gp.recheckPullRequest({ number: 848 }, {
+    token: 'TT', fetchImpl, logImpl: log, repoInfo: { owner: 'o', repo: 'r' },
+    reopenDelayMs: 0, sleepImpl: async () => {},
+  });
+  assert.equal(r.auto_merge, true);
+  assert.ok(!('auto_merge_reason' in r), 'no reason field on the happy path');
+  assert.equal(log.lines.length, 0);
+});
+
+// --- the seam itself is never load-bearing ---------------------------------
+
+await t('a logger that throws cannot break arming', async () => {
+  const boom = { warn: () => { throw new Error('log sink is down'); } };
+  const r = await gp.enableAutoMergeDetailed(
+    { nodeId: 'N1' }, { token: 'TT', fetchImpl: httpErr(500), logImpl: boom });
+  assert.equal(r.ok, false, 'the arming result still comes back');
+  assert.match(r.reason, /500/);
+});
+
+await t('the boolean façade still answers a bare true/false for its existing callers', async () => {
+  const log = spy();
+  assert.equal(await gp.enableAutoMerge({ nodeId: 'N1' }, { token: 'TT', fetchImpl: okFetch, logImpl: log }), true);
+  assert.equal(await gp.enableAutoMerge({ nodeId: 'N1' }, { token: 'TT', fetchImpl: httpErr(403), logImpl: log }), false);
+});
+
+// --- the re-arm's no-node-id branch (grade finding: uncovered) --------------
+
+await t('a reopen that returns no node id is itself a logged, reported failure', async () => {
+  const log = spy();
+  // GitHub answered the reopen PATCH, but with no node_id — there is nothing to arm.
+  // Before this task that fell into `autoMerge = false` with no log and no field.
+  const fetchImpl = async (url) => {
+    assert.ok(!String(url).includes('/graphql'), 'nothing to arm — no mutation should be sent');
+    return { ok: true, json: async () => ({}) };
+  };
+  const r = await gp.recheckPullRequest({ number: 849 }, {
+    token: 'TT', fetchImpl, logImpl: log, repoInfo: { owner: 'o', repo: 'r' },
+    reopenDelayMs: 0, sleepImpl: async () => {},
+  });
+  assert.equal(r.reopened, true);
+  assert.equal(r.auto_merge, false);
+  assert.match(r.auto_merge_reason, /no node id/i, 'the cause must be named, not implied');
+  assert.equal(r.node_id, null);
+  assert.equal(log.lines.length, 1, 'and it must be logged like every other shape');
+  assert.match(log.lines[0].context, /849/);
+});
+
+await t('a throw inside the re-arm is reported and logged, not swallowed by catch (_)', async () => {
+  const log = spy();
+  const fetchImpl = async (url) => {
+    if (String(url).includes('/graphql')) throw new Error('connection reset');
+    return { ok: true, json: async () => ({ node_id: 'N9' }) };
+  };
+  const r = await gp.recheckPullRequest({ number: 850 }, {
+    token: 'TT', fetchImpl, logImpl: log, repoInfo: { owner: 'o', repo: 'r' },
+    reopenDelayMs: 0, sleepImpl: async () => {},
+  });
+  assert.equal(r.auto_merge, false);
+  assert.match(r.auto_merge_reason, /connection reset/);
+  assert.ok(log.lines.length >= 1, 'the swallowed throw now leaves a trace');
+});
+
+// --- the SECOND ambiguity: deploy_status 'unconfigured' means two things ----
+//
+// The task named getPublishStatus as a surface: deploy_status 'unconfigured' covers
+// both "this repo has no deploy-prod.yml" (404) and "the token cannot read the Actions
+// API" (403). deploy_status and deploy_probe.state must NOT change — landConfirmed()
+// and deployProbeBlind() branch on them, and folding both permanent shapes into one
+// state is deliberate (tasks 1002472 / 1002737) so a merged PR can still flip. The fix
+// is a machine-readable `reason` naming WHICH shape it is, since the two need
+// different operator actions: 404 is nothing to fix, 403 is grant Actions:read.
+
+const mergedPr = {
+  number: 1, state: 'closed', merged_at: '2026-09-01T00:00:00Z',
+  merge_commit_sha: 'abc', html_url: 'u', title: 't', body: 'b',
+};
+const statusFetch = (runsRes) => async (url) => (String(url).includes('/actions/')
+  ? runsRes
+  : { ok: true, json: async () => [mergedPr] });
+
+await t('404 and 403 share deploy_status but are told apart by probe.reason', async () => {
+  const noWorkflow = await gp.getPublishStatus({ branch: 'b' }, {
+    token: 'TT', repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: statusFetch({ ok: false, status: 404, json: async () => ({}) }),
+  });
+  const forbidden = await gp.getPublishStatus({ branch: 'b' }, {
+    token: 'TT', repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: statusFetch({ ok: false, status: 403, json: async () => ({}) }),
+  });
+
+  // unchanged on purpose — the reconciler's contract
+  assert.equal(noWorkflow.deploy_status, 'unconfigured');
+  assert.equal(forbidden.deploy_status, 'unconfigured');
+  assert.equal(noWorkflow.deploy_probe.state, 'unconfigured');
+  assert.equal(forbidden.deploy_probe.state, 'unconfigured');
+
+  // the new distinction
+  assert.equal(noWorkflow.deploy_probe.reason, 'no_deploy_workflow');
+  assert.equal(forbidden.deploy_probe.reason, 'actions_read_forbidden');
+  assert.notEqual(noWorkflow.deploy_probe.reason, forbidden.deploy_probe.reason,
+    'the two causes need different operator actions, so they must read differently');
+  assert.equal(noWorkflow.deploy_probe.http, 404);
+  assert.equal(forbidden.deploy_probe.http, 403);
+});
+
+await t('every probe disposition carries a reason, so the field is never absent', async () => {
+  const seen = [];
+  // success (a deploy run for the merge commit)
+  seen.push((await gp.getPublishStatus({ branch: 'b' }, {
+    token: 'TT', repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: statusFetch({ ok: true, status: 200, json: async () => ({
+      workflow_runs: [{ status: 'completed', conclusion: 'success', head_sha: 'abc' }] }) }),
+  })).deploy_probe);
+  // pending (no matching run yet)
+  seen.push((await gp.getPublishStatus({ branch: 'b' }, {
+    token: 'TT', repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: statusFetch({ ok: true, status: 200, json: async () => ({ workflow_runs: [] }) }),
+  })).deploy_probe);
+  // unavailable (a transient read failure)
+  seen.push((await gp.getPublishStatus({ branch: 'b' }, {
+    token: 'TT', repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: statusFetch({ ok: false, status: 500, json: async () => ({}) }),
+  })).deploy_probe);
+
+  for (const p of seen) {
+    assert.ok(p.reason, `every disposition names its cause (state=${p.state})`);
+    assert.match(p.reason, /^[a-z0-9_]+$/, 'machine-readable, not prose');
+  }
+  assert.equal(seen[0].state, 'success');
+  assert.equal(seen[1].state, 'pending');
+  assert.equal(seen[2].state, 'unavailable');
+});
+
+// --- the scrub is centralized, not delegated to call sites ------------------
+
+await t('the log sink scrubs even when the caller handed it something raw', async () => {
+  const log = spy();
+  const TOKEN = 'ghp_RAWCREDENTIALSTRAIGHTFROMACALLSITE01';
+  // Simulates a FUTURE call site that forgot to scrub before reporting.
+  const leaky = async () => ({ ok: true, json: async () => ({ errors: [{ message: `bad credential ${TOKEN}` }] }) });
+  const r = await gp.enableAutoMergeDetailed(
+    { nodeId: 'N1' }, { token: 'TT', fetchImpl: leaky, logImpl: log });
+  assert.equal(r.ok, false);
+  assert.ok(!JSON.stringify(log.lines).includes(TOKEN), 'the log must not depend on the call site remembering');
+  assert.ok(!String(r.reason).includes(TOKEN), 'nor must the reason handed back');
+});
+
+await t('the log seam is NOT exported — it has no consumer outside this module', async () => {
+  assert.equal(gp.logAutoMergeFailure, undefined,
+    'an internal helper must not widen the public surface');
+});
+
+console.log(`\nauto_merge_diagnosis: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/hall_roster_world.mjs

@@ -270,8 +270,12 @@ test('sessions: every id on a row is a door, the earned figure is shown, the tot
   assert.match(html, /<section class="ov-summary" id="stats-scroll"/, 'the totals are the top-of-page strip');
   assert.match(html, /<div class="stat-row" id="stats-body"><\/div>/);
   const ths = (html.match(/<th[ >]/g) || []).length;
-  assert.equal(ths, 9, 'nine columns: session, builder, tasks, earned, turns, tokens, tool errors, duration, recorded');
-  assert.match(src, /colspan="9"/, 'the empty row spans them all');
+  // task 1002516: a tenth column, "Plain speech" — the transcript accessibility
+  // dimension the criterion asks to surface on the dashboard (ADR 0291). The
+  // per-cell contract (a not-scored session is a dash, never a zero) lives in
+  // tests/hall_sessions_ledger.mjs; this pin is only the column count.
+  assert.equal(ths, 10, 'ten columns: session, builder, tasks, earned, turns, tokens, tool errors, duration, plain speech, recorded');
+  assert.match(src, /colspan="10"/, 'the empty row spans them all');
   const fam = html.indexOf('/builders/oversight.css');
   assert.ok(fam > 0 && html.indexOf('/builders/sessions.css') > fam, 'sessions.html links the family sheet before its own');
 });

package/tests/hall_sessions_ledger.mjs

@@ -0,0 +1,94 @@
+// tests/hall_sessions_ledger.mjs — the Session Ledger's accessibility column
+// (task 1002516, clause 4 of criterion `accessibility-fluency-profile`;
+// ADR 0291). The dashboard is where the criterion says the dimension has to
+// surface, so these pin the two ways a ledger column silently lies: a header
+// count that drifts from the cells beneath it, and a "not scored" rendering as
+// a zero — which on this metric would read as the worst possible session when
+// the truth is that the builder's own profile waived every signal.
+//
+// sessions.js is an IIFE with no exports, so the cell renderer is SLICED OUT OF
+// THE SHIPPED SOURCE and executed. That runs the real text rather than a copy.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8').replace(/\r\n/g, '\n');
+
+const JS = read('sessions.js');
+const HTML = read('sessions.html');
+
+// Slice `const ACCESSIBILITY_TITLE = {...}` through the end of accessibilityCell
+// and run it with the one helper it closes over.
+function cellRenderer() {
+  const from = JS.indexOf('const ACCESSIBILITY_TITLE');
+  assert.ok(from > 0, 'ACCESSIBILITY_TITLE is still where the slice expects it');
+  const marker = '\n  function accessibilityCell(s) {';
+  const at = JS.indexOf(marker, from);
+  assert.ok(at > 0, 'accessibilityCell is still a named function');
+  const end = JS.indexOf('\n  }', at);
+  assert.ok(end > at, 'accessibilityCell still closes at its own indent');
+  const src = JS.slice(from, end + 4);
+  const escapeHtml = (v) => String(v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  return new Function('escapeHtml', `${src}\nreturn accessibilityCell;`)(escapeHtml);
+}
+
+test('a scored session renders its score, and warns below the 6.0 threshold', () => {
+  const cell = cellRenderer();
+  const good = cell({ accessibility_score: '8.5', accessibility_band: 'clear' });
+  assert.match(good, />8\.5</, 'the score is shown');
+  assert.ok(!/\bwarn\b/.test(good), 'a passing score is not painted as a warning');
+
+  const bad = cell({ accessibility_score: '3.5', accessibility_band: 'opaque' });
+  assert.match(bad, /class="[^"]*\bwarn\b/, 'below 6.0 takes the row warning colour');
+  assert.match(bad, />3\.5</);
+});
+
+test('NOT SCORED renders an em dash with its reason, never a zero', () => {
+  const cell = cellRenderer();
+  for (const row of [{}, { accessibility_score: null }, { accessibility_score: undefined }]) {
+    const html = cell(row);
+    assert.match(html, /—/, 'an unscored session shows a dash');
+    assert.ok(!/>0/.test(html), 'and is never rendered as a 0, which would read as the worst score');
+    assert.ok(!/\bwarn\b/.test(html), 'and is never painted as a failure');
+    assert.match(html, /title="[^"]*waived/, 'the reason is on hover, not left as a bare dash');
+  }
+});
+
+test('a non-numeric score degrades to not-scored rather than to NaN', () => {
+  const cell = cellRenderer();
+  const html = cell({ accessibility_score: 'n/a' });
+  assert.ok(!/NaN/.test(html), 'no NaN reaches the page');
+  assert.match(html, /—/);
+});
+
+test('the ledger header count matches the empty-state colspan', () => {
+  // The drift this catches: adding a column to renderTable and not to the
+  // header (or the colspan) leaves a table whose rows and head disagree, which
+  // renders as a silently shifted row rather than an error.
+  const thead = HTML.slice(HTML.indexOf('<thead>'), HTML.indexOf('</thead>'));
+  const headers = (thead.match(/<th\b/g) || []).length;
+  const colspan = Number((JS.match(/colspan="(\d+)"/) || [])[1]);
+  assert.ok(headers > 0, 'the ledger still has a header row');
+  assert.equal(colspan, headers, `empty-state colspan (${colspan}) matches the ${headers} headers`);
+
+  // And the row itself: every cell renderTable emits inline, plus the one the
+  // accessibility cell contributes, minus the empty-state <td> that shares the
+  // function body.
+  const body = JS.slice(JS.indexOf('function renderTable'), JS.indexOf('\n  }', JS.indexOf('function renderTable')));
+  const inline = (body.match(/<td\b/g) || []).length - 1; // drop the empty-state cell
+  const viaHelper = (body.match(/accessibilityCell\(/g) || []).length;
+  assert.equal(inline + viaHelper, headers, `a rendered row has ${inline + viaHelper} cells for ${headers} headers`);
+});
+
+test('the accessibility column is headed in plain language, not "Accessibility"', () => {
+  // The shell's OTHER accessibility control is the page zoom (shell.js). Two
+  // meanings of one word in one view teaches nobody anything, so the column is
+  // headed for what it measures.
+  const thead = HTML.slice(HTML.indexOf('<thead>'), HTML.indexOf('</thead>'));
+  assert.match(thead, /Plain speech/, 'the column is headed "Plain speech"');
+  assert.ok(!/>Accessibility</.test(thead), 'and does not collide with the zoom control\'s word');
+});