@bongos/core 1.19.790 → 1.19.792

package/tests/accessibility_replay.mjs

@@ -0,0 +1,201 @@
+// tests/accessibility_replay.mjs
+//
+// The two-profile replay regression (task 1002517; clauses 5 and 8 of criterion
+// `accessibility-fluency-profile`) — the proof the criterion named for itself
+// and that had never been run.
+//
+// This is NOT a second copy of tests/session_accessibility.mjs. That file pins
+// the scorer's arithmetic against fixtures it builds line by line. This one runs
+// a fixed set of eight beginner questions through two real answer registers and
+// asserts what the criterion actually claims: accessible prose clears a floor,
+// an expert's prose is not scored for being an expert's prose, and the two
+// verdicts come from the same corpus — so neither is a tautology.
+//
+// The assertion that keeps the rest honest is DISCRIMINATION (leg 3). A scorer
+// that had gone blind — three detectors quietly matching nothing — produces a
+// perfect 10 on the non-technical run and passes leg 1 looking exactly like a
+// working one. Leg 3 reads the same engineer prose as a newcomer would and
+// requires every detector to register hits and the score to fall through the
+// floor. Nothing else here can pass while the detectors are dead.
+//
+// Run:  node tests/accessibility_replay.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const H = require('../scripts/gds/accessibility-replay.js');
+const acc = require('../modules/sessions/accessibility.js');
+
+const corpus = H.loadCorpus();
+const NEWCOMER = corpus.runs.non_technical.profile;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const signalsOf = (r) => Object.fromEntries(r.result.signals.map((s) => [s.type, s]));
+
+// ---- the floor is the scorer's own line, not a second number ---------------
+
+test('FLOOR is bandFor()\'s workable boundary, so retuning the bands cannot move it silently', () => {
+  assert.equal(H.bandFor(H.FLOOR), 'workable', 'FLOOR sits exactly on the workable boundary');
+  assert.equal(H.bandFor(H.FLOOR - 0.1), 'dense', 'a tenth below the floor is already the dense band');
+  assert.equal(corpus.floor, H.FLOOR, 'the corpus records the same floor the harness enforces');
+});
+
+// ---- the corpus is a fixed set, and both runs answer all of it -------------
+
+test('the prompt set is fixed, non-trivial, and answered in full by both runs', () => {
+  assert.ok(corpus.prompts.length >= 8, 'at least eight beginner prompts');
+  const ids = corpus.prompts.map((p) => p.id);
+  assert.equal(new Set(ids).size, ids.length, 'prompt ids are unique');
+  for (const runName of ['non_technical', 'engineer']) {
+    const run = corpus.runs[runName];
+    for (const id of ids) {
+      const turns = run.replies[id];
+      assert.ok(Array.isArray(turns) && turns.length > 0, `${runName} answers ${id}`);
+      for (const t of turns) assert.ok(typeof t === 'string' && t.trim(), `${runName}/${id} turn is prose`);
+    }
+    for (const [field, value] of Object.entries(run.profile)) {
+      assert.ok(acc.PROFILE_VALUES[field]?.includes(value), `${runName} profile ${field}=${value} is a real value`);
+    }
+  }
+});
+
+// ---- leg 1: the dimension recognises accessible prose ----------------------
+
+test('leg 1 — the non-technical run clears the floor under the non-technical profile', () => {
+  const r = H.replay(corpus, 'non_technical');
+  assert.ok(r.result.score != null, 'the non-technical run is scored, not waived away');
+  assert.ok(
+    r.result.score >= H.FLOOR,
+    `non-technical run scored ${r.result.score}, floor is ${H.FLOOR}`
+  );
+  assert.equal(r.result.confidence, 'normal', 'the sample is big enough for the score to stand behind');
+});
+
+// ---- leg 2: an expert's prose is not scored for being an expert's prose ----
+
+test('leg 2 — the engineer run is not scored at all under the engineer profile', () => {
+  const r = H.replay(corpus, 'engineer');
+  assert.equal(r.result.score, null, 'an all-waived session scores null, never a number');
+  assert.equal(r.result.band, 'n/a');
+  assert.equal(r.result.signals.length, 3);
+  for (const s of r.result.signals) {
+    assert.equal(s.waived, true, `${s.type} is waived for this profile`);
+    assert.ok(/technical_level|toolchain_familiarity/.test(s.reason), `${s.type} names the setting that waived it`);
+  }
+  assert.equal(r.result.confidence, 'normal', 'the prose was read — the null is a waiver, not an empty sample');
+});
+
+test('leg 2 holds when the same expert answers even more briefly', () => {
+  const full = H.replay(corpus, 'engineer');
+  const terse = H.replay(corpus, 'engineer', { variant: 'terse' });
+  assert.ok(terse.result.sampled_chars < full.result.sampled_chars, 'the terse variant really is shorter');
+  assert.equal(terse.result.score, null, 'still nothing to regress');
+});
+
+// ---- leg 3: the same prose, read as a newcomer would read it ---------------
+
+test('leg 3 — the SAME engineer prose falls through the floor under the non-technical profile', () => {
+  const r = H.replay(corpus, 'engineer', { profile: NEWCOMER });
+  assert.ok(r.result.score != null, 'nothing is waived for a newcomer');
+  assert.ok(
+    r.result.score < H.FLOOR,
+    `engineer prose read as a newcomer scored ${r.result.score}, which should be under ${H.FLOOR}`
+  );
+});
+
+test('leg 3 — every detector registers hits, so a scorer that went blind cannot pass', () => {
+  const s = signalsOf(H.replay(corpus, 'engineer', { profile: NEWCOMER }));
+  for (const type of Object.keys(acc.SIGNAL_SPEC)) {
+    assert.ok(s[type], `${type} was scored`);
+    assert.ok(s[type].count > 0, `${type} found something in the engineer prose (found ${s[type].count})`);
+    assert.ok(s[type].evidence, `${type} can name what it found`);
+  }
+});
+
+// ---- the perfect run is forgiveness, not avoidance -------------------------
+
+test('the non-technical run scores well WITH a jargon term and implementation framing in it, not by dodging them', () => {
+  const prose = Object.values(corpus.runs.non_technical.replies).flat().join('\n');
+  const present = acc.JARGON_TERMS.filter((t) => new RegExp(`\\b${t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'i').test(prose));
+  assert.ok(present.length > 0, 'the accessible prose does use at least one term from the jargon list');
+  assert.ok(/\barchitecture\b/i.test(prose), 'and frames something in architecture terms at least once');
+
+  const s = signalsOf(H.replay(corpus, 'non_technical'));
+  assert.equal(s.unexplained_jargon.count, 0, `"${present.join('", "')}" is used and DEFINED, so it is not a finding`);
+  assert.equal(s.implementation_over_outcome.count, 0, 'the architecture turn also names the cost, so it is not a finding');
+});
+
+// ---- leg 4: the metric reads density, not volume --------------------------
+
+test('leg 4 — saying the same thing twice doubles the counts and leaves every rate, and the score, identical', () => {
+  const once = H.replay(corpus, 'engineer', { profile: NEWCOMER });
+  const twice = H.replay(corpus, 'engineer', { profile: NEWCOMER, variant: 'doubled' });
+  assert.equal(twice.result.sampled_chars, once.result.sampled_chars * 2, 'twice the prose');
+
+  const a = signalsOf(once);
+  const b = signalsOf(twice);
+  for (const type of Object.keys(acc.SIGNAL_SPEC)) {
+    assert.equal(b[type].count, a[type].count * 2, `${type} finds twice as much in twice the prose`);
+    assert.equal(b[type].rate, a[type].rate, `${type} rate is unchanged — the metric reads density, not volume`);
+  }
+  assert.equal(twice.result.score, once.result.score, 'so the score does not move with length');
+});
+
+test('answering more briefly never costs points', () => {
+  for (const runName of ['non_technical', 'engineer']) {
+    const full = H.replay(corpus, runName);
+    const terse = H.replay(corpus, runName, { variant: 'terse' });
+    assert.ok(terse.result.sampled_chars < full.result.sampled_chars, `${runName} terse variant is shorter`);
+    if (full.result.score == null) {
+      assert.equal(terse.result.score, null, `${runName} stays unscored`);
+      continue;
+    }
+    assert.ok(
+      terse.result.score >= full.result.score,
+      `${runName} terse scored ${terse.result.score} against ${full.result.score} full — brevity must not cost`
+    );
+  }
+});
+
+// ---- the two waivers are independent settings ------------------------------
+
+test('an engineer who is new to the terminal still gets the click-path signal', () => {
+  const r = H.replay(corpus, 'engineer', { profile: H.ENGINEER_NEW_TO_TOOLCHAIN });
+  const s = signalsOf(r);
+  assert.equal(r.result.signals.filter((x) => x.waived).length, 2, 'technical_level waives two, not three');
+  assert.equal(s.terminal_where_ui_exists.waived, false, 'the click-path signal is waived by TOOLCHAIN familiarity, not by technical level');
+  assert.ok(s.terminal_where_ui_exists.count > 0, 'and it still finds the commands handed over');
+  assert.ok(r.result.score != null, 'so this profile still gets a number');
+});
+
+// ---- the harness is runnable, which is half of what the task asked for -----
+
+test('the report renders and names every run', () => {
+  const out = H.formatReport(corpus);
+  assert.ok(out.includes(`floor ${H.FLOOR.toFixed(1)}`), 'the report states the floor it enforces');
+  assert.ok(out.includes('non-technical profile'), 'and both profiles appear');
+  assert.ok(out.includes('engineer profile'));
+
+  let json = '';
+  assert.equal(H.main(['--json'], (s) => { json += s; }), 0, 'the JSON mode exits clean');
+  const parsed = JSON.parse(json);
+  assert.equal(parsed.floor, H.FLOOR, 'and carries the floor a caller would check against');
+});
+
+console.log('');
+console.log(`Accessibility two-profile replay (clauses 5 + 8): ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/auth_session_expiry_db.mjs

@@ -0,0 +1,183 @@
+// tests/auth_session_expiry_db.mjs — ADR 0294, task 1003956 (real DB).
+//
+// The DB-free sibling (auth_session_ttl.mjs) pins the CONSTANT, createSession's
+// choice of value against a stub pool, and the TEXT of the refresh statement and
+// the migration. That last part is the weak half, and the grader on this task was
+// right to say so — though not for the reason first assumed. Most edits to the
+// guard's WORDING do break its regex, so the sibling is tighter than it looks.
+// What a regex cannot see is whether Postgres ACCEPTS the statement at all.
+//
+// Measured, by deleting the CASE's `END` and running both files: the sibling
+// reported 20 passed, 0 failed on SQL that fails to parse — SQL that would throw
+// on every authenticated request in production. This file caught it.
+//
+// Worth knowing WHICH assertions caught it, because it is not the obvious one.
+// The refresh is fire-and-forget with a `.catch()`, so a broken UPDATE fails
+// SILENTLY: expires_at stays NULL and the never-expires assertion still passes.
+// What failed was `last_used_at` never moving and the web row never rolling. Those
+// two are not padding — on this statement they are the only live smoke alarm.
+//
+// So this file proves what only a real transaction engine can:
+//
+//   1. A CLI session is CREATED with no expiry, and a web session's explicit
+//      30 days survives untouched — the two halves of the default change.
+//   2. THE REGRESSION GUARD EXECUTES — after a real lookupSession, a CLI row's
+//      expires_at is still NULL. Without the CASE this is where the timeout
+//      comes back, on the first request after sign-in.
+//   3. A web row's expiry STILL rolls forward, so the guard narrowed the write
+//      to NULL rows rather than disabling refresh-on-use for everyone.
+//   4. Expiry is still HONOURED where present, and revocation still wins — the
+//      two things a "sessions never expire" change could plausibly have broken.
+//   5. THE MIGRATION, run for real: it clears a pre-existing CLI expiry, leaves
+//      web and revoked rows alone, and is idempotent.
+//   6. The point of the whole task — a session idle far past 24h authenticates.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in
+// run-unit-tests.js's INTEGRATION set so the default DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=... node tests/auth_session_expiry_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIGRATION = join(here, '..', 'migrations', 'core_243_cli_sessions_never_expire.sql');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`auth_session_expiry_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// An isolated schema, so this never touches a real builders/builder_sessions.
+const SCHEMA = `ttl_probe_${process.pid}`;
+await pool.query(`CREATE SCHEMA ${SCHEMA}`);
+await pool.query(`SET search_path TO ${SCHEMA}`);
+await pool.query(`
+  CREATE TABLE builders (id bigserial PRIMARY KEY, github_id text, github_login text,
+    display_name text, avatar_url text, total_credits int DEFAULT 0, rank text DEFAULT 'archon',
+    status text DEFAULT 'active', system_role text, anthropic_user_id text);
+  CREATE TABLE builder_sessions (id bigserial PRIMARY KEY, builder_id bigint REFERENCES builders(id),
+    token text UNIQUE, source text, user_agent text, created_at timestamptz DEFAULT now(),
+    last_used_at timestamptz DEFAULT now(), expires_at timestamptz, revoked_at timestamptz);
+  INSERT INTO builders (github_login) VALUES ('probe');
+`);
+
+// Run the REAL kernel against this schema: stub ./pool in the require cache so
+// db-kernel binds our client, exactly as the production code binds the singleton.
+const client = await pool.connect();
+await client.query(`SET search_path TO ${SCHEMA}`);
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: client } };
+const kernel = require('../src/bongos/db-kernel.js');
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+const row = async (sql, p) => (await client.query(sql, p)).rows[0];
+// refresh-on-use is fire-and-forget: let the UPDATE land before reading it back.
+const settle = () => new Promise((r) => setTimeout(r, 300));
+
+const thirtyDays = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+
+await t('a CLI session is created with NO expiry', async () => {
+  const s = await kernel.createSession({ builderId: '1', token: 'cli-tok', source: 'cli', userAgent: 'probe', expiresAt: null });
+  assert.equal(s.expires_at, null);
+});
+
+await t("a web session's explicit 30-day expiry is stored as given", async () => {
+  const s = await kernel.createSession({ builderId: '1', token: 'web-tok', source: 'web', userAgent: 'probe', expiresAt: thirtyDays });
+  assert.equal(s.expires_at.getTime(), thirtyDays.getTime());
+});
+
+await t('lookupSession resolves a CLI bearer to its builder', async () => {
+  const got = await kernel.lookupSession('cli-tok');
+  assert.equal(got && got.github_login, 'probe');
+});
+
+// THE GUARD. This is the assertion the source-matching sibling cannot make.
+await t('after a real use, a CLI session STILL has no expiry (the CASE guard)', async () => {
+  await kernel.lookupSession('cli-tok');
+  await settle();
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='cli-tok'`)).expires_at, null);
+});
+
+await t('refresh-on-use still bumps last_used_at on that same row', async () => {
+  const before = (await row(`SELECT last_used_at FROM builder_sessions WHERE token='cli-tok'`)).last_used_at;
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '1 hour' WHERE token='cli-tok'`);
+  await kernel.lookupSession('cli-tok');
+  await settle();
+  const after = (await row(`SELECT last_used_at FROM builder_sessions WHERE token='cli-tok'`)).last_used_at;
+  assert.ok(after > new Date(Date.now() - 60_000), `last_used_at did not move: ${after} (was ${before})`);
+});
+
+await t('a web session still rolls its expiry forward (refresh-on-use intact)', async () => {
+  await kernel.lookupSession('web-tok');
+  await settle();
+  const got = (await row(`SELECT expires_at FROM builder_sessions WHERE token='web-tok'`)).expires_at;
+  assert.ok(got !== null && got < thirtyDays, `expected a rolled-forward date below 30d, got ${got}`);
+});
+
+await t('an expired session is still REFUSED (expiry honoured where present)', async () => {
+  await client.query(`INSERT INTO builder_sessions (builder_id, token, source, expires_at)
+                      VALUES (1,'dead-tok','web', now() - interval '1 hour')`);
+  assert.equal(await kernel.lookupSession('dead-tok'), null);
+});
+
+await t('a revoked CLI session is still REFUSED', async () => {
+  await client.query(`INSERT INTO builder_sessions (builder_id, token, source, revoked_at)
+                      VALUES (1,'revoked-tok','cli', now())`);
+  assert.equal(await kernel.lookupSession('revoked-tok'), null);
+});
+
+// The migration, against rows shaped like the ones live instances actually hold.
+const migrationSql = readFileSync(MIGRATION, 'utf8');
+await client.query(`INSERT INTO builder_sessions (builder_id, token, source, expires_at) VALUES
+  (1,'old-cli','cli', now() + interval '24 hours'),
+  (1,'old-web','web', now() + interval '30 days'),
+  (1,'old-revoked','cli', now() + interval '24 hours')`);
+await client.query(`UPDATE builder_sessions SET revoked_at = now() WHERE token='old-revoked'`);
+await client.query(migrationSql);
+
+await t('core_243 clears a pre-existing CLI expiry', async () => {
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-cli'`)).expires_at, null);
+});
+
+await t('core_243 leaves a WEB row dated — the source filter is its safety property', async () => {
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-web'`)).expires_at, null);
+});
+
+await t('core_243 leaves a revoked row alone (it is the audit trail)', async () => {
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-revoked'`)).expires_at, null);
+});
+
+await t('core_243 is idempotent — a re-run changes nothing', async () => {
+  await client.query(migrationSql);
+  assert.equal((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-cli'`)).expires_at, null);
+  assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token='old-web'`)).expires_at, null);
+});
+
+// The whole point of the task, stated as a test.
+await t('a CLI session idle for 21 DAYS still authenticates', async () => {
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '21 days' WHERE token='cli-tok'`);
+  assert.notEqual(await kernel.lookupSession('cli-tok'), null);
+});
+
+await client.query(`SET search_path TO public`);
+client.release();
+await pool.query(`DROP SCHEMA ${SCHEMA} CASCADE`);
+await pool.end();
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/auth_session_ttl.mjs

@@ -19,15 +19,30 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const db = require('../src/bongos/db.js');
 
 let passed = 0;
 let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+// Cases are queued rather than run inline so an ASYNC one (the createSession
+// checks below hit a stubbed pool through an async function) is actually awaited.
+// Running those inline would report PASS before the assertion resolved, and a
+// rejection would surface as an unhandled rejection instead of a FAIL.
+const queue = [];
+function t(name, fn) { queue.push({ name, fn }); }
+// Section headers queue too, so they still print ABOVE the cases they introduce
+// instead of all bunching at the top once execution is deferred.
+function section(label) { queue.push({ label }); }
+async function runQueue() {
+  for (const item of queue) {
+    if (item.label) { console.log(item.label); continue; }
+    const { name, fn } = item;
+    try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+    catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+  }
+  queue.length = 0;
 }
 
 // ---------------------------------------------------------------------------
@@ -103,7 +118,7 @@ function isDemotion(oldRank, newRank) {
   return newIdx > oldIdx;
 }
 
-console.log('\ndemotion-detection (revoke-all hook in setBuilderRank):');
+section('\ndemotion-detection (revoke-all hook in setBuilderRank):');
 
 t('archon → metic is a demotion (revoke triggers)', () => {
   assert.equal(isDemotion('archon', 'metic'), true);
@@ -135,21 +150,119 @@ t('an unknown rank string does not crash and returns false', () => {
 });
 
 // ---------------------------------------------------------------------------
-// 3. TTL constant (criterion C9: idle-session hygiene)
+// 3. No expiry on a CLI session (ADR 0294)
 // ---------------------------------------------------------------------------
-// V3.R90 / #400: widened from 1h to 24h. Refresh-on-use is unchanged, so an
-// actively-used session is still indefinite — the constant only governs how
-// long an idle session lives. 1h kicked builders out over lunch; 24h still
-// kills idle sessions overnight. C7 (rank-change-near-instant) is unaffected
-// because demotion calls revokeAllSessionsForBuilder synchronously.
+// The TTL was argued three times — 1h (V3.R38/#259), 24h (V3.R90/#400), then
+// gone (ADR 0294 / task 1003956). The first two rounds moved the number; the
+// third removed the mechanism, because refresh-on-use meant the timer only ever
+// fired on a session gone QUIET — the legitimate holder stepping away — while a
+// leaked token's own traffic kept it alive. What is asserted here is the shape
+// that replaced it, and the two ways it could silently come back.
+//
+// createSession is exercised against a STUB POOL rather than a live Postgres, in
+// keeping with this file's no-real-PG stance: the claim under test is which
+// value reaches the INSERT, which is a pure function of the argument. The pool
+// module is stubbed in the require cache before db-kernel is loaded fresh, since
+// db-kernel binds `pool` once at module load.
 
-console.log('\nSESSION_TTL_MS constant:');
+section('\nSESSION_TTL_MS constant:');
 
 t('SESSION_TTL_MS is exactly 24 hours (86,400,000 ms)', () => {
   assert.equal(db.SESSION_TTL_MS, 24 * 60 * 60 * 1000);
 });
 
+section('\ncreateSession expiry default (ADR 0294):');
+
+// Load db-kernel over a stub pool that records the parameters it is handed.
+const poolPath = require.resolve('../src/bongos/pool.js');
+const kernelPath = require.resolve('../src/bongos/db-kernel.js');
+const realPool = require.cache[poolPath];
+const realKernel = require.cache[kernelPath];
+const calls = [];
+require.cache[poolPath] = {
+  id: poolPath, filename: poolPath, loaded: true, exports: {
+    pool: { query: async (text, params) => { calls.push({ text, params }); return { rows: [{ id: '1' }] }; } },
+  },
+};
+delete require.cache[kernelPath];
+const kernel = require('../src/bongos/db-kernel.js');
+
+// expires_at is the 5th INSERT parameter — see createSession's VALUES list.
+async function expiryFor(expiresAt) {
+  calls.length = 0;
+  await kernel.createSession({ builderId: '1', token: 't', source: 'cli', userAgent: null, expiresAt });
+  return calls[0].params[4];
+}
+
+t('a CLI session named with NO expiry is stored with expires_at NULL', async () => {
+  assert.equal(await expiryFor(null), null);
+});
+
+t('an OMITTED expiresAt is also stored as NULL, not a 24h default', async () => {
+  assert.equal(await expiryFor(undefined), null);
+});
+
+t('an EXPLICIT expiry is preserved verbatim — the web flow keeps its 30 days', async () => {
+  const thirtyDays = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+  assert.equal((await expiryFor(thirtyDays)).getTime(), thirtyDays.getTime());
+});
+
+section('\nrefresh-on-use must not re-mint an expiry (ADR 0294):');
+
+// THE REGRESSION THIS GUARDS. lookupSession rolls expires_at forward on every
+// authenticated request. Without the NULL guard, the FIRST request after sign-in
+// would write now()+24h onto a never-expires row and restore the whole timeout —
+// silently, with createSession still looking correct. Asserted over the source
+// because the behaviour lives in SQL the stub pool never executes.
+const kernelSrc = readFileSync(new URL('../src/bongos/db-kernel.js', import.meta.url), 'utf8');
+const refreshSql = kernelSrc.slice(
+  kernelSrc.indexOf('UPDATE builder_sessions'),
+  kernelSrc.indexOf('[row.session_id, SESSION_TTL_MS]')
+);
+
+t("refresh-on-use leaves a NULL expires_at NULL", () => {
+  assert.ok(refreshSql.includes('UPDATE builder_sessions'), 'refresh statement not found');
+  assert.match(refreshSql, /CASE\s*\n?\s*WHEN expires_at IS NULL THEN NULL/);
+});
+
+t('refresh-on-use still bumps last_used_at (the own-sessions list reads it)', () => {
+  assert.match(refreshSql, /last_used_at = now\(\)/);
+});
+
+section('\nmigration core_243 scope:');
+
+// The migration clears expires_at on rows that already exist. Its source filter
+// is the entire safety property: lookupSession only rolls an expiry it can
+// already SEE, so a web row cleared here would stay cleared forever — an
+// immortality nobody decided on, and unrecoverable by normal use.
+//
+// Comment lines are STRIPPED before matching. This file's header explains the
+// source filter at length, so asserting over the raw text would let the prose
+// satisfy a check the statement no longer meets — verified by deleting the WHERE
+// clause and watching the revoked_at assertion still pass.
+const migrationSql = readFileSync(
+  new URL('../migrations/core_243_cli_sessions_never_expire.sql', import.meta.url), 'utf8'
+)
+  .split('\n')
+  .filter((line) => !line.trim().startsWith('--'))
+  .join('\n');
+
+t("core_243 only clears CLI rows", () => {
+  assert.match(migrationSql, /SET expires_at = NULL/);
+  assert.match(migrationSql, /WHERE source = 'cli'/);
+});
+
+t('core_243 leaves revoked rows alone (they are the audit trail)', () => {
+  assert.match(migrationSql, /revoked_at IS NULL/);
+});
+
 // ---------------------------------------------------------------------------
 
+await runQueue();
+
+// Put the real modules back so anything importing this file after it is unaffected.
+if (realPool) require.cache[poolPath] = realPool; else delete require.cache[poolPath];
+if (realKernel) require.cache[kernelPath] = realKernel; else delete require.cache[kernelPath];
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/fixtures/accessibility-replay.json

@@ -0,0 +1,93 @@
+{
+  "_comment": "The fixed beginner-prompt set for the accessibility replay regression (task 1002517, clauses 5 and 8 of criterion accessibility-fluency-profile). EIGHT prompts a newcomer to this instance actually asks; each one is the documented trigger of a real surface, so the click-paths named in the non-technical replies are paths that EXIST (Settings -> API keys, Settings -> Session, Settings -> Interaction, the hall task list, the hall blockers page, the hall leaderboard, the hall Deploy page). Prompt 'make-it-live' is the owner's own words, verbatim, 2026-08-22 (task 1003159). Each prompt carries TWO answer runs: the same question answered in the register each profile asks for. The runs are the CONTROLLED variable and the prompt set is fixed - that is what makes this a replay rather than a fixture parade. Nothing here is tuned to a target score: the replies are written in each register and the harness measures what falls out, so a detector that goes blind moves these numbers.",
+  "floor": 6.0,
+  "_floor_comment": "6.0 is not a new number. It is bandFor()'s 'workable' boundary in modules/sessions/accessibility.js - the point the scorer itself calls the difference between prose a newcomer can work with and prose that is merely dense. accessibility_replay.mjs asserts the two stay tied, so retuning the bands cannot silently move the floor.",
+  "prompts": [
+    { "id": "what-to-work-on", "prompt": "What can I work on?" },
+    { "id": "make-it-live", "prompt": "I don't think I can make anything live." },
+    { "id": "art-key", "prompt": "My image generation stopped working." },
+    { "id": "session-expired", "prompt": "It says my session expired." },
+    { "id": "how-you-talk", "prompt": "Can you stop using so much jargon with me?" },
+    { "id": "credits", "prompt": "How do credits work here?" },
+    { "id": "stuck", "prompt": "What's stuck waiting on me?" },
+    { "id": "why-slow", "prompt": "Why is that page so slow?" }
+  ],
+  "runs": {
+    "non_technical": {
+      "_comment": "The register the non-technical profile asks for: lead with the answer, name the click-path before the terminal, define a term the first time it is needed, and frame the trade-off as cost, time and what the reader will see. Two turns deliberately exercise the scorer's FORGIVING paths rather than dodging them - 'why-slow' turn 1 uses the word migration and defines it in the same breath, and turn 2 names the architecture AND what it costs - because a run that scores well only by avoiding every trigger proves nothing about the detectors.",
+      "profile": { "technical_level": "non_technical", "toolchain_familiarity": "new" },
+      "replies": {
+        "what-to-work-on": [
+          "Four jobs are open to you right now. They are on the hall task list, newest first, and each row shows what it pays and roughly how long it takes.",
+          "The second one is the quickest - about twenty minutes, and it pays thirty credits. Tell me its number and I will take it on for you."
+        ],
+        "make-it-live": [
+          "You can do this yourself now, and it is two clicks. In the hall, open Deploy: the page shows the version your site is actually serving and the newer one it would move to.",
+          "The first click previews the move and the second makes it. If the new version does not answer within a minute it puts the old one back on its own, so a bad release cannot leave your site down. It costs nothing and takes about two minutes."
+        ],
+        "art-key": [
+          "Your free art coverage has ended, so pictures now come out of an art key of your own - think of a key as a password that lets us make images on your account, and you pay only for what you make.",
+          "Add it in Settings, under API keys. Do not paste it to me in chat; the Settings page is the only place it should ever go. Most people spend a few dollars per month on this."
+        ],
+        "session-expired": [
+          "That message means your sign-in has timed out. Nothing is lost, and it happens every few weeks on purpose.",
+          "Open Settings, then Session, and choose Re-issue. That hands you a fresh code and I take it from there. It takes under a minute."
+        ],
+        "how-you-talk": [
+          "Yes - and it is a setting, so you will not have to keep asking. Open Settings, then Interaction, and set your technical level to non-technical.",
+          "Every session after that starts already knowing to define a term the first time it comes up, and to talk in cost, time and what you will see on screen. You will notice the difference in the very next reply."
+        ],
+        "credits": [
+          "Credits are the record of what building here actually cost. When a piece of work ships you earn what the session really cost plus twenty per cent, and one credit is one dollar.",
+          "The figure on a task row is only a guide - you are paid on the real cost, never the estimate. Your running total sits on the hall leaderboard."
+        ],
+        "stuck": [
+          "Four things are waiting on you rather than on me. Two need a yes or no and two need a number I cannot guess for you.",
+          "They are all on the hall blockers page, oldest first. The one at the top has been sitting eleven days and is holding up two other jobs, so it is the one worth five minutes."
+        ],
+        "why-slow": [
+          "The page re-reads the whole list every time someone opens it. The fix is a migration - that is a one-off change to the way the information is kept - and it would take about an hour.",
+          "The architecture underneath is fine; the cost is that repeated reading. After the change the page should open in under a second instead of four."
+        ]
+      }
+    },
+    "engineer": {
+      "_comment": "The same eight questions answered the way an engineer profile asks to be answered: terse, command-first, and in the vocabulary of the trade with nothing defined. This run is DELIBERATELY dense in all three signals - that is the point. Under the engineer profile it must not be scored for any of it; under the non-technical profile the very same prose must fall through the floor. One run, two profiles, opposite verdicts is what proves the dimension is profile-relative rather than a taste test.",
+      "profile": { "technical_level": "engineer", "toolchain_familiarity": "comfortable" },
+      "replies": {
+        "what-to-work-on": [
+          "Four ready. Run `node scripts/gds/start.js`, then claim a task by id.",
+          "Second row is a refactor behind the module boundary. The claim is idempotent, so re-running it is a no-op."
+        ],
+        "make-it-live": [
+          "Pin move is gate 3. `bongos upgrade --registry --to <ver> --commit-pin` on the control plane, or the Deploy page enqueues the same intent.",
+          "The control flow is enqueue, drain, health-gate, rollback. SIGTERM on a failed probe and the symlink goes back."
+        ],
+        "art-key": [
+          "Art key is unset. Run `node scripts/gds/api.js` against the settings route, or set it in Settings - either path ends up in the same env file.",
+          "The upstream call is async and the error surfaces on stderr, not in the hall."
+        ],
+        "session-expired": [
+          "Session token expired. Run `bongos auth --reissue`.",
+          "The JWT is short-lived by design and the refresh is idempotent, so a double call is harmless."
+        ],
+        "how-you-talk": [
+          "That is the interaction profile. Run `node scripts/gds/api.js PATCH /settings`, or set it in Settings.",
+          "It is injected per session by the Conductor hook and never memoized, so the change takes on the next turn."
+        ],
+        "credits": [
+          "Cost-plus. Run `node scripts/gds/api.js GET /builders/me` for your balance, or read the leaderboard.",
+          "The write is an upsert keyed on the session, so a replayed ship cannot double-pay."
+        ],
+        "stuck": [
+          "Four open blockers. Run `node scripts/gds/blocker-review.js` to walk them.",
+          "Resolving one will upsert the linked rows to ready inside the same transaction."
+        ],
+        "why-slow": [
+          "N+1 on the list read.",
+          "The ORM will hydrate each row separately. Fold it into one query against the schema with a jsonb aggregate."
+        ]
+      }
+    }
+  }
+}