@bongos/core 1.19.812 → 1.19.814

package/tests/abandon_route.mjs

@@ -0,0 +1,276 @@
+// tests/abandon_route.mjs
+//
+// Regression guard for task 1002443 / ADR 0297 — the COMPOSITION layer of
+// POST /tasks/:id/abandon (modules/lifecycle/routes/abandon-handler.js).
+//
+// WHY THIS FILE EXISTS. The route's authority is assembled from three pieces that
+// each have their own tests and none of which cover the seams between them:
+//   • abandon-authz.js  — the pure decision      (tests/abandon_creator_authz.mjs)
+//   • abandonTask       — the transaction seam   (tests/abandon_task.mjs)
+//   • this handler      — resolve, compose, map  (nothing, until now)
+// A mistake in the wiring — admitting when the government port is absent, mapping
+// a refusal to the wrong status, naming the wrong atom in a denial, passing the
+// wrong flags into the decision — would have passed both of the others. That gap
+// was the grade finding on the first ship of this task; this closes it.
+//
+// No Express, no DB, no live port: the handler takes its collaborators as `deps`,
+// so fakes are enough.
+//
+// Run:  node --test tests/abandon_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { makeAbandonHandler } = require('../modules/lifecycle/routes/abandon-handler.js');
+
+const { test, summary } = makeRunner();
+
+const ME = 7;
+const ANY_KEY = 'task.abandon';
+const OWN_KEY = 'task.abandon.own';
+
+// A res that records instead of writing. `fail` mirrors the real envelope's two
+// call shapes: fail(code, status) and fail(code, { status, message, details }).
+function fakeRes() {
+  const rec = { json: null, fail: null };
+  return {
+    rec,
+    json(body) { rec.json = body; return this; },
+    fail(code, second, third) {
+      const opts = (second && typeof second === 'object') ? second : { status: second };
+      rec.fail = { code, status: opts.status, message: opts.message, details: opts.details ?? third };
+      return this;
+    },
+  };
+}
+
+// A government port with only what the handler actually consults.
+function fakeGovernance({ holds = [], crossOwner = [ANY_KEY], resolveThrows = false, omit = [] } = {}) {
+  const port = {
+    resolveBuilderPermissions: async () => {
+      if (resolveThrows) throw new Error('DB blip');
+      return [...holds];
+    },
+    sameOwner: (a, b) => a != null && b != null && String(a) === String(b),
+    crossOwnerKeysFor: () => [...crossOwner],
+    permissionFloor: (k) => (k === ANY_KEY ? 'metic' : k === OWN_KEY ? 'xenos' : null),
+  };
+  for (const k of omit) delete port[k];
+  return port;
+}
+
+function harness({ governance = fakeGovernance(), abandon, taskId = 42, body = {} } = {}) {
+  const calls = { abandon: null, logged: [] };
+  const deps = {
+    db: {
+      abandonTask: async (args) => {
+        calls.abandon = args;
+        if (typeof abandon === 'function') return abandon(args);
+        return { taskId: args.taskId, taskTitle: 'fixture', taskStatus: 'abandoned', previousStatus: 'ready', alreadyAbandoned: false };
+      },
+    },
+    seams: { resolveOptional: (name) => (name === 'government' ? governance : null) },
+    log: { error: (...a) => calls.logged.push(a) },
+    validateOrRespond: () => false,                    // body is valid
+    parseId: () => taskId,                             // id parses
+  };
+  const req = { builder: { id: ME }, body, params: { id: String(taskId) } };
+  const res = fakeRes();
+  return { handler: makeAbandonHandler(deps), req, res, calls };
+}
+
+// ── the port is the wall, and its absence denies ──────────────────────────────
+await test('a MISSING government port denies fail-closed, and never reaches the db', async () => {
+  // Admitting here would make disabling a module a privilege escalation — the
+  // inversion ADR 0016 exists to prevent.
+  const { handler, req, res, calls } = harness({ governance: null });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.equal(res.rec.fail.code, 'permission_forbidden');
+  assert.equal(res.rec.fail.details.held, null, 'held is null when authority could not be ESTABLISHED');
+  assert.equal(calls.abandon, null, 'no transaction may be opened');
+});
+
+await test('a MALFORMED port (missing a function the decision needs) also denies', async () => {
+  for (const missing of ['resolveBuilderPermissions', 'sameOwner']) {
+    const { handler, req, res, calls } = harness({ governance: fakeGovernance({ holds: [ANY_KEY], omit: [missing] }) });
+    await handler(req, res);
+    assert.equal(res.rec.fail.status, 403, `a port without ${missing} must deny`);
+    assert.equal(calls.abandon, null);
+  }
+});
+
+await test('a THROWING resolver denies rather than surfacing as a 500', async () => {
+  const { handler, req, res, calls } = harness({ governance: fakeGovernance({ resolveThrows: true }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.equal(res.rec.fail.details.held, null);
+  assert.equal(calls.abandon, null);
+  assert.equal(calls.logged.length, 1, 'and it is logged — a DB blip should be visible');
+});
+
+// ── the denial names the right atoms ──────────────────────────────────────────
+await test('holding neither atom is a 403 naming BOTH ways in, with their floors', async () => {
+  const { handler, req, res, calls } = harness({ governance: fakeGovernance({ holds: [] }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.deepEqual(res.rec.fail.details.required, [ANY_KEY, OWN_KEY],
+    'a denial listing only the metic key would send a creator after the wrong permission');
+  assert.deepEqual(res.rec.fail.details.floors, { [ANY_KEY]: 'metic', [OWN_KEY]: 'xenos' });
+  assert.deepEqual(res.rec.fail.details.held, []);
+  assert.equal(calls.abandon, null, 'the cheap pre-check must not open a transaction');
+});
+
+await test('floors come from the PORT, so a moved floor cannot leave a lie in the denial', async () => {
+  const gov = fakeGovernance({ holds: [] });
+  gov.permissionFloor = (k) => (k === ANY_KEY ? 'archon' : null);
+  const { handler, req, res } = harness({ governance: gov });
+  await handler(req, res);
+  assert.deepEqual(res.rec.fail.details.floors, { [ANY_KEY]: 'archon' },
+    'the floor is read at deny time, never hardcoded');
+});
+
+await test('a port that cannot answer floors still denies, without inventing one', async () => {
+  const { handler, req, res } = harness({ governance: fakeGovernance({ holds: [], omit: ['permissionFloor'] }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.deepEqual(res.rec.fail.details.floors, {});
+});
+
+// ── the escalation path is read from the catalog ──────────────────────────────
+await test('the cross-owner key is DERIVED from the catalog, not hardcoded', async () => {
+  // If the declared counterpart ever changes, the route must follow it rather than
+  // keep admitting on a stale pairing.
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: ['task.manage.any'], crossOwner: ['task.manage.any'] }),
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail, null, 'the declared counterpart must admit');
+  assert.equal(res.rec.json.ok, true);
+  assert.equal(calls.abandon.authorize({ createdBy: 999, status: 'completed' }).ok, true,
+    'and it must compose as the CROSS-OWNER branch, unbounded by the creator window');
+});
+
+await test('holding the OLD atom does not admit once the catalog has moved on', async () => {
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY], crossOwner: ['task.manage.any'] }),
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403, 'a catalog that moved on must not leave this gate wide');
+  assert.equal(calls.abandon, null);
+});
+
+await test('a port that cannot name the escalation falls back to the known atom, never to open', async () => {
+  const { handler, req, res } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY], omit: ['crossOwnerKeysFor'] }),
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail, null, 'the fallback keeps the metic path working');
+  assert.equal(res.rec.json.ok, true);
+});
+
+// ── composition: what the decision is actually handed ─────────────────────────
+await test('the own-scoped holder reaches the row question, composed correctly', async () => {
+  const { handler, req, res, calls } = harness({ governance: fakeGovernance({ holds: [OWN_KEY] }) });
+  await handler(req, res);
+  assert.ok(calls.abandon, 'an own-holder must be let as far as the transaction');
+  const verdict = calls.abandon.authorize;
+  assert.equal(verdict({ createdBy: ME, status: 'ready' }).ok, true, 'their own ready task admits');
+  assert.equal(verdict({ createdBy: 999, status: 'ready' }).ok, false, 'someone else\'s does not');
+  assert.equal(verdict({ createdBy: ME, status: 'completed' }).ok, false, 'and not past the grader');
+});
+
+await test('the callback is handed the CALLER as the owner to compare against', async () => {
+  // A wiring slip here (comparing against the task id, or a constant) would make
+  // every creator either always or never the owner.
+  let sawArgs = null;
+  const gov = fakeGovernance({ holds: [OWN_KEY] });
+  gov.sameOwner = (a, b) => { sawArgs = [a, b]; return true; };
+  const { handler, req, res, calls } = harness({ governance: gov });
+  await handler(req, res);
+  calls.abandon.authorize({ createdBy: 'abc', status: 'ready' });
+  assert.deepEqual(sawArgs, ['abc', ME], 'the row owner and the requesting builder, in that order');
+});
+
+await test('the reason is passed through and clamped to 2000 characters', async () => {
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY] }),
+    body: { reason: 'x'.repeat(2500) },
+  });
+  await handler(req, res);
+  assert.equal(calls.abandon.reason.length, 2000);
+});
+
+// ── refusal mapping ──────────────────────────────────────────────────────────
+await test('ABANDON_FORBIDDEN from the locked row maps to 403, carrying its reason', async () => {
+  const { handler, req, res } = harness({
+    governance: fakeGovernance({ holds: [OWN_KEY] }),
+    abandon: async () => { throw Object.assign(new Error('not yours'), { code: 'ABANDON_FORBIDDEN', reason: 'not_task_creator' }); },
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.equal(res.rec.fail.message, 'not yours', 'the row-scoped message reaches the caller');
+  assert.equal(res.rec.fail.details.reason, 'not_task_creator');
+  assert.deepEqual(res.rec.fail.details.held, [OWN_KEY], 'and it reports what they DO hold');
+});
+
+await test('the three lifecycle guards keep their own status codes', async () => {
+  const cases = [
+    ['TASK_NOT_FOUND', 404, 'task_not_found'],
+    ['CANNOT_ABANDON_SHIPPED', 409, 'cannot_abandon_shipped'],
+    ['TASK_HAS_ACTIVE_CLAIM', 409, 'task_has_active_claim'],
+  ];
+  for (const [code, status, envelope] of cases) {
+    const { handler, req, res } = harness({
+      governance: fakeGovernance({ holds: [ANY_KEY] }),
+      abandon: async () => { throw Object.assign(new Error(code), { code }); },
+    });
+    await handler(req, res);
+    assert.equal(res.rec.fail.status, status, `${code} must stay a ${status}`);
+    assert.equal(res.rec.fail.code, envelope);
+  }
+});
+
+await test('an unexpected error is a 500 and is logged, never a silent 403', async () => {
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY] }),
+    abandon: async () => { throw new Error('something else entirely'); },
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 500);
+  assert.equal(res.rec.fail.code, 'abandon_failed');
+  assert.equal(calls.logged.length, 1);
+});
+
+// ── the happy path ───────────────────────────────────────────────────────────
+await test('a successful retire answers ok with the db result spread in', async () => {
+  const { handler, req, res } = harness({ governance: fakeGovernance({ holds: [ANY_KEY] }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail, null);
+  assert.equal(res.rec.json.ok, true);
+  assert.equal(res.rec.json.taskStatus, 'abandoned');
+  assert.equal(res.rec.json.previousStatus, 'ready');
+});
+
+await test('an invalid body or id short-circuits before any authority work', async () => {
+  for (const stop of ['body', 'id']) {
+    const calls = { abandon: null, resolved: 0 };
+    const gov = fakeGovernance({ holds: [ANY_KEY] });
+    const realResolve = gov.resolveBuilderPermissions;
+    gov.resolveBuilderPermissions = async (...a) => { calls.resolved++; return realResolve(...a); };
+    const handler = makeAbandonHandler({
+      db: { abandonTask: async () => { calls.abandon = true; } },
+      seams: { resolveOptional: () => gov },
+      log: { error: () => {} },
+      validateOrRespond: () => stop === 'body',
+      parseId: () => (stop === 'id' ? null : 42),
+    });
+    await handler({ builder: { id: ME }, body: {}, params: {} }, fakeRes());
+    assert.equal(calls.abandon, null, `a bad ${stop} must not reach the db`);
+    assert.equal(calls.resolved, 0, `a bad ${stop} must not even resolve permissions`);
+  }
+});
+
+summary();

package/tests/abandon_task.mjs

@@ -40,10 +40,17 @@ const { test, summary } = makeRunner();
 //   status         → the row's current status
 //   hasActiveClaim → the claims lookup returns an unreleased claim
 //   updatedStatus  → what the UPDATE ... RETURNING reports (restore returns 'backlog')
-function fakePool({ status = 'ready', notFound = false, hasActiveClaim = false, updatedStatus = 'abandoned' }) {
+// createdBy (task 1002443) rides the locked SELECT so the ownership predicate and
+// the UPDATE read the same row version; null is the honest default (every task
+// filed before core_227, and every system vector, has no creator).
+function fakePool({ status = 'ready', notFound = false, hasActiveClaim = false, updatedStatus = 'abandoned', createdBy = null }) {
   return makeSqlAwareClient((s, params) => {
-      if (/^SELECT id, title, status FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
-        return { rows: notFound ? [] : [{ id: params[0], title: 'fixture task', status }] };
+      // Both locked SELECTs, and the optional group is load-bearing: abandonTask
+      // reads created_by (task 1002443) and restoreTask does not, so a regex
+      // pinned to either one alone silently returns no row for the other — which
+      // surfaces as TASK_NOT_FOUND and looks like a code bug, not a fake bug.
+      if (/^SELECT id, title, status(, created_by)? FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
+        return { rows: notFound ? [] : [{ id: params[0], title: 'fixture task', status, created_by: createdBy }] };
       }
       if (/SELECT id FROM claims WHERE task_id = \$1 AND released_at IS NULL/.test(s)) {
         return { rows: hasActiveClaim ? [{ id: 999 }] : [] };
@@ -207,5 +214,140 @@ await test('restore: never consults claims (an abandoned task has none by constr
   assert.equal(all(pool._client.queries, /SELECT id FROM claims/).length, 0);
 });
 
+// =========================================================================
+// task 1002443 / ADR 0297 — the `authorize` seam: the row-scoped veto that lets a
+// task's CREATOR retire their own work without holding the metic-floor
+// task.abandon. The DECISION itself is pinned branch-by-branch in
+// tests/abandon_creator_authz.mjs; what is pinned HERE is the seam's mechanics —
+// what it is handed, when it runs, and that every unhappy path denies.
+
+await test('authorize is handed the LOCKED row: created_by and status', async () => {
+  // The whole point of doing this inside the transaction. If the callback were fed
+  // anything other than the row abandonTask just locked FOR UPDATE, the ownership
+  // check would be reading a different version than the UPDATE writes — the TOCTOU
+  // window this seam exists to close.
+  const pool = fakePool({ status: 'ready', createdBy: 7 });
+  let seen = null;
+  await abandonTask({
+    taskId: TASK,
+    reason: 'mine to retire',
+    authorize: (row) => { seen = row; return { ok: true }; },
+  }, { pool });
+  assert.equal(seen.createdBy, 7, 'created_by must reach the predicate');
+  assert.equal(seen.status, 'ready', 'and so must the row status');
+  assert.equal(seen.taskId, TASK);
+  assert.ok(find(pool._client.queries, /^UPDATE tasks/), 'an admit still performs the write');
+  assert.ok(find(pool._client.queries, /^COMMIT/));
+});
+
+await test('a refusing authorize throws ABANDON_FORBIDDEN, rolls back, writes nothing', async () => {
+  const pool = fakePool({ status: 'ready', createdBy: 8 });
+  await assert.rejects(
+    () => abandonTask({
+      taskId: TASK,
+      authorize: () => ({ ok: false, reason: 'not_task_creator', message: 'not yours' }),
+    }, { pool }),
+    (err) => err.code === 'ABANDON_FORBIDDEN' && err.reason === 'not_task_creator',
+  );
+  assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0, 'a refusal must never write');
+  assert.ok(find(pool._client.queries, /^ROLLBACK/), 'must ROLLBACK');
+});
+
+await test('authorize runs BEFORE the already-abandoned idempotent return', async () => {
+  // Ordering, and it is a disclosure rule rather than a cosmetic one: if the
+  // idempotent branch came first, a builder with no authority over this row could
+  // probe it and read `alreadyAbandoned: true` back as a 200. An unauthorized retry
+  // is a refusal, not a no-op.
+  const pool = fakePool({ status: 'abandoned', createdBy: 8 });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => ({ ok: false, reason: 'not_task_creator' }) }, { pool }),
+    (err) => err.code === 'ABANDON_FORBIDDEN',
+  );
+  assert.ok(!find(pool._client.queries, /^COMMIT/), 'must not COMMIT the idempotent no-op to an unauthorized caller');
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('authorize also precedes the shipped and active-claim guards', async () => {
+  // Same reason: the 409s are informative, so an unauthorized caller must not be
+  // able to distinguish them. A refusal outranks every status branch below it.
+  for (const setup of [{ status: 'shipped' }, { status: 'ready', hasActiveClaim: true }]) {
+    const pool = fakePool({ ...setup, createdBy: 8 });
+    await assert.rejects(
+      () => abandonTask({ taskId: TASK, authorize: () => ({ ok: false }) }, { pool }),
+      (err) => err.code === 'ABANDON_FORBIDDEN',
+      `an unauthorized caller must get ABANDON_FORBIDDEN, not the ${setup.status} guard`,
+    );
+  }
+});
+
+await test('an authorized creator is STILL stopped by the existing guards', async () => {
+  // The widening adds an authority; it removes no guard. A creator who genuinely
+  // owns the row still cannot retire shipped history, nor a task someone is
+  // actively holding.
+  const shipped = fakePool({ status: 'shipped', createdBy: 7 });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => ({ ok: true }) }, { pool: shipped }),
+    (err) => err.code === 'CANNOT_ABANDON_SHIPPED',
+  );
+  const claimed = fakePool({ status: 'ready', createdBy: 7, hasActiveClaim: true });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => ({ ok: true }) }, { pool: claimed }),
+    (err) => err.code === 'TASK_HAS_ACTIVE_CLAIM',
+  );
+  assert.equal(all(claimed._client.queries, /^UPDATE tasks/).length, 0);
+});
+
+await test('the seam is FAIL-CLOSED: anything but an explicit { ok: true } denies', async () => {
+  for (const verdict of [undefined, null, false, {}, { ok: 'yes' }, { ok: 1 }, 'ok', { okay: true }]) {
+    const pool = fakePool({ status: 'ready', createdBy: 7 });
+    await assert.rejects(
+      () => abandonTask({ taskId: TASK, authorize: () => verdict }, { pool }),
+      (err) => err.code === 'ABANDON_FORBIDDEN',
+      `${JSON.stringify(verdict)} must not be read as an admit`,
+    );
+    assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0);
+  }
+});
+
+await test('a THROWING authorize denies rather than escaping as a 500', async () => {
+  const pool = fakePool({ status: 'ready', createdBy: 7 });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => { throw new Error('resolver blew up'); } }, { pool }),
+    (err) => err.code === 'ABANDON_FORBIDDEN' && err.reason === 'authorize_threw',
+  );
+  assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0);
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('authorize never runs for a task that does not exist', async () => {
+  const pool = fakePool({ notFound: true });
+  let called = false;
+  await assert.rejects(
+    () => abandonTask({ taskId: 424242, authorize: () => { called = true; return { ok: true }; } }, { pool }),
+    (err) => err.code === 'TASK_NOT_FOUND',
+  );
+  assert.equal(called, false, 'there is no row to be the owner of');
+});
+
+await test('OMITTING authorize preserves the pre-1002443 behaviour exactly', async () => {
+  // Every caller whose route already gated the transition (and the merge path,
+  // which mirrors this function) must be untouched by the new parameter.
+  const pool = fakePool({ status: 'ready', createdBy: 8 });
+  const out = await abandonTask({ taskId: TASK, reason: 'no authorize supplied' }, { pool });
+  assert.equal(out.taskStatus, 'abandoned');
+  assert.equal(out.previousStatus, 'ready');
+  assert.ok(find(pool._client.queries, /^UPDATE tasks/));
+  assert.ok(find(pool._client.queries, /^COMMIT/));
+});
+
+await test('a non-function authorize is ignored, not treated as a refusal', async () => {
+  // `authorize: null` is the documented "no row-scoped veto" default; only a real
+  // function is consulted. This pins that a caller passing null does not
+  // accidentally brick the gated path it already guards in middleware.
+  const pool = fakePool({ status: 'ready', createdBy: 8 });
+  const out = await abandonTask({ taskId: TASK, authorize: null }, { pool });
+  assert.equal(out.taskStatus, 'abandoned');
+});
+
 // -------------------------------------------------------------------------
 summary();

package/tests/criterion_authoring_gate.mjs

@@ -144,8 +144,29 @@ await test('authority is checked BEFORE goal state — an owner sees goal_not_op
 
 await test('bad_goal_id now means exactly what it says — the mask branch is gone from the route', () => {
   assert.match(doneWhenSrc, /const badGoalId = \(\) => res\.fail\('bad_goal_id'/, 'one helper builds the absent/foreign refusal');
-  assert.match(doneWhenSrc, /if \(!goal \|\| String\(goal\.version_id\) !== String\(versionId\)\) return badGoalId\(\);/, 'absent/foreign goal path');
+  // The absent/foreign check and the refusal it renders are now separated by the
+  // transaction boundary (task 1003840): the check runs inside withTx and returns
+  // a sentinel, because sending a response from inside the transaction would
+  // commit a unit of work the route is in the middle of refusing. So the chain is
+  // asserted in two links rather than as one literal line — the invariant is
+  // "an absent or foreign goal reaches badGoalId and nothing else", which is what
+  // this test was always about.
+  assert.match(
+    doneWhenSrc,
+    /if \(!goal \|\| String\(goal\.version_id\) !== String\(versionId\)\) return \{ badGoal: true \};/,
+    'absent/foreign goal path still refuses, inside the transaction',
+  );
+  assert.match(
+    doneWhenSrc,
+    /if \(outcome\.badGoal\) return badGoalId\(\);/,
+    'and that sentinel is rendered by badGoalId once the transaction resolves',
+  );
   assert.doesNotMatch(doneWhenSrc, /maskAsBadGoalId/, 'no code path renders an authorization refusal as bad_goal_id');
+  // The sentinel must be answered exactly where it is raised — a second producer
+  // with no consumer, or vice versa, is how a refusal quietly becomes a 201.
+  const raised = (doneWhenSrc.match(/badGoal: true/g) || []).length;
+  const answered = (doneWhenSrc.match(/outcome\.badGoal/g) || []).length;
+  assert.equal(raised, answered, 'every badGoal sentinel raised is answered');
 });
 
 await test('a SHIPPED version is refused (409) — closed scope', () => {