@bongos/core 1.19.882 → 1.19.884

package/tests/collab_page.mjs

@@ -23,6 +23,16 @@ function lib() {
   new Function('window', src)(win);
   return win.OTBCollabLib;
 }
+
+// The role vocabulary is pure too, so RUN it for the same reason — a grep over
+// roleWord()'s source would agree with a roleWord() that was wrong.
+function domUtils() {
+  const src = read('modules', 'hall-ui', 'public', 'dom-utils.js');
+  const win = { location: { search: '', hash: '', pathname: '/' }, addEventListener() {}, localStorage: null };
+  const doc = { addEventListener() {}, querySelector: () => null, querySelectorAll: () => [], documentElement: { dataset: {} } };
+  new Function('window', 'document', src)(win, doc);
+  return win.OTB;
+}
 const NOW = Date.parse('2026-08-24T12:00:00Z');
 const daysAgo = (d) => new Date(NOW - d * 86400000).toISOString();
 
@@ -71,8 +81,75 @@ test('ageing changes how a row LOOKS, not only where it sits', () => {
 test('the row markup carries the band class and the label', () => {
   const js = read('modules', 'hall-ui', 'public', 'collab.js');
   assert.match(js, /cb-age cb-age--\$\{band\.id\}/, 'the pill\'s class comes from the band');
-  assert.match(js, /escapeHtml\(band\.label\)/, 'the label is rendered, escaped');
+  assert.match(js, /escapeHtml\(L\.ageLabel\(req\.created_at, nowMs\)\)/, 'the label is rendered, escaped');
   assert.match(js, /L\.ageBand\(req\.created_at, nowMs\)/, 'through the lib, so the boundaries are the tested ones');
+  // THE BAND AND THE LABEL ARE TWO SOURCES ON PURPOSE (task 1004041). Until then
+  // the pill rendered `band.label`, so the band decided both how loud the row
+  // looked AND what it said — which is why fourteen rows past a week carried
+  // fourteen copies of "waiting over a week". The class still comes from the
+  // band (four treatments, readable down a column) and the words now come from
+  // ageLabel (the real age, different on every row). Asserting only one of the
+  // two would let them be collapsed back onto each other.
+  assert.ok(!/escapeHtml\(band\.label\)/.test(js), 'the words are the real age, not the band name again');
+});
+
+test('two rows in the same band do not read identically', () => {
+  // The artist's finding, as an executable claim: a signal that never varies is
+  // not a signal. Every one of these is band 'stale', and no two say the same
+  // thing.
+  const L = lib();
+  const said = [8, 9, 13, 21, 40, 400].map((d) => {
+    assert.equal(L.ageBand(daysAgo(d), NOW).id, 'stale', `${d} days is stale`);
+    return L.ageLabel(daysAgo(d), NOW);
+  });
+  assert.equal(new Set(said).size, said.length, `six stale rows, six different readings: ${said.join(' / ')}`);
+});
+
+test('the age label says how long, coarsely, and never accuses an unknown age', () => {
+  const L = lib();
+  assert.equal(L.ageLabel(daysAgo(0.4), NOW), 'just asked');
+  assert.equal(L.ageLabel(daysAgo(1), NOW), 'waiting a day');
+  assert.equal(L.ageLabel(daysAgo(4), NOW), 'waiting 4 days');
+  assert.equal(L.ageLabel(daysAgo(13), NOW), 'waiting 13 days');
+  // Past a fortnight it goes to weeks: 'waiting 38 days' is a precision nobody
+  // acts on, the same argument the bands were written on.
+  assert.equal(L.ageLabel(daysAgo(21), NOW), 'waiting 3 weeks');
+  for (const bad of [null, undefined, '', 'nonsense']) {
+    assert.equal(L.ageLabel(bad, NOW), 'just asked', `${JSON.stringify(bad)} must not look neglected`);
+  }
+});
+
+test('the two calm bands are not chips, and the date is not said twice', () => {
+  // The chip appears where there is something to say. All four bands keep their
+  // own ink (the test above), but fresh and waiting drop the pill's ring, so a
+  // board of healthy asks does not open as a wall of chips.
+  const css = read('modules', 'hall-ui', 'public', 'collab.css');
+  assert.match(
+    css,
+    /\.cb-age--fresh,\s*\n\.cb-age--waiting\s*\{[^}]*border-color: transparent/,
+    'the calm bands read as quiet text, not as chips',
+  );
+  // And the separate date line is gone: the pill carries the age in words and
+  // the exact timestamp on its title, so a date beside it was one fact twice.
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.ok(!/ov-row__when/.test(js), 'no second rendering of the same fact');
+  assert.match(js, /title="Asked \$\{escapeHtml\(String\(req\.created_at/, 'the exact date is still reachable');
+});
+
+test('the alarm does not sit beside the accent control', () => {
+  // DESIGN.md spends the accent only on what is pressable or live. On "Your
+  // asks" the age pill (danger ink) used to share the right column with the
+  // solid-accent "Someone helped" button, so a warning and a control sat two
+  // centimetres apart in one colour family. The age is a FACT about the ask now;
+  // the right column on that row holds only what you can press.
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  const mine = js.slice(js.indexOf('function mineRow('), js.indexOf('function allRow('));
+  assert.ok(mine.length > 100, 'found mineRow');
+  const right = mine.slice(mine.indexOf('ov-row__right'));
+  assert.ok(!right.includes('ageChip'), 'no age pill in the column that holds the accent button');
+  assert.ok(right.includes('btn-accent'), 'the accent button is still there');
+  const facts = mine.slice(mine.indexOf('ov-row__facts'), mine.indexOf('ov-row__right'));
+  assert.ok(facts.includes('ageChip'), 'the age reads as a fact about the ask');
 });
 
 test('oldest first WITHIN the page, in addition to the band', () => {
@@ -264,6 +341,64 @@ test('the page is the three blocks, led by faces, with the ledes gone', () => {
   assert.match(html, /class="cb-foot"/, 'and it is the foot, not the opener');
 });
 
+test('a person meets the page\'s NUMBERS before its pills', () => {
+  // Task 1003942 promised "a glass figure strip at the top (waiting on you /
+  // your open asks / crafts you answer for)" and shipped without it; the
+  // grader's narc worker caught the omission and the artist's verdict named
+  // what it cost — with nothing calm at the top, the page opens on age pills.
+  const html = read('modules', 'hall-ui', 'public', 'collab.html');
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(html, /<div class="stat-row ov-summary cb-figs" id="cb-figs"/, 'the strip is the shell\'s glass band');
+  // Position is the whole claim: before the blocks, not beside them.
+  assert.ok(html.indexOf('id="cb-figs"') < html.indexOf('cb-band'), 'the strip is ABOVE the blocks');
+  assert.ok(html.indexOf('id="cb-figs"') < html.indexOf('id="cb-all"'), 'and above the board');
+  assert.match(js, /function paintFigures\(/, 'the page fills it');
+  assert.match(js, /paintFigures\(rowsOf\(forMe\), rowsOf\(mine\), crafts\)/, 'from the reads it already makes — no fourth fetch');
+  for (const label of ['Waiting on you', 'Your open asks', 'Roles you answer for']) {
+    assert.ok(js.includes(label), `the strip carries "${label}"`);
+  }
+  // It is painted BEFORE the blocks, so the numbers are on screen first even on
+  // a slow paint.
+  assert.ok(js.indexOf('paintFigures(') < js.indexOf("paintBlock('for-me'"), 'and painted first');
+});
+
+test('ONE WORD, ONE CASING: a sentence takes roleWord, a control takes roleLabel', () => {
+  // The artist's third finding, and the design error under it. Collab said
+  // "Asks to Builders" in its sub line and "You asked artists" six lines down,
+  // because task 1003936 routed one call site through roleLabel() — correct for
+  // a picker, wrong in prose — and reasoned about the other separately.
+  const dom = read('modules', 'hall-ui', 'public', 'dom-utils.js');
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(dom, /function roleWord\(d\)/, 'prose has its own helper');
+  assert.match(dom, /roleAxisLabel, roleLabel, roleWord,/, 'and it is exported');
+  // The rule is written down next to the helper that made it necessary, which is
+  // the third DONE WHEN clause of task 1004041.
+  const nearby = dom.slice(dom.indexOf('function roleLabel('), dom.indexOf('function roleWord('));
+  assert.match(nearby, /A CONTROL TAKES roleLabel\(\); A SENTENCE TAKES roleWord\(\)/, 'the rule sits beside roleLabel');
+  // The page's sentence no longer capitalises a common noun, and no longer
+  // opens on a clause the next clause repeats.
+  assert.match(js, /roleWord\(c\)\}s/, 'the sub line names roles as common nouns');
+  assert.ok(!/Builders asking builders/.test(js), 'the tautology is gone');
+  // A CALL, not a mention: the comment above the sub line names roleLabel() to
+  // explain why it is not used, and a bare /roleLabel\(/ would read that as the
+  // defect it warns about.
+  assert.ok(!/window\.OTB\.roleLabel\(/.test(js), 'no control-voice label inside a sentence on this page');
+});
+
+test('roleWord and roleLabel disagree exactly where they should', () => {
+  // Executed, not grepped: the acronym exception has to survive both ways, or
+  // "You asked uis" ships the next time a ui task files a help request.
+  const { roleLabel, roleWord } = domUtils();
+  assert.equal(roleLabel('engineer'), 'Engineer');
+  assert.equal(roleWord('engineer'), 'engineer');
+  assert.equal(roleLabel('ui'), 'UI');
+  assert.equal(roleWord('ui'), 'UI', 'an acronym is not a common noun in any sentence');
+  assert.equal(roleLabel('unclassified'), 'No role yet');
+  assert.equal(roleWord('unclassified'), 'no role yet');
+  assert.equal(roleWord(''), '');
+  assert.equal(roleWord(null), '');
+});
+
 test('the by-name ask is the one LIT thing — the accent goes on the personal call', () => {
   const js = read('modules', 'hall-ui', 'public', 'collab.js');
   const css = read('modules', 'hall-ui', 'public', 'collab.css');

package/tests/modules.mjs

@@ -3,6 +3,10 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { existsSync } from 'node:fs';
 import modulesMod from '../src/modules.js';
+// Named, not modulesMod.moduleOverrides (task 1004052 strand walk): knip does not credit
+// property access on a default import as using the named export, so the snapshot getter
+// read as dead code and tripped the ratchet that held this branch out of main.
+import { moduleOverrides } from '../src/modules.js';
 
 const {
   resolveModules, isModuleEnabled, enabledModules, enabledDisciplines, clientModules,
@@ -221,3 +225,109 @@ test('a branded sibling (GDS_BRANDING_FILE set, no GDS_MODULES_FILE) defaults to
   // assertion above never reaches it (task 1003487).
   assert.deepEqual(enabledDisciplines(m), ['engineer', 'artist', 'ideator', 'ui']);
 });
+
+// ── the DB override layer (task 1002857, migration core_248) ────────────────────
+// The toggle used to write config/modules.json, which the pull-deploy's
+// `git reset --hard origin/main` then reverted. These pin the precedence the
+// durable replacement has to hold, because getting the ORDER wrong is the only way
+// this feature can be worse than the bug it replaces.
+
+test('1002857: an override outranks the committed instance pack', () => {
+  // The whole point: the pack is what a deploy restores, so an override that sat
+  // below it would be erased by the very event it exists to survive.
+  const m = resolveModules({ instance: OTB, override: { 'dev-box': false }, registry: SAMPLE_REG });
+  assert.equal(m['dev-box'], false, 'the override wins over the pack');
+  assert.equal(m.discord, true, 'a module with no override still reads the pack');
+});
+
+test('1002857: an override turns a module ON as well as off', () => {
+  const m = resolveModules({ instance: VANILLA, override: { discord: true }, registry: SAMPLE_REG });
+  assert.equal(m.discord, true);
+});
+
+test('1002857: env still outranks an override — the incident knob needs no database', () => {
+  const m = resolveModules({
+    instance: VANILLA,
+    override: { 'dev-box': true },
+    env: { OTB_MODULE_DEV_BOX: '0' },
+    envPrefix: 'OTB',
+    registry: SAMPLE_REG,
+  });
+  assert.equal(m['dev-box'], false, 'env must be able to kill a module the DB turned on');
+});
+
+test('1002857: an override for a module this build does not carry is inert, not fatal', () => {
+  // The database outlives any one build: a module can be uninstalled while its row
+  // remains. fromConfig throws on enabling an unknown key (a hand-authored file is
+  // written for THIS build); a table is not, so it must not stop the process.
+  const m = resolveModules({ override: { 'a-module-that-left': true }, registry: SAMPLE_REG });
+  assert.ok(!('a-module-that-left' in m), 'unknown key dropped');
+  // NOT 'enables nothing': some discovered modules (ui-design and friends) are
+  // default-ON for every instance, so the enabled set is legitimately non-empty.
+  // The claim under test is narrower and the one that matters — the unknown key
+  // did not conjure itself into the enabled list.
+  assert.ok(!enabledModules(m).includes('a-module-that-left'), 'and it enables nothing');
+});
+
+test('1002857: no override is "no opinion" — an unreachable database resolves as before', () => {
+  const withEmpty = resolveModules({ instance: OTB, override: {}, registry: SAMPLE_REG });
+  const without = resolveModules({ instance: OTB, registry: SAMPLE_REG });
+  assert.deepEqual({ ...withEmpty }, { ...without }, 'empty snapshot changes nothing');
+});
+
+test('1002857: each module reports the layer that produced its state', () => {
+  const m = resolveModules({
+    neutral: { modules: { discord: false } },
+    instance: OTB,
+    override: { 'dev-box': false },
+    env: { OTB_MODULE_GAME: '0' },
+    envPrefix: 'OTB',
+    registry: SAMPLE_REG,
+  });
+  assert.equal(m.sources['dev-box'], 'override');
+  assert.equal(m.sources.game, 'env');
+  assert.equal(m.sources.discord, 'instance', 'the instance pack outranks the neutral one');
+  assert.equal(m.sources['art-pipeline'], 'instance');
+  // sources must never join the boolean map: clientModules and every JSON
+  // projection of it would start shipping an object where a boolean belongs.
+  assert.ok(!Object.keys(m).includes('sources'), 'sources is non-enumerable');
+  assert.ok(!('sources' in JSON.parse(JSON.stringify(m))), 'and never serialises');
+});
+
+test('1002857: the scope key separates two instances sharing one database', () => {
+  // One checkout can run the default instance and a vanilla sibling, differentiated
+  // only by env. A single global row per module would let one flip the other's.
+  const dflt = modulesMod.moduleScopeKey({ env: {} });
+  const sibling = modulesMod.moduleScopeKey({ env: { GDS_BRANDING_FILE: 'config/branding.cloudbongos.json' } });
+  assert.notEqual(dflt, sibling, 'the two instances must not share a scope');
+  assert.equal(dflt, 'config/modules.json');
+  assert.equal(sibling, 'config/modules.neutral.json');
+  // Posix separators and no absolute path, so the key is stable across a moved
+  // checkout and across Windows vs Linux.
+  assert.ok(!dflt.includes(String.fromCharCode(92)), "posix separators, not a Windows path");
+  assert.deepEqual(
+    modulesMod.moduleScopeKey({ env: { GDS_MODULES_FILE: 'config/other.json' } }),
+    'config/other.json',
+  );
+});
+
+test('1002857: setModuleOverrides installs the snapshot AND invalidates the cache', () => {
+  // Setting without reloading would leave the live process on a stale answer —
+  // the exact class of bug this feature exists to remove.
+  try {
+    const before = modulesMod.modules();
+    assert.equal(before['dev-box'], false, 'precondition: off on a vanilla resolve');
+    const after = modulesMod.setModuleOverrides({ 'dev-box': true });
+    assert.equal(after['dev-box'], true, 'the returned set reflects the override');
+    assert.equal(modulesMod.modules()['dev-box'], true, 'and so does the live singleton');
+    assert.equal(moduleOverrides()['dev-box'], true);
+  } finally {
+    modulesMod._resetForTests();
+  }
+});
+
+test('1002857: _resetForTests clears the override snapshot too', () => {
+  modulesMod.setModuleOverrides({ 'dev-box': true });
+  modulesMod._resetForTests();
+  assert.deepEqual(moduleOverrides(), {}, 'a leaked snapshot would cross-contaminate tests');
+});

package/tests/modules_route_wiring.mjs

@@ -0,0 +1,103 @@
+// tests/modules_route_wiring.mjs — task 1002857.
+//
+// WHY THIS FILE EXISTS. The DB-backed enablement override shipped its first round
+// with `moduleOverrides.listOverrides()` and `moduleOverrides.setOverride()` called
+// in src/bongos/routes/modules.js and NOTHING binding that name — the require was
+// lost to a patch that aborted before writing. Every call to GET /modules and
+// POST /modules/:key/enable would have thrown ReferenceError.
+//
+// tests/modules.mjs did not catch it and could not: it covers the PURE layer —
+// resolveModules, moduleScopeKey, setModuleOverrides — and a resolver cannot know
+// whether the route that calls it can see its collaborators. The gap was the
+// seam, so this file tests the seam: it INVOKES the handlers rather than merely
+// importing the module, because an unbound identifier is a runtime error and
+// importing a file with one is perfectly quiet.
+//
+// Hermetic. No DB, no port, no supertest: the router is built, its handler pulled
+// off the Express stack and driven with a fake req/res. listOverrides() swallows
+// its own connection error and returns [], which is the documented no-database
+// behaviour — so GET must still answer here.
+//
+// Run:  node --test tests/modules_route_wiring.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { listOverrides, setOverride, refreshOverrides, clearOverride } from '../src/bongos/module-overrides.js';
+
+const require = createRequire(import.meta.url);
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+
+// The LAST handler on a route is the asyncHandler-wrapped business logic; the
+// earlier layers are auth, which this test deliberately does not exercise.
+function handlerFor(router, method, path) {
+  const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${path} on the router`);
+  const stack = layer.route.stack;
+  return stack[stack.length - 1].handle;
+}
+
+function fakeRes() {
+  const res = {
+    statusCode: 200,
+    body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    fail(code, opts) { this.body = { error: code, ...opts }; return this; },
+  };
+  return res;
+}
+
+// An error thrown inside the handler must reach us, not be swallowed into a
+// passing test — asyncHandler forwards to next(err), so capture that too.
+async function invoke(handler, req) {
+  const res = fakeRes();
+  let nextErr = null;
+  await handler(req, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+test('1002857: GET /modules runs — every collaborator it calls is actually bound', async () => {
+  const router = buildModulesRouter();
+  const res = await invoke(handlerFor(router, 'get', '/modules'), { params: {}, query: {}, body: {} });
+  assert.ok(Array.isArray(res.body.modules), 'it answered with a module list');
+  // The fields this task added, proving the override collaborator really ran
+  // rather than being skipped by a short-circuit somewhere.
+  assert.equal(typeof res.body.scope, 'string', 'the scope key is reported');
+  assert.ok(res.body.scope.length > 0);
+  for (const m of res.body.modules) {
+    assert.equal(typeof m.enabled_source, 'string', `${m.key} reports which layer won`);
+    assert.ok('override' in m, `${m.key} reports its override row (null when none)`);
+  }
+});
+
+test('1002857: POST /modules/:key/enable rejects a non-boolean before touching the database', async () => {
+  // Drives the toggle handler far enough to prove IT is wired too, without a DB:
+  // the body check comes first, so this exercises the handler's own code path and
+  // would still have thrown ReferenceError had the require stayed missing... which
+  // is why the next assertion matters more than this one.
+  const router = buildModulesRouter();
+  const res = await invoke(handlerFor(router, 'post', '/modules/:key/enable'), {
+    params: { key: 'dev-box' }, query: {}, body: { enabled: 'yes-please' }, builder: { id: 1 },
+  });
+  assert.equal(res.body.error, 'invalid_body');
+});
+
+test('1002857: the route module can see module-overrides — the require the first round lost', () => {
+  // The direct form of the blocker, stated so it cannot regress by a different
+  // route: the file must BIND the collaborator, and that collaborator must carry
+  // the two methods the handlers call. src/modules.js also exports a
+  // `moduleOverrides` (a sync getter for the snapshot), which is NOT this module —
+  // mistaking one for the other is exactly how the first round read as plausible.
+  const src = require('node:fs').readFileSync('src/bongos/routes/modules.js', 'utf8');
+  assert.match(src, /require\('\.\.\/module-overrides'\)/, 'the route requires ../module-overrides');
+  // Asserted through the NAMED IMPORTS at the top of this file rather than by indexing the
+  // module with strings. Two reasons, and the second is why it changed: a missing export now
+  // fails at load naming the export, instead of at an assertion; and knip cannot see a string
+  // as a usage, so indexing left clearOverride reading as dead code and tripped the ratchet
+  // that held this branch out of main for 20h (task 1004052 strand walk).
+  for (const [name, fn] of Object.entries({ listOverrides, setOverride, refreshOverrides, clearOverride })) {
+    assert.equal(typeof fn, 'function', `module-overrides exports ${name}`);
+  }
+});

package/tests/publish_branch_route.mjs

@@ -471,11 +471,11 @@ await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even w
       const router = buildTasksRouter();
       const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
       const handler = layer.route.stack[layer.route.stack.length - 1].handle;
-      const out = { failCode: null, jsonBody: null };
+      const out = { failCode: null, failOpts: null, jsonBody: null };
       const res = {
         status() { return this; },
         json(b) { out.jsonBody = b; return this; },
-        fail(code) { out.failCode = code; return this; },
+        fail(code, opts) { out.failCode = code; out.failOpts = opts; return this; },
       };
       // rank archon → gateTaskOwnership passes with no DB lookup, keeping the test hermetic.
       const req = { params: { id: '77' }, body: { head_sha: 'a'.repeat(40) }, builder: { id: 95, rank: 'archon' } };
@@ -483,9 +483,77 @@ await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even w
       assert.equal(out.failCode, 'push_unconfigured', 'no credential → still the usual 503 to the caller');
       assert.deepEqual(recorded, [{ taskId: 77, builderId: 95, sha: 'a'.repeat(40) }],
         'the tip is recorded BEFORE the credential check — the wave-strand cure');
+      // task 1004055: and the 503 must SAY the tip landed. This exit is the one a
+      // caller is most likely to misread as total failure; ship.js decides whether
+      // to warn the builder off this flag, so it has to travel on the error too.
+      assert.equal(out.failOpts && out.failOpts.details && out.failOpts.details.tip_recorded, true,
+        'the 503 must carry tip_recorded:true — the write happened before it');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+  }
+});
+
+// task 1004055: the SILENT MISS. setClaimPublishedSha returns null when the UPDATE
+// matched no claim row, and the old route discarded that return value — so a caller
+// that had already merged to main was told nothing was wrong, and only found out one
+// call later as an opaque ship_land_not_proven 409, with the task parked at
+// 'confirmed' gating its builder's whole queue. `tip_recorded` is what makes that
+// answerable at the moment it happens.
+await t('POST /tasks/:id/attest-gate reports tip_recorded:false when no claim row matched', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const savedHolder = dbMod.getLastClaimHolder;
+  // null = "the UPDATE matched nothing", the shape db-ship.js really returns.
+  dbMod.setClaimPublishedSha = async () => null;
+  dbMod.getLastClaimHolder = async () => ({ builder_id: 95 });
+  try {
+    // A credential IS configured, so the handler reaches res.json; a below-Metic rank
+    // means postGateAuthorTrust declines on the pure rank check and never fetches.
+    await withEnv({ GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined, GITHUB_PUSH_TOKEN: 'ghp_fake_for_isConfigured' }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { failCode: null, jsonBody: null };
+      const res = {
+        status() { return this; },
+        json(b) { out.jsonBody = b; return this; },
+        fail(code) { out.failCode = code; return this; },
+      };
+      const req = { params: { id: '77' }, body: { head_sha: 'b'.repeat(40) }, builder: { id: 95, rank: 'thetes' } };
+      await handler(req, res);
+      assert.equal(out.failCode, null, 'a below-Metic attest is a 200, not a failure');
+      assert.equal(out.jsonBody.ok, true);
+      assert.equal(out.jsonBody.attested, false, 'below Metic → no attestation, as before');
+      assert.equal(out.jsonBody.tip_recorded, false,
+        'nothing was recorded, and the response must say so rather than reading as success');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+    dbMod.getLastClaimHolder = savedHolder;
+  }
+});
+
+await t('POST /tasks/:id/attest-gate reports tip_recorded:true on the happy path', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const savedHolder = dbMod.getLastClaimHolder;
+  dbMod.setClaimPublishedSha = async () => 4242; // a claim id = the UPDATE matched
+  dbMod.getLastClaimHolder = async () => ({ builder_id: 95 });
+  try {
+    await withEnv({ GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined, GITHUB_PUSH_TOKEN: 'ghp_fake_for_isConfigured' }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { jsonBody: null };
+      const res = { status() { return this; }, json(b) { out.jsonBody = b; return this; }, fail() { return this; } };
+      const req = { params: { id: '77' }, body: { head_sha: 'c'.repeat(40) }, builder: { id: 95, rank: 'thetes' } };
+      await handler(req, res);
+      assert.equal(out.jsonBody.tip_recorded, true);
     });
   } finally {
     dbMod.setClaimPublishedSha = savedSet;
+    dbMod.getLastClaimHolder = savedHolder;
   }
 });