@bongos/core 1.19.889 → 1.19.891

package/tests/grader_reader_lens.mjs

@@ -0,0 +1,257 @@
+// tests/grader_reader_lens.mjs — the advisory Reader lens (task 1003977, ADR 0298).
+//
+// The owner settled three terms on 2026-09-17 and each is pinned here:
+//   SCOPE      copy-bearing diffs only, keyed off the ONE existing predicate.
+//   AUTHORITY  advisory, full stop — it cannot fail, cannot reach 'concerns',
+//              and cannot block via an error or a timeout.
+//   STANDARD   docs/voice.md, cited by rule id.
+//
+// The task names the error exemption as "the single most important test in this
+// task", because a worker error normally HARD-FAILS the panel
+// (panel_gate: 'ANY worker.error != null → passed=false'). It is §2 below.
+//
+// The subtlest case is §3: a HEALTHY reader must not mask a total grader
+// outage. Before the non-gating partition, a passing fifth worker would make
+// "every gating worker is missing signal" false, and a total outage would
+// present as FAIL · 0/10 with every axis null — the exact regression class
+// task 1003574 documents, where a builder sat dark on an unclearable re-grade.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const grader = require('../modules/grading/grader.js');
+const WORKERS = require('../modules/grading/grader-workers/index.js');
+const reader = require('../modules/grading/grader-workers/reader.js');
+const { hasPanelEvidence } = require('../modules/grading/grader-score.js');
+const { hasCopyOrVisualWork } = require('../modules/lifecycle/cascade.js');
+
+const W = (kind, verdict, extra = {}) => ({
+  kind, name: kind, verdict, scores: {}, issues: [], confidence: 0.9, error: null, ...extra,
+});
+const healthyFour = () => [
+  W('narc', 'pass', { scores: { functional_fidelity: 9 } }),
+  W('quality', 'pass', { scores: { code_quality: 9, economy: 9 } }),
+  W('hacker', 'pass', { scores: { security_score: 9 } }),
+  W('efficiency', 'pass', { scores: { efficiency_score: 9 } }),
+];
+const agg = (ws) => grader.aggregatePanel(ws, {});
+
+// ---- 1. AUTHORITY: the verdict itself cannot be a blocking one -------------
+
+test('computeVerdict returns "advisory" on EVERY path, including its own failures', () => {
+  // Structural, not a filter: there is no branch that returns pass/concerns/fail,
+  // so "it cannot block" is a property of the function rather than a promise
+  // kept by its callers.
+  const paths = [
+    ['clean', [{ copy_score: 10, issues: [] }, {}]],
+    ['bad copy', [{ copy_score: 0, issues: [{ severity: 'major', kind: 'break', rule: 'V1' }] }, {}]],
+    ['subagent error', [null, { subprocess_error: 'SUBAGENT_TIMEOUT' }]],
+    ['spawn failure', [null, { subprocess_error: 'SUBAGENT_SPAWN_FAILED' }]],
+    ['unparseable', ['not json at all', {}]],
+    ['schema error', [{ copy_score: 'banana', issues: [] }, {}]],
+    ['null parse', [null, {}]],
+  ];
+  for (const [name, [parsed, meta]] of paths) {
+    const v = reader.computeVerdict(parsed, meta);
+    assert.equal(v.verdict, 'advisory', `${name} → ${v.verdict}`);
+    assert.equal(v.verdict, reader.ADVISORY_VERDICT);
+  }
+});
+
+test('an errored Reader reports NO score rather than a zero', () => {
+  // 0/10 is a real reading ("would embarrass the project in front of a user").
+  // An outage is missing signal, not a bad signal — the distinction #943 draws
+  // for the whole panel, applied to one worker.
+  const v = reader.computeVerdict(null, { subprocess_error: 'SUBAGENT_TIMEOUT' });
+  assert.deepEqual(v.scores, {});
+  assert.equal(v.error, 'SUBAGENT_TIMEOUT');
+});
+
+test('a blocker severity is FLOORED to major, not dropped', () => {
+  // Dropping would hide a real observation; honouring would hand this lens the
+  // veto the owner's term denies it.
+  const v = reader.computeVerdict({ copy_score: 3, issues: [{ severity: 'blocker', kind: 'break', rule: 'V2' }] }, {});
+  assert.equal(v.issues.length, 1, 'the finding survives');
+  assert.equal(v.issues[0].severity, 'major');
+  assert.equal(v.issues[0].severity_floored_from, 'blocker');
+});
+
+// ---- 2. THE EXEMPTION THE TASK CALLS THE MOST IMPORTANT --------------------
+
+test('NO Reader outcome can stop a ship — including an error, which normally hard-fails', () => {
+  const baseline = agg(healthyFour());
+  assert.equal(baseline.passed, true);
+
+  const cases = {
+    'clean reader': W('reader', 'advisory', { scores: { copy_score: 9 } }),
+    'copy_score 0': W('reader', 'advisory', { scores: { copy_score: 0 } }),
+    'errored (timeout)': W('reader', 'advisory', { error: 'SUBAGENT_TIMEOUT' }),
+    'errored (prompt too long)': W('reader', 'advisory', { error: 'PROMPT_TOO_LONG' }),
+    'two major findings': W('reader', 'advisory', { scores: { copy_score: 2 }, issues: [{ severity: 'major' }, { severity: 'major' }] }),
+    // Belt AND braces: even if a future edit made the worker emit a gating
+    // verdict, the panel partition still refuses to read it.
+    'ILLEGALLY emits fail': W('reader', 'fail', { issues: [{ severity: 'blocker' }] }),
+  };
+  for (const [name, row] of Object.entries(cases)) {
+    const r = agg([...healthyFour(), row]);
+    assert.equal(r.passed, true, `${name} must not block the ship`);
+    assert.equal(r.signals.panel_outcome, 'pass', `${name} must not move the outcome`);
+  }
+});
+
+test('the Reader is absent from every gate count', () => {
+  const r = agg([...healthyFour(), W('reader', 'advisory', { error: 'SUBAGENT_TIMEOUT' })]);
+  assert.equal(r.signals.worker_count, 4, 'the gate denominator counts gating workers only');
+  assert.equal(r.signals.error_count, 0, "an errored Reader is not a gate error");
+  assert.equal(r.signals.fail_count, 0);
+  assert.equal(r.signals.pass_count, 4);
+});
+
+// ---- 3. THE SUBTLE ONE -----------------------------------------------------
+
+test('a HEALTHY Reader does not mask a total grader outage', () => {
+  const allErrored = ['narc', 'quality', 'hacker', 'efficiency'].map((k) => W(k, 'fail', { error: 'SUBAGENT_SPAWN_FAILED' }));
+  const without = agg(allErrored);
+  assert.equal(without.signals.panel_outcome, 'unavailable', 'baseline: a total outage is an outage');
+
+  const with_ = agg([...allErrored, W('reader', 'advisory', { scores: { copy_score: 9 } })]);
+  assert.equal(with_.signals.panel_outcome, 'unavailable',
+    'a passing fifth worker must not turn an outage into a FAIL 0/10 (the task-1003574 class)');
+  assert.equal(with_.passed, false);
+});
+
+test("the Reader's confidence cannot move the server-gate median", () => {
+  const four = healthyFour();
+  const noReader = agg(four).signals.confidence;
+  const withReader = agg([...four, W('reader', 'advisory', { confidence: 0.01, scores: { copy_score: 1 } })]).signals.confidence;
+  assert.equal(withReader, noReader, 'a low-confidence Reader must not drag the forwarded confidence');
+});
+
+// ---- 4. THE SIGNAL STILL LANDS ---------------------------------------------
+
+test('copy_score and the findings reach the RECORD even though the gate ignores them', () => {
+  const r = agg([...healthyFour(), W('reader', 'advisory', { scores: { copy_score: 4 }, issues: [{ severity: 'major', rule: 'V1' }] })]);
+  assert.equal(r.rubric_scores.copy_score, 4, 'the score is recorded');
+  assert.ok(r.signals.workers.some((w) => w.kind === 'reader'), 'the Reader row is in the record');
+  assert.equal(agg(healthyFour()).rubric_scores.copy_score, null, 'and is null when no Reader ran');
+});
+
+test('a Reader row still counts as evidence that the panel ran', () => {
+  // hasPanelEvidence is an `every` over the worker verdicts. Leave 'advisory'
+  // out of WORKER_VERDICTS and a fully-healthy five-worker panel reads as NO
+  // evidence, firing the implausible-pass guard on exactly the ships carrying
+  // the most lenses.
+  const rows = (extra = []) => ({ workers: [
+    { kind: 'narc', verdict: 'pass' }, { kind: 'quality', verdict: 'pass' },
+    { kind: 'hacker', verdict: 'pass' }, { kind: 'efficiency', verdict: 'pass' }, ...extra,
+  ] });
+  assert.equal(hasPanelEvidence(rows()), true);
+  assert.equal(hasPanelEvidence(rows([{ kind: 'reader', verdict: 'advisory' }])), true);
+  assert.equal(hasPanelEvidence(rows([{ kind: 'reader', verdict: 'nonsense' }])), false, 'the vocabulary is still closed');
+});
+
+// ---- 5. SCOPE --------------------------------------------------------------
+
+test('the panel is byte-identical to today when the diff is not copy-bearing', () => {
+  assert.deepEqual(WORKERS.panelFor({ copyBearing: false }), WORKERS.DEFAULT_PANEL);
+  assert.deepEqual(WORKERS.panelFor(), WORKERS.DEFAULT_PANEL, 'and when the caller says nothing');
+  assert.deepEqual(WORKERS.panelFor({ copyBearing: true }), [...WORKERS.DEFAULT_PANEL, 'reader']);
+});
+
+test('scope keys off the ONE existing predicate, not a second copy', () => {
+  // The at-ship lens and the after-the-fact artist review must never disagree
+  // about what they cover. Widening COPY_VISUAL_MODULES must widen both at once,
+  // which it only does while there is one predicate.
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-grade.js'), 'utf8');
+  assert.match(src, /hasCopyOrVisualWork/, 'the caller asks lifecycle for the answer');
+  assert.match(src, /panelFor\(\{ copyBearing \}\)/, 'and passes it down');
+  // RECURSIVE. A readdirSync of modules/grading alone skips grader-workers/,
+  // which holds reader.js — the file this assertion is most about. The first
+  // version of this test did exactly that and proved nothing it claimed.
+  const walk = (dir) => fs.readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
+    const full = path.join(dir, e.name);
+    return e.isDirectory() ? walk(full) : (e.name.endsWith('.js') ? [full] : []);
+  });
+  const gradingFiles = walk(path.join(ROOT, 'modules', 'grading'));
+  assert.ok(gradingFiles.some((f) => f.endsWith(`grader-workers${path.sep}reader.js`)),
+    'the scan reaches grader-workers/reader.js — otherwise it checks everything except the file in question');
+  for (const f of gradingFiles) {
+    const body = fs.readFileSync(f, 'utf8').replace(/^\s*\/\/.*$/gm, '');
+    assert.ok(!/COPY_VISUAL_MODULES|copy-proposal/.test(body),
+      `${path.relative(ROOT, f)} must not re-implement the copy predicate — grading cannot require lifecycle (ADR 0083), so the CALLER decides`);
+  }
+  // Sanity: the predicate really does discriminate.
+  assert.equal(hasCopyOrVisualWork({ discipline: 'artist' }), true);
+  assert.equal(hasCopyOrVisualWork({ module_key: 'hall-ui' }), true);
+  assert.equal(hasCopyOrVisualWork({ module_key: 'grading', discipline: 'engineer' }), false);
+});
+
+// ---- 6. STANDARD -----------------------------------------------------------
+
+test('the prompt sends the worker to the written guide, and forbids an uncited finding', () => {
+  const p = reader.PROMPT_HEADER;
+  assert.match(p, /docs\/voice\.md/, 'the rubric is the voice guide');
+  assert.match(p, /cites no rule id is not a finding/i, "the guide's own rule travels with it");
+  // The hard/judgement split is what stops an advisory lens recording taste as
+  // fact, so it is pinned rather than left to the prompt's good intentions.
+  assert.match(p, /V1-V5/, 'hard rules may be asserted');
+  assert.match(p, /V6-V11/, 'judgement rules may only be flagged');
+  assert.match(p, /ADVISORY/, 'the worker is told it cannot block');
+  assert.ok(!/blocker/.test(p.split('## Return ONLY JSON')[1] || ''),
+    'the JSON schema offers no blocker severity');
+});
+
+test('docs/voice.md exists — the lens has a standard to judge against', () => {
+  // The hard dependency (task 1003976). A copy lens with no written standard
+  // records taste and calls it a finding.
+  const guide = fs.readFileSync(path.join(ROOT, 'docs', 'voice.md'), 'utf8');
+  for (const id of ['V1', 'V2', 'V3', 'V4', 'V5']) {
+    assert.ok(guide.includes(`## ${id} —`) || guide.includes(`## ${id} `), `${id} is a rule in the guide`);
+  }
+});
+
+// ---- 7. THE DONE-WHEN CLAUSE THAT LIVES IN ANOTHER FILE ---------------------
+
+test('the artist review now coaches the reader, because there is a lens listening', () => {
+  // The task's own DONE WHEN: "Then STEP 1 of the artist review reverts to true
+  // coaching — see the comment in modules/lifecycle/cascade.js, which says so
+  // and asks not to be reverted early." The interim wording was explicitly a
+  // signal for which world we are in, so shipping the lens without turning it
+  // leaves the instruction to artists describing a panel that no longer exists.
+  const { artistReviewBody } = require('../modules/lifecycle/cascade.js');
+  const body = artistReviewBody({ id: '1234' });
+  assert.match(body, /COACH THE READER/, 'STEP 1 asks for coaching again');
+  assert.match(body, /docs\/voice\.md/, 'and names the standard to coach against');
+  assert.ok(!/none of them reads a sentence/.test(body),
+    'the interim claim that no lens reads a sentence is gone — it is no longer true');
+  // Still a request, never a gate (ADR 0241) — unchanged by this task.
+  assert.match(body, /REQUEST, not a gate/);
+});
+
+test('the cascade and the copy lens cover the SAME set by construction', () => {
+  // Both key off hasCopyOrVisualWork, so an artist review exists for exactly
+  // the ships a reader ran on. If these ever diverge, an artist is asked to
+  // coach a lens that never looked.
+  const cascadeSrc = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'cascade.js'), 'utf8');
+  const shipSrc = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-grade.js'), 'utf8');
+  assert.match(cascadeSrc, /hasCopyOrVisualWork/);
+  assert.match(shipSrc, /hasCopyOrVisualWork/);
+});
+
+// ---- 8. COST ---------------------------------------------------------------
+
+test('the Reader sits at the heavy timeout tier, so it cannot change worst-case wall time', () => {
+  // The four already sit at 360s and workers run in parallel, so the panel's
+  // wall time is max() and a fifth at the same budget does not move it.
+  const t = WORKERS.timeoutForWorker(reader, {});
+  assert.equal(t, 360_000);
+  for (const k of ['narc', 'quality', 'hacker', 'efficiency']) {
+    assert.equal(WORKERS.timeoutForWorker(WORKERS.REGISTRY[k], {}), t, `${k} shares the tier`);
+  }
+});

package/tests/status_default_version.mjs

@@ -0,0 +1,136 @@
+// tests/status_default_version.mjs — /status resolves its default version at
+// RUNTIME and never falls back to a sealed one (task 1004071).
+//
+// THE INCIDENT. `scripts/gds/status.js:29` read
+//   const DEFAULT_VERSION = resolveEnv('STATUS_DEFAULT_VERSION') || 'BONGOS-V1';
+// while the comment three lines above stated the rule it was meant to keep:
+// "the bare /status card should default to the live version, not a sealed one."
+// BONGOS-V1 was later sealed and the literal was never bumped, so bare `/status`
+// served a shipped version's closing scoreboard — 140/203 satisfied — as the
+// project's CURRENT status. The output looks perfectly healthy, which is why it
+// sat: nothing in the header says `shipped`, and /status is exactly what a
+// session runs when it does NOT already know the answer and so cannot tell.
+//
+// WHY THE GUARD DID NOT CATCH IT. version-literal-guard.js already hunts this
+// shape and already owns the remedy (version-select.js). status.js was on its
+// allowlist, justified by "TWO versions are currently building — so 'most recent
+// building' is not a derivable answer here." That was TRUE when written
+// (BONGOS-V1 + CB-V1). It is false now: one version is building. The entry did
+// not become wrong through anyone's error — the world moved under a justification
+// that was a claim about live state, with nothing re-checking it. That staleness
+// is the class defect, and `version_literals.mjs` now pins it.
+//
+// The rule these tests hold: an EXPLICIT choice always wins (flag, then env),
+// a default is RESOLVED, and when nothing is building we stop rather than guess.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const status = require(path.join(ROOT, 'scripts', 'gds', 'status.js'));
+const { parseArgs, resolveVersion } = status;
+
+// A deps bundle with nothing configured: no env override, nothing building.
+const deps = (over = {}) => ({
+  resolveEnv: () => null,
+  resolveDefaultVersion: async () => null,
+  ...over,
+});
+
+// ---- parseArgs no longer bakes the default in -----------------------------
+test('parseArgs leaves version NULL when none is given, so main can resolve it', () => {
+  const o = parseArgs(['node', 'status.js']);
+  assert.equal(o.version, null, 'a literal default here is the bug this task fixes');
+  assert.equal(o.criterion, null, 'and nothing was mistaken for a criterion');
+});
+
+test('an explicit --version is still carried through', () => {
+  const o = parseArgs(['node', 'status.js', '--version', 'BONGOS-V2']);
+  assert.equal(o.version, 'BONGOS-V2');
+
+});
+
+test('a bare version token is carried through too', () => {
+  const o = parseArgs(['node', 'status.js', 'BONGOS-V2']);
+  assert.equal(o.version, 'BONGOS-V2');
+
+});
+
+test('a bare Cn token is a criterion, not a version', () => {
+  const o = parseArgs(['node', 'status.js', 'C8']);
+  assert.equal(o.criterion, 'C8');
+  assert.equal(o.version, null, 'C8 must not be mistaken for a version id');
+});
+
+// ---- the resolution order -------------------------------------------------
+test('an explicit flag beats both the env override and the building lookup', async () => {
+  const r = await resolveVersion({ version: 'GDS-V3' }, deps({
+    resolveEnv: () => 'ENV-V9',
+    resolveDefaultVersion: async () => 'BONGOS-V2',
+  }));
+  assert.equal(r.version, 'GDS-V3');
+  assert.equal(r.defaulted, false, 'the user chose it, so nothing was defaulted');
+  assert.equal(r.source, 'flag');
+});
+
+test('the env override beats the building lookup, and still counts as defaulted', async () => {
+  const r = await resolveVersion({ version: null }, deps({
+    resolveEnv: () => 'ENV-V9',
+    resolveDefaultVersion: async () => 'BONGOS-V2',
+  }));
+  assert.equal(r.version, 'ENV-V9');
+  assert.equal(r.source, 'env');
+  assert.equal(r.defaulted, true, 'the user did not name it on this invocation');
+});
+
+test('with no flag and no env, the BUILDING version is resolved at runtime', async () => {
+  const r = await resolveVersion({ version: null }, deps({
+    resolveDefaultVersion: async () => 'BONGOS-V2',
+  }));
+  assert.equal(r.version, 'BONGOS-V2');
+  assert.equal(r.source, 'building');
+  assert.equal(r.defaulted, true);
+});
+
+test('THE INCIDENT: when nothing is building we return null, never a sealed guess', async () => {
+  // version-select.js already refuses to guess here, and status must not
+  // reintroduce the guess downstream of it. A sealed version's final scoreboard
+  // presented as current status is worse than an error, because it looks fine.
+  const r = await resolveVersion({ version: null }, deps());
+  assert.equal(r.version, null);
+  assert.equal(r.source, 'none');
+});
+
+test('a resolved default never returns a SHIPPED version', async () => {
+  // Wired through the real selection rule rather than a stub, so this test fails
+  // if pickDefaultVersion is ever loosened to fall back to the newest-any-status.
+  const { pickDefaultVersion } = require(path.join(ROOT, 'scripts', 'gds', 'version-select.js'));
+  const versions = [
+    { id: 'BONGOS-V1', status: 'shipped', started_at: '2026-06-20' },
+    { id: 'CB-V1', status: 'shipped', started_at: '2026-06-21' },
+    { id: 'BONGOS-V2', status: 'building', started_at: '2026-06-22' },
+  ];
+  const r = await resolveVersion({ version: null }, deps({
+    resolveDefaultVersion: async () => pickDefaultVersion(versions),
+  }));
+  assert.equal(r.version, 'BONGOS-V2', 'the only building row wins over two newer-looking sealed ones');
+});
+
+// ---- the drill-in must say which version it answered about ----------------
+test('a DEFAULTED version is announced, so a cross-version answer cannot pass unnoticed', () => {
+  // Cn is version-scoped and the versions number independently: BONGOS-V1 C8 is
+  // `money-one-unit`, BONGOS-V2 C8 is `wa6-kernel-and-packs`. Asking for "C8"
+  // against a silently-defaulted version answers a different question than the
+  // one asked, and the old output gave the reader nothing to notice it by.
+  const note = status.defaultedVersionNote({ version: 'BONGOS-V2', defaulted: true, source: 'building' });
+  assert.match(note, /BONGOS-V2/, 'it names the version it resolved');
+  assert.match(note, /building/, 'and why that one');
+});
+
+test('an explicitly chosen version is NOT announced — no noise when the user said it', () => {
+  const note = status.defaultedVersionNote({ version: 'BONGOS-V2', defaulted: false, source: 'flag' });
+  assert.equal(note, '', 'the user already knows which version they asked for');
+});

package/tests/version_literals.mjs

@@ -199,3 +199,95 @@ test('ship-flow.js imports every cross-module function it calls', () => {
     }
   }
 });
+
+// ---- an exemption must not outlive its justification ----------------------
+// Task 1004071. scripts/gds/status.js sat on VERSION_LITERAL_ALLOW justified by
+// "TWO versions are currently building — so 'most recent building' is not a
+// derivable answer here." That was true the day it was written (BONGOS-V1 and
+// CB-V1). It is false now: one version builds. Nothing noticed, because the
+// reason is a claim about LIVE STATE and an allowlist holds prose, which no CI
+// step can re-check. The entry did not become wrong through anyone's error —
+// the world moved under it. Hence the rule now written beside the Map: a reason
+// may cite the CODE's shape, never the database's contents.
+//
+// SCANNING AN ALLOWLISTED PATH PROVES NOTHING. scanScripts applies the allowlist
+// itself (`if (VERSION_LITERAL_ALLOW.has(rel)) continue`), so handing it an
+// exempt path returns zero violations whatever the file says — the first draft
+// of this test read that vacuous [] as "no literal" and reported every entry as
+// dead, including grade-smoke.js, which plainly still carries two. The source is
+// therefore re-scanned under a synthetic path that is on neither the allowlist
+// nor isExempt's patterns, which is the only way to see what the guard WOULD say.
+const PROBE = 'scripts/gds/__allowlist_probe__.js';
+const scanUnexempt = (src) => g.scanScripts([PROBE], () => src);
+
+test('the probe path really is unexempt — otherwise every check below is vacuous', () => {
+  assert.ok(!g.VERSION_LITERAL_ALLOW.has(PROBE), 'probe must not be allowlisted');
+  assert.ok(!g.isExempt(PROBE), 'probe must not match an isExempt pattern');
+  // And it must actually fire on a known-bad line, or a silent-empty scanner
+  // would let every assertion below pass for the wrong reason (learning: a
+  // static scan breaks by finding nothing, and green looks identical to working).
+  assert.equal(scanUnexempt("  version_id: 'PMS-V1',").violations.length, 1);
+});
+
+test('no allowlist entry is DEAD — each exempt file still contains the shape it is exempt for', () => {
+  for (const [rel] of g.VERSION_LITERAL_ALLOW) {
+    let src = null;
+    try { src = read(...rel.split('/')); } catch { /* handled below */ }
+    assert.ok(src !== null, `${rel} is allowlisted but does not exist — drop the entry`);
+    assert.ok(
+      scanUnexempt(src).violations.length > 0,
+      `${rel} is on VERSION_LITERAL_ALLOW but no longer names a version literal — `
+      + 'the exemption is dead and must be removed, or it will silently cover a '
+      + 'literal someone reintroduces later.'
+    );
+  }
+});
+
+test('THE INCIDENT: status.js is no longer exempt, and names no version literal', () => {
+  // Both halves must hold. Dropping the entry while leaving the literal reds the
+  // guard; fixing the literal while leaving the entry leaves status.js covered by
+  // nothing for good. Scanned under the probe path so this stays honest even if
+  // someone re-adds the allowlist entry.
+  assert.ok(
+    !g.VERSION_LITERAL_ALLOW.has('scripts/gds/status.js'),
+    'status.js resolves its default at runtime now — it must not stay exempt'
+  );
+  assert.deepEqual(scanUnexempt(read('scripts', 'gds', 'status.js')).violations, []);
+});
+
+// ---- the fallback shape ASSIGNED could not see ----------------------------
+test('THE BLIND SPOT: a version field falling back to a literal through || is caught', () => {
+  // The literal line that shipped, verbatim. ASSIGNED misses it because its
+  // `[^,;)]*` stops at the `)` of resolveEnv(...) — so wrapping a literal in any
+  // call defeated the guard, while the bare assignment was caught.
+  const bad = "const DEFAULT_VERSION = resolveEnv('STATUS_DEFAULT_VERSION') || 'BONGOS-V1';";
+  assert.equal(g.ASSIGNED.test(bad), false, 'documents WHY a third pattern was needed');
+  assert.equal(g.FALLBACK.test(bad), true);
+  assert.equal(scanUnexempt(bad).violations.length, 1, 'and the scanner reports it');
+});
+
+test('the bare assignment ASSIGNED already caught still fails', () => {
+  assert.equal(scanUnexempt("const DEFAULT_VERSION = 'BONGOS-V1';").violations.length, 1);
+});
+
+test('FALLBACK stays narrow — it does not fire on a version field alone', () => {
+  // The over-broad source assertion this repo keeps relearning (learning 1000196).
+  // Loosening ASSIGNED to `[^;]*` would have flagged all of these.
+  for (const ok of [
+    "  const v = versions.find((x) => x.version_id === id) || null;",
+    "  if (!version_id) throw new Error('need a version');",
+    "  console.log(`resolved ${version_id}`);",
+    "  const label = version_id || 'unknown';",
+  ]) {
+    assert.deepEqual(scanUnexempt(ok).violations, [], `must not flag: ${ok.trim()}`);
+  }
+});
+
+test('a comment showing the old bad line does not re-trip the guard', () => {
+  // status.js now quotes its own former literal in the explanatory comment. If
+  // comment-stripping regressed, the file it documents would red the guard.
+  assert.deepEqual(
+    scanUnexempt("// const DEFAULT_VERSION = resolveEnv('X') || 'BONGOS-V1';").violations,
+    []
+  );
+});