@bongos/core 1.19.910 → 1.19.912

package/scripts/gds/fitness-ratchets.js

@@ -347,6 +347,15 @@ const METRIC_HINTS = {
     + 'Write Bongos instead. Run `node scripts/gds/gds-literal-scan.js` to see every counted file. '
     + 'Version ids (GDS-V##), docs/adr, docs/session-logs, docs/audits, limitations and migrations '
     + 'are excluded by construction — if your literal is history, it belongs in one of those.',
+  legacy_api_gds_callers:
+    ' — a NEW in-repo caller was written against the permanent `/api/gds` alias (task 1004064, '
+    + 'idea 1001030). Ask for `/api/bongos` instead: the alias exists for callers we CANNOT update '
+    + '(shipped Dev Box binaries, live dev boxes), not for code in this repo. Run '
+    + '`node scripts/gds/api-alias-caller-scan.js --files` to see every counted line. The alias '
+    + 'contract, the pinned OAuth callbacks, the uptime poller + smoke, the rename guardrails, '
+    + 'tests/, docs/, migrations/ and captured fixtures are excluded by construction — and so is '
+    + 'any line that also names /api/bongos or carries the words alias / legacy / permanent / forever, '
+    + 'so if your line is ABOUT the alias rather than a call to it, say so on the line.',
 };
 
 function compareToBaselines(metrics, baselines) {
@@ -379,6 +388,27 @@ function gdsMetrics() {
   return { legacy_gds_literals: scanGdsLiterals().total };
 }
 
+// legacy_api_gds_callers — the LOWERCASE half of the same rename (task 1004064, idea 1001030).
+// `legacy_gds_literals` above is case-sensitive on the shouting acronym, so it read 1135 both
+// before and after task 1003707 moved 665 in-repo callers off `/api/gds` — correct for what it
+// measures, and exactly why a caller written against the alias tomorrow moves no number and reds
+// no build. This counts that spelling instead. Detector + the reason for every exclusion:
+// scripts/gds/api-alias-caller-scan.js.
+//
+// It FAILS CLOSED on a collapsed enumeration. A static scan breaks by finding nothing, and a
+// green run looks identical to a working one — so if the scanner scanned no files at all, the
+// metric is OMITTED with a reason on stderr rather than reported as a flattering 0 that would
+// invite someone to ratchet the baseline down to it.
+function apiAliasCallerMetrics() {
+  const { scanAliasCallers } = require('./api-alias-caller-scan.js');
+  const { total, scanned } = scanAliasCallers();
+  if (!scanned) {
+    process.stderr.write('fitness-ratchets: legacy_api_gds_callers NOT MEASURED — the caller scan enumerated ZERO files, which is a scan defect, not a clean tree\n');
+    return {};
+  }
+  return { legacy_api_gds_callers: total };
+}
+
 // skill_listing_chars — the resident cost of the skill listing (every name +
 // description, both skill homes). Ratcheted rather than merely warned about
 // because this number has now been trimmed three times (tasks 1003548, 1003587,
@@ -411,6 +441,7 @@ function computeMetrics({ withDocs = true } = {}) {
     require_cycle_count: countCycles(requireGraph(contents)),
     console_call_count: consoleCallCount(contents),
     ...gdsMetrics(),
+    ...apiAliasCallerMetrics(),
     ...skillListingMetrics(),
     ...(withDocs ? docMetrics() : {}),
   };

package/scripts/gds/provision-net.js

@@ -270,6 +270,45 @@ function checkCaddyWiring(exec, opts = {}) {
   }
   return caddyWiringGap(res && res.stdout, { ...opts, caddyfile });
 }
+// Can this plane give a child instance a front door AT ALL? (task 1004017)
+//
+// ADR 0303 asks whether a box's Caddy is wired right. This is the question BEFORE it: the
+// self-host image installs no caddy binary and runs unprivileged, so step 6's snippet write
+// and `systemctl reload caddy` cannot work there. The 0303 preflight is gated on inst.domain,
+// so a DOMAINLESS child skipped it entirely and died on the write — a hard error on attempt
+// one, not the pending-retry a refusal earns. Probed, not configured: a plane either answers
+// `caddy version` or it does not. Same cheap-read posture as checkCaddyWiring — no privilege,
+// no config, no running server.
+// A MISSING BINARY is the only failure that proves there is no proxy. Under remote exec
+// boxExec is `ssh <host> bash -s`, which throws on a transport blip too — and diagnosing a
+// briefly-unreachable co-hosting box as "this platform has no proxy, provision elsewhere"
+// would be a confident wrong answer, the thing this check exists to stop. ssh reports its
+// OWN failures as 255 and otherwise propagates the remote command's status, so 127 still
+// means "no caddy" across the hop. cmd.exe says 9009 and words it differently.
+const NO_CADDY_BINARY = /command not found|not recognized as an internal|No such file or directory/i;
+function ingressPlaneGap(exec, { caddyfile = CONFIG.caddyfile } = {}) {
+  try { exec('caddy version'); return null; } catch (e) {
+    const why = String((e && (e.stderr || e.message)) || e).trim().slice(0, 200);
+    const status = e && e.status;
+    if (status !== 127 && status !== 9009 && !NO_CADDY_BINARY.test(why)) {
+      return `could not confirm a reverse proxy on this plane: 'caddy version' failed (${why}). Provisioning writes a Caddy site snippet for every child instance, so it refuses rather than assume — re-run once the box answers.`;
+    }
+    return `this plane has no reverse proxy, so a child instance would have no front door: 'caddy version' failed (${why}). Provision from a host that runs Caddy — a plane with no proxy cannot serve a child, and ${caddyfile} is not something provisioning will create.`;
+  }
+}
+// The preflight around ingressPlaneGap: the narration its sibling preflights already carry,
+// including the dry-run line without which the plan prints step 6's Caddy write as though it
+// will work. Returns the refusal, or null to proceed. `dedicated` skips it (Caddy comes from
+// cloud-init). Lives here rather than inline at the two call sites to keep provision.js under
+// its 1,500-line ratchet.
+function ingressPreflight({ exec, apply, log, shape, probe = ingressPlaneGap, before = 'writing any Caddy config' }) {
+  if (shape === 'dedicated') return null;
+  if (!apply) { log(`  [preflight] would probe the plane for a reverse proxy before ${before}`); return null; }
+  const missing = probe(exec);
+  if (missing) return `Ingress preflight failed: ${missing}`;
+  log('  [preflight] the plane serves a reverse proxy ✓');
+  return null;
+}
 function healthzCmd(inst) {
   return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/healthz`;
 }
@@ -322,6 +361,8 @@ module.exports = {
   healthzCmd,
   identityCmd,
   identityVerdict,
+  ingressPlaneGap,
+  ingressPreflight,
   shouldFederate,
   zoneForDomain,
 };

package/scripts/gds/provision.js

@@ -52,7 +52,7 @@ const crypto = require('node:crypto');
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
 const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
@@ -268,6 +268,14 @@ async function provisionInstance(inst, deps) {
       log(`  [preflight] would verify the Cloudflare token can reach zone ${zoneForDomain(inst.domain)} before the address step`);
     }
   }
+  const room = await capacityPreflight(inst, deps);   // box capacity (ADR 0285, task 1003927): an honest refusal BEFORE the status flip — never a silent oversubscribe
+  if (room.ok === false) return room;
+  // Ingress preflight (task 1004017, ADR 0315). Ordered capacity → ingress → wiring, all three
+  // before any mutation: ingress asks whether this plane has a proxy AT ALL, 0303 below whether
+  // that proxy is wired for THIS domain. Deliberately NOT domain-gated — a domainless child
+  // skipped 0303 entirely, reached step 6 and died on the snippet write.
+  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, probe: deps.ingressPlaneGap });
+  if (ingressGap) return { ok: false, error: ingressGap };
   // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
   // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
@@ -275,8 +283,6 @@ async function provisionInstance(inst, deps) {
     const gap = caddyCheck(boxExec, { domain: inst.domain });
     if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
   }
-  const room = await capacityPreflight(inst, deps);   // box capacity (ADR 0285, task 1003927): an honest refusal BEFORE the status flip — never a silent oversubscribe
-  if (room.ok === false) return room;
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
   const patch = {};
 
@@ -750,6 +756,8 @@ async function domainAttachInstance(inst, deps) {
     }
     log(`  [preflight] DNS token can reach zone ${scope.zone} ✓`);
   }
+  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, probe: deps.ingressPlaneGap, before: 're-writing the Caddy snippet' });
+  if (ingressGap) return { ok: false, error: ingressGap };   // Ingress preflight (task 1004017, ADR 0315)
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;   // Caddy preflight (task 1002860, ADR 0303)
   if (apply) {
     const gap = caddyCheck(boxExec, { domain: inst.domain });

package/scripts/hall-preview/server.js

@@ -231,7 +231,20 @@ app.use((req, res, next) => {
     return res.end(png);
   }
 
-  if (req.method !== 'GET') {
+  // READ-SHAPED POSTS. A handful of routes are POSTs only because the INPUT is a
+  // draft rather than an id — they write nothing. Serving them the 501 below made
+  // their surfaces permanently un-demoable here: the page renders its degraded
+  // state forever, which is the "a page that only ever renders its empty state
+  // cannot be redesigned by looking" trap modules/hall-ui/CLAUDE.md names. They
+  // fall through to the ordinary fixture lookup instead.
+  //
+  // AN ALLOWLIST, and it stays short. Anything absent is still refused, so a real
+  // write cannot reach the harness by growing a comment — adding a member means
+  // asserting that route writes nothing, which is checkable at its handler.
+  const READ_SHAPED_POSTS = new Set([
+    'inbox/preview-landing', // the landing verdict for a draft (task 1004083)
+  ]);
+  if (req.method !== 'GET' && !READ_SHAPED_POSTS.has(apiPath)) {
     return res.status(501).json({ error: { code: 'preview_readonly', message: 'the preview harness serves fixtures; writes are not wired' } });
   }
   // Your own account wins over the checked-in snapshot; a me-scoped read that

package/src/bongos/module-scope-map.js

@@ -456,12 +456,50 @@ const SHARED_GLOBS = Object.freeze(
   SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], PROTECTED_GLOBS)),
 );
 
-// A glob set is protected iff it overlaps the imported PROTECTED_GLOBS — the one
-// source of truth (permission-path-check.js). Prefix-aware both directions
-// (path-match.touchesOverlap), so e.g. a module owning 'src/bongos/routes/inbox.js'
-// is protected because PROTECTED_GLOBS carries the 'src/bongos/routes/' subtree.
+// A CLI ENTRYPOINT — a single executable script under scripts/, e.g.
+// 'scripts/gds/setup.js'. Structural, not a list: it is a path test, so no roster
+// is hand-maintained here and nothing has to be kept in step with PROTECTED_GLOBS.
+// Directories ('scripts/deploy/', 'scripts/gds/hooks/') are territory, not
+// commands, and are deliberately NOT matched.
+function isCommandPath(glob) {
+  return /^scripts\/.*\.js$/.test(glob);
+}
+
+// Which of a module's globs make it protected? A glob qualifies iff it overlaps
+// the imported PROTECTED_GLOBS — the one source of truth (permission-path-check.js),
+// prefix-aware both directions (path-match.touchesOverlap), so e.g. a module owning
+// 'src/bongos/routes/inbox.js' qualifies because PROTECTED_GLOBS carries the
+// 'src/bongos/routes/' subtree.
+function protectingGlobs(globs) {
+  return (globs || []).filter((g) => touchesOverlap([g], PROTECTED_GLOBS));
+}
+
+// A module is protected iff it owns protected TERRITORY — ADR 0314.
+//
+// WHY THIS IS NOT JUST touchesOverlap(globs, PROTECTED_GLOBS) ANY MORE.
+//   That asked "does this module touch the trust core", and three modules answered
+//   yes because of exactly one CLI they own that happens to sit on a protected
+//   path: onboarding (scripts/gds/setup.js), autonomy (conductor-dispatch.js),
+//   copy-desk (copy-inventory.js). Owning the command is not owning the authority
+//   — modules/government/ IS government, but setup.js merely lives near
+//   onboarding — so the whole module became Archon-only to scope a goal to on the
+//   strength of one file that is not its domain. ADR 0314 narrows the QUESTION to
+//   the one the other three walls already ask: is the territory being scoped
+//   itself protected?
+//
+// So a protected CLI entrypoint no longer protects its owning module; protected
+// territory (a directory, or a non-command file like server.js or CLAUDE.md)
+// still does. The derivation stays COMPUTED from PROTECTED_GLOBS — no hand-set
+// flag, no override list (ADR 0086 §7 / SEC #863). It can only ever SHRINK the
+// protected set relative to the old rule, never grow it, because it filters a
+// subset: no module can become protected that was not protected before.
+//
+// THE WALL THAT MATTERS DOES NOT MOVE. This decides who may CREATE a goal whose
+// territory includes a protected path. It does not decide who may WRITE one: a
+// sub-Metic builder touching scripts/gds/setup.js is still refused by
+// checkPermissionPaths (goal-scope-check.js wall 2), exactly as before.
 function isProtected(globs) {
-  return touchesOverlap(globs || [], PROTECTED_GLOBS);
+  return protectingGlobs(globs).some((g) => !isCommandPath(g));
 }
 
 // The frozen exported roster: key → { globs:[...], protected:bool } (derived).

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.910'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.912'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/api_alias_caller_ratchet.mjs

@@ -0,0 +1,130 @@
+// tests/api_alias_caller_ratchet.mjs — the lowercase `/api/gds` CALLER ratchet
+// (task 1004064, from idea 1001030). Mirrors tests/fitness_gds_ratchet.mjs, its
+// case-sensitive sibling.
+//
+// WHAT THIS FILE IS DEFENDING AGAINST. The brief names the trap exactly: "this is a static scan;
+// it breaks by finding nothing, and a green run looks identical to a working one." Every case
+// below is written so that a scanner which enumerates nothing, excludes everything, or counts
+// nothing FAILS here rather than passing quietly. The aggregation cases inject their own file
+// list and reader, so the real exclusion + counting path runs without writing into the repo —
+// the unit lane runs test files in parallel, and a test that edited a tracked file would break
+// whichever suite happened to be scanning the tree at that moment.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const scan = require(path.join(ROOT, 'scripts', 'gds', 'api-alias-caller-scan.js'));
+
+// A reader over an in-memory tree — no repo writes.
+const fake = (tree) => ({ files: Object.keys(tree), readFile: (rel) => tree[rel] });
+
+test('the counter COUNTS — a file that should count, does (the trap case)', () => {
+  const r = scan.scanAliasCallers(fake({
+    'src/bongos/routes/thing.js': "await fetch(`${base}/api/gds/tasks/${id}`);\n",
+  }));
+  assert.equal(r.total, 1, 'a plain in-repo caller must be counted');
+  assert.deepEqual(Object.keys(r.byFile), ['src/bongos/routes/thing.js']);
+  assert.equal(r.scanned, 1, 'and the file must actually have been scanned');
+});
+
+test('a collapsed enumeration is visible as scanned=0, not as a flattering total of 0', () => {
+  const empty = scan.scanAliasCallers(fake({}));
+  assert.equal(empty.total, 0);
+  assert.equal(empty.scanned, 0, 'scanned is what distinguishes "nothing to find" from "nothing looked at"');
+
+  const allExcluded = scan.scanAliasCallers(fake({
+    'tests/x.mjs': '/api/gds\n',
+    'docs/x.md': '/api/gds\n',
+  }));
+  assert.equal(allExcluded.total, 0);
+  assert.equal(allExcluded.scanned, 0, 'an every-path-excluded run is also scanned=0 — the same signal');
+});
+
+test('the REAL scan enumerates the repo and lands on the committed baseline', () => {
+  const r = scan.scanAliasCallers();
+  assert.ok(r.scanned > 500, `the real tree must enumerate substantially (got ${r.scanned})`);
+  const baselines = JSON.parse(readFileSync(path.join(ROOT, 'config', 'fitness-baselines.json'), 'utf8'));
+  const floor = baselines.metrics.legacy_api_gds_callers;
+  assert.equal(typeof floor, 'number', 'the metric must have a baseline, or the ratchet only warns');
+  assert.ok(r.total <= floor, `caller count ${r.total} is ABOVE baseline ${floor} — a new /api/gds caller entered the tree`);
+});
+
+test('the exclusions are real and each one is reachable', () => {
+  // Rule numbers refer to the header of api-alias-caller-scan.js.
+  for (const p of [
+    'src/bongos/api-prefix.js',            // 1 the alias contract
+    'src/bongos/routes/auth.js',           // 2 the pinned OAuth callbacks
+    'modules/provisioning/provisioning.js',
+    'src/bongos/uptime-poller.js',         // 3 the live proof
+    'scripts/gds/smoke-gds.js',
+    'scripts/gds/gds-literal-scan.js',     // 4 the rename guardrails
+    'scripts/gds/fitness-ratchets.js',
+    'scripts/gds/api-alias-caller-scan.js',
+    'tests/api_alias_exceptions.mjs',      // 5 tests
+    'modules/dev-box/app/test/thing.mjs',
+    'docs/architecture.md',                // 6 docs
+    'migrations/033_audit_log.sql',        // 7 migrations
+    'scripts/hall-preview/fixtures/tasks.json', // 9 captured fixtures
+    'node_modules/pkg/index.js',           // vendored
+  ]) {
+    assert.equal(scan.isExcludedPath(p), true, `${p} must be excluded`);
+  }
+  // …and the exclusion is not a blanket that swallows the tree.
+  for (const p of [
+    'src/bongos/serve-internal.js',
+    'modules/lifecycle/abandon-leftovers.js',
+    'clients/bongos-client/index.mjs', // a .mjs that is NOT a test — a blanket \.mjs$ would blind the ratchet
+    'bin/bongos.js',
+    'CLAUDE.md',
+  ]) {
+    assert.equal(scan.isExcludedPath(p), false, `${p} must NOT be excluded`);
+  }
+});
+
+test('a line ABOUT the alias is not a caller of it — and the rule is not so loose it excuses everything', () => {
+  // Excluded: names the canonical prefix too, or says what it is.
+  assert.equal(scan.isCountedLine('mount /api/bongos and /api/gds'), false);
+  assert.equal(scan.isCountedLine('// /api/gds is a permanent alias'), false);
+  assert.equal(scan.isCountedLine('// the legacy /api/gds mount'), false);
+  assert.equal(scan.isCountedLine('// /api/gds stays FOREVER'), false);
+  // Counted: a bare caller, with none of those tells.
+  assert.equal(scan.isCountedLine('const r = await fetch(`${base}/api/gds/me`);'), true);
+  assert.equal(scan.isCountedLine('  node scripts/gds/api.js GET /api/gds/tasks/1'), true);
+  // And a line with no alias at all is never counted, whatever else it says.
+  assert.equal(scan.isCountedLine('fetch(`${base}/api/bongos/me`)'), false);
+  assert.equal(scan.isCountedLine('a line about a legacy alias, forever'), false);
+});
+
+test('occurrences are counted, not lines — moving ONE of two callers on a line lowers the number', () => {
+  assert.equal(scan.countInText('f("/api/gds/a"); f("/api/gds/b");\n'), 2);
+  assert.equal(scan.countInText('f("/api/bongos/a"); f("/api/gds/b");\n'), 0, 'the canonical name on the line is the alias-commentary rule, by design');
+  assert.equal(scan.countInText('nothing here\n'), 0);
+});
+
+test('the ratchet is WIRED — computeMetrics reports the metric and compareToBaselines fails a rise', () => {
+  const ratchets = require(path.join(ROOT, 'scripts', 'gds', 'fitness-ratchets.js'));
+  const baselines = JSON.parse(readFileSync(path.join(ROOT, 'config', 'fitness-baselines.json'), 'utf8')).metrics;
+
+  // A rise is a violation…
+  const worse = ratchets.compareToBaselines(
+    { legacy_api_gds_callers: baselines.legacy_api_gds_callers + 1 },
+    baselines,
+  );
+  assert.equal(worse.violations.length, 1, 'one more caller must RED the build');
+  assert.match(worse.violations[0], /legacy_api_gds_callers regressed/);
+  assert.match(worse.violations[0], /api-alias-caller-scan/, 'the hint must name the tool that lists the offenders');
+
+  // …a fall is a ratchet-down warning, not a failure.
+  const better = ratchets.compareToBaselines(
+    { legacy_api_gds_callers: baselines.legacy_api_gds_callers - 1 },
+    baselines,
+  );
+  assert.equal(better.violations.length, 0);
+  assert.equal(better.warnings.length, 1);
+  assert.match(better.warnings[0], /ratchet-down available/);
+});