@bongos/core 1.19.916 → 1.19.918

package/tests/removal_proposal.mjs

@@ -0,0 +1,583 @@
+// tests/removal_proposal.mjs — BV2.R15: a ship that deletes earlier shipped work
+// files a QUESTION (task 1004090, ADR 0313).
+//
+// The assertions that matter here are the NEGATIVE ones. This derivation moves
+// nothing on its own — it must not mark work removed, must not touch a status or
+// a credit, and must not fail a ship. Most of what follows exists to fail loudly
+// if a later change turns the proposal into a verdict.
+
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+
+const cascade = require(path.join(ROOT, 'modules/lifecycle/cascade.js'));
+const removal = require(path.join(ROOT, 'modules/lifecycle/removal-derivation.js'));
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const RULE_KEY = 'removal-proposed-on-ship';
+const rule = cascade.CASCADES.find((r) => r.key === RULE_KEY);
+
+// --- the three exclusions ADR 0313 names -----------------------------------
+
+await test('only a deletion counts — a rename is not a removal', () => {
+  // The exclusion that matters most: a directory reorganisation would otherwise
+  // propose a removal for every file it moved.
+  const files = [
+    { path: 'a/moved.js', status: 'renamed', deleted: false },
+    { path: 'a/gone.js', status: 'removed', deleted: true },
+  ];
+  assert.deepEqual(removal.deletedPathsFrom(files), ['a/gone.js']);
+});
+
+await test('a rewrite in place is not a removal, however many lines went', () => {
+  // Where a `removed > added` line-count heuristic goes wrong.
+  const files = [{ path: 'a/rewritten.js', status: 'modified', deleted: false, additions: 2, deletions: 900 }];
+  assert.deepEqual(removal.deletedPathsFrom(files), []);
+});
+
+await test('added, copied and changed carry no loss', () => {
+  for (const status of ['added', 'copied', 'changed']) {
+    assert.deepEqual(removal.deletedPathsFrom([{ path: 'x.js', status }]), [], `status ${status} leaked`);
+  }
+});
+
+await test('status and the deleted flag must agree; status wins when both are present', () => {
+  // A caller that hand-set `deleted` must not be able to invent a removal, and a
+  // caller that shaped the row the other way must not have one missed.
+  assert.deepEqual(removal.deletedPathsFrom([{ path: 'x.js', status: 'renamed', deleted: true }]), []);
+  assert.deepEqual(removal.deletedPathsFrom([{ path: 'x.js', deleted: true }]), ['x.js']);
+  assert.deepEqual(removal.deletedPathsFrom([{ path: 'x.js', deleted: false }]), []);
+});
+
+await test('malformed rows are skipped rather than throwing into the ship path', () => {
+  const files = [null, 'nope', {}, { status: 'removed' }, { path: '', status: 'removed' }, { path: 'ok.js', status: 'removed' }];
+  assert.deepEqual(removal.deletedPathsFrom(files), ['ok.js']);
+  assert.deepEqual(removal.deletedPathsFrom(null), []);
+});
+
+// --- attribution ------------------------------------------------------------
+
+const lookupFrom = (map) => async (shas) => {
+  const out = new Map();
+  for (const s of shas) if (map[s]) out.set(s, map[s]);
+  return out;
+};
+
+await test('a deleted path is attributed to the task that published it', async () => {
+  const { attributions } = await removal.attributeDeletions(
+    { paths: ['a/gone.js'], shipTaskId: '999' },
+    {
+      listCommitsForPath: async () => ['shaNew', 'shaOld'],
+      shippedTasksByPublishedSha: lookupFrom({ shaOld: { taskId: '1003944', title: 'The old scorer' } }),
+    }
+  );
+  assert.equal(attributions.length, 1);
+  assert.equal(attributions[0].taskId, '1003944');
+});
+
+await test('the OLDEST matching commit wins — not whoever last edited the file', async () => {
+  // The newest would answer a different and wrong question: who touched it, not
+  // whose work it was.
+  const { attributions } = await removal.attributeDeletions(
+    { paths: ['a/gone.js'], shipTaskId: '999' },
+    {
+      // API order is newest-first.
+      listCommitsForPath: async () => ['shaLate', 'shaEarly'],
+      shippedTasksByPublishedSha: lookupFrom({
+        shaLate: { taskId: '1003999', title: 'A later touch' },
+        shaEarly: { taskId: '1003944', title: 'The one that introduced it' },
+      }),
+    }
+  );
+  assert.equal(attributions[0].taskId, '1003944');
+});
+
+await test('a ship deleting its OWN earlier file attributes nothing', async () => {
+  // Tidying up inside one piece of work is not a removal of someone else's.
+  const { attributions } = await removal.attributeDeletions(
+    { paths: ['a/gone.js'], shipTaskId: '1003944' },
+    {
+      listCommitsForPath: async () => ['shaOld'],
+      shippedTasksByPublishedSha: lookupFrom({ shaOld: { taskId: '1003944', title: 'Mine' } }),
+    }
+  );
+  assert.deepEqual(attributions, []);
+});
+
+await test('an UNATTRIBUTABLE deletion attributes nothing — silence, not a guess', async () => {
+  // published_head_sha is nullable. ADR 0313: a wrong removal proposal costs a
+  // person's attention and dims a real star, so absence must stay silent.
+  const { attributions } = await removal.attributeDeletions(
+    { paths: ['a/gone.js'], shipTaskId: '999' },
+    { listCommitsForPath: async () => ['unknownSha'], shippedTasksByPublishedSha: lookupFrom({}) }
+  );
+  assert.deepEqual(attributions, []);
+});
+
+await test('one unreadable path costs only itself', async () => {
+  const { attributions, errors } = await removal.attributeDeletions(
+    { paths: ['bad.js', 'good.js'], shipTaskId: '999' },
+    {
+      listCommitsForPath: async ({ path: p }) => {
+        if (p === 'bad.js') throw new Error('boom');
+        return ['shaOld'];
+      },
+      shippedTasksByPublishedSha: lookupFrom({ shaOld: { taskId: '1003944', title: 'T' } }),
+    }
+  );
+  assert.equal(attributions.length, 1);
+  assert.equal(attributions[0].path, 'good.js');
+  assert.ok(errors.some((e) => e.includes('bad.js')));
+});
+
+await test('attribution is capped, and the cap is on attribution not detection', async () => {
+  const paths = Array.from({ length: removal.MAX_ATTRIBUTED_PATHS + 10 }, (_, i) => `f${i}.js`);
+  let calls = 0;
+  await removal.attributeDeletions(
+    { paths, shipTaskId: '999' },
+    { listCommitsForPath: async () => { calls += 1; return []; }, shippedTasksByPublishedSha: lookupFrom({}) }
+  );
+  assert.equal(calls, removal.MAX_ATTRIBUTED_PATHS);
+});
+
+// --- the GitHub call budget -------------------------------------------------
+//
+// This derivation runs on the ship path and spends the SERVER'S SHARED push
+// credential — the same one the publish path depends on. Every assertion here is
+// about not spending more of it than the question is worth.
+
+await test('a rate-limit refusal ABANDONS the walk instead of spending the rest', async () => {
+  // The point of the fix: continuing would spend the remaining budget on requests
+  // already known to fail, which is the opposite of backing off.
+  let calls = 0;
+  const { attributions, errors } = await removal.attributeDeletions(
+    { paths: ['a.js', 'b.js', 'c.js', 'd.js'], shipTaskId: '999' },
+    {
+      listCommitsForPath: async () => {
+        calls += 1;
+        const e = new Error('RATE_LIMITED');
+        e.rateLimited = true;
+        throw e;
+      },
+      shippedTasksByPublishedSha: lookupFrom({}),
+    }
+  );
+  assert.equal(calls, 1, 'the walk must stop at the FIRST rate-limit signal');
+  assert.deepEqual(attributions, []);
+  assert.ok(errors.some((e) => /rate limit/i.test(e)), 'and it must say so rather than failing silently');
+});
+
+await test('an ORDINARY per-path failure does NOT abandon the walk', async () => {
+  // The other half: only a rate limit is a statement about the whole credential.
+  // Treating every error as fatal would lose attributions to one bad path.
+  let calls = 0;
+  const { attributions } = await removal.attributeDeletions(
+    { paths: ['bad.js', 'good.js'], shipTaskId: '999' },
+    {
+      listCommitsForPath: async ({ path: pth }) => {
+        calls += 1;
+        if (pth === 'bad.js') throw new Error('STATUS_FETCH_FAILED 500');
+        return ['shaOld'];
+      },
+      shippedTasksByPublishedSha: lookupFrom({ shaOld: { taskId: '1003944', title: 'T' } }),
+    }
+  );
+  assert.equal(calls, 2);
+  assert.equal(attributions.length, 1);
+});
+
+await test('the call budget is small enough to be worth spending', async () => {
+  // A number, pinned, because the whole finding was about how many requests one
+  // ship can fire. Raising it is a deliberate act that should fail a test first.
+  assert.equal(removal.MAX_ATTRIBUTED_PATHS, 8);
+});
+
+await test('a rate-limited derivation still files nothing and never throws', async () => {
+  const r = await removal.deriveRemovalsForShip(
+    { taskId: '1', prNumber: 7 },
+    {
+      getPullRequestFiles: async () => [
+        { path: 'a.js', status: 'removed', deleted: true },
+        { path: 'b.js', status: 'removed', deleted: true },
+      ],
+      listCommitsForPath: async () => { const e = new Error('RATE_LIMITED'); e.rateLimited = true; throw e; },
+      shippedTasksByPublishedSha: lookupFrom({}),
+    }
+  );
+  assert.deepEqual(r.removals, []);
+  assert.equal(r.deletedCount, 2, 'detection is honest even when attribution was abandoned');
+});
+
+await test('listCommitsForPath names a rate limit apart from an ordinary 403', async () => {
+  // A 403 for any other reason keeps a non-zero remaining (or sends no header),
+  // and must stay an ordinary failure — otherwise a permissions problem would
+  // silently abandon every future walk as if it were throttling.
+  const res = (status, remaining) => ({
+    status, ok: false,
+    headers: { get: (h) => (h === 'x-ratelimit-remaining' ? remaining : null) },
+    json: async () => [],
+  });
+  const call = (r) => removal.listCommitsForPath(
+    { path: 'a.js' },
+    { resolveToken: async () => 'tok', repoInfo: { owner: 'o', repo: 'r' }, fetchImpl: async () => r }
+  );
+
+  await assert.rejects(() => call(res(403, '0')), (e) => e.rateLimited === true);
+  await assert.rejects(() => call(res(429, '55')), (e) => e.rateLimited === true);
+  await assert.rejects(() => call(res(403, '55')), (e) => !e.rateLimited);
+  await assert.rejects(() => call(res(403, null)), (e) => !e.rateLimited);
+});
+
+// --- the whole derivation is non-blocking ----------------------------------
+
+await test('no pull request derives nothing and does not throw', async () => {
+  const r = await removal.deriveRemovalsForShip({ taskId: '1', prNumber: null });
+  assert.deepEqual(r.removals, []);
+});
+
+await test('an unreadable PR derives nothing and does not throw', async () => {
+  const r = await removal.deriveRemovalsForShip(
+    { taskId: '1', prNumber: 7 },
+    { getPullRequestFiles: async () => { throw new Error('GitHub down'); } }
+  );
+  assert.deepEqual(r.removals, []);
+  assert.ok(r.errors.length);
+});
+
+await test('a sha lookup that throws derives nothing and does not throw', async () => {
+  const r = await removal.deriveRemovalsForShip(
+    { taskId: '1', prNumber: 7 },
+    {
+      getPullRequestFiles: async () => [{ path: 'a.js', status: 'removed', deleted: true }],
+      listCommitsForPath: async () => ['s1'],
+      shippedTasksByPublishedSha: async () => { throw new Error('db down'); },
+    }
+  );
+  assert.deepEqual(r.removals, []);
+});
+
+await test('a ship that deleted nothing reports no error at all', async () => {
+  // The overwhelmingly common case. It must be quiet, not merely harmless.
+  const r = await removal.deriveRemovalsForShip(
+    { taskId: '1', prNumber: 7 },
+    { getPullRequestFiles: async () => [{ path: 'a.js', status: 'modified' }] }
+  );
+  assert.deepEqual(r.removals, []);
+  assert.deepEqual(r.errors, []);
+});
+
+await test('the end-to-end derivation groups paths under their task', async () => {
+  const r = await removal.deriveRemovalsForShip(
+    { taskId: '999', prNumber: 7 },
+    {
+      getPullRequestFiles: async () => [
+        { path: 'a/one.js', status: 'removed', deleted: true },
+        { path: 'a/two.js', status: 'removed', deleted: true },
+        { path: 'a/moved.js', status: 'renamed', deleted: false },
+      ],
+      listCommitsForPath: async () => ['shaOld'],
+      shippedTasksByPublishedSha: lookupFrom({ shaOld: { taskId: '1003944', title: 'The old scorer' } }),
+    }
+  );
+  assert.equal(r.removals.length, 1);
+  assert.deepEqual(r.removals[0].paths, ['a/one.js', 'a/two.js']);
+  assert.equal(r.deletedCount, 2, 'the renamed file must not be counted');
+});
+
+// --- THE WIRING, which is where the dead feature lived ----------------------
+//
+// The first two rounds of this task shipped a rule that could never fire: the
+// resolver read `pr.number` off findTaskPullRequest, which returns `pr_number`,
+// so prNumber was null on every real ship and the derivation short-circuited
+// every time. Thirty-three tests passed over it, because every one of them
+// injected `removalCandidates` or `getPullRequestFiles` and none was wired to
+// the part that was wrong.
+//
+// These drive the REAL resolver. They are the tests that would have caught it.
+
+await test('the resolver reads pr_number — the field findTaskPullRequest ACTUALLY returns', async () => {
+  // The blocker, pinned. Reading the wrong field is SILENT: it yields null,
+  // which is a legal "no PR" answer, so the feature just never runs.
+  let sawPrNumber = null;
+  const r = await removal.removalCandidatesForTask(
+    { id: '7002' },
+    {
+      // Exactly the shape github-push.js:855 returns.
+      findTaskPullRequest: async () => ({ branch: 'b', pr_number: 1046, pr_state: 'open', merged: true }),
+      getPullRequestFiles: async ({ number }) => {
+        sawPrNumber = number;
+        return [{ path: 'a/gone.js', status: 'removed', deleted: true }];
+      },
+      listCommitsForPath: async () => ['shaOld'],
+      shippedTasksByPublishedSha: lookupFrom({ shaOld: { taskId: '1003944', title: 'The old scorer' } }),
+    }
+  );
+  assert.equal(sawPrNumber, 1046, 'the PR number never reached the files read');
+  assert.equal(r.removals.length, 1, 'a real deletion must produce a candidate');
+  assert.equal(r.removals[0].taskId, '1003944');
+});
+
+await test('a PR shape carrying only .number yields NOTHING — no silent alternative field', async () => {
+  // Guards the fix from being "fixed" back by someone adding a || pr.number
+  // fallback: that would resurrect the bug as a tolerated shape.
+  const r = await removal.removalCandidatesForTask(
+    { id: '7002' },
+    {
+      findTaskPullRequest: async () => ({ number: 1046 }),
+      getPullRequestFiles: async () => { throw new Error('must not be reached'); },
+    }
+  );
+  assert.deepEqual(r.removals, []);
+});
+
+await test('no PR at all derives nothing and does not throw', async () => {
+  const r = await removal.removalCandidatesForTask(
+    { id: '7002' },
+    { findTaskPullRequest: async () => null }
+  );
+  assert.deepEqual(r.removals, []);
+});
+
+await test('a PR lookup that throws costs the ship nothing', async () => {
+  const r = await removal.removalCandidatesForTask(
+    { id: '7002' },
+    { findTaskPullRequest: async () => { throw new Error('GitHub down'); } }
+  );
+  assert.deepEqual(r.removals, []);
+});
+
+await test('the LISTENER wires the named resolver, not a closure of its own', async () => {
+  // Structural, and it is the lesson rather than the symptom: a closure inside
+  // the listener registration is unreachable from a test, which is exactly how
+  // the wrong field name survived two grading rounds. If someone inlines it
+  // again, this names the file before the feature silently dies again.
+  const src = await import('node:fs').then((m) => m.readFileSync(
+    path.join(ROOT, 'modules/lifecycle/routes/lifecycle.js'), 'utf8'
+  ));
+  assert.match(src, /removalCandidates:\s*\(task\)\s*=>\s*removalDerivation\.removalCandidatesForTask/);
+  // codeOnly, because the listener's comment legitimately NAMES the function it
+  // no longer calls — the third time in this task a raw source scan matched its
+  // own explanatory prose. See the stripper's own header.
+  assert.ok(!/findTaskPullRequest/.test(codeOnly(src)), 'the PR lookup belongs in the tested resolver, not the listener');
+});
+
+// --- the rule itself --------------------------------------------------------
+
+await test('the rule is declared and the table still validates', () => {
+  assert.ok(rule, `${RULE_KEY} is not in CASCADES`);
+  assert.deepEqual(cascade.validateCascades(), []);
+});
+
+await test('the anti-recursion guard holds — a cascade task never cascades', () => {
+  const t = { id: 5, source: cascade.CASCADE_SOURCE };
+  assert.equal(rule.when(t, { removals: [{ taskId: '1', paths: ['a'] }] }), false);
+});
+
+await test('NO derived removals files nothing', () => {
+  const t = { id: 5, source: 'builder' };
+  assert.equal(rule.when(t, { removals: [] }), false);
+});
+
+await test('an ABSENT context files nothing — silence is never read as a removal', () => {
+  // The opposite default to the artist gate, deliberately. A derivation that did
+  // not run must not be able to propose that work was destroyed.
+  const t = { id: 5, source: 'builder' };
+  assert.equal(rule.when(t, {}), false);
+  assert.equal(rule.when(t, undefined), false);
+  assert.equal(rule.when(t, { removals: null }), false);
+  assert.equal(rule.when(t, { removals: 'yes' }), false);
+});
+
+await test('derived removals DO file', () => {
+  const t = { id: 5, source: 'builder' };
+  assert.equal(rule.when(t, { removals: [{ taskId: '1003944', paths: ['a.js'] }] }), true);
+});
+
+// --- it asks; it does not tell ---------------------------------------------
+
+const ctx = {
+  removals: [{ taskId: '1003944', title: 'The old scorer', paths: ['modules/foo/old-scorer.js'] }],
+};
+
+await test('the proposal names the task and the path it lost', () => {
+  const body = cascade.removalProposalBody({ id: 1004090 }, ctx);
+  assert.match(body, /task 1003944/);
+  assert.match(body, /The old scorer/);
+  assert.match(body, /modules\/foo\/old-scorer\.js/);
+});
+
+await test('the proposal SAYS it is a question and that nothing has moved', () => {
+  // The done-when in one assertion: a question, not a verdict.
+  const body = cascade.removalProposalBody({ id: 1004090 }, ctx);
+  assert.match(body, /question, not a verdict/i);
+  assert.match(body, /no\s+status changed and no credit moved/i);
+  assert.match(body, /`shipped` is terminal/);
+  assert.match(body, /\*\*Dismiss\*\*/);
+});
+
+await test('the proposal says when its own list is partial', () => {
+  const body = cascade.removalProposalBody({ id: 1 }, { ...ctx, removalTruncated: true, removalDeletedCount: 90 });
+  assert.match(body, /PARTIAL/);
+  assert.match(body, /90/);
+});
+
+await test('the generated task is a backlog REQUEST carrying the preamble', () => {
+  // Filing at backlog is what makes confirming a promote on the existing
+  // awaiting-nod surface (R16) rather than a new page.
+  const spec = cascade.cascadeTaskSpec(rule, { id: 7, version_id: 'BONGOS-V2', goal_id: 1000095, source: 'builder' }, cascade.TRIGGERS.ship, ctx);
+  assert.equal(spec.status, 'backlog');
+  assert.equal(spec.source, cascade.CASCADE_SOURCE);
+  assert.match(spec.description, /it is a REQUEST/);
+  assert.match(spec.description, /task 1003944/);
+  assert.equal(spec.discipline, 'engineer');
+});
+
+await test('cascadesFor threads ctx into the body, not just the predicate', () => {
+  // The bug this pins: `when` seeing the removals while `body` did not would file
+  // a proposal with an EMPTY list — a question nobody can answer.
+  const { matched, errors } = cascade.cascadesFor(
+    { id: 7, version_id: 'BONGOS-V2', goal_id: 1000095, source: 'builder' },
+    [rule],
+    ctx
+  );
+  assert.deepEqual(errors, []);
+  assert.equal(matched.length, 1);
+  assert.match(matched[0].spec.description, /modules\/foo\/old-scorer\.js/);
+});
+
+// Strip comments before scanning source for forbidden constructs.
+//
+// WHY THIS EXISTS AS A HELPER. The first cut of the test below scanned the raw
+// file and failed on the word "credit" — inside a COMMENT explaining that this
+// derivation must never touch credits. That is the same defect that redded
+// task 1004083 in CI (a comment reading "on purpose" matched a scan for the
+// template field key "purpose"): a substring scan over source is a scan over
+// prose unless you say otherwise.
+//
+// Rewording the comment would have hidden the bug rather than fixed it, and
+// would have left the next honest comment to trip the same wire. Strings are
+// left in place deliberately — a forbidden construct inside a string literal is
+// still worth failing on.
+function codeOnly(src) {
+  return src
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .split('\n')
+    .map((line) => line.replace(/(^|[^:])\/\/.*$/, '$1'))
+    .join('\n');
+}
+
+await test('the comment stripper actually strips — otherwise the scan below is vacuous', () => {
+  // A scanner breaks by quietly finding nothing, and green looks identical to
+  // working. So the stripper is tested before anything relies on it.
+  assert.ok(!codeOnly('// credit\nconst a = 1;').includes('credit'));
+  assert.ok(!codeOnly('/* credit */ const a = 1;').includes('credit'));
+  assert.ok(codeOnly('const credit = 1; // note').includes('credit'), 'stripped real code');
+  assert.ok(codeOnly("const u = 'https://x';").includes('https://x'), 'ate a URL');
+});
+
+await test('nothing in the proposal path changes a status or a credit', () => {
+  // Structural. The derivation is read-only by construction; if it ever grows a
+  // write, this names the file.
+  const src = codeOnly(require('node:fs').readFileSync(path.join(ROOT, 'modules/lifecycle/removal-derivation.js'), 'utf8'));
+  for (const forbidden of ['UPDATE ', 'INSERT ', 'credit', 'shipped_at', "status = '"]) {
+    assert.ok(!src.includes(forbidden), `removal-derivation.js contains "${forbidden}" in CODE — it must stay read-only`);
+  }
+});
+
+// --- the RUNNER, end to end ------------------------------------------------
+//
+// Everything above tests a part. These drive runCascadesForShip itself, because
+// the parts agreeing with each other proves nothing about the path that actually
+// files the task — and the ctx plumbing between the resolver, the predicate and
+// the body is exactly where a half-wired feature hides.
+
+const shippedTask = (over = {}) => ({
+  id: '7002', version_id: 'BONGOS-V2', goal_id: '1000095',
+  title: 'Delete the old scorer', discipline: 'engineer',
+  kind: 'feature', status: 'shipped', source: 'manual', ...over,
+});
+
+function runnerDeps(over = {}) {
+  const created = [];
+  return {
+    created,
+    deps: {
+      getTask: async () => shippedTask(),
+      findTaskBySourceRef: async () => null,
+      createTask: async (spec) => { created.push(spec); return { id: '8001' }; },
+      ...over,
+    },
+  };
+}
+
+await test('a derived removal files ONE proposal naming the task and path', async () => {
+  const { created, deps } = runnerDeps({
+    removalCandidates: async () => ({
+      removals: [{ taskId: '1003944', title: 'The old scorer', paths: ['modules/foo/old-scorer.js'] }],
+      deletedCount: 1, truncated: false, errors: [],
+    }),
+  });
+  const report = await cascade.runCascadesForShip({ id: '7002' }, deps);
+  const proposals = created.filter((c) => c.sourceRef.includes(RULE_KEY));
+  assert.equal(proposals.length, 1);
+  assert.match(proposals[0].description, /task 1003944/);
+  assert.match(proposals[0].description, /modules\/foo\/old-scorer\.js/);
+  assert.equal(proposals[0].status, 'backlog');
+  assert.deepEqual(report.errors, []);
+});
+
+await test('NO removalCandidates dep at all files no proposal, and no error', async () => {
+  // The state every instance is in until the listener is wired, and the state a
+  // test rebuilding the router lands in. It must be quiet.
+  const { created, deps } = runnerDeps();
+  const report = await cascade.runCascadesForShip({ id: '7002' }, deps);
+  assert.equal(created.filter((c) => c.sourceRef.includes(RULE_KEY)).length, 0);
+  assert.deepEqual(report.errors, []);
+});
+
+await test('a resolver that THROWS costs the ship nothing', async () => {
+  // ADR 0313: landing work matters more than dimming a star on time.
+  const { created, deps } = runnerDeps({
+    removalCandidates: async () => { throw new Error('GitHub exploded'); },
+  });
+  const report = await cascade.runCascadesForShip({ id: '7002' }, deps);
+  assert.equal(created.filter((c) => c.sourceRef.includes(RULE_KEY)).length, 0);
+  assert.ok(report.errors.some((e) => /removalCandidates/.test(e)), 'the failure must be reported, not swallowed silently');
+});
+
+await test('the proposal is idempotent — a second run files nothing new', async () => {
+  const { created, deps } = runnerDeps({
+    removalCandidates: async () => ({
+      removals: [{ taskId: '1003944', title: 'T', paths: ['a.js'] }], deletedCount: 1, truncated: false, errors: [],
+    }),
+    findTaskBySourceRef: async () => ({ id: '8001' }),
+  });
+  const report = await cascade.runCascadesForShip({ id: '7002' }, deps);
+  assert.equal(created.length, 0);
+  assert.ok(report.skipped.some((sk) => sk.key === RULE_KEY));
+});
+
+await test('the derivation errors ride into the report without blocking the filing', async () => {
+  const { created, deps } = runnerDeps({
+    removalCandidates: async () => ({
+      removals: [{ taskId: '1003944', title: 'T', paths: ['a.js'] }],
+      deletedCount: 3, truncated: false, errors: ['removal: history for b.js unreadable (boom)'],
+    }),
+  });
+  const report = await cascade.runCascadesForShip({ id: '7002' }, deps);
+  assert.equal(created.filter((c) => c.sourceRef.includes(RULE_KEY)).length, 1, 'a partial read still files what it DID find');
+  assert.ok(report.errors.some((e) => e.includes('b.js')));
+});
+
+console.log(`\nremoval_proposal: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);