@bongos/core 1.19.918 → 1.19.919

package/tests/removal_verdict.mjs

@@ -0,0 +1,311 @@
+// tests/removal_verdict.mjs — BV2.R16: confirming or dismissing a removal
+// proposal (task 1004095, ADR 0313 + ADR 0319). The sibling of
+// tests/removal_proposal.mjs, which covers the QUESTION this file answers.
+//
+// WHAT THESE ASSERTIONS ARE FOR. The feature's whole output is a fact that
+// survives the click: which answer a person gave. So the tests that matter are
+// the ones that fail if the two answers ever become indistinguishable — if a
+// verdict stops being written, if the closing status is the only record, if the
+// prefix match widens to a task nobody proposed removing, or if a second click
+// silently overwrites the first.
+//
+// Nothing here talks to a database. The pure half is pure; the transaction runs
+// against the #538 `deps.pool` seam with a SQL-aware fake, the abandon_task.mjs
+// posture. The one thing a fake cannot pin — that the SQL is valid Postgres — is
+// left to the live route, deliberately rather than by omission.
+//
+// Run:  node tests/removal_verdict.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const cascade = require('../modules/lifecycle/cascade.js');
+const rot = require('../modules/lifecycle/rot.js');
+const proposals = require('../modules/lifecycle/removal-proposals.js');
+
+const { test, summary } = makeRunner();
+
+const SHIP = 1004090;
+const PROPOSAL = 555001;
+const DECIDER = 42;
+
+// The ref a REAL proposal carries, built by the same code that files one rather
+// than typed out here. A literal would let this file agree with itself while
+// disagreeing with production — the exact failure mode task 1004090 shipped.
+const rule = cascade.CASCADES.find((r) => r.key === cascade.REMOVAL_RULE_KEY);
+const realSpec = cascade.cascadeTaskSpec(
+  rule,
+  { id: SHIP, goal_id: 1000095, version_id: 'BONGOS-V2' },
+  cascade.TRIGGERS.ship,
+  { removals: [{ taskId: '1003000', title: 'earlier work', paths: ['a/gone.js'] }] }
+);
+const REAL_REF = realSpec.sourceRef;
+
+// --- the prefix, end to end -------------------------------------------------
+
+await test('the prefix matches what the cascade actually writes', () => {
+  // THE WHOLE PATH, not its middle: the prefix is asserted against a spec the
+  // real rule produced, so a change to the key or to cascadeSourceRef's format
+  // reds here instead of quietly making the queue read return nothing.
+  assert.ok(REAL_REF.startsWith(proposals.PROPOSAL_SOURCE_REF_PREFIX),
+    `a real proposal ref (${REAL_REF}) must carry the prefix the reader matches`);
+  assert.equal(proposals.shipTaskIdFromSourceRef(REAL_REF), SHIP,
+    'and the ship id must come back out of it');
+});
+
+await test('the prefix does NOT match the other cascade rule', () => {
+  // Both rules write `source: 'cascade'`, so the ref prefix is the ONLY thing
+  // separating a removal question from an artist review. If it ever widened, a
+  // Confirm button would appear on a copy review and answering it would record a
+  // removal verdict about work nobody proposed removing.
+  const artist = cascade.CASCADES.find((r) => r.key === 'artist-review-on-ship');
+  const artistRef = cascade.cascadeSourceRef(artist.key, SHIP);
+  assert.ok(!artistRef.startsWith(proposals.PROPOSAL_SOURCE_REF_PREFIX));
+  assert.equal(proposals.shipTaskIdFromSourceRef(artistRef), null);
+});
+
+await test('a malformed or foreign ref yields null, never a guess', () => {
+  const P = proposals.PROPOSAL_SOURCE_REF_PREFIX;
+  assert.equal(proposals.shipTaskIdFromSourceRef(`${P}not-a-number`), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef(P), null, 'a bare prefix names no ship');
+  assert.equal(proposals.shipTaskIdFromSourceRef(`${P}0`), null, 'zero is not a task id');
+  assert.equal(proposals.shipTaskIdFromSourceRef(`${P}12.5`), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef('planning-session-bv2'), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef(null), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef(undefined), null);
+});
+
+// --- the vocabulary ---------------------------------------------------------
+
+await test('the verdict vocabulary is an allow-list of exactly two', () => {
+  assert.deepEqual([...proposals.VERDICTS].sort(), ['confirmed', 'dismissed']);
+});
+
+await test('an unknown verdict is refused BEFORE the transaction opens', async () => {
+  // A deny-list ("anything that is not dismissed confirms") would admit every
+  // value added later, and the admitted one is the answer that dims a star. The
+  // refusal must also cost no connection — a rejected verdict that still opened a
+  // transaction would be a lock taken for a write that can never happen.
+  for (const bad of ['removed', 'CONFIRMED', 'confirm', '', null, undefined, 1]) {
+    let connected = false;
+    const pool = { connect: async () => { connected = true; throw new Error('must not connect'); } };
+    await assert.rejects(
+      () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: bad }, { pool }),
+      (err) => err.code === 'BAD_VERDICT',
+      `verdict ${JSON.stringify(bad)} must be refused`
+    );
+    assert.equal(connected, false, 'no transaction for a refused verdict');
+  }
+});
+
+// --- the transaction --------------------------------------------------------
+
+// The fake: one proposal row, an optional existing verdict, and a recording log.
+function fakePool({
+  status = 'backlog',
+  notFound = false,
+  source = 'cascade',
+  sourceRef = REAL_REF,
+  existingVerdict = null,
+} = {}) {
+  return makeSqlAwareClient((s, params) => {
+    if (/^SELECT id::text AS id, title, status, source, source_ref FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
+      return { rows: notFound ? [] : [{ id: String(params[0]), title: 'Was this removed?', status, source, source_ref: sourceRef }] };
+    }
+    if (/^SELECT verdict, decided_by/.test(s)) {
+      return { rows: existingVerdict ? [existingVerdict] : [] };
+    }
+    if (/^INSERT INTO lifecycle_removal_verdicts/.test(s)) {
+      return {
+        rows: [{
+          proposal_task_id: String(params[0]),
+          ship_task_id: params[1] == null ? null : String(params[1]),
+          verdict: params[2],
+          decided_by: params[3] == null ? null : String(params[3]),
+          decided_at: '2026-09-20T00:00:00.000Z',
+          note: params[4] || null,
+        }],
+      };
+    }
+    return { rows: [] };  // BEGIN / COMMIT / ROLLBACK / UPDATE tasks
+  });
+}
+
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ').trim()));
+
+await test('confirming writes the verdict AND closes the question, in one txn', async () => {
+  const pool = fakePool();
+  const out = await proposals.recordVerdict(
+    { proposalTaskId: PROPOSAL, verdict: 'confirmed', builderId: DECIDER },
+    { pool }
+  );
+
+  assert.equal(out.verdict, 'confirmed');
+  assert.equal(out.ship_task_id, String(SHIP), 'the ship is denormalised out of the ref');
+  assert.equal(out.decided_by, String(DECIDER), 'a verdict without an author is a rumour');
+
+  const ins = find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/);
+  assert.ok(ins, 'the verdict row is the record — it must be written');
+  assert.deepEqual(ins.params.slice(0, 4), [PROPOSAL, SHIP, 'confirmed', DECIDER]);
+
+  const upd = find(pool._client.queries, /^UPDATE tasks/);
+  assert.ok(upd, 'the answered question must leave the queue');
+  assert.ok(/status = 'abandoned'/.test(String(upd.sql)), 'closed as abandoned, the ledger\'s one spelling');
+  assert.ok(find(pool._client.queries, /^COMMIT/), 'both writes commit together');
+  assert.ok(!find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('dismissing writes the OPPOSITE verdict and closes it the same way', async () => {
+  // The point of the whole table: the two answers differ in the verdict column
+  // and NOWHERE else that matters. If a future edit made dismiss skip the insert,
+  // a dismissed proposal would be indistinguishable from an unanswered one that
+  // somebody killed off the rot feed.
+  const pool = fakePool();
+  const out = await proposals.recordVerdict(
+    { proposalTaskId: PROPOSAL, verdict: 'dismissed', builderId: DECIDER },
+    { pool }
+  );
+  assert.equal(out.verdict, 'dismissed');
+  const ins = find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/);
+  assert.equal(ins.params[2], 'dismissed');
+  assert.ok(find(pool._client.queries, /^UPDATE tasks/), 'dismissing closes the question too');
+  assert.ok(find(pool._client.queries, /^COMMIT/));
+});
+
+await test('the proposal row is locked FOR UPDATE before anything is decided', async () => {
+  // Two people pressing Confirm and Dismiss at the same moment must not both read
+  // "undecided" and both write. The lock is what makes the second one lose.
+  const pool = fakePool();
+  await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool });
+  const sel = find(pool._client.queries, /FROM tasks WHERE id = \$1 FOR UPDATE/);
+  assert.ok(sel, 'the row must be locked');
+  const order = pool._client.queries.map((q) => String(q.sql).replace(/\s+/g, ' ').trim());
+  assert.ok(order.indexOf('BEGIN') < order.findIndex((s) => /FOR UPDATE/.test(s)),
+    'the lock is taken inside the transaction');
+});
+
+await test('a task that is not a removal proposal cannot be answered', async () => {
+  const pool = fakePool({ source: 'planning-session', sourceRef: 'bv2-ideator-surface-R15a' });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'NOT_A_PROPOSAL'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/), 'nothing written');
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('an ARTIST REVIEW is not a removal proposal either', async () => {
+  // Same `source`, different rule. This is the row most likely to be mistaken for
+  // one, because everything except the ref matches.
+  const artistRef = cascade.cascadeSourceRef('artist-review-on-ship', SHIP);
+  const pool = fakePool({ source: 'cascade', sourceRef: artistRef });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'dismissed' }, { pool }),
+    (err) => err.code === 'NOT_A_PROPOSAL'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/));
+});
+
+await test('a missing task is NOT_FOUND and rolls back', async () => {
+  const pool = fakePool({ notFound: true });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'NOT_FOUND'
+  );
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('a second answer is refused, never an overwrite', async () => {
+  // Not an upsert and not an idempotent 200. Overwriting would destroy the record
+  // that a person answered differently, which is the one thing this table holds.
+  const pool = fakePool({
+    status: 'abandoned',
+    existingVerdict: { verdict: 'dismissed', decided_by: '7', decided_at: '2026-09-19T00:00:00.000Z' },
+  });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'ALREADY_DECIDED' && err.existing && err.existing.verdict === 'dismissed'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/));
+});
+
+await test('already-decided outranks already-closed, so the message is the useful one', async () => {
+  // An answered proposal is ALSO abandoned, so checking the status first would
+  // report "this is not an open question" to someone whose real answer is "it was
+  // already dismissed, by builder 7, yesterday".
+  const pool = fakePool({
+    status: 'abandoned',
+    existingVerdict: { verdict: 'confirmed', decided_by: '7', decided_at: '2026-09-19T00:00:00.000Z' },
+  });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'ALREADY_DECIDED'
+  );
+});
+
+await test('a proposal that left backlog with no verdict is closed, not answerable', async () => {
+  // Killed or prioritised off the rot feed. The question is gone; a verdict on it
+  // would answer something nobody is asking.
+  const pool = fakePool({ status: 'ready' });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'PROPOSAL_CLOSED' && err.status === 'ready'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/));
+});
+
+await test('an unparseable ref still answers — with a null ship, not a refusal', async () => {
+  // The verdict is the point. Refusing to record one because the convenience
+  // column could not be filled would be the tail wagging the dog.
+  const pool = fakePool({ sourceRef: `${proposals.PROPOSAL_SOURCE_REF_PREFIX}oops` });
+  const out = await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool });
+  assert.equal(out.ship_task_id, null);
+  const ins = find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/);
+  assert.equal(ins.params[1], null, 'ship_task_id binds NULL rather than a guess');
+});
+
+await test('a note is trimmed and capped; an empty one stores nothing', async () => {
+  const pool = fakePool();
+  await proposals.recordVerdict(
+    { proposalTaskId: PROPOSAL, verdict: 'dismissed', note: '  it was a move  ' },
+    { pool }
+  );
+  assert.equal(find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/).params[4], 'it was a move');
+
+  const pool2 = fakePool();
+  await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'dismissed', note: '   ' }, { pool: pool2 });
+  assert.equal(find(pool2._client.queries, /^INSERT INTO lifecycle_removal_verdicts/).params[4], '',
+    'blank binds the empty string, which NULLIF turns into NULL');
+
+  const pool3 = fakePool();
+  await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'dismissed', note: 'x'.repeat(5000) }, { pool: pool3 });
+  assert.ok(find(pool3._client.queries, /^INSERT INTO lifecycle_removal_verdicts/).params[4].length <= 2000);
+});
+
+await test('the closure line says which answer was given, and is not the record', () => {
+  const yes = proposals.closureSummary('confirmed', null);
+  const no = proposals.closureSummary('dismissed', null);
+  assert.notEqual(yes, no, 'the two answers must not read the same');
+  assert.match(yes, /confirmed/i);
+  assert.match(no, /dismissed/i);
+  assert.match(proposals.closureSummary('dismissed', 'a rename'), /a rename$/);
+});
+
+// --- the clock it rides rather than rebuilds --------------------------------
+
+await test('an unanswered proposal rots, an answered one leaves the feed', () => {
+  // Spec decision 14, proved against the rot module's own vocabulary rather than
+  // asserted in a comment. A proposal is filed at 'backlog' (pinned upstream in
+  // tests/removal_proposal.mjs) and answering it writes 'abandoned'.
+  assert.ok(rot.TASK_ROTTABLE_STATUSES.includes('backlog'),
+    'an unanswered proposal must sit in a rottable status');
+  assert.ok(!rot.TASK_ROTTABLE_STATUSES.includes('abandoned'),
+    'an answered one must fall out of the feed by the same mechanism');
+  assert.equal(realSpec.status, 'backlog', 'and that is the status the cascade actually files');
+});
+
+summary();