@bongos/core 1.20.36 → 1.20.38

package/tests/autobongos_loop.mjs

@@ -1084,6 +1084,211 @@ test('a runner that just started will NOT upgrade-exit, so a failed fetch cannot
   assert.equal(askedForDrift, false, 'and not even ask — the check costs a network call');
 });
 
+// --- pull always, restart rarely (task 1004406) -----------------------------
+//
+// Owner-approved 2026-09-30: restart only when the supervisor's OWN code changes.
+// Every worker is a fresh process in its own tree, so it runs whatever is on disk
+// already; the only code a restart refreshes is what THIS process has loaded.
+// So on drift the checkout is updated in place, and the process exits for the
+// wrapper only when a change touches a file it holds in memory.
+
+const loopDeps = (over = {}) => ({
+  iteration: async () => ({ event: 'hold', reason: 'test' }),
+  reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+  waitOrJump: async () => ({ waited: 0, jumped: false }),
+  writeHeartbeat: () => true,
+  postHeartbeat: async () => true,
+  emit: () => {},
+  loadedHead: async () => 'a'.repeat(40),
+  now: () => Date.now() + runner.MIN_UPTIME_BEFORE_UPGRADE_MS + 1000,
+  codeDrifted: async () => ({ from: 'aaaaaaaa', to: 'cccccccc' }),
+  loadedFiles: () => ['scripts/gds/autobongos-run.js', 'scripts/gds/sequence.js'],
+  state: runner.newRunnerState(),
+  ...over,
+});
+
+test('main moving with none of the supervisor\'s code refreshes the checkout IN PLACE and does not restart', async () => {
+  const rows = [];
+  let refreshed = 0;
+  const d = loopDeps({
+    record: (r) => { rows.push(r); return r; },
+    refreshCheckout: async () => { refreshed += 1; return { ok: true, to: 'c'.repeat(40), changed: ['docs/recipes/x.md', 'src/bongos/routes/tasks.js'] }; },
+  });
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2, refreshInPlace: true }, d);
+  assert.equal(code, 0, 'no restart for code the supervisor does not run');
+  assert.ok(refreshed >= 1, 'the checkout is brought current, so workers run the new code');
+  assert.ok(rows.some((r) => r.event === 'code_refreshed'), 'and the refresh is logged');
+  assert.ok(!rows.some((r) => r.event === 'upgrade_exit'));
+  assert.equal(d.state.diskHead, 'c'.repeat(40), 'the on-disk commit is remembered apart from the loaded one');
+});
+
+test('a change to a file the supervisor has LOADED restarts, and says which file', async () => {
+  const rows = [];
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2, refreshInPlace: true }, loopDeps({
+    record: (r) => { rows.push(r); return r; },
+    refreshCheckout: async () => ({ ok: true, to: 'c'.repeat(40), changed: ['docs/x.md', 'scripts/gds/sequence.js'] }),
+  }));
+  assert.equal(code, runner.UPGRADE_EXIT_CODE);
+  const exit = rows.find((r) => r.event === 'upgrade_exit');
+  assert.match(exit.reason, /scripts\/gds\/sequence\.js/);
+  assert.ok(!/docs\/x\.md/.test(exit.reason), 'only the files that force the restart are named');
+});
+
+test('a change under the supervisor\'s own paths restarts even before that file was loaded', async () => {
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2, refreshInPlace: true }, loopDeps({
+    record: (r) => r,
+    loadedFiles: () => [],
+    refreshCheckout: async () => ({ ok: true, to: 'c'.repeat(40), changed: ['modules/autonomy/cadence.js'] }),
+  }));
+  assert.equal(code, runner.UPGRADE_EXIT_CODE);
+});
+
+test('an in-place refresh that fails falls back to the restart, which re-runs the wrapper\'s refresh', async () => {
+  const rows = [];
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2, refreshInPlace: true }, loopDeps({
+    record: (r) => { rows.push(r); return r; },
+    refreshCheckout: async () => ({ ok: false, reason: 'fetch failed' }),
+  }));
+  assert.equal(code, runner.UPGRADE_EXIT_CODE);
+  assert.match(rows.find((r) => r.event === 'upgrade_exit').reason, /fetch failed/);
+});
+
+test('the real --forever entry point is the one place that arms the in-place refresh', () => {
+  // main() is the production call shape and is not driven by these tests (it
+  // would run the real loop), so its one line is pinned by source. Without it the
+  // refresh is dead code and every merge to main restarts the runner again.
+  const src = readFileSync(new URL('../scripts/gds/autobongos-run.js', import.meta.url), 'utf8');
+  const line = src.split('\n').find((l) => l.includes('if (opts.forever) return forever('));
+  assert.ok(line, 'main() must still hand --forever to forever()');
+  assert.ok(line.includes('refreshInPlace: true'), `and arm the refresh there: ${line}`);
+});
+
+test('without refreshInPlace, forever never touches the checkout — tests and one-shot runs stay safe', async () => {
+  // refreshCheckout runs `git reset --hard`. A suite that reached it would wipe
+  // the tree it is testing, in CI or on a laptop, so only main() arms it.
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, loopDeps({
+    record: (r) => r,
+    refreshCheckout: async () => { throw new Error('refreshed a checkout it was never told it owns'); },
+  }));
+  assert.equal(code, runner.UPGRADE_EXIT_CODE);
+});
+
+test('after a refresh, drift is measured from the REFRESHED commit, so it does not refresh every loop', async () => {
+  const tip = 'c'.repeat(40);
+  const run = async () => ({ ok: true, stdout: `${tip}\trefs/heads/main\n` });
+  assert.equal(await runner.codeDrifted({ run, loadedHead: async () => 'a'.repeat(40), state: { diskHead: tip } }), false);
+  const moved = await runner.codeDrifted({ run, loadedHead: async () => 'a'.repeat(40), state: { diskHead: 'b'.repeat(40) } });
+  assert.deepEqual(moved, { from: 'bbbbbbbb', to: 'cccccccc' });
+});
+
+test('supervisorTouched: loaded files and the supervisor\'s own paths count; nothing else does', () => {
+  const loaded = ['scripts/gds/sequence.js'];
+  assert.deepEqual(runner.supervisorTouched(['docs/a.md', 'src/x.js'], loaded), []);
+  assert.deepEqual(runner.supervisorTouched(['scripts/gds/sequence.js'], loaded), ['scripts/gds/sequence.js']);
+  assert.deepEqual(runner.supervisorTouched(['scripts/gds/autobongos-verify.js'], []), ['scripts/gds/autobongos-verify.js']);
+  assert.deepEqual(runner.supervisorTouched(['modules/autonomy/fence.js'], []), ['modules/autonomy/fence.js']);
+  assert.deepEqual(runner.supervisorTouched(['scripts/gds/claim.js'], loaded), [], 'claim.js runs as a child process, so it is always fresh');
+});
+
+test('loadedFiles lists this process\'s own repo modules, repo-relative with forward slashes', () => {
+  const files = runner.loadedFiles();
+  assert.ok(files.includes('scripts/gds/autobongos-run.js'));
+  assert.ok(files.every((f) => !f.includes('\\') && !f.startsWith('/') && !f.includes('node_modules/')));
+});
+
+test('refreshCheckout refuses to reset anything but the MAIN checkout', async () => {
+  const calls = [];
+  // Everything else answers as a healthy main checkout would, so the ONLY thing
+  // that can stop the reset is the worktree check itself.
+  const run = async (bin, args) => {
+    calls.push(args.join(' '));
+    if (args[1] === '--git-dir') return { ok: true, stdout: '/repo/.git/worktrees/some-claim\n' };
+    if (args[1] === '--git-common-dir') return { ok: true, stdout: '/repo/.git\n' };
+    if (args[0] === 'rev-parse' && args[1] === 'FETCH_HEAD') return { ok: true, stdout: `${'c'.repeat(40)}\n` };
+    if (args[0] === 'diff') return { ok: true, stdout: 'docs/a.md\n' };
+    return { ok: true, stdout: '' };
+  };
+  const r = await runner.refreshCheckout({ run, loadedHead: async () => 'a'.repeat(40) });
+  assert.equal(r.ok, false);
+  assert.ok(!calls.some((c) => c.startsWith('reset')), 'a linked worktree is somebody\'s claim — never reset it');
+});
+
+test('refreshCheckout in the main checkout fetches, diffs from the LOADED commit, then resets', async () => {
+  const calls = [];
+  const tip = 'c'.repeat(40);
+  const run = async (bin, args) => {
+    calls.push(args.join(' '));
+    if (args[1] === '--git-dir' || args[1] === '--git-common-dir') return { ok: true, stdout: '.git\n' };
+    if (args[0] === 'rev-parse' && args[1] === 'FETCH_HEAD') return { ok: true, stdout: `${tip}\n` };
+    if (args[0] === 'diff') return { ok: true, stdout: 'docs/a.md\r\nscripts/gds/sequence.js\n' };
+    return { ok: true, stdout: '' };
+  };
+  const r = await runner.refreshCheckout({ run, loadedHead: async () => 'a'.repeat(40) });
+  assert.deepEqual(r, { ok: true, to: tip, changed: ['docs/a.md', 'scripts/gds/sequence.js'] });
+  const order = ['fetch', 'diff', 'reset'].map((v) => calls.findIndex((c) => c.startsWith(v)));
+  assert.ok(order.every((i) => i >= 0) && order[0] < order[1] && order[1] < order[2], `fetch → diff → reset, got ${calls.join(' | ')}`);
+  assert.ok(calls.find((c) => c.startsWith('diff')).includes('a'.repeat(40)), 'the diff is from what the process LOADED, so a change that landed several refreshes ago still counts');
+});
+
+// Each way the refresh can bail must bail BEFORE the reset: a half-done refresh
+// that resets to an unread or undiffed commit would lose the restart decision.
+for (const [name, failAt] of [
+  ['the running commit is unknown', 'loaded'],
+  ['fetch failed', 'fetch'],
+  ['could not read the fetched commit', 'FETCH_HEAD'],
+  ['could not diff the running commit against main', 'diff'],
+]) {
+  test(`refreshCheckout bails without resetting when: ${name}`, async () => {
+    const calls = [];
+    const run = async (bin, args) => {
+      calls.push(args.join(' '));
+      if (args[1] === '--git-dir' || args[1] === '--git-common-dir') return { ok: true, stdout: '.git\n' };
+      if (args[0] === 'fetch') return { ok: failAt !== 'fetch', stdout: '' };
+      if (args[0] === 'rev-parse' && args[1] === 'FETCH_HEAD') return { ok: true, stdout: failAt === 'FETCH_HEAD' ? 'not-a-sha\n' : `${'c'.repeat(40)}\n` };
+      if (args[0] === 'diff') return { ok: failAt !== 'diff', stdout: 'docs/a.md\n' };
+      return { ok: true, stdout: '' };
+    };
+    const r = await runner.refreshCheckout({ run, loadedHead: async () => (failAt === 'loaded' ? null : 'a'.repeat(40)) });
+    assert.deepEqual(r, { ok: false, reason: name });
+    assert.ok(!calls.some((c) => c.startsWith('reset')), `no reset after "${name}"`);
+  });
+}
+
+test('a refresh in place reaches the heartbeat FILE through the real beat — disk_head end to end', async () => {
+  // The grader's catch: every forever() test stubbed writeHeartbeat, so the
+  // state never had to travel from the refresh to the file. This one does not.
+  const dir = mkdtempSync(join(tmpdir(), 'ab-diskhead-e2e-'));
+  const prev = process.env.AUTOBONGOS_HEARTBEAT_FILE;
+  process.env.AUTOBONGOS_HEARTBEAT_FILE = join(dir, 'beat.json');
+  try {
+    const d = loopDeps({
+      record: (r) => r,
+      refreshCheckout: async () => ({ ok: true, to: 'e'.repeat(40), changed: ['docs/a.md'] }),
+    });
+    delete d.writeHeartbeat;
+    await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2, refreshInPlace: true }, d);
+    const beat = JSON.parse(readFileSync(process.env.AUTOBONGOS_HEARTBEAT_FILE, 'utf8'));
+    assert.equal(beat.disk_head, 'e'.repeat(40));
+  } finally {
+    if (prev === undefined) delete process.env.AUTOBONGOS_HEARTBEAT_FILE; else process.env.AUTOBONGOS_HEARTBEAT_FILE = prev;
+  }
+});
+
+test('the heartbeat file names the on-disk commit when it differs from the running one', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'ab-diskhead-'));
+  const prev = process.env.AUTOBONGOS_HEARTBEAT_FILE;
+  process.env.AUTOBONGOS_HEARTBEAT_FILE = join(dir, 'beat.json');
+  try {
+    runner.writeHeartbeat(Date.now(), { diskHead: 'd'.repeat(40) });
+    const beat = JSON.parse(readFileSync(process.env.AUTOBONGOS_HEARTBEAT_FILE, 'utf8'));
+    assert.equal(beat.disk_head, 'd'.repeat(40), '"up to date on disk, old supervisor" must be visible');
+    runner.writeHeartbeat(Date.now(), { diskHead: null });
+    assert.equal(JSON.parse(readFileSync(process.env.AUTOBONGOS_HEARTBEAT_FILE, 'utf8')).disk_head, undefined);
+  } finally {
+    if (prev === undefined) delete process.env.AUTOBONGOS_HEARTBEAT_FILE; else process.env.AUTOBONGOS_HEARTBEAT_FILE = prev;
+  }
+});
+
 test('past the uptime floor, a drift still exits', async () => {
   const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, {
     iteration: async () => ({ event: 'hold', reason: 'test' }),
@@ -1098,3 +1303,79 @@ test('past the uptime floor, a drift still exits', async () => {
   });
   assert.equal(code, runner.UPGRADE_EXIT_CODE);
 });
+
+// ── the priority goal reaches the picker, the rows and the heartbeat (task 1004453) ──
+
+const twoGoalFence = (priority) => async () => ({
+  raw: { enabled: true, paused_reason: null, goals: [{ goal_id: 1000119 }, { goal_id: 1000090 }], priority_goal_id: priority },
+  graderBypassed: false,
+});
+
+test('the picker is handed the priority goal first', async () => {
+  let sawGoals = null;
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async (goals) => { sawGoals = goals; return { task: { ...aTask, goal_id: 1000090 }, goalId: 1000090, skipped: [] }; },
+  });
+  await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.deepEqual(sawGoals, [1000090, 1000119]);
+});
+
+test('a worked row says its pick came from the priority goal', async () => {
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async () => ({ task: { ...aTask, goal_id: 1000090 }, goalId: 1000090, skipped: [] }),
+  });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.event, 'worked');
+  assert.equal(row.goal_id, 1000090);
+  assert.equal(row.priority, true);
+});
+
+test('once the priority goal runs dry, a pick from the rest reads priority:false', async () => {
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async () => ({ task: aTask, goalId: 1000119, skipped: [] }),
+  });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.event, 'worked');
+  assert.equal(row.goal_id, 1000119);
+  assert.equal(row.priority, false);
+});
+
+test('with no priority set, no pick claims to be one', async () => {
+  const h = harness({ readFence: twoGoalFence(null) });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.priority, false);
+});
+
+test('a dry run and an empty queue both name the priority', async () => {
+  const dry = await runner.iteration({ ...opts, goals: [], dryRun: true }, harness({
+    readFence: twoGoalFence(1000119),
+  }).deps);
+  assert.equal(dry.event, 'dry_run');
+  assert.equal(dry.priority, true);
+  const none = await runner.iteration({ ...opts, goals: [] }, harness({
+    readFence: twoGoalFence(1000119),
+    pickTask: async () => ({ none: true, skipped: [] }),
+  }).deps);
+  assert.equal(none.event, 'nothing_claimable');
+  assert.equal(none.priority_goal, 1000119);
+});
+
+test('the server heartbeat carries the goal the current task came from', async () => {
+  const beats = [];
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 1 }, {
+    iteration: async () => ({ event: 'worked', task_id: 4242, goal_id: 1000090, priority: true }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields); return true; },
+    emit: () => {},
+    record: (r) => r,
+    codeDrifted: async () => false,
+  });
+  const b = beats.find((x) => x.working_task_id === 4242);
+  assert.ok(b, 'the beat after a worked row must name its task');
+  assert.equal(b.working_goal_id, 1000090);
+});

package/tests/autonomy_fence_priority.mjs

@@ -0,0 +1,211 @@
+// tests/autonomy_fence_priority.mjs — the fence's priority goal, server side
+// (task 1004453).
+//
+// Owner ruling, 2026-09-30: whoever starts the runner names the goal it works
+// FIRST, from the hall's /builders/gate page or the API, and the server refuses a
+// priority that is not on the allowlist. These drive REAL requests through the
+// assembled autonomy router with only the auth gates stubbed (the
+// routine_observability_api precedent), pin the SQL against a stubbed pool, and
+// hold the migration to the shape the route relies on. The pure ordering rule is
+// tests/autobongos_fence.mjs; the runner's use of it is tests/autobongos_loop.mjs.
+//
+// DB-free, no network. Run:  node --test tests/autonomy_fence_priority.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+const permStub = (key) => {
+  const mw = (_req, _res, next) => next();
+  mw.permKey = key;
+  return mw;
+};
+const passBuilder = (reqq, _res, next) => { reqq.builder = { id: 3, rank: 'archon' }; next(); };
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = passBuilder;
+  api.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)();
+  } finally {
+    api.requireBuilder = saved.b;
+    api.requirePermission = saved.p;
+  }
+}
+
+async function serve(router) {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(router);
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  return { base: `http://127.0.0.1:${server.address().port}`, close: () => server.close() };
+}
+
+const post = (base, p, body) => fetch(`${base}${p}`, {
+  method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+});
+
+test('POST /autonomy/fence/priority sits behind the same owner-only atom as the allowlist', () => {
+  const router = autonomyRouter();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/autonomy/fence/priority');
+  assert.ok(layer, 'the route is registered');
+  assert.equal(layer.route.methods.post, true);
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.fence.manage');
+});
+
+test('the route sets, clears, and refuses a goal that is not allowlisted', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.setPriorityGoal;
+  const seen = [];
+  let answer = { row: { priority_goal_id: 1000119, updated_at: '2026-09-30T00:00:00.000Z' } };
+  db.setPriorityGoal = async (args) => { seen.push(args); return answer; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 200);
+    assert.equal((await r.json()).priority_goal_id, 1000119);
+    assert.deepEqual(seen.pop(), { goalId: 1000119, builderId: 3 }, 'the writer is the SESSION, never the body');
+
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: '1000119' });
+    assert.equal(r.status, 200, 'a stringified id is accepted, as the allowlist route accepts one');
+    assert.equal(seen.pop().goalId, 1000119);
+
+    answer = { row: { priority_goal_id: null, updated_at: '2026-09-30T00:00:00.000Z' } };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: null });
+    assert.equal(r.status, 200);
+    assert.equal(seen.pop().goalId, null, 'null clears the priority');
+
+    answer = { notAllowed: true };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000090 });
+    assert.equal(r.status, 409, 'a priority must already be on the allowlist');
+    assert.equal((await r.json()).error.code, 'goal_not_allowlisted');
+
+    answer = { missing: true };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 503);
+
+    const before = seen.length;
+    for (const bad of [{}, { goal_id: 0 }, { goal_id: -1 }, { goal_id: 'abc' }, { goal_id: 1.5 }]) {
+      r = await post(s.base, '/autonomy/fence/priority', bad);
+      assert.equal(r.status, 400, `${JSON.stringify(bad)} is refused`);
+    }
+    assert.equal(seen.length, before, 'a malformed request never reaches the database');
+
+    db.setPriorityGoal = async () => { throw new Error('connection reset'); };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 500);
+    assert.ok(!JSON.stringify(await r.json()).includes('connection reset'), 'the database error stays in the log');
+  } finally {
+    s.close();
+    db.setPriorityGoal = saved;
+  }
+});
+
+test('setPriorityGoal: the WHERE refuses a goal that is not allowlisted, and says which refusal it was', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  let replies = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return replies.shift(); };
+  try {
+    replies = [{ rows: [{ priority_goal_id: '1000119', updated_at: 't' }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000119, builderId: 3 }), { row: { priority_goal_id: 1000119, updated_at: 't' } });
+    assert.match(calls[0].sql, /UPDATE autonomy_fence/);
+    assert.match(calls[0].sql, /EXISTS \(SELECT 1 FROM autonomy_allowed_goals WHERE goal_id = \$1::bigint\)/);
+    assert.deepEqual(calls[0].params, [1000119, 3]);
+
+    replies = [{ rows: [] }, { rows: [{ '?column?': 1 }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000090 }), { notAllowed: true });
+
+    replies = [{ rows: [] }, { rows: [] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000090 }), { missing: true });
+
+    replies = [{ rows: [{ priority_goal_id: null, updated_at: 't' }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: null }), { row: { priority_goal_id: null, updated_at: 't' } });
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('readFence carries the priority as a number, and null when unset', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  let pri = '1000119';
+  api.pool.query = async (sql) => (/FROM autonomy_fence/.test(sql)
+    ? { rows: [{ enabled: true, paused_reason: null, priority_goal_id: pri, updated_at: 't', updated_by: '3' }] }
+    : { rows: [{ goal_id: '1000119', note: null, added_at: 't', added_by: '3' }] });
+  try {
+    assert.equal((await db.readFence()).priority_goal_id, 1000119, 'a bigint string would never equal a numeric goal id');
+    pri = null;
+    assert.equal((await db.readFence()).priority_goal_id, null);
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the heartbeat stores and returns the goal the current task came from', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ working_task_id: 4242, working_goal_id: 1000090 }] }; };
+  try {
+    await db.recordRunnerHeartbeat({ builderId: 3, host: 'winbox', workingTaskId: 4242, workingGoalId: 1000090 });
+    assert.match(calls[0].sql, /working_goal_id = EXCLUDED\.working_goal_id/);
+    assert.equal(calls[0].params[8], 1000090);
+    const rows = await db.readRunnerHeartbeats(3);
+    assert.equal(rows[0].working_goal_id, '1000090');
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the route accepts working_goal_id on a heartbeat and passes it through', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.recordRunnerHeartbeat;
+  const seen = [];
+  db.recordRunnerHeartbeat = async (args) => { seen.push(args); return {}; };
+  const s = await serve(autonomyRouter());
+  try {
+    const r = await post(s.base, '/autonomy/heartbeat', { host: 'winbox', working_task_id: 4242, working_goal_id: 1000090 });
+    assert.equal(r.status, 200);
+    assert.equal(seen[0].workingGoalId, 1000090);
+  } finally {
+    s.close();
+    db.recordRunnerHeartbeat = saved;
+  }
+});
+
+test('the migration ties the priority to the allowlist and clears it on revoke', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'modules/autonomy/migrations/autonomy_003_priority_goal.sql'), 'utf8')
+    .split('\n').filter((l) => !l.trim().startsWith('--')).join('\n');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS priority_goal_id bigint\s+REFERENCES autonomy_allowed_goals \(goal_id\) ON DELETE SET NULL/,
+    'revoking the priority goal must clear the priority, never leave a revoked goal "first"');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS working_goal_id bigint/);
+  assert.doesNotMatch(sql, /\bDROP\b/i, 'module migrations are additive');
+});
+
+test('the gate page renders the priority, lists it first, and posts to the priority route', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
+  assert.match(src, /renderFenceGoals\(fence\.goals, fence\.priority_goal_id\)/, 'the page must pass the priority it read');
+  assert.match(src, /sendJson\('POST', '\/autonomy\/fence\/priority', \{ goal_id: goalId \}\)/);
+  assert.match(src, /Make priority/);
+  assert.match(src, /Clear priority/);
+});

package/tests/bongos_cli.mjs

@@ -87,7 +87,13 @@ test('VERBS: selfHelp is only claimed by scripts that really print their own usa
   // `serve` is dev.js with --server pinned on, so it inherits dev's own usage()
   // printer — verified: `bongos serve --help` prints the card and exits 0.
   const selfHelp = Object.entries(cli.VERBS).filter(([, d]) => d.selfHelp).map(([v]) => v).sort();
-  assert.deepEqual(selfHelp, ['dev', 'module', 'serve', 'status', 'task', 'upgrade']);
+  assert.deepEqual(selfHelp, ['dev', 'feedback', 'module', 'serve', 'status', 'task', 'upgrade']);
+});
+
+test('bongos feedback --help prints its own usage and sends nothing', () => {
+  const r = run('feedback', '--help');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /bongos feedback "what went wrong"/);
 });
 
 // ---- spawned: the dispatcher answers --help without touching the script ----

package/tests/filing_abuse_matrix.mjs

@@ -405,10 +405,15 @@ await test('[F18] the vector fails CLOSED — forged, absent or unknown never op
       `vector ${JSON.stringify(vector)} must not route`
     );
   }
-  // The allowlist is exactly two members, and both are server-set at their call
+  // The allowlist is exactly three members, and all are server-set at their call
   // site — never read from a request body, which is what makes forging it a
   // non-move rather than a merely-hard one.
-  assert.deepEqual([...routing.HOMELESS_ROUTING_VECTORS].sort(), ['api', 'discord-bugs']);
+  assert.deepEqual([...routing.HOMELESS_ROUTING_VECTORS].sort(), ['api', 'discord-bugs', 'instance-feedback']);
+  // The hub's feedback relay (task 1004462) names its own vector and never a rank,
+  // so a relayed bug can only ever land at 'backlog'.
+  const feedbackSrc = read('modules/platform-identity/instance-feedback.js');
+  assert.match(feedbackSrc, /vector: 'instance-feedback'/, 'the relay hardcodes its own vector');
+  assert.match(feedbackSrc, /filerRank: null/, 'and files with no rank');
   const routeSrc = read('modules/ideas/routes/inbox.js');
   assert.match(routeSrc, /vector: 'api'/, 'the route hardcodes its own vector');
   assert.ok(!/vector:\s*body\.|vector:\s*req\.body/.test(routeSrc),

package/tests/idea_routing.mjs

@@ -172,7 +172,7 @@ await test('matrix: FAIL-CLOSED — an absent or unrecognised rank never hard-la
 // -------------------------------------------------------------------------
 
 await test('matrix: a homeless BUG from a trusted vector routes, and keeps the rank split', () => {
-  for (const vector of ['api', 'discord-bugs']) {
+  for (const vector of ['api', 'discord-bugs', 'instance-feedback']) {
     assert.deepEqual(
       decideLanding({ goalId: null, kind: 'bug', filerRank: 'archon', vector }),
       { route: true, status: 'ready', homeless: true, reason: 'bug_homeless_trusted_filer' },