@bongos/core 1.21.126 → 1.21.127

package/src/module-loader/error-tally.js

@@ -0,0 +1,188 @@
+// src/module-loader/error-tally.js — count each mounted module's runtime errors
+// per day, so a store module's Reliability score has real installs behind it
+// (task 1004637, follow-up to task 1003793; ADR 0343 D1).
+//
+// WHY. The store scores Reliability from a daily runtime-error count per module
+// version, but nothing on an instance counted one: the loader console.errored a
+// poller that failed to load and attributed nothing else to a module at all. This
+// file is the instance-side tally the loader feeds; scripts/gds/module-error-report.js
+// is the sender that turns it into reports.
+//
+// WHAT COUNTS. A request a module's router took and answered 500 (a thrown error or
+// an unhandled failure — not a 4xx, which is the caller's mistake, and not a 503,
+// which modules use to say "not set up here"); a poller that failed to load, threw
+// or rejected on start; and anything a poller hands to the `reportError` the loader
+// gives it. Only a module whose manifest carries an exact X.Y.Z version is counted,
+// because the store files counts against an exact version.
+//
+// COUNTS ONLY (owner's privacy posture, 2026-10-01). The tally holds module key,
+// version, day and a whole number — never an error's text, a path or a request.
+//
+// WHO SENDS (owner, 2026-10-15). A builder's sign-in on the box: the store's report
+// routes take a builder, and no project-to-store credential exists (parked as
+// task 1004740). So this file never talks to the network. It writes the tally to the
+// instance config dir, and startDailySend() runs the sender as a CHILD process —
+// cli-lib's session plumbing must never load in the server process.
+//
+// Counting is always in memory; nothing touches disk until start() is called, and
+// only the server entrypoint calls it — so a test or tool that mounts modules never
+// writes a file.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const FILE_NAME = 'module-error-counts.json';
+// Days kept on disk. One more than the store accepts (ERROR_DAY_WINDOW = 30), so a
+// day the sender has not reached yet is never pruned before it can go.
+const KEEP_DAYS = 31;
+const FLUSH_DELAY_MS = 5_000;
+const ROLL_CHECK_MS = 60 * 60 * 1000;
+const SEND_EVERY_MS = 6 * 60 * 60 * 1000;
+const FIRST_SEND_DELAY_MS = 10 * 60 * 1000;
+const EXACT_VERSION = /^\d+\.\d+\.\d+$/;
+// The sender, rooted at this file so what the server runs is answerable by reading
+// this line (exec-path-guard, task 1003371).
+const SENDER = path.join(__dirname, '..', '..', 'scripts', 'gds', 'module-error-report.js');
+
+function utcDay(ms = Date.now()) { return new Date(ms).toISOString().slice(0, 10); }
+
+let _now = Date.now;
+let _days = {};          // day → { "key@version": count }
+let _mounted = new Map(); // key → version, for every module seeded today and each new day
+let _file = null;         // set by start(); null = nothing written to disk
+let _flushTimer = null;
+let _timers = [];
+
+function entryOf(key, version) { return `${key}@${version}`; }
+
+// Make sure today has a 0 for every mounted module — a clean day is exactly what
+// Reliability measures, so a module that ran and threw nothing must still appear.
+function seedToday() {
+  const today = utcDay(_now());
+  const row = (_days[today] ||= {});
+  for (const [key, version] of _mounted) {
+    const e = entryOf(key, version);
+    if (!(e in row)) row[e] = 0;
+  }
+  return row;
+}
+
+// Register the modules this process runs. Call once the enabled set is known; a
+// module without an exact version is ignored. Returns how many were registered.
+function seed(modules) {
+  let n = 0;
+  for (const { key, manifest } of modules) {
+    const v = manifest && manifest.version;
+    if (typeof v !== 'string' || !EXACT_VERSION.test(v)) continue;
+    _mounted.set(key, v);
+    n += 1;
+  }
+  seedToday();
+  scheduleFlush();
+  return n;
+}
+
+// Count one runtime error against a mounted module. Unknown or unversioned keys
+// are ignored, so a stray call can never invent a module.
+function record(key) {
+  const version = _mounted.get(key);
+  if (!version) return false;
+  const row = seedToday();
+  row[entryOf(key, version)] += 1;
+  scheduleFlush();
+  return true;
+}
+
+function prune() {
+  const cutoff = utcDay(_now() - KEEP_DAYS * 86_400_000);
+  for (const d of Object.keys(_days)) if (d < cutoff) delete _days[d];
+}
+
+function scheduleFlush() {
+  if (!_file || _flushTimer) return;
+  _flushTimer = setTimeout(() => { _flushTimer = null; flush(); }, FLUSH_DELAY_MS);
+  if (_flushTimer.unref) _flushTimer.unref();
+}
+
+// Write the tally atomically (temp file, then rename), so the sender never reads
+// half a file. Best-effort: a failed write costs a count, never the server.
+function flush() {
+  if (!_file) return false;
+  prune();
+  try {
+    fs.mkdirSync(path.dirname(_file), { recursive: true });
+    const tmp = `${_file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ days: _days }, null, 2));
+    fs.renameSync(tmp, _file);
+    return true;
+  } catch (e) {
+    process.emitWarning(`module error tally: could not write ${_file}: ${e && e.message ? e.message : e}`);
+    return false;
+  }
+}
+
+// Read a tally file. Never throws: a missing or unreadable file is an empty tally.
+function readTally(file) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return parsed && typeof parsed.days === 'object' && parsed.days ? parsed.days : {};
+  } catch { return {}; }
+}
+
+function defaultFile() {
+  return require('../instance-config').configPath(FILE_NAME);
+}
+
+// Persist from now on. Merges what is already on disk (a restart mid-day keeps the
+// morning's count: the higher of the two wins per entry), seeds today, and checks
+// hourly for a new day so a server that runs for a week still files a 0 each day.
+function start({ file = defaultFile(), now } = {}) {
+  if (now) _now = now;
+  _file = file;
+  const onDisk = readTally(file);
+  for (const [day, row] of Object.entries(onDisk)) {
+    const mine = (_days[day] ||= {});
+    for (const [e, n] of Object.entries(row || {})) {
+      if (Number.isInteger(n) && n >= 0) mine[e] = Math.max(mine[e] || 0, n);
+    }
+  }
+  seedToday();
+  flush();
+  const roll = setInterval(() => { seedToday(); flush(); }, ROLL_CHECK_MS);
+  if (roll.unref) roll.unref();
+  _timers.push(roll);
+  return file;
+}
+
+// Run the sender now and then (scripts/gds/module-error-report.js) as a child
+// process. It sends nothing without a builder sign-in on this box, and only days
+// before today, so running it often is cheap and safe. Returns the timers.
+function startDailySend({ spawnImpl } = {}) {
+  const { spawn } = require('node:child_process');
+  const run = spawnImpl || (() => {
+    const child = spawn(process.execPath, [SENDER, '--quiet'], { stdio: 'ignore', detached: false });
+    child.on('error', () => {});
+    if (child.unref) child.unref();
+  });
+  if (!fs.existsSync(SENDER)) return [];
+  const go = () => { try { run(SENDER); } catch { /* best-effort */ } };
+  const first = setTimeout(go, FIRST_SEND_DELAY_MS);
+  const every = setInterval(go, SEND_EVERY_MS);
+  for (const t of [first, every]) if (t.unref) t.unref();
+  _timers.push(first, every);
+  return [first, every];
+}
+
+// The in-memory tally, for tests and a /watch tile.
+function snapshot() { return JSON.parse(JSON.stringify(_days)); }
+
+function _reset() {
+  for (const t of _timers) { clearTimeout(t); clearInterval(t); }
+  if (_flushTimer) clearTimeout(_flushTimer);
+  _timers = []; _flushTimer = null; _days = {}; _mounted = new Map(); _file = null; _now = Date.now;
+}
+
+module.exports = {
+  FILE_NAME,
+  utcDay, seed, record, readTally, start, startDailySend, snapshot, _reset,
+};

package/src/module-loader/loader.js

@@ -112,7 +112,7 @@ function discoverModules({ roots = DEFAULT_ROOTS, core = coreVersion() } = {}) {
 // Cached singleton for app code (lazy, like src/modules.js's modules()).
 let _cache = null;
 function discovered(opts) { return (_cache ||= discoverModules(opts)); }
-function _reset() { _cache = null; _startedPollers = []; _boot = { routes: null, pollers: null }; _bootShape = null; }
+function _reset() { resetErrorTally(); _cache = null; _startedPollers = []; _boot = { routes: null, pollers: null }; _bootShape = null; }
 
 // The discovered manifests as MODULE_REGISTRY-shaped entries, so src/modules.js
 // can merge them with its built-in registry. Empty until a module exists.
@@ -197,10 +197,13 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
     for (const rk of routeKeys) {
       const factory = require(path.join(dir, 'routes', `${rk}.js`));
       const sub = typeof factory === 'function' ? factory() : factory;
-      router.use(sub);
+      router.use(attributeErrors(key, sub));
       mounted += 1;
     }
   }
+  // Every enabled module gets a 0 for today, routes or not: a clean day is what the
+  // store's Reliability score measures (task 1004637).
+  seedErrorTally(enabled);
   return mounted;
 }
 
@@ -352,19 +355,26 @@ function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
         // here. A file that EXISTS but throws is a real error (the catch below).
         if (e && e.code === 'MODULE_NOT_FOUND' && String(e.message).includes(pollerPath)) continue;
         console.error(`[module-loader] poller ${key}/${pk} failed to load: ${e && e.message ? e.message : e}`);
+        recordModuleError(key);
         continue;
       }
       try {
         if (poller && typeof poller.start === 'function') {
-          const r = poller.start(deps);
+          // reportError: how a poller counts a failure in its own runs against its
+          // module (task 1004637) — counts only, it takes no message.
+          const r = poller.start({ ...deps, reportError: () => recordModuleError(key) });
           if (r && typeof r.then === 'function') {
-            r.catch((e) => console.error(`[module-loader] poller ${key}/${pk} start error: ${e && e.message ? e.message : e}`));
+            r.catch((e) => {
+              console.error(`[module-loader] poller ${key}/${pk} start error: ${e && e.message ? e.message : e}`);
+              recordModuleError(key);
+            });
           }
           started.push({ key, poller: pk, handle: poller });
           _boot.pollers.add(key);
         }
       } catch (e) {
         console.error(`[module-loader] poller ${key}/${pk} start threw: ${e && e.message ? e.message : e}`);
+        recordModuleError(key);
       }
     }
   }
@@ -397,9 +407,47 @@ function loaderSnapshot(opts) {
     loaded: d.loaded.map((m) => m.key),
     skipped: d.skipped,
     errors: d.errors,
+    // per-day runtime-error counts per module@version, kept for the store (task 1004637)
+    errorCounts: snapshotErrorTally(),
   };
 }
 
+// Which module took this request, and whether its 500 has been hooked yet.
+const OWNER = Symbol('moduleOwner');
+const HOOKED = Symbol('moduleErrorHooked');
+
+// Wrap a module's router so a request it answers with a 500 counts against that
+// module (task 1004637). The module is the owner from the moment the request enters
+// its router until it falls through (the router calls next() with no error): a request
+// the module never matched is not its fault, and the next module or the kernel takes
+// it from there. An error the module passes on (next(err)) keeps it the owner, so the
+// kernel's error handler answering 500 for it still counts here. Only a 500 counts:
+// a 4xx is the caller's mistake and a 503 is a module saying it is not set up.
+//
+// A plain function rather than a nested express Router, so nothing about mounting
+// changes for the kernel; `stack` is passed through so tooling that reads a mounted
+// router's routes still sees the module's own.
+function attributeErrors(key, sub) {
+  const scoped = function moduleScoped(req, res, next) {
+    const prev = req[OWNER];
+    req[OWNER] = key;
+    if (!req[HOOKED] && res && typeof res.on === 'function') {
+      req[HOOKED] = true;
+      res.on('finish', () => { if (res.statusCode === 500 && req[OWNER]) recordModuleError(req[OWNER]); });
+    }
+    sub(req, res, (err) => {
+      if (!err || typeof err === 'string') req[OWNER] = prev; // fell through ('route'/'router' too)
+      next(err);
+    });
+  };
+  if (sub && sub.stack) scoped.stack = sub.stack;
+  return scoped;
+}
+
+// Per-module runtime-error counts (task 1004637). Pure fs + timers, no network and no
+// core requires at load, so it is cycle-safe here.
+const { seed: seedErrorTally, record: recordModuleError, _reset: resetErrorTally, snapshot: snapshotErrorTally } = require('./error-tally');
+
 module.exports = {
   discoverModules,
   discovered,

package/src/platform-server.js

@@ -47,6 +47,7 @@ const express = require('express');
 const { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal } = require('./bongos/serve-internal');
 const { isApiShapedPath, apiNotFoundBody } = require('./bongos/api-path-404');
 const moduleLoader = require('./module-loader/loader');
+const { start: startErrorTally, startDailySend: startErrorReports } = require('./module-loader/error-tally');
 const { isModuleEnabled } = require('./modules');
 // Hoisted out of an inline require inside the boot IIFE below (task 1004052 strand walk).
 // knip does not follow an inline require(), so every export of module-overrides.js read as
@@ -413,6 +414,12 @@ if (require.main === module) {
       // process starts, and /version carries the count within one query of a restart.
       schemaPending();
       startBackgroundServices();
+      // Store modules' daily runtime-error counts (task 1004637): keep the tally on
+      // disk, and now and then run the sender, which goes out only with a builder
+      // sign-in on this box. Here, not in startBackgroundServices(), so a test that
+      // starts the pollers never writes the tally or spawns the sender.
+      try { startErrorTally(); startErrorReports(); }
+      catch (e) { logger.warn({ err: e.message }, 'module error tally did not start; module error counts are not kept'); }
     });
   })().catch((err) => {
     // THE AWAIT ABOVE MUST NOT SOFTEN A FATAL BOOT (task 1002857, caught by

package/tests/module_error_counts.mjs

@@ -0,0 +1,265 @@
+// tests/module_error_counts.mjs — instances count each store module's runtime
+// errors per day and send the daily count with the builder sign-in on the box
+// (task 1004637): the loader's attribution, the on-disk tally, and the sender.
+// Hermetic — temp dirs, a fake store client, an in-process express app.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const loader = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
+const { seed, record, readTally, start, startDailySend, _reset } = require(path.join(ROOT, 'src', 'module-loader', 'error-tally.js'));
+// the in-memory tally is read the way tooling reads it: through the loader's snapshot
+const tally = { seed, record, readTally, start, startDailySend, _reset, snapshot: () => loader.loaderSnapshot().errorCounts };
+const sender = require(path.join(ROOT, 'scripts', 'gds', 'module-error-report.js'));
+const express = require('express');
+
+function tmpDir(prefix) { return fs.mkdtempSync(path.join(os.tmpdir(), prefix)); }
+
+function fixtureRoot(spec) {
+  const root = tmpDir('bongos-errmods-');
+  for (const [key, def] of Object.entries(spec)) {
+    const d = path.join(root, key);
+    fs.mkdirSync(d, { recursive: true });
+    fs.writeFileSync(path.join(d, 'module.json'), JSON.stringify({
+      key, title: key, description: 'd', version: def.version === undefined ? '1.2.0' : def.version,
+      coreVersion: '^1.0.0', contributes: def.contributes || {},
+    }));
+    for (const [rel, content] of Object.entries(def.files || {})) {
+      const fp = path.join(d, rel);
+      fs.mkdirSync(path.dirname(fp), { recursive: true });
+      fs.writeFileSync(fp, content);
+    }
+  }
+  return root;
+}
+
+const TODAY = new Date().toISOString().slice(0, 10);
+
+// ---------------------------------------------------------------------------
+// The tally
+// ---------------------------------------------------------------------------
+
+test('seed gives every exactly-versioned module a 0 today; record counts only those', () => {
+  tally._reset();
+  const n = tally.seed([
+    { key: 'alpha', manifest: { version: '1.2.0' } },
+    { key: 'loose', manifest: { version: '^1.0.0' } },
+    { key: 'none', manifest: {} },
+  ]);
+  assert.equal(n, 1);
+  assert.deepEqual(tally.snapshot()[TODAY], { 'alpha@1.2.0': 0 }, 'a clean day is a 0, not a missing row');
+  assert.equal(tally.record('alpha'), true);
+  assert.equal(tally.record('alpha'), true);
+  assert.equal(tally.record('loose'), false, 'no exact version, nothing to file it against');
+  assert.equal(tally.record('ghost'), false, 'a stray key never invents a module');
+  assert.deepEqual(tally.snapshot()[TODAY], { 'alpha@1.2.0': 2 });
+  tally._reset();
+});
+
+test('nothing touches disk until start(); start merges the file (higher count wins) and prunes old days', () => {
+  tally._reset();
+  const dir = tmpDir('bongos-tally-');
+  const file = path.join(dir, 'module-error-counts.json');
+  tally.seed([{ key: 'alpha', manifest: { version: '1.2.0' } }]);
+  tally.record('alpha');
+  assert.equal(fs.existsSync(file), false);
+  fs.writeFileSync(file, JSON.stringify({ days: {
+    [TODAY]: { 'alpha@1.2.0': 5 },
+    '2000-01-01': { 'alpha@1.0.0': 9 },
+  } }));
+  tally.start({ file });
+  const onDisk = tally.readTally(file);
+  assert.equal(onDisk[TODAY]['alpha@1.2.0'], 5, 'a restart mid-day keeps the morning count');
+  assert.equal(onDisk['2000-01-01'], undefined, 'days past the window are pruned');
+  tally._reset();
+});
+
+test('the tally on disk holds counts only — key@version and a number, nothing else', () => {
+  tally._reset();
+  const file = path.join(tmpDir('bongos-tally-'), 'c.json');
+  tally.seed([{ key: 'alpha', manifest: { version: '1.2.0' } }]);
+  tally.record('alpha');
+  tally.start({ file });
+  const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+  assert.deepEqual(Object.keys(raw), ['days']);
+  for (const row of Object.values(raw.days)) {
+    for (const [k, v] of Object.entries(row)) {
+      assert.match(k, /^[a-z0-9-]+@\d+\.\d+\.\d+$/);
+      assert.ok(Number.isInteger(v));
+    }
+  }
+  tally._reset();
+});
+
+// ---------------------------------------------------------------------------
+// The loader attributes a 500 to the module that answered it
+// ---------------------------------------------------------------------------
+
+async function withServer(app, fn) {
+  const server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  try { return await fn(base); } finally { await new Promise((r) => server.close(r)); }
+}
+
+test('a module route that throws or answers 500 counts against it; a 4xx, a 503 and a fall-through do not', async () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: {
+      contributes: { routes: ['main'] },
+      files: { 'routes/main.js': `
+        const express = require(${JSON.stringify(require.resolve('express'))});
+        module.exports = () => {
+          const r = express.Router();
+          r.get('/alpha/boom', () => { throw new Error('boom'); });
+          r.get('/alpha/fail', (req, res) => res.status(500).json({ error: 'x' }));
+          r.get('/alpha/bad', (req, res) => res.status(400).json({ error: 'x' }));
+          r.get('/alpha/off', (req, res) => res.status(503).json({ error: 'not set up' }));
+          r.get('/alpha/pass', (req, res, next) => next(new Error('handed on')));
+          return r;
+        };` },
+    },
+    beta: { contributes: {} },
+  });
+  const app = express();
+  const router = express.Router();
+  loader.mountModuleRoutes(router, { isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  router.get('/kernel/boom', () => { throw new Error('kernel'); });
+  app.use(router);
+  app.use((err, req, res, next) => res.status(500).json({ error: 'internal' })); // eslint-disable-line no-unused-vars
+
+  await withServer(app, async (base) => {
+    for (const p of ['/alpha/boom', '/alpha/fail', '/alpha/bad', '/alpha/off', '/alpha/pass', '/kernel/boom']) {
+      await (await fetch(base + p)).text();
+    }
+  });
+  await new Promise((r) => setImmediate(r));
+  const day = tally.snapshot()[TODAY];
+  assert.equal(day['alpha@1.2.0'], 3, 'boom + fail + next(err) — not the 400, not the 503, not the kernel route');
+  assert.equal(day['beta@1.2.0'], 0, 'an enabled module with no routes still files its clean day');
+  loader._reset();
+});
+
+test('the wrapped router still exposes the module’s own routes to tooling', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: {
+      contributes: { routes: ['main'] },
+      files: { 'routes/main.js': `
+        const express = require(${JSON.stringify(require.resolve('express'))});
+        module.exports = () => { const r = express.Router(); r.get('/alpha/x', (q, s) => s.end()); return r; };` },
+    },
+  });
+  const used = [];
+  loader.mountModuleRoutes({ use: (r) => used.push(r) }, { isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.equal(used.length, 1);
+  const paths = (used[0].stack || []).filter((l) => l.route).map((l) => l.route.path);
+  assert.deepEqual(paths, ['/alpha/x']);
+  loader._reset();
+});
+
+test('a poller that throws on start counts, and a running poller can report through reportError', async () => {
+  loader._reset();
+  const root = fixtureRoot({
+    broken: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start() { throw new Error("x"); } };' } },
+    rejecting: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start() { return Promise.reject(new Error("x")); } };' } },
+    reporting: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start(deps) { deps.reportError(); deps.reportError(); } };' } },
+  });
+  const opts = { roots: [root], core: '1.0.0' };
+  loader.mountModuleRoutes({ use: () => {} }, { isEnabled: () => true }, opts);
+  const origErr = console.error;
+  console.error = () => {};
+  try {
+    loader.startModulePollers({}, { isEnabled: () => true }, opts);
+    await new Promise((r) => setImmediate(r));
+  } finally { console.error = origErr; }
+  const day = tally.snapshot()[TODAY];
+  assert.equal(day['broken@1.2.0'], 1);
+  assert.equal(day['rejecting@1.2.0'], 1);
+  assert.equal(day['reporting@1.2.0'], 2);
+  loader._reset();
+});
+
+// ---------------------------------------------------------------------------
+// The sender
+// ---------------------------------------------------------------------------
+
+function fakeStore({ enabled = true, known = ['alpha'], post = () => ({ ok: true, status: 200 }) } = {}) {
+  const calls = [];
+  const call = async (method, p, opts = {}) => {
+    calls.push({ method, p, json: opts.json });
+    if (p === '/store/usage-reporting') return { ok: true, status: 200, data: { enabled } };
+    if (p.startsWith('/store/modules/latest')) {
+      return { ok: true, status: 200, data: { latest: Object.fromEntries(known.map((k) => [k, { version: '1.2.0' }])) } };
+    }
+    return post(p, opts.json);
+  };
+  return { call, calls };
+}
+
+test('pendingDays: finished, unsent days inside the store window, oldest first', () => {
+  const days = { '2026-10-14': {}, '2026-10-15': {}, '2026-10-12': {}, '2026-09-01': {} };
+  assert.deepEqual(sender.pendingDays(days, { '2026-10-12': true }, '2026-10-15'), ['2026-10-14']);
+});
+
+test('sendPending sends every count for a store module, zeros included, and skips modules the store does not know', async () => {
+  const { call, calls } = fakeStore();
+  const days = { '2026-10-14': { 'alpha@1.2.0': 0, 'core-thing@3.0.0': 4 } };
+  const out = await sender.sendPending({ days, today: '2026-10-15', call });
+  const posts = calls.filter((c) => c.method === 'POST');
+  assert.equal(posts.length, 1);
+  assert.equal(posts[0].p, '/store/modules/alpha/versions/1.2.0/error-count');
+  assert.deepEqual(posts[0].json, { day: '2026-10-14', count: 0 }, 'a clean day goes as a 0');
+  assert.deepEqual(out.sentDays, ['2026-10-14']);
+  assert.equal(out.skipped, 1);
+});
+
+test('an opted-out builder sends nothing, and the days are marked done', async () => {
+  const { call, calls } = fakeStore({ enabled: false });
+  const out = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 2 } }, today: '2026-10-15', call });
+  assert.equal(calls.filter((c) => c.method === 'POST').length, 0);
+  assert.equal(out.optedOut, true);
+  assert.deepEqual(out.sentDays, ['2026-10-14']);
+});
+
+test('a refusal for good (4xx) is done; a server error leaves the day for the next run', async () => {
+  const refused = fakeStore({ post: () => ({ ok: false, status: 403 }) });
+  const a = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 1 } }, today: '2026-10-15', call: refused.call });
+  assert.deepEqual(a.sentDays, ['2026-10-14']);
+  const down = fakeStore({ post: () => ({ ok: false, status: 502 }) });
+  const b = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 1 } }, today: '2026-10-15', call: down.call });
+  assert.deepEqual(b.sentDays, []);
+  assert.equal(b.retryLater, true);
+});
+
+test('main records the days it sent, and a second run sends nothing again', async () => {
+  const dir = tmpDir('bongos-sender-');
+  const tallyFile = path.join(dir, 'counts.json');
+  const sentFile = path.join(dir, 'sent.json');
+  fs.writeFileSync(tallyFile, JSON.stringify({ days: { '2026-10-14': { 'alpha@1.2.0': 3 }, '2026-10-15': { 'alpha@1.2.0': 1 } } }));
+  const first = fakeStore();
+  const log = () => {};
+  assert.equal(await sender.main([], { log, request: first.call, tallyFile, sentFile, today: '2026-10-15' }), 0);
+  assert.equal(first.calls.filter((c) => c.method === 'POST').length, 1, 'today is not finished, so only yesterday goes');
+  assert.deepEqual(JSON.parse(fs.readFileSync(sentFile, 'utf8')).sent, { '2026-10-14': true });
+  const second = fakeStore();
+  assert.equal(await sender.main([], { log, request: second.call, tallyFile, sentFile, today: '2026-10-15' }), 0);
+  assert.equal(second.calls.length, 0);
+});
+
+test('the server runs the sender as a child process, never in its own process', () => {
+  tally._reset();
+  const ran = [];
+  const timers = tally.startDailySend({ spawnImpl: (s) => ran.push(s) });
+  assert.equal(timers.length, 2, 'a first run soon after boot, then every few hours');
+  tally._reset();
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'module-loader', 'error-tally.js'), 'utf8');
+  assert.doesNotMatch(src, /require\([^)]*cli-lib/, 'the session plumbing never loads in the server');
+});

package/tests/provision.mjs

@@ -637,6 +637,8 @@ t('systemd manager: emits byte-identical commands + unit paths to the inline str
     'sudo rm -f /etc/systemd/system/demo.service [allowFail]',
     'sudo systemctl disable --now demo-db-backup.timer [allowFail]',
     'sudo rm -f /etc/systemd/system/demo-db-backup.service /etc/systemd/system/demo-db-backup.timer [allowFail]',
+    'sudo rm -f /etc/systemd/system.control/demo.service.d/50-*.conf [allowFail]',   // the caps drop-in (task 1004414)
+    'sudo rmdir /etc/systemd/system.control/demo.service.d [allowFail]',
     'sudo systemctl daemon-reload [allowFail]',
     'sudo systemctl reset-failed demo.service demo-db-backup.service [allowFail]',
   ], 'including reset-failed — a removed unit\'s FAILED state outlives its file (task 1003940)');