@bongos/core 1.21.131 → 1.21.132

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.131",
-  "core_contract": "1.21.131",
-  "source_commit": "20e5d1edc0b0fcf6174f198a5b4a419dd665a3a7",
+  "core_version": "1.21.132",
+  "core_contract": "1.21.132",
+  "source_commit": "10dc21ed515c04c95e9dba666c809be9ea45a593",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T17:40:46.146Z",
+  "built_at": "2026-10-15T18:14:12.382Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 606,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3781,
-  "tree_sha256": "31c81958624432df97a7d5ddcbbb268280c384ac5411f4c91015de0d01141376",
+  "tree_sha256": "2f366274bb2738a2385ff8682e82cddcda6f1cffea387e43a5a9001755b9ee84",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "fa69c03c8f48c36f148522c0f882c1f075c4d534a53e5cc2d0f97a587f53af44"
+      "sha256": "fcac7f752834fcc7244b69e173b1c9711bb86100e1904e3a59933fa508716c0c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8567,7 +8567,7 @@
     {
       "path": "modules/provisioning/github-setup.js",
       "mode": "0000644",
-      "sha256": "3de4b170e869c21236d5e5c60f4a0774788dc3022a9879c20dab09a50b210f04"
+      "sha256": "ba6b384d7a7a73bd38f0db9f1d93bd02ebd87c60014bfbd7494bf4a9010c5538"
     },
     {
       "path": "modules/provisioning/look.js",
@@ -8802,7 +8802,7 @@
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
       "mode": "0000644",
-      "sha256": "2403b4c3da7a401e65f9d97815d6582e17c28dcb5fdc78fc3956906163acb712"
+      "sha256": "18578b6eafb69daf2991323ecc2aebf668e1209fc500ff30c165aca2b1bfcfd4"
     },
     {
       "path": "modules/provisioning/pollers/runner-drift-notify.js",
@@ -8942,7 +8942,7 @@
     {
       "path": "modules/provisioning/tests/liveness.mjs",
       "mode": "0000644",
-      "sha256": "a0889e57bf8f620f678dbd5d39799ae261e6a813586af9206dd87e453b34edba"
+      "sha256": "f4adaf4dacf05b31f7848c62fafafc3f0498e276b2f4fe4d04f18ee5b27fd969"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -10502,12 +10502,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4456c94ea95ed42f413b1be2d6a1ba71efd942fe4ea5c8c3d2b3fbef5f98abaa"
+      "sha256": "6664906b88a5d77b193eb6c60bcad81603678fd33b14dc6c60d94e56cd7221d0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7287b5976d50f478332c5dabefe23d78403c4c608bafeb8bff5fb15a7850c21d"
+      "sha256": "971b67f78304f94f08f4ca1f66bab6b692362b81b949aa8ed886e51696000d83"
     },
     {
       "path": "public-docs/index.html",
@@ -10527,7 +10527,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "ff392941dfce2d1fe56a33d2169fcb26309c568dd17acb6f8ab63cc685c8ee9c"
+      "sha256": "ba6b8f8a08e0aaf99bb72acb3f28f291bc92232c5f234e4c7ab86ca7c23bcb95"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12882,7 +12882,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9ad423365192371aa8a7035110108ad484fad685dc33386e647cb396b916dcbb"
+      "sha256": "551446e38657afe5ad3430c5b33ee82f052bee8d6da7f4ad24f4ffeef24d57dd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14617,7 +14617,7 @@
     {
       "path": "tests/github_sign_in_seen.mjs",
       "mode": "0000644",
-      "sha256": "7a337ab8268947ad705872d341e1d1d95df70fed342e4ecb1df82ff3ef0044c2"
+      "sha256": "6c17ca54ca78aadfd0032c91f28d642740f2489a8baa94b5958c64be5276a492"
     },
     {
       "path": "tests/github_token_session_life.mjs",

package/docs/module-api-changelog.md

@@ -3099,5 +3099,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.129 with no explicit bump. run 38775541138. (task 1002620)
   1.21.131 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.130 with no explicit bump. run 38779214079. (task 1002620)
+  1.21.132 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.131 with no explicit bump. run 38783817499. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/github-setup.js

@@ -47,8 +47,8 @@ const SETUP_EVENTS = Object.freeze({
   // the founder pressed "Pick up where it stopped" or "Check again" (task 1004652). Like an
   // install report it re-opens the runner's checking window; it claims nothing itself.
   checkRequested: 'github-app-check-requested',
-  // the liveness sweep saw the project's own /healthz answer auth_configured: true (task
-  // 1004410). Recorded once per attempt (recordSignInSeen); no detail.
+  // the liveness sweep saw the project's own /api/bongos/healthz answer auth_configured: true
+  // (task 1004410). Recorded once per attempt (recordSignInSeen); no detail.
   signInSeen: 'github-sign-in-seen',
 });
 

package/modules/provisioning/pollers/liveness-sweep.js

@@ -164,13 +164,20 @@ function probeReason(err) {
   return err.message ? String(err.message).slice(0, 40) : 'error';
 }
 
-// The /healthz answer is tiny; read no more than this of a body a builder's host chose.
+// The health answer is tiny; read no more than this of a body a builder's host chose.
 const BODY_CAP_BYTES = 4096;
 
+// auth_configured lives on the JSON health answer; the root /healthz says a plain "ok" and
+// stays the up/down read, so a core without this route never reads as down (task 1004743).
+const AUTH_HEALTHZ_PATH = '/api/bongos/healthz';
+
+const is2xx = (res) => res.status >= 200 && res.status < 300;
+
 // Did the answer say auth_configured: true (task 1004410)? Reads at most BODY_CAP_BYTES
-// and answers false for anything else — a big, slow or non-JSON body is never "configured".
+// and answers false for anything else — a non-2xx, big, slow or non-JSON body is never "configured".
 async function readAuthConfigured(res) {
   try {
+    if (!is2xx(res)) return false;
     if (!res.body || typeof res.body.getReader !== 'function') {
       return typeof res.json === 'function' ? (await res.json()).auth_configured === true : false;
     }
@@ -192,22 +199,30 @@ async function readAuthConfigured(res) {
 
 // Knock once. Any 2xx = up; everything else (non-2xx, refused, DNS, TLS, timeout)
 // = down with a reason. Never throws — a probe result is the whole point. An up answer
-// also carries whether the project says its sign-in is configured (task 1004410).
+// also carries whether the project says its sign-in is configured (task 1004410), asked
+// on the same origin through the same pin and time budget; that read failing is only "no".
 async function probeHealthz(url, { timeoutMs = PROBE_TIMEOUT_MS, fetchImpl, pin } = {}) {
   const doFetch = fetchImpl || globalThis.fetch;
   const dispatcher = pin && !fetchImpl ? pinnedDispatcher(pin, timeoutMs) : null;
+  const signal = AbortSignal.timeout(timeoutMs);
+  const get = async (target) => doFetch(target, {
+    method: 'GET',
+    // manual: a redirect must never re-aim the probe (SSRF pivot) — and a
+    // healthz that redirects isn't answering anyway.
+    redirect: 'manual',
+    signal,
+    headers: { accept: 'application/json, text/plain;q=0.9, */*;q=0.8' },
+    ...(dispatcher ? { dispatcher } : {}),
+  });
   try {
-    const res = await doFetch(url, {
-      method: 'GET',
-      // manual: a redirect must never re-aim the probe (SSRF pivot) — and a
-      // healthz that redirects isn't answering anyway.
-      redirect: 'manual',
-      signal: AbortSignal.timeout(timeoutMs),
-      headers: { accept: 'application/json, text/plain;q=0.9, */*;q=0.8' },
-      ...(dispatcher ? { dispatcher } : {}),
-    });
-    if (res.status >= 200 && res.status < 300) return { up: true, authConfigured: await readAuthConfigured(res) };
-    return { up: false, reason: `http ${res.status}` };
+    const res = await get(url);
+    if (!is2xx(res)) return { up: false, reason: `http ${res.status}` };
+    if (res.body && typeof res.body.cancel === 'function') res.body.cancel().catch(() => {});
+    // An https answer with no pin reached an address the gate never vetted; ask it nothing more.
+    const askAuth = !!pin || !url.startsWith('https://');
+    const authConfigured = askAuth
+      && await get(new URL(AUTH_HEALTHZ_PATH, url).href).then(readAuthConfigured, () => false);
+    return { up: true, authConfigured };
   } catch (e) {
     return { up: false, reason: probeReason(e) };
   } finally {

package/modules/provisioning/tests/liveness.mjs

@@ -115,7 +115,7 @@ console.log('\nsweepOnce (real loopback probes, recording fake db):');
 
 await ta('an answering instance is UP and a refusing one is DOWN — both columns written, status never touched', async () => {
   const server = http.createServer((req, res) => {
-    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'application/json' }); res.end('{"ok":true}'); return; }
+    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' }); res.end('ok'); return; }
     res.writeHead(404); res.end();
   });
   await listen(server);
@@ -322,15 +322,17 @@ await ta('a rebinding nameserver cannot re-aim the probe — the pinned address
 
 await ta('the pin is load-bearing on the REAL client: same URL, the pinned address decides where it lands', async () => {
   const server = http.createServer((req, res) => {
-    if (req.url === '/healthz') { res.writeHead(200); res.end('{"ok":true}'); return; }
+    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' }); res.end('ok'); return; }
+    if (req.url === '/api/bongos/healthz') { res.writeHead(200, { 'content-type': 'application/json' }); res.end('{"ok":true,"auth_configured":true}'); return; }
     res.writeHead(404); res.end();
   });
   await listen(server);
   const url = `http://pinned.invalid:${server.address().port}/healthz`;
   try {
-    // 'pinned.invalid' resolves nowhere; only the pin can make this connect.
+    // 'pinned.invalid' resolves nowhere; only the pin can make this connect — for the sign-in
+    // read (task 1004743) as much as for the up/down one.
     const hit = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.1', family: 4 } });
-    assert.deepEqual(hit, { up: true, authConfigured: false }, 'the pinned address is what gets connected');
+    assert.deepEqual(hit, { up: true, authConfigured: true }, 'the pinned address is what both reads connect to');
     const miss = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.2', family: 4 } });
     assert.equal(miss.up, false, 'a different pin cannot reach the same server — the pin, not DNS, decides');
   } finally {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.131",
+  "version": "1.21.132",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.131",
+      "version": "1.21.132",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.131",
+  "version": "1.21.132",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9788,5 +9788,11 @@
       "id": "1004577",
       "text": "Two projects whose GitHub sign-in actually worked no longer show it as failed; their setup checklists now point at the real next step."
     }
+  ],
+  "1.21.132": [
+    {
+      "id": "1004743",
+      "text": "A project whose GitHub sign-in already works now gets that step ticked on its setup checklist automatically, within about five minutes."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.131'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.132'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_sign_in_seen.mjs

@@ -5,7 +5,7 @@
 // Sign-in used to tick only from the one-click GitHub attempt reaching 'done', so a project
 // whose sign-in was wired some other way — a hand-made OAuth app, or a GitHub tab that never
 // came back — sat at "Waiting on GitHub" for good. Now the liveness sweep reads the project's
-// /healthz answer, records 'github-sign-in-seen' once per attempt, and githubChecklist reads it.
+// JSON health answer, records 'github-sign-in-seen' once per attempt, and githubChecklist reads it.
 // The page half (what the founder sees) is tests/setup_status_facts.mjs §6.
 //
 // Pinned here, DB-free over recording fakes and real loopback servers:
@@ -14,7 +14,10 @@
 //   * pickUpFor offers nothing to pick up once sign-in works elsewhere;
 //   * githubSetupRead reads the fact even when no attempt exists;
 //   * recordSignInSeen writes at most one row per attempt;
-//   * probeHealthz reports auth_configured only from a small JSON answer saying true;
+//   * probeHealthz reports auth_configured only from a small JSON answer saying true, read
+//     from <API prefix>/healthz — the root /healthz says a plain "ok" (task 1004743), and every
+//     server here answers both paths the way a real project does;
+//   * a sign-in read that fails, hangs or redirects never turns an up project down;
 //   * sweepOnce records the fact only for an up project that says so.
 //
 // Run:  node --test tests/github_sign_in_seen.mjs
@@ -23,6 +26,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
 import path from 'node:path';
+import { readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
@@ -30,6 +34,8 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const gs = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
 const liveness = require(path.join(ROOT, 'modules', 'provisioning', 'pollers', 'liveness-sweep.js'));
+const { API_PREFIX } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
+const AUTH_PATH = `${API_PREFIX}/healthz`;
 
 const SEEN = { signInSeenAt: '2026-10-14T10:00:00.000Z' };
 
@@ -100,13 +106,38 @@ test('recordSignInSeen writes at most one row per attempt, from the liveness swe
 });
 
 // ── the probe and the sweep ────────────────────────────────────────────────────────────
-function serve(body, type = 'application/json') {
-  const server = http.createServer((req, res) => { res.writeHead(200, { 'content-type': type }); res.end(body); });
-  return new Promise((r) => server.listen(0, '127.0.0.1', () => r(server)));
+// A project as it really answers: the ROOT /healthz is a plain-text "ok", and auth_configured
+// lives only on the JSON answer under the API prefix. `api` handles that one path; without it
+// the path 404s, like a core with no such route. A root mocked as JSON is what hid task 1004743.
+function project(api) {
+  const server = http.createServer((req, res) => {
+    if (req.url === '/healthz') { res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' }); res.end('ok'); return; }
+    if (req.url === AUTH_PATH && api) { api(req, res); return; }
+    res.writeHead(404); res.end();
+  });
+  return listen(server);
 }
+function json(body, status = 200) {
+  return (_req, res) => { res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' }); res.end(body); };
+}
+function listen(server) { return new Promise((r) => server.listen(0, '127.0.0.1', () => r(server))); }
 function close(server) { if (server.closeAllConnections) server.closeAllConnections(); server.close(); }
+const rootOf = (s) => `http://127.0.0.1:${s.address().port}/healthz`;
+
+test('the fixture is the real shape: the root /healthz says a plain-text "ok"', () => {
+  const src = readFileSync(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'), 'utf8').replace(/\r\n/g, '\n');
+  assert.match(src, /app\.get\('\/healthz', \(_req, res\) => \{\n\s*res\.type\('text\/plain'\)\.send\('ok'\);/,
+    'if the root ever answers JSON, project() above must change with it');
+});
 
-test('probeHealthz says auth_configured only from a small JSON answer saying true', async () => {
+test('a project whose root is the only answer is up, never configured, and never crashes the probe', async () => {
+  const s = await project(null);
+  try {
+    assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 }), { up: true, authConfigured: false });
+  } finally { close(s); }
+});
+
+test('probeHealthz says auth_configured only from a small JSON answer under the API prefix saying true', async () => {
   const cases = [
     ['{"ok":true,"auth_configured":true}', true],
     ['{"ok":true,"auth_configured":false}', false],
@@ -116,23 +147,80 @@ test('probeHealthz says auth_configured only from a small JSON answer saying tru
     [JSON.stringify({ ok: true, auth_configured: true, pad: 'x'.repeat(8000) }), false],
   ];
   for (const [body, want] of cases) {
-    const s = await serve(body);
+    const s = await project(json(body));
     try {
-      const r = await liveness.probeHealthz(`http://127.0.0.1:${s.address().port}/healthz`, { timeoutMs: 3000 });
-      assert.equal(r.up, true, 'any 2xx is still up');
+      const r = await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 });
+      assert.equal(r.up, true, 'the root answered, so it is up');
       assert.equal(r.authConfigured, want, body.slice(0, 50));
     } finally { close(s); }
   }
 });
 
+test('against the REAL healthz router, the probe reads what the project\'s auth says', async () => {
+  const express = require('express');
+  const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+  const buildHealthzRouter = require(path.join(ROOT, 'src', 'bongos', 'routes', 'healthz.js'));
+  const realAuthConfigured = auth.authConfigured;
+  let configured = true;
+  let s = null;
+  try {
+    auth.authConfigured = () => configured;
+    const app = express();
+    app.get('/healthz', (_req, res) => { res.type('text/plain').send('ok'); });
+    app.use(API_PREFIX, buildHealthzRouter());
+    s = await listen(http.createServer(app));
+    assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 }), { up: true, authConfigured: true });
+    configured = false;
+    assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 3000 }), { up: true, authConfigured: false });
+  } finally { auth.authConfigured = realAuthConfigured; if (s) close(s); }
+});
+
+test('a sign-in read that fails, hangs or redirects never turns an up project down, and is never followed', async () => {
+  const elsewhere = await project(json('{"ok":true,"auth_configured":true}'));
+  const answers = {
+    'a 500': json('{"ok":true,"auth_configured":true}', 500),
+    'a hang': () => {},
+    'a redirect to a yes': (_req, res) => { res.writeHead(302, { location: `http://127.0.0.1:${elsewhere.address().port}${AUTH_PATH}` }); res.end(); },
+  };
+  try {
+    for (const [name, api] of Object.entries(answers)) {
+      const s = await project(api);
+      try {
+        assert.deepEqual(await liveness.probeHealthz(rootOf(s), { timeoutMs: 400 }), { up: true, authConfigured: false }, name);
+      } finally { close(s); }
+    }
+  } finally { close(elsewhere); }
+});
+
+test('the sign-in read rides only a vetted address, and no shape of failure turns it into a down', async () => {
+  const asked = [];
+  const answering = async (url) => {
+    asked.push(String(url));
+    return String(url).endsWith(AUTH_PATH) ? new Response('{"ok":true,"auth_configured":true}', { status: 200 }) : new Response('ok', { status: 200 });
+  };
+  const url = 'https://kestrel.example.com/healthz';
+  assert.deepEqual(await liveness.probeHealthz(url, { fetchImpl: answering, pin: { address: '93.184.216.34', family: 4 } }), { up: true, authConfigured: true });
+  assert.deepEqual(asked, [url, `https://kestrel.example.com${AUTH_PATH}`], 'the same origin, nowhere else');
+  asked.length = 0;
+  assert.deepEqual(await liveness.probeHealthz(url, { fetchImpl: answering }), { up: true, authConfigured: false });
+  assert.deepEqual(asked, [url], 'an https answer the gate never pinned is asked nothing more');
+
+  let calls = 0;
+  const throwsSecond = (u) => { calls += 1; if (calls > 1) throw new TypeError(`no: ${u}`); return Promise.resolve(new Response('ok', { status: 200 })); };
+  assert.deepEqual(await liveness.probeHealthz('http://127.0.0.1:1/healthz', { fetchImpl: throwsSecond }), { up: true, authConfigured: false }, 'a synchronous throw is only "no"');
+  const noStatus = await liveness.probeHealthz('http://127.0.0.1:1/healthz', { fetchImpl: async () => ({}) });
+  assert.equal(noStatus.up, false, 'an answer with no status is not a 2xx');
+});
+
 test('the sweep records the fact for an up project that says so, and for no other', async () => {
-  const yes = await serve('{"ok":true,"auth_configured":true}');
-  const no = await serve('{"ok":true,"auth_configured":false}');
+  const kestrel = await project(json('{"ok":true,"auth_configured":true}'));
+  const tern = await project(json('{"ok":true,"auth_configured":false}'));
+  const wren = await project(null);
   const inserts = [];
   const db = {
     query: async (sql, params) => {
       if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) {
-        return { rows: [{ id: 1, slug: 'kestrel', domain: null, port: yes.address().port }, { id: 2, slug: 'tern', domain: null, port: no.address().port }] };
+        return { rows: [kestrel, tern, wren].map((s, i) => ({ id: i + 1, slug: ['kestrel', 'tern', 'wren'][i], domain: null, port: s.address().port })) };
       }
       if (/^UPDATE provisioning_instances/.test(sql)) return { rows: [{ id: params[0], prev_up: true }] };
       if (/INSERT INTO provisioning_events/.test(sql)) { inserts.push(params); return { rows: [] }; }
@@ -142,7 +230,7 @@ test('the sweep records the fact for an up project that says so, and for no othe
   try {
     liveness.resetNoticeState();
     const out = await liveness.sweepOnce({ pool: db, log: () => {}, timeoutMs: 3000, notify: () => {}, collectRunnerDrift: async () => [] });
-    assert.equal(out.up, 2);
+    assert.equal(out.up, 3, 'what the sign-in read finds never changes up or down');
     assert.deepEqual(inserts, [[1, 'github-sign-in-seen']]);
-  } finally { close(yes); close(no); }
+  } finally { close(kestrel); close(tern); close(wren); }
 });