@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/run-unit-tests.js

@@ -1,660 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/run-unit-tests.js — run the DB-free unit suite as one command,
-// for the #856 PR-check gate (ADR 0042). Auto-merge can't land a functional
-// regression once this is a required check.
-//
-// Runs every tests/*.mjs EXCEPT the documented exclusions below, each in its own
-// `node` process with a timeout, and exits non-zero if ANY fail. New pure tests
-// are picked up automatically (no allowlist to maintain) — only the two
-// exclusion categories need upkeep.
-//
-// Exclusions:
-//   INTEGRATION — need a live Postgres/server/network. They belong in the
-//     integration-smoke gate (a separate task with a Postgres service container),
-//     not this DB-free unit gate. (Classified by a DB/network-marker scan +
-//     verified by running them: they fail standalone.)
-//   KNOWN_FAILING — currently red on main, tracked separately so this gate stays
-//     trustworthy (a gate that's already red gates nothing). See idea #225.
-//
-// Module-owned tests (ADR 0107 / task 1768): a contributed module may ALSO ship
-// its own DB-free tests at modules/<key>/tests/*.mjs. These are discovered by
-// directory the same way the loader discovers modules/*/module.json (no
-// allowlist to maintain here either). main() runs every module's tests whether or
-// not this instance enables it (a default:false module still ships in the repo);
-// discoverModuleTests() keeps the isEnabled gate for callers that inject one.
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-const { isModuleEnabled } = require('../../src/modules');
-
-const TESTS_DIR = path.resolve(__dirname, '..', '..', 'tests');
-const MODULES_DIR = path.resolve(__dirname, '..', '..', 'modules');
-const PER_TEST_TIMEOUT_MS = 90_000;
-// Integration tests (package build + `npm install` + a spawned server) are far heavier than a
-// DB-free unit file, so the `--integration` gate (task 1002221 / audit H1) gives each one a much
-// longer budget than the 90s unit cap.
-const INTEGRATION_TIMEOUT_MS = 300_000;
-// A PARKED test is expected to fail, and a failing test fails fast — it throws or
-// trips an assertion. Handing it the full run-to-completion budget only buys the
-// right to burn five billable CPU-minutes per HUNG entry on every main push, and
-// this set is re-checked on each one. A minute is ample for a verdict that is
-// expected to arrive in seconds; an entry that needs longer than that to fail is
-// itself the finding.
-const PARKED_RECHECK_TIMEOUT_MS = 60_000;
-
-// Feature-module test sets (R59 / task 1198). A test that exercises a feature
-// MODULE runs only when this instance enables that module — a vanilla Cloud
-// Bongos instance carries no game/art code, so those tests are not part of its
-// suite. OTB enables both modules (config/modules.json), so nothing is skipped
-// here in this repo's CI; the gating only takes effect on an instance that turns
-// the module off. Curated like INTEGRATION/KNOWN_FAILING (not auto-derived) so a
-// new test is opted in deliberately.
-const MODULE_TESTS = {
-  game: [
-    'preview_server', 'sandbox_stage', 'walkability', 'snapshot_picker',
-    'terrain_picker', 'local_preview',
-  ],
-  'art-pipeline': [
-    // task 1003207 deleted anti_grid / autotile_variants / autotile_xverify — the
-    // art pipeline is not a module of this core any more, so they targeted a
-    // directory that no longer exists. art_key / art_stage still gate on the
-    // module being enabled, which is what this map is for.
-    'art_key', 'art_stage',
-  ],
-};
-
-// Tests skipped because their feature module is OFF on THIS instance.
-const MODULE_DISABLED = new Set();
-for (const [mod, names] of Object.entries(MODULE_TESTS)) {
-  let on = true;
-  try { on = isModuleEnabled(mod); } catch { on = true; } // resolve failure → don't skip
-  if (!on) for (const n of names) MODULE_DISABLED.add(n);
-}
-
-// Shared test scaffolding (task 1096, C12) — exported helpers, not a test file;
-// running it standalone is a no-op. Skip so it doesn't inflate the count.
-const SUPPORT_MODULES = new Set(['helpers']);
-
-// Need a live DB / server / network — run in the integration-smoke gate instead.
-const INTEGRATION = new Set([
-  // task 1004004: the acclaim feed proves a claim about SQL semantics — that a
-  // grader outage nulls rather than scoring 0.0, and that a summed cost over no
-  // rows is NULL rather than a free ship. Only a transaction engine settles
-  // those, so this runs here and the DB-free sibling covers the renderer.
-  'acclaim_feed_evidence_db',
-  // task 1002977: proves the changed-totals skip rule (a single INSERT ...
-  // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
-  // a fake pool can prove the query shape but not which reports it inserts.
-  'activity_snapshots_db',
-  // task 1004268: an older rollup report never overwrites a newer one — a WHERE on
-  // the upsert's conflict branch, whose NULL handling and racing-writer outcome only
-  // a real Postgres settles (the DB-free sibling is activity_rollup_as_of).
-  'activity_rollup_order_db',
-  // task 1002978: the windowed leaderboard against real SQL. Which snapshot
-  // becomes a window baseline (a LATERAL at-or-before probe), a missing baseline
-  // counting as zero, and the privacy matrix filtering are all planner facts the
-  // DB-free route test can only assert the shape of.
-  'community_leaderboard_db',
-  'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
-  'cli_token_reissue',
-  // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live
-  // platform-server (task 2142), then installs the package from its own shipped lockfile,
-  // migrates brand-new EMPTY databases and serves a database-backed route from one (task
-  // 1002863) — network + package build + spawned servers + Postgres. It runs in the
-  // integration job of .github/workflows/integration.yml like the rest of this set; there
-  // never was a dedicated consumer-layout-boot workflow, whatever older notes say.
-  'consumer_layout_boot',
-  'claim_gate_open_blocker', 'claim_gate_rebase',
-  // task 1004585: a hall-made goal's spec task gates its other work — the edge, the
-  // claim gate's unsatisfiedDeps read, and the ship-time auto-promotion, on real Postgres.
-  'goal_spec_task_db',
-  // task 1003457: proves the blocker-resolve auto-promotion trigger (migration
-  // 009, tightened by core_223) fires on the HALL'S OWN write path — the real
-  // buildGdsRouter() HTTP routes, not a static SQL-text pin (blocker_resolve_guard.mjs,
-  // blocker_unlink.mjs) or a pure-predicate unit test (blocker_link.mjs, which never
-  // touches a database). Only a real transaction engine behind a real router proves
-  // that; self-skips without a reachable Postgres.
-  'blocker_hall_live_proof',
-  // task 1002709: core_221's re-keyed backstop index against a real Postgres.
-  // The DB-free sibling pins the guard and the migration's text; this proves the
-  // index actually refuses the commingling INSERT and still allows the parallel
-  // -worktree case. It self-skips without a DB, and refuses any database that
-  // has a `builders` table, since it TRUNCATEs claims.
-  // task 1004677: two marked auto-pickup claims racing for the last slot of the
-  // monthly cap; only real connections prove the advisory lock. Scratch DB only.
-  'autopickup_cap_db',
-  'claims_requested_worktree_db',
-  'clawback_confirmed_backlog',
-  // task 1003113: the copy_desk_flags schema half. The module's own tests are
-  // DB-free and cover the pure layer; the rules that MATTER here live in the
-  // schema — a CHECK-constraint reason floor whose whole argument is that no
-  // future write path evades it, a PARTIAL unique index whose partiality is the
-  // design, and a close guarded on the open status so two closers cannot both
-  // win. None of those are testable without a real transaction engine.
-  // (Prose here avoids single-quoted tokens: the pairing guard below parses this
-  // set out of the source, so a quoted word in a comment reads as an entry.)
-  'copy_desk_flags_db',
-  // task 1004362: core_258 against a real Postgres holding a claim created from a
-  // dev box session. The claims foreign key that failed the live upgrade is a
-  // schema fact only a transaction engine enforces. Always rolled back.
-  'core_258_box_session_claims_db',
-  // task 1004360: core_262 drops the four builders columns migration 104 added, against a real
-  // Postgres, with the foreign key live, then re-runs it. Always rolled back.
-  'core_262_drop_box_blocked_db',
-  'discord_autojoin', 'discord_oauth',
-  // task 1003000 (IC6): the three ideator credit streams against a real Postgres.
-  // The three DB-free sibling suites stub the client and SIMULATE the
-  // INSERT ... WHERE NOT EXISTS, so the whole no-double-pay argument of the lane
-  // is asserted against a fake there; here the statement meets a real transaction
-  // engine and the real credit trigger that moves a balance. Every fixture and
-  // credit row is written inside a transaction that is always rolled back, so it
-  // is safe against a dev database and never TRUNCATEs anything.
-  // (Prose here avoids apostrophes and single-quoted tokens: the review gate
-  // parses this set out of the source, so a quoted word in a comment reads as an
-  // entry — the same reason the copy_desk_flags_db note above is worded that way.)
-  'idea_credit_streams_db',
-  // task 1003634: the session earnings mirror against real SQL. The defect was
-  // never arithmetic — it was which credit_log rows a WHERE clause can reach, so
-  // a stubbed client would answer exactly the assumption under test. Here the
-  // two-key predicate meets a real planner, and the first test asserts the OLD
-  // predicate still returns 0 so the bug itself stays executable. Same
-  // always-rolled-back transaction discipline as the entry above.
-  'session_earnings_mirror_db',
-  // task 1004433: the credits-by-craft split and the per-person earnings
-  // fragment against real SQL. Both are questions about which ledger rows a LIKE
-  // pattern and a LATERAL unnest reach, which a stubbed client cannot answer.
-  // One transaction, always rolled back.
-  'role_stats_db',
-  // RENAMED by ADR 0174 (goal 1000068) — these entries said governance_* until task
-  // 1003091. A curated set keyed by a stem that no longer exists silently stops
-  // covering its file: both of these dropped OUT of the integration set and INTO the
-  // DB-free lane, where they only "passed" because they self-skip. The pairing guard
-  // is in tests/government_live_proof_shape.mjs — every curated entry must name a
-  // real test file.
-  // task 1003094: the board FRANCHISE against real SQL. The DB-free sibling covers
-  // the grammar; this covers what the task actually changed — the ANY() rewrite,
-  // the DISTINCT, and that a deactivated builder or a machine principal still
-  // never governs under the widened predicate.
-  'government_board_membership_db',
-  'government_fold_bench', 'government_live_proof',
-  // task 1002806: these three declare "in the INTEGRATION set" in their own headers
-  // and were never in it. Every one boots a real Postgres and self-skips without one,
-  // so in the DB-free lane they ran, skipped, exited 0 and asserted NOTHING — while
-  // the --integration lane never saw them either, because it runs only this set. A
-  // test that cannot fail in either lane is a file that looks like a gate.
-  'handle_machinery', 'hub_profile_leak', 'profile_fields',
-  // task 1004735: the schema ownership handover (provision-repo.js dbOwnershipSql) against a
-  // real engine — one DO block of catalog queries, so only Postgres can say it runs, what it
-  // reaches and that it leaves extension objects alone. Throwaway schema + role, dropped after.
-  'db_ownership_handover',
-  // task 1002300 (R24): guilds against real SQL. The DB-free sibling
-  // (guilds_api) pins the route layer and statement shapes; only a real engine
-  // proves the one-owner partial index, the expiry CTE drained before its insert,
-  // the cascade on dissolve and the two-statement transfer.
-  'guilds_db',
-  // task 1002303 (R27): guild engagements against real SQL — the FK that cascades
-  // a dissolved guild's engagements and the one that SETs NULL on the echo, the
-  // upsert restarting the 30-day window in place, and the joined_at rule. The
-  // DB-free sibling (guild_engagement) pins the routes and statement shapes.
-  'guild_engagement_db',
-  // task 1002302 (R26): a guild's weekly rounded totals against real SQL. Who is
-  // counted (three predicates and a FILTERed k count) and the upsert's week guard,
-  // re-evaluated against a racing writer's committed row, are planner facts; the
-  // DB-free sibling (guild_totals) pins the band scale and statement shapes.
-  'guild_totals_db',
-  // task 1002306 (R30): the guild map against real SQL — the INNER join that drops
-  // an empty public roster, the capped roster count, and NULLS LAST on a guild
-  // with no weekly record yet. guilds_api §3b pins the route and statement shape.
-  'guild_map_db',
-  // task 1003935: 'linkify_refs' was swept in with the three above without the
-  // no-DB check they were being fixed for. It touches no Postgres at all — pure
-  // string work plus a filesystem walk — so the DB-free lane skipped it and the
-  // --integration lane, which runs only this set, never had a reason to. It ran in
-  // NEITHER lane, which is the exact failure the comment above describes, and it
-  // is why one permanently-red Windows case sat unnoticed. It is now in the unit
-  // gate, where it is the only coverage linkifyText has.
-  'memory_isolation',
-  'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent',
-  // task 1003145: whether the PLANNER uses the migration 225 index for the recall
-  // freshness probe. The DB-free sibling (recall_corpus_health) pins the query
-  // shape and that the migration declares the index; only a real Postgres can
-  // answer whether the probe stops at the first visible row or reads the corpus —
-  // and an unverified claim about exactly that is the comment this task fixed.
-  'recall_freshness_plan_db',
-  'reward_mode_cost_plus_only',
-  // task 1002323 (BV1.R04): the project visibility half against real SQL. The DB-free
-  // sibling in the module pins the JS gate and the migration text; only a real engine can
-  // prove the CHECK actually refuses a stored fourth state, that the backfill lands on a
-  // pre-migration row, and that publishableSql and projectPublishability agree.
-  'project_visibility_db',
-  // task 1002969 (ADR 0356): the invite expiry against real SQL — the router's and the
-  // admission reads' statements run on Postgres, and the hub's notice restamp and
-  // listing. The DB-free sibling (application_lifecycle) interprets the same WHEREs.
-  'invite_expiry_db',
-  // task 1004750 (ADR 0382 D6): passkey tables from the real migration — single-use
-  // challenges, TTL sweep, unique credential id, sign-count regression.
-  'passkey_foundation_db',
-  // task 1004408: migration platform_identity_028 deletes the old hub invite's
-  // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
-  // engine runs the DO block, the numeric version compare and the one-shot guard.
-  'pending_invite_purge_db',
-  // task 1003956 (ADR 0294): that CLI sessions really never expire. The DB-free
-  // sibling (auth_session_ttl) pins the constant, createSession's value against a
-  // stub pool, and the TEXT of the refresh statement — but a regex over source
-  // proves the characters are there, not that Postgres does what they mean. Only a
-  // real engine can show the CASE guard leaving a NULL alone on an actual use,
-  // which is exactly where the removed timeout would come back.
-  'auth_session_expiry_db',
-  // task 1003372 (audit A1, core_249): that hashing the bearer at rest does not
-  // sign anybody out. The DB-free sibling (session_token_hash) stands in front of
-  // the pool and proves the plaintext never reaches a query — the negative that
-  // matters — but it cannot show that Postgres accepts the migration, nor that
-  // the digest the backfill computes in SQL equals the one the kernel computes in
-  // Node. That mismatch would leave every new session working and every migrated
-  // one dead, which is the failure a source-reading test walks straight past.
-  'session_token_hash_db',
-  // task 1002002: the no-false-alarm half of the schema-lag detector. The DB-free
-  // sibling (schema_lag) covers the arithmetic against a stub; only a database that
-  // migrate.sh has just run can show the expected stems (core + enabled modules) equal the recorded ones,
-  // so a healthy instance reads zero rather than a permanent SCHEMA BEHIND.
-  'schema_lag_db',
-  // task 1004137: migrate.sh's module set reads the hall's DB overrides — needs the
-  // override table and a database the real migrate.sh can connect to.
-  'migrate_module_overrides_db',
-  'scouting_rollup_fanout', 'session_records',
-  // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
-  // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a
-  // revisit predicate comparing cost_log.recorded_at to the digest upload. The
-  // DB-free siblings (session_records, session_cost) cover the transcript
-  // de-duplication half.
-  'session_cost_row_raise',
-  // task 1003360: the T&C grandfather migration against real SQL. The DB-free
-  // sibling (the T&C acceptance suite) pins the statement text and runs the conflict
-  // branch over a fake table; only a real engine runs the one-shot DO block and
-  // shows a legacy account published again and marked apart from a sign-in.
-  'terms_grandfather_db',
-  'setup_smoke',
-  'status-probe',
-]);
-
-// Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):
-//   - autotile_variants / autotile_xverify / anti_grid were parked here because they
-//     needed modules/art-pipeline artifacts. Task 1003207 DELETED all three: the
-//     art pipeline left this core with the game, so they targeted a module that no
-//     longer exists and could never have gone green again. A permanently-parked
-//     test is not a gate, it is a file that looks like one.
-//
-// grader_panel was excluded here (2 "failing" assertions, idea #225) until #954
-// (V4.R16) diagnosed them as STALE — they predated #481's Narc-advisory change,
-// NOT a grader regression. Now green and back under this gate so the quality-
-// gate brain can't silently regress.
-// EMPTY, and that is the intended steady state (task 1002617 closed the last entry).
-//
-// This set existed because the unit lane's first-ever runs (task 1002610) surfaced three
-// tests red in every clean environment, and a gate that is already red gates nothing —
-// so they were parked to make `unit` requireable while each was diagnosed. platform_boot
-// and publish_manifest were fixed earlier; served_paths_shipped was the survivor, and its
-// failure turned out to be its own self-guard correctly reporting that the source scan
-// had gone blind when the OpenAPI serve moved to a root ladder (task 1002200).
-//
-// Adding an entry here is a real cost and should be rare: a parked test is invisible
-// coverage, and this one sat parked long enough that its diagnosis had to be redone.
-// PAIRING: tests/known_failing_ratchet.mjs keeps EXECUTING each parked test and fails the
-// suite the moment one starts passing — so this set cannot rot silently.
-const KNOWN_FAILING = new Set([]);
-
-// Task 1003845: on Windows + Node 24 a suite that hard-exits after serving HTTP can
-// print a clean verdict and THEN abort natively (the cliExit class in
-// scripts/gds/CLAUDE.md), exiting 127 or 0xC0000409 depending on timing. Counted as
-// FAILED, these swap in and out of a Windows baseline, so a new failure can hide
-// behind a vanished one. Recognised by signature plus the suite's own verdict —
-// never by a list of names, which docs/recipes/windows-builders.md shows goes stale
-// in hours. Only the `N passed, M failed` summary counts as a verdict: node:test
-// suites set exitCode rather than hard-exiting, so they do not hit this.
-const LIBUV_TEARDOWN_ABORT = /Assertion failed: !\(handle->flags & UV_HANDLE_CLOSING\)/;
-
-// A suite that reports honest skips ends `N passed, 0 failed, M skipped` (task 1003993), so
-// the optional suffix is part of a clean verdict. Without it, the first suite to start telling
-// the truth about unrun coverage would have its clean verdict read as unrecognised and its
-// Windows teardown abort counted as a real failure — a fix for one honesty bug creating another.
-const CLEAN_VERDICT_RE = /\b[1-9]\d* passed, 0 failed(?:, \d+ skipped)?\s*$/;
-
-// `  SKIP <name>` from a suite's own stdout. Counted here rather than parsed out of the summary
-// line so a suite that prints skips without a summary suffix is still surfaced.
-const SKIP_LINE_RE = /^\s*SKIP\b/;
-
-// node:test suites print no SKIP line at all — they report `ℹ skipped N` in their own summary
-// (task 1004112). Until this, every skip in a node:test suite was INVISIBLE to the roll-up whose
-// entire purpose is to say "a skipped case is not a passing one": the suite printed `ok`, the
-// roll-up counted nothing, and the unrun coverage vanished without a trace.
-//
-// Found while fixing this counter's own subject. Gating four unevaluable cases in
-// tests/skip_is_not_pass.mjs turned four honest FAILURES into four invisible skips — the 1003993
-// defect reappearing one layer up, in the file written to prevent it. A skip that nothing counts
-// is a pass with extra steps.
-const NODE_TEST_SKIP_RE = /^\s*(?:ℹ|#)\s*skipped\s+(\d+)\s*$/m;
-
-function countSkips(stdout) {
-  if (!stdout) return 0;
-  const lines = stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
-  // The two formats are mutually exclusive in practice (a suite is either the project's own
-  // harness or node:test), but SUM rather than branch: a suite that grew both would otherwise
-  // report whichever we happened to check first, and under-reporting is the failure mode here.
-  const m = stdout.match(NODE_TEST_SKIP_RE);
-  return lines + (m ? Number(m[1]) : 0);
-}
-
-function isCleanTeardownAbort(stdout, stderr) {
-  if (!LIBUV_TEARDOWN_ABORT.test(stderr)) return false;
-  // Line-leading only: a passing case titled "... is FAIL-CLOSED" is not a failure.
-  if (/^\s*FAIL\b/m.test(stdout)) return false;
-  const lastLine = stdout.trim().split('\n').pop();
-  return CLEAN_VERDICT_RE.test(lastLine);
-}
-
-// The failing tests as ONE line, for the `unit-report` commit status the workflow
-// posts (task 1003988): a builder box cannot read check runs without Checks:read,
-// but it can read a status, so this line is how it learns WHICH test failed.
-// GitHub caps a status description at 140 chars; the count leads so a cut list
-// still says how many. Whitespace is folded because the line is written to
-// $GITHUB_OUTPUT, where a newline inside a test name would forge a second key.
-const STATUS_DESCRIPTION_MAX = 140;
-
-function describeFailures(failures) {
-  if (!failures.length) return '';
-  const line = `${failures.length} failed: ${failures.join(', ')}`.replace(/\s+/g, ' ');
-  return line.length <= STATUS_DESCRIPTION_MAX ? line : `${line.slice(0, STATUS_DESCRIPTION_MAX - 1)}…`;
-}
-
-function reportToWorkflow(failures) {
-  if (!process.env.GITHUB_OUTPUT) return;
-  fs.appendFileSync(process.env.GITHUB_OUTPUT, `failures=${describeFailures(failures)}\n`);
-}
-
-// Discover modules/<key>/tests/*.mjs. Pure-ish (reads disk; `isEnabled` is
-// injected so this is unit-testable with zero real modules/ or DB config —
-// mirrors the injected-dependency pattern the module loader itself uses).
-// Returns { included: [{key,name,file}], skippedDisabled: [{key,name}] }.
-// A key that isEnabled() can't resolve (bad/missing manifest — not a real
-// mounted module) is treated as disabled: it isn't mounted, so its tests
-// don't run either.
-function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEnabled } = {}) {
-  const included = [];
-  const skippedDisabled = [];
-  let entries;
-  try { entries = fs.readdirSync(modulesDir, { withFileTypes: true }); }
-  catch (e) { if (e.code === 'ENOENT') return { included, skippedDisabled }; throw e; }
-
-  for (const ent of entries) {
-    if (!ent.isDirectory()) continue;
-    const key = ent.name;
-    const testsDir = path.join(modulesDir, key, 'tests');
-    let files;
-    try { files = fs.readdirSync(testsDir).filter((f) => f.endsWith('.mjs')); }
-    catch (e) { if (e.code === 'ENOENT') continue; throw e; }
-    if (files.length === 0) continue;
-
-    let enabled;
-    try { enabled = isEnabled(key); } catch { enabled = false; }
-
-    for (const f of files) {
-      const entry = { key, name: f.replace(/\.mjs$/, ''), file: path.join(testsDir, f) };
-      (enabled ? included : skippedDisabled).push(entry);
-    }
-  }
-  included.sort((a, b) => (a.key + a.name).localeCompare(b.key + b.name));
-  return { included, skippedDisabled };
-}
-
-// ── INTEGRATION_PARKED — the integration lane's known-failing set (task 1004034) ──
-//
-// The integration lane (task 1000862) gave these 20 their FIRST EVER run on
-// 2026-09-17 and all 20 failed. None is a regression: nothing had ever executed
-// them, in any lane, so nothing was keeping them honest. Parked by owner decision
-// so the lane can gate the tests that DO pass — a gate that is already red gates
-// nothing, the same argument task 1002617 made for the unit lane.
-//
-// WHY A SEPARATE SET, AND NOT KNOWN_FAILING. KNOWN_FAILING is paired with
-// tests/known_failing_ratchet.mjs, which re-executes each parked test and reds the
-// suite the moment one starts passing. That ratchet runs in the DB-FREE lane: an
-// integration test executed there fails for want of a database, so `still fails`
-// would be trivially true and a genuine fix would go unnoticed. Parking these there
-// would have bought the appearance of tracking and none of it.
-//
-// So the guarantee is kept where it can actually hold: `--integration-parked` runs
-// this set WITH the database and FAILS when one PASSES. Same ratchet semantics, in
-// the only environment that can tell the difference. The integration workflow runs
-// it as a blocking step, so fixing one of these reds the lane until its entry here
-// is removed.
-//
-// Triage per test, and the owner decision, are on task 1004034. The causes are
-// heterogeneous — stale post-de-branding expectations, unseeded fixtures, temp-dir
-// assumptions, a missing core tarball, DB-state collisions — so these come off this
-// list one at a time, not in a batch.
-//
-// acclaim_feed_evidence_db WAS LEFT OUT OF THE FIRST PASS, deliberately and on the
-// evidence then available: it PASSED in CI run 35291948008, and parking a test that
-// passes makes --integration-parked red the lane immediately. Two later readings
-// reversed that — it fails 2/2 alone on a freshly migrated database, and it FAILED in
-// run 35404478232, the first run after the parking landed. The single pass was the
-// anomaly. It fails on `duplicate key value violates unique constraint
-// "versions_one_planning_idx"`: the seeds create a version at status='planning', a
-// partial unique index permits exactly one, and the test adds another — so it leans on
-// the seeded state of `versions` rather than establishing its own, which is also how
-// its verdict moves between runs. needs_rebase trips the same constraint and is
-// already here. IF THE PARKED RATCHET EVER REDS NAMING THIS TEST, that is this known
-// oscillation, not a fix: the real repair is to stop it colliding — give it its own
-// version row, or roll back in a transaction the way the other DB-writing entries do.
-//
-// handle_machinery IS THE SAME DEFECT SEEN FROM THE OTHER SIDE, and it is why the
-// ratchet moved to its own job with its own database (task 1004043). It PASSES once
-// the suite has run and FAILS from a pristine one — verified by migrating an empty
-// database and running it alone. So it is correctly parked: it fails from exactly the
-// state the gate starts in. Do NOT unpark it on the strength of a green post-suite
-// reading; that reading answers a different question. Like acclaim_feed_evidence_db
-// above, the real repair is for the test to establish the state it needs instead of
-// inheriting whatever ran before it.
-//
-// consumer_layout_boot LEFT THIS LIST under task 1002863. Its "missing core tarball" was
-// package-core's fail-closed leak gate reading the lane's throwaway database password (the
-// word postgres, present in hundreds of core files) as a leaked credential and refusing to
-// build. The harness now withholds database settings from the packager, and it is the only
-// test that proves the PUBLISHED package installs, migrates an empty database and serves
-// from it — parking it again re-opens that gap, which tests/integration_parked_ratchet.mjs
-// now says out loud.
-const INTEGRATION_PARKED = new Set([
-  'acclaim_feed_evidence_db',
-  'bfg', 'bfg_write',
-  'claim_gate_open_blocker', 'claim_gate_rebase',
-  'clawback_confirmed_backlog', 'copy_desk_flags_db',
-  'government_board_membership_db', 'handle_machinery',
-  'idea_credit_streams_db', 'memory_isolation', 'memory_pull', 'needs_rebase',
-  'profile_fields', 'project_visibility_db', 'reward_mode_cost_plus_only',
-  'session_earnings_mirror_db', 'setup_smoke', 'status-probe',
-]);
-
-function main() {
-  // Two gates from one runner (task 1002221 / audit H1):
-  //   default        — the DB-free UNIT gate: every test file MINUS the integration set (+ known-
-  //                     failing / support / disabled-module). Fast, runs in a clean checkout / per PR.
-  //   --integration  — the standing INTEGRATION-SMOKE gate: ONLY the integration set (package build +
-  //                     `npm install` + live boot etc.). Heavier, longer per-test budget; run per
-  //                     release / on a schedule in an env that provides the services (DB/network). This
-  //                     is what promotes tests/consumer_layout_boot.mjs from "excluded + ad-hoc" to a
-  //                     first-class gate a release step can invoke with one command.
-  const integrationMode = process.argv.includes('--integration');
-
-  // --integration-parked — the ratchet for INTEGRATION_PARKED. Runs ONLY the parked
-  // set and inverts the verdict: a parked test that PASSES fails this run, because an
-  // allowlist that outlives the failures it documents is how a graveyard starts. Needs
-  // the same database the integration lane provides; running it DB-free would report
-  // every entry as still-failing and prove nothing.
-  if (process.argv.includes('--integration-parked')) {
-    const parked = [...INTEGRATION_PARKED].sort();
-    console.log(`run-unit-tests --integration-parked: re-checking ${parked.length} parked test(s)`);
-    const nowPassing = [];
-    for (const name of parked) {
-      const file = path.join(TESTS_DIR, `${name}.mjs`);
-      if (!fs.existsSync(file)) {
-        console.log(`  GONE  ${name} — parked but the file no longer exists; remove its entry`);
-        nowPassing.push(name);
-        continue;
-      }
-      try {
-        execFileSync(process.execPath, [file], {
-          stdio: ['ignore', 'ignore', 'ignore'],
-          timeout: PARKED_RECHECK_TIMEOUT_MS,
-          env: { ...process.env, NODE_ENV: 'test' },
-        });
-        console.log(`  PASSES  ${name} — fixed; remove it from INTEGRATION_PARKED`);
-        nowPassing.push(name);
-      } catch (_) {
-        console.log(`  still red  ${name}`);
-      }
-    }
-    if (nowPassing.length) {
-      console.error(`\nrun-unit-tests --integration-parked: ${nowPassing.length} parked test(s) no longer fail — ${nowPassing.join(', ')}.`);
-      console.error('Remove each from INTEGRATION_PARKED in scripts/gds/run-unit-tests.js so the lane starts gating it again (task 1004034).');
-      process.exit(1);
-    }
-    console.log('every parked test still fails — the list is current.');
-    process.exit(0);
-  }
-
-  const perTestTimeout = integrationMode ? INTEGRATION_TIMEOUT_MS : PER_TEST_TIMEOUT_MS;
-
-  const files = fs
-    .readdirSync(TESTS_DIR)
-    .filter((f) => f.endsWith('.mjs'))
-    .map((f) => f.replace(/\.mjs$/, ''))
-    .filter((name) => integrationMode
-      ? (INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !INTEGRATION_PARKED.has(name) && !SUPPORT_MODULES.has(name))
-      : (!INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name) && !MODULE_DISABLED.has(name)))
-    .sort();
-
-  // Module-owned tests are DB-free unit tests — only the default gate runs them.
-  // Run every module's tests, enabled here or not: the code ships in the repo either way, and
-  // a default:false module (provisioning) otherwise goes unexercised and rots unseen.
-  const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = integrationMode
-    ? { included: [], skippedDisabled: [] }
-    : discoverModuleTests({ isEnabled: () => true });
-
-  if (integrationMode) {
-    console.log(`run-unit-tests --integration: ${files.length} integration-smoke test file(s) (${files.join(', ') || 'none found'}); per-test budget ${INTEGRATION_TIMEOUT_MS / 1000}s`);
-  } else {
-    const moduleNote = MODULE_DISABLED.size
-      ? ` + ${MODULE_DISABLED.size} disabled-module (${[...MODULE_DISABLED].sort().join(', ')})`
-      : '';
-    const modOwnedSkipNote = moduleTestsSkipped.length
-      ? ` + ${moduleTestsSkipped.length} module-owned test(s) skipped (module disabled: ${[...new Set(moduleTestsSkipped.map((t) => t.key))].sort().join(', ')})`
-      : '';
-    console.log(`run-unit-tests: ${files.length + moduleTests.length} DB-free unit test file(s) (${files.length} core + ${moduleTests.length} module-owned; excluded ${INTEGRATION.size} integration + ${KNOWN_FAILING.size} known-failing${moduleNote}${modOwnedSkipNote})`);
-  }
-  const total = files.length + moduleTests.length;
-
-  const failures = [];
-  const teardownAborts = [];
-  // A GREEN suite that skipped cases is the shape this roll-up used to hide: the suite said so
-  // on its own stdout, which was discarded on success, so the only visible line was `ok` and a
-  // session reading the roll-up could not tell exercised coverage from absent coverage.
-  const skipped = [];
-  const runOne = (displayName, filePath) => {
-    try {
-      const out = execFileSync(process.execPath, [filePath], {
-        // task 1002644: stdout used to be IGNORED, so the failing assertion (test
-        // files print their FAIL lines to stdout) was discarded and the only
-        // context shown was the last 3 STDERR lines — often stale diagnostic
-        // noise from an EARLIER, PASSING test. The live example: gate_approvals'
-        // route-catch console.error dump made every failure in that file read as
-        // a GraphQL/network outage, and the real flaky assertion was invisible.
-        stdio: ['ignore', 'pipe', 'pipe'],
-        maxBuffer: 16 * 1024 * 1024,
-        timeout: perTestTimeout,
-        env: { ...process.env, NODE_ENV: 'test' },
-      });
-      const n = countSkips(out ? out.toString() : '');
-      if (n) skipped.push({ name: displayName, n });
-      console.log(`  ok    ${displayName}${n ? ` (${n} SKIPPED — not run on this platform)` : ''}`);
-    } catch (err) {
-      // `exit null` on its own is unreadable, and it is what a HANG looks like here: the
-      // signal that ended the process is the whole diagnosis, so say it (task 1004052 —
-      // a test that hung for the full budget reported `exit null` and nothing else).
-      const why = err.killed
-        ? `TIMEOUT after ${perTestTimeout / 1000}s${err.signal ? `, ${err.signal}` : ''}`
-        : `exit ${err.status}${err.signal ? ` (${err.signal})` : ''}`;
-      const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
-      if (!err.killed && isCleanTeardownAbort(stdoutText, err.stderr ? err.stderr.toString() : '')) {
-        console.log(`  ok    ${displayName} (clean verdict, then libuv teardown abort, ${why})`);
-        teardownAborts.push(displayName);
-        return;
-      }
-      console.log(`  FAIL  ${displayName} (${why})`);
-      // The actual failures first: the file's own FAIL lines, then its stdout
-      // tail (the last failure's assertion detail + summary), both bounded.
-      // EMPTY STDOUT IS ITSELF THE CLUE, and it used to print as a blank gap. node:test
-      // buffers a file's whole report until the file finishes, so a suite that hangs
-      // mid-run emits NOTHING — which reads as "no detail available" when it actually
-      // means "it never got to the end". Name that, and name how to find the case.
-      if (!stdoutText) {
-        console.log('        (no output at all — node:test buffers a file\'s report until it finishes,');
-        console.log('         so this suite did not reach the end. To find which case: run it on the same');
-        console.log('         platform with each case writing its name to STDERR before it runs; stderr is');
-        console.log('         unbuffered, so the last name with no completion is the one that hung.)');
-      }
-      const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
-      for (const l of failLines) console.log(`      ${l.trim()}`);
-      if (stdoutText) {
-        for (const l of stdoutText.split('\n').slice(-5)) console.log(`      ${l}`);
-      }
-      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
-      if (stderr) console.log(`      stderr: ${stderr}`);
-      failures.push(displayName);
-    }
-  };
-
-  // EXECUTION IS SERIAL, ONE PROCESS PER TEST — and that is load-bearing, not
-  // incidental (task 1001435). runOne uses execFileSync, which blocks, and these
-  // are plain sequential loops: no Promise.all, no worker pool, no concurrency
-  // anywhere in this file. Pinned by tests/unit_runner_serial.mjs.
-  //
-  // Why it is written down. A flaky-`unit` report (this task, from idea #353)
-  // diagnosed "parallel execution racing on shared global state" and asked whether
-  // the runner fans tests out concurrently in one process. It does not, and never
-  // has — so an in-process race is ruled out as a cause by construction, and any
-  // future flake investigation should start somewhere else. The three suites that
-  // report named were audited then:
-  //   - fitness.mjs      — writes only under mkdtempSync(os.tmpdir()); no repo
-  //                        writes, no env mutation. Clean.
-  //   - session_index.mjs — mutates no global state at all. Clean.
-  //   - secret_box.mjs   — DID have a real hole, but not this one: it redirected
-  //                        only HOME, which os.homedir() ignores on Windows, so
-  //                        its sandbox was a no-op there. Fixed under this task.
-  // Collisions between separate processes remain possible through state OUTSIDE
-  // them — the real home directory, generated files in the repo, a second run on
-  // the same machine — which is where to look next, not here.
-  for (const name of files) runOne(name, path.join(TESTS_DIR, `${name}.mjs`));
-  for (const { key, name, file } of moduleTests) runOne(`${key}/${name}`, file);
-
-  const label = integrationMode ? 'run-unit-tests --integration' : 'run-unit-tests';
-  console.log('');
-  if (teardownAborts.length) {
-    console.log(`${label}: ${teardownAborts.length} passed but aborted in libuv teardown (not failures; task 1003845) — ${teardownAborts.join(', ')}`);
-  }
-  if (skipped.length) {
-    const n = skipped.reduce((sum, s) => sum + s.n, 0);
-    console.log(`${label}: ${n} case(s) NOT RUN on this platform — ${skipped.map((s) => `${s.name} (${s.n})`).join(', ')}`);
-    console.log(`${label}: a skipped case is not a passing one. Green here does not mean that coverage was exercised.`);
-  }
-  reportToWorkflow(failures);
-  if (failures.length === 0) {
-    console.log(`${label}: all ${total} passed.`);
-    process.exit(0);
-  }
-  console.log(`${label}: ${failures.length} FAILED — ${failures.join(', ')}`);
-  process.exit(1);
-}
-
-if (require.main === module) main();
-
-module.exports = { discoverModuleTests, isCleanTeardownAbort, countSkips, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };
+// scripts/gds/run-unit-tests.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/run-unit-tests.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'run-unit-tests.js');