@bongos/core 1.21.175 → 1.21.177

package/scripts/bongos/run-unit-tests.js

@@ -0,0 +1,654 @@
+#!/usr/bin/env node
+// scripts/bongos/run-unit-tests.js — run the DB-free unit suite as one command,
+// for the #856 PR-check gate (ADR 0042). Auto-merge can't land a functional
+// regression once this is a required check.
+//
+// Runs every tests/*.mjs EXCEPT the documented exclusions below, each in its own
+// `node` process with a timeout, and exits non-zero if ANY fail. New pure tests
+// are picked up automatically (no allowlist to maintain) — only the two
+// exclusion categories need upkeep.
+//
+// Exclusions:
+//   INTEGRATION — need a live Postgres/server/network. They belong in the
+//     integration-smoke gate (a separate task with a Postgres service container),
+//     not this DB-free unit gate. (Classified by a DB/network-marker scan +
+//     verified by running them: they fail standalone.)
+//   KNOWN_FAILING — currently red on main, tracked separately so this gate stays
+//     trustworthy (a gate that's already red gates nothing). See idea #225.
+//
+// Module-owned tests (ADR 0107 / task 1768): a contributed module may ALSO ship
+// its own DB-free tests at modules/<key>/tests/*.mjs. These are discovered by
+// directory the same way the loader discovers modules/*/module.json (no
+// allowlist to maintain here either). main() runs every module's tests whether or
+// not this instance enables it (a default:false module still ships in the repo);
+// discoverModuleTests() keeps the isEnabled gate for callers that inject one.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { isModuleEnabled } = require('../../src/modules');
+
+const TESTS_DIR = path.resolve(__dirname, '..', '..', 'tests');
+const MODULES_DIR = path.resolve(__dirname, '..', '..', 'modules');
+const PER_TEST_TIMEOUT_MS = 90_000;
+// Integration tests (package build + `npm install` + a spawned server) are far heavier than a
+// DB-free unit file, so the `--integration` gate (task 1002221 / audit H1) gives each one a much
+// longer budget than the 90s unit cap.
+const INTEGRATION_TIMEOUT_MS = 300_000;
+// A PARKED test is expected to fail, and a failing test fails fast — it throws or
+// trips an assertion. Handing it the full run-to-completion budget only buys the
+// right to burn five billable CPU-minutes per HUNG entry on every main push, and
+// this set is re-checked on each one. A minute is ample for a verdict that is
+// expected to arrive in seconds; an entry that needs longer than that to fail is
+// itself the finding.
+const PARKED_RECHECK_TIMEOUT_MS = 60_000;
+
+// Shared test scaffolding (task 1096, C12) — exported helpers, not a test file;
+// running it standalone is a no-op. Skip so it doesn't inflate the count.
+const SUPPORT_MODULES = new Set(['helpers']);
+
+// Need a live DB / server / network — run in the integration-smoke gate instead.
+const INTEGRATION = new Set([
+  // task 1004004: the acclaim feed proves a claim about SQL semantics — that a
+  // grader outage nulls rather than scoring 0.0, and that a summed cost over no
+  // rows is NULL rather than a free ship. Only a transaction engine settles
+  // those, so this runs here and the DB-free sibling covers the renderer.
+  'acclaim_feed_evidence_db',
+  // task 1004727: idea votes fold into the SUBMITTER's karma through the one
+  // weekly fold, after the same lag, frozen once tallied. Only a real
+  // transaction engine runs that fold, so it lives here.
+  'idea_votes_fold_db',
+  // task 1002977: proves the changed-totals skip rule (a single INSERT ...
+  // WHERE NOT EXISTS statement) and the upsertActivity wiring against real SQL —
+  // a fake pool can prove the query shape but not which reports it inserts.
+  'activity_snapshots_db',
+  // task 1004268: an older rollup report never overwrites a newer one — a WHERE on
+  // the upsert's conflict branch, whose NULL handling and racing-writer outcome only
+  // a real Postgres settles (the DB-free sibling is activity_rollup_as_of).
+  'activity_rollup_order_db',
+  // task 1002978: the windowed leaderboard against real SQL. Which snapshot
+  // becomes a window baseline (a LATERAL at-or-before probe), a missing baseline
+  // counting as zero, and the privacy matrix filtering are all planner facts the
+  // DB-free route test can only assert the shape of.
+  'community_leaderboard_db',
+  // bfg, bfg_write, memory_isolation, memory_pull and setup_smoke LEFT this set under task
+  // 1004865: none of them ever needed a database. Each failed on a stale test harness (a fake
+  // server without res.fail, a stub on the wrong module, an old error shape, a renamed session
+  // file, a stale API prefix), and the failure was read as "needs Postgres". They gate the
+  // cross-builder memory read and write, memory isolation, the memory restore hook and setup.
+  'asset_version', 'auth_flow_slice1', 'backfill_sessions',
+  'cli_token_reissue',
+  // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live
+  // platform-server (task 2142), then installs the package from its own shipped lockfile,
+  // migrates brand-new EMPTY databases and serves a database-backed route from one (task
+  // 1002863) — network + package build + spawned servers + Postgres. It runs in the
+  // integration job of .github/workflows/integration.yml like the rest of this set; there
+  // never was a dedicated consumer-layout-boot workflow, whatever older notes say.
+  'consumer_layout_boot',
+  'claim_gate_open_blocker', 'claim_gate_rebase',
+  // task 1004585: a hall-made goal's spec task gates its other work — the edge, the
+  // claim gate's unsatisfiedDeps read, and the ship-time auto-promotion, on real Postgres.
+  'goal_spec_task_db',
+  // task 1003457: proves the blocker-resolve auto-promotion trigger (migration
+  // 009, tightened by core_223) fires on the HALL'S OWN write path — the real
+  // buildGdsRouter() HTTP routes, not a static SQL-text pin (blocker_resolve_guard.mjs,
+  // blocker_unlink.mjs) or a pure-predicate unit test (blocker_link.mjs, which never
+  // touches a database). Only a real transaction engine behind a real router proves
+  // that; self-skips without a reachable Postgres.
+  'blocker_hall_live_proof',
+  // task 1002709: core_221's re-keyed backstop index against a real Postgres.
+  // The DB-free sibling pins the guard and the migration's text; this proves the
+  // index actually refuses the commingling INSERT and still allows the parallel
+  // -worktree case. It self-skips without a DB, and refuses any database that
+  // has a `builders` table, since it TRUNCATEs claims.
+  // task 1004677: two marked auto-pickup claims racing for the last slot of the
+  // monthly cap; only real connections prove the advisory lock. Scratch DB only.
+  'autopickup_cap_db',
+  'claims_requested_worktree_db',
+  'clawback_confirmed_backlog',
+  // task 1003113: the copy_desk_flags schema half. The module's own tests are
+  // DB-free and cover the pure layer; the rules that MATTER here live in the
+  // schema — a CHECK-constraint reason floor whose whole argument is that no
+  // future write path evades it, a PARTIAL unique index whose partiality is the
+  // design, and a close guarded on the open status so two closers cannot both
+  // win. None of those are testable without a real transaction engine.
+  // (Prose here avoids single-quoted tokens: the pairing guard below parses this
+  // set out of the source, so a quoted word in a comment reads as an entry.)
+  'copy_desk_flags_db',
+  // task 1004362: core_258 against a real Postgres holding a claim created from a
+  // dev box session. The claims foreign key that failed the live upgrade is a
+  // schema fact only a transaction engine enforces. Always rolled back.
+  'core_258_box_session_claims_db',
+  // task 1004360: core_262 drops the four builders columns migration 104 added, against a real
+  // Postgres, with the foreign key live, then re-runs it. Always rolled back.
+  'core_262_drop_box_blocked_db',
+  'discord_autojoin', 'discord_oauth',
+  // task 1003000 (IC6): the three ideator credit streams against a real Postgres.
+  // The three DB-free sibling suites stub the client and SIMULATE the
+  // INSERT ... WHERE NOT EXISTS, so the whole no-double-pay argument of the lane
+  // is asserted against a fake there; here the statement meets a real transaction
+  // engine and the real credit trigger that moves a balance. Every fixture and
+  // credit row is written inside a transaction that is always rolled back, so it
+  // is safe against a dev database and never TRUNCATEs anything.
+  // (Prose here avoids apostrophes and single-quoted tokens: the review gate
+  // parses this set out of the source, so a quoted word in a comment reads as an
+  // entry — the same reason the copy_desk_flags_db note above is worded that way.)
+  'idea_credit_streams_db',
+  // task 1003634: the session earnings mirror against real SQL. The defect was
+  // never arithmetic — it was which credit_log rows a WHERE clause can reach, so
+  // a stubbed client would answer exactly the assumption under test. Here the
+  // two-key predicate meets a real planner, and the first test asserts the OLD
+  // predicate still returns 0 so the bug itself stays executable. Same
+  // always-rolled-back transaction discipline as the entry above.
+  'session_earnings_mirror_db',
+  // task 1004433: the credits-by-craft split and the per-person earnings
+  // fragment against real SQL. Both are questions about which ledger rows a LIKE
+  // pattern and a LATERAL unnest reach, which a stubbed client cannot answer.
+  // One transaction, always rolled back.
+  'role_stats_db',
+  // RENAMED by ADR 0174 (goal 1000068) — these entries said governance_* until task
+  // 1003091. A curated set keyed by a stem that no longer exists silently stops
+  // covering its file: both of these dropped OUT of the integration set and INTO the
+  // DB-free lane, where they only "passed" because they self-skip. The pairing guard
+  // is in tests/government_live_proof_shape.mjs — every curated entry must name a
+  // real test file.
+  // task 1003094: the board FRANCHISE against real SQL. The DB-free sibling covers
+  // the grammar; this covers what the task actually changed — the ANY() rewrite,
+  // the DISTINCT, and that a deactivated builder or a machine principal still
+  // never governs under the widened predicate.
+  'government_board_membership_db',
+  'government_live_proof',
+  // task 1002806: these three declare "in the INTEGRATION set" in their own headers
+  // and were never in it. Every one boots a real Postgres and self-skips without one,
+  // so in the DB-free lane they ran, skipped, exited 0 and asserted NOTHING — while
+  // the --integration lane never saw them either, because it runs only this set. A
+  // test that cannot fail in either lane is a file that looks like a gate.
+  'handle_machinery', 'hub_profile_leak', 'profile_fields',
+  // task 1004735: the schema ownership handover (provision-repo.js dbOwnershipSql) against a
+  // real engine — one DO block of catalog queries, so only Postgres can say it runs, what it
+  // reaches and that it leaves extension objects alone. Throwaway schema + role, dropped after.
+  'db_ownership_handover',
+  // task 1002300 (R24): guilds against real SQL. The DB-free sibling
+  // (guilds_api) pins the route layer and statement shapes; only a real engine
+  // proves the one-owner partial index, the expiry CTE drained before its insert,
+  // the cascade on dissolve and the two-statement transfer.
+  'guilds_db',
+  // task 1002303 (R27): guild engagements against real SQL — the FK that cascades
+  // a dissolved guild's engagements and the one that SETs NULL on the echo, the
+  // upsert restarting the 30-day window in place, and the joined_at rule. The
+  // DB-free sibling (guild_engagement) pins the routes and statement shapes.
+  'guild_engagement_db',
+  // task 1002302 (R26): a guild's weekly rounded totals against real SQL. Who is
+  // counted (three predicates and a FILTERed k count) and the upsert's week guard,
+  // re-evaluated against a racing writer's committed row, are planner facts; the
+  // DB-free sibling (guild_totals) pins the band scale and statement shapes.
+  'guild_totals_db',
+  // task 1002306 (R30): the guild map against real SQL — the INNER join that drops
+  // an empty public roster, the capped roster count, and NULLS LAST on a guild
+  // with no weekly record yet. guilds_api §3b pins the route and statement shape.
+  'guild_map_db',
+  // task 1003935: 'linkify_refs' was swept in with the three above without the
+  // no-DB check they were being fixed for. It touches no Postgres at all — pure
+  // string work plus a filesystem walk — so the DB-free lane skipped it and the
+  // --integration lane, which runs only this set, never had a reason to. It ran in
+  // NEITHER lane, which is the exact failure the comment above describes, and it
+  // is why one permanently-red Windows case sat unnoticed. It is now in the unit
+  // gate, where it is the only coverage linkifyText has.
+  'needs_rebase', 'parallel-load', 'profile_rollup_consent',
+  // task 1003145: whether the PLANNER uses the migration 225 index for the recall
+  // freshness probe. The DB-free sibling (recall_corpus_health) pins the query
+  // shape and that the migration declares the index; only a real Postgres can
+  // answer whether the probe stops at the first visible row or reads the corpus —
+  // and an unverified claim about exactly that is the comment this task fixed.
+  'recall_freshness_plan_db',
+  'reward_mode_cost_plus_only',
+  // task 1004861: the real-DB halves of session_reward_on_land / session_reward_reconcile,
+  // split out of those (still DB-free, still unit-gated) files. They used to read a
+  // setup failure as SKIP and sat in no database lane, so a fixture collision with
+  // versions_one_planning_idx hid them for months; here a setup failure is a FAIL.
+  'session_reward_on_land_db', 'session_reward_reconcile_db',
+  // task 1002323 (BV1.R04): the project visibility half against real SQL. The DB-free
+  // sibling in the module pins the JS gate and the migration text; only a real engine can
+  // prove the CHECK actually refuses a stored fourth state, that the backfill lands on a
+  // pre-migration row, and that publishableSql and projectPublishability agree.
+  'project_visibility_db',
+  // task 1002969 (ADR 0356): the invite expiry against real SQL — the router's and the
+  // admission reads' statements run on Postgres, and the hub's notice restamp and
+  // listing. The DB-free sibling (application_lifecycle) interprets the same WHEREs.
+  'invite_expiry_db',
+  // task 1004750 (ADR 0382 D6): passkey tables from the real migration — single-use
+  // challenges, TTL sweep, unique credential id, sign-count regression.
+  'passkey_foundation_db',
+  // task 1004408: migration platform_identity_028 deletes the old hub invite's
+  // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
+  // engine runs the DO block, the numeric version compare and the one-shot guard.
+  'pending_invite_purge_db',
+  // task 1003956 (ADR 0294): that CLI sessions really never expire. The DB-free
+  // sibling (auth_session_ttl) pins the constant, createSession's value against a
+  // stub pool, and the TEXT of the refresh statement — but a regex over source
+  // proves the characters are there, not that Postgres does what they mean. Only a
+  // real engine can show the CASE guard leaving a NULL alone on an actual use,
+  // which is exactly where the removed timeout would come back.
+  'auth_session_expiry_db',
+  // task 1003372 (audit A1, core_249): that hashing the bearer at rest does not
+  // sign anybody out. The DB-free sibling (session_token_hash) stands in front of
+  // the pool and proves the plaintext never reaches a query — the negative that
+  // matters — but it cannot show that Postgres accepts the migration, nor that
+  // the digest the backfill computes in SQL equals the one the kernel computes in
+  // Node. That mismatch would leave every new session working and every migrated
+  // one dead, which is the failure a source-reading test walks straight past.
+  'session_token_hash_db',
+  // task 1002002: the no-false-alarm half of the schema-lag detector. The DB-free
+  // sibling (schema_lag) covers the arithmetic against a stub; only a database that
+  // migrate.sh has just run can show the expected stems (core + enabled modules) equal the recorded ones,
+  // so a healthy instance reads zero rather than a permanent SCHEMA BEHIND.
+  'schema_lag_db',
+  // task 1004137: migrate.sh's module set reads the hall's DB overrides — needs the
+  // override table and a database the real migrate.sh can connect to.
+  'migrate_module_overrides_db',
+  'scouting_rollup_fanout', 'session_records',
+  // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
+  // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a
+  // revisit predicate comparing cost_log.recorded_at to the digest upload. The
+  // DB-free siblings (session_records, session_cost) cover the transcript
+  // de-duplication half.
+  'session_cost_row_raise',
+  // task 1003360: the T&C grandfather migration against real SQL. The DB-free
+  // sibling (the T&C acceptance suite) pins the statement text and runs the conflict
+  // branch over a fake table; only a real engine runs the one-shot DO block and
+  // shows a legacy account published again and marked apart from a sign-in.
+  'terms_grandfather_db',
+]);
+
+// Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):
+//   - autotile_variants / autotile_xverify / anti_grid were parked here because they
+//     needed modules/art-pipeline artifacts. Task 1003207 DELETED all three: the
+//     art pipeline left this core with the game, so they targeted a module that no
+//     longer exists and could never have gone green again. A permanently-parked
+//     test is not a gate, it is a file that looks like one.
+//
+// grader_panel was excluded here (2 "failing" assertions, idea #225) until #954
+// (V4.R16) diagnosed them as STALE — they predated #481's Narc-advisory change,
+// NOT a grader regression. Now green and back under this gate so the quality-
+// gate brain can't silently regress.
+// EMPTY, and that is the intended steady state (task 1002617 closed the last entry).
+//
+// This set existed because the unit lane's first-ever runs (task 1002610) surfaced three
+// tests red in every clean environment, and a gate that is already red gates nothing —
+// so they were parked to make `unit` requireable while each was diagnosed. platform_boot
+// and publish_manifest were fixed earlier; served_paths_shipped was the survivor, and its
+// failure turned out to be its own self-guard correctly reporting that the source scan
+// had gone blind when the OpenAPI serve moved to a root ladder (task 1002200).
+//
+// Adding an entry here is a real cost and should be rare: a parked test is invisible
+// coverage, and this one sat parked long enough that its diagnosis had to be redone.
+// PAIRING: tests/known_failing_ratchet.mjs keeps EXECUTING each parked test and fails the
+// suite the moment one starts passing — so this set cannot rot silently.
+const KNOWN_FAILING = new Set([]);
+
+// Task 1003845: on Windows + Node 24 a suite that hard-exits after serving HTTP can
+// print a clean verdict and THEN abort natively (the cliExit class in
+// scripts/bongos/CLAUDE.md), exiting 127 or 0xC0000409 depending on timing. Counted as
+// FAILED, these swap in and out of a Windows baseline, so a new failure can hide
+// behind a vanished one. Recognised by signature plus the suite's own verdict —
+// never by a list of names, which docs/recipes/windows-builders.md shows goes stale
+// in hours. Only the `N passed, M failed` summary counts as a verdict: node:test
+// suites set exitCode rather than hard-exiting, so they do not hit this.
+const LIBUV_TEARDOWN_ABORT = /Assertion failed: !\(handle->flags & UV_HANDLE_CLOSING\)/;
+
+// A suite that reports honest skips ends `N passed, 0 failed, M skipped` (task 1003993), so
+// the optional suffix is part of a clean verdict. Without it, the first suite to start telling
+// the truth about unrun coverage would have its clean verdict read as unrecognised and its
+// Windows teardown abort counted as a real failure — a fix for one honesty bug creating another.
+const CLEAN_VERDICT_RE = /\b[1-9]\d* passed, 0 failed(?:, \d+ skipped)?\s*$/;
+
+// `  SKIP <name>` from a suite's own stdout. Counted here rather than parsed out of the summary
+// line so a suite that prints skips without a summary suffix is still surfaced.
+//
+// Not only the uppercase shape (task 1004865). Suites that skip say so in four ways, and the
+// three this used to miss all read as a clean `ok`: `  skip <case> — why` (infra_exec_paths,
+// workflow_exec_paths, agent_invoke_live), a parenthesised `(skipped — why)` under a case, and
+// `<file>.mjs SKIPPED — why` when a whole file has nothing to run against (page_notes_db,
+// howto_state's db half, every *_db file without Postgres). So: a line that LEADS with the word
+// in any case, optionally inside a parenthesis, or the uppercase SKIPPED followed by its reason
+// dash. Still never a word inside a passing case's name — `  ok  skips identical files` is a pass.
+const SKIP_LINE_RES = [/^\s*\(?skip(?:ped)?\b/i, /\bSKIPPED\s+[—–-]/];
+const isSkipLine = (l) => SKIP_LINE_RES.some((re) => re.test(l));
+
+// node:test suites print no SKIP line at all — they report `ℹ skipped N` in their own summary
+// (task 1004112). Until this, every skip in a node:test suite was INVISIBLE to the roll-up whose
+// entire purpose is to say "a skipped case is not a passing one": the suite printed `ok`, the
+// roll-up counted nothing, and the unrun coverage vanished without a trace.
+//
+// Found while fixing this counter's own subject. Gating four unevaluable cases in
+// tests/skip_is_not_pass.mjs turned four honest FAILURES into four invisible skips — the 1003993
+// defect reappearing one layer up, in the file written to prevent it. A skip that nothing counts
+// is a pass with extra steps.
+const NODE_TEST_SKIP_RE = /^\s*(?:ℹ|#)\s*skipped\s+(\d+)\s*$/m;
+
+function countSkips(stdout) {
+  if (!stdout) return 0;
+  const lines = stdout.split('\n').filter(isSkipLine).length;
+  // The two formats are mutually exclusive in practice (a suite is either the project's own
+  // harness or node:test), but SUM rather than branch: a suite that grew both would otherwise
+  // report whichever we happened to check first, and under-reporting is the failure mode here.
+  const m = stdout.match(NODE_TEST_SKIP_RE);
+  return lines + (m ? Number(m[1]) : 0);
+}
+
+function isCleanTeardownAbort(stdout, stderr) {
+  if (!LIBUV_TEARDOWN_ABORT.test(stderr)) return false;
+  // Line-leading only: a passing case titled "... is FAIL-CLOSED" is not a failure.
+  if (/^\s*FAIL\b/m.test(stdout)) return false;
+  const lastLine = stdout.trim().split('\n').pop();
+  return CLEAN_VERDICT_RE.test(lastLine);
+}
+
+// The failing tests as ONE line, for the `unit-report` commit status the workflow
+// posts (task 1003988): a builder box cannot read check runs without Checks:read,
+// but it can read a status, so this line is how it learns WHICH test failed.
+// GitHub caps a status description at 140 chars; the count leads so a cut list
+// still says how many. Whitespace is folded because the line is written to
+// $GITHUB_OUTPUT, where a newline inside a test name would forge a second key.
+const STATUS_DESCRIPTION_MAX = 140;
+
+function describeFailures(failures) {
+  if (!failures.length) return '';
+  const line = `${failures.length} failed: ${failures.join(', ')}`.replace(/\s+/g, ' ');
+  return line.length <= STATUS_DESCRIPTION_MAX ? line : `${line.slice(0, STATUS_DESCRIPTION_MAX - 1)}…`;
+}
+
+function reportToWorkflow(failures) {
+  if (!process.env.GITHUB_OUTPUT) return;
+  fs.appendFileSync(process.env.GITHUB_OUTPUT, `failures=${describeFailures(failures)}\n`);
+}
+
+// Discover modules/<key>/tests/*.mjs. Pure-ish (reads disk; `isEnabled` is
+// injected so this is unit-testable with zero real modules/ or DB config —
+// mirrors the injected-dependency pattern the module loader itself uses).
+// Returns { included: [{key,name,file}], skippedDisabled: [{key,name}] }.
+// A key that isEnabled() can't resolve (bad/missing manifest — not a real
+// mounted module) is treated as disabled: it isn't mounted, so its tests
+// don't run either.
+function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEnabled } = {}) {
+  const included = [];
+  const skippedDisabled = [];
+  let entries;
+  try { entries = fs.readdirSync(modulesDir, { withFileTypes: true }); }
+  catch (e) { if (e.code === 'ENOENT') return { included, skippedDisabled }; throw e; }
+
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    const key = ent.name;
+    const testsDir = path.join(modulesDir, key, 'tests');
+    let files;
+    try { files = fs.readdirSync(testsDir).filter((f) => f.endsWith('.mjs')); }
+    catch (e) { if (e.code === 'ENOENT') continue; throw e; }
+    if (files.length === 0) continue;
+
+    let enabled;
+    try { enabled = isEnabled(key); } catch { enabled = false; }
+
+    for (const f of files) {
+      const entry = { key, name: f.replace(/\.mjs$/, ''), file: path.join(testsDir, f) };
+      (enabled ? included : skippedDisabled).push(entry);
+    }
+  }
+  included.sort((a, b) => (a.key + a.name).localeCompare(b.key + b.name));
+  return { included, skippedDisabled };
+}
+
+// ── INTEGRATION_PARKED — the integration lane's known-failing set (task 1004034) ──
+//
+// The integration lane (task 1000862) gave these 20 their FIRST EVER run on
+// 2026-09-17 and all 20 failed. None is a regression: nothing had ever executed
+// them, in any lane, so nothing was keeping them honest. Parked by owner decision
+// so the lane can gate the tests that DO pass — a gate that is already red gates
+// nothing, the same argument task 1002617 made for the unit lane.
+//
+// WHY A SEPARATE SET, AND NOT KNOWN_FAILING. KNOWN_FAILING is paired with
+// tests/known_failing_ratchet.mjs, which re-executes each parked test and reds the
+// suite the moment one starts passing. That ratchet runs in the DB-FREE lane: an
+// integration test executed there fails for want of a database, so `still fails`
+// would be trivially true and a genuine fix would go unnoticed. Parking these there
+// would have bought the appearance of tracking and none of it.
+//
+// So the guarantee is kept where it can actually hold: `--integration-parked` runs
+// this set WITH the database and FAILS when one PASSES. Same ratchet semantics, in
+// the only environment that can tell the difference. The integration workflow runs
+// it as a blocking step, so fixing one of these reds the lane until its entry here
+// is removed.
+//
+// Triage per test, and the owner decision, are on task 1004034. The causes are
+// heterogeneous — stale post-de-branding expectations, unseeded fixtures, temp-dir
+// assumptions, a missing core tarball, DB-state collisions — so these come off this
+// list one at a time, not in a batch.
+//
+// acclaim_feed_evidence_db WAS LEFT OUT OF THE FIRST PASS, deliberately and on the
+// evidence then available: it PASSED in CI run 35291948008, and parking a test that
+// passes makes --integration-parked red the lane immediately. Two later readings
+// reversed that — it fails 2/2 alone on a freshly migrated database, and it FAILED in
+// run 35404478232, the first run after the parking landed. The single pass was the
+// anomaly. It fails on `duplicate key value violates unique constraint
+// "versions_one_planning_idx"`: the seeds create a version at status='planning', a
+// partial unique index permits exactly one, and the test adds another — so it leans on
+// the seeded state of `versions` rather than establishing its own, which is also how
+// its verdict moves between runs. (Five siblings that tripped the same constraint left
+// this list under task 1004861; switching this one's fixture to 'building' is not enough —
+// it then fails an assertion on its sliced query, a separate defect.) IF THE PARKED RATCHET EVER REDS NAMING THIS TEST, that is this known
+// oscillation, not a fix: the real repair is to stop it colliding — give it its own
+// version row, or roll back in a transaction the way the other DB-writing entries do.
+//
+// handle_machinery, profile_fields AND project_visibility_db LEFT THIS LIST under task
+// 1004864. All three are platform-identity tests, and that module is default-OFF, so the
+// lane migrated only the slice of its schema the tests apply by hand — which is why
+// handle_machinery once looked fixed after the suite had built state around it and red
+// from a pristine database. integration.yml now switches the module on in both jobs;
+// each of the three passes alone on a freshly migrated database. profile_fields also
+// needed terms_accepted_at stamped: the public read requires both consent columns since
+// ADR 0213. If one of them reds again, check the module flag is still set first.
+//
+// consumer_layout_boot LEFT THIS LIST under task 1002863. Its "missing core tarball" was
+// package-core's fail-closed leak gate reading the lane's throwaway database password (the
+// word postgres, present in hundreds of core files) as a leaked credential and refusing to
+// build. The harness now withholds database settings from the packager, and it is the only
+// test that proves the PUBLISHED package installs, migrates an empty database and serves
+// from it — parking it again re-opens that gap, which tests/integration_parked_ratchet.mjs
+// now says out loud.
+//
+// claim_gate_open_blocker, claim_gate_rebase, clawback_confirmed_backlog, needs_rebase AND
+// reward_mode_cost_plus_only LEFT THIS LIST under task 1004861. Each added a second
+// 'planning' version (versions_one_planning_idx; the seeds hold the one slot) — their
+// fixtures now use 'building'. Under that sat three more stale fixtures the collision had
+// hidden: tasks rows with no discipline (core_247 made it required), a task_blockers row
+// with no blocker_ref, and db.shipTask called without the land assurance task 1002483
+// made mandatory. Each passes alone on a freshly migrated database.
+const INTEGRATION_PARKED = new Set([
+  'acclaim_feed_evidence_db',
+  'copy_desk_flags_db',
+  'government_board_membership_db',
+  'idea_credit_streams_db',
+  'session_earnings_mirror_db',
+]);
+
+function main() {
+  // Two gates from one runner (task 1002221 / audit H1):
+  //   default        — the DB-free UNIT gate: every test file MINUS the integration set (+ known-
+  //                     failing / support / disabled-module). Fast, runs in a clean checkout / per PR.
+  //   --integration  — the standing INTEGRATION-SMOKE gate: ONLY the integration set (package build +
+  //                     `npm install` + live boot etc.). Heavier, longer per-test budget; run per
+  //                     release / on a schedule in an env that provides the services (DB/network). This
+  //                     is what promotes tests/consumer_layout_boot.mjs from "excluded + ad-hoc" to a
+  //                     first-class gate a release step can invoke with one command.
+  const integrationMode = process.argv.includes('--integration');
+
+  // --integration-parked — the ratchet for INTEGRATION_PARKED. Runs ONLY the parked
+  // set and inverts the verdict: a parked test that PASSES fails this run, because an
+  // allowlist that outlives the failures it documents is how a graveyard starts. Needs
+  // the same database the integration lane provides; running it DB-free would report
+  // every entry as still-failing and prove nothing.
+  if (process.argv.includes('--integration-parked')) {
+    const parked = [...INTEGRATION_PARKED].sort();
+    console.log(`run-unit-tests --integration-parked: re-checking ${parked.length} parked test(s)`);
+    const nowPassing = [];
+    for (const name of parked) {
+      const file = path.join(TESTS_DIR, `${name}.mjs`);
+      if (!fs.existsSync(file)) {
+        console.log(`  GONE  ${name} — parked but the file no longer exists; remove its entry`);
+        nowPassing.push(name);
+        continue;
+      }
+      try {
+        execFileSync(process.execPath, [file], {
+          stdio: ['ignore', 'ignore', 'ignore'],
+          timeout: PARKED_RECHECK_TIMEOUT_MS,
+          env: { ...process.env, NODE_ENV: 'test' },
+        });
+        console.log(`  PASSES  ${name} — fixed; remove it from INTEGRATION_PARKED`);
+        nowPassing.push(name);
+      } catch (_) {
+        console.log(`  still red  ${name}`);
+      }
+    }
+    if (nowPassing.length) {
+      console.error(`\nrun-unit-tests --integration-parked: ${nowPassing.length} parked test(s) no longer fail — ${nowPassing.join(', ')}.`);
+      console.error('Remove each from INTEGRATION_PARKED in scripts/bongos/run-unit-tests.js so the lane starts gating it again (task 1004034).');
+      process.exit(1);
+    }
+    console.log('every parked test still fails — the list is current.');
+    process.exit(0);
+  }
+
+  const perTestTimeout = integrationMode ? INTEGRATION_TIMEOUT_MS : PER_TEST_TIMEOUT_MS;
+
+  const files = fs
+    .readdirSync(TESTS_DIR)
+    .filter((f) => f.endsWith('.mjs'))
+    .map((f) => f.replace(/\.mjs$/, ''))
+    .filter((name) => integrationMode
+      ? (INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !INTEGRATION_PARKED.has(name) && !SUPPORT_MODULES.has(name))
+      : (!INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name)))
+    .sort();
+
+  // Module-owned tests are DB-free unit tests — only the default gate runs them.
+  // Run every module's tests, enabled here or not: the code ships in the repo either way, and
+  // a default:false module (provisioning) otherwise goes unexercised and rots unseen.
+  const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = integrationMode
+    ? { included: [], skippedDisabled: [] }
+    : discoverModuleTests({ isEnabled: () => true });
+
+  if (integrationMode) {
+    console.log(`run-unit-tests --integration: ${files.length} integration-smoke test file(s) (${files.join(', ') || 'none found'}); per-test budget ${INTEGRATION_TIMEOUT_MS / 1000}s`);
+  } else {
+    const modOwnedSkipNote = moduleTestsSkipped.length
+      ? ` + ${moduleTestsSkipped.length} module-owned test(s) skipped (module disabled: ${[...new Set(moduleTestsSkipped.map((t) => t.key))].sort().join(', ')})`
+      : '';
+    console.log(`run-unit-tests: ${files.length + moduleTests.length} DB-free unit test file(s) (${files.length} core + ${moduleTests.length} module-owned; excluded ${INTEGRATION.size} integration + ${KNOWN_FAILING.size} known-failing${modOwnedSkipNote})`);
+  }
+  const total = files.length + moduleTests.length;
+
+  const failures = [];
+  const teardownAborts = [];
+  // A GREEN suite that skipped cases is the shape this roll-up used to hide: the suite said so
+  // on its own stdout, which was discarded on success, so the only visible line was `ok` and a
+  // session reading the roll-up could not tell exercised coverage from absent coverage.
+  const skipped = [];
+  const runOne = (displayName, filePath) => {
+    try {
+      const out = execFileSync(process.execPath, [filePath], {
+        // task 1002644: stdout used to be IGNORED, so the failing assertion (test
+        // files print their FAIL lines to stdout) was discarded and the only
+        // context shown was the last 3 STDERR lines — often stale diagnostic
+        // noise from an EARLIER, PASSING test. The live example: gate_approvals'
+        // route-catch console.error dump made every failure in that file read as
+        // a GraphQL/network outage, and the real flaky assertion was invisible.
+        stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: 16 * 1024 * 1024,
+        timeout: perTestTimeout,
+        env: { ...process.env, NODE_ENV: 'test' },
+      });
+      const n = countSkips(out ? out.toString() : '');
+      if (n) skipped.push({ name: displayName, n });
+      console.log(`  ok    ${displayName}${n ? ` (${n} SKIPPED — not run here)` : ''}`);
+    } catch (err) {
+      // `exit null` on its own is unreadable, and it is what a HANG looks like here: the
+      // signal that ended the process is the whole diagnosis, so say it (task 1004052 —
+      // a test that hung for the full budget reported `exit null` and nothing else).
+      const why = err.killed
+        ? `TIMEOUT after ${perTestTimeout / 1000}s${err.signal ? `, ${err.signal}` : ''}`
+        : `exit ${err.status}${err.signal ? ` (${err.signal})` : ''}`;
+      const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
+      if (!err.killed && isCleanTeardownAbort(stdoutText, err.stderr ? err.stderr.toString() : '')) {
+        console.log(`  ok    ${displayName} (clean verdict, then libuv teardown abort, ${why})`);
+        teardownAborts.push(displayName);
+        return;
+      }
+      console.log(`  FAIL  ${displayName} (${why})`);
+      // The actual failures first: the file's own FAIL lines, then its stdout
+      // tail (the last failure's assertion detail + summary), both bounded.
+      // EMPTY STDOUT IS ITSELF THE CLUE, and it used to print as a blank gap. node:test
+      // buffers a file's whole report until the file finishes, so a suite that hangs
+      // mid-run emits NOTHING — which reads as "no detail available" when it actually
+      // means "it never got to the end". Name that, and name how to find the case.
+      if (!stdoutText) {
+        console.log('        (no output at all — node:test buffers a file\'s report until it finishes,');
+        console.log('         so this suite did not reach the end. To find which case: run it on the same');
+        console.log('         platform with each case writing its name to STDERR before it runs; stderr is');
+        console.log('         unbuffered, so the last name with no completion is the one that hung.)');
+      }
+      const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
+      for (const l of failLines) console.log(`      ${l.trim()}`);
+      if (stdoutText) {
+        for (const l of stdoutText.split('\n').slice(-5)) console.log(`      ${l}`);
+      }
+      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
+      if (stderr) console.log(`      stderr: ${stderr}`);
+      failures.push(displayName);
+    }
+  };
+
+  // EXECUTION IS SERIAL, ONE PROCESS PER TEST — and that is load-bearing, not
+  // incidental (task 1001435). runOne uses execFileSync, which blocks, and these
+  // are plain sequential loops: no Promise.all, no worker pool, no concurrency
+  // anywhere in this file. Pinned by tests/unit_runner_serial.mjs.
+  //
+  // Why it is written down. A flaky-`unit` report (this task, from idea #353)
+  // diagnosed "parallel execution racing on shared global state" and asked whether
+  // the runner fans tests out concurrently in one process. It does not, and never
+  // has — so an in-process race is ruled out as a cause by construction, and any
+  // future flake investigation should start somewhere else. The three suites that
+  // report named were audited then:
+  //   - fitness.mjs      — writes only under mkdtempSync(os.tmpdir()); no repo
+  //                        writes, no env mutation. Clean.
+  //   - session_index.mjs — mutates no global state at all. Clean.
+  //   - secret_box.mjs   — DID have a real hole, but not this one: it redirected
+  //                        only HOME, which os.homedir() ignores on Windows, so
+  //                        its sandbox was a no-op there. Fixed under this task.
+  // Collisions between separate processes remain possible through state OUTSIDE
+  // them — the real home directory, generated files in the repo, a second run on
+  // the same machine — which is where to look next, not here.
+  for (const name of files) runOne(name, path.join(TESTS_DIR, `${name}.mjs`));
+  for (const { key, name, file } of moduleTests) runOne(`${key}/${name}`, file);
+
+  const label = integrationMode ? 'run-unit-tests --integration' : 'run-unit-tests';
+  console.log('');
+  if (teardownAborts.length) {
+    console.log(`${label}: ${teardownAborts.length} passed but aborted in libuv teardown (not failures; task 1003845) — ${teardownAborts.join(', ')}`);
+  }
+  if (skipped.length) {
+    const n = skipped.reduce((sum, s) => sum + s.n, 0);
+    console.log(`${label}: ${n} case(s) NOT RUN here (no database, missing host files, or platform) in ${skipped.length} file(s) — ${skipped.map((s) => `${s.name} (${s.n})`).join(', ')}`);
+    console.log(`${label}: a skipped case is not a passing one. Green here does not mean that coverage was exercised.`);
+  }
+  reportToWorkflow(failures);
+  if (failures.length === 0) {
+    console.log(`${label}: all ${total} passed.`);
+    process.exit(0);
+  }
+  console.log(`${label}: ${failures.length} FAILED — ${failures.join(', ')}`);
+  process.exit(1);
+}
+
+if (require.main === module) main();
+
+module.exports = { discoverModuleTests, isCleanTeardownAbort, countSkips, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };