@bongos/core 1.21.175 → 1.21.177

package/tests/leak_scan_fail_closed.mjs

@@ -17,7 +17,7 @@ import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { scanArtifactForLeaks, leakScanVerdict, PRIOR_INSTANCE_FLOOR } = require('../scripts/gds/package-core.js');
+const { scanArtifactForLeaks, leakScanVerdict, PRIOR_INSTANCE_FLOOR } = require('../scripts/bongos/package-core.js');
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 

package/tests/lib_sh_resolution.mjs

@@ -1,7 +1,7 @@
 // tests/lib_sh_resolution.mjs — the bash smokes resolve their token + API base
 // from instance-config, never from a baked-in literal (task 1002567).
 //
-// THE BUG. scripts/gds/lib.sh — sourced by every bash smoke — resolved the CLI
+// THE BUG. scripts/bongos/lib.sh — sourced by every bash smoke — resolved the CLI
 // session token from a hardcoded `${HOME}/.config/otb/` and defaulted the API
 // base to a hardcoded founder host. On any instance whose configDir is not
 // `otb` (this one's is `cloudbongos`) every sourcing script died looking for a
@@ -32,7 +32,7 @@ import { fitnessSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GDS = path.join(ROOT, 'scripts', 'gds');
+const GDS = path.join(ROOT, 'scripts', 'bongos');
 const fitness = require(path.join(GDS, 'fitness.js'));
 
 // Every bash script that resolves a GDS token or API base.
@@ -92,23 +92,23 @@ test('lib.sh resolves both values through node, not python3', () => {
 // ---- 2. the scripts still parse, and the helpers behave --------------------
 
 test('every smoke script passes bash -n', (t) => {
-  const probe = bash(['-n', 'scripts/gds/lib.sh']);
+  const probe = bash(['-n', 'scripts/bongos/lib.sh']);
   if (!probe) return t.skip('bash not available on this machine');
   for (const f of SMOKES) {
-    const r = bash(['-n', `scripts/gds/${f}`]);
-    assert.equal(r.status, 0, `bash -n scripts/gds/${f} failed:\n${r.stderr}`);
+    const r = bash(['-n', `scripts/bongos/${f}`]);
+    assert.equal(r.status, 0, `bash -n scripts/bongos/${f} failed:\n${r.stderr}`);
   }
 });
 
 test('gds_api_base honors the GDS_API_BASE override', (t) => {
-  const r = bash(['-c', 'source scripts/gds/lib.sh; GDS_API_BASE=http://127.0.0.1:9 gds_api_base']);
+  const r = bash(['-c', 'source scripts/bongos/lib.sh; GDS_API_BASE=http://127.0.0.1:9 gds_api_base']);
   if (!r) return t.skip('bash not available on this machine');
   assert.equal(r.status, 0, r.stderr);
   assert.equal(r.stdout, 'http://127.0.0.1:9');
 });
 
 test('gds_api_base falls back to the instance, never a foreign host', (t) => {
-  const r = bash(['-c', 'source scripts/gds/lib.sh; gds_api_base']);
+  const r = bash(['-c', 'source scripts/bongos/lib.sh; gds_api_base']);
   if (!r) return t.skip('bash not available on this machine');
   assert.equal(r.status, 0, r.stderr);
   assert.match(r.stdout, /^https?:\/\/\S+$/, `expected a resolved origin, got "${r.stdout}"`);
@@ -135,7 +135,7 @@ test('a re-hardcoded host in a .sh is caught, and a rationale comment is not', (
     '# rationale: this used to point at https://amazonprimea.com',
     'BASE="${GDS_API_BASE:-https://amazonprimea.com}"',
   ].join('\n');
-  const found = fitness.scanPromptIdentity('scripts/gds/fake.sh', sh, '.sh');
+  const found = fitness.scanPromptIdentity('scripts/bongos/fake.sh', sh, '.sh');
   assert.equal(found.length, 1, `expected exactly the code line to trip: ${JSON.stringify(found)}`);
   assert.match(found[0], /fake\.sh:3/);
 });
@@ -144,7 +144,7 @@ test('the .sh comment strip cannot swallow a literal after an inline #', () => {
   // Cutting from ANY `#` would truncate `${v#p}` / `$#` lines and hide what
   // follows them. Only full-line comments are stripped.
   const sh = 'N=${VAR#prefix}; curl https://amazonprimea.com/healthz\n';
-  assert.equal(fitness.scanPromptIdentity('scripts/gds/fake.sh', sh, '.sh').length, 1);
+  assert.equal(fitness.scanPromptIdentity('scripts/bongos/fake.sh', sh, '.sh').length, 1);
   assert.match(fitness.stripCommentsForIdentity('  # only a comment\ncode\n', '.sh'), /^\ncode/);
 });
 

package/tests/lifecycle-card.mjs

@@ -54,7 +54,7 @@ function runHook(payload) {
 function shipPayload(toolName, cardPath) {
   return {
     tool_name: toolName,
-    tool_input: { command: 'node scripts/gds/ship.js 1003999 --summary x' },
+    tool_input: { command: 'node scripts/bongos/ship.js 1003999 --summary x' },
     tool_response: `shipped\n[otb-card-html] ${cardPath}\n`,
   };
 }
@@ -78,15 +78,15 @@ test('a lifecycle card is emitted for every shell tool, not Bash alone', () => {
 // ---------- matchesLifecycle ----------
 
 test('matches claim / ship / release script invocations', () => {
-  assert.ok(hook.matchesLifecycle('node scripts/gds/claim.js 1288'));
-  assert.ok(hook.matchesLifecycle('node scripts/gds/ship.js 1288 --notes x --summary y'));
-  assert.ok(hook.matchesLifecycle('node scripts/gds/release.js 1288'));
-  assert.ok(hook.matchesLifecycle('cd /repo && node scripts/gds/ship.js 5'));
+  assert.ok(hook.matchesLifecycle('node scripts/bongos/claim.js 1288'));
+  assert.ok(hook.matchesLifecycle('node scripts/bongos/ship.js 1288 --notes x --summary y'));
+  assert.ok(hook.matchesLifecycle('node scripts/bongos/release.js 1288'));
+  assert.ok(hook.matchesLifecycle('cd /repo && node scripts/bongos/ship.js 5'));
 });
 
 test('does NOT match other Bash commands', () => {
-  for (const c of ['git status', 'node scripts/gds/start.js --hook', 'node scripts/gds/status.js C8',
-    'ls scripts/gds/claim.js', 'node scripts/gds/capture.js "idea"']) {
+  for (const c of ['git status', 'node scripts/bongos/start.js --hook', 'node scripts/bongos/status.js C8',
+    'ls scripts/bongos/claim.js', 'node scripts/bongos/capture.js "idea"']) {
     assert.ok(!hook.matchesLifecycle(c), `should not match: ${c}`);
   }
   assert.equal(hook.matchesLifecycle(null), false);

package/tests/linkify_check.mjs

@@ -15,7 +15,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(REPO, 'scripts', 'gds', 'linkify-refs.js');
+const SCRIPT = path.join(REPO, 'scripts', 'bongos', 'linkify-refs.js');
 const SPAWN_TIMEOUT_MS = 60_000; // under run-unit-tests' 90s so WE decide the timeout outcome
 
 const r = spawnSync(process.execPath, [SCRIPT, '--check'], {
@@ -34,6 +34,6 @@ assert.equal(r.error, undefined, `linkify-refs.js --check failed to spawn: ${r.e
 assert.equal(
   r.status,
   0,
-  `linkify-refs.js --check found bare/upgradeable refs in committed docs — run \`node scripts/gds/linkify-refs.js --apply\` and commit.\n${r.stdout}\n${r.stderr}`
+  `linkify-refs.js --check found bare/upgradeable refs in committed docs — run \`node scripts/bongos/linkify-refs.js --apply\` and commit.\n${r.stdout}\n${r.stderr}`
 );
 console.log('linkify_check: committed docs carry no bare #NNN refs (linkify-refs.js --check exit 0).');

package/tests/linkify_refs.mjs

@@ -14,7 +14,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { linkifyText, RESOLVER_BASE, RESOLVER_BASE_IDEA, RESOLVER_BASE_BLOCKER, discoverDocs, isLoopbackOrigin } =
-  require('../scripts/gds/linkify-refs.js');
+  require('../scripts/bongos/linkify-refs.js');
 
 let passed = 0;
 let failed = 0;

package/tests/llm-cache-route.mjs

@@ -2,7 +2,7 @@
 // the llm-cache DB helpers are stubbed, and the route handlers are pulled out of
 // the express Router and driven with fake req/res. Tests the VALIDATION + TRUST
 // logic (hex key, known task_type, cost clamp, owner pinning, never-500). The
-// rank gate itself is asserted mechanically by scripts/gds/route-rank-check.js.
+// rank gate itself is asserted mechanically by scripts/bongos/route-rank-check.js.
 // Run: node tests/llm-cache-route.mjs
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';

package/tests/local_preview.mjs

@@ -1,4 +1,4 @@
-// tests/local_preview.mjs — hermetic unit smoke for scripts/gds/local-preview-lib.js
+// tests/local_preview.mjs — hermetic unit smoke for scripts/bongos/local-preview-lib.js
 // (the LOCAL sandbox launcher, task 1056). NO real spawn, NO network, NO fs
 // writes: fs / spawn / kill / fetchImpl / env are all injected.
 //
@@ -8,7 +8,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const lib = require('../scripts/gds/local-preview-lib.js');
+const lib = require('../scripts/bongos/local-preview-lib.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {

package/tests/main_audit.mjs

@@ -1,6 +1,6 @@
 // tests/main_audit.mjs
 //
-// Unit smoke for scripts/gds/main-audit.js — the post-push main audit
+// Unit smoke for scripts/bongos/main-audit.js — the post-push main audit
 // (SEC #863, layer 3). Pure analyzer: feed synthetic commits + a rank map.
 //
 // Run:  node tests/main_audit.mjs
@@ -10,7 +10,7 @@ import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
 
 const require = createRequire(import.meta.url);
-const { analyzeCommits, clampWindow, defaultRange, firstParentDepth, rowsToMap } = require('../scripts/gds/main-audit.js');
+const { analyzeCommits, clampWindow, defaultRange, firstParentDepth, rowsToMap } = require('../scripts/bongos/main-audit.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -54,7 +54,7 @@ t('Metic editing a protected path → no finding', () => {
 t('Archon editing a protected path → no finding', () => {
   const r = analyzeCommits([{
     sha: 'bbb', subject: 'x', authorName: 'somearchon', authorEmail: 'l@x',
-    isMerge: false, files: ['scripts/gds/ship.js', 'CLAUDE.md'],
+    isMerge: false, files: ['scripts/bongos/ship.js', 'CLAUDE.md'],
   }], RANKS);
   assert.equal(r.hardFail, false);
 });

package/tests/main_audit_attestation.mjs

@@ -14,7 +14,7 @@ import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const audit = require('../scripts/gds/main-audit.js');
+const audit = require('../scripts/bongos/main-audit.js');
 const {
   ATTEST_CONTEXT, mapIntroducingHeads, isAttested, analyzeAttestation, attestationConfig,
   fetchAttestations, runAttestationPass,

package/tests/main_audit_db_roster.mjs

@@ -26,12 +26,12 @@ import path from 'node:path';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const audit = require('../scripts/gds/main-audit.js');
+const audit = require('../scripts/bongos/main-audit.js');
 
 test('the --db roster address is LIVE: that module really exports getBuildersRoster', () => {
   // Resolved from main-audit.js's OWN directory, exactly as the lazy require() inside it
   // does — so this fails for the same reason the gate would, and never for a different one.
-  const auditDir = path.dirname(require.resolve('../scripts/gds/main-audit.js'));
+  const auditDir = path.dirname(require.resolve('../scripts/bongos/main-audit.js'));
   const mod = require(path.resolve(auditDir, audit.ROSTER_DB_MODULE));
   assert.equal(
     typeof mod.getBuildersRoster, 'function',

package/tests/main_worktree_busy_reason.mjs

@@ -29,8 +29,8 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { describeMainWorktreeBusy } = require(path.join(ROOT, 'scripts', 'gds', 'ship-regen.js'));
-const { parkedMainCheckoutWarning } = require(path.join(ROOT, 'scripts', 'gds', 'worktree-claim-guard.js'));
+const { describeMainWorktreeBusy } = require(path.join(ROOT, 'scripts', 'bongos', 'ship-regen.js'));
+const { parkedMainCheckoutWarning } = require(path.join(ROOT, 'scripts', 'bongos', 'worktree-claim-guard.js'));
 
 let passed = 0;
 let failed = 0;
@@ -133,7 +133,7 @@ t('release warning NEVER offers to restore the tree — on EITHER branch of the
 // interpolating it into a command string, and release.js now goes further and
 // uses an argv array with no shell at all.
 t('release.js never interpolates a path into a git command string', () => {
-  const raw = readFileSync(path.join(ROOT, 'scripts', 'gds', 'release.js'), 'utf8');
+  const raw = readFileSync(path.join(ROOT, 'scripts', 'bongos', 'release.js'), 'utf8');
   // Strip comments first: the file DESCRIBES the unsafe form on purpose, to stop
   // the next reader reintroducing it. Scanning prose as if it were code is how a
   // guard reds on its own documentation — which this one did, first run.

package/tests/markdown_line_endings.mjs

@@ -69,10 +69,10 @@ test('no tracked .md carries CRLF in the index', () => {
 // expect it. A future over-broad edit that pinned everything to LF would silently break
 // those, and the markdown assertions above would keep passing while it did.
 test('the Windows-shell classes stay pinned to CRLF', () => {
-  // scripts/gds/api.ps1 is the one such file that exists today; the .cmd/.bat spellings
+  // scripts/bongos/api.ps1 is the one such file that exists today; the .cmd/.bat spellings
   // are the declared-up-front rules for the wrappers .gitattributes says do not exist yet.
   // check-attr resolves a PATTERN, so it answers for those too — which is the point here.
-  for (const p of ['scripts/gds/api.ps1', 'scripts/setup-builder.cmd', 'scripts/setup-builder.bat']) {
+  for (const p of ['scripts/bongos/api.ps1', 'scripts/setup-builder.cmd', 'scripts/setup-builder.bat']) {
     assert.equal(eolOf(p), 'crlf', `${p} must stay CRLF — cmd.exe/PowerShell expect it`);
   }
 });

package/tests/me_streak_leaderboard_queries.mjs

@@ -0,0 +1,193 @@
+// tests/me_streak_leaderboard_queries.mjs
+//
+// Task 1004853: /me and the public leaderboard stop recomputing the same answer
+// per request.
+//
+//   1. /me's per-claim streak preview. It used to call wouldExtendStreak once per
+//      active claim, and each call re-ran computeStreak (2 queries) plus a task
+//      lookup: 3 queries per claim for one answer /me had already computed. Now
+//      the request's streak is handed in and every claimed task comes from ONE
+//      query, so the count is fixed however many claims there are, and each
+//      claim's streak_preview is exactly what the old path returned.
+//   2. The public leaderboard. Two reads within the 60 s window hit the database
+//      once; a different page is its own entry; a failed read is not cached.
+//
+// DB-free: queries go to a recorder, so what is pinned is how many are sent.
+//
+// Run:  node tests/me_streak_leaderboard_queries.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { pool } = require('../src/bongos/pool');
+const streak = require('../modules/economy/streak.js');
+const achievements = require('../modules/economy/achievements.js');
+const { claimsWithStreakPreview } = require('../src/bongos/routes/me.js');
+const { test, summary } = makeRunner();
+
+// A fake pg client that answers the three streak-related reads from fixtures and
+// records every SQL string it is sent.
+function fakeDb({ shipDays = [], today = '2026-10-25', tasks = {} } = {}) {
+  const sqls = [];
+  return {
+    sqls,
+    async query(sql, params) {
+      sqls.push(String(sql));
+      if (sql.includes('FROM claims c')) {
+        return { rows: shipDays.map((d) => ({ local_date: d, cnt: 1, timezone: 'UTC' })) };
+      }
+      if (sql.includes('AT TIME ZONE timezone)::date')) return { rows: [{ today }] };
+      if (sql.includes('SELECT timezone FROM builders')) return { rows: [{ timezone: 'UTC' }] };
+      if (sql.includes('FROM tasks WHERE id = ANY')) {
+        return { rows: params[0].filter((id) => tasks[id]).map((id) => ({ id, ...tasks[id] })) };
+      }
+      if (sql.includes('FROM tasks WHERE id = $1')) {
+        const t = tasks[String(params[0])];
+        return { rows: t ? [{ id: String(params[0]), ...t }] : [] };
+      }
+      return { rows: [] };
+    },
+  };
+}
+
+// The reward port as /me resolves it, pointed at the fake client.
+const rewardOn = (db) => ({
+  streakPreviewsForTasks: (b, ids, opts) => streak.streakPreviewsForTasks(b, ids, { ...opts, client: db }),
+});
+
+const TASKS = {
+  101: { kind: 'feature', est_minutes: 60 },
+  102: { kind: 'cleanup', est_minutes: 30 },
+  103: { kind: 'feature', est_minutes: 10 }, // under the 15-minute floor
+  104: { kind: 'refactor', est_minutes: 90 },
+  105: { kind: 'bug', est_minutes: 20 },
+};
+const claimsFor = (ids) => ids.map((id) => ({ task_id: String(id), discipline: 'engineer' }));
+
+await test('/me sends the same number of streak queries for 1 claim as for 5', async () => {
+  const counts = [];
+  for (const ids of [[101], [101, 102, 103, 104, 105]]) {
+    const db = fakeDb({ tasks: TASKS });
+    const cur = await streak.computeStreak(1, db); // the streak /me computes once, in its fan-out
+    db.sqls.length = 0;
+    const out = await claimsWithStreakPreview(rewardOn(db), 1, claimsFor(ids), cur, null);
+    assert.equal(out.length, ids.length);
+    counts.push(db.sqls.length);
+  }
+  assert.deepEqual(counts, [1, 1], 'one task query per request, no streak re-reads, at any claim count');
+});
+
+await test('no claims, no query', async () => {
+  const db = fakeDb();
+  const out = await claimsWithStreakPreview(rewardOn(db), 1, [], { current_streak: 0 }, null);
+  assert.deepEqual(out, []);
+  assert.equal(db.sqls.length, 0);
+});
+
+await test('the old per-claim path cost 3 queries a claim (the baseline this replaces)', async () => {
+  // 3 for a builder with ship-days; 4 for one with none (a timezone fallback read).
+  const db = fakeDb({ shipDays: ['2026-10-24'], tasks: TASKS });
+  for (const id of [101, 102, 103, 104, 105]) await streak.wouldExtendStreak(1, id, db);
+  assert.equal(db.sqls.length, 15);
+});
+
+await test('each streak_preview is exactly what wouldExtendStreak returns, in every streak state', async () => {
+  const scenarios = [
+    { name: 'shipped today', shipDays: ['2026-10-23', '2026-10-24', '2026-10-25'] },
+    { name: 'run ends yesterday', shipDays: ['2026-10-23', '2026-10-24'] },
+    { name: 'no recent run', shipDays: ['2026-10-01'] },
+    { name: 'never shipped', shipDays: [] },
+  ];
+  const ids = [101, 102, 103, 104, 105, 999]; // 999: a task that is not found
+  for (const sc of scenarios) {
+    const db = fakeDb({ shipDays: sc.shipDays, tasks: TASKS });
+    const cur = await streak.computeStreak(1, db);
+    const out = await claimsWithStreakPreview(rewardOn(db), 1, claimsFor(ids), cur, null);
+    for (const c of out) {
+      const old = await streak.wouldExtendStreak(1, c.task_id, fakeDb({ shipDays: sc.shipDays, tasks: TASKS }));
+      assert.deepEqual(c.streak_preview, old, `${sc.name}: task ${c.task_id}`);
+    }
+    assert.equal(out.find((c) => c.task_id === '999').streak_preview.reason, 'task-not-found');
+    assert.equal(out.find((c) => c.task_id === '103').streak_preview.reason, 'est_minutes<15');
+  }
+});
+
+await test('the claim keeps its own fields and gains craft_mode beside the preview', async () => {
+  const db = fakeDb({ tasks: TASKS });
+  const cur = await streak.computeStreak(1, db);
+  const [c] = await claimsWithStreakPreview(rewardOn(db), 1, [{ task_id: '101', discipline: 'engineer', id: 7 }], cur, null);
+  assert.equal(c.id, 7);
+  assert.equal(c.task_id, '101');
+  assert.ok('craft_mode' in c);
+  assert.equal(c.streak_preview.qualifies, true);
+});
+
+// ---- 2. the leaderboard cache ----------------------------------------------------
+
+let leaderboardReads = 0;
+let failNext = false;
+pool.query = async (sql) => {
+  if (/FROM builders b/.test(String(sql)) && /session_records/.test(String(sql))) {
+    leaderboardReads++;
+    if (failNext) { failNext = false; throw new Error('db down'); }
+    return { rows: [{ id: '1', github_login: 'a', total_credits: 10, achievements: [], tokens_used: '5' }] };
+  }
+  return { rows: [] };
+};
+
+await test('two leaderboard reads within the window hit the database once', async () => {
+  achievements.clearLeaderboardCache();
+  leaderboardReads = 0;
+  const a = await achievements.getLeaderboardWithAchievements(100, 5);
+  const b = await achievements.getLeaderboardWithAchievements(100, 5);
+  assert.equal(leaderboardReads, 1);
+  assert.deepEqual(a, b, 'the cached answer is the same answer');
+});
+
+await test('a caller editing its rows does not edit the cached answer', async () => {
+  achievements.clearLeaderboardCache();
+  const a = await achievements.getLeaderboardWithAchievements(100, 5);
+  a[0].roles = ['engineer'];
+  const b = await achievements.getLeaderboardWithAchievements(100, 5);
+  assert.equal(b[0].roles, undefined);
+});
+
+await test('different arguments are different entries', async () => {
+  achievements.clearLeaderboardCache();
+  leaderboardReads = 0;
+  await achievements.getLeaderboardWithAchievements(100, 5);
+  await achievements.getLeaderboardWithAchievements(150, 5);
+  await achievements.getLeaderboardWithAchievements(150, 5);
+  assert.equal(leaderboardReads, 2);
+});
+
+await test('the entry expires after 60 seconds', async () => {
+  achievements.clearLeaderboardCache();
+  leaderboardReads = 0;
+  const realNow = Date.now;
+  try {
+    const t0 = realNow();
+    Date.now = () => t0;
+    await achievements.getLeaderboardWithAchievements(100, 5);
+    Date.now = () => t0 + 59_000;
+    await achievements.getLeaderboardWithAchievements(100, 5);
+    assert.equal(leaderboardReads, 1, 'still fresh at 59 s');
+    Date.now = () => t0 + 60_000;
+    await achievements.getLeaderboardWithAchievements(100, 5);
+    assert.equal(leaderboardReads, 2, 're-read at 60 s');
+  } finally { Date.now = realNow; }
+});
+
+await test('a failed read is not cached', async () => {
+  achievements.clearLeaderboardCache();
+  leaderboardReads = 0;
+  failNext = true;
+  await assert.rejects(() => achievements.getLeaderboardWithAchievements(100, 5), /db down/);
+  const rows = await achievements.getLeaderboardWithAchievements(100, 5);
+  assert.equal(rows.length, 1);
+  assert.equal(leaderboardReads, 2, 'the next request retried');
+});
+
+summary();

package/tests/membership_kind_lockstep.mjs

@@ -40,7 +40,7 @@ import { fileURLToPath } from 'node:url';
 import { authSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const lint = require('../scripts/gds/lint-migrations.js');
+const lint = require('../scripts/bongos/lint-migrations.js');
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');

package/tests/memory_isolation.mjs

@@ -37,12 +37,11 @@ const require = createRequire(import.meta.url);
 
 // Grab the real module objects so we can monkeypatch their exported functions
 // BEFORE building the router (requireBuilder / requireRank are captured at
-// build time; memory.* and db.insertAuditLog are called by property at request
+// build time; memory.* and the doorway's insertAuditLog are called by property at request
 // time). This is the same "stub the dependency module" pattern the project uses
 // elsewhere — no DI framework, just Node's module cache.
 const auth = require('../src/module-api'); // doorway: memory-module routes capture api.requireBuilder, so the stub must patch the doorway (BV1.R72 / ADR 0091)
 const memory = require('../modules/memory/memory.js');
-const db = require('../src/bongos/db.js');
 
 let passed = 0;
 let failed = 0;
@@ -261,7 +260,7 @@ const orig = {
   requireRank: auth.requireRank,
   listMemoryFiles: memory.listMemoryFiles,
   fetchMemoryFile: memory.fetchMemoryFile,
-  insertAuditLog: db.insertAuditLog,
+  insertAuditLog: auth.insertAuditLog,
   assertValidPath: memory.assertValidPath,
 };
 
@@ -313,7 +312,12 @@ memory.assertValidPath = orig.assertValidPath;
 
 // Stub the audit insert: async, records the row, optionally throws. Making it
 // async + asserting the response waited for it proves the route AWAITS it.
-db.insertAuditLog = async function stubAudit(row) {
+// The route reaches the audit insert through the module doorway (`db = api` in
+// modules/memory/routes/memory.js), so the stub goes on the doorway. Stubbing
+// src/bongos/db.js left the REAL insert in place: without Postgres every audited read
+// failed closed with a 500, and with Postgres the cases wrote real audit rows instead of
+// recording them here (task 1004865).
+auth.insertAuditLog = async function stubAudit(row) {
   // yield a turn so a non-awaited caller would race ahead of us
   await new Promise((r) => setImmediate(r));
   if (fixture.auditShouldThrow) throw new Error('audit db down');
@@ -366,7 +370,11 @@ try {
     const res = await fetch(`${base}/memory/builders/99/files`);
     assert.equal(res.status, 403, 'a non-archon must be refused by the rank gate');
     const body = await res.json();
-    assert.equal(body.error, 'rank_forbidden');
+    // The gate is requirePermission('memory.read.any') since BV1.R105, answering in the
+    // { error: { code, details } } envelope — not the old flat 'rank_forbidden' string.
+    assert.equal(body.error.code, 'permission_forbidden');
+    assert.deepEqual(body.error.details.required, ['memory.read.any']);
+    assert.ok(!body.error.details.held.includes('memory.read.any'), 'a xenos must not hold memory.read.any');
     // The store must NEVER have been touched for builder 99.
     assert.equal(fixture.storeCalls.length, 0, 'no store call may happen when the rank gate refuses');
   });
@@ -451,7 +459,7 @@ try {
     const res = await fetch(`${base}/memory/builders/99/file?path=MEMORY.md`);
     assert.equal(res.status, 500, 'a failed audit must fail the read closed');
     const body = await res.json();
-    assert.equal(body.error, 'audit_failed');
+    assert.equal(body.error.code, 'audit_failed');
     // Critically: the target's file content must NOT be in the response.
     assert.ok(!('content' in body), 'the target builder content must NOT leak when the audit failed');
     assert.equal(body.content, undefined);
@@ -464,7 +472,7 @@ try {
     const res = await fetch(`${base}/memory/builders/99/files`);
     assert.equal(res.status, 500);
     const body = await res.json();
-    assert.equal(body.error, 'audit_failed');
+    assert.equal(body.error.code, 'audit_failed');
     assert.ok(!('files' in body), 'the target builder file list must NOT leak when the audit failed');
   });
 } finally {
@@ -474,7 +482,7 @@ try {
   auth.requireRank = orig.requireRank;
   memory.listMemoryFiles = orig.listMemoryFiles;
   memory.fetchMemoryFile = orig.fetchMemoryFile;
-  db.insertAuditLog = orig.insertAuditLog;
+  auth.insertAuditLog = orig.insertAuditLog;
   memory.assertValidPath = orig.assertValidPath;
 }
 

package/tests/memory_map.mjs

@@ -1,4 +1,4 @@
-// Tests for scripts/gds/memory-map.js — the memory-map guard + auto-tidy (task 1362).
+// Tests for scripts/bongos/memory-map.js — the memory-map guard + auto-tidy (task 1362).
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const mm = require(path.join(ROOT, 'scripts/gds/memory-map.js'));
+const mm = require(path.join(ROOT, 'scripts/bongos/memory-map.js'));
 
 // Build a synthetic MEMORY.md: `rules` feedback_* entries + `projects` project-NNN
 // entries, each hook `hookLen` chars. mtime is injected by index so project-001 is