@bongos/core 1.21.176 → 1.21.178

package/tests/autonomy_daily_checks.mjs

@@ -0,0 +1,201 @@
+// tests/autonomy_daily_checks.mjs — the server's daily checks run once a day, file
+// each distinct finding once, and never record "could not check" as clean
+// (task 1004878).
+//
+// DB-free and network-free: the run ledger, the roster, npm and the idea inbox are
+// all injected. The one thing these tests exist to stop is the failure every one of
+// these routines already had — declared daily, run never — so the scheduling half
+// (isDue against the ledger, not the boot) is pinned as hard as the filing half.
+//
+// Run:  node --test tests/autonomy_daily_checks.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const dc = require('../modules/autonomy/pollers/daily-checks.js');
+const { SERVER_ROUTINES, DAY_MS, WEEK_MS } = require('../modules/autonomy/server-schedule.js');
+const rt = require('../modules/autonomy/pollers/routine-timers.js');
+
+const NOW = Date.parse('2026-10-26T12:00:00Z');
+const hoursAgo = (h) => new Date(NOW - h * 3600_000).toISOString();
+const LADDER = ['xenos', 'thetes', 'metic', 'archon'];
+
+// A fake ledger: rows newest-first, plus a list of what got recorded.
+function ledger(rows = []) {
+  const recorded = [];
+  return {
+    recorded,
+    db: {
+      readAutonomyRuns: async () => rows,
+      recordAutonomyRun: async (r) => { recorded.push(r); return {}; },
+      readRankRoster: async () => [
+        { id: 1, github_login: 'ok', rank: 'archon', status: 'active' },
+        { id: 2, github_login: 'old', rank: 'ephor', status: 'inactive' },
+      ],
+    },
+  };
+}
+const quiet = { log: () => {}, error: () => {} };
+const capturing = () => {
+  const filed = [];
+  return { filed, captureIdea: async (i) => { filed.push(i); return { id: 42 }; } };
+};
+
+// ------------------------------------------------------------- the schedule table
+
+test('the daily poller runs exactly the server-schedule rows that name it', () => {
+  assert.deepEqual(dc.ROUTINES, SERVER_ROUTINES.filter((r) => r.poller === 'daily-checks').map((r) => r.routine));
+  assert.deepEqual(dc.ROUTINES.sort(), ['dep-audit-nightly', 'rank-roles-audit']);
+});
+
+test('peer-vote-tally takes its period from the same table (weekly)', () => {
+  assert.equal(rt.PEER_VOTE_INTERVAL_MS, WEEK_MS);
+});
+
+// ------------------------------------------------------------------ isDue
+
+test('due when it has never run', () => {
+  assert.equal(dc.isDue([], 'rank-roles-audit', NOW), true);
+});
+
+test('not due 20 hours after the last run, due 23.5 hours after — daily, not per boot', () => {
+  assert.equal(dc.isDue([{ created_at: hoursAgo(20) }], 'rank-roles-audit', NOW), false);
+  assert.equal(dc.isDue([{ created_at: hoursAgo(23.5) }], 'rank-roles-audit', NOW), true);
+  assert.equal(dc.DUE_SLACK_MS < DAY_MS / 24, true, 'slack must stay under one hourly tick or runs drift');
+});
+
+test('an ERROR row counts as a run too, so a broken check is retried daily, not hourly', async () => {
+  const L = ledger([{ decision: 'no-go', reason: 'error: x', created_at: hoursAgo(2) }]);
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, ...quiet });
+  assert.equal(out.skipped, 'not_due');
+  assert.equal(L.recorded.length, 0);
+});
+
+// --------------------------------------------------------------- filing
+
+test('a finding is filed as one idea and the run records its fingerprint', async () => {
+  const L = ledger();
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'filed');
+  assert.equal(C.filed.length, 1);
+  assert.match(C.filed[0].title, /^\[rank-roles\] 1 builder/);
+  assert.match(C.filed[0].bodyMd, /builder 2 \(old\) rank=ephor status=inactive/);
+  assert.equal(C.filed[0].kind, 'bug');
+  assert.equal(L.recorded[0].decision, 'go');
+  assert.match(L.recorded[0].reason, /^findings n=1 fp=[0-9a-f]{12} idea=42$/);
+});
+
+test('the SAME finding the next day is recorded unchanged and NOT filed again', async () => {
+  const fp = dc.fingerprint(['2:ephor']);
+  const L = ledger([{ decision: 'go', reason: `findings n=1 fp=${fp} idea=42`, created_at: hoursAgo(24) }]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'unchanged');
+  assert.equal(C.filed.length, 0);
+  assert.match(L.recorded[0].reason, /unchanged$/);
+});
+
+test('an error between two identical findings does not cause a duplicate filing', async () => {
+  const fp = dc.fingerprint(['2:ephor']);
+  const L = ledger([
+    { decision: 'no-go', reason: 'error: db blip', created_at: hoursAgo(24) },
+    { decision: 'go', reason: `findings n=1 fp=${fp} idea=42`, created_at: hoursAgo(48) },
+  ]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'unchanged');
+  assert.equal(C.filed.length, 0);
+});
+
+test('a finding that comes back after a clean day is filed again', async () => {
+  const L = ledger([{ decision: 'go', reason: 'clean', created_at: hoursAgo(24) }]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'filed');
+});
+
+test('the fingerprint ignores order and changes when the set changes', () => {
+  assert.equal(dc.fingerprint(['a', 'b']), dc.fingerprint(['b', 'a']));
+  assert.notEqual(dc.fingerprint(['a']), dc.fingerprint(['a', 'b']));
+});
+
+test('a clean run files nothing and records clean', async () => {
+  const L = ledger();
+  L.db.readRankRoster = async () => [{ id: 1, rank: 'archon' }];
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'clean');
+  assert.equal(C.filed.length, 0);
+  assert.deepEqual(L.recorded[0], { routine: 'rank-roles-audit', decision: 'go', reason: 'clean' });
+});
+
+test('no idea inbox (ideas module off) is recorded as undelivered, and retried next time', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: 'not a function', ...quiet });
+  assert.equal(out.outcome, 'undelivered');
+  assert.equal(L.recorded[0].decision, 'no-go', 'a no-go row is never read as delivered');
+  assert.equal(dc.lastFiledFingerprint(L.recorded.map((r) => ({ ...r }))), null);
+});
+
+test('a capture that throws is undelivered, never a crash', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('rank-roles-audit', {
+    db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: async () => { throw { code: 'BAD_KIND' }; }, ...quiet,
+  });
+  assert.equal(out.outcome, 'undelivered');
+  assert.match(L.recorded[0].reason, /undelivered: BAD_KIND/);
+});
+
+// ------------------------------------------------------- could not check ≠ clean
+
+test('npm missing is an ERROR row, not clean', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/i', npmAudit: async () => ({ error: 'npm not found' }), ...quiet,
+  });
+  assert.equal(out.outcome, 'error');
+  assert.deepEqual(L.recorded[0], { routine: 'dep-audit-nightly', decision: 'no-go', reason: 'error: npm not found' });
+});
+
+test("npm's own JSON error (no lockfile) is an ERROR row, not clean", async () => {
+  const L = ledger();
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/i',
+    npmAudit: async () => ({ stdout: JSON.stringify({ error: { code: 'ENOLOCK', summary: 'This command requires an existing lockfile.' } }), stderr: '' }),
+    ...quiet,
+  });
+  assert.equal(out.outcome, 'error');
+  assert.match(L.recorded[0].reason, /lockfile/);
+});
+
+test('dep-audit audits the cwd it is handed and files high/critical findings only', async () => {
+  const L = ledger();
+  const C = capturing();
+  let auditedIn = null;
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/srv/instance', captureIdea: C.captureIdea, ...quiet,
+    npmAudit: async (cwd) => {
+      auditedIn = cwd;
+      return { stdout: JSON.stringify({ vulnerabilities: {
+        bad: { severity: 'critical', via: [{ severity: 'critical', title: 'RCE', url: 'https://x/1', source: 1 }], fixAvailable: true },
+        meh: { severity: 'moderate', via: [], fixAvailable: true },
+      } }), stderr: '' };
+    },
+  });
+  assert.equal(auditedIn, '/srv/instance');
+  assert.equal(out.outcome, 'filed');
+  assert.match(C.filed[0].title, /^\[dep-audit\] 1 high\/critical vulnerability in/);
+  assert.match(C.filed[0].bodyMd, /\*\*bad\*\* \(critical\) — RCE/);
+  assert.doesNotMatch(C.filed[0].bodyMd, /meh/);
+});
+
+// --------------------------------------------------------------- the tick
+
+test('an unreachable database is a quiet skip for every routine (a builder laptop)', async () => {
+  const db = { readAutonomyRuns: async () => { throw new Error('connect ENOENT /var/run/postgresql'); } };
+  const out = await dc.tick({ db, ...quiet });
+  assert.deepEqual(out.map((r) => r.skipped), dc.ROUTINES.map(() => 'db_unreachable'));
+});

package/tests/bump_version.mjs

@@ -22,7 +22,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 const bump = require(path.join(ROOT, 'scripts', 'bongos', 'bump-version.js'));
-const { bumpPatch, CONST_RE } = bump;
+const { bumpPatch, nextFreePatch, registryVersions, CONST_RE } = bump;
 // The LIVE test below reads this repo's real release history (task 1003202).
 const { execFileSync } = require('node:child_process');
 
@@ -217,25 +217,59 @@ test('the push to main happens exactly once, and not inside the bump step', () =
   assert.ok(bumpStep.includes('git commit -m'), 'the bump step still commits locally — package-core stamps the version found AT the ref');
 });
 
-test('an already-published version is success, not a wedge', () => {
-  // Publish-then-failed-push leaves a version on npm with no release commit.
-  // The next run reads it as free (laneReleasedVersions is git-based), bumps to
-  // it, and npm refuses the duplicate. Without this branch that run fails, and
-  // so does every run after it — the lane wedges with no way out but a human.
+test('an already-published version FAILS the publish and records nothing (task 1004886)', () => {
+  // Task 1003914 made a duplicate-version refusal count as success and fell through to
+  // the record step. But a version is left unrecorded only when its record push lost a
+  // race to a MOVED main, so the registry's copy is never this run's tree: on
+  // 2026-10-25 that recorded 1.21.175 on main for a tree npm's 1.21.175 (2026-10-23)
+  // never held. The refusal must now fail the step, which skips the record step.
   const pubAt = PUBLISH_YML.indexOf('id: pub');
   assert.ok(pubAt !== -1, 'the publish step must carry id: pub');
-  const pubStep = PUBLISH_YML.slice(pubAt, PUBLISH_YML.indexOf('\n      # PUBLISH VERDICT'));
-  assert.match(
-    pubStep,
-    /cannot publish over\|previously published\|EPUBLISHCONFLICT/,
-    'the publish step must recognise npm refusing a duplicate version',
-  );
-  assert.match(pubStep, /already=true/, 'and must record that it took the already-present branch');
-  assert.match(
-    pubStep,
-    /exit "\$RC"/,
-    'every OTHER publish failure must still fail the step — the tolerance is narrow on purpose',
-  );
+  const pubStep = PUBLISH_YML.slice(pubAt, PUBLISH_YML.indexOf('\n      # THE ONLY IRREVERSIBLE STEP'));
+  assert.match(pubStep, /cannot publish over\|previously published\|EPUBLISHCONFLICT/,
+    'the publish step still recognises npm refusing a duplicate — to say so plainly');
+  assert.doesNotMatch(pubStep, /already=true/, 'no already-present success branch');
+  // After a non-zero npm publish, the only way out is `exit "$RC"`: the duplicate
+  // branch must not be able to reach the "published" line.
+  const failAt = pubStep.indexOf('if [ "$RC" -ne 0 ]; then');
+  const failBlock = pubStep.slice(failAt, pubStep.indexOf('\n          fi\n          echo "published', failAt));
+  assert.ok(failAt !== -1 && failBlock.trimEnd().endsWith('exit "$RC"'), 'every publish failure, the duplicate included, exits non-zero');
+  const recAt = PUBLISH_YML.indexOf('- name: Record the release on main');
+  const recIf = PUBLISH_YML.slice(recAt, PUBLISH_YML.indexOf('\n        run:', recAt));
+  assert.doesNotMatch(recIf, /always\(\)|failure\(\)/, 'the record step must not run after a failed publish');
+  const verdict = PUBLISH_YML.slice(PUBLISH_YML.indexOf('# PUBLISH VERDICT'));
+  assert.doesNotMatch(verdict.slice(0, 1500), /ALREADY PRESENT/, 'the verdict no longer reports a recorded duplicate');
+});
+
+test('the registry listing is read and every listed version is skipped by the bump (task 1004886)', () => {
+  const verAt = PUBLISH_YML.indexOf('id: ver');
+  const verStep = PUBLISH_YML.slice(verAt, PUBLISH_YML.indexOf('\n      - name:', verAt));
+  assert.match(verStep, /npm view @bongos\/core versions --json > "\$TAKEN_FILE"/, 'the resolve step reads the registry listing');
+  assert.match(verStep, /registryVersions\(.*\)\.has\(process\.argv\[2\]\) \? 0 : 1\)" "\$TAKEN_FILE" "\$HEAD_V"; then\s+TAKEN=true/,
+    'a HEAD version already on the registry counts as taken, so it is bumped past');
+  assert.match(verStep, /echo '\[\]' > "\$TAKEN_FILE"/, 'an unreadable listing degrades to git-only, it does not stop the lane');
+  assert.match(verStep, /taken_file=/, 'the listing is handed on');
+  const bumpAt = PUBLISH_YML.indexOf('id: bump');
+  const bumpStep = PUBLISH_YML.slice(bumpAt, PUBLISH_YML.indexOf('\n      - name:', bumpAt));
+  assert.match(bumpStep, /bump-version\.js --apply .*--taken-file "\$\{\{ steps\.ver\.outputs\.taken_file \}\}"/, 'the bump skips the listed versions');
+});
+
+test('bumpPatch skips every taken version (task 1004886)', () => {
+  const src = "const CORE_VERSION = '1.21.174'; // x\n";
+  assert.equal(bumpPatch(src).to, '1.21.175', 'nothing taken → the next patch, as before');
+  assert.equal(bumpPatch(src, { taken: new Set(['1.21.175']) }).to, '1.21.176', 'the 2026-10-25 shape: 1.21.175 is on npm with an older tree');
+  assert.equal(bumpPatch(src, { taken: new Set(['1.21.175', '1.21.176', '1.21.178']) }).to, '1.21.177', 'the first free patch, not the highest');
+  assert.equal(bumpPatch(src, { taken: new Set(['1.22.0', '1.21.174']) }).to, '1.21.175', 'other minors and the current version do not matter');
+  assert.match(bumpPatch(src, { taken: new Set(['1.21.175']) }).text, /^const CORE_VERSION = '1\.21\.176';/m, 'the literal carries the skipped-to version');
+  assert.throws(() => nextFreePatch(1, 0, 0, { has: () => true }), /no free patch/, 'a taken-list that covers everything throws, never spins');
+});
+
+test('registryVersions parses npm view output and drops anything that is not x.y.z', () => {
+  assert.deepEqual([...registryVersions('["1.21.174","1.21.175"]')], ['1.21.174', '1.21.175']);
+  assert.deepEqual([...registryVersions('"1.0.0"')], ['1.0.0'], 'npm prints a bare string when one version exists');
+  assert.deepEqual([...registryVersions('["1.2.3","1.2.4-rc.1","x; rm -rf",7]')], ['1.2.3']);
+  assert.equal(registryVersions('not json').size, 0);
+  assert.equal(registryVersions('').size, 0);
 });
 
 test('the record step gates on a bump actually having been made', () => {

package/tests/claude_materialize.mjs

@@ -177,7 +177,7 @@ t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companio
   assert.ok(existsSync(rt), '.claude/scheduled-tasks created in the instance');
   // Every materialized routine's core invocation is bongosified — asserted over
   // WHATEVER routines the tree carries (the neutral core carries redteam-weekly;
-  // the founder core also carries stale-claim-release/diagram-drift). No routine
+  // the founder core also carries rank-roles-audit/peer-vote-tally). No routine
   // body may keep a bare `node scripts/bongos/…` core invocation.
   let sawBongosified = false;
   for (const name of readdirSync(rt)) {
@@ -191,17 +191,17 @@ t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companio
   // Founder-specific fixtures — assert their finer behavior only when present, so
   // this coverage stays live on the founder core without demanding those routines
   // exist in the neutral core (which carries a different routine set).
-  const stalePath = join(rt, 'stale-claim-release', 'SKILL.md');
-  if (existsSync(stalePath)) {
-    assert.ok(readFileSync(stalePath, 'utf8').includes('bongos exec scripts/bongos/pulse.js'), 'body core-invocation rewritten to bongos exec');
-  }
-  const ddCheck = join(rt, 'diagram-drift', 'check.js');
-  if (existsSync(ddCheck)) {
-    const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
-    assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
-    const check = readFileSync(ddCheck, 'utf8');
-    assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
-    assert.ok(!check.includes("require('../../../scripts/bongos/"), 'no bare ../../../scripts/bongos require left in the companion');
+  // The companion-script case (task 1004878 moved this off the retired
+  // diagram-drift routine): a routine whose step runs a .js beside its SKILL.md.
+  const pvTally = join(rt, 'peer-vote-tally', 'tally.js');
+  if (existsSync(pvTally)) {
+    const pv = readFileSync(join(rt, 'peer-vote-tally', 'SKILL.md'), 'utf8');
+    assert.ok(pv.includes('node .claude/scheduled-tasks/peer-vote-tally/tally.js'), 'companion-path step command preserved');
+    const tally = readFileSync(pvTally, 'utf8');
+    assert.ok(tally.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
+    // Code lines only: tally.js's own header QUOTES the bare form to explain why it is gone.
+    const code = tally.split('\n').filter((l) => !/^\s*\/\//.test(l)).join('\n');
+    assert.ok(!code.includes("require('../../../scripts/bongos/"), 'no bare ../../../scripts/bongos require left in the companion');
   }
   rmSync(dir, { recursive: true, force: true });
 });

package/tests/copy_desk_flags_db.mjs

@@ -26,15 +26,17 @@
 //
 // Run:  DATABASE_URL=postgres://... node tests/copy_desk_flags_db.mjs
 //
-// It creates its OWN minimal `builders`/`tasks` stand-ins if they are absent, so
-// it works against a throwaway container as well as a full migrated database, and
-// it cleans up every row it writes.
+// It needs a MIGRATED database (scripts/migrate.sh), the one the integration lane
+// builds. It once created its own minimal `builders`/`tasks` stand-ins; those drifted
+// from the real schema (builders.github_id became NOT NULL) and hid it, so they are
+// gone (task 1004863). It cleans up every row it writes.
 
 import { createRequire } from 'node:module';
 import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { insertTestBuilders } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
@@ -58,21 +60,19 @@ async function test(name, fn) {
 }
 
 // --- fixtures -------------------------------------------------------------
-// Minimal stand-ins ONLY if the real tables are absent (throwaway container).
-// Against a fully migrated DB these are no-ops and the real tables are used.
-await pool.query(`
-  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
-  CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text, display_name text);
-  CREATE TABLE IF NOT EXISTS tasks (id bigserial PRIMARY KEY);
-`);
-
 // Two throwaway builders + one task, at ids far above any real row.
 const A = 900000001;
 const B = 900000002;
 const T = 900000003;
-await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES ($1,$2,$3),($4,$5,$6) ON CONFLICT (id) DO NOTHING',
-  [A, 'cdtest-a', 'Copy Desk Test A', B, 'cdtest-b', 'Copy Desk Test B']);
-await pool.query('INSERT INTO tasks (id) VALUES ($1) ON CONFLICT (id) DO NOTHING', [T]);
+await insertTestBuilders(pool, [
+  { id: A, login: 'cdtest-a', display_name: 'Copy Desk Test A' },
+  { id: B, login: 'cdtest-b', display_name: 'Copy Desk Test B' },
+]);
+// The task needs a version (tasks.version_id is NOT NULL). Its own row, at status
+// 'building': the seeds own the one 'planning' version the partial index allows.
+const VER = 'ZZZ-CDF';
+await pool.query("INSERT INTO versions (id, name, status) VALUES ($1, 'copy desk fixture', 'building') ON CONFLICT (id) DO NOTHING", [VER]);
+await pool.query("INSERT INTO tasks (id, version_id, title, discipline) VALUES ($1, $2, 'copy desk fixture', 'engineer') ON CONFLICT (id) DO NOTHING", [T, VER]);
 
 // Apply the migration verbatim — this also proves it is idempotent, since a
 // migrated DB has already run it.
@@ -248,6 +248,12 @@ await test('closeFlag returns null on a second call — the route answers 409 fr
 // --- page asks (task 1004317 / TW06, copy_desk_002) -----------------------
 // A page ask's surface IS its page id, so these use SURF as the page id and the
 // cleanup above still catches every row.
+//
+// The section starts from no rows (task 1004863): the string-flag cases above leave
+// open flags on SURF (some with a null string_id), and the one-open-per-target index
+// keys on (flagged_by, surface, string_id) — so a page ask by the same builder on the
+// same surface collided with them rather than testing anything about page asks.
+await clean();
 console.log('copy_desk_flags — page asks (copy_desk_002)');
 
 const pageIns = (o = {}) => pool.query(
@@ -299,6 +305,8 @@ await test('pageAskSummary groups open asks by page: distinct askers, the oldest
 
 // --- cleanup --------------------------------------------------------------
 await clean();
+await pool.query('DELETE FROM tasks WHERE id = $1', [T]).catch(() => {});
+await pool.query('DELETE FROM versions WHERE id = $1', [VER]).catch(() => {});
 await pool.query('DELETE FROM builders WHERE id = ANY($1)', [[A, B]]).catch(() => {});
 
 console.log(`\n${passed} passed, ${failed} failed`);

package/tests/effective_visibility_predicate.mjs

@@ -145,24 +145,6 @@ const SPELLING_EXEMPTIONS = [
     obligation: (code) => !/\.query\s*\(/.test(code) && !/require\(\s*'pg'\s*\)/.test(code),
     demands: 'issues no database query and loads no database driver — it answers from fixtures only',
   },
-  {
-    file: 'scripts/bongos/seed-bv1-privacy-invites-tasks.js',
-    allow: [
-      { text: "profile_state='", count: 1, why: 'a one-shot historical seeder: this sits inside a task DESCRIPTION string, quoting the predicate as prose describing the work to be done. Its subject IS this predicate.' },
-      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same task description — prose, not a query.' },
-    ],
-    obligation: (code) => !/\.query\s*\(/.test(code),
-    demands: 'issues no database query at all — it posts task rows over HTTP',
-  },
-  {
-    file: 'scripts/bongos/seed-bv1-r01-delta-tasks.js',
-    allow: [
-      { text: "profile_state='", count: 1, why: 'the ADR 0171 R01 seeder: the predicate is quoted as prose inside the task briefs this script files, the same shape as the privacy seeder above.' },
-      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same brief — prose describing work, never executed.' },
-    ],
-    obligation: (code) => !/\.query\s*\(/.test(code),
-    demands: 'issues no database query at all — it posts task rows over HTTP',
-  },
 ];
 
 // Every SELECT against platform_identity_accounts that is deliberately NOT a

package/tests/gating_review_retired.mjs

@@ -43,7 +43,7 @@ test('cmdOn normalizes BOTH restore paths — a pre-retirement snapshot cannot r
 
 test('the CODEOWNERS file is gone; its GLOB guards remain where they enforce', () => {
   assert.ok(!fs.existsSync(path.join(ROOT, 'CODEOWNERS')), 'CODEOWNERS must not exist (ADR 0162)');
-  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'), 'utf8');
+  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'hard-floor.js'), 'utf8');
   assert.match(gateReview, /'CODEOWNERS'/, 'the HARD_FLOOR glob stays — reintroducing the file is itself gate-flagged');
 });
 

package/tests/government_act_alone_buildings.mjs

@@ -68,7 +68,7 @@ async function withPort(port, fn) {
 // The port the routers below are driven through (section 3); restored after
 // each gate test swaps in its own.
 const ATOMS = [
-  'autonomy.fence.manage', 'criterion.satisfy', 'criterion.unsatisfy', 'gate_approval.decide', 'override_request.decide',
+  'autonomy.fence.manage', 'criterion.satisfy', 'criterion.unsatisfy', 'override_request.decide',
   'core.pin.move', 'builder.budget.set', 'goal.create', 'goal.reorder', 'version.focus.set', 'project.settings.manage',
   'security.report.adjudicate', 'access_request.review', 'government.manage',
 ];
@@ -211,7 +211,6 @@ app.use(attachFail);
 for (const rel of [
   'modules/autonomy/routes/autonomy.js',
   'modules/lifecycle/routes/done-when.js',
-  'modules/lifecycle/routes/gate-approvals.js',
   'modules/lifecycle/routes/tasks.js',
   'modules/lifecycle/routes/goals.js',
   'modules/lifecycle/routes/versions.js',
@@ -264,7 +263,6 @@ const REQUESTS = {
   'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
   'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
   'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
-  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
   'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
   'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
   'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],

package/tests/government_board_membership_db.mjs

@@ -26,6 +26,7 @@
 // ids far above any real row, and deletes them at the end.
 
 import pg from 'pg';
+import { insertTestBuilders } from './helpers.mjs';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
@@ -45,38 +46,48 @@ async function t(name, fn) {
 }
 const assert = (await import('node:assert')).strict;
 
-// Minimal stand-ins ONLY when the real tables are absent (throwaway container);
-// against a migrated database these are no-ops and the real tables are used.
-await pool.query(`
-  CREATE TABLE IF NOT EXISTS builders (
-    id bigserial PRIMARY KEY, github_login text, display_name text,
-    status text DEFAULT 'active', system_role text);
-  CREATE TABLE IF NOT EXISTS government_builder_ranks (
-    builder_id bigint, rank_key text);
-`);
+// Needs a MIGRATED database (the integration lane's). The stand-in tables this once
+// created when the real ones were absent drifted from the schema (builders.github_id
+// became NOT NULL) and are gone (task 1004863); the builder rows go through the shared
+// helper so the next required column is added in one place.
+
+// ONE TRANSACTION, ALWAYS ROLLED BACK (task 1004863). The machine principal below needs a
+// real system_role, and system_role is UNIQUE with only two legal values — both held by
+// the seeded system builders on any migrated database. So the fixture releases the seeded
+// 'bfg' role inside this transaction, gives it to its own throwaway machine, and the
+// rollback restores everything. The library under test is pointed at the same client, so
+// it reads exactly the rows the fixture wrote.
+const db = await pool.connect();
+await db.query('BEGIN');
+await db.query("UPDATE builders SET system_role = NULL WHERE system_role = 'bfg'");
 
 // Ids far above any real row, and every login prefixed, so cleanup is exact and
 // this can never touch a real builder or a real rank assignment.
 const B = 990000000;
 const ID = { xenos: B + 1, thetes: B + 2, metic: B + 3, archon: B + 4, gone: B + 5, bot: B + 6, ops: B + 7 };
 const cleanup = async () => {
-  await pool.query('DELETE FROM government_builder_ranks WHERE builder_id >= $1', [B]);
-  await pool.query('DELETE FROM builders WHERE id >= $1', [B]);
+  await db.query('DELETE FROM government_builder_ranks WHERE builder_id >= $1', [B]);
+  await db.query('DELETE FROM builders WHERE id >= $1', [B]);
 };
 await cleanup();
-await pool.query(`INSERT INTO builders (id, github_login, display_name, status, system_role) VALUES
-  ($1,'gbmdb-x','Xenos','active',NULL),($2,'gbmdb-t','Thetes','active',NULL),
-  ($3,'gbmdb-m','Metic','active',NULL),($4,'gbmdb-a','Archon','active',NULL),
-  ($5,'gbmdb-gone','Deactivated Archon','inactive',NULL),
-  ($6,'gbmdb-bot','A Machine','active','bfg'),
-  ($7,'gbmdb-ops','Custom Ops','active',NULL)`,
-[ID.xenos, ID.thetes, ID.metic, ID.archon, ID.gone, ID.bot, ID.ops]);
-await pool.query(`INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES
+await insertTestBuilders(db, [
+  { id: ID.xenos, login: 'gbmdb-x', display_name: 'Xenos', status: 'active', system_role: null },
+  { id: ID.thetes, login: 'gbmdb-t', display_name: 'Thetes', status: 'active', system_role: null },
+  { id: ID.metic, login: 'gbmdb-m', display_name: 'Metic', status: 'active', system_role: null },
+  { id: ID.archon, login: 'gbmdb-a', display_name: 'Archon', status: 'active', system_role: null },
+  { id: ID.gone, login: 'gbmdb-gone', display_name: 'Deactivated Archon', status: 'inactive', system_role: null },
+  { id: ID.bot, login: 'gbmdb-bot', display_name: 'A Machine', status: 'active', system_role: 'bfg' },
+  { id: ID.ops, login: 'gbmdb-ops', display_name: 'Custom Ops', status: 'active', system_role: null },
+], { onConflict: '' });
+// The custom rank is a real government_ranks row: government_builder_ranks.rank_key is a
+// foreign key into it on a migrated database.
+await db.query("INSERT INTO government_ranks (rank_key, label) VALUES ('gbmdb-ops-rank', 'Custom Ops (test)')");
+await db.query(`INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES
   ($1,'xenos'),($2,'thetes'),($3,'metic'),($4,'archon'),($5,'archon'),($6,'archon'),($7,'gbmdb-ops-rank')`,
 [ID.xenos, ID.thetes, ID.metic, ID.archon, ID.gone, ID.bot, ID.ops]);
 
 const api = require(process.cwd() + '/src/module-api.js');
-api.pool.query = (...a) => pool.query(...a);
+api.pool.query = (...a) => db.query(...a);   // the library reads through the same transaction
 const { resolveBoardMembers, isBoardMember } = require(process.cwd() + '/modules/government/board-membership.js');
 
 const board = (membership) => ({ membership, pass_rule: 'consent', window_minutes: null, close_early_on_full_turnout: true });
@@ -120,13 +131,13 @@ await t('the deactivated and the machine are STILL excluded under the widened fo
 });
 
 await t('no duplicate rows when a builder matches through two keys', async () => {
-  await pool.query('INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES ($1, $2)', [ID.archon, 'gbmdb-ops-rank']);
+  await db.query('INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES ($1, $2)', [ID.archon, 'gbmdb-ops-rank']);
   try {
     const l = await logins('rank:archon,gbmdb-ops-rank');
     assert.deepEqual(l.filter((x) => x === 'a').length, 1,
       'DISTINCT holds — a double-counted member silently raises the consent bar');
   } finally {
-    await pool.query("DELETE FROM government_builder_ranks WHERE builder_id=$1 AND rank_key='gbmdb-ops-rank'", [ID.archon]);
+    await db.query("DELETE FROM government_builder_ranks WHERE builder_id=$1 AND rank_key='gbmdb-ops-rank'", [ID.archon]);
   }
 });
 
@@ -145,6 +156,8 @@ await t('an unparseable predicate still seats nobody against a real db', async (
 });
 
 await cleanup();
+await db.query('ROLLBACK');
+db.release();
 console.log(`\n${passed} passed, ${failed} failed`);
 await pool.end();
 process.exit(failed ? 1 : 0);