@bongos/core 1.21.177 → 1.21.179

package/tests/hall_street_desk.mjs

@@ -51,7 +51,7 @@ function board() {
 
 // ── a long-winded docket: every source, long words everywhere ─────────────────
 const LONG = 'The extraordinarily long-winded proposal to reorganise every single floor of the hall before winter';
-const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['gate_approvals', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
+const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
 function matter(over = {}) {
   return { id: 'blockers:1', source: 'blockers', building: 'planning', rule: 'majority', state: 'needs', title: 'A matter', short: 'a matter', where: 'Planning', opened_at: '2026-09-29T10:00:00.000Z', deadline: null, proposer: null, tally: null, href: null, ref: null, ...over };
 }
@@ -78,6 +78,9 @@ function longMatters() {
     }
   }
   out.push(matter({ id: 'board:900', source: 'board', building: 'planning', short: 'idea to ratify', title: LONG, state: 'needs' }));
+  // A second override waiting at Release: task 1004859 removed the gate-approval source that
+  // used to fill a Release floor, and the stress docket must still reach its 30 rows.
+  out.push(matter({ id: 'override_requests:901', source: 'override_requests', building: 'release', title: `${LONG} 901`, short: 'a matter with a very long short description', state: 'needs', ref: { id: 901 } }));
   return out;
 }
 const ROOM = { open: [{ id: '1', subject_type: 'constitutional_amendment', subject: { title: LONG, author_id: '7' }, votes: [] }, { id: '900', subject_type: 'full_idea', subject: { title: LONG }, votes: [] }], closed: [] };
@@ -176,7 +179,6 @@ test('a row\'s buttons are the card\'s acts under the board\'s words, and send t
     matter({ id: 'access_requests:11', source: 'access_requests', building: 'people', state: 'needs', proposer: { name: 'Ana Ruiz' }, ref: { id: 11 } }),
     matter({ id: 'goal_join_requests:12', source: 'goal_join_requests', building: 'people', state: 'needs', proposer: { name: 'Kai Mo' }, href: '/builders/goal/42', ref: { id: 12 } }),
     matter({ id: 'override_requests:13', source: 'override_requests', building: 'release', state: 'needs', ref: { id: 13 } }),
-    matter({ id: 'gate_approvals:14', source: 'gate_approvals', building: 'release', state: 'needs', ref: { id: 14 } }),
     matter({ id: 'board:1', source: 'board', building: 'charter', state: 'needs', ref: { type: 'board_item', id: '1' } }),
   ];
   const dk = docket(ms);
@@ -189,7 +191,6 @@ test('a row\'s buttons are the card\'s acts under the board\'s words, and send t
   const rel = D.rowsFor('release', 0, dk, { now: NOW });
   assert.deepEqual(rel[0].actions.map((a) => a.label), ['release', 'hold']);
   assert.equal(C.request(rel[0].card, 'release').url, '/api/bongos/override-requests/13/decide');
-  assert.equal(C.request(D.rowsFor('release', 5, dk, { now: NOW })[0].card, 'release').url, '/api/bongos/gate-approvals/14/approve');
   // a vote: yes and no, and the no's reason is a chip, never free text
   const vote = row('charter', 0);
   assert.deepEqual(vote.actions.map((a) => [a.key, a.label]), [['for', 'yes'], ['object', 'no']]);

package/tests/hall_street_inside.mjs

@@ -54,7 +54,7 @@ function proto(mode, st = {}) {
 function matter(over = {}) {
   return { id: 'blockers:1', source: 'blockers', building: 'planning', rule: 'majority', state: 'needs', title: 'A matter', short: 'a matter', where: 'Planning', opened_at: '2026-09-29T10:00:00.000Z', deadline: null, proposer: null, tally: null, href: null, ref: null, ...over };
 }
-const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['gate_approvals', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
+const SOURCES = [['board', 'charter'], ['blockers', 'planning'], ['access_requests', 'people'], ['goal_join_requests', 'people'], ['override_requests', 'release'], ['removal_proposals', 'disputes'], ['redteam_reports', 'disputes'], ['criteria_uat', 'review'], ['core_update', 'release'], ['autobongos_fence', 'automation'], ['module_rechecks', 'release'], ['grade_appeals', 'disputes'], ['standing_rules', 'rules'], ['treasury_spending', 'treasury']];
 const READINGS = [['flow', 'review'], ['promises', 'planning'], ['money', 'treasury'], ['people', 'people'], ['fairness', 'disputes'], ['rules', 'rules']];
 function docket(matters = [], over = {}) {
   const counts = { needs: 0, moving: 0, settled: 0 };

package/tests/helpers.mjs

@@ -1136,3 +1136,37 @@ export function fakeHttpsGet(routes) {
   };
   return { get, asked };
 }
+
+// insertTestBuilders — insert throwaway `builders` rows that satisfy the MIGRATED schema
+// (task 1004863). builders.github_id became NOT NULL + UNIQUE, and the database tests
+// that each hand-wrote `INSERT INTO builders (id, github_login, …)` broke on it at once,
+// unnoticed, because the lanes that ran them were weekly or absent. One spelling here
+// fixes the drift, not just the column: a future NOT NULL column is added in one place.
+//
+// `db` is anything with `query(text, params)` (a pg Pool, or a client inside a
+// transaction). Each row is `{ id, login, ...columns }`: `github_id` defaults to
+// `test-gh-<id>` (unique per id, never a real GitHub id) and `display_name` to the login;
+// any other builders column may be named (rank, status, system_role, total_credits …).
+// A column one row names and another does not is written as DEFAULT for the other, so
+// the table's own defaults still apply. Column names come from the caller's literal
+// fixtures, never from input. `onConflict` is appended verbatim (default
+// `ON CONFLICT (id) DO NOTHING`; pass '' for none). Returns the inserted rows.
+export async function insertTestBuilders(db, rows, { onConflict = 'ON CONFLICT (id) DO NOTHING' } = {}) {
+  if (!rows.length) return [];
+  const shaped = rows.map(({ id, login, ...rest }) => {
+    if (id == null || !login) throw new Error('insertTestBuilders: every row needs an id and a login');
+    return { id, github_id: `test-gh-${id}`, github_login: login, display_name: login, ...rest };
+  });
+  const cols = [...new Set(shaped.flatMap((r) => Object.keys(r)))];
+  const params = [];
+  const tuples = shaped.map((r) => `(${cols.map((c) => {
+    if (!(c in r)) return 'DEFAULT';
+    params.push(r[c]);
+    return `$${params.length}`;
+  }).join(', ')})`);
+  const { rows: out } = await db.query(
+    `INSERT INTO builders (${cols.map((c) => `"${c}"`).join(', ')}) VALUES ${tuples.join(', ')} ${onConflict} RETURNING *`,
+    params,
+  );
+  return out;
+}

package/tests/howto_state.mjs

@@ -1,11 +1,16 @@
 // tests/howto_state.mjs — per-person read/unread state for the how-to steps (task 1004634)
 //
-// Two halves. The DB-free half drives howto-state.js against an in-memory pool that
-// honours the three statements it issues, so the contract runs everywhere: unread by
-// default, mark read, skip all, a read upgrades a skip (never the reverse), the first
-// read time is kept, reset some or all, and an id the guide does not name is refused.
-// The DB half applies the real migration and runs the same calls against Postgres; it
-// skips when no Postgres is reachable (DATABASE_URL), like copy_desk_flags_db.mjs.
+// The DB-free half. It drives howto-state.js against an in-memory pool that honours the
+// three statements it issues, so the contract runs everywhere: unread by default, mark
+// read, skip all, a read upgrades a skip (never the reverse), the first read time is
+// kept, reset some or all, and an id the guide does not name is refused.
+//
+// The SAME contract runs against Postgres in tests/howto_state_db.mjs, which imports
+// `contract` from here (task 1004863). That half used to live in this file, where it ran
+// in the DB-free unit lane against whatever database DATABASE_URL reached — creating a
+// stand-in `builders` table there if one was missing — and skipped in CI, so no lane
+// ever ran it. Split out, it is in the integration lane and uses the migrated schema.
+// The tests below run only when this file is the entry point, so importing it runs none.
 //
 // Run:  node tests/howto_state.mjs
 
@@ -60,7 +65,8 @@ function fakePool() {
   };
 }
 
-async function contract(label, deps, A, B) {
+// `test` is the caller's runner, so each file counts and reports its own cases.
+export async function contract(test, label, deps, A, B) {
   const first = guide.STEPS[0].id;
   const second = guide.STEPS[1].id;
 
@@ -126,53 +132,24 @@ async function contract(label, deps, A, B) {
   });
 }
 
-await test('shapeState ignores a stored mark for a step the guide no longer has', async () => {
-  const s = hs.shapeState([{ step_id: 'retired_step', how: 'read', read_at: new Date() }]);
-  assert.equal(s.read, 0);
-  assert.equal(s.total, guide.STEPS.length);
-});
-
-await test('the module declares its migration and the routes are mounted', async () => {
-  const mod = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/onboarding/module.json'), 'utf8'));
-  assert.equal(mod.contributes.migrations, true);
-  assert.ok(fs.existsSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql')));
-  const src = fs.readFileSync(path.join(ROOT, 'modules/onboarding/routes/onboarding.js'), 'utf8');
-  for (const r of ["router.get('/me/howto'", "router.post('/me/howto/read'", "router.post('/me/howto/reset'"]) assert.ok(src.includes(r), r);
-});
-
-await contract('in-memory', { pool: fakePool() }, 1, 2);
-
-// ── the real database ────────────────────────────────────────────────────────
-const { Pool } = require('pg');
-const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
-let dbUp = true;
-try { await pool.query('SELECT 1'); } catch (e) {
-  dbUp = false;
-  console.log(`  (db half SKIPPED — no reachable Postgres: ${e.code || e.message}. Set DATABASE_URL to run.)`);
-}
-if (dbUp) {
-  await pool.query(`
-    CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
-    CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text);
-  `);
-  await pool.query(fs.readFileSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql'), 'utf8'));
-  await pool.query(fs.readFileSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql'), 'utf8')); // idempotent
-  const A = 910000001;
-  const B = 910000002;
-  await pool.query('INSERT INTO builders (id, github_login) VALUES ($1, $2), ($3, $4) ON CONFLICT (id) DO NOTHING', [A, 'howto-a', B, 'howto-b']);
-  await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]);
-  try {
-    await contract('postgres', { pool }, A, B);
-    await test('postgres: the CHECK refuses a malformed step id and a bad how', async () => {
-      await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id) VALUES ($1, 'Bad Id')", [A]));
-      await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id, how) VALUES ($1, 'welcome', 'seen')", [A]));
-    });
-  } finally {
-    await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]).catch(() => {});
-    await pool.query('DELETE FROM builders WHERE id IN ($1, $2)', [A, B]).catch(() => {});
-  }
-}
-await pool.end().catch(() => {});
+const isMain = Boolean(process.argv[1]) && fs.realpathSync(url.fileURLToPath(import.meta.url)) === fs.realpathSync(path.resolve(process.argv[1]));
+if (isMain) {
+  await test('shapeState ignores a stored mark for a step the guide no longer has', async () => {
+    const s = hs.shapeState([{ step_id: 'retired_step', how: 'read', read_at: new Date() }]);
+    assert.equal(s.read, 0);
+    assert.equal(s.total, guide.STEPS.length);
+  });
 
-console.log(`\n${passed} passed, ${failed} failed`);
-if (failed) process.exit(1);
+  await test('the module declares its migration and the routes are mounted', async () => {
+    const mod = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/onboarding/module.json'), 'utf8'));
+    assert.equal(mod.contributes.migrations, true);
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql')));
+    const src = fs.readFileSync(path.join(ROOT, 'modules/onboarding/routes/onboarding.js'), 'utf8');
+    for (const r of ["router.get('/me/howto'", "router.post('/me/howto/read'", "router.post('/me/howto/reset'"]) assert.ok(src.includes(r), r);
+  });
+
+  await contract(test, 'in-memory', { pool: fakePool() }, 1, 2);
+
+  console.log(`\n${passed} passed, ${failed} failed`);
+  if (failed) process.exit(1);
+}

package/tests/howto_state_db.mjs

@@ -0,0 +1,68 @@
+// tests/howto_state_db.mjs — the how-to read/unread contract against a REAL Postgres
+// (task 1004634; split out of tests/howto_state.mjs by task 1004863).
+//
+// tests/howto_state.mjs runs the contract against an in-memory pool in the DB-free unit
+// lane. This runs the SAME contract (imported, not copied) against the real migration
+// and the real CHECK constraints, in the integration lane (run-unit-tests.js INTEGRATION).
+// It used to be the second half of that file, where it ran in the unit lane against
+// whatever DATABASE_URL reached, created a stand-in `builders` table there if one was
+// missing, and skipped in CI — so no lane ever executed it, and it broke unnoticed when
+// builders.github_id became NOT NULL.
+//
+// Needs a MIGRATED database (scripts/migrate.sh). SKIPS (exit 0) with no reachable
+// Postgres, like every *_db test.
+//
+// Run:  DATABASE_URL=postgres://... node tests/howto_state_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+import { contract } from './howto_state.mjs';
+import { insertTestBuilders } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
+const { Pool } = require('pg');
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`howto_state_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/onboarding/migrations/onboarding_001_howto_reads.sql'), 'utf8');
+await test('postgres: the migration re-applies cleanly over the migrated schema (idempotent)', async () => {
+  await pool.query(MIGRATION);
+  await pool.query(MIGRATION);
+});
+
+const A = 910000101;
+const B = 910000102;
+await insertTestBuilders(pool, [{ id: A, login: 'howto-a' }, { id: B, login: 'howto-b' }]);
+await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]);
+try {
+  await contract(test, 'postgres', { pool }, A, B);
+  await test('postgres: the CHECK refuses a malformed step id and a bad how', async () => {
+    await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id) VALUES ($1, 'Bad Id')", [A]), (e) => e.code === '23514');
+    await assert.rejects(pool.query("INSERT INTO onboarding_howto_reads (builder_id, step_id, how) VALUES ($1, 'welcome', 'seen')", [A]), (e) => e.code === '23514');
+  });
+} finally {
+  await pool.query('DELETE FROM onboarding_howto_reads WHERE builder_id IN ($1, $2)', [A, B]).catch(() => {});
+  await pool.query('DELETE FROM builders WHERE id IN ($1, $2)', [A, B]).catch(() => {});
+  await pool.end().catch(() => {});
+}
+
+console.log(`\nhowto_state_db: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/idea_credit_streams_db.mjs

@@ -133,13 +133,21 @@ async function fixture(client, { completeness = 70, developed = false, taskCount
     idea_id: idea.id,
     grade: 'full',
     completeness_score: completeness,
-    ...(developer ? { developed_by: developer.id } : {}),
+    // developed_by and developed_at travel as a pair (ideas_grades_developed_pair_chk).
+    ...(developer ? { developed_by: developer.id, developed_at: new Date() } : {}),
+  });
+  // status is named, not placeholder-filled: versions_status_check admits only the
+  // lifecycle values, and 'building' is the one with no uniqueness rule of its own
+  // (versions_one_planning_idx allows exactly one 'planning' row, which the seeds own).
+  const version = await insertRow(client, 'versions', {
+    id: `IC6-${Date.now()}-${Math.random()}`.slice(0, 40), status: 'building',
   });
-  const version = await insertRow(client, 'versions', { id: `IC6-${Date.now()}-${Math.random()}`.slice(0, 40) });
   const tasks = [];
   for (let i = 0; i < taskCount; i++) {
     const task = await insertRow(client, 'tasks', {
-      version_id: version.id, title: `ic6 task ${i + 1}`, status: 'shipped',
+      // discipline is named for the same reason as the version status above:
+      // tasks_discipline_check admits only the live crafts.
+      version_id: version.id, title: `ic6 task ${i + 1}`, status: 'shipped', discipline: 'engineer',
     });
     await insertRow(client, 'ideas_task_lineage', {
       task_id: task.id, idea_id: idea.id, origin: 'promote',

package/tests/integration_parked_ratchet.mjs

@@ -51,7 +51,13 @@ const { INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING } = require('../scripts/b
 // LOWERED 11 → 6 by task 1004861: claim_gate_open_blocker, claim_gate_rebase,
 // clawback_confirmed_backlog, needs_rebase and reward_mode_cost_plus_only stopped adding a
 // second 'planning' version (and had three stale fixtures under it repaired).
-const MAX_PARKED = 6;
+// LOWERED 6 → 1 by task 1004863: acclaim_feed_evidence_db, copy_desk_flags_db,
+// government_board_membership_db, idea_credit_streams_db and session_earnings_mirror_db had
+// stale fixtures (a missing builders.github_id, retired status/discipline values, a sliced
+// copy of a route's SQL); repaired, they gate again.
+// LOWERED 1 → 0: status-probe, the last entry, was deleted with its test by task 1004858.
+// Nothing is parked; a new entry now needs this raised, deliberately.
+const MAX_PARKED = 0;
 
 // The one test that proves the PUBLISHED package works end to end: packaged, installed into
 // a consumer, installed again from its own shipped lockfile, migrated onto EMPTY databases,

package/tests/nav_permission_atoms.mjs

@@ -93,7 +93,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // says a held core version was tried and rolled back; task 1004731: the one-time
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
 // task 1004846: the new logo (its bump landed late, in task 1004852).
-const SHELL_SHA = 'bf052d6fabeb1953';
+const SHELL_SHA = '670b2f71085c13b6';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/page_notes_db.mjs

@@ -10,6 +10,7 @@ import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { insertTestBuilders } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
@@ -42,15 +43,15 @@ async function refuses(sql, params, constraint) {
   throw new Error(`expected ${constraint || 'a refusal'}, but the write landed`);
 }
 
-await pool.query(`
-  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
-  CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text, display_name text);
-  CREATE TABLE IF NOT EXISTS idea_inbox (id bigserial PRIMARY KEY, title text, status text);
-`);
+// Needs a MIGRATED database (the integration lane's). The stand-in builders /
+// idea_inbox tables this once created drifted from the schema (builders.github_id
+// became NOT NULL) and are gone (task 1004863).
 const A = 910000001;
 const B = 910000002;
-await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES ($1,$2,$3),($4,$5,$6) ON CONFLICT (id) DO NOTHING',
-  [A, 'pntest-a', 'Page Notes Test A', B, 'pntest-b', '']);
+await insertTestBuilders(pool, [
+  { id: A, login: 'pntest-a', display_name: 'Page Notes Test A' },
+  { id: B, login: 'pntest-b', display_name: '' },
+]);
 
 const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/page-notes/migrations/page_notes_001_notes.sql'), 'utf8');
 await pool.query(MIGRATION);
@@ -137,7 +138,6 @@ await test('deleting a doc takes its images with it', async () => {
 });
 
 await clean();
-await pool.query('DELETE FROM builders WHERE id = ANY($1::bigint[])', [[A, B]]).catch(() => {});
 await test('THE SITE LIST (task 1004499): one surface, submitted only, newest first, read through its own index', async () => {
   await pool.query(MIGRATION_2);
   const mk = async (author, page, at) => {
@@ -162,6 +162,10 @@ await test('THE SITE LIST (task 1004499): one surface, submitted only, newest fi
   await clean();
 });
 
+// The builders go LAST (task 1004863): the site-list case above writes notes authored
+// by A and B, and page_notes_docs.author_id is a foreign key into builders.
+await clean();
+await pool.query('DELETE FROM builders WHERE id = ANY($1::bigint[])', [[A, B]]).catch(() => {});
 await pool.end();
 console.log(`page_notes_db: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/page_tweak_no_rearm.mjs

@@ -0,0 +1,50 @@
+// tests/page_tweak_no_rearm.mjs — a page tweak held for its artist is never
+// re-armed for auto-merge from outside github-push (task 1004859).
+//
+// WHY. ADR 0341 D7 holds a page tweak until its artist signs it off. The one
+// caller that could re-arm auto-merge on an open PR was the hall's gate-approval
+// route (POST /gate-approvals/:pr/approve → recheckPullRequest), and
+// tests/gate_approvals.mjs "layer 3" pinned that it passed { arm: false } for a
+// held tweak. Task 1004859 deleted that route with the dead held-PR list. The
+// guarantee now rests on there being NO other caller, so this pins that: a
+// new caller of recheckPullRequest must come with its own held-tweak check
+// and its own test, and this file is where it gets noticed.
+//
+// DB-free, no network. Run: node --test tests/page_tweak_no_rearm.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const OWNER = 'modules/lifecycle/github-push.js';
+
+// Code only: a comment naming the function is not a call.
+const stripComments = (src) => src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+
+function callers(files, read) {
+  return files.filter((f) => f !== OWNER && /recheckPullRequest\s*\(/.test(stripComments(read(f))));
+}
+
+test('nothing outside github-push calls recheckPullRequest (the only re-arm path was the removed gate route)', () => {
+  const files = execFileSync('git', ['ls-files', 'src', 'modules', 'scripts'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').filter((f) => /\.(c|m)?js$/.test(f) && !/\/tests?\//.test(f));
+  assert.ok(files.length > 500, `only ${files.length} files scanned — the sweep is not reading the tree`);
+  const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
+  assert.deepEqual(callers(files, read), [],
+    'a new caller re-arms auto-merge on an open PR: it must check heldForArtistFailClosed for the PR\'s task '
+    + 'and pass { arm: false } when held (ADR 0341 D7), with a test, then be listed here');
+  assert.ok(!fs.existsSync(path.join(ROOT, 'modules/lifecycle/routes/gate-approvals.js')), 'the gate route stays removed');
+});
+
+test('the sweep would catch a caller (counterfactual), and ignores one in a comment', () => {
+  const fake = {
+    'modules/x/a.js': 'await githubPush.recheckPullRequest({ number: 1 });',
+    'modules/x/b.js': '// recheckPullRequest(...) is described here only',
+    [OWNER]: 'async function recheckPullRequest() {}',
+  };
+  assert.deepEqual(callers(Object.keys(fake), (f) => fake[f]), ['modules/x/a.js']);
+});

package/tests/publish_manifest.mjs

@@ -22,6 +22,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { execFileSync } from 'node:child_process';
 
 const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
@@ -324,5 +325,68 @@ t('no publishable test statically imports an excluded module (R89 boundary)', ()
   assert.equal(offenders.length, 0, '\n        ' + offenders.join('\n        '));
 });
 
+// ── hall-preview fixtures stay out of the core; the harness stays in (task 1004888) ──
+// scripts/hall-preview/fixtures/ is ~2.4 MB of captured hall data from THIS instance
+// (owner login, world name, prior instance name). INSTANCE_EXCLUDE keeps it out of the
+// published core (task 1002219, audit H5); this pins that, so an edit to the exclude
+// list cannot silently start shipping the fixtures to every hosted project again.
+// The selection is built the way package-core builds it: enumerate the git tree
+// (`git ls-tree -r` on a ref) and keep what isPublishable() admits.
+const HALL_PREVIEW = 'scripts/hall-preview/';
+const HALL_FIXTURES = `${HALL_PREVIEW}fixtures/`;
+// The harness files the preview cannot boot without: the server and its two local
+// requires (./live-identity, ./pref-writes). A named floor, so the check below can
+// never pass by finding no harness at all.
+const HALL_HARNESS_FLOOR = ['server.js', 'live-identity.js', 'pref-writes.js'].map((f) => HALL_PREVIEW + f);
+
+function treeFiles() {
+  // package-core's ref path: every blob on HEAD. A core checkout with no git history
+  // (a consumer's vendored core) falls back to walking the disk, as --from-worktree does.
+  try {
+    const out = execFileSync('git', ['ls-tree', '-r', '--name-only', 'HEAD'], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 });
+    return out.split('\n').filter(Boolean);
+  } catch (_) {
+    const files = [];
+    const walk = (rel) => {
+      for (const ent of fs.readdirSync(path.join(ROOT, rel), { withFileTypes: true })) {
+        const r = rel ? `${rel}/${ent.name}` : ent.name;
+        if (ent.isDirectory()) walk(r); else files.push(r);
+      }
+    };
+    if (fs.existsSync(path.join(ROOT, HALL_PREVIEW))) walk(HALL_PREVIEW.slice(0, -1));
+    return files;
+  }
+}
+
+t('hall-preview fixtures are excluded from the core (path rule, task 1004888)', () => {
+  // Holds even where the fixtures are not on disk (a consumer core never has them).
+  for (const p of [`${HALL_FIXTURES}me.json`, `${HALL_FIXTURES}nested/deep.json`, `${HALL_FIXTURES}tasks.json`]) {
+    assert.equal(isPublishable(p), false, `${p} would ship in the published core — keep '${HALL_FIXTURES}' in INSTANCE_EXCLUDE`);
+  }
+  for (const p of HALL_HARNESS_FLOOR) {
+    assert.equal(isPublishable(p), true, `${p} is the preview harness and must still publish`);
+  }
+});
+
+t('the package-core selection carries no hall-preview fixture, but keeps the harness (task 1004888)', () => {
+  const hall = treeFiles().filter((f) => f.startsWith(HALL_PREVIEW));
+  const fixtures = hall.filter((f) => f.startsWith(HALL_FIXTURES));
+  const harness = hall.filter((f) => !f.startsWith(HALL_FIXTURES));
+  const { publish } = partitionPaths(hall);
+  const leaked = publish.filter((f) => f.startsWith(HALL_FIXTURES));
+  assert.equal(leaked.length, 0, `${leaked.length} hall-preview fixture(s) would ship in the core, e.g. ${leaked.slice(0, 3).join(', ')} — keep '${HALL_FIXTURES}' in INSTANCE_EXCLUDE`);
+  // Every harness file on the tree publishes, and the named floor is among them
+  // whenever the harness exists here at all (the source repo always has it).
+  const dropped = harness.filter((f) => !publish.includes(f));
+  assert.equal(dropped.length, 0, `hall-preview harness file(s) dropped from the core: ${dropped.join(', ')}`);
+  if (harness.length) {
+    for (const p of HALL_HARNESS_FLOOR) assert.ok(publish.includes(p), `${p} missing from the core selection`);
+  }
+  // Non-vacuous in the source repo: the fixtures are there to be excluded.
+  if (fs.existsSync(path.join(ROOT, HALL_FIXTURES))) {
+    assert.ok(fixtures.length > 0, `found ${HALL_FIXTURES} on disk but no fixture in the enumerated tree — the enumeration is broken, so this check proves nothing`);
+  }
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/search_isolation.mjs

@@ -14,15 +14,13 @@
 //      to searchChunks and IGNORES any attempt to widen scope via the body
 //      (builder_id / rank / min_rank / owner_builder_id). This is the
 //      "can't be tricked" proof.
-//   C. DB-backed (auto-SKIPS without a reachable Postgres): seeds rank-gated +
-//      owner-scoped chunks and runs the REAL searchChunks in a ROLLED-BACK
-//      transaction for the done-when cases (xenos-vs-protected, cross-builder
-//      memory, owner-sees-own). The same cases were also proven against the prod
-//      DB in a rolled-back transaction at ship time (the authoritative evidence).
+//   C. DB-backed: lives in tests/search_isolation_db.mjs (task 1004863). It was
+//      the third layer of this file, whose comment said it ran in the integration
+//      gate — but this file was never in that set, so in CI Layer C always skipped
+//      and no lane executed it. Split out, it is in the INTEGRATION set, and A + B
+//      stay here in the DB-free unit lane.
 //
 // Run:  node tests/search_isolation.mjs
-//   (Layer C runs only where a Postgres is reachable — the integration gate / any
-//    machine with one; it skips cleanly otherwise so the DB-free unit gate stays green.)
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -136,102 +134,6 @@ try {
   search.searchChunks = orig.searchChunks;
 }
 
-// ---------------------------------------------------------------------------
-// Layer C — DB-backed real-query scoping (auto-skips without Postgres)
-// ---------------------------------------------------------------------------
-console.log('\nLayer C — real searchChunks against a live DB (skips if unreachable):');
-
-let pool = null;
-try {
-  // task 1003207: this said `../src/db`, which has not existed since the kernel
-  // carve — so the require ALWAYS threw, pool stayed null, and Layer C skipped
-  // even against a live Postgres. It was a dead layer reporting as a skip.
-  ({ pool } = require('../src/bongos/pool'));
-} catch { pool = null; }
-
-async function dbReachable() {
-  if (!pool) return null;
-  try {
-    const c = await pool.connect();
-    try { await c.query('SELECT 1'); return c; } catch { c.release(); return null; }
-  } catch { return null; }
-}
-
-const client = await dbReachable();
-if (!client) {
-  console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / wherever a Postgres is reachable.');
-  console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
-  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
-  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
-  // still closing from its failed connect — and the process.exit() at the bottom of
-  // this file then tore down the loop underneath them. On Windows that surfaces as
-  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
-  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
-  // a failing suite in the unit gate while every assertion actually passed.
-  if (pool) await pool.end().catch(() => {});
-} else {
-  try {
-    await client.query('BEGIN');
-    await client.query(`SET LOCAL pg_trgm.word_similarity_threshold = ${search.TRGM_THRESHOLD}`);
-    // builder 1 exists (example-owner); seed a protected (metic) chunk, a public one,
-    // and a chunk owned by builder 1 — all matching q='enforcement'.
-    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
-      ('doc','__iso__/protected.md',0,'p','PROT','trust boundary permission core enforcement','metic',NULL,'i1'),
-      ('doc','__iso__/public.md',0,'pub','PUB','trust boundary public enforcement overview','xenos',NULL,'i2'),
-      ('db','__iso__/memory:1',0,'m','MEM1','builder one private enforcement memo','xenos',1,'i3')`);
-
-    const titles = (rows) => rows.map((r) => r.title).sort().join(',');
-
-    await t('xenos caller sees the public chunk but NOT the metic-protected one (xenos-vs-protected)', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 2, builderRank: 'xenos', limit: 50 }, { client });
-      const ts = titles(rows);
-      assert.ok(ts.includes('PUB'), `expected PUB, got [${ts}]`);
-      assert.ok(!ts.includes('PROT'), `xenos must NOT see the metic chunk, got [${ts}]`);
-    });
-
-    await t('metic caller sees the protected chunk too', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 2, builderRank: 'metic', limit: 50 }, { client });
-      const ts = titles(rows);
-      assert.ok(ts.includes('PROT') && ts.includes('PUB'), `metic should see PROT+PUB, got [${ts}]`);
-    });
-
-    await t('builder 2 does NOT see builder 1\'s owned chunk (cross-builder memory)', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 2, builderRank: 'archon', limit: 50 }, { client });
-      assert.ok(!rows.some((r) => r.title === 'MEM1'), 'an Archon STILL must not see another builder\'s private chunk');
-    });
-
-    await t('builder 1 DOES see their own owned chunk (owner-sees-own)', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 1, builderRank: 'xenos', limit: 50 }, { client });
-      assert.ok(rows.some((r) => r.title === 'MEM1'), 'a builder must see their own private chunk');
-    });
-
-    // The public port (task 1002534, ADR 0367): the Discord #support answerer
-    // has no session, so its scope is fixed — shared xenos docs on the
-    // allowlist, nothing else, whatever matches the query.
-    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
-      ('doc','__pub__/allowed/guide.md',0,'g','PUBOK','support enforcement guide','xenos',NULL,'p1'),
-      ('doc','__pub__/allowed/locked.md',0,'l','PUBMETIC','support enforcement locked','metic',NULL,'p2'),
-      ('doc','__pub__/allowed/mine.md',0,'m','PUBOWNED','support enforcement owned','xenos',1,'p3'),
-      ('db','__pub__/allowed/task:1',0,'d','PUBDB','support enforcement task prose','xenos',NULL,'p4'),
-      ('doc','__pub__/elsewhere.md',0,'e','PUBOFFLIST','support enforcement off the list','xenos',NULL,'p5')`);
-
-    await t('searchPublicDocs returns ONLY a shared xenos doc on the allowlist (no metic, owned, db, or off-list row)', async () => {
-      const rows = await search.searchPublicDocs({ q: 'support enforcement', refs: ['__pub__/allowed/'], limit: 10 }, { client });
-      const ts = titles(rows);
-      assert.equal(ts, 'PUBOK', `expected only PUBOK, got [${ts}]`);
-      assert.ok(rows[0].body.includes('support enforcement guide'), 'the body comes back with the hit');
-    });
-
-    await t('searchPublicDocs with no allowlist returns nothing at all', async () => {
-      assert.deepEqual(await search.searchPublicDocs({ q: 'support enforcement', refs: [] }, { client }), []);
-    });
-  } finally {
-    await client.query('ROLLBACK').catch(() => {});
-    client.release();
-    await pool.end().catch(() => {});
-  }
-}
-
 console.log(`\n${passed} passed, ${failed} failed`);
 // EXIT CODE, NOT process.exit() (task 1003848). A hard exit tears the event loop down
 // underneath any handle that is still closing — and pg leaves one behind after a