@bongos/core 1.21.4 → 1.21.6

package/tests/autonomy_config_idle.mjs

@@ -0,0 +1,272 @@
+// tests/autonomy_config_idle.mjs — idle on a setting is not idle on no work
+// (task 1004539).
+//
+// The incident: ten hours fenced with no_builder_scope while the hall said
+// "alive, waiting for work". These pin the done-when: runner health reports a
+// configuration idle as NOT ok with the fix, the owner's kill switch does not,
+// and the Discord notice is said once per change rather than once per loop.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ci = require('../modules/autonomy/config-idle.js');
+const { describeRunner } = require('../modules/autonomy/runner-health.js');
+const runner = require('../scripts/gds/autobongos-run.js');
+
+const NOW = Date.parse('2026-10-02T09:47:00.000Z');
+const agoS = (s) => new Date(NOW - s * 1000).toISOString();
+const hb = (over = {}) => ({ host: 'winbox', mode: 'full', last_seen_at: agoS(30), ...over });
+
+// ── runner health: the hall's verdict ───────────────────────────────────────
+
+test('a runner idle on no_builder_scope is NOT ok, and the hall gets the fix', () => {
+  const d = describeRunner(hb({ last_event: 'config_idle:no_builder_scope' }), { nowMs: NOW });
+  assert.equal(d.state, 'idle_config');
+  assert.equal(d.ok, false, 'the incident: this read ok=true for ten hours');
+  assert.equal(d.idleCode, 'no_builder_scope');
+  assert.match(d.remedy, /Settings/);
+  assert.match(d.detail, /no goals are picked/);
+  assert.match(d.detail, /winbox/);
+});
+
+test('every configuration code reads not-ok with its own remedy', () => {
+  for (const code of Object.keys(ci.CONFIG_IDLE)) {
+    const d = describeRunner(hb({ last_event: `config_idle:${code}` }), { nowMs: NOW });
+    assert.equal(d.ok, false, code);
+    assert.equal(d.remedy, ci.CONFIG_IDLE[code].remedy, code);
+  }
+});
+
+test('a config-idle runner that goes quiet past the dead line is DEAD, not idle', () => {
+  // A dead runner cannot report its configuration; silence still wins.
+  const d = describeRunner(hb({ last_event: 'config_idle:no_builder_scope', last_seen_at: agoS(3 * 3600) }), { nowMs: NOW });
+  assert.equal(d.state, 'dead');
+});
+
+test('the kill switch, a plain wait and an unknown code stay ok', () => {
+  for (const last_event of ['fenced', 'waiting', 'nothing_claimable', 'hold', 'config_idle:kill_switch', 'config_idle:<b>x</b>']) {
+    const d = describeRunner(hb({ last_event }), { nowMs: NOW });
+    assert.equal(d.state, 'alive', last_event);
+    assert.equal(d.ok, true, last_event);
+    assert.equal(d.remedy, undefined, last_event);
+  }
+});
+
+// ── the runner side: which rows count, and the grace ────────────────────────
+
+test('configIdleCode: configuration refusals count; deliberate stops and no-work do not', () => {
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'no_builder_scope' }), 'no_builder_scope');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'no_allowlist' }), 'no_allowlist');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'fence_unreadable' }), 'fence_unreadable');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'goal_not_allowlisted', refused_goals: [7] }), 'goal_not_allowlisted');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'goal_not_allowlisted', task_id: 5 }), null, 'one task outside the allowlist is the fence working');
+  assert.equal(ci.configIdleCode({ event: 'hold', unknown: true, reason: 'no gauge file' }), 'gauge_unknown');
+  for (const row of [
+    { event: 'fenced', code: 'kill_switch' },
+    { event: 'fenced', code: 'builder_paused' },
+    { event: 'fenced', code: 'not_permitted' },
+    { event: 'fenced', code: 'protected_path', task_id: 3 },
+    { event: 'hold', unknown: false, sleep_until: 1 },
+    { event: 'hold', unknown: false, usage_limit: true },
+    { event: 'nothing_claimable' },
+    null,
+  ]) assert.equal(ci.configIdleCode(row), null, JSON.stringify(row));
+});
+
+test('the grace: nothing is said until the stretch has held for it', () => {
+  const t0 = NOW;
+  let tr = ci.trackIdle(null, { event: 'fenced', code: 'no_builder_scope' }, t0);
+  assert.equal(ci.idleEvent(tr, t0 + (ci.GRACE_S - 1) * 1000), null);
+  tr = ci.trackIdle(tr, { event: 'fenced', code: 'no_builder_scope' }, t0 + 600_000);
+  assert.equal(tr.sinceMs, t0, 'the same code continues the stretch');
+  assert.equal(ci.idleEvent(tr, t0 + ci.GRACE_S * 1000), 'config_idle:no_builder_scope');
+  // A blip-prone code waits longer.
+  const fu = ci.trackIdle(null, { event: 'fenced', code: 'fence_unreadable' }, t0);
+  assert.equal(ci.idleEvent(fu, t0 + ci.GRACE_S * 1000), null);
+  assert.equal(ci.idleEvent(fu, t0 + ci.LONG_GRACE_S * 1000), 'config_idle:fence_unreadable');
+  // A different code restarts the clock; any other row ends it.
+  assert.equal(ci.trackIdle(tr, { event: 'fenced', code: 'no_allowlist' }, t0 + 1).sinceMs, t0 + 1);
+  assert.equal(ci.trackIdle(tr, { event: 'fenced', code: 'kill_switch' }, t0 + 1), null);
+  assert.equal(ci.trackIdle(tr, { event: 'nothing_claimable' }, t0 + 1), null);
+});
+
+test('markBeat leaves a working, booting or exiting beat alone', () => {
+  const tr = { code: 'no_builder_scope', sinceMs: NOW - 3600_000 };
+  assert.equal(ci.markBeat({ last_event: 'waiting' }, tr, NOW).last_event, 'config_idle:no_builder_scope');
+  assert.equal(ci.markBeat({ last_event: 'loop', mode: 'full' }, tr, NOW).mode, 'full');
+  assert.equal(ci.markBeat({ last_event: 'worked', working_task_id: 9 }, tr, NOW).last_event, 'worked');
+  assert.equal(ci.markBeat({ last_event: 'boot' }, tr, NOW).last_event, 'boot');
+  assert.equal(ci.markBeat({ last_event: 'upgrade_exit' }, tr, NOW).last_event, 'upgrade_exit');
+  assert.equal(ci.markBeat({ last_event: 'waiting' }, null, NOW).last_event, 'waiting');
+});
+
+test('THE LOOP: a runner fenced on no_builder_scope says so on its heartbeat once the grace has passed', async () => {
+  // Driven through the real forever(), so the beat override is wired, not just written.
+  let clock = NOW;
+  const beats = [];
+  const deps = {
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true, leftover: 0 }),
+    iteration: async () => ({ event: 'fenced', code: 'no_builder_scope', reason: 'r' }),
+    waitOrJump: async (waitS, d) => { clock += 10 * 60_000; await d.beat({ last_event: 'waiting' }); return { waited: waitS, jumped: false }; },
+    record: (r) => r,
+    emit: () => {},
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields.last_event); return true; },
+    codeDrifted: async () => false,
+    loadedHead: async () => null,
+    now: () => clock,
+  };
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 4 }, deps);
+  assert.equal(beats[0], 'boot');
+  // The first loop is inside the grace: pending, which the hall reads as a fence wait.
+  assert.equal(beats[1], 'loop');
+  assert.equal(beats[2], 'config_pending:no_builder_scope');
+  assert.equal(describeRunner(hb({ last_event: beats[2] }), { nowMs: NOW }).ok, true, 'inside the grace is not an alert');
+  assert.ok(beats.includes('config_idle:no_builder_scope'), `beats: ${beats.join(',')}`);
+  assert.equal(beats[beats.length - 1], 'config_idle:no_builder_scope', 'and keeps saying it while it holds');
+});
+
+test('THE LOOP: the kill switch never turns into a config_idle beat', async () => {
+  let clock = NOW;
+  const beats = [];
+  const deps = {
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true, leftover: 0 }),
+    iteration: async () => ({ event: 'fenced', code: 'kill_switch', reason: 'r' }),
+    waitOrJump: async (waitS, d) => { clock += 60 * 60_000; await d.beat({ last_event: 'waiting' }); return { waited: waitS, jumped: false }; },
+    record: (r) => r, emit: () => {},
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields.last_event); return true; },
+    codeDrifted: async () => false, loadedHead: async () => null, now: () => clock,
+  };
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 4 }, deps);
+  assert.ok(!beats.some((b) => String(b).startsWith('config_idle:')), beats.join(','));
+});
+
+// ── the notice: once per change ─────────────────────────────────────────────
+
+test('the Discord notice is DE-DUPLICATED: once when it starts, once when it clears', async () => {
+  const posts = [];
+  const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+  const beat = (lastEvent, extra = {}) => n.observe({ builderId: '3', host: 'WinBox', lastEvent, ...extra });
+
+  await beat('waiting');
+  assert.equal(posts.length, 0, 'quiet idle says nothing');
+  for (let i = 0; i < 30; i++) await beat('config_idle:no_builder_scope');
+  // A runner restart mid-stretch: boot, then the same setting pending again.
+  for (const e of ['loop', 'waiting', 'upgrade_exit', 'boot', 'loop', 'config_pending:no_builder_scope', 'waiting']) await beat(e);
+  await beat('config_idle:no_builder_scope');
+  assert.equal(posts.length, 1, 'thirty beats and a restart are one notice');
+  assert.match(posts[0].text, /no goals are picked/);
+  assert.match(posts[0].text, /Settings/);
+  assert.equal(posts[0].channel, 'ship_news');
+
+  await beat('config_idle:no_allowlist');
+  assert.equal(posts.length, 2, 'a different cause is a new notice');
+  await beat('nothing_claimable');
+  assert.equal(posts.length, 3, 'clearing is said once');
+  assert.match(posts[2].text, /no longer held/);
+  assert.match(posts[2].text, /no goal is allowed/, 'the clear names the setting in words');
+  for (const p of posts) assert.doesNotMatch(p.text, /no_allowlist|no_builder_scope/, 'never a raw code in a sentence a person reads');
+  await beat('nothing_claimable');
+  await beat('waiting');
+  assert.equal(posts.length, 3);
+});
+
+test('the kill switch never posts, and a working beat clears a notice', async () => {
+  const posts = [];
+  const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'fenced' });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:kill_switch' });
+  assert.equal(posts.length, 0);
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'loop', workingTaskId: 42 });
+  assert.equal(posts.length, 2);
+  // Separate runners are separate notices.
+  await n.observe({ builderId: 1, host: 'b', lastEvent: 'config_idle:gauge_unknown' });
+  await n.observe({ builderId: 2, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+  assert.equal(posts.length, 4);
+});
+
+test('a gauge notice clears when the runner moves to an ordinary capacity hold, or the owner throws the switch', async () => {
+  for (const after of ['hold', 'fenced']) {
+    const posts = [];
+    const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: 'waiting' });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: after });
+    assert.equal(posts.length, 2, after);
+    assert.match(posts[1].text, /no longer held/, after);
+  }
+});
+
+test('the host lands in Discord as plain code, never a link or formatting', () => {
+  const t = ci.noticeText({ action: 'raise', code: 'no_allowlist', host: '[click](https://evil.example)*@everyone*' });
+  assert.doesNotMatch(t, /\]\(|https?:|\*|@/);
+  assert.match(t, /on `clickhttpsevil\.exampleeveryone`/);
+});
+
+test('no Discord on the instance: nothing posts and nothing is remembered', async () => {
+  const n = ci.createNotifier({ post: null });
+  const r = await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:no_allowlist' });
+  assert.deepEqual([r.posted, r.reason], [false, 'no_discord']);
+  assert.equal(n.notified.size, 0);
+  // A port that answers "no webhook for that channel" is the same.
+  const m = ci.createNotifier({ post: async () => ({ posted: false, reason: 'no_webhook_for_channel' }) });
+  await m.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:no_allowlist' });
+  assert.equal(m.notified.size, 0);
+});
+
+test('the hall draws idle_config as a warning with the fix, on the Gate page and in Settings', () => {
+  const fs = require('node:fs');
+  const gate = fs.readFileSync('modules/hall-ui/public/gate.js', 'utf8');
+  assert.match(gate, /idle_config: 'warn'/, 'the dot is a warning, not ok');
+  assert.match(gate, /h\.state === 'idle_config'[\s\S]{0,200}h\.remedy/, 'the checklist carries the remedy');
+  const panel = fs.readFileSync('modules/hall-ui/public/settings-autobongos.js', 'utf8');
+  assert.match(panel, /'GET', `\$\{API\}\/autonomy\/runners`/);
+  assert.match(panel, /h\.state !== 'idle_config'/);
+  assert.match(panel, /escapeHtml\(h\.remedy/);
+});
+
+// ── the route: POST /autonomy/heartbeat posts through the discord.post port ──
+
+test('POST /autonomy/heartbeat: thirty config-idle beats are ONE Discord post', async () => {
+  const path = require('node:path');
+  const express = require('express');
+  const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+  const api = require('../src/module-api.js');
+  const saved = { b: api.requireBuilder, p: api.requirePermission, r: api.resolveOptional, q: api.pool.query };
+  const posts = [];
+  api.requireBuilder = (r, _s, next) => { r.builder = { id: 7, rank: 'metic' }; next(); };
+  api.requirePermission = () => (_r, _s, next) => next();
+  api.resolveOptional = (name, dflt) => (name === 'discord.post' ? async (m) => { posts.push(m); return { posted: true }; } : dflt);
+  api.pool.query = async () => ({ rows: [{ host: 'winbox' }] });
+  const routePath = require.resolve(path.resolve('modules/autonomy/routes/autonomy.js'));
+  delete require.cache[routePath];
+  let server;
+  try {
+    const router = require(routePath)();
+    const app = express();
+    app.use(express.json()); app.use(attachFail); app.use(router);
+    server = app.listen(0);
+    await new Promise((r) => server.once('listening', r));
+    const base = `http://127.0.0.1:${server.address().port}`;
+    const beat = async (last_event) => {
+      const r = await fetch(`${base}/autonomy/heartbeat`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ host: 'WinBox', last_event }) });
+      assert.equal(r.status, 200);
+      await new Promise((res) => setImmediate(res));
+    };
+    await beat('fenced');
+    for (let i = 0; i < 30; i++) await beat('config_idle:no_builder_scope');
+    await beat('waiting');
+    await beat('config_idle:no_builder_scope');
+    assert.equal(posts.length, 1);
+    assert.match(posts[0].text, /`WinBox`/);
+    assert.match(posts[0].text, /Settings/);
+  } finally {
+    if (server) server.close();
+    api.requireBuilder = saved.b; api.requirePermission = saved.p; api.resolveOptional = saved.r; api.pool.query = saved.q;
+    delete require.cache[routePath];
+  }
+});

package/tests/core_update_banner.mjs

@@ -398,3 +398,32 @@ test('a trailing slash is still /deploy', async () => {
   await new Promise((r) => setTimeout(r, 0));
   assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/);
 });
+
+test('the banner asks with the project\'s stored update rule (task 1004535)', async () => {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  const realAuth = r2(authPath);
+  const savedBuilder = realAuth.requireBuilder;
+  const savedPerm = realAuth.requirePermission;
+  realAuth.requireBuilder = (_req, _res, next) => next();
+  realAuth.requirePermission = () => (_req, _res, next) => next();
+  delete r2.cache[routePath];
+  let seen;
+  const express = r2('express');
+  const app = express();
+  app.use(r2(routePath)({ coreUpdate: async (a) => { seen = a; return { reading: 'ok', behind: true, channel: a.channel }; }, selfChannel: async () => 'minor' }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/core-update`);
+    assert.equal(res.status, 200);
+    assert.equal(seen.channel, 'minor', 'the rule set on /deploy, not the platform default');
+    assert.equal((await res.json()).update.channel_source, 'deploy');
+  } finally {
+    server.close();
+    realAuth.requireBuilder = savedBuilder;
+    realAuth.requirePermission = savedPerm;
+    delete r2.cache[routePath];
+  }
+});

package/tests/core_upgrade_door.mjs

@@ -866,10 +866,25 @@ await t('a box that reached the target by another road supersedes the failure',
 
 await t('AN UNREADABLE REGISTRY LEAVES A FAILURE STANDING — not knowing is not evidence of recovery', () => {
   const now = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'x' };
-  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, recommended: null }, null, now);
+  // An unreadable registry is what the snapshot writer stores when `npm view` fails: an
+  // EMPTY available list, and so no recommendation (provision-core-upgrade.js snapshotCoreVersions).
+  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, available: [], recommended: null }, null, now);
   assert.equal(p.last_move.superseded, false, 'the direction to fail in is showing an old failure, never hiding a live one');
 });
 
+await t('an UP-TO-DATE box supersedes an old failure: a read registry with nothing on offer is not "unknown" (task 1004534)', () => {
+  // The live shape, 2026-10-02: cloudbongos served 1.21.5, the registry answered (1168
+  // versions), nothing newer was within its rule, and the page still led with a day-old
+  // "waiting on a decision" about 1.20.73. recommended=null was being read as "the
+  // registry could not be read", so the failure could never become history.
+  const old = { action: 'core-upgrade', state: 'error', target_version: '1.20.73', resolved_at: new Date().toISOString(), last_error: 'x', failure_class: 'needs_decision', failure_reason: 'outside_channel' };
+  const p = CU.previewFromSnapshot(ACTIVE, { served_version: '1.21.5', available: ['1.20.73', '1.21.5'], recommended: null, observed_at: new Date().toISOString() }, null, old);
+  assert.equal(p.behind, false);
+  assert.equal(p.last_move.superseded, true, 'the box is current; a failure about another version is history');
+  assert.equal(CU.lastMoveSuperseded('1.20.73', '1.21.5', null, true), true);
+  assert.equal(CU.lastMoveSuperseded('1.20.73', '1.21.5', null, false), false, 'an unread registry still leaves it standing');
+});
+
 await t('lastMoveSuperseded computes no version ORDERING — only identity', () => {
   // The page's standing rule is that no version comparison happens outside the runner's
   // channel resolution. This helper answers "is this news" without ever asking which of
@@ -885,6 +900,21 @@ await t('lastMoveSuperseded computes no version ORDERING — only identity', ()
   assert.equal(CU.lastMoveSuperseded('1.19.921', '1.19.900', '1.19.949'), true);
 });
 
+console.log('\nthe platform\'s own rule, for Settings and the banner (task 1004535):');
+
+await t('selfUpdateChannel reads the CONTROL-PLANE row\'s rule', async () => {
+  const sqls = [];
+  const db = { query: async (sql) => { sqls.push(sql); return { rows: [{ update_channel: 'minor' }] }; } };
+  assert.equal(await CU.selfUpdateChannel(db), 'minor');
+  assert.match(sqls[0], /hosting_shape = 'control-plane'/, 'this hall\'s own row, never a tenant\'s');
+});
+
+await t('selfUpdateChannel answers null with no row, an unknown value, or a failed read', async () => {
+  assert.equal(await CU.selfUpdateChannel({ query: async () => ({ rows: [] }) }), null);
+  assert.equal(await CU.selfUpdateChannel({ query: async () => ({ rows: [{ update_channel: 'nightly' }] }) }), null);
+  assert.equal(await CU.selfUpdateChannel({ query: async () => { throw new Error('relation does not exist'); } }), null);
+});
+
 console.log('\nthe project\'s update rule (task 1004445):');
 
 const channelHandler = (inst, calls) => updateChannelHandlerFor({

package/tests/core_upgrade_runner.mjs

@@ -232,6 +232,26 @@ await t('the channel refusal names a step that EXISTS on /deploy, never "change
   assert.match(major, /upgrading-the-core\.md/);
 });
 
+await t('a target the box ALREADY SERVES is not a channel refusal — the move is a no-op (task 1004534)', () => {
+  // 2026-10-01 16:32: the sweep and the door both went for 1.20.73; the sweep got there
+  // first, and the door's press was refused as "outside this project's 'minor' update
+  // channel … across a major version or onto a prerelease" — false on every count.
+  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
+  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  assert.equal(R.targetFault('1.20.73', ['1.20.72', '1.20.73'], '1.20.73', 'minor', channelAllows, compare), null,
+    'no fault: the runner\'s own already-serving check answers it as a no-op');
+});
+
+await t('a target BELOW what the box serves says so, and is never called outside the update rule (task 1004534)', () => {
+  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
+  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  const f = R.targetFault('1.20.73', ['1.20.73', '1.21.5'], '1.21.5', 'minor', channelAllows, compare);
+  assert.ok(f, 'still refused — a move never goes backwards on its own');
+  assert.doesNotMatch(f, /update channel|major version|prerelease/, 'none of the channel sentence is true here');
+  assert.match(f, /already runs core 1\.21\.5/);
+  assert.equal(require('../scripts/gds/upgrade-outcome.js').runnerReason(f), 'downgrade');
+});
+
 await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
   const empty = R.targetFault('1.19.760', [], '1.19.758', 'patch', () => true);
   assert.match(empty, /could not read the published core versions/);

package/tests/discord_craft_broadcast.mjs

@@ -0,0 +1,162 @@
+// tests/discord_craft_broadcast.mjs — the Discord feed announces an artist's and
+// an ideator's moments, not only shipped tasks (task 1004439 / WA6.RP09, goal
+// 1000095, criterion wa6-roles-read-true-in-public).
+//
+// The done-when: "a ratified idea and an approved page each post one line to the
+// feed". Run for real, through the module's own posters with the webhook stubbed:
+//
+//   1. A RATIFIED IDEA. board.item.passed for a full_idea posts ONE line to
+//      #ship-feed naming its author; an amendment or a genesis stage posts nothing;
+//      the idea's title never leaves the hall.
+//   2. A FULL IDEA AT THE BAR. idea.graded.full posts at economy's own pass bar
+//      and not below it, naming the developer when someone else developed it.
+//   3. AN APPROVED PAGE. A page-tweak round's ship line says "page approved" and
+//      names its ARTIST (the shipped_by of task 1004432), never the applier; a
+//      security-flagged round still goes only to the security feed.
+//   4. THE WIRING. The module subscribes to both events, and nothing here pays.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+const { test, summary } = makeRunner();
+const craft = require('../modules/discord/craft-broadcast.js');
+const ship = require('../modules/discord/ship-broadcast.js');
+const credits = require('../modules/economy/credits.js');
+
+const BUILDERS = { 7: { display_name: 'Builder 7' }, 9: { display_name: 'Builder 9' }, 4: { display_name: 'Builder 4' } };
+function harness({ channel = true } = {}) {
+  const posts = [];
+  return {
+    posts,
+    deps: {
+      getBuilder: async (id) => BUILDERS[id] || null,
+      hasChannel: () => channel,
+      post: async (ch, text) => { posts.push({ ch, text }); },
+      postWebhook: async (ch, text) => { posts.push({ ch, text }); },
+      reward: { IDEA_FULL_PASS_BAR: credits.IDEA_FULL_PASS_BAR },
+      log: () => {},
+    },
+  };
+}
+
+// ---- 1. a ratified idea ---------------------------------------------------------
+
+await test('a ratified idea posts ONE line to #ship-feed, naming its author and linking the idea', async () => {
+  const h = harness();
+  const r = await craft.postIdeaRatified({ item_id: 31, subject_type: 'full_idea', subject_id: 812, idea_id: 812, author_id: 9, completeness_score: 80, passed_at: 'now' }, h.deps);
+  assert.equal(r.posted, true);
+  assert.equal(h.posts.length, 1, 'one line');
+  assert.equal(h.posts[0].ch, 'ship_feed');
+  assert.match(h.posts[0].text, /The board ratified an idea by Builder 9\./);
+  assert.match(h.posts[0].text, /\/#\/idea\/812$/, 'the hall link carries the rest to whoever may see it');
+  assert.ok(!h.posts[0].text.startsWith('#'), 'never read by the applause bot as a ship');
+});
+
+await test('an amendment or a genesis stage is the project\'s decision, not an ideator\'s moment — nothing posts', async () => {
+  for (const subject_type of ['constitutional_amendment', 'genesis_stage']) {
+    const h = harness();
+    const r = await craft.postIdeaRatified({ item_id: 2, subject_type, subject_id: 3, idea_id: null, author_id: 4 }, h.deps);
+    assert.equal(r.skipped, 'not_an_idea');
+    assert.equal(h.posts.length, 0);
+  }
+});
+
+await test('the idea\'s title is never posted, and a name cannot carry formatting or a link', async () => {
+  const h = harness();
+  BUILDERS[66] = { display_name: '@everyone [click](evil.example) **x**' };
+  await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 5, author_id: 66, title: 'Secret plan for the private goal' }, h.deps);
+  assert.ok(!h.posts[0].text.includes('Secret plan'), 'a payload title would not be read even if one were sent');
+  assert.ok(!/[\[\]()*@]/.test(h.posts[0].text.split(' by ')[1].split('.')[0]), 'the shared name sanitizer ran');
+  delete BUILDERS[66];
+});
+
+await test('an unconfigured feed is a named skip, and a failed post never throws', async () => {
+  const off = harness({ channel: false });
+  assert.equal((await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 9 }, off.deps)).skipped, 'channel_not_configured');
+  const broken = harness();
+  broken.deps.post = async () => { throw new Error('discord down'); };
+  const r = await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 9 }, broken.deps);
+  assert.equal(r.skipped, 'post_failed');
+});
+
+await test('an author who cannot be read leaves the line unnamed, never fails it', async () => {
+  const h = harness();
+  await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 12345 }, h.deps);
+  assert.match(h.posts[0].text, /^\u{1F3DB}\u{FE0F} The board ratified an idea\. /u);
+});
+
+// ---- 2. a Full Idea at the bar ----------------------------------------------------
+
+await test('a Full Idea posts at economy\'s own pass bar, and not below it', async () => {
+  const bar = credits.IDEA_FULL_PASS_BAR;
+  const at = harness();
+  await craft.postFullIdeaPassed({ id: 40, idea_id: 40, grade: 'full', completeness_score: bar, captured_by: 9 }, at.deps);
+  assert.equal(at.posts.length, 1);
+  assert.match(at.posts[0].text, /Builder 9's Full Idea passed its completeness check\./);
+  const below = harness();
+  const r = await craft.postFullIdeaPassed({ id: 41, grade: 'full', completeness_score: bar - 1, captured_by: 9 }, below.deps);
+  assert.equal(r.skipped, 'below_bar');
+  assert.equal(below.posts.length, 0);
+  const unscored = harness();
+  assert.equal((await craft.postFullIdeaPassed({ id: 42, completeness_score: null, captured_by: 9 }, unscored.deps)).skipped, 'below_bar');
+});
+
+await test('a developed spark names its developer, as the credit split does; no economy, no bar, no line', async () => {
+  const h = harness();
+  await craft.postFullIdeaPassed({ id: 43, completeness_score: 90, captured_by: 9, developed_by: 7 }, h.deps);
+  assert.match(h.posts[0].text, /Builder 7's Full Idea/);
+  const none = harness();
+  none.deps.reward = null;
+  const r = await craft.postFullIdeaPassed({ id: 43, completeness_score: 90, captured_by: 9 }, { ...none.deps, reward: {} });
+  assert.equal(r.skipped, 'below_bar');
+  assert.equal(none.posts.length, 0);
+});
+
+await test('the reward port carries the bar the feed reads', () => {
+  const reward = require('../modules/economy/reward.js');
+  assert.equal(reward.IDEA_FULL_PASS_BAR, credits.IDEA_FULL_PASS_BAR);
+});
+
+// ---- 3. an approved page ----------------------------------------------------------
+
+await test('an approved page posts one line saying so, naming its ARTIST, not the applier', async () => {
+  const h = harness();
+  // shipped_by is the round's artist since task 1004432; the applier (4) is nowhere in the row
+  const r = await ship.postShipBroadcast({ id: 501, value_summary: 'The landing page reads plainly now.', security_sensitive: false, source: 'page-tweak', shipped_by: 7 }, h.deps);
+  assert.deepEqual(r.posted, ['ship_feed']);
+  assert.equal(h.posts.length, 1, 'one line');
+  assert.equal(h.posts[0].text, '#501 page approved — rewritten by Builder 7: The landing page reads plainly now.');
+  assert.ok(!h.posts[0].text.includes('Builder 4'));
+});
+
+await test('an ordinary ship is unchanged, and a security-flagged page round goes only to the security feed', async () => {
+  const h = harness();
+  await ship.postShipBroadcast({ id: 502, value_summary: 'Faster claims.', security_sensitive: false, source: null, shipped_by: 4 }, h.deps);
+  assert.equal(h.posts[0].text, '#502 shipped — Faster claims.');
+  const sec = harness();
+  await ship.postShipBroadcast({ id: 503, value_summary: 'x', security_sensitive: true, source: 'page-tweak', shipped_by: 7 }, sec.deps);
+  assert.deepEqual(sec.posts.map((p) => p.ch), ['security_ship_feed']);
+  assert.ok(!sec.posts[0].text.includes('Builder 7'), 'the security line is untouched');
+  const unknown = harness();
+  await ship.postShipBroadcast({ id: 504, value_summary: 'y', security_sensitive: false, source: 'page-tweak', shipped_by: 9999 }, unknown.deps);
+  assert.equal(unknown.posts[0].text, '#504 page approved: y', 'an unreadable artist names nobody rather than the applier');
+});
+
+// ---- 4. the wiring ------------------------------------------------------------------
+
+await test('the module subscribes to both events, and nothing on these paths pays', () => {
+  const routes = fs.readFileSync(path.join(ROOT, 'modules/discord/routes/discord.js'), 'utf8');
+  assert.match(routes, /api\.on\('board\.item\.passed', \(payload\) => craftBroadcast\.postIdeaRatified\(payload\)\)/);
+  assert.match(routes, /api\.on\('idea\.graded\.full', \(graded\) => craftBroadcast\.postFullIdeaPassed\(graded\)\)/);
+  const src = fs.readFileSync(path.join(ROOT, 'modules/discord/craft-broadcast.js'), 'utf8');
+  assert.ok(!/award|credit_log|INSERT/i.test(src.replace(/\/\/.*$/gm, '')), 'a mirror: it reads names and posts, it never books');
+});
+
+summary();

package/tests/genesis_home.mjs

@@ -340,7 +340,7 @@ test('a demo\'s genesis card: no decide form, the settled plan in one line, each
   await new Promise((r) => setImmediate(r));
   assert.equal(host.hidden, false);
   assert.match(host.innerHTML, /Monarchy \/ BDFL, 3 people, 4 hours each/);
-  assert.match(host.innerHTML, /about 49 minutes/);
+  assert.match(host.innerHTML, /about 49 min\. /, 'one unit for a demo stage: "min", as the stage rows say (task 1004504)');
   assert.match(host.innerHTML, /14 min, due /, 'the stage in progress is due at a time, not a date');
   assert.match(host.innerHTML, /Stage 1 of 5 · scope · demo/);
   assert.doesNotMatch(host.innerHTML, /data-genesis-plan/, 'a demo never shows the decide form');

package/tests/government_routes.mjs

@@ -93,7 +93,9 @@ test('every /governance route gates via REAL middleware on exactly its PINNED at
   // everything outside the Board Room family — the /board/ routes and the
   // /constitution read (R18: reading the rule you vote under is part of
   // casting) — still gates on government.manage.
-  const boardFamily = (key) => key.includes('/board/') || key.endsWith('/government/constitution');
+  // task 1004523: the docket reads the board family's atom too — opening the city
+  // is part of casting, and each source inside is scoped to its own atom.
+  const boardFamily = (key) => key.includes('/board/') || key.endsWith('/government/constitution') || key.endsWith('/government/docket');
   for (const r of classified.filter((x) => !boardFamily(x.key))) {
     assert.deepEqual(r.perms, ['government.manage'], `${r.key}: the admin surface gates on the manage atom`);
   }