@bongos/core 1.21.5 → 1.21.7

package/tests/autobongos_verify.mjs

@@ -102,7 +102,9 @@ test('an unparseable updated_at still gets a shape — quiet is the wrong failur
 // ── the incident this exists for ───────────────────────────────────────────────
 
 test('shipped with nothing on main is called out, not celebrated', () => {
-  const v = classifyLedger({ task: task(), artifact: notOnMain, nowMs: NOW });
+  // Past the land grace window (task 1004538) — inside it the same facts are
+  // `pending_land`, covered below.
+  const v = classifyLedger({ task: task({ shipped_at: '2026-09-16T12:00:00.000Z' }), artifact: notOnMain, nowMs: NOW });
   assert.equal(v.shape, 'shipped_no_artifact');
   assert.equal(v.verified, false);
   assert.equal(v.fileBlocker, true);
@@ -199,16 +201,44 @@ test('the artifact probe reads main, fixed-string, for the ship-commit conventio
   const git = async (args) => {
     calls.push(args);
     if (args[0] === 'fetch') return { ok: true, stdout: '', stderr: '' };
-    return { ok: true, stdout: 'deadbeefcafe1234 feat: the thing (task 42)\n', stderr: '' };
+    return { ok: true, stdout: 'deadbeefcafe1234\x1ffeat: the thing (task 42)\x1f\x1e\n', stderr: '' };
   };
   const r = await probeArtifact(42, { git });
   assert.deepEqual(r, { checked: true, onMain: true, sha: 'deadbeefcafe1234', subject: 'feat: the thing (task 42)' });
   assert.deepEqual(calls[0], ['fetch', '-q', 'origin', 'main']);
   assert.ok(calls[1].includes('-F'), 'the pattern is a fixed string, not a regex');
-  assert.ok(calls[1].includes('--grep=(task 42)'));
+  assert.ok(calls[1].includes('--grep=42'), 'git narrows by the bare id; the exact match is made in JS');
   assert.ok(calls[1].includes('FETCH_HEAD'), 'read what was just fetched, not a stale local ref');
 });
 
+// task 1004538 — the commits PR 1456 landed for task 1004513 never wrote the
+// literal `(task 1004513)`: the merge subject names the BRANCH
+// (`…/autobongos-1004513-978953`) and a body line says "task 1004513 makes…".
+// The old `(task N)`-only grep therefore said "no artifact" even AFTER the land,
+// so no grace window alone could ever have cleared that blocker.
+test('the probe recognises a ship branch in a merge subject and a body mention', async () => {
+  const log = (rows) => async (args) => (args[0] === 'fetch'
+    ? { ok: true, stdout: '', stderr: '' }
+    : { ok: true, stdout: rows.map(([h, s, b]) => `${h}\x1f${s}\x1f${b || ''}\x1e\n`).join(''), stderr: '' });
+  const merge = await probeArtifact(1004513, { git: log([['3d50a6289', 'Merge pull request #1456 from octo/autobongos-1004513-978953']]) });
+  assert.equal(merge.onMain, true);
+  assert.equal(merge.sha, '3d50a6289');
+  const manual = await probeArtifact(1004440, { git: log([['a55b7707e', 'Merge pull request #1471 from octo/task-1004440']]) });
+  assert.equal(manual.onMain, true);
+  const body = await probeArtifact(1004513, { git: log([['301df048f', 'docs(lifecycle): a note', 'Fixes the goal close.\n\nRefs (task 1004513).']]) });
+  assert.equal(body.onMain, true, 'the `(task N)` convention still counts in a body');
+  // A body that merely DISCUSSES the task is another task's commit talking about
+  // it — not an artifact. (This task's own commits mention task 1004513.)
+  const talk = await probeArtifact(1004513, { git: log([['dddd', 'fix(verify): slow lands (task 1004538)', 'task 1004513 was flagged too early']]) });
+  assert.equal(talk.onMain, false);
+  // A longer id that merely STARTS with this one is not this task.
+  const prefix = await probeArtifact(1004513, { git: log([['aaaa', 'fix: thing (task 10045139)'], ['bbbb', 'Merge from x/task-10045130']]) });
+  assert.equal(prefix.onMain, false);
+  // Nor is a bare number with no `task` before it (a PR number, a row count).
+  const bare = await probeArtifact(1004513, { git: log([['cccc', 'chore: bump 1004513 rows']]) });
+  assert.equal(bare.onMain, false);
+});
+
 test('a failed fetch reports `checked: false`, never `onMain: false`', async () => {
   const git = async (args) => (args[0] === 'fetch'
     ? { ok: false, stdout: '', stderr: 'fatal: could not read from remote' }
@@ -345,3 +375,209 @@ test('a thrown client error is a read failure, not a crash', async () => {
   assert.equal(out.halt, true);
   assert.match(out.read_error, /fetch failed/);
 });
+
+// ── a slow land is not a missing artifact (task 1004538) ───────────────────────
+//
+// Task 1004513 was flagged `shipped_no_artifact` at 22:24Z and its merge landed
+// ~11 hours later; the owner got a false alarm (blocker 1000185). A shipped task
+// with nothing on main is first `pending_land`. The clock is the LEDGER's
+// `shipped_at`, so a runner restart cannot reset it.
+
+const { LAND_GRACE_MS, recheckLands, pendingLandIds } = verify;
+const shippedAgo = (ms) => task({ shipped_at: new Date(NOW - ms).toISOString(), updated_at: new Date(NOW - ms).toISOString() });
+
+test('(1) inside the grace window, a missing artifact is pending_land and files NO blocker', async () => {
+  assert.ok(LAND_GRACE_MS >= 12 * 3600_000, 'the land pipeline can take hours on a red main — 1004513 took ~11');
+  const v = classifyLedger({ task: shippedAgo(11 * 3600_000), artifact: notOnMain, nowMs: NOW });
+  assert.equal(v.shape, 'pending_land');
+  assert.equal(v.verified, false, 'not yet a fact');
+  assert.equal(v.fileBlocker, false);
+  assert.equal(v.releaseClaim, false);
+  assert.equal(v.halt, false);
+
+  let filed = 0;
+  const out = await verifyShip({ taskId: 1003903 }, {
+    api: fakeApi(), task: shippedAgo(60_000), nowMs: NOW,
+    probeArtifact: async () => notOnMain,
+    fileBlocker: async () => { filed += 1; return { filed: true, blockerId: 9 }; },
+  });
+  assert.equal(out.shape, 'pending_land');
+  assert.equal(filed, 0, 'no owner blocker for a land that is merely slow');
+  assert.equal(out.blocker, null);
+});
+
+test('(2) past the grace window, a still-missing artifact files the blocker', async () => {
+  const v = classifyLedger({ task: shippedAgo(LAND_GRACE_MS + 60_000), artifact: notOnMain, nowMs: NOW });
+  assert.equal(v.shape, 'shipped_no_artifact');
+  assert.equal(v.fileBlocker, true);
+
+  const rows = [];
+  const out = await verifyShip({ taskId: 1003903 }, {
+    api: fakeApi(), task: shippedAgo(LAND_GRACE_MS + 60_000), nowMs: NOW,
+    probeArtifact: async () => notOnMain,
+    fileBlocker: async (_a, row) => { rows.push(row); return { filed: true, blockerId: 9 }; },
+  });
+  assert.equal(out.shape, 'shipped_no_artifact');
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].source_ref, 'task-1003903-shipped_no_artifact', 'the dedupe key the resolve sweep matches on');
+});
+
+test('the grace clock is shipped_at, and an unreadable clock does not hide a missing artifact', () => {
+  // updated_at moves on every touch; shipped_at is when the ship happened.
+  const t = task({ shipped_at: new Date(NOW - LAND_GRACE_MS - 1000).toISOString(), updated_at: new Date(NOW - 1000).toISOString() });
+  assert.equal(classifyLedger({ task: t, artifact: notOnMain, nowMs: NOW }).shape, 'shipped_no_artifact');
+  const undated = task({ shipped_at: null, updated_at: 'not a date' });
+  assert.equal(classifyLedger({ task: undated, artifact: notOnMain, nowMs: NOW }).shape, 'shipped_no_artifact',
+    'with no clock the grace cannot be measured, so this stays as strict as it was');
+});
+
+test('a pending land that later appears on main verifies as shipped', () => {
+  assert.equal(classifyLedger({ task: shippedAgo(3600_000), artifact: onMain, nowMs: NOW }).shape, 'shipped');
+});
+
+// ── re-probing across iterations, and across a restart ─────────────────────────
+
+test('pendingLandIds reads the run log: the LATEST verdict per task decides', () => {
+  const rows = [
+    { event: 'worked', task_id: '1', ledger_shape: 'pending_land' },
+    { event: 'worked', task_id: '2', ledger_shape: 'pending_land' },
+    { event: 'land_recheck', task_id: '2', ledger_shape: 'shipped' },
+    { event: 'worked', task_id: '3', ledger_shape: 'shipped' },
+    { event: 'land_recheck', task_id: '4', ledger_shape: 'pending_land' },
+    { event: 'cadence', mode: 'full' },
+    { event: 'worked', task_id: '5', ledger_shape: 'pending_land' },
+    { event: 'land_recheck', task_id: '5', ledger_shape: 'shipped_no_artifact' },
+    null, 'garbage',
+  ];
+  assert.deepEqual(pendingLandIds(rows).sort(), ['1', '4']);
+  assert.deepEqual(pendingLandIds([]), []);
+});
+
+const blockerApi = (open, resolved) => ({
+  tasks: { getTasksId: async ({ id }) => ({ ok: true, data: { task: { ...shippedAgo(3600_000), id: String(id) } } }) },
+  blockers: {
+    getBlockers: async () => ({ ok: true, data: { blockers: open } }),
+    postBlockersIdResolve: async ({ id, body }) => { resolved.push({ id: String(id), note: body.resolution_note }); return { ok: true, data: {} }; },
+  },
+});
+
+test('(3) an already-filed no-artifact blocker is resolved once main carries the commit', async () => {
+  const resolved = [];
+  const open = [
+    { id: '1000185', source: 'autobongos', source_ref: 'task-1004513-shipped_no_artifact', status: 'open' },
+    { id: '1000186', source: 'autobongos', source_ref: 'task-1004514-shipped_no_artifact', status: 'open' },
+    { id: '1000187', source: 'autobongos', source_ref: 'task-1004515-still_held', status: 'open' },
+    { id: '1000188', source: 'manual', source_ref: 'task-1004516-shipped_no_artifact', status: 'open' },
+  ];
+  const probed = [];
+  const out = await recheckLands({ pendingIds: [] }, {
+    api: blockerApi(open, resolved), nowMs: NOW,
+    probeArtifact: async (id) => {
+      probed.push(String(id));
+      return String(id) === '1004513'
+        ? { checked: true, onMain: true, sha: '3d50a6289abc', subject: 'Merge pull request #1456 from octo/autobongos-1004513-978953' }
+        : notOnMain;
+    },
+  });
+  assert.deepEqual(resolved.map((r) => r.id), ['1000185'], 'only the autobongos no-artifact blocker whose commit is now on main');
+  assert.match(resolved[0].note, /3d50a628/);
+  assert.match(resolved[0].note, /task 1004513/);
+  assert.deepEqual(probed.sort(), ['1004513', '1004514'], 'other shapes and other sources are not this sweep’s business');
+  assert.deepEqual(out.resolved.map((r) => r.blocker_id), ['1000185']);
+});
+
+test('a probe that could not run never resolves a blocker', async () => {
+  const resolved = [];
+  await recheckLands({ pendingIds: [] }, {
+    api: blockerApi([{ id: '7', source: 'autobongos', source_ref: 'task-42-shipped_no_artifact' }], resolved), nowMs: NOW,
+    probeArtifact: async () => ({ checked: false, reason: 'no network' }),
+  });
+  assert.deepEqual(resolved, []);
+});
+
+test('recheckLands re-verifies each pending task: quiet inside the window, a blocker after it', async () => {
+  const filed = [];
+  const deps = (ageMs) => ({
+    api: {
+      tasks: { getTasksId: async ({ id }) => ({ ok: true, data: { task: { ...shippedAgo(ageMs), id: String(id) } } }) },
+      blockers: { getBlockers: async () => ({ ok: true, data: { blockers: [] } }) },
+    },
+    nowMs: NOW, probeArtifact: async () => notOnMain,
+    fileBlocker: async (_a, row) => { filed.push(row.source_ref); return { filed: true, blockerId: 11 }; },
+  });
+  const early = await recheckLands({ pendingIds: ['42'] }, deps(3600_000));
+  assert.deepEqual(early.rechecked.map((r) => r.ledger_shape), ['pending_land']);
+  assert.deepEqual(filed, []);
+  const late = await recheckLands({ pendingIds: ['42'] }, deps(LAND_GRACE_MS + 1000));
+  assert.deepEqual(late.rechecked.map((r) => r.ledger_shape), ['shipped_no_artifact']);
+  assert.deepEqual(filed, ['task-42-shipped_no_artifact']);
+  assert.equal(late.rechecked[0].blocker_id, 11);
+});
+
+test('one pass fetches main ONCE, however many tasks and blockers it probes', async () => {
+  const calls = [];
+  const git = async (args) => {
+    calls.push(args[0]);
+    if (args[0] === 'fetch') return { ok: true, stdout: '', stderr: '' };
+    const id = args.find((a) => a.startsWith('--grep=')).slice(7);
+    return { ok: true, stdout: `abc${id}\x1fMerge from x/task-${id}\x1f\x1e\n`, stderr: '' };
+  };
+  const resolved = [];
+  const api = blockerApi([
+    { id: '1', source: 'autobongos', source_ref: 'task-201-shipped_no_artifact' },
+    { id: '2', source: 'autobongos', source_ref: 'task-202-shipped_no_artifact' },
+  ], resolved);
+  await recheckLands({ pendingIds: ['101', '102', '201'] }, { api, git, nowMs: NOW });
+  assert.equal(calls.filter((c) => c === 'fetch').length, 1, 'one fetch per pass, not one per id');
+  assert.equal(calls.filter((c) => c === 'log').length, 4, 'one log per DISTINCT id (201 is both pending and blocked)');
+  assert.deepEqual(resolved.map((r) => r.id).sort(), ['1', '2']);
+});
+
+test('nothing to probe means no git at all, and a failed fetch resolves nothing', async () => {
+  let gitCalls = 0;
+  await recheckLands({ pendingIds: [], sweepBlockers: false }, {
+    api: { tasks: {}, blockers: {} }, git: async () => { gitCalls += 1; return { ok: true, stdout: '' }; }, nowMs: NOW,
+  });
+  assert.equal(gitCalls, 0);
+
+  const resolved = [];
+  const out = await recheckLands({ pendingIds: [] }, {
+    api: blockerApi([{ id: '9', source: 'autobongos', source_ref: 'task-301-shipped_no_artifact' }], resolved), nowMs: NOW,
+    git: async (args) => (args[0] === 'fetch' ? { ok: false, stderr: 'fatal: unreachable' } : { ok: true, stdout: 'x\x1fMerge from x/task-301\x1f\x1e' }),
+  });
+  assert.deepEqual(resolved, [], 'not looking is not evidence the commit landed either');
+  assert.deepEqual(out.resolved, []);
+});
+
+test('the blocker list pages by the route’s total, and says so when it gives up', async () => {
+  let gets = 0;
+  const paged = {
+    tasks: {},
+    blockers: {
+      getBlockers: async ({ query }) => {
+        gets += 1;
+        const rows = query.offset === 0
+          ? Array.from({ length: 200 }, (_, i) => ({ id: String(i), source: 'manual', source_ref: null }))
+          : [{ id: '900', source: 'autobongos', source_ref: 'task-55-shipped_no_artifact' }];
+        return { ok: true, data: { blockers: rows, page: { limit: 200, offset: query.offset, total: 201 } } };
+      },
+      postBlockersIdResolve: async () => ({ ok: true }),
+    },
+  };
+  const probed = [];
+  await recheckLands({ pendingIds: [] }, { api: paged, nowMs: NOW, probeArtifact: async (id) => { probed.push(id); return notOnMain; } });
+  assert.equal(gets, 2, 'page two holds the 201st row');
+  assert.deepEqual(probed, ['55']);
+
+  const endless = { tasks: {}, blockers: { getBlockers: async ({ query }) => ({ ok: true, data: { blockers: Array.from({ length: 200 }, (_, i) => ({ id: String(query.offset + i), source: 'manual' })), page: { total: 1e9 } } }) } };
+  const out = await recheckLands({ pendingIds: [] }, { api: endless, nowMs: NOW, probeArtifact: async () => notOnMain });
+  assert.match(out.errors.join(' '), /stopped paging/, 'a cap that is hit must say so, not read as "looked everywhere"');
+});
+
+test('an unreadable blocker list is reported, not thrown', async () => {
+  const out = await recheckLands({ pendingIds: [] }, {
+    api: { tasks: {}, blockers: { getBlockers: async () => { throw new Error('fetch failed'); } } }, nowMs: NOW,
+    probeArtifact: async () => notOnMain,
+  });
+  assert.match(out.errors.join(' '), /fetch failed/);
+});

package/tests/autonomy_config_idle.mjs

@@ -0,0 +1,272 @@
+// tests/autonomy_config_idle.mjs — idle on a setting is not idle on no work
+// (task 1004539).
+//
+// The incident: ten hours fenced with no_builder_scope while the hall said
+// "alive, waiting for work". These pin the done-when: runner health reports a
+// configuration idle as NOT ok with the fix, the owner's kill switch does not,
+// and the Discord notice is said once per change rather than once per loop.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ci = require('../modules/autonomy/config-idle.js');
+const { describeRunner } = require('../modules/autonomy/runner-health.js');
+const runner = require('../scripts/gds/autobongos-run.js');
+
+const NOW = Date.parse('2026-10-02T09:47:00.000Z');
+const agoS = (s) => new Date(NOW - s * 1000).toISOString();
+const hb = (over = {}) => ({ host: 'winbox', mode: 'full', last_seen_at: agoS(30), ...over });
+
+// ── runner health: the hall's verdict ───────────────────────────────────────
+
+test('a runner idle on no_builder_scope is NOT ok, and the hall gets the fix', () => {
+  const d = describeRunner(hb({ last_event: 'config_idle:no_builder_scope' }), { nowMs: NOW });
+  assert.equal(d.state, 'idle_config');
+  assert.equal(d.ok, false, 'the incident: this read ok=true for ten hours');
+  assert.equal(d.idleCode, 'no_builder_scope');
+  assert.match(d.remedy, /Settings/);
+  assert.match(d.detail, /no goals are picked/);
+  assert.match(d.detail, /winbox/);
+});
+
+test('every configuration code reads not-ok with its own remedy', () => {
+  for (const code of Object.keys(ci.CONFIG_IDLE)) {
+    const d = describeRunner(hb({ last_event: `config_idle:${code}` }), { nowMs: NOW });
+    assert.equal(d.ok, false, code);
+    assert.equal(d.remedy, ci.CONFIG_IDLE[code].remedy, code);
+  }
+});
+
+test('a config-idle runner that goes quiet past the dead line is DEAD, not idle', () => {
+  // A dead runner cannot report its configuration; silence still wins.
+  const d = describeRunner(hb({ last_event: 'config_idle:no_builder_scope', last_seen_at: agoS(3 * 3600) }), { nowMs: NOW });
+  assert.equal(d.state, 'dead');
+});
+
+test('the kill switch, a plain wait and an unknown code stay ok', () => {
+  for (const last_event of ['fenced', 'waiting', 'nothing_claimable', 'hold', 'config_idle:kill_switch', 'config_idle:<b>x</b>']) {
+    const d = describeRunner(hb({ last_event }), { nowMs: NOW });
+    assert.equal(d.state, 'alive', last_event);
+    assert.equal(d.ok, true, last_event);
+    assert.equal(d.remedy, undefined, last_event);
+  }
+});
+
+// ── the runner side: which rows count, and the grace ────────────────────────
+
+test('configIdleCode: configuration refusals count; deliberate stops and no-work do not', () => {
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'no_builder_scope' }), 'no_builder_scope');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'no_allowlist' }), 'no_allowlist');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'fence_unreadable' }), 'fence_unreadable');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'goal_not_allowlisted', refused_goals: [7] }), 'goal_not_allowlisted');
+  assert.equal(ci.configIdleCode({ event: 'fenced', code: 'goal_not_allowlisted', task_id: 5 }), null, 'one task outside the allowlist is the fence working');
+  assert.equal(ci.configIdleCode({ event: 'hold', unknown: true, reason: 'no gauge file' }), 'gauge_unknown');
+  for (const row of [
+    { event: 'fenced', code: 'kill_switch' },
+    { event: 'fenced', code: 'builder_paused' },
+    { event: 'fenced', code: 'not_permitted' },
+    { event: 'fenced', code: 'protected_path', task_id: 3 },
+    { event: 'hold', unknown: false, sleep_until: 1 },
+    { event: 'hold', unknown: false, usage_limit: true },
+    { event: 'nothing_claimable' },
+    null,
+  ]) assert.equal(ci.configIdleCode(row), null, JSON.stringify(row));
+});
+
+test('the grace: nothing is said until the stretch has held for it', () => {
+  const t0 = NOW;
+  let tr = ci.trackIdle(null, { event: 'fenced', code: 'no_builder_scope' }, t0);
+  assert.equal(ci.idleEvent(tr, t0 + (ci.GRACE_S - 1) * 1000), null);
+  tr = ci.trackIdle(tr, { event: 'fenced', code: 'no_builder_scope' }, t0 + 600_000);
+  assert.equal(tr.sinceMs, t0, 'the same code continues the stretch');
+  assert.equal(ci.idleEvent(tr, t0 + ci.GRACE_S * 1000), 'config_idle:no_builder_scope');
+  // A blip-prone code waits longer.
+  const fu = ci.trackIdle(null, { event: 'fenced', code: 'fence_unreadable' }, t0);
+  assert.equal(ci.idleEvent(fu, t0 + ci.GRACE_S * 1000), null);
+  assert.equal(ci.idleEvent(fu, t0 + ci.LONG_GRACE_S * 1000), 'config_idle:fence_unreadable');
+  // A different code restarts the clock; any other row ends it.
+  assert.equal(ci.trackIdle(tr, { event: 'fenced', code: 'no_allowlist' }, t0 + 1).sinceMs, t0 + 1);
+  assert.equal(ci.trackIdle(tr, { event: 'fenced', code: 'kill_switch' }, t0 + 1), null);
+  assert.equal(ci.trackIdle(tr, { event: 'nothing_claimable' }, t0 + 1), null);
+});
+
+test('markBeat leaves a working, booting or exiting beat alone', () => {
+  const tr = { code: 'no_builder_scope', sinceMs: NOW - 3600_000 };
+  assert.equal(ci.markBeat({ last_event: 'waiting' }, tr, NOW).last_event, 'config_idle:no_builder_scope');
+  assert.equal(ci.markBeat({ last_event: 'loop', mode: 'full' }, tr, NOW).mode, 'full');
+  assert.equal(ci.markBeat({ last_event: 'worked', working_task_id: 9 }, tr, NOW).last_event, 'worked');
+  assert.equal(ci.markBeat({ last_event: 'boot' }, tr, NOW).last_event, 'boot');
+  assert.equal(ci.markBeat({ last_event: 'upgrade_exit' }, tr, NOW).last_event, 'upgrade_exit');
+  assert.equal(ci.markBeat({ last_event: 'waiting' }, null, NOW).last_event, 'waiting');
+});
+
+test('THE LOOP: a runner fenced on no_builder_scope says so on its heartbeat once the grace has passed', async () => {
+  // Driven through the real forever(), so the beat override is wired, not just written.
+  let clock = NOW;
+  const beats = [];
+  const deps = {
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true, leftover: 0 }),
+    iteration: async () => ({ event: 'fenced', code: 'no_builder_scope', reason: 'r' }),
+    waitOrJump: async (waitS, d) => { clock += 10 * 60_000; await d.beat({ last_event: 'waiting' }); return { waited: waitS, jumped: false }; },
+    record: (r) => r,
+    emit: () => {},
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields.last_event); return true; },
+    codeDrifted: async () => false,
+    loadedHead: async () => null,
+    now: () => clock,
+  };
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 4 }, deps);
+  assert.equal(beats[0], 'boot');
+  // The first loop is inside the grace: pending, which the hall reads as a fence wait.
+  assert.equal(beats[1], 'loop');
+  assert.equal(beats[2], 'config_pending:no_builder_scope');
+  assert.equal(describeRunner(hb({ last_event: beats[2] }), { nowMs: NOW }).ok, true, 'inside the grace is not an alert');
+  assert.ok(beats.includes('config_idle:no_builder_scope'), `beats: ${beats.join(',')}`);
+  assert.equal(beats[beats.length - 1], 'config_idle:no_builder_scope', 'and keeps saying it while it holds');
+});
+
+test('THE LOOP: the kill switch never turns into a config_idle beat', async () => {
+  let clock = NOW;
+  const beats = [];
+  const deps = {
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true, leftover: 0 }),
+    iteration: async () => ({ event: 'fenced', code: 'kill_switch', reason: 'r' }),
+    waitOrJump: async (waitS, d) => { clock += 60 * 60_000; await d.beat({ last_event: 'waiting' }); return { waited: waitS, jumped: false }; },
+    record: (r) => r, emit: () => {},
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields.last_event); return true; },
+    codeDrifted: async () => false, loadedHead: async () => null, now: () => clock,
+  };
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 4 }, deps);
+  assert.ok(!beats.some((b) => String(b).startsWith('config_idle:')), beats.join(','));
+});
+
+// ── the notice: once per change ─────────────────────────────────────────────
+
+test('the Discord notice is DE-DUPLICATED: once when it starts, once when it clears', async () => {
+  const posts = [];
+  const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+  const beat = (lastEvent, extra = {}) => n.observe({ builderId: '3', host: 'WinBox', lastEvent, ...extra });
+
+  await beat('waiting');
+  assert.equal(posts.length, 0, 'quiet idle says nothing');
+  for (let i = 0; i < 30; i++) await beat('config_idle:no_builder_scope');
+  // A runner restart mid-stretch: boot, then the same setting pending again.
+  for (const e of ['loop', 'waiting', 'upgrade_exit', 'boot', 'loop', 'config_pending:no_builder_scope', 'waiting']) await beat(e);
+  await beat('config_idle:no_builder_scope');
+  assert.equal(posts.length, 1, 'thirty beats and a restart are one notice');
+  assert.match(posts[0].text, /no goals are picked/);
+  assert.match(posts[0].text, /Settings/);
+  assert.equal(posts[0].channel, 'ship_news');
+
+  await beat('config_idle:no_allowlist');
+  assert.equal(posts.length, 2, 'a different cause is a new notice');
+  await beat('nothing_claimable');
+  assert.equal(posts.length, 3, 'clearing is said once');
+  assert.match(posts[2].text, /no longer held/);
+  assert.match(posts[2].text, /no goal is allowed/, 'the clear names the setting in words');
+  for (const p of posts) assert.doesNotMatch(p.text, /no_allowlist|no_builder_scope/, 'never a raw code in a sentence a person reads');
+  await beat('nothing_claimable');
+  await beat('waiting');
+  assert.equal(posts.length, 3);
+});
+
+test('the kill switch never posts, and a working beat clears a notice', async () => {
+  const posts = [];
+  const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'fenced' });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:kill_switch' });
+  assert.equal(posts.length, 0);
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+  await n.observe({ builderId: 1, host: 'a', lastEvent: 'loop', workingTaskId: 42 });
+  assert.equal(posts.length, 2);
+  // Separate runners are separate notices.
+  await n.observe({ builderId: 1, host: 'b', lastEvent: 'config_idle:gauge_unknown' });
+  await n.observe({ builderId: 2, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+  assert.equal(posts.length, 4);
+});
+
+test('a gauge notice clears when the runner moves to an ordinary capacity hold, or the owner throws the switch', async () => {
+  for (const after of ['hold', 'fenced']) {
+    const posts = [];
+    const n = ci.createNotifier({ post: async (m) => { posts.push(m); return { posted: true }; } });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:gauge_unknown' });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: 'waiting' });
+    await n.observe({ builderId: 1, host: 'a', lastEvent: after });
+    assert.equal(posts.length, 2, after);
+    assert.match(posts[1].text, /no longer held/, after);
+  }
+});
+
+test('the host lands in Discord as plain code, never a link or formatting', () => {
+  const t = ci.noticeText({ action: 'raise', code: 'no_allowlist', host: '[click](https://evil.example)*@everyone*' });
+  assert.doesNotMatch(t, /\]\(|https?:|\*|@/);
+  assert.match(t, /on `clickhttpsevil\.exampleeveryone`/);
+});
+
+test('no Discord on the instance: nothing posts and nothing is remembered', async () => {
+  const n = ci.createNotifier({ post: null });
+  const r = await n.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:no_allowlist' });
+  assert.deepEqual([r.posted, r.reason], [false, 'no_discord']);
+  assert.equal(n.notified.size, 0);
+  // A port that answers "no webhook for that channel" is the same.
+  const m = ci.createNotifier({ post: async () => ({ posted: false, reason: 'no_webhook_for_channel' }) });
+  await m.observe({ builderId: 1, host: 'a', lastEvent: 'config_idle:no_allowlist' });
+  assert.equal(m.notified.size, 0);
+});
+
+test('the hall draws idle_config as a warning with the fix, on the Gate page and in Settings', () => {
+  const fs = require('node:fs');
+  const gate = fs.readFileSync('modules/hall-ui/public/gate.js', 'utf8');
+  assert.match(gate, /idle_config: 'warn'/, 'the dot is a warning, not ok');
+  assert.match(gate, /h\.state === 'idle_config'[\s\S]{0,200}h\.remedy/, 'the checklist carries the remedy');
+  const panel = fs.readFileSync('modules/hall-ui/public/settings-autobongos.js', 'utf8');
+  assert.match(panel, /'GET', `\$\{API\}\/autonomy\/runners`/);
+  assert.match(panel, /h\.state !== 'idle_config'/);
+  assert.match(panel, /escapeHtml\(h\.remedy/);
+});
+
+// ── the route: POST /autonomy/heartbeat posts through the discord.post port ──
+
+test('POST /autonomy/heartbeat: thirty config-idle beats are ONE Discord post', async () => {
+  const path = require('node:path');
+  const express = require('express');
+  const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+  const api = require('../src/module-api.js');
+  const saved = { b: api.requireBuilder, p: api.requirePermission, r: api.resolveOptional, q: api.pool.query };
+  const posts = [];
+  api.requireBuilder = (r, _s, next) => { r.builder = { id: 7, rank: 'metic' }; next(); };
+  api.requirePermission = () => (_r, _s, next) => next();
+  api.resolveOptional = (name, dflt) => (name === 'discord.post' ? async (m) => { posts.push(m); return { posted: true }; } : dflt);
+  api.pool.query = async () => ({ rows: [{ host: 'winbox' }] });
+  const routePath = require.resolve(path.resolve('modules/autonomy/routes/autonomy.js'));
+  delete require.cache[routePath];
+  let server;
+  try {
+    const router = require(routePath)();
+    const app = express();
+    app.use(express.json()); app.use(attachFail); app.use(router);
+    server = app.listen(0);
+    await new Promise((r) => server.once('listening', r));
+    const base = `http://127.0.0.1:${server.address().port}`;
+    const beat = async (last_event) => {
+      const r = await fetch(`${base}/autonomy/heartbeat`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ host: 'WinBox', last_event }) });
+      assert.equal(r.status, 200);
+      await new Promise((res) => setImmediate(res));
+    };
+    await beat('fenced');
+    for (let i = 0; i < 30; i++) await beat('config_idle:no_builder_scope');
+    await beat('waiting');
+    await beat('config_idle:no_builder_scope');
+    assert.equal(posts.length, 1);
+    assert.match(posts[0].text, /`WinBox`/);
+    assert.match(posts[0].text, /Settings/);
+  } finally {
+    if (server) server.close();
+    api.requireBuilder = saved.b; api.requirePermission = saved.p; api.resolveOptional = saved.r; api.pool.query = saved.q;
+    delete require.cache[routePath];
+  }
+});

package/tests/core_update_banner.mjs

@@ -398,3 +398,32 @@ test('a trailing slash is still /deploy', async () => {
   await new Promise((r) => setTimeout(r, 0));
   assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/);
 });
+
+test('the banner asks with the project\'s stored update rule (task 1004535)', async () => {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  const realAuth = r2(authPath);
+  const savedBuilder = realAuth.requireBuilder;
+  const savedPerm = realAuth.requirePermission;
+  realAuth.requireBuilder = (_req, _res, next) => next();
+  realAuth.requirePermission = () => (_req, _res, next) => next();
+  delete r2.cache[routePath];
+  let seen;
+  const express = r2('express');
+  const app = express();
+  app.use(r2(routePath)({ coreUpdate: async (a) => { seen = a; return { reading: 'ok', behind: true, channel: a.channel }; }, selfChannel: async () => 'minor' }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/core-update`);
+    assert.equal(res.status, 200);
+    assert.equal(seen.channel, 'minor', 'the rule set on /deploy, not the platform default');
+    assert.equal((await res.json()).update.channel_source, 'deploy');
+  } finally {
+    server.close();
+    realAuth.requireBuilder = savedBuilder;
+    realAuth.requirePermission = savedPerm;
+    delete r2.cache[routePath];
+  }
+});

package/tests/core_upgrade_door.mjs

@@ -866,10 +866,25 @@ await t('a box that reached the target by another road supersedes the failure',
 
 await t('AN UNREADABLE REGISTRY LEAVES A FAILURE STANDING — not knowing is not evidence of recovery', () => {
   const now = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'x' };
-  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, recommended: null }, null, now);
+  // An unreadable registry is what the snapshot writer stores when `npm view` fails: an
+  // EMPTY available list, and so no recommendation (provision-core-upgrade.js snapshotCoreVersions).
+  const p = CU.previewFromSnapshot(ACTIVE, { ...SNAP, available: [], recommended: null }, null, now);
   assert.equal(p.last_move.superseded, false, 'the direction to fail in is showing an old failure, never hiding a live one');
 });
 
+await t('an UP-TO-DATE box supersedes an old failure: a read registry with nothing on offer is not "unknown" (task 1004534)', () => {
+  // The live shape, 2026-10-02: cloudbongos served 1.21.5, the registry answered (1168
+  // versions), nothing newer was within its rule, and the page still led with a day-old
+  // "waiting on a decision" about 1.20.73. recommended=null was being read as "the
+  // registry could not be read", so the failure could never become history.
+  const old = { action: 'core-upgrade', state: 'error', target_version: '1.20.73', resolved_at: new Date().toISOString(), last_error: 'x', failure_class: 'needs_decision', failure_reason: 'outside_channel' };
+  const p = CU.previewFromSnapshot(ACTIVE, { served_version: '1.21.5', available: ['1.20.73', '1.21.5'], recommended: null, observed_at: new Date().toISOString() }, null, old);
+  assert.equal(p.behind, false);
+  assert.equal(p.last_move.superseded, true, 'the box is current; a failure about another version is history');
+  assert.equal(CU.lastMoveSuperseded('1.20.73', '1.21.5', null, true), true);
+  assert.equal(CU.lastMoveSuperseded('1.20.73', '1.21.5', null, false), false, 'an unread registry still leaves it standing');
+});
+
 await t('lastMoveSuperseded computes no version ORDERING — only identity', () => {
   // The page's standing rule is that no version comparison happens outside the runner's
   // channel resolution. This helper answers "is this news" without ever asking which of
@@ -885,6 +900,21 @@ await t('lastMoveSuperseded computes no version ORDERING — only identity', ()
   assert.equal(CU.lastMoveSuperseded('1.19.921', '1.19.900', '1.19.949'), true);
 });
 
+console.log('\nthe platform\'s own rule, for Settings and the banner (task 1004535):');
+
+await t('selfUpdateChannel reads the CONTROL-PLANE row\'s rule', async () => {
+  const sqls = [];
+  const db = { query: async (sql) => { sqls.push(sql); return { rows: [{ update_channel: 'minor' }] }; } };
+  assert.equal(await CU.selfUpdateChannel(db), 'minor');
+  assert.match(sqls[0], /hosting_shape = 'control-plane'/, 'this hall\'s own row, never a tenant\'s');
+});
+
+await t('selfUpdateChannel answers null with no row, an unknown value, or a failed read', async () => {
+  assert.equal(await CU.selfUpdateChannel({ query: async () => ({ rows: [] }) }), null);
+  assert.equal(await CU.selfUpdateChannel({ query: async () => ({ rows: [{ update_channel: 'nightly' }] }) }), null);
+  assert.equal(await CU.selfUpdateChannel({ query: async () => { throw new Error('relation does not exist'); } }), null);
+});
+
 console.log('\nthe project\'s update rule (task 1004445):');
 
 const channelHandler = (inst, calls) => updateChannelHandlerFor({

package/tests/core_upgrade_runner.mjs

@@ -232,6 +232,26 @@ await t('the channel refusal names a step that EXISTS on /deploy, never "change
   assert.match(major, /upgrading-the-core\.md/);
 });
 
+await t('a target the box ALREADY SERVES is not a channel refusal — the move is a no-op (task 1004534)', () => {
+  // 2026-10-01 16:32: the sweep and the door both went for 1.20.73; the sweep got there
+  // first, and the door's press was refused as "outside this project's 'minor' update
+  // channel … across a major version or onto a prerelease" — false on every count.
+  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
+  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  assert.equal(R.targetFault('1.20.73', ['1.20.72', '1.20.73'], '1.20.73', 'minor', channelAllows, compare), null,
+    'no fault: the runner\'s own already-serving check answers it as a no-op');
+});
+
+await t('a target BELOW what the box serves says so, and is never called outside the update rule (task 1004534)', () => {
+  const channelAllows = require('../scripts/gds/update-channel.js').channelAllows;
+  const compare = require('../scripts/gds/update-channel.js').compareSemver;
+  const f = R.targetFault('1.20.73', ['1.20.73', '1.21.5'], '1.21.5', 'minor', channelAllows, compare);
+  assert.ok(f, 'still refused — a move never goes backwards on its own');
+  assert.doesNotMatch(f, /update channel|major version|prerelease/, 'none of the channel sentence is true here');
+  assert.match(f, /already runs core 1\.21\.5/);
+  assert.equal(require('../scripts/gds/upgrade-outcome.js').runnerReason(f), 'downgrade');
+});
+
 await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
   const empty = R.targetFault('1.19.760', [], '1.19.758', 'patch', () => true);
   assert.match(empty, /could not read the published core versions/);