@bongos/core 1.23.21 → 1.23.22

package/tests/module_skills_hook.mjs

@@ -0,0 +1,69 @@
+// tests/module_skills_hook.mjs
+//
+// Task 1004915 — session start puts module skills in place for an artist-craft builder.
+// Pins the pure decision and the printed line; the network leg is a thin raw fetch (as in
+// recall_hints.mjs) and the copy itself is pinned by claude_materialize.mjs.
+//
+// Run:  node tests/module_skills_hook.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { wantsModuleSkills, missingModuleSkills, newlyLanded, formatLanded, DEADLINE_MS } =
+  requireHostModule(require, '../.claude/hooks/module-skills.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('an artist-craft builder gets the skills', () => {
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: ['artist'] } }), true);
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: ['engineer', 'artist'] } }), true);
+});
+
+t('anyone else gets nothing (the 2026-09-02 rule holds)', () => {
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: ['engineer'] } }), false);
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: [] } }), false);
+  assert.equal(wantsModuleSkills({ builder: {} }), false);
+});
+
+t('a missing or malformed lookup copies nothing', () => {
+  for (const bad of [null, undefined, {}, { builder: null }, { builder: { preferred_disciplines: 'artist' } }]) {
+    assert.equal(wantsModuleSkills(bad), false);
+  }
+});
+
+t('the line names each new skill and says when it shows up; silent when none landed', () => {
+  const line = formatLanded(['tweak']);
+  assert.ok(line.includes('/tweak') && line.includes('next session'));
+  assert.equal(formatLanded([]), null);
+  assert.equal(formatLanded(undefined), null);
+});
+
+t('only an enabled module absent skills are missing; with all in place nothing is (steady state: no lookup, no copy)', () => {
+  const roster = [
+    { key: 'copy-desk', enabled: true, skills: ['tweak'] },
+    { key: 'pixel-art', enabled: false, skills: ['otb-tile-generate'] },
+  ];
+  assert.deepEqual(missingModuleSkills(roster, []), ['tweak']);
+  assert.deepEqual(missingModuleSkills(roster, ['tweak', 'design']), []);
+  assert.deepEqual(missingModuleSkills(undefined, undefined), []);
+});
+
+t('only what was missing AND landed is announced', () => {
+  assert.deepEqual(newlyLanded(['tweak'], ['tweak', 'other']), ['tweak']);
+  assert.deepEqual(newlyLanded(['tweak'], []), []);
+  assert.deepEqual(newlyLanded([], ['tweak']), []);
+});
+
+t('the network budget stays under the session-start ceiling', () => {
+  assert.ok(DEADLINE_MS <= 2000);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/public_landing_projects.mjs

@@ -458,6 +458,43 @@ test('a stamped asset still serves — the query string is not part of the filen
   assert.match(res.body, /\.shell\{/, 'and it must be the real stylesheet');
 });
 
+/* ── How long a landing asset may be kept (task 1004925) ──────────────────────
+   A URL carrying the file's CURRENT stamp can never name other bytes, so it is
+   kept for a year; a stale or made-up stamp, or a bare URL, must not be — that
+   is how a changed file still reaches a returning visitor. ── */
+
+const IMMUTABLE = 'public, max-age=31536000, immutable';
+
+test('a stamped landing asset is cached for a year', async () => {
+  const page = await request('/projects');
+  const urls = [...page.body.matchAll(/(?:href|src)="(\/assets\/[^"?]+\?v=[0-9a-f]{8})"/g)].map((m) => m[1]);
+  assert.ok(urls.some((u) => /\.css\?/.test(u)), 'the page stamps at least one stylesheet');
+  assert.ok(urls.some((u) => /\.js\?/.test(u)), 'the page stamps at least one script');
+  for (const u of urls) {
+    const res = await request(u);
+    assert.equal(res.status, 200, u);
+    assert.equal(res.headers['cache-control'], IMMUTABLE, `${u} carries its content stamp`);
+  }
+});
+
+test('a bare, stale or made-up stamp is never cached for a year', async () => {
+  const page = await request('/projects');
+  const real = (page.body.match(/\/assets\/cosmos\.css\?v=([0-9a-f]{8})/) || [])[1];
+  assert.ok(real, 'need the real stamp');
+  const stale = real === '00000000' ? '11111111' : '00000000';
+  for (const u of ['/assets/cosmos.css', `/assets/cosmos.css?v=${stale}`, '/assets/cosmos.css?v=3', `/assets/cosmos.css?v=${real}x`]) {
+    const res = await request(u);
+    assert.equal(res.status, 200, u);
+    assert.doesNotMatch(String(res.headers['cache-control'] || ''), /immutable|31536000/, `${u} must stay short-lived`);
+  }
+});
+
+test('an unstamped landing image is kept for a day', async () => {
+  const res = await request('/assets/world/r2-chrome-blob-one-cut.webp');
+  assert.equal(res.status, 200);
+  assert.equal(res.headers['cache-control'], 'public, max-age=86400');
+});
+
 // ── #view-mine: the ways to /invitations and /account ──────────────────────────
 // The hall's my-projects page was deleted in task 1003308 on the owner's own
 // decision that this is a hub surface, and task 1003774 brought its lists here.

package/tests/session_start_freshness.mjs

@@ -16,10 +16,15 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { decideFreshness } = requireHostModule(require, '../.claude/hooks/session-start.js');
+const {
+  decideFreshness, planFetch, viewNote, staleViewLine, lastMainFetchMs, FETCH_FRESH_MS, FETCH_OLD_NOTE_MS,
+} = requireHostModule(require, '../.claude/hooks/session-start.js');
 
 let passed = 0;
 let failed = 0;
@@ -120,5 +125,65 @@ test('dirty and ahead → still just warn (no pull)', () => {
   assert.equal(d.action, 'warn');
 });
 
+// ---------- the fetch is off the critical path (task 1004928) ----------
+// The hook used to block on `git fetch` (4 s timeout). It now judges against the local
+// origin/main, fetches in the background when that view is old, and says how old it is.
+
+const NOW = Date.parse('2026-10-28T12:00:00Z');
+const MIN = 60000;
+
+test('planFetch: a view fetched under 10 min ago is used as-is, no fetch', () => {
+  const p = planFetch({ lastFetchMs: NOW - 9 * MIN, nowMs: NOW });
+  assert.equal(p.background, false);
+  assert.equal(p.ageMs, 9 * MIN);
+});
+
+test('planFetch: an older view starts a background fetch', () => {
+  assert.equal(planFetch({ lastFetchMs: NOW - FETCH_FRESH_MS, nowMs: NOW }).background, true);
+});
+
+test('planFetch: never fetched (null) → background fetch, age unknown', () => {
+  const p = planFetch({ lastFetchMs: null, nowMs: NOW });
+  assert.equal(p.background, true);
+  assert.equal(p.ageMs, null);
+});
+
+test('viewNote: the behind-count names the age of its origin/main', () => {
+  assert.equal(viewNote({ ageMs: 4 * MIN, background: false }), 'as fetched 4m ago');
+  assert.equal(viewNote({ ageMs: 3 * 60 * MIN, background: true }), 'as fetched 3h ago; a fresh fetch is running in the background');
+  assert.match(viewNote({ ageMs: null, background: true }), /time unknown/);
+});
+
+test('staleViewLine: silent when the view is fresh or merely minutes old', () => {
+  assert.equal(staleViewLine({ ageMs: 2 * MIN, background: false }), null);
+  assert.equal(staleViewLine({ ageMs: 20 * MIN, background: true }), null);
+});
+
+test('staleViewLine: an old or unknown view says "up to date" is unconfirmed instead of staying silent', () => {
+  assert.match(staleViewLine({ ageMs: FETCH_OLD_NOTE_MS, background: true }), /last fetched 1h ago.*unconfirmed/);
+  assert.match(staleViewLine({ ageMs: null, background: true }), /never been fetched/);
+});
+
+test('lastMainFetchMs: the newest FETCH_HEAD across worktrees that recorded main wins', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ss-fetch-'));
+  try {
+    fs.mkdirSync(path.join(dir, 'worktrees', 'a'), { recursive: true });
+    fs.mkdirSync(path.join(dir, 'worktrees', 'b'), { recursive: true });
+    const main = "abc\t\tbranch 'main' of https://example.invalid/repo\n";
+    const other = "def\t\tbranch 'feature' of https://example.invalid/repo\n";
+    const put = (rel, body, t) => { const f = path.join(dir, rel); fs.writeFileSync(f, body); fs.utimesSync(f, t / 1000, t / 1000); };
+    put('FETCH_HEAD', main, NOW - 60 * MIN);
+    put(path.join('worktrees', 'a', 'FETCH_HEAD'), main, NOW - 5 * MIN);
+    put(path.join('worktrees', 'b', 'FETCH_HEAD'), other, NOW - 1 * MIN); // newest, but not main
+    assert.equal(Math.round(lastMainFetchMs(dir) / 1000), Math.round((NOW - 5 * MIN) / 1000));
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('lastMainFetchMs: no FETCH_HEAD anywhere → null (never fetched)', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ss-fetch-'));
+  try { assert.equal(lastMainFetchMs(dir), null); } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  assert.equal(lastMainFetchMs(null), null);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/shell_hooks.mjs

@@ -0,0 +1,209 @@
+// tests/shell_hooks.mjs — the per-shell-call hooks run in ONE node process
+// (.claude/hooks/shell-hooks.js, task 1004931) and conclude exactly what the separate
+// processes did. Every case SPAWNS the dispatcher with a real payload (the contract
+// Claude Code sees: exit code, stdout JSON, stderr) and, where it matters, spawns the
+// same hooks ALONE and compares — so a drift between a hook's run() and its own main()
+// reds here.
+//
+// .claude/hooks/ is package-excluded, so a clean core checkout skips this file
+// (tests/host_topology_skips.mjs carries the allowlist entry).
+//
+// Run:  node tests/shell_hooks.mjs
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { requireHostModule } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const dispatcher = requireHostModule(require, '../.claude/hooks/shell-hooks.js');
+const { plainCardLines } = require('../scripts/bongos/plain-cards.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOOKS = path.join(ROOT, '.claude', 'hooks');
+const DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'shell-hooks-'));
+const ENV = {
+  ...process.env, OTB_STUCK_DIR: DIR, CLAUDE_PROJECT_DIR: ROOT,
+  BONGOS_STUCK_DETECTOR_OFF: '', BONGOS_GIT_GUARD_OFF: '', BONGOS_SECRET_GATE_OFF: '', OTB_SECRET_GATE_OFF: '',
+  BONGOS_ALLOW_RULE_GUARD_OFF: '', OTB_SESSION_CARDS_OFF: '', OTB_SUBAGENT: '',
+};
+const PRE = ['secret-gate.js', 'git-guard.js', 'allow-rule-guard.js'];
+const POST = ['lifecycle-card.js', 'stuck-detector.js'];
+
+function spawn(file, args, input, env = {}) {
+  const r = spawnSync(process.execPath, [path.join(HOOKS, file), ...args], {
+    input: typeof input === 'string' ? input : JSON.stringify(input), encoding: 'utf8', timeout: 15000, env: { ...ENV, ...env },
+  });
+  return { status: r.status, stdout: r.stdout || '', stderr: r.stderr || '' };
+}
+const together = (names, payload, env) => spawn('shell-hooks.js', names, payload, env);
+const alone = (name, payload, env) => spawn(name, [], payload, env);
+const out = (r) => (r.stdout.trim() ? JSON.parse(r.stdout).hookSpecificOutput : null);
+// A credential-shaped string built at runtime, so this file never holds one literally.
+const FAKE_KEY = ['gh', 'p_'].join('') + 'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8';
+const shell = (tool, command, extra = {}) => ({ session_id: `s-${Math.random()}`, tool_name: tool, tool_input: { command }, ...extra });
+
+// ---- PreToolUse -----------------------------------------------------------
+t('a clean command: exit 0, nothing on stdout or stderr — same as each hook alone', () => {
+  for (const tool of ['Bash', 'PowerShell']) {
+    const p = shell(tool, 'ls -la');
+    const r = together(PRE, p);
+    assert.deepEqual(r, { status: 0, stdout: '', stderr: '' }, tool);
+    for (const h of PRE) assert.equal(alone(h, p).status, 0, `${h} alone`);
+  }
+});
+
+t('git-guard blocks through the dispatcher with the exact stderr it prints alone', () => {
+  const p = shell('Bash', 'git stash push -m x');
+  const a = alone('git-guard.js', { ...p, session_id: 's-gg-alone' });
+  const r = together(PRE, { ...p, session_id: 's-gg-together' });
+  assert.equal(a.status, 2);
+  assert.equal(r.status, 2, 'a block is still exit 2');
+  assert.equal(r.stderr, a.stderr, 'the block reason is the one git-guard gives on its own');
+  assert.equal(r.stdout, '');
+});
+
+t('secret-gate blocks a credential in a shell command through the dispatcher', () => {
+  const p = shell('PowerShell', `echo ${FAKE_KEY}`);
+  const a = alone('secret-gate.js', p);
+  const r = together(PRE, p);
+  assert.equal(a.status, 2);
+  assert.equal(r.status, 2);
+  assert.equal(r.stderr, a.stderr);
+});
+
+t('two hooks blocking at once: exit 2 and BOTH reasons, never a JSON answer beside them', () => {
+  const p = shell('PowerShell', `git stash push -m ${FAKE_KEY}`);
+  const r = together(PRE, p);
+  assert.equal(r.status, 2);
+  assert.match(r.stderr, /secret-gate: blocked/);
+  assert.match(r.stderr, /git-guard: blocked/);
+  assert.equal(r.stdout, '', 'a block outranks the allow-rule-guard ask');
+});
+
+t('allow-rule-guard asks on PowerShell through the dispatcher, with its own JSON', () => {
+  const p = shell('PowerShell', 'git status $(Remove-Item x)');
+  const a = alone('allow-rule-guard.js', p);
+  const r = together(PRE, p);
+  assert.equal(r.status, 0);
+  assert.deepEqual(out(r), out(a));
+  assert.equal(out(r).permissionDecision, 'ask');
+  assert.equal(together(PRE, shell('Bash', 'git status $(rm x)')).stdout, '', 'Bash is not its tool');
+});
+
+t('kill switches still work through the dispatcher', () => {
+  assert.equal(together(PRE, shell('Bash', 'git stash push -m x'), { BONGOS_GIT_GUARD_OFF: '1' }).status, 0);
+  assert.equal(together(PRE, shell('Bash', `echo ${FAKE_KEY}`), { BONGOS_SECRET_GATE_OFF: '1' }).status, 0);
+  assert.equal(together(PRE, shell('PowerShell', 'git status $(x)'), { BONGOS_ALLOW_RULE_GUARD_OFF: '1' }).stdout, '');
+});
+
+t('the third git-guard block in a session still carries the stuck line (the shared counter runs)', () => {
+  const p = { ...shell('Bash', 'git branch -D x'), session_id: 's-third' };
+  together(PRE, p); together(PRE, p);
+  assert.match(together(PRE, p).stderr, /\[otb-stuck\]/);
+});
+
+// ---- PostToolUse ----------------------------------------------------------
+t('stuck-detector context comes through the dispatcher on the third wall, as alone', () => {
+  const card = plainCardLines('TASK_NOT_READY', {}).join('\n');
+  const mk = (s) => ({ ...shell('Bash', 'node scripts/bongos/claim.js 9'), session_id: s, hook_event_name: 'PostToolUse', tool_response: { stdout: card, stderr: '' } });
+  for (let i = 0; i < 2; i++) { alone('stuck-detector.js', mk('s-post-alone')); together(POST, mk('s-post-together')); }
+  const a = alone('stuck-detector.js', mk('s-post-alone'));
+  const r = together(POST, mk('s-post-together'));
+  assert.equal(r.status, 0);
+  assert.deepEqual(out(r), out(a));
+  assert.match(out(r).additionalContext, /\[otb-stuck\]/);
+});
+
+t('lifecycle-card context comes through the dispatcher, as alone', () => {
+  const cardPath = path.join(DIR, 'otb-ship-card-77.html');
+  fs.writeFileSync(cardPath, '<div>card</div>');
+  const p = { ...shell('Bash', 'node scripts/bongos/claim.js 77'), hook_event_name: 'PostToolUse', tool_response: { stdout: `[otb-card-html] ${cardPath}\n`, stderr: '' } };
+  const a = alone('lifecycle-card.js', p);
+  const r = together(POST, p);
+  assert.ok(out(a), 'fixture: lifecycle-card alone injects a card');
+  assert.deepEqual(out(r), out(a));
+  assert.equal(together(POST, p, { OTB_SESSION_CARDS_OFF: '1' }).stdout, '', 'its kill switch holds');
+});
+
+t('two context producers in one call are merged into one JSON, both texts kept', () => {
+  const merged = dispatcher.merge([
+    { code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: 'one' } }) },
+    { code: 0, stdout: '' },
+    { code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: 'two' } }) },
+  ]);
+  assert.equal(merged.code, 0);
+  assert.deepEqual(JSON.parse(merged.stdout).hookSpecificOutput, { hookEventName: 'PostToolUse', additionalContext: 'one\n\ntwo' });
+});
+
+t('the most restrictive permission decision wins, with its own reason', () => {
+  const ans = (d, why) => ({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: d, permissionDecisionReason: why } }) });
+  const h = JSON.parse(dispatcher.merge([ans('ask', 'a'), ans('deny', 'd'), ans('allow', 'x')]).stdout).hookSpecificOutput;
+  assert.equal(h.permissionDecision, 'deny');
+  assert.equal(h.permissionDecisionReason, 'd');
+});
+
+// ---- failure modes --------------------------------------------------------
+t('unparseable stdin: every hook fails open — exit 0, silent', () => {
+  assert.deepEqual(together([...PRE, ...POST], 'not json'), { status: 0, stdout: '', stderr: '' });
+});
+
+t('a missing hook is visible (exit 1, one line) and never blocks; the others still run', () => {
+  const r = together(['no-such-hook.js', 'git-guard.js'], shell('Bash', 'ls'));
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /no-such-hook\.js/);
+  const b = together(['no-such-hook.js', 'git-guard.js'], shell('Bash', 'git stash push -m x'));
+  assert.equal(b.status, 2, 'a real block still blocks beside a missing hook');
+});
+
+t('only plain sibling names load — no paths, not itself', () => {
+  for (const bad of ['../hooks/git-guard.js', 'sub/x.js', 'shell-hooks.js', 'git-guard', '']) {
+    assert.equal(dispatcher.loadHook(bad), null, bad);
+  }
+  assert.equal(typeof dispatcher.loadHook('git-guard.js'), 'function');
+});
+
+t('a hook that throws fails open; the rest of the roster still answers', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'shell-hooks-throw-'));
+  fs.writeFileSync(path.join(tmp, 'boom.js'), 'module.exports = { run() { throw new Error("x"); } };');
+  fs.writeFileSync(path.join(tmp, 'ctx.js'), 'module.exports = { run: () => ({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: "kept" } }) }) };');
+  const r = dispatcher.dispatch(['boom.js', 'ctx.js'], '{}', process.env, tmp);
+  assert.equal(r.code, 0);
+  assert.equal(JSON.parse(r.stdout).hookSpecificOutput.additionalContext, 'kept');
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+// ---- wiring ---------------------------------------------------------------
+t('settings.json: one process per shell call on each side, rostered by file name, through run-node.sh', () => {
+  const settings = JSON.parse(fs.readFileSync(path.join(ROOT, '.claude', 'settings.json'), 'utf8'));
+  const shellEntries = (event) => (settings.hooks[event] || [])
+    .filter((g) => (g.matcher || '').split('|').includes('Bash'))
+    .flatMap((g) => g.hooks.map((h) => h.command));
+  const pre = shellEntries('PreToolUse');
+  const post = shellEntries('PostToolUse');
+  assert.equal(pre.length, 1, `PreToolUse spawns ${pre.length} processes per Bash call`);
+  assert.equal(post.length, 1, `PostToolUse spawns ${post.length} processes per Bash call`);
+  for (const [cmd, roster] of [[pre[0], PRE], [post[0], POST]]) {
+    assert.match(cmd, /run-node\.sh/);
+    assert.match(cmd, /shell-hooks\.js/);
+    for (const h of roster) assert.ok(cmd.includes(` ${h}`), `${h} missing from "${cmd}"`);
+  }
+  for (const h of [...PRE, ...POST]) {
+    assert.equal(typeof dispatcher.loadHook(h), 'function', `${h} exports run()`);
+  }
+});
+
+fs.rmSync(DIR, { recursive: true, force: true });
+console.log(`\nshell_hooks: ${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/tests/ship_assurance.mjs

@@ -385,5 +385,33 @@ await t('the gate sends the cause as the error MESSAGE, which is what the CLI pr
   assert.match(src, /res\.fail\(code, \{ status, message, details \}\)/);
 });
 
+// Task 1004879: the audit row used method 'SHIP', which audit_log's CHECK
+// refuses, so every write failed into a warning. Read the allowed list from the
+// migration itself, so a future verb change is checked against the real rule.
+await t('the ship-assurance audit row uses a method audit_log accepts', async () => {
+  const { recordShipAssurance } = require(path.join(ROOT, 'modules/lifecycle/ship-assurance.js'));
+  const sql = fs.readFileSync(path.join(ROOT, 'migrations/033_audit_log.sql'), 'utf8');
+  const m = sql.match(/method\s+text NOT NULL CHECK \(method IN \(([^)]*)\)\)/);
+  assert.ok(m, 'migration 033 still declares the method CHECK');
+  const allowed = m[1].split(',').map((s) => s.trim().replace(/'/g, ''));
+  assert.ok(allowed.length >= 4, `parsed the allowed list: ${allowed}`);
+  const rows = [];
+  const warns = [];
+  await recordShipAssurance({
+    insertAuditLog: async (row) => {
+      if (!allowed.includes(row.method)) throw new Error('violates check constraint "audit_log_method_check"');
+      rows.push(row);
+    },
+    taskId: 7,
+    builderId: 1,
+    assurance: { kind: 'proof', sha: TIP },
+    log: { warn: (...a) => warns.push(a.join(' ')) },
+  });
+  assert.deepEqual(warns, []);
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].route, '/tasks/7/ship');
+  assert.deepEqual(rows[0].requestBodyRedacted, { ship_assurance: { kind: 'proof', sha: TIP } });
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/ship_card.mjs

@@ -54,6 +54,10 @@ test('fmtTokens / fmtUsd / fmtMins', () => {
 });
 
 // ---- shipped ----
+// task 1004741: shipped means MERGED. With no reading of the live build the card
+// must not say "live" — a merge reaches no instance until a release carries it.
+const MERGED_NOT_LIVE = 'merged · 967fb4a — not live until a published release carries it and the pin moves';
+
 test('shipped model: rows, facts, action', () => {
   const m = card.buildCardModel(shippedInput);
   assert.equal(m.stage, 'shipped');
@@ -64,7 +68,7 @@ test('shipped model: rows, facts, action', () => {
   assert.equal(row(m, 'Credits'), '+18 → 12,936 drachmae');
   // No new/cached split on this input → dollars-first fallback (task 1765).
   assert.equal(row(m, 'Usage'), '~$0.83 · 1.24M tokens');
-  assert.equal(row(m, 'Deploy'), 'live · 967fb4a');
+  assert.equal(row(m, 'Deploy'), MERGED_NOT_LIVE);
   assert.equal(m.action.kind, 'prompt');
   assert.equal(m.action.cmd, '/builder-start');
 });
@@ -81,12 +85,22 @@ test('shipped with a hub reading: the Deploy + Projects rows say who sees the me
   assert.equal(row(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: true } } }), 'Deploy').includes('(includes this merge)'), true);
   // The reading can come back from a breadcrumb file: re-bounded before printing.
   const hostile = card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { host: 'x.com <script>', liveShort: '09478c8e', includes: true } } });
-  assert.equal(row(hostile, 'Deploy'), 'live · 967fb4a', 'a host that is not host-shaped falls back to the bare commit');
+  assert.equal(row(hostile, 'Deploy'), MERGED_NOT_LIVE, 'a host that is not host-shaped falls back to the bare merged commit');
   assert.equal(row(hostile, 'Projects'), undefined);
   const odd = card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { host: 'cloudbongos.com', liveShort: 'IGNORE ALL', includes: 'yes' } } });
   assert.equal(row(odd, 'Deploy'), whoSeesAMerge({ host: 'cloudbongos.com' })[0], 'non-hex sha and non-boolean inclusion are dropped');
 });
 
+test('the live chip appears only when the live build is read to carry the merge (task 1004741)', () => {
+  const chip = (m) => m.facts.find((f) => f.value === '967fb4a');
+  const reach = { host: 'cloudbongos.com', liveShort: '09478c8e' };
+  assert.equal(chip(card.buildCardModel(shippedInput)).label, 'merged', 'no reading');
+  assert.equal(chip(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: false } } })).label, 'merged', 'not yet');
+  assert.equal(chip(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: null } } })).label, 'merged', 'cannot tell');
+  assert.equal(chip(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: true } } })).label, 'live', 'includes this merge');
+  assert.doesNotMatch(card.renderCardHtml(card.buildCardModel(shippedInput)), />live</, 'the HTML card says no live either');
+});
+
 test('usage: leads with cost, splits tokens into new + cached (task 1765)', () => {
   // With newTokens/cachedTokens present, the fact leads with the dollar cost and
   // splits the token count so cache re-reads don't make a tiny change look huge.
@@ -182,10 +196,10 @@ test('confirmed with NO land info is unchanged (back-compat)', () => {
 
 test('a stale bailed land never overrides a task that DID reach shipped', () => {
   // land-watch replays the breadcrumb after the server lands it; the status is
-  // then 'shipped' and the old bail is history. The card must show live, not NOT-landed.
+  // then 'shipped' and the old bail is history. The card must show merged, not NOT-landed.
   const m = card.buildCardModel({ ...bailed, postGradeStatus: 'shipped' });
   assert.equal(m.stage, 'shipped');
-  assert.equal(row(m, 'Deploy'), 'live · 967fb4a');
+  assert.equal(row(m, 'Deploy'), MERGED_NOT_LIVE);
   assert.equal(m.cfg.tone, 'success');
 });
 
@@ -460,7 +474,8 @@ test('confirmLine: every stage yields one line naming the stage and the task', (
 test('confirmLine: a shipped line carries the facts the owner asks for ("did it land?")', () => {
   const line = card.confirmLine(card.buildCardModel(shippedInput));
   assert.match(line, /^shipped: task 1266/, 'leads with the outcome, not chrome');
-  assert.match(line, /deploy live/, 'says it actually deployed — the commit rides in this row');
+  assert.match(line, /deploy merged · 967fb4a/, 'says it merged — the commit rides in this row');
+  assert.doesNotMatch(line, /\blive ·/, 'never claims live without a reading of the live build (task 1004741)');
   assert.match(line, /credits/, 'carries the credit outcome');
 });
 

package/tests/strand_watch.mjs

@@ -206,5 +206,53 @@ await t('both status queues are fetched CONCURRENTLY, not serially', async () =>
   assert.equal(maxInFlight, sw.WATCHED.length, `expected ${sw.WATCHED.length} concurrent fetches, saw ${maxInFlight}`);
 });
 
+// ---- the SessionStart line stays off the critical path (task 1004928) --------
+// The audit timed --line at 8.2 s, the floor for every session start. The answer is now kept
+// 15 min, served with its age up to 2 h while a detached child refreshes it, and a cold read is
+// bounded as a whole.
+
+const M = 60000;
+await t('linePlan: a record under 15 min is fresh — printed with no ledger read', () => {
+  assert.equal(sw.linePlan({ at: NOW - 14 * M, value: 'x' }, NOW), 'fresh');
+  assert.equal(sw.linePlan({ at: NOW - 1, value: null }, NOW), 'fresh', 'a cached clean board is an answer too');
+});
+
+await t('linePlan: 15 min to 2 h is stale — printed with its age, refreshed in the background', () => {
+  assert.equal(sw.linePlan({ at: NOW - sw.LINE_FRESH_MS, value: 'x' }, NOW), 'stale');
+  assert.equal(sw.linePlan({ at: NOW - 119 * M, value: 'x' }, NOW), 'stale');
+});
+
+await t('linePlan: past 2 h, missing, malformed or from the future is a miss — read the ledger', () => {
+  assert.equal(sw.linePlan({ at: NOW - sw.LINE_STALE_MAX_MS, value: 'x' }, NOW), 'miss');
+  assert.equal(sw.linePlan(null, NOW), 'miss');
+  assert.equal(sw.linePlan({ value: 'x' }, NOW), 'miss');
+  assert.equal(sw.linePlan({ at: NOW + 5 * M, value: 'x' }, NOW), 'miss', 'a clock that moved must not freeze an answer forever');
+});
+
+await t('labelStale: a stale strand line says how old it is; a stale clean board stays silent', () => {
+  const out = sw.labelStale('Stranded ship: task 1002459 (confirmed, 4d).', 40 * M);
+  assert.match(out, /^Stranded ship: task 1002459/);
+  assert.match(out, /Checked 40m ago; refreshing for the next session\.\)$/);
+  assert.equal(sw.labelStale(null, 40 * M), null);
+});
+
+await t('produceLine: returns the line from a real read', async () => {
+  const call = async (_m, url) => ({ tasks: url.includes('confirmed')
+    ? [{ id: '1002459', status: 'confirmed', updated_at: ago(4 * D), needs_rebase: true, needs_rebase_reason: 'strand:land_not_proven' }] : [] });
+  const out = await sw.produceLine({ nowMs: NOW, call }, 1000);
+  assert.match(out, /task 1002459/);
+});
+
+await t('produceLine: an undetermined read THROWS, so a silence is never cached as a clean board', async () => {
+  await assert.rejects(sw.produceLine({ nowMs: NOW, call: async () => { throw new Error('ECONNREFUSED'); } }, 1000));
+});
+
+await t('produceLine: the deadline bounds the WHOLE read, not each call', async () => {
+  // Every call hangs; check() alone would wait timeoutMs per stage. The deadline must cut it.
+  const started = Date.now();
+  await assert.rejects(sw.produceLine({ nowMs: NOW, call: () => new Promise(() => {}) }, 150));
+  assert.ok(Date.now() - started < 1500, `took ${Date.now() - started}ms`);
+});
+
 console.log(`\nstrand_watch: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/version_close_route.mjs

@@ -166,7 +166,7 @@ function closePool({ status = 'building', goalStatus = 'open', remaining = 0, st
   return txPool((sql) => {
     const q = String(sql).replace(/\s+/g, ' ');
     if (/FROM versions WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: 'V1', status }] };
-    if (/FROM goals WHERE id = \$1 AND version_id = \$2 FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 'g', status: goalStatus }] };
+    if (/FROM goals WHERE id = ANY\(\$1::bigint\[\]\) AND version_id = \$2 ORDER BY id FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 'g', status: goalStatus }] };
     if (/UPDATE tasks SET status = 'abandoned'/.test(q)) return { rows: [{ id: 11 }, { id: 12 }] };
     // R17 (task 1003604) — the roll_forward writes: the successor INSERT, the
     // membership copy, and the task re-point.