@bongos/core 1.23.21 → 1.24.1

package/tests/hall_studio_home.mjs

@@ -129,7 +129,7 @@ function heldClock(h, m) {
   return Held;
 }
 
-function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY, rank = 'metic', queue = null } = {}) {
+function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY, rank = 'metic', queue = null, search = '' } = {}) {
   const root = augment(makeEl('body', {}));
   root.innerHTML = body;
   const byId = (id) => walk(root, (c) => (c.id === id ? c : null));
@@ -166,7 +166,7 @@ function bootStudio({ answers = {}, signedIn = true, at = null, body = BODY, ran
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: {} },
     BongosClient: { createClient: () => client },
-    location: { host: 'builders.cloudbongos.com', hostname: 'builders.cloudbongos.com', protocol: 'https:', search: '', pathname: '/studio', assign: (u) => { out.navigated = u; } },
+    location: { host: 'builders.cloudbongos.com', hostname: 'builders.cloudbongos.com', protocol: 'https:', search, pathname: '/studio', assign: (u) => { out.navigated = u; } },
     localStorage: { getItem: () => null, setItem() {} },
     addEventListener() {},
     scrollTo() {},
@@ -702,6 +702,65 @@ try {
     assert.match(down.el('st-panel-body').innerHTML, /could not be read just now/);
   });
 
+  await test('the full-page reader: a doc at ?note=N and the list at ?view=site, in place of the room, never a dialog', async () => {
+    const note = {
+      id: 31, page_title: 'Projects', page_id: 'site:projects', author_name: 'Ana', status: 'filed', submitted_at: day(1),
+      body_md: ['# Map', 'The labels <b>overlap</b>.', '- one', '- two', '![shot](/api/bongos/page-notes/images/4)', '![evil](https://example.com/x.png)'].join('\n'),
+    };
+    const s = bootStudio({ search: '?note=31', answers: { ...HOME, 'GET /page-notes/31': ok({ note, ideas: [{ id: 7, title: 'Fix the map' }] }) } });
+    await s.settle();
+    assert.equal(s.el('st-doc').hidden, false);
+    assert.ok(s.html.classList.contains('st-reading'), 'the room steps aside');
+    assert.equal(s.el('st-doc-title').textContent, 'Projects');
+    const b = s.el('st-doc-body').innerHTML;
+    assert.match(b, /Ana · /);
+    assert.match(b, /<h3>Map<\/h3>/);
+    assert.match(b, /<li>one<\/li><li>two<\/li>/);
+    assert.match(b, /The labels &lt;b&gt;overlap&lt;\/b&gt;/, 'the doc is escaped');
+    assert.match(b, /<img class="st-doc__img" src="\/api\/bongos\/page-notes\/images\/4"/, 'its own pictures are drawn');
+    assert.doesNotMatch(b, /<img[^>]*example\.com/, 'any other picture stays text');
+    assert.match(b, /It became 1 idea/);
+    assert.match(b, /href="\/#\/idea\/7"/);
+
+    const gone = bootStudio({ search: '?note=99', answers: HOME });
+    await gone.settle();
+    assert.match(gone.el('st-doc-body').innerHTML, /could not be opened/);
+
+    const rows = [{ id: 31, page_id: 'site:projects', page_path: '/projects', page_title: 'Projects', status: 'filed', idea_count: 2, submitted_at: day(1), author_name: 'Ana', excerpt: 'Map labels overlap.', link: '/builders/studio?note=31' }];
+    const list = bootStudio({ search: '?view=site', answers: { ...HOME, 'GET /page-notes/site': ok({ notes: rows }) } });
+    await list.settle();
+    assert.equal(list.el('st-doc-title').textContent, 'From the live site');
+    assert.match(list.el('st-doc-body').innerHTML, /st-doc-list__row" href="\/builders\/studio\?note=31"/);
+
+    const plain = bootStudio({ answers: HOME });
+    await plain.settle();
+    assert.equal(plain.el('st-doc').hidden, true, 'no link, no reader');
+    assert.ok(!plain.html.classList.contains('st-reading'));
+  });
+
+  await test('the overview: the two summary rows sit in the quiet Overview, the three things to do in the actions', () => {
+    const nc = HTML.replace(/<!--[\s\S]*?-->/g, '');
+    const actions = /<div class="st-actions">([\s\S]*?)\n        <\/div>/.exec(nc)[1];
+    const glance = /<div class="st-glance"[^>]*>([\s\S]*?)\n        <\/div>/.exec(nc)[1];
+    for (const id of ['st-resume', 'st-flow', 'studio-approvals']) assert.match(actions, new RegExp(`id="${id}"`), `${id} is an action`);
+    for (const id of ['st-status', 'st-site']) {
+      assert.match(glance, new RegExp(`id="${id}"`), `${id} is an overview row`);
+      assert.doesNotMatch(actions, new RegExp(`id="${id}"`), `${id} is not among the actions`);
+    }
+    const css = fs.readFileSync(new URL('../modules/hall-ui/public/studio.css', import.meta.url), 'utf8');
+    assert.match(css, /\.st-resume::after,\s*\.st-action::after \{/, 'Resume and the doors share the arrow');
+  });
+
+  await test('the reader stands in for the side sheet: craft-mode keeps it shut on the Studio, and a signed-out link says why', async () => {
+    const craft = fs.readFileSync(new URL('../modules/hall-ui/public/craft-mode.js', import.meta.url), 'utf8');
+    assert.match(craft, /getAttribute\('data-page'\) === 'studio'/);
+    assert.match(HTML, /<body[^>]*data-page="studio"/, 'the marker craft-mode reads is on the page');
+    const out = bootStudio({ search: '?note=31', signedIn: false, answers: {} });
+    await out.settle();
+    assert.match(out.el('st-doc-body').innerHTML, /Sign in to read page reviews/);
+    assert.equal(out.requests.some((r) => r.url.includes('/page-notes/')), false, 'nothing is asked for while signed out');
+  });
+
   await test('the markup: one h1 (the greeting), the tally and four doors, the libs before the page, the full-screen switch', () => {
     const nc = HTML.replace(/<!--[\s\S]*?-->/g, '');
     assert.equal((nc.match(/<h1\b/g) || []).length, 1);

package/tests/home_attention_cards.mjs

@@ -35,7 +35,7 @@ const STUBS = `
     return d ? { ok: true, status: 200, data: d } : { ok: false, status: 404, data: null };
   } }) };
   window.OTBKit = { esc: (s) => String(s), fmtAbsDate: () => 'Oct 1' };
-  window.OTBBlockersLib = { blockerFacts: (b) => ({ titleHtml: '<a class="ginbox__goal">' + b.title + '</a>', factsHtml: '', noteHtml: '' }) };
+  window.OTBBlockersLib = { blockerFacts: (b) => ({ titleHtml: '<a class="ginbox__goal">' + b.title + '</a>', factsHtml: '', noteHtml: '' }), humanKind: () => 'task' };
   window.OTB = {
     escapeHtml: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
     toast() {}, rankLabel: (r) => r,

package/tests/hook_shell_tools.mjs

@@ -57,13 +57,19 @@ function entries() {
   return out;
 }
 
+// A hook may ALSO have an entry for the file-writing tools only (secret-gate does,
+// since task 1004931 moved its shell half into the shell-hooks.js dispatcher). What
+// must never exist is an entry naming SOME shell tools but not all — the bug above.
 test('every shell-reading hook is registered, and its matcher names every shell tool', () => {
   const all = entries();
   for (const hook of SHELL_HOOKS) {
     const found = all.filter((e) => e.command.includes(hook));
     assert.ok(found.length > 0, `${hook} is not registered in settings.json at all`);
+    let coversShell = false;
     for (const e of found) {
       const named = e.matcher.split('|').map((s) => s.trim());
+      const shellNamed = SHELL_TOOLS.filter((tool) => named.includes(tool));
+      if (shellNamed.length === 0) continue; // a file-writing-tools entry
       for (const tool of SHELL_TOOLS) {
         assert.ok(
           named.includes(tool),
@@ -71,7 +77,9 @@ test('every shell-reading hook is registered, and its matcher names every shell
             'that shell tool reaches the hook not at all, silently',
         );
       }
+      coversShell = true;
     }
+    assert.ok(coversShell, `${hook} has no entry whose matcher names the shell tools`);
   }
 });
 

package/tests/hooks_drain.mjs

@@ -20,7 +20,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const HOOKS = ['recall-hints', 'rank-change-greeting', 'conductor', 'pull-memory', 'edit-hints', 'stuck-detector'].map((n) => path.join(ROOT, '.claude', 'hooks', `${n}.js`));
+const HOOKS = ['recall-hints', 'module-skills', 'rank-change-greeting', 'conductor', 'pull-memory', 'edit-hints', 'stuck-detector'].map((n) => path.join(ROOT, '.claude', 'hooks', `${n}.js`));
 // The SessionStart/SessionEnd scripts that did network work and then process.exit()ed — 59 recorded
 // UV_HANDLE_CLOSING aborts in three days (task 1003548). Same contract: exit 0 on their own, no abort.
 // session-digest requires `pg` at load (via db-kernel), so it can only be exercised where node_modules

package/tests/host_topology_skips.mjs

@@ -40,6 +40,7 @@ const ALLOWED = {
   first_run_engine_check: '.claude/hooks/session-start.js (package-excluded)',
   hook_core_resolve: '.claude/hooks/_core-resolve.js (package-excluded)',
   'lifecycle-card': '.claude/hooks/lifecycle-card.js (package-excluded)',
+  module_skills_hook: '.claude/hooks/module-skills.js (package-excluded)',
   pre_compact: '.claude/hooks/pre-compact.js (package-excluded)',
   preview_server: 'src/preview-server.js (game module, not in the core)',
   recall_hints: '.claude/hooks/recall-hints.js (package-excluded)',
@@ -47,6 +48,7 @@ const ALLOWED = {
   run_routine_two_root: '.claude/hooks/_core-resolve.js (package-excluded)',
   'session-cards': '.claude/hooks/session-cards.js (package-excluded)',
   session_start_freshness: '.claude/hooks/session-start.js (package-excluded)',
+  shell_hooks: '.claude/hooks/shell-hooks.js (package-excluded)',
   stop_refcheck: '.claude/hooks/stop-refcheck.js (package-excluded; the task-1002234 precedent)',
   stuck_detector: '.claude/hooks/stuck-strikes.js (package-excluded)',
   worktree_guard: '.claude/hooks/worktree-guard.js (package-excluded)',

package/tests/howto_moments.mjs

@@ -119,6 +119,23 @@ test('ordinary prompts are not guide requests', () => {
   }
 });
 
+// Task 1004744: a pasted handoff quoting "skip the tutorial" made the Conductor tell
+// the AI to run `npx bongos howto skip` unasked. Only a prompt that IS the request counts.
+test('a long or multi-line prompt that merely quotes a request is not one', () => {
+  const handoff = [
+    'Continue the onboarding chain from task 1004636.',
+    'Context: the owner said "skip the tutorial" is a valid phrase the guide must accept.',
+    'Next: wire the hall card.',
+  ].join('\n');
+  assert.equal(m.guideRequest(handoff), null, 'multi-line handoff');
+  const oneLong = 'Reviewing the copy for the how-to card: the button reads "skip the tutorial", which matches what the guide accepts, so leave it.';
+  assert.ok(oneLong.length > 100);
+  assert.equal(m.guideRequest(oneLong), null, 'one long line');
+  assert.equal(m.guideRequest('  skip the tutorial  \n'), 'skip', 'surrounding whitespace is still the request');
+  const a = howtoAdvisory({ howto: { read: [] }, prompt: handoff, firstPrompt: false, activeClaims: [] });
+  assert.ok(!a || !String(a.id).startsWith('howto-request:'), 'the Conductor gives no howto command for the handoff');
+});
+
 test('each request tells the AI the command that changes the stored state', () => {
   for (const kind of ['show', 'next', 'skip', 'reset']) assert.match(m.renderRequestForAi(kind), new RegExp(`npx bongos howto ${kind}`));
 });

package/tests/human_signal.mjs

@@ -0,0 +1,141 @@
+// tests/human_signal.mjs — HUMAN TASK / HUMAN DECISION, the one human signal
+// (task 1004922, owner 2026-10-28).
+//
+// Whatever waits on a person says so with a person, the same two words in the
+// hall (a badge drawn by hall-ask.js) and in every AI chat (a marker line the
+// Conductor teaches Claude and AGENTS.md/GEMINI.md teach every other model).
+// The two halves must say the same words, so this file holds them together.
+//
+// Run:  node tests/human_signal.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ask = require('../modules/hall-ui/public/hall-ask.js');
+const conductor = require('../.claude/hooks/conductor.js');
+const blockersLib = require('../modules/hall-ui/public/blockers-lib.js');
+const read = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); console.log(`  PASS  ${name}`); passed += 1; }
+  catch (e) { console.log(`  FAIL  ${name}\n        ${e.message}`); failed += 1; }
+}
+
+const TASK = '🙋 **HUMAN TASK:**';
+const DECISION = '🔀 **HUMAN DECISION:**';
+
+t('an ask card is a HUMAN DECISION unless told otherwise', () => {
+  const h = ask.html({ q: 'Let Ana join?', where: 'A goal', opts: [{ label: 'Let them in' }] });
+  assert.match(h, /hhuman--decision/);
+  assert.match(h, />HUMAN DECISION</);
+  assert.doesNotMatch(h, /HUMAN TASK/);
+  assert.match(h, /A goal/, 'the where line still reads beside the badge');
+});
+
+t('a card for something a person must DO is a HUMAN TASK', () => {
+  const h = ask.html({ q: 'Blocker', human: 'task', opts: [{ label: 'Resolve it' }] });
+  assert.match(h, /hhuman--task/);
+  assert.match(h, />HUMAN TASK</);
+  assert.doesNotMatch(h, /HUMAN DECISION/);
+});
+
+t('a card with no where line carries the badge on its own line, not as an eyebrow', () => {
+  const h = ask.html({ q: 'Blocker', human: 'task' });
+  assert.match(h, /class="hask__human"><span class="hhuman hhuman--task"/);
+  assert.doesNotMatch(h, /hask__where/, 'the Blockers page dropped its repeated eyebrow (task 1004824)');
+});
+
+t('human:false drops the badge and keeps the old dot', () => {
+  const h = ask.html({ q: 'x', where: 'w', human: false });
+  assert.doesNotMatch(h, /hhuman/);
+  assert.match(h, /hask__dot/);
+});
+
+t('an unknown kind draws nothing rather than a wrong signal', () => {
+  assert.equal(ask.human('maybe'), '');
+  assert.equal(ask.human(undefined), '');
+});
+
+t('the badge is a drawn person, never an emoji (voice V4)', () => {
+  for (const k of ['task', 'decision']) {
+    const b = ask.human(k);
+    assert.match(b, /<svg[^>]*aria-hidden="true"/);
+    assert.doesNotMatch(b, /\p{Extended_Pictographic}/u, `${k} badge carries an emoji`);
+  }
+});
+
+t('an Awaiting UAT row is a HUMAN TASK', () => {
+  assert.match(read('modules/hall-ui/public/criterion-uat-ui.js'), /awaiting_uat' && ask \? ask\.human\('task'\)/);
+});
+
+// task 1004946: a blocker's own stored ask says whether it is a task or a choice.
+// The six asks open on the live hub on 2026-10-28, cut to their option keys.
+const opts = (...keys) => ({ ask: { options: keys.map((key) => ({ key, label: key })) } });
+const LIVE = [
+  ['1000193 V2 or V3 or hold', opts('v2', 'v3', 'hold'), 'decision'],
+  ['1000194 bucket or copy or leave', opts('bucket', 'copy', 'none'), 'decision'],
+  ['1000195 set it up / not yet', opts('yes', 'later'), 'task'],
+  ['1000196 do it / not yet', opts('do', 'later'), 'task'],
+  ['1000197 restart / not yet', opts('yes', 'later'), 'task'],
+  ['1000198 scope or split', opts('scope', 'split'), 'decision'],
+];
+
+t('a blocker with two or more real options is a HUMAN DECISION; do-it-or-not-yet is a HUMAN TASK', () => {
+  for (const [name, b, want] of LIVE) assert.equal(blockersLib.humanKind(b), want, name);
+});
+
+t('a blocker with no ask, or only deferrals, is a HUMAN TASK', () => {
+  assert.equal(blockersLib.humanKind({}), 'task');
+  assert.equal(blockersLib.humanKind({ ask: null }), 'task');
+  assert.equal(blockersLib.humanKind(null), 'task');
+  assert.equal(blockersLib.humanKind(opts('do')), 'task');
+  assert.equal(blockersLib.humanKind(opts('later', 'not_yet', 'wait')), 'task');
+});
+
+t('the Blockers page and Home both ask the one rule, never their own', () => {
+  assert.match(read('modules/hall-ui/public/blockers.js'), /human: lib\.humanKind\(b\)/);
+  assert.match(read('modules/hall-ui/public/goal-inbox.js'), /human: lib\.humanKind\(b\),\s*\n\s*where: 'Waiting on the project owner'/);
+});
+
+t('the rendered blocker card wears the badge the rule picks', () => {
+  for (const [name, b, want] of LIVE) {
+    const h = ask.html({ q: name, human: blockersLib.humanKind(b) });
+    assert.match(h, new RegExp(`hhuman--${want}`), name);
+  }
+});
+
+t('the Conductor teaches both markers on a session\'s first prompt, and only then', () => {
+  const first = conductor.evaluateTriggers({ firstPrompt: true }).find((a) => a.id === 'human-signal');
+  assert.ok(first, 'no human-signal advisory on the first prompt');
+  assert.ok(first.text.includes(TASK) && first.text.includes(DECISION), first.text);
+  assert.ok(!conductor.evaluateTriggers({ firstPrompt: false }).some((a) => a.id === 'human-signal'));
+});
+
+t('the one-time human line does not count toward the block fingerprint, so prompt two is still a repeat', () => {
+  const first = conductor.evaluateTriggers({ firstPrompt: true, interaction: { inject: true, contract: 'P' } });
+  const second = conductor.evaluateTriggers({ firstPrompt: false, interaction: { inject: true, contract: 'P' } });
+  assert.equal(conductor.fingerprint(first), conductor.fingerprint(second));
+});
+
+t('an ask is a decision, so the ask-shape reminder wears the decision mark', () => {
+  const a = conductor.evaluateTriggers({ prompt: 'file a blocker' }).find((x) => x.id === 'ask-shape');
+  assert.equal(a.icon, '🔀');
+});
+
+t('every other model reads the same two markers', () => {
+  for (const f of ['AGENTS.md', 'GEMINI.md', 'docs/voice.md']) {
+    const s = read(f);
+    assert.ok(s.includes(TASK) || s.includes('`🙋 **HUMAN TASK:**`'), `${f} lacks the task marker`);
+    assert.ok(s.includes(DECISION), `${f} lacks the decision marker`);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/tests/install_script_reader.mjs

@@ -0,0 +1,51 @@
+// tests/install_script_reader.mjs
+//
+// task 1004924 — the one-line installers (/downloads/bongos/install.sh and
+// install.ps1) were read from disk and re-substituted on EVERY request, a sync
+// read blocking the event loop. src/bongos-downloads.js installScriptReader reads
+// and substitutes each once per process; serve-internal mounts the routes on it.
+//
+// Its own file, not tests/bongos_downloads.mjs: that file needs the host-only
+// config/bongos-cli.json and exits as HOST-TOPOLOGY-SKIP on the neutral core, so
+// a case added there never runs here or in core CI.
+//
+// Run:  node tests/install_script_reader.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { installScriptReader } = require('../src/bongos-downloads.js');
+const { test, summary } = makeRunner();
+
+await test('substitutes the pinned origin, and reads each script from disk once', () => {
+  const reads = [];
+  const read = installScriptReader({
+    readFile: (name) => { reads.push(name); return `BASE=__GDS_API_BASE__\nAGAIN=__GDS_API_BASE__/x\n# ${name}`; },
+    origin: 'https://hub.example',
+  });
+  for (let i = 0; i < 25; i++) {
+    assert.equal(read('bongos-install.sh'), 'BASE=https://hub.example\nAGAIN=https://hub.example/x\n# bongos-install.sh');
+    assert.match(read('bongos-install.ps1'), /^BASE=https:\/\/hub\.example\n/);
+  }
+  assert.deepEqual(reads, ['bongos-install.sh', 'bongos-install.ps1'], 'one disk read per script, not one per request');
+});
+
+await test('a missing script is null (the route 404s), and is not re-read either', () => {
+  let n = 0;
+  const read = installScriptReader({ readFile: () => { n++; throw Object.assign(new Error('nope'), { code: 'ENOENT' }); }, origin: 'https://o' });
+  assert.equal(read('bongos-install.sh'), null);
+  assert.equal(read('bongos-install.sh'), null);
+  assert.equal(n, 1);
+});
+
+await test('serve-internal mounts the installer routes on the memoised reader', () => {
+  const src = readFileSync(new URL('../src/bongos/serve-internal.js', import.meta.url), 'utf8');
+  assert.match(src, /const readBongosInstallScript = installScriptReader\(\{/);
+  assert.doesNotMatch(src, /\.split\('__GDS_API_BASE__'\)/, 'no per-request read + split left in the route file');
+  assert.equal((src.match(/readBongosInstallScript\('bongos-install\.(sh|ps1)'\)/g) || []).length, 2, 'both installer routes use it');
+});
+
+summary();

package/tests/integration_fixture_ids.mjs

@@ -0,0 +1,82 @@
+// tests/integration_fixture_ids.mjs — no two real-Postgres tests hand-pick the same
+// fixture id (task 1005008).
+//
+// The integration tests share ONE database and seed rows at fixed ids in the
+// 9xxxxxxx range. Task 1004950's task_needs_db.mjs picked builder ids 90000401-403,
+// which page_tweak_no_block.mjs already used; that test failed part-way and its
+// cleanup could not delete its builders (rows its claims had written still pointed
+// at them), so the next file's INSERT hit a duplicate key and main's integration
+// job went red, blocking every release. An id two files share is a collision
+// waiting for one of them to leave a row behind.
+//
+// The ids already shared when this guard landed are frozen below. The list may
+// only shrink: give a new test ids nobody else uses (grep the range first).
+//
+// Run:  node tests/integration_fixture_ids.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+
+const require = createRequire(import.meta.url);
+const { INTEGRATION, INTEGRATION_PARKED } = require('../scripts/bongos/run-unit-tests.js');
+const HERE = path.dirname(url.fileURLToPath(import.meta.url));
+
+// Shared before task 1005008, each by tests that have not collided in practice.
+const KNOWN_SHARED = new Set([
+  '90000301', '90000302', '90000303', // claim_gate_open_blocker, clawback_confirmed_backlog, reward_mode_cost_plus_only
+  '90000401', // page_tweak_no_block, goal_spec_task_db
+  '90000411', // page_tweak_no_block, task_criteria_unlink_db, session_cost_row_raise
+  '90000801', '90000802', // acclaim_feed_evidence_db, blocker_hall_live_proof
+]);
+
+function sharedIds() {
+  const owners = new Map();
+  let scanned = 0;
+  for (const name of [...INTEGRATION, ...INTEGRATION_PARKED]) {
+    const file = path.join(HERE, `${name}.mjs`);
+    if (!fs.existsSync(file)) continue;
+    scanned++;
+    for (const id of new Set(fs.readFileSync(file, 'utf8').match(/\b9\d{7}\b/g) || [])) {
+      if (!owners.has(id)) owners.set(id, []);
+      owners.get(id).push(name);
+    }
+  }
+  return { scanned, shared: [...owners].filter(([, names]) => names.length > 1) };
+}
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
+}
+
+const { scanned, shared } = sharedIds();
+
+t('the scan actually read the integration tests', () => {
+  assert.ok(scanned >= 40, `expected the integration set on disk, read ${scanned} file(s)`);
+});
+
+t('no new fixture id is shared between two integration tests', () => {
+  const fresh = shared.filter(([id]) => !KNOWN_SHARED.has(id));
+  assert.deepEqual(fresh.map(([id, names]) => `${id}: ${names.join(', ')}`), [],
+    'pick an unused id range for the newer test');
+});
+
+t('the frozen list only names ids that are still shared (shrink it when one is fixed)', () => {
+  const still = new Set(shared.map(([id]) => id));
+  assert.deepEqual([...KNOWN_SHARED].filter((id) => !still.has(id)), []);
+});
+
+t('task_needs_db uses its own ids (the collision that reddened main)', () => {
+  const src = fs.readFileSync(path.join(HERE, 'task_needs_db.mjs'), 'utf8');
+  const pt = fs.readFileSync(path.join(HERE, 'page_tweak_no_block.mjs'), 'utf8');
+  const ids = (s) => new Set(s.match(/\b9\d{7}\b/g) || []);
+  const overlap = [...ids(src)].filter((id) => ids(pt).has(id));
+  assert.deepEqual(overlap, []);
+});
+
+console.log(`\nintegration_fixture_ids (task 1005008): ${passed} passed, ${failed} failed`);
+if (failed) process.exitCode = 1;

package/tests/invite_expiry_db.mjs

@@ -110,7 +110,7 @@ try {
   await q(`INSERT INTO builders (id, github_login) VALUES (42, 'owner')`);
   for (const f of ['060_access_requests', 'core_230_access_requests_applicant_vouch',
     'core_254_access_requests_applicant_handle', 'core_255_access_requests_invite_kind',
-    'core_266_access_requests_invited_login_idx']) await q(coreSql(f));
+    'core_266_access_requests_invited_login_idx', 'core_282_builders_lower_login_idx']) await q(coreSql(f));
 
   // ── The instance: the door, the queues, the probe ────────────────────────
   console.log('the instance:');
@@ -135,6 +135,18 @@ try {
   await q('RESET enable_seqscan');
   ok(/idx_access_requests_invited_login/.test(plan), 'the sign-in gate can read invited rows through core_266\'s index');
 
+  // core_282 (task 1004923): the onboarding routes' "already a member?" probe
+  // compares lower(github_login), which only an expression index can serve.
+  await q('SET enable_seqscan = off');
+  const memberPlan = (await q('EXPLAIN SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1', ['Owner']))
+    .rows.map((r) => r['QUERY PLAN']).join('\n');
+  await q('RESET enable_seqscan');
+  ok(/idx_builders_lower_login/.test(memberPlan), 'the member-by-login probe reads builders through core_282\'s index');
+  ok((await q('SELECT 1 FROM builders WHERE lower(github_login) = lower($1)', ['OWNER'])).rowCount === 1,
+    'and still matches a login case-insensitively');
+  await q(coreSql('core_282_builders_lower_login_idx'));
+  ok(true, 'core_282 re-runs cleanly (IF NOT EXISTS, ON CONFLICT DO NOTHING)');
+
   const hist = Object.fromEntries((await call('GET', '/api/gds/access-requests?status=invited')).json.requests.map((r) => [r.github_login, r]));
   ok(hist.fay.expired === true && hist.eve.expired === false && hist.cy.expired === false, 'the queue marks only the expired invite');
   ok(hist.cy.expires_at === null && new Date(hist.fay.expires_at) <= new Date() && new Date(hist.eve.expires_at) > new Date(),

package/tests/lib_sh_resolution.mjs

@@ -39,10 +39,6 @@ const fitness = require(path.join(GDS, 'fitness.js'));
 const SMOKES = [
   'lib.sh',
   'smoke-write.sh',
-  'smoke-batch-claim.sh',
-  'smoke-batch-release.sh',
-  'smoke-claim-consistency.sh',
-  'smoke-dependencies.sh',
   'portability-smoke-memory.sh',
 ];