@bongos/core 1.23.21 → 1.24.1

package/tests/metrics.mjs

@@ -100,6 +100,96 @@ await test('httpMiddleware records request + duration + auth-failure on res fini
   assert.doesNotMatch(out, /route="\/metrics"/, '/metrics scrape is not self-counted');
 });
 
+// task 1004924 — the label leak. A scanner crawl of random 404 paths used to mint
+// a new counter AND histogram series per path, held forever.
+await test('a crawl of 404 paths collapses to ONE unmatched series, not one per path', async () => {
+  metrics.__resetForTests();
+  const mw = metrics.httpMiddleware();
+  for (let i = 0; i < 300; i++) {
+    const req = fakeReq({ path: `/wp-admin/probe-${i}/x.php`, method: 'GET' });
+    const res = new EventEmitter(); res.statusCode = 404;
+    mw(req, res, () => {}); res.emit('finish');
+  }
+  const out = await metrics.render(fakePool);
+  assert.match(out, /gds_http_requests_total\{method="GET",route="unmatched",status="404"\} 300/);
+  assert.doesNotMatch(out, /probe-/, 'no literal scanner path becomes a label');
+  assert.equal((out.match(/^gds_http_requests_total\{/gm) || []).length, 1, 'one counter series');
+});
+
+await test('a matched route labels by mount path + pattern, never the literal path', async () => {
+  metrics.__resetForTests();
+  const mw = metrics.httpMiddleware();
+  const hit = (req, status) => {
+    const res = new EventEmitter(); res.statusCode = status;
+    mw({ method: 'GET', ...req }, res, () => {}); res.emit('finish');
+  };
+  const routed = { baseUrl: '/api/bongos', route: { path: '/tasks/:id' } };
+  hit({ path: '/tasks/1380', ...routed }, 200);
+  // a matched route that answers 404 (task not found) keeps its own label
+  hit({ path: '/tasks/999999', ...routed }, 404);
+  // a mount path carrying a literal id is normalized, not kept verbatim
+  hit({ path: '/x', baseUrl: '/api/projects/77', route: { path: '/x' } }, 200);
+  // unrouted, non-404 (a static file) keeps the normalized path
+  hit({ path: '/assets/atlas-89d47b50abcd' }, 200);
+  const out = await metrics.render(fakePool);
+  assert.match(out, /route="\/api\/bongos\/tasks\/:id",status="200"\} 1/);
+  assert.match(out, /route="\/api\/bongos\/tasks\/:id",status="404"\} 1/);
+  assert.match(out, /route="\/api\/projects\/:id\/x",status="200"\} 1/);
+  assert.match(out, /route="\/assets\/:hash",status="200"\} 1/);
+  // Scoped to route labels: a duration _sum such as 0.0000393999999... matched a
+  // bare /999999/ and redded this test at random.
+  assert.doesNotMatch(out, /route="[^"]*(1380|999999|projects\/77)/);
+});
+
+await test('through real Express: matched routes label by pattern, unknown paths are unmatched', async () => {
+  const express = require('express');
+  metrics.__resetForTests();
+  const app = express();
+  app.use(metrics.httpMiddleware());
+  const router = express.Router();
+  router.get('/tasks/:id', (req, res) => res.json({ id: req.params.id }));
+  app.use('/api/bongos', router);
+  const server = await new Promise((r) => { const s = app.listen(0, '127.0.0.1', () => r(s)); });
+  try {
+    const port = server.address().port;
+    // node:http with no keep-alive agent, not fetch: pooled fetch sockets still
+    // closing at process.exit abort the run on Windows (libuv assertion).
+    const get = (p) => new Promise((resolve, reject) => {
+      require('node:http').get({ host: '127.0.0.1', port, path: p, agent: false }, (res) => { res.resume(); res.on('end', resolve); }).on('error', reject);
+    });
+    for (const p of ['/api/bongos/tasks/1', '/api/bongos/tasks/abc', '/.env', '/wp-login.php', '/random-slug-zz']) await get(p);
+    await new Promise((r) => setTimeout(r, 20)); // let every 'finish' land
+  } finally { await new Promise((r) => server.close(r)); }
+  const out = await metrics.render(fakePool);
+  assert.match(out, /route="\/api\/bongos\/tasks\/:id",status="200"\} 2/);
+  assert.match(out, /route="unmatched",status="404"\} 3/);
+  assert.doesNotMatch(out, /\.env|wp-login|random-slug/);
+});
+
+await test('series cap: past the cap a metric folds new label sets into one overflow series', async () => {
+  metrics.__resetForTests();
+  // The cap's exact value is not the contract; that it exists and is modest is.
+  const N = 12000;
+  for (let i = 0; i < N; i++) {
+    metrics.incCounter('cap_test_total', 'h', { method: 'GET', route: `/static/f${i}.png`, status: '200' });
+    metrics.observeHistogram('cap_test_seconds', 'h', { method: 'GET', route: `/static/f${i}.png` }, 0.01);
+    metrics.incCounter('cap_noroute_total', 'h', { builder: `b${i}` });
+  }
+  const out = await metrics.render(fakePool);
+  const counterSeries = (out.match(/^cap_test_total\{/gm) || []).length;
+  assert.ok(counterSeries > 1 && counterSeries <= 10001, `bounded: ${counterSeries} series for ${N} label sets`);
+  const folded = N - (counterSeries - 1);
+  // assert.ok, not match: a failing match would dump a multi-megabyte render
+  assert.ok(new RegExp(`cap_test_total\\{method="GET",route="other",status="200"\\} ${folded}\\n`).test(out), 'overflow counter series holds every folded hit');
+  assert.ok(new RegExp(`cap_test_seconds_count\\{method="GET",route="other"\\} ${folded}\\n`).test(out), 'overflow histogram series');
+  // a metric with no route label folds every label to 'other' — still one series
+  assert.equal((out.match(/^cap_noroute_total\{/gm) || []).length, counterSeries);
+  assert.ok(/cap_noroute_total\{builder="other"\}/.test(out), 'route-less overflow series');
+  // an EXISTING series still counts normally once the cap is reached
+  metrics.incCounter('cap_test_total', 'h', { method: 'GET', route: '/static/f0.png', status: '200' });
+  assert.ok(/cap_test_total\{method="GET",route="\/static\/f0\.png",status="200"\} 2/.test(await metrics.render(fakePool)), 'existing series still counts');
+});
+
 await test('authorizeScrape: local Prometheus yes, public no, bearer token yes', () => {
   // loopback, no proxy header → allowed (the local agent)
   assert.equal(metrics.authorizeScrape(fakeReq({ remote: '127.0.0.1' })), true);
@@ -144,4 +234,38 @@ await test('render is resilient: a DB failure still yields process metrics + db_
   assert.match(out, /gds_db_scrape_ok\{?\}? ?0/);
 });
 
+// Task 1004961: a 1 s lag timer kept an idle instance awake forever. Load the
+// module fresh with setInterval spied, and pin that every interval it arms is
+// at least 5 s (the audit's allowed 5-10 s sampling window) and unref'd.
+await test('no sub-5-second interval is armed at load (event-loop lag sampler)', async () => {
+  const realSetInterval = globalThis.setInterval;
+  const armed = [];
+  globalThis.setInterval = (fn, ms, ...rest) => {
+    const t = realSetInterval(fn, ms, ...rest);
+    const unref = t.unref.bind(t);
+    const rec = { ms, unrefd: false };
+    t.unref = () => { rec.unrefd = true; return unref(); };
+    armed.push({ rec, t });
+    return t;
+  };
+  const key = require.resolve('../src/bongos/metrics.js');
+  const cached = require.cache[key];
+  try {
+    delete require.cache[key];
+    const fresh = require('../src/bongos/metrics.js');
+    assert.ok(armed.length >= 1, 'the lag sampler arms an interval');
+    for (const { rec } of armed) {
+      assert.ok(rec.ms >= 5000 && rec.ms <= 10_000, `interval of ${rec.ms} ms is outside 5-10 s`);
+      assert.ok(rec.unrefd, 'the sampler interval is unref\'d');
+    }
+    const out = await fresh.render({ async query() { return { rows: [] }; } });
+    assert.match(out, /# TYPE gds_nodejs_eventloop_lag_seconds gauge/);
+    assert.match(out, /gds_nodejs_eventloop_lag_seconds\{?\}? ?0/);
+  } finally {
+    globalThis.setInterval = realSetInterval;
+    for (const { t } of armed) clearInterval(t);
+    require.cache[key] = cached;
+  }
+});
+
 summary();

package/tests/migration_namespace.mjs

@@ -279,6 +279,20 @@ t('numberCollisions: the one pre-existing collision is grandfathered', () => {
   assert.equal(ns.numberCollisions(other).length, 1, '013 in the same module still fails');
 });
 
+t('numberCollisions: the core 283 pair is grandfathered, and 283 stays closed (task 1004954)', () => {
+  // Two renames off 282 both landed on 283 and are applied on the hub; recording them is
+  // the fix, because a third rename would re-run an applied migration.
+  const pair = ['claimable_ignores_page_markers', 'payout_approvals'].map((s) => ({
+    source: 'core', basename: `core_283_${s}.sql`,
+  }));
+  assert.deepEqual(ns.numberCollisions(pair), [], 'the landed 283 pair is exempt');
+
+  const three = [...pair, { source: 'core', basename: 'core_283_new.sql' }];
+  const c3 = ns.numberCollisions(three);
+  assert.equal(c3.length, 1, 'a NEW third file at 283 still fails');
+  assert.ok(c3[0].files.includes('core_283_new.sql'), 'and the new file is named in the violation');
+});
+
 t('numberCollisions: non-migration filenames are ignored', () => {
   const files = [
     { source: 'module', moduleKey: 'economy', basename: 'README.md' },

package/tests/module_api.mjs

@@ -30,8 +30,10 @@ const PUBLISHED_SURFACE = [
   // published because the artist gate's one escape hatch is the owner's alone, and
   // a module cannot enforce that without being able to ask who the owner is.
   'getFoundingBuilder',
+  'taskNeeds', // task 1004950 (ADR 0395, 1.24.0): what a task needs and what a builder can do — the feed and claim gate read it, and the session optimizer (core) applies the same rule
   'sleep', // task 1004893: THE server-side "wait N milliseconds" (1.23.0) — modules wait through it, never a private copy
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
+  'prelaunchActive', // task 1004998 (1.24.0): is pre-launch (stealth) on? — the adopt preflight refuses a PUBLIC repo while it is
   'grantedScopeCoversRepos', // the create-route credential preflight's scope read (task 1002909); kernel (auth-config.js), unlike db/github-repos which the module reaches via `pool` + its own client
   'accountExistenceReadRateLimit', // task 1003339 (ADR 0209): the shared per-IP budget both account-existence probes spend from — one instance, not a factory, so the budget is genuinely shared
   'publicProjectFeedRateLimit', // task 1002327 (ADR 0252 §5.3): the per-IP ceiling on GET /projects/featured — the platform's most expensive anonymous read (a cold call fans out to up to 500 third-party origins). One instance for the same reason as its neighbour

package/tests/module_loader.mjs

@@ -278,7 +278,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'ai-studio', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'market-watch', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/module_skills_hook.mjs

@@ -0,0 +1,69 @@
+// tests/module_skills_hook.mjs
+//
+// Task 1004915 — session start puts module skills in place for an artist-craft builder.
+// Pins the pure decision and the printed line; the network leg is a thin raw fetch (as in
+// recall_hints.mjs) and the copy itself is pinned by claude_materialize.mjs.
+//
+// Run:  node tests/module_skills_hook.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { wantsModuleSkills, missingModuleSkills, newlyLanded, formatLanded, DEADLINE_MS } =
+  requireHostModule(require, '../.claude/hooks/module-skills.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('an artist-craft builder gets the skills', () => {
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: ['artist'] } }), true);
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: ['engineer', 'artist'] } }), true);
+});
+
+t('anyone else gets nothing (the 2026-09-02 rule holds)', () => {
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: ['engineer'] } }), false);
+  assert.equal(wantsModuleSkills({ builder: { preferred_disciplines: [] } }), false);
+  assert.equal(wantsModuleSkills({ builder: {} }), false);
+});
+
+t('a missing or malformed lookup copies nothing', () => {
+  for (const bad of [null, undefined, {}, { builder: null }, { builder: { preferred_disciplines: 'artist' } }]) {
+    assert.equal(wantsModuleSkills(bad), false);
+  }
+});
+
+t('the line names each new skill and says when it shows up; silent when none landed', () => {
+  const line = formatLanded(['tweak']);
+  assert.ok(line.includes('/tweak') && line.includes('next session'));
+  assert.equal(formatLanded([]), null);
+  assert.equal(formatLanded(undefined), null);
+});
+
+t('only an enabled module absent skills are missing; with all in place nothing is (steady state: no lookup, no copy)', () => {
+  const roster = [
+    { key: 'copy-desk', enabled: true, skills: ['tweak'] },
+    { key: 'pixel-art', enabled: false, skills: ['otb-tile-generate'] },
+  ];
+  assert.deepEqual(missingModuleSkills(roster, []), ['tweak']);
+  assert.deepEqual(missingModuleSkills(roster, ['tweak', 'design']), []);
+  assert.deepEqual(missingModuleSkills(undefined, undefined), []);
+});
+
+t('only what was missing AND landed is announced', () => {
+  assert.deepEqual(newlyLanded(['tweak'], ['tweak', 'other']), ['tweak']);
+  assert.deepEqual(newlyLanded(['tweak'], []), []);
+  assert.deepEqual(newlyLanded([], ['tweak']), []);
+});
+
+t('the network budget stays under the session-start ceiling', () => {
+  assert.ok(DEADLINE_MS <= 2000);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/notes.mjs

@@ -0,0 +1,182 @@
+// tests/notes.mjs — notes on a task or goal, grouped by purpose (task 1004745,
+// goal 1000095).
+//
+// What is pinned: a note is sorted into a purpose (the author's choice, else a
+// plain-word guess); the page gets the notes GROUPED by purpose in a fixed reading
+// order with the newest few open and the rest folded; a note is about a task or a
+// goal and never both or neither; and the purposes the code knows are exactly the
+// ones the table's CHECK allows.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const notes = require(path.join(ROOT, 'modules', 'lifecycle', 'notes.js'));
+
+const at = (n) => new Date(Date.UTC(2026, 9, 1, 0, n)).toISOString();
+const row = (id, kind, minute) => ({ id, kind, created_at: at(minute), body: `note ${id}` });
+
+test('a note with no purpose is sorted by its words, and says it was guessed', () => {
+  const cases = [
+    ['We decided to keep the old route.', 'decision'],
+    ['Risk: this could break the claim gate.', 'risk'],
+    ['Should the page show drafts?', 'question'],
+    ['See https://example.com/spec for the layout', 'reference'],
+    ['Started on the migration, the route is next step', 'progress'],
+    ['Out of scope: the mobile layout', 'scope'],
+    ['hello there', 'other'],
+  ];
+  for (const [text, kind] of cases) {
+    assert.equal(notes.suggestKind(text), kind, text);
+    const v = notes.validateNote({ body: text, task_id: 5 });
+    assert.equal(v.ok, true);
+    assert.equal(v.kind, kind);
+    assert.equal(v.kindSource, 'auto');
+  }
+});
+
+test('a purpose the author chose is kept and recorded as the author\'s', () => {
+  const v = notes.validateNote({ body: 'Should we?', kind: 'scope', goal_id: 2 });
+  assert.equal(v.ok, true);
+  assert.equal(v.kind, 'scope');
+  assert.equal(v.kindSource, 'author');
+});
+
+test('a note is refused with no body, an unknown purpose, or the wrong subject', () => {
+  const reasons = (i) => notes.validateNote(i).errors.map((e) => `${e.field}:${e.reason}`);
+  assert.ok(reasons({ body: '   ', task_id: 1 }).includes('body:required'));
+  assert.ok(reasons({ body: 'x'.repeat(notes.MAX_BODY + 1), task_id: 1 }).some((r) => r.startsWith('body:at most')));
+  assert.ok(reasons({ body: 'x', kind: 'gossip', task_id: 1 }).some((r) => r.startsWith('kind:')));
+  assert.ok(reasons({ body: 'x' }).some((r) => r.startsWith('subject:')), 'neither subject');
+  assert.ok(reasons({ body: 'x', task_id: 1, goal_id: 2 }).some((r) => r.startsWith('subject:')), 'both subjects');
+  assert.ok(reasons({ body: 'x', kind: 'gossip', task_id: 1 }).join().includes('Open questions'), 'the refusal names groups by their labels');
+});
+
+test('notes group by purpose in reading order, empty groups left out', () => {
+  const groups = notes.groupNotes([
+    row(1, 'reference', 1), row(2, 'question', 2), row(3, 'scope', 3), row(4, 'question', 4),
+  ]);
+  assert.deepEqual(groups.map((g) => g.kind), ['scope', 'question', 'reference']);
+  assert.deepEqual(groups.find((g) => g.kind === 'question').count, 2);
+});
+
+test('inside a group the newest comes first, the newest few are open and the rest are folded', () => {
+  const rows = [1, 2, 3, 4, 5].map((i) => row(i, 'decision', i));
+  const [g] = notes.groupNotes(rows);
+  assert.deepEqual(g.open.map((n) => n.id), [5, 4, 3]);
+  assert.deepEqual(g.folded.map((n) => n.id), [2, 1]);
+  assert.equal(g.count, 5);
+  assert.equal(g.latest_at, at(5));
+  assert.equal(notes.groupNotes(rows, { openPerGroup: 1 })[0].folded.length, 4);
+});
+
+test('a note under an unknown purpose shows under Other rather than vanishing', () => {
+  const groups = notes.groupNotes([row(1, 'mystery', 1)]);
+  assert.deepEqual(groups.map((g) => g.kind), ['other']);
+});
+
+test('the purposes in code are exactly the ones the table allows', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'migrations', 'lifecycle_017_notes.sql'), 'utf8');
+  const m = sql.match(/lifecycle_notes_kind_chk\s+CHECK \(kind IN \(([^)]*)\)\)/);
+  assert.ok(m, 'the kind CHECK is present');
+  const allowed = m[1].split(',').map((s) => s.trim().replace(/'/g, '')).sort();
+  assert.deepEqual(allowed, [...notes.KIND_KEYS].sort());
+});
+
+// A fake pool that answers by the SQL it is handed, so the data layer runs for real.
+function fakePool() {
+  const calls = [];
+  const store = [];
+  return {
+    calls,
+    query: async (sql, params) => {
+      calls.push({ sql, params });
+      if (/INSERT INTO lifecycle_notes/.test(sql)) {
+        const [task_id, goal_id, author_id, body, kind, kind_source] = params;
+        const r = { id: String(store.length + 1), task_id, goal_id, author_id, body, kind, kind_source, created_at: at(store.length + 1), updated_at: at(store.length + 1) };
+        store.push(r);
+        return { rows: [{ ...r, author_login: 'sam', author_name: 'Sam', author_avatar_url: null }], rowCount: 1 };
+      }
+      if (/count\(\*\)/.test(sql)) {
+        const col = /task_id = \$1/.test(sql) ? 'task_id' : 'goal_id';
+        return { rows: [{ n: store.filter((x) => String(x[col]) === String(params[0])).length }] };
+      }
+      if (/FROM tasks t LEFT JOIN goals g/.test(sql)) {
+        if (params[0] === 6) return { rows: [] };
+        return { rows: params[0] === 7 ? [{ goal_id: 40, visibility: 'private' }] : [{ goal_id: null, visibility: null }] };
+      }
+      if (/FROM goals g WHERE g\.id/.test(sql)) return { rows: params[0] === 99 ? [] : [{ goal_id: params[0], visibility: params[0] === 40 ? 'private' : 'public' }] };
+      if (/FROM goal_members/.test(sql)) return { rows: params[1] === 11 ? [{}] : [] };
+      if (/FROM lifecycle_notes n JOIN builders/.test(sql)) {
+        const col = /n\.task_id = \$1/.test(sql) ? 'task_id' : 'goal_id';
+        return { rows: store.filter((x) => String(x[col]) === String(params[0])).reverse() };
+      }
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+}
+
+test('adding and reading notes goes through the real data layer, task and goal kept apart', async () => {
+  const pool = fakePool();
+  const a = await notes.addNote({ taskId: 5, authorId: 9, body: 'Decided: ship behind a flag', kind: 'decision', kindSource: 'author' }, { pool });
+  await notes.addNote({ goalId: 2, authorId: 9, body: 'What is the goal?', kind: 'question', kindSource: 'author' }, { pool });
+  assert.equal(a.author_name, 'Sam');
+  assert.deepEqual((await notes.listNotes({ taskId: 5 }, { pool })).map((n) => n.body), ['Decided: ship behind a flag']);
+  assert.deepEqual((await notes.listNotes({ goalId: 2 }, { pool })).map((n) => n.body), ['What is the goal?']);
+  const someone = { id: 12, rank: 'thetes' };
+  assert.equal(await notes.canSee(someone, { taskId: 5 }, { pool }), true);
+  assert.equal(await notes.canSee(someone, { taskId: 6 }, { pool }), false, 'a missing task reads as not found');
+  assert.equal(await notes.canSee({ id: 13, rank: 'archon' }, { goalId: 99 }, { pool }), false, 'even an Archon gets not found for a missing goal');
+});
+
+test('exactly one subject is accepted, as a positive whole number', () => {
+  assert.deepEqual(notes.subjectOf({ task_id: '5' }), { taskId: 5 });
+  assert.deepEqual(notes.subjectOf({ goal_id: 2 }), { goalId: 2 });
+  assert.equal(notes.subjectOf({}), null);
+  assert.equal(notes.subjectOf({ task_id: 1, goal_id: 2 }), null);
+  assert.equal(notes.subjectOf({ task_id: 'abc' }), null);
+  assert.equal(notes.subjectOf({ task_id: -3 }), null);
+});
+
+test('a private goal\'s notes are for its members and an Archon, and so are its tasks\' notes', async () => {
+  const pool = fakePool();
+  const member = { id: 11, rank: 'thetes' };
+  const outsider = { id: 12, rank: 'metic' };
+  const archon = { id: 13, rank: 'archon' };
+  assert.equal(await notes.canSee(member, { goalId: 40 }, { pool }), true);
+  assert.equal(await notes.canSee(outsider, { goalId: 40 }, { pool }), false, 'a Metic who is not a member');
+  assert.equal(await notes.canSee(archon, { goalId: 40 }, { pool }), true);
+  assert.equal(await notes.canSee(outsider, { taskId: 7 }, { pool }), false, 'a task inside the private goal');
+  assert.equal(await notes.canSee(member, { taskId: 7 }, { pool }), true);
+  assert.equal(await notes.canSee(outsider, { goalId: 2 }, { pool }), true, 'a public goal is open');
+  assert.equal(await notes.canSee(outsider, { taskId: 5 }, { pool }), true, 'a task with no goal is open');
+});
+
+test('only the author or a Metic and above may re-file or delete a note', () => {
+  const note = { author_id: '9' };
+  assert.equal(notes.canChange({ id: 9, rank: 'xenos' }, note), true, 'the author');
+  assert.equal(notes.canChange({ id: 10, rank: 'thetes' }, note), false);
+  assert.equal(notes.canChange({ id: 10, rank: 'metic' }, note), true);
+  assert.equal(notes.canChange({ id: 10, rank: 'archon' }, note), true);
+  assert.equal(notes.canChange({ id: 10, rank: 'nonsense' }, note), false, 'an unknown rank fails closed');
+});
+
+test('a task or goal holds a bounded number of notes', async () => {
+  const pool = fakePool();
+  for (let i = 0; i < 3; i += 1) await notes.addNote({ taskId: 5, authorId: 9, body: 'n', kind: 'other', kindSource: 'auto' }, { pool });
+  assert.equal(await notes.countNotes({ taskId: 5 }, { pool }), 3);
+  assert.equal(await notes.countNotes({ goalId: 2 }, { pool }), 0);
+  assert.ok(notes.MAX_NOTES_PER_SUBJECT > 3);
+});
+
+test('the route is registered, and its author is the caller and never the body', () => {
+  const route = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'notes.js'), 'utf8');
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'module.json'), 'utf8'));
+  assert.ok(manifest.contributes.routes.includes('notes'));
+  assert.ok(/authorId: req\.builder\.id/.test(route), 'author is the caller, never the body');
+  assert.ok(!/authorId: (body|req\.body)/.test(route));
+});

package/tests/own_scope_guard.mjs

@@ -89,6 +89,11 @@ const OWN_SCOPED_SURFACES = [
     why: "the caller's OWN hardware security cards — list, register, rename, remove (task 1004746, ADR 0382). Every store call is keyed on req.builder.id; a credential id belonging to somebody else matches no row. The one ungated route serves a vendored static library file.",
     crossOwner: [],
   },
+  {
+    file: 'src/bongos/routes/my-payouts.js',
+    why: "the CALLER's own side of the payout gates (task 1004914, ADR 0385 D8): their payout standing and holds, declaring their own age tier, appealing a hold on their own pay (anyone else's answers 404, and the database refuses an appeal by anyone but the frozen person), and co-signing as themselves where the database checks they are the current guardian. Every route acts on req.builder.id. The approver's routes live apart in routes/payout-gates.js for exactly that reason.",
+    crossOwner: [],
+  },
   {
     file: 'modules/specialities/routes/specialities.js',
     why: "role sub-specialities (task 1003855, ADR 0296). The own-scoped route here is GET /me/specialities — the CALLER's own adoptions, taken from req.builder.id with nothing read off the request. The rest of the router is /specialities/* rather than /me/*, and those are ownership-checked per row against req.builder.id after re-reading the speciality server-side, never from a client-supplied owner id.",

package/tests/page_tweak_marker_sql.mjs

@@ -0,0 +1,76 @@
+// tests/page_tweak_marker_sql.mjs — the page-marker predicate and every copy of it
+// (task 1004947). DB-free: the real-Postgres twin is page_tweak_no_block.mjs.
+//
+// An artist's page claim is a marker, so each overlap read that guards engineering
+// work leaves it out. This drives the real feed and the real batch dry-run through
+// a recording pool and checks the SQL each one SENDS carries the predicate, then
+// pins the three hand copies (the helper, the optimizer's inlined guard, the
+// claimable_tasks view migration) to one another, the way claimable_blocker_status
+// pins the blocker and dependency guards.
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { strict as assert } from 'node:assert';
+import { makeRunner } from './helpers.mjs';
+const require = createRequire(import.meta.url);
+const { test, summary } = makeRunner();
+
+const flat = (s) => String(s).replace(/\s+/g, ' ').trim();
+const read = (...p) => readFileSync(new URL(['..', ...p].join('/'), import.meta.url), 'utf8');
+const { notPageMarkerSql } = require('../modules/lifecycle/page-tweak-artist.js');
+
+const MARKER = "NOT (COALESCE(t.source, '') = 'page-tweak' AND c.worktree_name IS NULL AND c.creator_session_id IS NULL)";
+const MARKER_T2 = MARKER.replace('t.source', 't2.source');
+
+await test('the predicate names the page-tweak source and both NULLs of a web claim', () => {
+  assert.equal(flat(notPageMarkerSql('c', 't')), MARKER);
+  assert.equal(flat(notPageMarkerSql('cl', 'tk')),
+    "NOT (COALESCE(tk.source, '') = 'page-tweak' AND cl.worktree_name IS NULL AND cl.creator_session_id IS NULL)");
+});
+
+await test('a NULL task source keeps the claim COUNTED (the predicate cannot go NULL)', () => {
+  // SQL three-valued logic: `NULL = 'page-tweak'` is NULL, and NOT (NULL AND true AND true)
+  // is NULL, which WHERE reads as false — the claim would silently vanish. COALESCE is
+  // what stops that, so a source-less task's both-NULL claim still counts.
+  assert.match(flat(notPageMarkerSql('c', 't')), /COALESCE\(t\.source, ''\) = 'page-tweak'/);
+});
+
+await test('the optimizer hand copy and the view migration carry the same predicate', () => {
+  const opt = flat(read('src', 'bongos', 'optimizer.js'));
+  assert.ok(opt.includes(`const PAGE_MARKER_GUARD = \`${MARKER_T2}\`;`), 'optimizer declares the guard once, verbatim');
+  assert.ok(opt.includes('AND ${PAGE_MARKER_GUARD} AND t2.touches && t.touches'), 'and the claimable query uses it before the overlap test');
+  const mig = flat(read('migrations', 'core_283_claimable_ignores_page_markers.sql').replace(/^\s*--.*$/gm, ''));
+  assert.ok(mig.includes(`${MARKER_T2} AND t2.touches && t.touches`), 'the view migration carries it verbatim');
+});
+
+// Route the module pool through a recorder, then drive the real functions.
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+const sent = [];
+async function recording(fn) {
+  const orig = api.pool.query;
+  api.pool.query = async (sql, params) => {
+    sent.push(flat(sql));
+    if (/FROM tasks/.test(flat(sql)) && /ANY\(\$1/.test(flat(sql)) && !/FROM claims/.test(flat(sql))) {
+      return { rows: [{ id: params[0][0], status: 'ready', touches: ['a'], module_key: null, requires_rank: 'xenos', version_id: 'V' }] };
+    }
+    return { rows: [] };
+  };
+  try { sent.length = 0; await fn(); } finally { api.pool.query = orig; }
+}
+
+await test('the batch dry-run overlap read leaves page markers out', async () => {
+  await recording(() => db.validateClaimBatch({ taskIds: ['1'], builderId: '1' }).catch(() => {}));
+  const overlap = sent.find((s) => /FROM claims c JOIN tasks t/.test(s) && /released_at IS NULL/.test(s) && /t\.touches/.test(s));
+  assert.ok(overlap, 'the dry-run sent its active-claims read');
+  assert.ok(overlap.includes(MARKER), 'and it carries the marker predicate');
+});
+
+await test('the claimable feed overlap clause leaves page markers out', async () => {
+  await recording(() => db.listClaimableTasks({}));
+  const feed = sent.find((s) => /t2\.touches && t\.touches/.test(s));
+  assert.ok(feed, 'the feed sent its overlap clause');
+  assert.ok(feed.includes(MARKER_T2), 'and it carries the marker predicate');
+});
+
+summary();