@bongos/core 1.23.22 → 1.24.1

package/modules/market-watch/seed.js

@@ -0,0 +1,252 @@
+'use strict';
+
+// modules/market-watch/seed.js — load the 2026-10-28 market research into the HUB's
+// Market Watch, once (task 1004936, goal 1000137).
+//
+// WHAT. seed/market-data.json (36 companies scored on the five market dimensions) and
+// seed/partners-data.json (24 philosophy-aligned partners, scored on five values) become
+// tracked items, one 'seed' run, their score snapshots under that run, a few sourced case
+// file entries each, and version 1 of the watch rules. Those two files are the research
+// as it was delivered, committed unchanged; this file is the only reader.
+//
+// WHO GETS IT. The hub only. Every project is its own instance and database (ADR 0393),
+// and this research is about the platform's own market, so a project that turns Market
+// Watch on starts empty and tracks its own names. The hub is the instance that runs
+// platform-identity (the same test src/bongos/routes/feedback.js uses). The project key
+// is the instance's own public origin, read from branding, never a hardcoded name.
+//
+// IDEMPOTENT BY CONSTRAINT, not by a marker. One seed run per project (a partial unique
+// index), items unique on (project, kind, url, name), snapshots on (item, run, dimension),
+// entries on (item, run, takeaway), rules on (project, version): every insert is
+// ON CONFLICT DO NOTHING, all in one transaction. A second load changes nothing, and an
+// item an owner later removed stays removed because its row still exists.
+//
+// NOT A PERSON. Seeded rows carry no author (NULL). The research was a session's work,
+// not a member's act, and an invented author would be a false record.
+//
+// THE BOUNDARY (ADR 0093 §1): core is reached only through ../../src/module-api.js.
+
+const path = require('node:path');
+const fs = require('node:fs');
+
+const SEED_DIR = path.join(__dirname, 'seed');
+const RESEARCH_DATE = '2026-10-28';
+const RESEARCH_AT = `${RESEARCH_DATE}T12:00:00Z`;
+
+// The two rubrics the research scored on. Keys are the JSON files' own score keys, so
+// a snapshot's `dimension` is the research's word for it. Definitions are the research
+// notes' axes in one line each; weights are 1 (the rules page's "x1"), since the research
+// judged "overall" separately rather than averaging.
+const RUBRIC = Object.freeze({
+  competitor: Object.freeze([
+    { key: 'ai_agents_write_code', label: 'AI agents write the code', definition: 'How far AI agents, not people, write and open the code changes.', weight: 1 },
+    { key: 'human_gates', label: 'Humans hold the gates', definition: 'How much people govern the agents: scope, approvals, review and deploy gates.', weight: 1 },
+    { key: 'contributor_economy', label: 'Contributors get paid', definition: 'Whether contributors are paid or credited for the work they ship.', weight: 1 },
+    { key: 'open_source_ethos', label: 'Open source, self-host', definition: 'An open licence and the ability to run it yourself.', weight: 1 },
+    { key: 'multi_project_hub', label: 'Many projects, one hub', definition: 'One place that hosts many projects and their people.', weight: 1 },
+  ]),
+  partner: Object.freeze([
+    { key: 'open_source', label: 'Open source', definition: 'Builds and funds open-source software.', weight: 1 },
+    { key: 'worker_ownership', label: 'Worker ownership', definition: 'Workers or contributors own or steer the organisation.', weight: 1 },
+    { key: 'transparency', label: 'Transparency', definition: 'Decisions, money and records are public.', weight: 1 },
+    { key: 'human_oversight_ai', label: 'Human oversight of AI', definition: 'Insists people review and answer for what AI makes.', weight: 1 },
+    { key: 'cooperative_economics', label: 'Cooperative economics', definition: 'Shares value with the people who create it.', weight: 1 },
+  ]),
+});
+
+// Version 1 of the rules: what the research session searched, read and asked for.
+const RULES_V1 = Object.freeze({
+  version: 1,
+  summary: 'first rules, from the 2026-10-28 research',
+  reason: 'Seeded from the 2026-10-28 market and partner research.',
+  searchQueries: [
+    'AI agent that writes code and opens pull requests',
+    'self-hosted AI software engineer, open source',
+    'pay open-source contributors per task',
+    'open-source funding and grants for AGPL projects',
+    'worker-owned and cooperative software organisations',
+  ],
+  sources: [
+    'company sites and pricing pages',
+    'changelogs and GitHub releases',
+    'funding news, two sources or marked unverified',
+  ],
+  instructions: 'For each tracked item, find what changed this week. Every finding needs a source link and a confidence (low, medium, high); mark single-source claims unverified. Re-score each rubric dimension 0 to 10 and give a one-line reason for any change. Then write five lines for the team: what moved this week, who moved it, and the one thing we should look at. Plain words. No hype.',
+});
+
+function readSeed(name, dir = SEED_DIR) {
+  return JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'));
+}
+
+function hostOf(url) {
+  try { return new URL(url).hostname.replace(/^www\./, ''); } catch { return ''; }
+}
+
+const isHttp = (u) => typeof u === 'string' && /^https?:\/\//.test(u);
+// A research string that says it is unverified is low confidence; otherwise medium.
+// Nothing in the seed is high: it was one session's desk research, never re-checked.
+const confidenceOf = (text) => (/unverified|unclear|conflict|disagree/i.test(String(text)) ? 1 : 2);
+
+// buildSeed({ market, partners }) → { rules, items } — pure: the rows the seed writes,
+// each item carrying its scores and its case-file entries. Tested without a database.
+function buildSeed({ market, partners }) {
+  if (!Array.isArray(market) || !Array.isArray(partners)) throw new Error('buildSeed: market and partners must be arrays');
+  const items = [];
+  for (const c of market) {
+    const scores = { ...c.scores, overall: c.overall_likeness };
+    const entries = [];
+    if (c.what) entries.push({ type: 'insight', takeaway: c.what, confidence: confidenceOf(c.what), dimension: null });
+    if (c.pricing) entries.push({ type: 'datapoint', takeaway: `Pricing: ${c.pricing}`, confidence: confidenceOf(c.pricing), dimension: 'contributor_economy' });
+    if (c.funding_size) entries.push({ type: 'datapoint', takeaway: `Funding: ${c.funding_size}`, confidence: confidenceOf(c.funding_size), dimension: null });
+    if (c.open_source_self_host) entries.push({ type: 'datapoint', takeaway: `Open source / self-host: ${c.open_source_self_host}`, confidence: confidenceOf(c.open_source_self_host), dimension: 'open_source_ethos' });
+    items.push({
+      kind: 'competitor',
+      name: c.name,
+      url: c.url,
+      category: c.category || '',
+      description: c.what || '',
+      whyTracked: c.partner_candidate
+        ? 'A competitor in the 2026-10-28 market research that it also named a possible partner.'
+        : 'A competitor in the 2026-10-28 market research.',
+      facts: {
+        pricing: c.pricing || null,
+        funding: c.funding_size || null,
+        open_source_self_host: c.open_source_self_host || null,
+        partner_candidate: !!c.partner_candidate,
+      },
+      scores,
+      entries: entries.map((e) => ({ ...e, sourceUrl: c.url, sourceLabel: hostOf(c.url) })),
+    });
+  }
+  for (const p of partners) {
+    const scores = { ...p.scores, overall: p.overall };
+    const src = isHttp(p.quote_url) ? p.quote_url : p.url;
+    const entries = [];
+    if (p.partnership) entries.push({ type: 'insight', takeaway: p.partnership, confidence: confidenceOf(p.partnership), dimension: null });
+    if (p.quote) entries.push({ type: 'datapoint', takeaway: `In their words: "${p.quote}"`, confidence: 3, dimension: null });
+    else if (p.quote_note) entries.push({ type: 'datapoint', takeaway: p.quote_note, confidence: 1, dimension: null });
+    for (const u of p.unverified || []) entries.push({ type: 'datapoint', takeaway: `Unverified: ${u}`, confidence: 1, dimension: null });
+    items.push({
+      kind: 'partner',
+      name: p.name,
+      url: p.url,
+      category: p.category || '',
+      description: p.partnership || '',
+      whyTracked: `A philosophy-aligned partner, ranked ${p.rank} of ${partners.length} in the 2026-10-28 partner research.`,
+      facts: { rank: p.rank, quote: p.quote || null, quote_url: p.quote_url || null, unverified: p.unverified || [] },
+      scores,
+      entries: entries.map((e) => ({ ...e, sourceUrl: src, sourceLabel: hostOf(src) })),
+    });
+  }
+  for (const it of items) {
+    if (!isHttp(it.url)) throw new Error(`buildSeed: ${it.name} has no http(s) url`);
+    for (const [k, v] of Object.entries(it.scores)) {
+      if (typeof v !== 'number' || v < 0 || v > 10) throw new Error(`buildSeed: ${it.name} ${k} score ${v} is not 0..10`);
+    }
+  }
+  return { rules: { ...RULES_V1, rubric: RUBRIC }, items };
+}
+
+// projectKey(origin) — the instance's public origin, lower-cased, no trailing slash: the
+// one spelling every market_watch_* row's `project` uses.
+function projectKey(origin) {
+  const s = String(origin || '').trim().replace(/\/+$/, '').toLowerCase();
+  return /^https?:\/\/[^/\s]+$/.test(s) ? s : null;
+}
+
+function defaultIsHub() {
+  try { return require('../../src/module-api').isModuleEnabled('platform-identity') === true; } catch { return false; }
+}
+function defaultProject() {
+  try { return projectKey(require('../../src/module-api').branding().domains.publicOrigin); } catch { return null; }
+}
+
+// writeSeed(client, project, seed) — the inserts, on a client already inside a
+// transaction. Returns counts of rows actually inserted (0 everywhere on a re-run).
+async function writeSeed(client, project, seed) {
+  const n = { rules: 0, runs: 0, items: 0, scores: 0, entries: 0 };
+  const r = seed.rules;
+  const ins = await client.query(
+    `INSERT INTO market_watch_rule_versions
+       (project, version, status, search_queries, sources, rubric, instructions, summary, reason, approved_at, created_at)
+     VALUES ($1, $2, 'active', $3::jsonb, $4::jsonb, $5::jsonb, $6, $7, $8, $9, $9)
+     ON CONFLICT (project, version) DO NOTHING
+     RETURNING id`,
+    [project, r.version, JSON.stringify(r.searchQueries), JSON.stringify(r.sources), JSON.stringify(r.rubric),
+      r.instructions, r.summary, r.reason, RESEARCH_AT],
+  );
+  n.rules += ins.rowCount;
+  const { rows: [rule] } = await client.query(
+    'SELECT id FROM market_watch_rule_versions WHERE project = $1 AND version = $2', [project, r.version]);
+
+  const runIns = await client.query(
+    `INSERT INTO market_watch_runs (project, status, trigger, rule_version_id, started_at, finished_at, created_at)
+     VALUES ($1, 'done', 'seed', $2, $3, $3, $3)
+     ON CONFLICT (project) WHERE trigger = 'seed' DO NOTHING
+     RETURNING id`,
+    [project, rule.id, RESEARCH_AT],
+  );
+  n.runs += runIns.rowCount;
+  const { rows: [run] } = await client.query(
+    "SELECT id FROM market_watch_runs WHERE project = $1 AND trigger = 'seed'", [project]);
+
+  for (const it of seed.items) {
+    const itemIns = await client.query(
+      `INSERT INTO market_watch_items
+         (project, kind, name, url, category, description, why_tracked, facts, added_via, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, 'seed', $9, $9)
+       ON CONFLICT (project, kind, url, name) DO NOTHING
+       RETURNING id`,
+      [project, it.kind, it.name, it.url, it.category, it.description, it.whyTracked, JSON.stringify(it.facts), RESEARCH_AT],
+    );
+    n.items += itemIns.rowCount;
+    const { rows: [item] } = await client.query(
+      'SELECT id FROM market_watch_items WHERE project = $1 AND kind = $2 AND url = $3 AND name = $4',
+      [project, it.kind, it.url, it.name]);
+    for (const [dimension, value] of Object.entries(it.scores)) {
+      const s = await client.query(
+        `INSERT INTO market_watch_score_snapshots (item_id, run_id, dimension, value, created_at)
+         VALUES ($1, $2, $3, $4, $5)
+         ON CONFLICT (item_id, run_id, dimension) DO NOTHING`,
+        [item.id, run.id, dimension, value, RESEARCH_AT],
+      );
+      n.scores += s.rowCount;
+    }
+    for (const e of it.entries) {
+      const s = await client.query(
+        `INSERT INTO market_watch_log_entries
+           (item_id, run_id, type, found_on, takeaway, dimension, source_url, source_label, confidence, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+         ON CONFLICT (item_id, run_id, md5(takeaway)) DO NOTHING`,
+        [item.id, run.id, e.type, RESEARCH_DATE, e.takeaway, e.dimension, e.sourceUrl, e.sourceLabel, e.confidence, RESEARCH_AT],
+      );
+      n.entries += s.rowCount;
+    }
+  }
+  return n;
+}
+
+// seedHub(deps) → { seeded: true, project, inserted } | { seeded: false, skipped }.
+// deps.pool / isHub / project / seed are test seams; production reads the doorway.
+async function seedHub(deps = {}) {
+  const isHub = deps.isHub !== undefined ? deps.isHub : defaultIsHub();
+  if (isHub !== true) return { seeded: false, skipped: 'not_hub' };
+  const project = deps.project !== undefined ? projectKey(deps.project) : defaultProject();
+  if (!project) return { seeded: false, skipped: 'no_project_origin' };
+  const pool = deps.pool || require('../../src/module-api').pool;
+  const seed = deps.seed || buildSeed({ market: readSeed('market-data.json'), partners: readSeed('partners-data.json') });
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const inserted = await writeSeed(client, project, seed);
+    await client.query('COMMIT');
+    return { seeded: true, project, inserted };
+  } catch (e) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw e;
+  } finally {
+    client.release();
+  }
+}
+
+module.exports = { seedHub, writeSeed, buildSeed, readSeed, projectKey, RUBRIC, RULES_V1, RESEARCH_DATE };

package/modules/market-watch/store.js

@@ -0,0 +1,230 @@
+'use strict';
+
+// modules/market-watch/store.js — the weekly run's reads and writes (task 1004937, ADR 0394).
+//
+// run.js decides; this file is the only place that spells the run's SQL. Every function
+// takes the project key and every statement filters on it, so a run can only ever read
+// or write its own project's rows.
+//
+// THE CROSS-PROJECT GUARD IS IN THE SQL, not only in the caller. Each item result is
+// written in one transaction that first proves the item AND the run both belong to the
+// project (`guardSql`); if they do not, nothing is written and the call throws
+// `cross_project`. The log entries and score snapshots are then inserted with
+// INSERT ... SELECT ... WHERE i.project = $project, so even a statement that somehow ran
+// past the guard could not land a row on another project's item.
+//
+// WRITTEN ONCE. An item's result moves its run_items row to 'done' or 'error' in the same
+// transaction as its entries and scores, guarded by `status NOT IN ('done','error')`. A
+// second write for the same (run, item) — a resumed run, a second process — finds the
+// row already finished, rolls back, and reports recorded: false, so the caller never
+// mirrors its cost a second time.
+
+const db = require('./db');
+
+const LEASE_SQL = `now() + ($3::bigint * interval '1 millisecond')`;
+
+const SETTINGS_SQL = `SELECT enabled, monthly_cap_usd, cadence FROM market_watch_settings WHERE project = $1`;
+
+async function readSettings(pool, project) {
+  const { rows: [s] } = await pool.query(SETTINGS_SQL, [project]);
+  if (!s) return { ...db.DEFAULT_SETTINGS };
+  return { enabled: s.enabled === true, monthly_cap_usd: Number(s.monthly_cap_usd), cadence: s.cadence, configured: true };
+}
+
+const LAST_RUN_SQL = `
+  SELECT id, status, reason, trigger, created_at, claimed_until
+    FROM market_watch_runs WHERE project = $1
+   ORDER BY created_at DESC, id DESC LIMIT 1`;
+
+// The newest run of any kind (the seed run included): what the weekly clock counts from.
+async function lastRun(pool, project) {
+  const { rows: [r] } = await pool.query(LAST_RUN_SQL, [project]);
+  return r ? { ...r, id: Number(r.id) } : null;
+}
+
+const OPEN_RUN_SQL = `
+  SELECT id, status, rule_version_id, cap_usd, claimed_until, (claimed_until IS NOT NULL AND claimed_until > now()) AS leased
+    FROM market_watch_runs WHERE project = $1 AND status IN ('queued', 'running')
+   ORDER BY id LIMIT 1`;
+
+async function openRun(pool, project) {
+  const { rows: [r] } = await pool.query(OPEN_RUN_SQL, [project]);
+  return r ? { ...r, id: Number(r.id), leased: r.leased === true } : null;
+}
+
+const SKIPPED_SQL = `
+  INSERT INTO market_watch_runs (project, status, reason, trigger, rule_version_id, cap_usd, spent_before_usd, finished_at)
+  VALUES ($1, 'skipped', $2, $3, $4, $5, $6, now())
+  RETURNING id`;
+
+// A run that never started is still a row, with its reason (the settings strip shows it).
+async function insertSkipped(pool, project, { reason, trigger = 'poller', ruleVersionId = null, capUsd = null, spentBeforeUsd = null }) {
+  const { rows: [r] } = await pool.query(SKIPPED_SQL, [project, reason, trigger, ruleVersionId, capUsd, spentBeforeUsd]);
+  return Number(r.id);
+}
+
+// Created already running and leased, in one statement. ON CONFLICT against the
+// one-open-run-per-project index (market_watch_002): a second process that found the same
+// run due gets no row back and stands down.
+const CREATE_SQL = `
+  INSERT INTO market_watch_runs (project, status, trigger, rule_version_id, cap_usd, spent_before_usd, claimed_until, started_at)
+  VALUES ($1, 'running', $2, $4, $5, $6, ${LEASE_SQL}, now())
+  ON CONFLICT (project) WHERE status IN ('queued', 'running') DO NOTHING
+  RETURNING id`;
+
+async function createRun(pool, project, { trigger = 'poller', ruleVersionId, capUsd, spentBeforeUsd, leaseMs }) {
+  const { rows } = await pool.query(CREATE_SQL, [project, trigger, leaseMs, ruleVersionId, capUsd, spentBeforeUsd]);
+  return rows[0] ? Number(rows[0].id) : null;
+}
+
+// Take (or retake) an open run whose lease has lapsed: the single-flight claim.
+const CLAIM_SQL = `
+  UPDATE market_watch_runs
+     SET status = 'running', claimed_until = ${LEASE_SQL}, started_at = COALESCE(started_at, now())
+   WHERE project = $1 AND id = $2 AND status IN ('queued', 'running')
+     AND (claimed_until IS NULL OR claimed_until < now())
+  RETURNING id`;
+
+async function claimRun(pool, project, runId, leaseMs) {
+  const { rows } = await pool.query(CLAIM_SQL, [project, runId, leaseMs]);
+  return rows.length === 1;
+}
+
+const RENEW_SQL = `
+  UPDATE market_watch_runs SET claimed_until = ${LEASE_SQL}
+   WHERE project = $1 AND id = $2 AND status = 'running'
+  RETURNING id`;
+
+async function renewLease(pool, project, runId, leaseMs) {
+  const { rows } = await pool.query(RENEW_SQL, [project, runId, leaseMs]);
+  return rows.length === 1;
+}
+
+const FINISH_SQL = `
+  UPDATE market_watch_runs SET status = $3, reason = $4, finished_at = now(), claimed_until = NULL
+   WHERE project = $1 AND id = $2 AND status IN ('queued', 'running')
+  RETURNING id`;
+
+async function finishRun(pool, project, runId, { status, reason = null }) {
+  const { rows } = await pool.query(FINISH_SQL, [project, runId, status, reason]);
+  return rows.length === 1;
+}
+
+// Mark an item started. The INSERT ... SELECT only matches when both the run and the item
+// are this project's, and a finished row is never reopened.
+const START_ITEM_SQL = `
+  INSERT INTO market_watch_run_items (run_id, item_id, status, started_at)
+  SELECT r.id, i.id, 'running', now()
+    FROM market_watch_runs r JOIN market_watch_items i ON i.project = r.project
+   WHERE r.project = $1 AND r.id = $2::bigint AND i.id = $3::bigint
+  ON CONFLICT (run_id, item_id) DO UPDATE SET status = 'running', started_at = now()
+   WHERE market_watch_run_items.status NOT IN ('done', 'error')
+  RETURNING item_id`;
+
+async function startItem(pool, project, runId, itemId) {
+  const { rows } = await pool.query(START_ITEM_SQL, [project, runId, itemId]);
+  return rows.length === 1;
+}
+
+const GUARD_SQL = `
+  SELECT 1 FROM market_watch_items i
+    JOIN market_watch_runs r ON r.project = i.project
+   WHERE i.project = $1 AND r.id = $2 AND i.id = $3`;
+
+const ENTRY_SQL = `
+  INSERT INTO market_watch_log_entries (item_id, run_id, type, takeaway, dimension, source_url, source_label, confidence)
+  SELECT i.id, $3::bigint, $4::text, $5::text, $6::text, $7::text, $8::text, $9::smallint
+    FROM market_watch_items i WHERE i.project = $1 AND i.id = $2
+  ON CONFLICT (item_id, run_id, md5(takeaway)) DO NOTHING`;
+
+const SCORE_SQL = `
+  INSERT INTO market_watch_score_snapshots (item_id, run_id, dimension, value, reason)
+  SELECT i.id, $3::bigint, $4::text, $5::numeric, $6::text
+    FROM market_watch_items i WHERE i.project = $1 AND i.id = $2
+  ON CONFLICT (item_id, run_id, dimension) DO NOTHING`;
+
+// A candidate is a PROPOSAL to add an item, never an item. Skipped when the project
+// already tracks something by that name; one per name per run (market_watch_002).
+const PROPOSAL_SQL = `
+  INSERT INTO market_watch_proposals (project, kind, origin, run_id, payload, reason)
+  SELECT $1::text, 'add_item', 'run', $2::bigint, $3::jsonb, $4::text
+   WHERE NOT EXISTS (SELECT 1 FROM market_watch_items x WHERE x.project = $1 AND lower(x.name) = lower($5::text))
+  ON CONFLICT DO NOTHING`;
+
+const FINISH_ITEM_SQL = `
+  UPDATE market_watch_run_items SET status = $3, error = $4, cost_usd = $5, finished_at = now()
+   WHERE run_id = $1 AND item_id = $2 AND status NOT IN ('done', 'error')
+  RETURNING item_id`;
+
+// recordItem — one item's whole result, in one transaction. Returns { recorded, counts }.
+// Throws Error('cross_project') if the run or the item is not this project's.
+async function recordItem(pool, project, runId, itemId, result) {
+  const r = result || {};
+  const client = await pool.connect();
+  const counts = { entries: 0, scores: 0, proposals: 0 };
+  try {
+    await client.query('BEGIN');
+    const { rows: guard } = await client.query(GUARD_SQL, [project, runId, itemId]);
+    if (guard.length !== 1) {
+      await client.query('ROLLBACK');
+      const e = new Error('cross_project');
+      e.code = 'cross_project';
+      throw e;
+    }
+    if (r.ok) {
+      for (const e of r.entries || []) {
+        const x = await client.query(ENTRY_SQL, [project, itemId, runId, e.type, e.takeaway, e.dimension, e.sourceUrl, e.sourceLabel, e.confidence]);
+        counts.entries += x.rowCount || 0;
+      }
+      for (const s of r.scores || []) {
+        const x = await client.query(SCORE_SQL, [project, itemId, runId, s.dimension, s.value, s.reason]);
+        counts.scores += x.rowCount || 0;
+      }
+      for (const c of r.candidates || []) {
+        const payload = { name: c.name, url: c.url, kind: c.kind, found_via_item_id: itemId };
+        const x = await client.query(PROPOSAL_SQL, [project, runId, JSON.stringify(payload), c.why, c.name]);
+        counts.proposals += x.rowCount || 0;
+      }
+    }
+    const { rows: fin } = await client.query(FINISH_ITEM_SQL, [
+      runId, itemId, r.ok ? 'done' : 'error', r.ok ? null : String(r.error || 'error').slice(0, 200), r.costUsd || 0,
+    ]);
+    if (fin.length !== 1) {
+      // Already finished by an earlier write: keep that one, write nothing new.
+      await client.query('ROLLBACK');
+      return { recorded: false, counts: { entries: 0, scores: 0, proposals: 0 } };
+    }
+    await client.query('COMMIT');
+    return { recorded: true, counts };
+  } catch (e) {
+    if (e && e.code !== 'cross_project') await client.query('ROLLBACK').catch(() => {});
+    throw e;
+  } finally {
+    client.release();
+  }
+}
+
+// The store bound to one pool: what run.js is handed. Tests hand run.js a fake with the
+// same method names.
+function createStore(pool) {
+  return {
+    readSettings: (project) => readSettings(pool, project),
+    lastRun: (project) => lastRun(pool, project),
+    openRun: (project) => openRun(pool, project),
+    insertSkipped: (project, o) => insertSkipped(pool, project, o),
+    createRun: (project, o) => createRun(pool, project, o),
+    claimRun: (project, runId, leaseMs) => claimRun(pool, project, runId, leaseMs),
+    renewLease: (project, runId, leaseMs) => renewLease(pool, project, runId, leaseMs),
+    finishRun: (project, runId, o) => finishRun(pool, project, runId, o),
+    startItem: (project, runId, itemId) => startItem(pool, project, runId, itemId),
+    recordItem: (project, runId, itemId, result) => recordItem(pool, project, runId, itemId, result),
+    remainingItems: (project, runId) => db.remainingItems(pool, { project, runId }),
+    monthSpend: (project, now) => db.monthSpend(pool, { project, now }),
+    activeRules: async (project) => (await db.rules(pool, { project })).active,
+  };
+}
+
+module.exports = {
+  createStore, openRun, recordItem,
+  SQL: { GUARD_SQL, ENTRY_SQL, SCORE_SQL, PROPOSAL_SQL, START_ITEM_SQL, FINISH_ITEM_SQL, CREATE_SQL },
+};

package/modules/memory/routes/memory.js

@@ -78,6 +78,15 @@ const db = api;
 const SYNC_RATE_WINDOW_MS = 60 * 1000;
 const SYNC_RATE_LIMIT = 6; // syncs per builder per minute
 const syncBuckets = new Map(); // builderId -> timestamp[]
+// Hard size cap on both bucket maps here (task 1004964): their sweeps bound them by
+// time only, every five minutes. At the cap the oldest-inserted key goes first.
+const MAX_TRACKED_KEYS = 50000;
+function newBucket(map, key) {
+  while (map.size >= MAX_TRACKED_KEYS) map.delete(map.keys().next().value);
+  const bucket = [];
+  map.set(key, bucket);
+  return bucket;
+}
 
 const syncSweepTimer = setInterval(() => {
   const cutoff = Date.now() - SYNC_RATE_WINDOW_MS;
@@ -94,7 +103,7 @@ function syncRateLimit(req, res, next) {
   const now = Date.now();
   const key = String(req.builder.id);
   let bucket = syncBuckets.get(key);
-  if (!bucket) { bucket = []; syncBuckets.set(key, bucket); }
+  if (!bucket) bucket = newBucket(syncBuckets, key);
   const cutoff = now - SYNC_RATE_WINDOW_MS;
   while (bucket.length && bucket[0] < cutoff) bucket.shift();
   if (bucket.length >= SYNC_RATE_LIMIT) {
@@ -137,7 +146,7 @@ function readRateLimit(req, res, next) {
   const now = Date.now();
   const key = String(req.builder.id);
   let bucket = readBuckets.get(key);
-  if (!bucket) { bucket = []; readBuckets.set(key, bucket); }
+  if (!bucket) bucket = newBucket(readBuckets, key);
   const cutoff = now - READ_RATE_WINDOW_MS;
   while (bucket.length && bucket[0] < cutoff) bucket.shift();
   if (bucket.length >= READ_RATE_LIMIT) {
@@ -914,5 +923,8 @@ module.exports._internals = {
   syncRateLimit,
   READ_RATE_LIMIT,
   SYNC_RATE_LIMIT,
+  MAX_TRACKED_KEYS,
+  syncBuckets,
+  readBuckets,
   bfgWriteEnabled,
 };

package/modules/memory/routes/search.js

@@ -27,6 +27,9 @@ const search = require('../search');
 const READ_RATE_WINDOW_MS = 60 * 1000;
 const READ_RATE_LIMIT = 60; // searches per builder per minute
 const buckets = new Map(); // builderId -> timestamp[]
+// Hard size cap (task 1004964): the sweep below bounds the map by time only, every
+// five minutes. At the cap the oldest-inserted key goes first; the newest survive.
+const MAX_TRACKED_KEYS = 50000;
 
 const sweepTimer = setInterval(() => {
   const cutoff = Date.now() - READ_RATE_WINDOW_MS;
@@ -43,7 +46,10 @@ function searchRateLimit(req, res, next) {
   const now = Date.now();
   const key = String(req.builder.id);
   let bucket = buckets.get(key);
-  if (!bucket) { bucket = []; buckets.set(key, bucket); }
+  if (!bucket) {
+    while (buckets.size >= MAX_TRACKED_KEYS) buckets.delete(buckets.keys().next().value);
+    bucket = []; buckets.set(key, bucket);
+  }
   const cutoff = now - READ_RATE_WINDOW_MS;
   while (bucket.length && bucket[0] < cutoff) bucket.shift();
   if (bucket.length >= READ_RATE_LIMIT) {
@@ -212,4 +218,4 @@ module.exports = function buildSearchRouter() {
 };
 
 // Exported for tests — the pure rate-limit bucket logic + limits.
-module.exports._internals = { searchRateLimit, READ_RATE_LIMIT, READ_RATE_WINDOW_MS };
+module.exports._internals = { searchRateLimit, READ_RATE_LIMIT, READ_RATE_WINDOW_MS, MAX_TRACKED_KEYS, buckets };