@bongos/core 1.23.22 → 1.24.1

package/tests/blockers_people.mjs

@@ -0,0 +1,198 @@
+// tests/blockers_people.mjs — open blockers UNDER THE PEOPLE they wait on (task 1004999).
+//
+// WHAT IT GUARDS.
+//   * Every route the City carries now names the PEOPLE in its seat, not only the seat.
+//   * groupByPerson lists each open blocker under every person its seat resolves to,
+//     with the City's own rule (seatOf → resolveSeat): owner, a seated Lead, an
+//     unseated building falling to the owner, a board's members, and nobody.
+//   * The grouping and the City agree on every blocker — they are one rule.
+//   * Seating a different Lead moves the blocker with nothing on the blocker edited.
+//   * blockersByPerson reads the real contributed source, its asks and the seats.
+//   * The hall draws it: the viewer first as "You", the seat in words, "Nobody yet",
+//     escaping, and the City card's "waits on Lars, the owner".
+//
+// DB-free: the government db reads, the resolver and the asks read are stubbed.
+// Run:  node --test tests/blockers_people.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gov = (f) => path.join(ROOT, 'modules', 'government', f);
+const routing = require(gov('routing.js'));
+const waiting = require(gov('waiting.js'));
+const leads = require(gov('leads.js'));
+const people = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'blockers-by-person.js'));
+
+const NOW = Date.parse('2026-10-29T12:00:00Z');
+const ARCHONS = [{ id: 1, github_login: 'lars', display_name: 'Lars' }];
+const owner = leads.ownerOf(ARCHONS);
+const planningLead = { id: 9, building: 'planning', builder_id: 42, github_login: 'ana', display_name: 'Ana', removed_at: null };
+const releaseLead = { id: 10, building: 'release', builder_id: 43, github_login: 'ben', display_name: 'Ben', removed_at: null };
+const ask = (waitsOn) => ({ question: 'Allow it?', waits_on: waitsOn, if_nobody_answers: 'It stays stuck.' });
+const blocker = (id, over = {}) => ({
+  id: `blockers:${id}`, source: 'blockers', building: 'planning', state: 'needs', title: `Blocker ${id}`,
+  opened_at: `2026-10-2${id % 10}T00:00:00Z`, deadline: null, href: `/blockers#blocker-${id}`, ref: { type: 'blocker', id: String(id) }, ...over,
+});
+
+test('a route names the people in its seat, not only the seat', () => {
+  const seats = { leads: [planningLead], owner, holders: { charter: [{ builder_id: 7, github_login: 'cy', display_name: 'Cy' }, { builder_id: 8, github_login: 'di' }] } };
+  const byOwner = routing.routeMatter(blocker(1, { ask: ask('owner') }), '1', seats, NOW);
+  assert.deepEqual(byOwner.people, [{ id: '1', login: 'lars', name: 'Lars' }]);
+  const byLead = routing.routeMatter(blocker(2), '1', seats, NOW);
+  assert.equal(byLead.seat, 'lead:planning');
+  assert.deepEqual(byLead.people, [{ id: '42', login: 'ana', name: 'Ana' }]);
+  const unseated = routing.routeMatter(blocker(3, { building: 'treasury' }), '1', seats, NOW);
+  assert.deepEqual([unseated.seat, unseated.fell_to_owner, unseated.people.map((p) => p.name)], ['owner', true, ['Lars']]);
+  const board = routing.routeMatter(blocker(4, { ask: ask('board:charter') }), '1', seats, NOW);
+  assert.deepEqual(board.people, [{ id: '7', login: 'cy', name: 'Cy' }, { id: '8', login: 'di', name: 'di' }]);
+});
+
+test('the name map is built once per request: routeMatter takes it, and routeAll gives the same routes', () => {
+  const seats = { leads: [planningLead], owner, holders: {} };
+  // a passed map is the one used — so routeAll can hand every matter the one it built
+  const dir = new Map([['42', { id: '42', login: 'x', name: 'From the map' }]]);
+  assert.deepEqual(routing.routeMatter(blocker(1), '1', seats, NOW, dir).people, [{ id: '42', login: 'x', name: 'From the map' }]);
+  const ms = [blocker(1), blocker(2, { ask: ask('owner') }), blocker(3, { building: 'treasury' })];
+  const one = ms.map((m) => routing.routeMatter(m, '42', seats, NOW));
+  const all = ms.map((m) => ({ ...m }));
+  routing.routeAll(all, '42', seats, NOW);
+  assert.deepEqual(all.map((m) => m.route), one);
+  const src = fs.readFileSync(gov('routing.js'), 'utf8');
+  const body = src.slice(src.indexOf('function routeAll'), src.indexOf('\n}', src.indexOf('function routeAll')));
+  assert.match(body, /const dir = directoryOf\(ctx\);[\s\S]*routeMatter\(m, viewerId, ctx, now, dir\)/, 'built once, outside the loop');
+});
+
+test('groupByPerson: each blocker under every person its seat resolves to; nobody is never dropped', () => {
+  const seats = { leads: [planningLead], owner, holders: { charter: [{ builder_id: 7, display_name: 'Cy' }, { builder_id: 42, display_name: 'Ana' }], rules: [] } };
+  const matters = [
+    blocker(1, { ask: ask('owner') }),
+    blocker(2), // ask-less → lead:planning → Ana
+    blocker(3, { building: 'treasury' }), // unseated → the owner
+    blocker(4, { ask: ask('board:charter') }), // two members
+    blocker(5, { ask: ask('board:rules') }), // nobody seated → falls to the owner
+    blocker(6, { state: 'settled', ask: ask('owner') }), // settled is not waiting
+  ];
+  const g = waiting.groupByPerson(matters, seats);
+  const ids = (name) => g.people.find((x) => x.person.name === name).items.map((i) => i.id);
+  assert.deepEqual(ids('Lars'), ['1', '3', '5']);
+  assert.deepEqual(ids('Ana'), ['2', '4']);
+  assert.deepEqual(ids('Cy'), ['4']);
+  assert.deepEqual(g.people.map((p) => [p.person.name, p.count]), [['Lars', 3], ['Ana', 2], ['Cy', 1]], 'most waiting first');
+  const two = g.people.find((x) => x.person.name === 'Ana').items.find((i) => i.id === '2');
+  assert.deepEqual([two.seat, two.as, two.asked, two.fell_to_owner], ['lead:planning', 'the Planning Lead', 'lead:planning', false]);
+  const three = g.people.find((x) => x.person.name === 'Lars').items.find((i) => i.id === '3');
+  assert.deepEqual([three.seat, three.asked, three.fell_to_owner], ['owner', 'lead:treasury', true]);
+  // no owner at all: an owner-seat blocker waits on nobody, and is listed there
+  const empty = waiting.groupByPerson([blocker(1, { ask: ask('owner') })], { leads: [], owner: leads.ownerOf([]), holders: {} });
+  assert.deepEqual([empty.people.length, empty.nobody.map((i) => i.id)], [0, ['1']]);
+});
+
+test('the grouping and the City agree on every blocker', () => {
+  const seats = { leads: [planningLead, releaseLead], owner, holders: { charter: [{ builder_id: 7, display_name: 'Cy' }] } };
+  const matters = [blocker(1), blocker(2, { ask: ask('owner') }), blocker(3, { ask: ask('lead:release') }), blocker(4, { ask: ask('board:charter') }), blocker(5, { building: 'people' }), blocker(6, { ask: ask('committee:release.ops') })];
+  const g = waiting.groupByPerson(matters, seats);
+  for (const m of matters) {
+    const city = routing.routeMatter(m, null, seats, NOW).people.map((p) => p.id).sort();
+    const here = g.people.filter((x) => x.items.some((i) => i.matter_id === m.id)).map((x) => x.person.id).sort();
+    assert.deepEqual(here, city, `${m.id}: the same people on both`);
+  }
+});
+
+test('seating a different Lead moves the blocker; nothing on the blocker changes', () => {
+  const m = [blocker(1)];
+  const before = waiting.groupByPerson(m, { leads: [planningLead], owner, holders: {} });
+  const after = waiting.groupByPerson(m, { leads: [{ ...planningLead, builder_id: 77, github_login: 'eve', display_name: 'Eve' }], owner, holders: {} });
+  assert.deepEqual(before.people.map((p) => p.person.name), ['Ana']);
+  assert.deepEqual(after.people.map((p) => p.person.name), ['Eve']);
+  const removed = waiting.groupByPerson(m, { leads: [{ ...planningLead, removed_at: '2026-10-28T00:00:00Z' }], owner, holders: {} });
+  assert.deepEqual(removed.people.map((p) => p.person.name), ['Lars'], 'a removed Lead hands it back to the owner');
+});
+
+test('forViewer: the viewer\'s own group, or an empty one', () => {
+  const g = waiting.groupByPerson([blocker(1), blocker(2, { ask: ask('owner') })], { leads: [planningLead], owner, holders: {} });
+  assert.deepEqual(waiting.forViewer(g, 42).items.map((i) => i.id), ['1']);
+  assert.deepEqual(waiting.forViewer(g, '1').items.map((i) => i.id), ['2']);
+  assert.deepEqual([waiting.forViewer(g, 5).count, waiting.forViewer(g, 5).items], [0, []]);
+});
+
+test('blockersByPerson reads the contributed blockers, their asks and the seats', async () => {
+  const docket = require(gov('docket.js'));
+  const resolver = require(gov('resolver.js'));
+  const asksDb = require(gov('asks-db.js'));
+  const db = require(gov('db.js'));
+  const real = { perms: resolver.resolveBuilderPermissions, asks: asksDb.asksFor, leads: db.listLeads, archons: db.listActiveArchons };
+  resolver.resolveBuilderPermissions = async () => ['board.vote.cast'];
+  asksDb.asksFor = async (ids) => new Map(ids.filter((id) => id === 'blockers:7').map((id) => [id, ask('owner')]));
+  db.listLeads = async () => [planningLead];
+  db.listActiveArchons = async () => ARCHONS;
+  const rows = [{ id: 7, title: 'Token needs the workflow scope', created_at: '2026-10-29T10:00:00Z' }, { id: 8, title: 'Pick a host', created_at: '2026-10-28T10:00:00Z' }];
+  const contributions = { sources: new Map([['blockers', { source: 'blockers', building: 'planning', gate: { anyBuilder: true }, read: async () => rows.map((b) => ({ id: b.id, title: b.title, state: 'needs', opened_at: b.created_at, href: `/blockers#blocker-${b.id}`, ref: { type: 'blocker', id: b.id } })) }]]) };
+  try {
+    const r = await docket.blockersByPerson({ id: 42, rank: 'metic' }, { contributions, now: NOW });
+    assert.equal(r.available, true);
+    assert.deepEqual(r.people.map((p) => [p.person.name, p.items.map((i) => i.id)]), [['Ana', ['8']], ['Lars', ['7']]]);
+    assert.deepEqual(r.yours.items.map((i) => i.id), ['8'], 'Ana sees her own');
+    const off = await docket.blockersByPerson({ id: 42 }, { contributions: { sources: new Map() }, now: NOW });
+    assert.deepEqual([off.available, off.reason, off.people], [false, 'off', []], 'no source is said, not shown as empty');
+    db.listLeads = async () => { throw new Error('db down'); };
+    const down = await docket.blockersByPerson({ id: 42 }, { contributions, now: NOW });
+    assert.deepEqual([down.available, down.reason], [false, 'unavailable'], 'a failed seats read groups nothing rather than guessing');
+  } finally {
+    resolver.resolveBuilderPermissions = real.perms; asksDb.asksFor = real.asks; db.listLeads = real.leads; db.listActiveArchons = real.archons;
+  }
+});
+
+const esc = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+const fmtDate = (iso) => iso.slice(0, 10);
+
+test('the Blockers page: the viewer first as "You", the seat in words, "Nobody yet", escaped', () => {
+  const g = waiting.groupByPerson([
+    blocker(1, { ask: ask('owner'), title: '<b>Token</b>' }),
+    blocker(2), blocker(3, { building: 'treasury' }),
+    blocker(4, { ask: ask('board:rules') }),
+  ], { leads: [planningLead], owner: leads.ownerOf([]), holders: { rules: [] } });
+  const html = people.peopleHtml({ available: true, ...g }, { esc, fmtDate, viewerId: 42, blockerHref: (id) => `#/blocker/${id}` });
+  assert.ok(html.indexOf('>You<') < html.indexOf('>Nobody yet<'), 'the viewer first');
+  assert.match(html, /as the Planning Lead · filed 2026-10-22/);
+  assert.match(html, /href="#\/blocker\/2"/);
+  assert.match(html, /&lt;b&gt;Token&lt;\/b&gt;/, 'a title is escaped');
+  assert.ok(!html.includes('<b>Token'), 'never raw');
+  assert.equal(people.peopleHtml({ available: false, people: [], nobody: [] }, { esc, fmtDate }), '', 'unavailable draws nothing');
+  assert.equal(people.peopleHtml({ available: true, people: [], nobody: [] }, { esc, fmtDate }), '', 'nothing open draws nothing');
+  assert.equal(people.asWords({ as: 'the owner', asked: 'lead:treasury', fell_to_owner: true }), 'as the owner, since Treasury has no Lead');
+  assert.equal(people.asWords({ as: 'the owner', asked: 'owner', fell_to_owner: false }), 'as the owner');
+});
+
+test('Collab\'s block draws only the viewer\'s own, and nothing when nothing waits', () => {
+  const mine = { available: true, count: 1, items: [{ id: '9', title: 'Pick a host', as: 'the Planning Lead', asked: 'lead:planning', opened_at: '2026-10-28T00:00:00Z' }] };
+  const html = people.mineHtml(mine, { esc, fmtDate, blockerHref: (id) => `#/blocker/${id}` });
+  assert.match(html, /Pick a host/);
+  assert.match(html, /as the Planning Lead/);
+  assert.equal(people.mineHtml({ available: true, count: 0, items: [] }, { esc, fmtDate }), '');
+  assert.equal(people.mineHtml(null, { esc, fmtDate }), '');
+});
+
+test('the pages carry the sections and load the script', () => {
+  const pub = (f) => fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', f), 'utf8');
+  assert.match(pub('blockers.html'), /id="blockers-people-scroll"[^>]*hidden/);
+  assert.match(pub('blockers.html'), /<script src="\/builders\/blockers-by-person.js"><\/script>/);
+  assert.match(pub('collab.html'), /id="cb-blockers-scroll"[^>]*hidden/);
+  assert.match(pub('collab.html'), /<script src="\/builders\/blockers-by-person.js"><\/script>/);
+});
+
+test('the City card says who: "waits on Lars, the owner"', () => {
+  const deck = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'street-deck.js'));
+  const who = deck.whoWords;
+  assert.equal(who({ label: 'the owner', people: [{ name: 'Lars' }] }), 'Lars, the owner');
+  assert.equal(who({ label: 'the board', people: [{ name: 'Cy' }, { login: 'di' }] }), 'Cy and di, the board');
+  assert.equal(who({ label: 'the board', people: [{ name: 'A' }, { name: 'B' }, { name: 'C' }] }), 'A and 2 others, the board');
+  assert.equal(who({ label: 'the owner', people: [] }), 'the owner', 'nobody named: the seat alone');
+  const foot = deck.footOf({ waits_on: { real: true, label: 'the Planning Lead', people: [{ name: 'Ana' }] } }, '');
+  assert.equal(foot.rest, 'It waits on Ana, the Planning Lead.');
+});

package/tests/bounded_rate_maps.mjs

@@ -0,0 +1,184 @@
+// tests/bounded_rate_maps.mjs
+//
+// Task 1004964 (2026-10-28 server audit, item 10): every in-memory rate-limit and
+// login map has a HARD size cap with oldest-first eviction, not only a time-based
+// sweep that runs every five minutes. Each case floods a map past its cap through
+// the real middleware (or the real tracker) and shows the size stays at the cap,
+// the newest entries survive, and the oldest are the ones evicted.
+// deviceFlows is also pruned on an unref'd timer, not only when a new flow starts.
+//
+// Hermetic: no DB, no network. Run:  node tests/bounded_rate_maps.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { test, summary } = makeRunner();
+
+const fakeRes = () => ({ set() { return this; }, fail() { return this; } });
+const noop = () => {};
+
+// Drive `mw` with `n` distinct callers; `reqFor(i)` builds the request for caller i.
+function flood(mw, n, reqFor) {
+  for (let i = 0; i < n; i++) mw(reqFor(i), fakeRes(), noop);
+}
+const byIp = (method = 'GET') => (i) => ({ method, ip: `ip-${i}`, headers: {}, path: '/' });
+const byBuilder = (i) => ({ method: 'GET', builder: { id: i }, headers: {} });
+
+// The one assertion every case makes: capped size, newest kept, oldest gone.
+function assertCapped(map, cap, n, keyFor) {
+  assert.ok(n > cap, 'the flood must overrun the cap');
+  assert.equal(map.size, cap, `map holds ${map.size}, cap is ${cap}`);
+  assert.ok(map.has(keyFor(n - 1)), 'the newest caller survives');
+  assert.ok(map.has(keyFor(n - cap)), 'the oldest still-in-cap caller survives');
+  assert.ok(!map.has(keyFor(n - cap - 1)), 'the caller just past the cap was evicted');
+  assert.ok(!map.has(keyFor(0)), 'the first caller was evicted');
+}
+
+const rl = require('../src/bongos/middleware/rate-limit.js');
+const CAP = rl.MAX_TRACKED_KEYS;
+const N = CAP + 25;
+
+await test('the shared cap is about 50k', () => {
+  assert.equal(CAP, 50000);
+});
+
+await test('rate-limit.js per-IP write bucket map stays capped', () => {
+  const m = rl._bucketMaps.ipBuckets;
+  m.clear();
+  flood(rl.rateLimitMiddleware, N, byIp('POST'));
+  assertCapped(m, CAP, N, (i) => `ip-${i}`);
+  m.clear();
+});
+
+await test('rate-limit.js per-session write bucket map stays capped', () => {
+  const m = rl._bucketMaps.sessionBuckets;
+  m.clear();
+  // A fresh IP per request: the per-IP check runs first and would 429 one IP early.
+  rl._bucketMaps.ipBuckets.clear();
+  flood(rl.rateLimitMiddleware, N, (i) => ({
+    method: 'POST', ip: `s-${i}`, headers: { authorization: `Bearer tok-${i}` },
+  }));
+  assertCapped(m, CAP, N, (i) => `b:tok-${i}`);
+  m.clear();
+  rl._bucketMaps.ipBuckets.clear();
+});
+
+await test('rate-limit.js public-read bucket map stays capped', () => {
+  const m = rl._bucketMaps.publicReadBuckets;
+  m.clear();
+  flood(rl.publicReadRateLimitMiddleware, N, byIp());
+  assertCapped(m, CAP, N, (i) => `ip-${i}`);
+  m.clear();
+});
+
+await test('rate-limit.js account-existence bucket map stays capped', () => {
+  const m = rl._bucketMaps.accountExistenceBuckets;
+  m.clear();
+  flood(rl.accountExistenceReadRateLimit, N, byIp());
+  assertCapped(m, CAP, N, (i) => `ip-${i}`);
+  m.clear();
+});
+
+await test('rate-limit.js public-project-feed bucket map stays capped', () => {
+  const m = rl._bucketMaps.projectFeedBuckets;
+  m.clear();
+  flood(rl.publicProjectFeedRateLimit, N, byIp());
+  assertCapped(m, CAP, N, (i) => `ip-${i}`);
+  m.clear();
+});
+
+await test('rate-limit.js default-read map keeps its tighter 10k cap', () => {
+  const m = rl._bucketMaps.defaultReadBuckets;
+  m.clear();
+  const mw = rl.defaultReadRateLimit({ stack: [] });
+  const cap = rl.DEFAULT_READ_MAX_TRACKED_IPS;
+  flood(mw, cap + 25, byIp());
+  assertCapped(m, cap, cap + 25, (i) => `ip-${i}`);
+  m.clear();
+});
+
+await test('memory sync + read bucket maps stay capped', () => {
+  const { _internals: mem } = require('../modules/memory/routes/memory.js');
+  assert.equal(mem.MAX_TRACKED_KEYS, CAP);
+  for (const [mw, map] of [[mem.syncRateLimit, mem.syncBuckets], [mem.readRateLimit, mem.readBuckets]]) {
+    map.clear();
+    flood(mw, N, byBuilder);
+    assertCapped(map, CAP, N, (i) => String(i));
+    map.clear();
+  }
+});
+
+await test('memory search bucket map stays capped', () => {
+  const { _internals: s } = require('../modules/memory/routes/search.js');
+  assert.equal(s.MAX_TRACKED_KEYS, CAP);
+  s.buckets.clear();
+  flood(s.searchRateLimit, N, byBuilder);
+  assertCapped(s.buckets, CAP, N, (i) => String(i));
+  s.buckets.clear();
+});
+
+await test('SSO applicant-read bucket map stays capped', () => {
+  const { _internals: sso } = require('../modules/platform-identity/routes/sso.js');
+  assert.equal(sso.APPLICANT_MAX_TRACKED_IPS, CAP);
+  sso.applicantReadBuckets.clear();
+  flood(sso.applicantReadRateLimit, N, byIp());
+  assertCapped(sso.applicantReadBuckets, CAP, N, (i) => `ip-${i}`);
+  sso.applicantReadBuckets.clear();
+});
+
+await test('public-profile bucket map stays capped', () => {
+  const { _internals: pp } = require('../modules/platform-identity/routes/public-profile.js');
+  assert.equal(pp.MAX_TRACKED_IPS, CAP);
+  pp.buckets.clear();
+  flood(pp.profileReadRateLimit, N, byIp());
+  assertCapped(pp.buckets, CAP, N, (i) => `ip-${i}`);
+  pp.buckets.clear();
+});
+
+await test('deviceFlows stays capped with oldest-first eviction', () => {
+  const ac = require('../src/bongos/auth-config.js');
+  assert.equal(ac.DEVICE_FLOW_MAX, CAP);
+  ac.deviceFlows.clear();
+  const live = () => ({ interval: 5, expires_at: Date.now() + 15 * 60_000, last_polled_at: 0 });
+  for (let i = 0; i < N; i++) ac.trackDeviceFlow(`dc-${i}`, live());
+  assertCapped(ac.deviceFlows, CAP, N, (i) => `dc-${i}`);
+  ac.deviceFlows.clear();
+});
+
+await test('deviceFlows is pruned on an unref\'d timer, not only on a new flow', () => {
+  // Load auth-config fresh with setInterval spied, to see the timer it arms.
+  const realSetInterval = globalThis.setInterval;
+  const armed = [];
+  globalThis.setInterval = (fn, ms, ...rest) => {
+    const t = realSetInterval(fn, ms, ...rest);
+    const unref = t.unref.bind(t);
+    const rec = { fn, ms, unrefd: false, t };
+    t.unref = () => { rec.unrefd = true; return unref(); };
+    armed.push(rec);
+    return t;
+  };
+  const key = require.resolve('../src/bongos/auth-config.js');
+  const cached = require.cache[key];
+  try {
+    delete require.cache[key];
+    const fresh = require('../src/bongos/auth-config.js');
+    const timer = armed.find((r) => r.fn === fresh.pruneDeviceFlows);
+    assert.ok(timer, 'a prune timer is armed at load');
+    assert.equal(timer.ms, fresh.DEVICE_FLOW_PRUNE_MS);
+    assert.ok(timer.ms >= 60_000, 'the prune timer is not a per-second wake');
+    assert.ok(timer.unrefd, 'the prune timer is unref\'d');
+    // And what it runs drops expired flows while keeping live ones, with no new flow started.
+    fresh.deviceFlows.set('old', { expires_at: Date.now() - 1 });
+    fresh.deviceFlows.set('new', { expires_at: Date.now() + 60_000 });
+    timer.fn();
+    assert.deepEqual([...fresh.deviceFlows.keys()], ['new']);
+  } finally {
+    globalThis.setInterval = realSetInterval;
+    for (const r of armed) clearInterval(r.t);
+    require.cache[key] = cached;
+  }
+});
+
+summary();

package/tests/claimable_blocker_status.mjs

@@ -35,7 +35,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
 const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 
-const MIG = 'core_264_claimable_respects_dependencies.sql';
+const MIG = 'core_285_task_needs.sql';
 const mig = read('migrations', MIG);
 // Comments carry the rationale; strip them when asserting on the executable body
 // so a claim in prose can never stand in for the real SQL.