@bongos/core 1.24.3 → 1.24.5

package/tests/claims_batch_routes.mjs

@@ -47,7 +47,8 @@ function answer(sql, params, via) {
   // The release's locked read (FOR UPDATE) — distinct from the newcomer gate's
   // active-claims read, which joins the same tables.
   if (/FROM claims c JOIN tasks t ON t\.id = c\.task_id/.test(sql) && /FOR UPDATE/.test(sql)) {
-    const wanted = new Set(params[0].map(String));
+    // An array for the batch release; a single id for resolveClaim.
+    const wanted = new Set([].concat(params[0]).map(String));
     return { rows: claimFixture.filter((r) => wanted.has(String(r.id))) };
   }
   if (/FROM claims c/.test(sql) && /released_at IS NULL/.test(sql)) {
@@ -215,19 +216,41 @@ test('own claim with matching id types (both strings, as production sends them)
   assert.equal(claimReleases().length, 1);
 });
 
-// KNOWN BUG (task 1005004, filed by task 1004983): releaseClaimsBatch compares
-// claim.builder_id !== builderId strictly, so a STRING row id (node-pg bigint)
-// against a NUMBER caller id refuses the caller's OWN claim as NOT_YOUR_CLAIM.
-// Production is unaffected today only because req.builder.id is also a string.
-// It fails closed (never releases a stranger's claim), so this pins CURRENT
-// behaviour; when the compare is fixed, flip this to expect a release.
-test('KNOWN BUG: own claim as string builder_id vs a NUMBER caller id is refused NOT_YOUR_CLAIM (fails closed)', async () => {
-  caller = { id: 42, rank: 'thetes' };
-  claimFixture = [row({ builder_id: '42' })];
-  const r = await post(RELEASE, { claim_ids: [101] });
-  assert.deepEqual(r.json.released, []);
-  assert.deepEqual(r.json.failures, [{ claim_id: 101, reason: 'NOT_YOUR_CLAIM' }]);
+// task 1005004 (found by task 1004983): the ownership compare was a strict
+// claim.builder_id !== builderId, so a STRING row id (node-pg bigint) against a
+// NUMBER caller id refused the caller's OWN claim as NOT_YOUR_CLAIM. It now
+// compares one spelling of each side (db-shared idKey). The stranger matrix
+// above still refuses in every combination.
+test('own claim is released whatever the id types — string or number on either side', async () => {
+  for (const [rowId, callerId] of [['42', 42], [42, '42'], [42, 42], ['42', '42']]) {
+    calls = [];
+    caller = { id: callerId, rank: 'thetes' };
+    claimFixture = [row({ builder_id: rowId })];
+    const r = await post(RELEASE, { claim_ids: [101] });
+    const label = `row builder_id ${JSON.stringify(rowId)} vs caller ${JSON.stringify(callerId)}`;
+    assert.deepEqual(r.json.released.map((x) => x.claim_id), [101], label);
+    assert.deepEqual(r.json.failures, [], label);
+    assert.equal(claimReleases().length, 1, label);
+  }
+});
+
+// The same compare in resolveClaim (db-ship.js), the single-claim ship/release
+// path: a number caller id must reach past the ownership check on its own
+// claim, and a stranger's claim is still NOT_YOUR_CLAIM before any write.
+test('resolveClaim: own claim with a NUMBER caller id passes the ownership check; a stranger\'s is refused, nothing written', async () => {
+  const resolve = (builderId) => db.resolveClaim({
+    claimId: 101, builderId, outcome: 'abandoned', resolverSessionId: 'sess-A', force: true,
+  }).then(() => null, (e) => e);
+
+  claimFixture = [row({ builder_id: '7', creator_session_id: 'sess-Z' })];
+  const stranger = await resolve(42);
+  assert.equal(stranger && stranger.code, 'NOT_YOUR_CLAIM');
   assert.deepEqual(writes(), []);
+
+  calls = [];
+  claimFixture = [row({ builder_id: '42' })];
+  const own = await resolve(42);
+  assert.notEqual(own && own.code, 'NOT_YOUR_CLAIM', `own claim refused: ${own && (own.code || own.message)}`);
 });
 
 // ── the session check, and force ─────────────────────────────────────────────

package/tests/copy_stuck_page_tweaks.mjs

@@ -63,7 +63,9 @@ await test('every state has an owner and a deadline: overdue only past it, told
     ['applying', () => ({ status: 'active', holder_id: '99', holder_worktree: true }), 'appliers', 1],
     ['waiting_for_artist', () => ({ status: 'completed', grade_passed: true }), 'artist', 3],
     ['landing', () => ({ status: 'confirmed' }), 'appliers', 1],
-    ['unknown', () => ({ status: 'ready' }), 'appliers', 0],
+    ['unknown', () => ({ status: 'active', holder_id: null }), 'appliers', 0],
+    // task 1004972: a blank round waits on its artist and is due when it closes itself (1 day).
+    ['blank', () => ({ status: 'ready' }), 'artist', 1],
   ];
   for (const [state, shape, owner, days] of table) {
     const id = 'landing:projects';

package/tests/credit_grant.mjs

@@ -490,20 +490,20 @@ await test('REWARD_MARGIN_PCT exported as 20', () => {
 //     per-task ESTIMATE payout on. The cost-plus session reward is untouched.
 // =========================================================================
 
-await test('rewardPolicy: default (no mode) → pay both streams; margin/peg resolve', () => {
+await test('rewardPolicy: default (no mode) → pay both streams; margin/scale resolve', () => {
   const p = rewardPolicy({});
   assert.equal(p.mode, REWARD_MODE_DEFAULT);
   assert.equal(p.perTaskCredit, true, 'a default instance pays the per-task estimate');
   assert.equal(p.marginPct, 20);
-  assert.equal(p.usdPeg, 1);
+  assert.equal(p.costScale, 1);
 });
 
 await test('rewardPolicy: mode "cost-plus-only" → per-task estimate payout OFF, cost-plus untouched', () => {
-  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 20, usdPeg: 1 });
+  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 20, costScale: 1 });
   assert.equal(p.mode, REWARD_MODE_COST_PLUS_ONLY);
   assert.equal(p.perTaskCredit, false, 'cost-plus-only suppresses the per-task estimate payout');
   assert.equal(p.marginPct, 20, 'the cost-plus margin is unaffected — that stream is still paid');
-  assert.equal(p.usdPeg, 1);
+  assert.equal(p.costScale, 1);
 });
 
 await test('rewardPolicy: unknown/garbage mode → default (a typo never silently zeroes rewards)', () => {
@@ -546,11 +546,11 @@ await test('rewardPolicy: ideatorCredit is opt-out-only — only an explicit fal
   }
 });
 
-await test('rewardPolicy: cost-plus-only still honors a custom margin + peg', () => {
-  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 35, usdPeg: 2 });
+await test('rewardPolicy: cost-plus-only still honors a custom margin + scale', () => {
+  const p = rewardPolicy({ mode: 'cost-plus-only', marginPct: 35, costScale: 2 });
   assert.equal(p.perTaskCredit, false);
   assert.equal(p.marginPct, 35);
-  assert.equal(p.usdPeg, 2);
+  assert.equal(p.costScale, 2);
 });
 
 await test('insertMultipliedConfirmCredit: cost-plus-only mode writes NO credit_log row', async () => {

package/tests/credit_wording.mjs

@@ -0,0 +1,154 @@
+// tests/credit_wording.mjs — no investment wording next to credits or models
+// (task 1004969; ADR 0385 decision 9).
+//
+// Credits are a contribution meter, not money and not a stake. This fails when
+// the hall's words, the role packs, the onboarding docs or the branding pack
+// describe credits or models as an investment, a return, appreciation, passive
+// income, equity or ownership — and proves the server's publish paths FLAG such
+// text in the log while publishing it unchanged.
+//
+// Run: node tests/credit_wording.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+const wording = require('../modules/economy/credit-wording.js');
+const reward = require('../modules/economy/reward.js');
+const shipBroadcast = require('../modules/discord/ship-broadcast.js');
+
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+function walk(rel) {
+  const out = [];
+  for (const e of fs.readdirSync(path.join(ROOT, rel), { withFileTypes: true })) {
+    const p = `${rel}/${e.name}`;
+    if (e.isDirectory()) out.push(...walk(p));
+    else if (/\.(md|mmd|json|txt|html)$/.test(e.name)) out.push(p);
+  }
+  return out;
+}
+
+// The corpus the task names: hall copy (the generated copy registry — every
+// string the hall, status page and landing render), the role packs, the
+// onboarding docs and the branding pack.
+function corpus() {
+  const docs = [
+    'config/branding.neutral.json',
+    ...fs.readdirSync(path.join(ROOT, 'docs/packs')).filter((f) => f.endsWith('.md')).map((f) => `docs/packs/${f}`),
+    ...walk('docs/onboarding'),
+  ].map((rel) => ({ where: rel, text: read(rel) }));
+  const registry = JSON.parse(read('docs/copy-registry.json'));
+  const copy = registry.entries.map((e) => ({ where: `hall copy ${e.file}:${e.line}`, text: e.text }));
+  return { docs, copy };
+}
+
+test('the corpus is really read (a scan that finds nothing to scan is not a pass)', () => {
+  const { docs, copy } = corpus();
+  assert.ok(docs.length >= 8, `expected the packs, onboarding docs and branding pack, read ${docs.length}`);
+  assert.ok(copy.length > 1000, `expected the hall copy registry, read ${copy.length} strings`);
+  assert.ok(docs.some((d) => /credit/i.test(d.text)) && copy.some((c) => /credit/i.test(c.text)), 'the corpus talks about credits at all');
+});
+
+test('no investment wording next to credits or models in hall copy, packs, onboarding or branding', () => {
+  const { docs, copy } = corpus();
+  const hits = [];
+  for (const { where, text } of [...docs, ...copy]) {
+    for (const h of wording.findInvestmentWording(text)) hits.push(`${where}: "${h.phrase}" near "${h.anchor}" — ${h.sentence.slice(0, 160)}`);
+  }
+  assert.deepEqual(hits, [], `credits and models are not an investment (ADR 0385 decision 9):\n  ${hits.join('\n  ')}`);
+});
+
+test('a planted phrase is caught — the probe that shows the scan can go red', () => {
+  const planted = [
+    ['Credits are a smart investment in the project.', 'investment'],
+    ['Hold your credits and watch for a return on them.', 'return'],
+    ['Your credits earn a return every month.', 'return'],
+    ['Expect appreciation of credits as the project grows.', 'appreciation'],
+    ['Credits will appreciate in value over time.', 'appreciation'],
+    ['Turn your credits into passive income.', 'passive income'],
+    ['Credits give you equity in the project.', 'equity'],
+    ['Owning the model means ownership of what it builds.', 'ownership'],
+    ['Investing in models pays off.', 'investment'],
+  ];
+  for (const [text, term] of planted) {
+    const hits = wording.findInvestmentWording(text);
+    assert.deepEqual(hits.map((h) => h.term), [term], `"${text}" should flag ${term}`);
+  }
+  // The same corpus with one planted sentence goes red.
+  const { docs } = corpus();
+  const doctored = `${docs[0].text}\n\nCredits are a smart investment.`;
+  assert.equal(wording.findInvestmentWording(doctored).length, 1);
+});
+
+test('the wording we want is left alone: denials, the verb "return", and investment words with no credit nearby', () => {
+  const fine = [
+    'Credits are not an investment.',
+    'They are not money, not redeemable and not equity.',
+    'Credits measure contribution, never money, never equity.',
+    'When a claim is released the task returns to ready, and no credits are awarded.',
+    'Return to the hall to see your credits.',
+    'Equity, if a project offers any, is granted by the project separately.',
+    'We appreciate every credit you earn.',
+  ];
+  for (const text of fine) assert.deepEqual(wording.findInvestmentWording(text), [], text);
+  // Too far apart to be talking about each other.
+  const far = 'Credits are what you earn for shipped work. '.repeat(1) + 'Some unrelated paragraph about how a company may raise money, take outside investment and sell equity.';
+  assert.deepEqual(wording.findInvestmentWording(far), []);
+});
+
+test('flagInvestmentWording logs one line per hit, returns the hits, and never throws', () => {
+  const lines = [];
+  const hits = wording.flagInvestmentWording('Credits are an investment. Credits are not equity.', { where: 'ship summary', ref: 'task 7', log: (l) => lines.push(l) });
+  assert.equal(hits.length, 1);
+  assert.equal(lines.length, 1);
+  assert.match(lines[0], /^\[credit-wording\] flagged ship summary task 7: "investment" near "credits"/);
+  assert.match(lines[0], /published unchanged/);
+  assert.deepEqual(wording.flagInvestmentWording(null, { log: () => { throw new Error('x'); } }), []);
+  assert.deepEqual(wording.flagInvestmentWording('Credits are an investment.', { log: () => { throw new Error('log down'); } }), []);
+});
+
+test('the reward port carries both, so other modules reach it without importing economy', () => {
+  assert.equal(typeof reward.findInvestmentWording, 'function');
+  assert.equal(typeof reward.flagInvestmentWording, 'function');
+  assert.equal(reward.findInvestmentWording('Credits are an investment.').length, 1);
+});
+
+test('a flagged ship summary is RECORDED and posted unchanged — never blocked, never rewritten', async () => {
+  const summary = 'Builders can now treat their credits as an investment in the project.';
+  const posts = [];
+  const logs = [];
+  const r = await shipBroadcast.postShipBroadcast(
+    { id: 42, value_summary: summary, security_sensitive: false, kind: 'feature' },
+    { postWebhook: async (channel, line) => { posts.push([channel, line]); }, log: (l) => logs.push(l), reward },
+  );
+  assert.deepEqual(r.posted, ['ship_feed', 'ship_news']);
+  assert.equal(r.wording_flags, 1);
+  assert.deepEqual(posts, [['ship_feed', `#42 shipped — ${summary}`], ['ship_news', summary]], 'the text goes out exactly as written');
+  assert.equal(logs.filter((l) => l.startsWith('[credit-wording] flagged ship summary task 42')).length, 1);
+
+  // A clean summary logs nothing; no economy module means no check, still posted.
+  const quiet = [];
+  const clean = await shipBroadcast.postShipBroadcast({ id: 43, value_summary: 'The Treasury counts credits.', security_sensitive: false, kind: 'bug' }, { postWebhook: async () => {}, log: (l) => quiet.push(l), reward });
+  assert.equal(clean.wording_flags, 0);
+  assert.deepEqual(quiet, []);
+  const none = await shipBroadcast.postShipBroadcast({ id: 44, value_summary: summary, security_sensitive: false, kind: 'bug' }, { postWebhook: async () => {}, log: () => {}, reward: null });
+  assert.deepEqual(none.posted, ['ship_feed', 'ship_news']);
+  assert.equal(none.wording_flags, undefined);
+});
+
+test('the idea and board publish paths flag through the port and never return early on it', () => {
+  const inbox = read('modules/ideas/routes/inbox.js');
+  const gov = read('modules/government/routes/government.js');
+  for (const [src, where] of [[inbox, "where: 'idea'"], [gov, "where: 'board item'"]]) {
+    const at = src.indexOf(where);
+    assert.ok(at > 0, `${where} is wired`);
+    const block = src.slice(src.lastIndexOf("resolveOptional('reward')", at), at + 80);
+    assert.match(block, /flagInvestmentWording\(/);
+    assert.doesNotMatch(block, /return\s+res\.|res\.fail|throw /, 'a flag never refuses or rewrites the text');
+  }
+});

package/tests/google_halls.mjs

@@ -0,0 +1,211 @@
+// tests/google_halls.mjs — a project's hall takes a person who joined with Google
+// (task 1004994, ADR 0393/0396).
+//
+// WHY. Someone with no GitHub account must be able to apply to a project, be
+// admitted, and sign in to its hall like anyone else. What must hold:
+//   - the hub hands a Google-only person (a negative person key) only to a hall
+//     whose authorize link says it can take one; an older hall never gets one;
+//   - the join relay carries them by their stand-in `~handle` with a vouch for
+//     their key, and a hall too old to take a stand-in is said as such;
+//   - the hall files a stand-in application only with that vouch, and matches
+//     their approval on the vouched key, never on the handle (a handle can be
+//     renamed and later taken by someone else);
+//   - a stand-in key and a stand-in login always travel as a pair;
+//   - people read the handle, not `~handle`.
+// No server beyond an in-process express app, no database, no network.
+//
+// Run:  node tests/google_halls.mjs
+
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+// ESM imports so knip credits the exports (a createRequire import reads as
+// unused). Every stub below is read at call time, so hoisting is harmless.
+import { idpAuthorizeUrl, applicationVouchIdentity, PERSON_KEYS_PARAM as CORE_PARAM } from '../src/bongos/auth-idp.js';
+import { hasInvitedAccessRequest } from '../src/bongos/db-kernel.js';
+import { PERSON_KEYS_PARAM as HUB_PARAM, hallTakesPersonKey } from '../modules/platform-identity/account-logins.js';
+import { joinRelayOutcome } from '../modules/platform-identity/routes/my-projects.js';
+import buildAccessRequestsRouter, { shownLogin, accessRequestDocketMatter } from '../modules/onboarding/routes/access-requests.js';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); } catch (err) { failed++; console.log(`  FAIL ${name}\n    ${err && err.stack}`); }
+}
+
+// ── stubs, installed before anything destructures them ──
+const { pool } = require('../src/bongos/pool.js');
+let queries = [];
+let answer = () => ({ rows: [] });
+pool.query = async (sql, params) => { queries.push({ sql, params }); return answer(sql, params); };
+
+const auth = require('../src/bongos/auth.js');
+const projectDoor = require('../src/bongos/project-door.js');
+projectDoor.effectiveJoinDoor = () => 'apply';
+
+const hubKeys = require('../modules/platform-identity/hub-keys.js');
+const logins = { PERSON_KEYS_PARAM: HUB_PARAM, hallTakesPersonKey };
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const { privateKeyB64, publicKeyB64 } = hubKeys.generateHubKeypair();
+const crypto = require('node:crypto');
+const signingKey = crypto.createPrivateKey({ key: Buffer.from(privateKeyB64, 'base64'), format: 'der', type: 'pkcs8' });
+const publicKey = crypto.createPublicKey({ key: Buffer.from(publicKeyB64, 'base64'), format: 'der', type: 'spki' });
+const vouch = (githubId, githubLogin) => hubKeys.mintHubApplicationVouch(
+  { clientId: 'client-x', githubId, githubLogin, handle: 'ana' }, { signingKey },
+);
+const vouchOpts = (githubLogin) => ({ githubLogin, publicKey, clientId: 'client-x' });
+
+console.log('the hub sends a Google-only person only to a hall that says it can take one:');
+
+await t('a current hall’s authorize link says so, under the name the hub reads', () => {
+  const u = new URL(idpAuthorizeUrl('https://hub.example', 'client-x', 'st', 'https://p.example/cb'));
+  assert.equal(CORE_PARAM, logins.PERSON_KEYS_PARAM, 'core and hub must spell the marker the same');
+  assert.equal(u.searchParams.get(CORE_PARAM), '1');
+});
+
+await t('a GitHub person goes to any hall; a minted key only to one that said person_keys=1', () => {
+  assert.equal(logins.hallTakesPersonKey('42', {}), true, 'GitHub people are unchanged on older halls');
+  assert.equal(logins.hallTakesPersonKey('-5', {}), false, 'an older hall never receives a minted key');
+  assert.equal(logins.hallTakesPersonKey('-5', { person_keys: '0' }), false);
+  assert.equal(logins.hallTakesPersonKey('-5', { person_keys: ['1', '1'] }), false, 'a repeated param is not a yes');
+  assert.equal(logins.hallTakesPersonKey('-5', { person_keys: '1' }), true);
+});
+
+await t('/sso/authorize asks hallTakesPersonKey and the old blanket refusal is gone', () => {
+  const src = require('node:fs').readFileSync(new URL('../modules/platform-identity/routes/sso.js', import.meta.url), 'utf8');
+  assert.match(src, /if \(!hallTakesPersonKey\(session\.github_id, req\.query\)\)/);
+  assert.doesNotMatch(src, /Google sign-in yet\. That is coming soon/);
+  const join = require('node:fs').readFileSync(new URL('../modules/platform-identity/routes/my-projects.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(join, /google_join_not_yet/, 'the join relay no longer refuses a Google-only person');
+});
+
+console.log('\nthe join relay:');
+
+await t('an older hall refusing a stand-in is "needs an update", not "could not be reached"', () => {
+  const o = joinRelayOutcome(400, { error: { code: 'bad_github_login', message: 'x' } }, { standIn: true });
+  assert.equal(o.status, 'needs_update');
+  assert.match(o.message, /older version/);
+  assert.equal(joinRelayOutcome(400, { error: { code: 'bad_github_login' } }), null,
+    'a GitHub login refused is still not relayed: that is not a version gap');
+});
+
+console.log('\nthe vouch — a stand-in key and a stand-in login travel together:');
+
+await t('a minted key vouched with its stand-in login yields the key', () => {
+  assert.deepEqual(applicationVouchIdentity(vouch(-5, '~ana'), vouchOpts('~ana')), { githubId: '-5', handle: 'ana' });
+});
+
+await t('a minted key with a GitHub login, or a GitHub id with a stand-in, is no vouch', () => {
+  assert.equal(applicationVouchIdentity(vouch(-5, 'octo'), vouchOpts('octo')), null);
+  assert.equal(applicationVouchIdentity(vouch(42, '~ana'), vouchOpts('~ana')), null);
+});
+
+console.log('\nadmission on the hall:');
+
+await t('a Google-only person’s approval is matched on the vouched key, never the handle', async () => {
+  queries = [];
+  answer = () => ({ rows: [{ '?column?': 1 }] });
+  assert.equal(await hasInvitedAccessRequest('~ana', '-5'), true);
+  assert.equal(queries.length, 1);
+  assert.match(queries[0].sql, /applicant_github_id = \$1/);
+  assert.doesNotMatch(queries[0].sql, /github_login/, 'whoever is ~ana next must not inherit the approval');
+  assert.deepEqual(queries[0].params, ['-5']);
+});
+
+await t('a GitHub person is still matched by login', async () => {
+  queries = [];
+  await hasInvitedAccessRequest('octo', '42');
+  await hasInvitedAccessRequest('octo');
+  for (const q of queries) {
+    assert.match(q.sql, /lower\(github_login\) = lower\(\$1\)/);
+    assert.deepEqual(q.params, ['octo']);
+  }
+});
+
+await t('both hub sign-ins on the hall pass the key to the admission read', () => {
+  const src = require('node:fs').readFileSync(new URL('../src/bongos/auth-idp.js', import.meta.url), 'utf8');
+  assert.equal((src.match(/hasInvitedAccessRequest\(ghLogin, ghId\)/g) || []).length, 2);
+});
+
+// The hall's public POST /access-requests, in-process.
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildAccessRequestsRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const post = (body, headers = {}) => fetch(`${base}/access-requests`, {
+  method: 'POST', headers: { 'Content-Type': 'application/json', ...headers }, body: JSON.stringify(body),
+});
+
+let vouchFor = null;
+auth.readApplicationVouch = (token, { githubLogin }) => (token === 'good' ? vouchFor(githubLogin) : null);
+
+await t('a stand-in application with the hub’s vouch is filed, keyed on the person', async () => {
+  queries = [];
+  answer = (sql) => (sql.startsWith('INSERT') ? { rows: [{ id: 9, github_login: '~ana', status: 'pending' }] } : { rows: [] });
+  vouchFor = (login) => (login === '~ana' ? { githubId: '-5', handle: 'ana' } : null);
+  const res = await post({ github_login: '~ana', display_name: 'Ana' }, { 'X-Bongos-Platform-Assertion': 'good' });
+  assert.equal(res.status, 201);
+  const member = queries.find((q) => /FROM builders/.test(q.sql));
+  assert.match(member.sql, /github_id = \$1/, 'the already-a-member check is on the key');
+  assert.deepEqual(member.params, ['-5']);
+  const insert = queries.find((q) => q.sql.startsWith('INSERT'));
+  assert.equal(insert.params[0], '~ana');
+  assert.equal(insert.params[3], '-5', 'applicant_github_id is the key the approval will match');
+});
+
+await t('a stale approval under a handle someone else now holds does not block the new holder', async () => {
+  // An approved row for `~ana` belongs to person -4; person -5 holds the handle now.
+  const approved = [{ github_login: '~ana', applicant_github_id: '-4' }];
+  queries = [];
+  answer = (sql, params) => {
+    if (sql.startsWith('INSERT')) return { rows: [{ id: 11, github_login: '~ana', status: 'pending' }] };
+    if (/FROM access_requests/.test(sql) && /status = 'invited'/.test(sql)) {
+      const hit = /applicant_github_id = \$1/.test(sql)
+        ? approved.some((r) => r.applicant_github_id === params[0])
+        : approved.some((r) => r.github_login.toLowerCase() === String(params[0]).toLowerCase());
+      return { rows: hit ? [{ '?column?': 1 }] : [] };
+    }
+    return { rows: [] };
+  };
+  vouchFor = () => ({ githubId: '-5', handle: 'ana' });
+  const res = await post({ github_login: '~ana' }, { 'X-Bongos-Platform-Assertion': 'good' });
+  assert.equal(res.status, 201, 'the new holder’s application is filed, not answered "already approved"');
+  vouchFor = () => ({ githubId: '-4', handle: 'ana' });
+  const again = await post({ github_login: '~ana' }, { 'X-Bongos-Platform-Assertion': 'good' });
+  assert.equal(again.status, 409, 'the approved person themselves is told they are already approved');
+});
+
+await t('a stand-in typed by anyone, with no vouch, is refused and nothing is written', async () => {
+  queries = [];
+  const res = await post({ github_login: '~ana' });
+  assert.equal(res.status, 400);
+  assert.equal(queries.length, 0);
+});
+
+await t('a GitHub login still files with or without a vouch', async () => {
+  answer = (sql) => (sql.startsWith('INSERT') ? { rows: [{ id: 10, github_login: 'octo', status: 'pending' }] } : { rows: [] });
+  const res = await post({ github_login: 'octo' });
+  assert.equal(res.status, 201);
+});
+
+server.close();
+
+console.log('\nwhat people read:');
+
+await t('the handle is shown without its ~; a GitHub login is unchanged', () => {
+  assert.equal(shownLogin('~ana'), 'ana');
+  assert.equal(shownLogin('octo'), 'octo');
+  const m = accessRequestDocketMatter({ id: 1, github_login: '~ana', display_name: null, created_at: new Date() });
+  assert.equal(m.title, 'Admit ana as a builder');
+  assert.equal(m.short, 'admit ana');
+});
+
+console.log(`\ngoogle_halls: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/government_laws_session.mjs

@@ -91,7 +91,8 @@ test('GET /me carries the block and resolves the settings slices through the loc
   assert.match(src, /government\.lawsForSession\(\)/, '/me reads the laws through the government port');
   assert.match(src, /settings\.describeWithLaws\(behaviorPrefs, \(sessionLaws && sessionLaws\.laws\) \|\| \[\]/, 'the slices are resolved with the laws applied');
   for (const slice of ['wandering', 'interaction', 'model_allocation']) {
-    assert.match(src, new RegExp(`${slice}: lawed \\? lawed\\.${slice} :`), `${slice} reads the locked slice`);
+    // interaction is wrapped by withStandingRules (task 1005015); the locked slice is still what it wraps.
+    assert.match(src, new RegExp(`${slice}: (?:withStandingRules\\()?lawed \\? lawed\\.${slice} :`), `${slice} reads the locked slice`);
   }
   assert.match(src, /laws: sessionLaws \? \{/, '/me answers a laws block');
   assert.equal(typeof settingsPort.describeWithLaws, 'function');

package/tests/hall_tweak_editor.mjs

@@ -328,6 +328,17 @@ try {
     assert.equal(b.el('tw-notice').hidden, true);
   });
 
+  // task 1004972: a blank round (opened, nothing written) used to read as
+  // 'unknown' and the editor told the viewer it was "submitted and on its way".
+  await test('a blank round nobody holds offers the take button, never "submitted"', async () => {
+    const read = editorRead({ held: false, state: 'ready', draftLines: null });
+    assert.equal(read.round.state, 'blank');
+    const b = bootEditor({ answers: { 'GET /copy-desk/pages/landing:index/draft': ok(read) } });
+    await b.settle();
+    assert.ok(b.el('tw-claim'), 'the notice carries the take button');
+    assert.doesNotMatch(b.el('tw-notice').innerHTML, /submitted/);
+  });
+
   await test('someone else writing it: read-only, and named', async () => {
     const b = bootEditor({ answers: { 'GET /copy-desk/pages/landing:index/draft': ok(editorRead({ holder: '8' })) } });
     await b.settle();

package/tests/host_topology_skips.mjs

@@ -30,6 +30,7 @@ const TESTS_DIR = path.dirname(fileURLToPath(import.meta.url));
 // Every test file permitted to skip itself wholesale, with the topology it needs.
 // Adding a line here is a deliberate, reviewable act — that is the point.
 const ALLOWED = {
+  agent_standing_rules: '.claude/hooks/conductor.js + stop-slopcheck.js (package-excluded)',
   allow_rule_guard: '.claude/hooks/allow-rule-guard.js (package-excluded)',
   art_stage: 'scripts/bongos/art-stage.js (art-pipeline tooling, not in the core)',
   bongos_downloads: 'config/bongos-cli.json (instance content)',
@@ -45,6 +46,7 @@ const ALLOWED = {
   preview_server: 'src/preview-server.js (game module, not in the core)',
   recall_hints: '.claude/hooks/recall-hints.js (package-excluded)',
   rubric_fixtures: 'modules/art-pipeline/template/rubric_fixtures (module not installed)',
+  run_node_reroute: '.claude/hooks/run-node.sh (package-excluded)',
   run_routine_two_root: '.claude/hooks/_core-resolve.js (package-excluded)',
   'session-cards': '.claude/hooks/session-cards.js (package-excluded)',
   session_start_freshness: '.claude/hooks/session-start.js (package-excluded)',