@bongos/core 1.24.3 → 1.24.5

package/tests/market_watch_ask.mjs

@@ -0,0 +1,369 @@
+// tests/market_watch_ask.mjs — the Market Watch weekly ask card (task 1004940, goal 1000137).
+//
+// DB-free: the flow (modules/market-watch/ask.js) runs over an in-memory store that keeps the
+// same rules the SQL store keeps (the UNIQUE constraints, the project guard on an answer's
+// ask, the pooled-proposal lookup), and the real routes run over it in a real Express app.
+// tests/market_watch_ask_db.mjs runs the SQL store itself on Postgres (INTEGRATION set).
+//
+//   - pure: the week, normalising, chips from the project's own data, parsing and its caps
+//   - the poller: once per project per week, by the wall clock
+//   - THE WHOLE PATH: the card the hall draws → a member taps and names one → POST → the
+//     proposals with their agree counts, read back as the next card's team rows
+//   - members only (403), nobody answers for anyone else (403), closed weeks expire quietly
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const ask = require('../modules/market-watch/ask.js');
+const widget = require('../modules/market-watch/public/hall-widget.js');
+const api = require('../src/module-api.js');
+
+const PROJECT = 'https://acme.example';
+const OTHER = 'https://other.example';
+// Thursday of ISO week 44, 2026; its Monday is 26 October.
+const NOW = new Date('2026-10-29T12:00:00Z');
+
+// ---- the in-memory store --------------------------------------------------
+
+function memoryStore({ items = [], activeRules = { [PROJECT]: 11 }, names = {} } = {}) {
+  const s = { asks: [], answers: [], proposals: [], seq: 0, items, activeRules, names, locks: [] };
+  const q = {
+    async insertAnswer({ project, askId, builderId, choice, freeText }) {
+      const a = s.asks.find((x) => x.id === askId && x.project === project);
+      if (!a) return null; // the SQL guard: an ask of another project inserts nothing
+      if (s.answers.some((x) => x.ask_id === askId && x.builder_id === builderId && x.choice === choice)) return null;
+      const row = { id: ++s.seq, ask_id: askId, builder_id: builderId, choice, free_text: freeText };
+      s.answers.push(row);
+      return row.id;
+    },
+    async lockPool(project, key) { s.locks.push(`${project}:${key}`); },
+    async findPooled(project, key) {
+      const p = s.proposals.find((x) => x.project === project && x.origin === 'weekly_ask' && x.payload.pool_key === key && ['open', 'approved', 'applied'].includes(x.status));
+      return p ? p.id : null;
+    },
+    async insertProposal(x) {
+      const row = { id: ++s.seq, project: x.project, kind: x.kind, origin: 'weekly_ask', rule_version_id: x.ruleVersionId, answer_id: x.answerId, payload: x.payload, reason: x.reason, proposed_by: x.proposedBy, status: 'open', created_at: NOW };
+      if (s.proposals.some((p) => p.answer_id === row.answer_id)) throw new Error('one proposal per answer');
+      s.proposals.push(row);
+      return row.id;
+    },
+  };
+  return {
+    state: s,
+    async asksForWeek(project, weekOf) { return s.asks.filter((a) => a.project === project && a.week_of === weekOf); },
+    async insertAsk(project, a) {
+      if (s.asks.some((x) => x.project === project && x.week_of === a.weekOf && x.question_key === a.questionKey)) return false;
+      s.asks.push({ id: ++s.seq, project, week_of: a.weekOf, question_key: a.questionKey, prompt: a.prompt, options: JSON.parse(JSON.stringify(a.options)), closes_at: a.closesAt });
+      return true;
+    },
+    async chipSource(project) { return s.items.filter((i) => (i.project || PROJECT) === project && (i.status || 'active') === 'active'); },
+    async answeredWeek(project, weekOf, builderId) {
+      const ids = new Set(s.asks.filter((a) => a.project === project && a.week_of === weekOf).map((a) => a.id));
+      return s.answers.some((x) => ids.has(x.ask_id) && x.builder_id === builderId);
+    },
+    async streak() { return 4; },
+    async teamProposals(project) {
+      return s.proposals.filter((p) => p.project === project && ['open', 'approved', 'applied'].includes(p.status)).map((p) => {
+        const agreeing = new Set(s.answers.filter((x) => {
+          const a = s.asks.find((k) => k.id === x.ask_id);
+          return a && a.project === project && `${a.question_key}|${x.choice}` === p.payload.pool_key;
+        }).map((x) => x.builder_id));
+        return { ...p, who: s.names[p.proposed_by] || null, agree: agreeing.size };
+      }).sort((a, b) => b.agree - a.agree || b.id - a.id).slice(0, 5);
+    },
+    async activeRuleVersionId(project) { return s.activeRules[project] ?? null; },
+    async tx(fn) { return fn(q); },
+  };
+}
+
+const ITEMS = [
+  { kind: 'competitor', name: 'Cognition (Devin)', category: 'AI software-engineering agent' },
+  { kind: 'competitor', name: 'Factory', category: 'AI software-engineering agent' },
+  { kind: 'competitor', name: 'Lovable', category: 'AI app builder' },
+  { kind: 'competitor', name: 'Bolt.new (StackBlitz)', category: 'AI app builder' },
+  { kind: 'competitor', name: 'Cursor (Anysphere)', category: 'AI IDE + background/cloud agents' },
+  { kind: 'competitor', name: 'Gone Inc', category: 'Removed kind', status: 'removed' },
+  { kind: 'partner', name: 'NLnet Foundation', category: 'open-source funding' },
+  { kind: 'partner', name: 'FLOSS/fund (Zerodha)', category: 'open-source funding' },
+  { kind: 'partner', name: 'Colony', category: 'DAO tooling' },
+  { kind: 'partner', name: 'Igalia', category: 'worker co-op (software)' },
+  { kind: 'topic', name: 'Worker co-op (software)', category: '' },
+];
+
+// ---- pure -------------------------------------------------------------------
+
+test('the week is the Monday (UTC) and the card names its ISO week number', () => {
+  assert.equal(ask.weekStart(NOW), '2026-10-26');
+  assert.equal(ask.weekStart(new Date('2026-10-26T00:00:00Z')), '2026-10-26', 'Monday midnight is the new week');
+  assert.equal(ask.weekStart(new Date('2026-10-25T23:59:59Z')), '2026-10-19', 'Sunday night is still last week');
+  assert.equal(ask.isoWeek('2026-10-26'), 44);
+  assert.equal(ask.isoWeek('2025-12-29'), 1, 'the week holding the year\'s first Thursday is week 1');
+});
+
+test('similar answers pool: case, punctuation, spacing and a leading article do not count', () => {
+  for (const s of ['Kilo Code', ' kilo-code ', 'The Kilo  Code!', 'KILO_CODE']) assert.equal(ask.normalise(s), 'kilo code');
+  assert.equal(ask.normalise('Ｋｉｌｏ Ｃｏｄｅ'), 'kilo code', 'full-width letters fold');
+  assert.equal(ask.normalise('the'), 'the', 'a lone word is never emptied');
+  assert.ok(!ask.normalise('~nothing').includes('~'), 'no entry can collide with the nothing-new marker');
+  const hidden = (n) => String.fromCharCode(n); // spelled as code points: no hidden character sits in this file
+  assert.equal(ask.cleanText(`a${hidden(0)}b${hidden(0x202e)}c\n d${hidden(0x200b)}`), 'a b c d', 'control and direction characters go');
+});
+
+test('chips come from the project\'s own items: competitor kinds, then partner areas it does not already watch', () => {
+  const c = ask.chipOptions(ITEMS);
+  assert.deepEqual(c.rival.map((o) => o.label), ['AI app builder', 'AI software-engineering agent', 'AI IDE + background/cloud agents']);
+  assert.equal(c.rival[1].example, 'Cognition, Factory', 'the parenthetical is dropped from an example');
+  assert.ok(!c.rival.some((o) => o.label === 'Removed kind'), 'a removed item is not a chip');
+  assert.deepEqual(c.watch.map((o) => o.label), ['Open-source funding', 'DAO tooling'],
+    'the area already watched as a topic is not offered again');
+  assert.deepEqual(ask.chipOptions([]), { rival: [], watch: [] }, 'a project with no data still gets the free entries');
+});
+
+test('parseAnswer refuses what the card cannot send, and caps free text', () => {
+  assert.equal(ask.parseAnswer(null).error, 'bad_answer');
+  assert.equal(ask.parseAnswer({}).error, 'empty_answer');
+  assert.equal(ask.parseAnswer({ picks: [{ question: 'salary', choice: 'x' }] }).error, 'unknown_question');
+  assert.equal(ask.parseAnswer({ names: [{ question: 'rival', text: 'x'.repeat(81) }] }).error, 'text_too_long');
+  assert.equal(ask.parseAnswer({ names: [{ question: 'rival', text: '  !!  ' }] }).error, 'empty_answer');
+  assert.equal(ask.parseAnswer({ picks: Array.from({ length: 21 }, () => ({ question: 'rival', choice: 'a' })) }).error, 'too_many');
+  const ok = ask.parseAnswer({ names: [{ question: 'rival', text: '  Kilo   Code ' }] });
+  assert.deepEqual(ok.entries, [{ question: 'rival', choice: 'kilo code', label: 'Kilo Code', free: true }]);
+  assert.deepEqual(ask.parseAnswer({ nothing: true }), { entries: [], nothing: true });
+});
+
+// ---- the poller -------------------------------------------------------------
+
+test('the poller issues each week once per project, by the wall clock', async () => {
+  const tick = require('../modules/market-watch/pollers/weekly-ask.js').tick;
+  const store = memoryStore({ items: ITEMS });
+  const first = await tick({ project: PROJECT, store, now: () => NOW });
+  assert.equal(first.created, 2);
+  assert.equal((await tick({ project: PROJECT, store, now: () => new Date('2026-10-30T09:00:00Z') })).created, 0, 'a later tick the same week is a no-op');
+  assert.equal(store.state.asks.length, 2);
+  const [rival] = store.state.asks;
+  assert.equal(rival.week_of, '2026-10-26');
+  assert.equal(new Date(rival.closes_at).toISOString(), '2026-11-02T00:00:00.000Z', 'it closes when the next week opens');
+  const next = await tick({ project: PROJECT, store, now: () => new Date('2026-11-02T00:30:00Z') });
+  assert.equal(next.created, 2, 'the next week gets its own card');
+  assert.equal((await tick({ project: OTHER, store, now: () => NOW })).created, 2, 'per project');
+  assert.deepEqual(await tick({ project: null, store }), { skipped: 'no_project_origin' });
+});
+
+// ---- the routes ---------------------------------------------------------------
+
+let viewer = { id: 7, rank: 'xenos', status: 'active' };
+Object.defineProperty(api, 'requireBuilder', {
+  configurable: true,
+  value: (req, res, next) => { if (!viewer) { res.status(401).json({ error: { code: 'unauthenticated' } }); return; } req.builder = viewer; next(); },
+});
+const express = require('express');
+let store = memoryStore({ items: ITEMS, names: { 7: 'ada', 8: 'ben', 9: 'cy' } });
+let clock = NOW;
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code } });
+  next();
+});
+app.use(express.json());
+app.use('/api/bongos', require('../modules/market-watch/routes/ask.js')({ store: () => store, project: PROJECT, now: () => clock }));
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => { const raw = Buffer.concat(chunks).toString(); resolve({ status: res.statusCode, raw, body: JSON.parse(raw) }); });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+async function freshWeek() {
+  store = memoryStore({ items: ITEMS, names: { 7: 'ada', 8: 'ben', 9: 'cy' } });
+  clock = NOW;
+  await ask.issueWeeklyAsk(store, { project: PROJECT, now: NOW });
+}
+
+test('THE WHOLE PATH: a member answers from the hall card and the answer shows up as a proposal', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+
+  // 1. The card the hall draws, from the route the hall calls.
+  const got = await call('GET', '/market-watch/ask');
+  assert.equal(got.status, 200);
+  const card = got.body.card;
+  assert.equal(card.week_no, 44);
+  assert.equal(card.next_on, '2026-11-02');
+  const html = widget.cardHtml(card);
+  assert.match(html, /market watch · week 44 · about 30 seconds/);
+  assert.match(html, /what counts as a competitor\?/);
+  assert.match(html, /and what else should we watch\?/);
+  assert.match(html, /data-mwask-choice="AI app builder"/);
+  assert.match(html, /\+ name one/);
+  assert.match(html, /\+ a topic/);
+  assert.match(html, /class="hask ginbox__item mwask"/, 'drawn as an inbox row, so the attention card counts it');
+
+  // 2. The member taps a competitor chip and a watch chip, and names one; the page builds the body.
+  const body = widget.answerBody(card.week_of, [
+    { question: 'rival', choice: 'AI app builder' },
+    { question: 'watch', choice: 'Open-source funding' },
+    { question: 'rival', text: 'Kilo Code' },
+  ]);
+  assert.ok(!('builder_id' in body), 'the page never names who is answering');
+  const sent = await call('POST', '/market-watch/ask/answer', body);
+  assert.equal(sent.status, 200, sent.raw);
+  assert.deepEqual([sent.body.answers, sent.body.proposals, sent.body.pooled], [3, 3, 0]);
+
+  // 3. Each answer is stored, under the caller.
+  assert.deepEqual(store.state.answers.map((a) => [a.builder_id, a.choice, a.free_text]), [
+    [7, 'ai app builder', null], [7, 'open source funding', null], [7, 'kilo code', 'Kilo Code'],
+  ]);
+
+  // 4. ... and is a proposal: change a definition, add a topic, add an item.
+  const byKey = Object.fromEntries(store.state.proposals.map((p) => [p.payload.pool_key, p]));
+  assert.equal(byKey['rival|ai app builder'].kind, 'rule_change');
+  assert.equal(byKey['rival|ai app builder'].rule_version_id, 11, 'it changes the rules in use');
+  assert.equal(byKey['rival|ai app builder'].payload.include, 'AI app builder');
+  assert.deepEqual([byKey['watch|open source funding'].kind, byKey['watch|open source funding'].payload.item_kind], ['add_item', 'topic']);
+  assert.deepEqual([byKey['rival|kilo code'].kind, byKey['rival|kilo code'].payload.item_kind, byKey['rival|kilo code'].payload.name], ['add_item', 'competitor', 'Kilo Code']);
+  for (const p of store.state.proposals) assert.equal(p.proposed_by, 7);
+
+  // 5. Answered: the card is gone for them (no second ask, no reminder).
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null);
+
+  // 6. Two more members name the same rival their own way: one pool, three agree.
+  viewer = { id: 8, rank: 'thetes', status: 'active' };
+  const ben = await call('POST', '/market-watch/ask/answer', { week_of: card.week_of, names: [{ question: 'rival', text: 'kilo-code' }] });
+  assert.deepEqual([ben.body.answers, ben.body.proposals, ben.body.pooled], [1, 0, 1]);
+  viewer = { id: 9, rank: 'metic', status: 'active' };
+  const cyCard = (await call('GET', '/market-watch/ask')).body.card;
+  await call('POST', '/market-watch/ask/answer', { week_of: card.week_of, names: [{ question: 'rival', text: 'The Kilo Code' }] });
+  assert.equal(store.state.proposals.filter((p) => p.payload.pool_key === 'rival|kilo code').length, 1, 'similar answers are ONE proposal');
+
+  // 7. The team rows the next member sees: "Add Kilo Code as a competitor · ada · 3 agree".
+  const row = cyCard.team.find((r) => r.name === 'Kilo Code');
+  assert.deepEqual([row.verb, row.tail, row.who, row.agree], ['Add', 'as a competitor', 'ada', 2], 'ada and ben had agreed when cy opened the card');
+  viewer = { id: 10, rank: 'xenos', status: 'active' };
+  const team = (await call('GET', '/market-watch/ask')).body.card.team;
+  assert.equal(team[0].name, 'Kilo Code');
+  assert.equal(team[0].agree, 3);
+  assert.match(widget.cardHtml({ ...card, team }), /Add <b>Kilo Code<\/b> as a competitor<\/span><span class="mwask__who">ada<\/span><span class="mwask__pill mwask__pill--hot">3 agree<\/span>/);
+});
+
+test('a second tap on the same chip is a no-op, and "nothing new" files no proposal', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  const b = { week_of: '2026-10-26', picks: [{ question: 'rival', choice: 'AI app builder' }, { question: 'rival', choice: 'ai APP builder' }] };
+  const r = await call('POST', '/market-watch/ask/answer', b);
+  assert.deepEqual([r.body.answers, r.body.proposals], [1, 1]);
+  viewer = { id: 8, rank: 'xenos', status: 'active' };
+  const n = await call('POST', '/market-watch/ask/answer', { week_of: '2026-10-26', nothing: true });
+  assert.equal(n.status, 200);
+  assert.deepEqual([n.body.answers, n.body.proposals], [1, 0]);
+  assert.equal(store.state.proposals.length, 1);
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null, 'nothing new still answers the week');
+});
+
+test('with no rules in use a competitor chip is kept as an answer and files no proposal', async () => {
+  await freshWeek();
+  store.state.activeRules = {};
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  const r = await call('POST', '/market-watch/ask/answer', { picks: [{ question: 'rival', choice: 'AI app builder' }] });
+  assert.deepEqual([r.status, r.body.answers, r.body.proposals], [200, 1, 0]);
+});
+
+test('MEMBERS ONLY: a non-member is refused 403 on both routes, a signed-out caller 401', async () => {
+  await freshWeek();
+  for (const v of [{ id: 66, rank: 'helot', status: 'active' }, { id: 67, rank: 'xenos', status: 'inactive' }, { id: 68, rank: null, status: 'active' }]) {
+    viewer = v;
+    const g = await call('GET', '/market-watch/ask');
+    const p = await call('POST', '/market-watch/ask/answer', { picks: [{ question: 'rival', choice: 'AI app builder' }] });
+    assert.equal(g.status, 403, `GET as ${JSON.stringify(v)}`);
+    assert.equal(p.status, 403, `POST as ${JSON.stringify(v)}`);
+  }
+  assert.equal(store.state.answers.length, 0, 'nothing was stored');
+  viewer = null;
+  assert.equal((await call('POST', '/market-watch/ask/answer', { nothing: true })).status, 401);
+});
+
+test('a member cannot answer for another member', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'metic', status: 'active' };
+  const r = await call('POST', '/market-watch/ask/answer', { builder_id: 8, picks: [{ question: 'rival', choice: 'AI app builder' }] });
+  assert.equal(r.status, 403);
+  assert.equal(r.body.error.code, 'not_your_answer');
+  assert.equal(store.state.answers.length, 0);
+  // Naming yourself is allowed, and is the same as naming nobody.
+  const self = await call('POST', '/market-watch/ask/answer', { builder_id: 7, picks: [{ question: 'rival', choice: 'AI app builder' }] });
+  assert.equal(self.status, 200);
+  assert.deepEqual(store.state.answers.map((a) => a.builder_id), [7]);
+});
+
+test('a chip must be one the card offered, and free text is capped', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  const forged = await call('POST', '/market-watch/ask/answer', { picks: [{ question: 'rival', choice: 'Anything I like' }] });
+  assert.deepEqual([forged.status, forged.body.error.code], [400, 'unknown_choice']);
+  const long = await call('POST', '/market-watch/ask/answer', { names: [{ question: 'watch', text: 'y'.repeat(200) }] });
+  assert.deepEqual([long.status, long.body.error.code], [400, 'text_too_long']);
+  const extra = await call('POST', '/market-watch/ask/answer', { nothing: true, reason: '<b>hi</b>' });
+  assert.equal(extra.status, 400, 'an unknown field is refused (strict body schema)');
+  assert.equal(store.state.answers.length, 0);
+});
+
+test('an unanswered card expires quietly: after the week closes there is no card and no answer', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  clock = new Date('2026-11-02T00:00:01Z'); // the next week, before its ask is out
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null);
+  const late = await call('POST', '/market-watch/ask/answer', { week_of: '2026-10-26', nothing: true });
+  assert.deepEqual([late.status, late.body.error.code], [409, 'ask_closed']);
+  // A body for last week, sent once the new week's card is out, is refused, not filed on the new one.
+  await ask.issueWeeklyAsk(store, { project: PROJECT, now: clock });
+  const stale = await call('POST', '/market-watch/ask/answer', { week_of: '2026-10-26', nothing: true });
+  assert.equal(stale.status, 409);
+  assert.equal(store.state.answers.length, 0);
+});
+
+test('an ask whose closes_at has passed is closed even inside its week', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  for (const a of store.state.asks) a.closes_at = new Date('2026-10-29T00:00:00Z'); // closed this morning
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null);
+  assert.equal((await call('POST', '/market-watch/ask/answer', { nothing: true })).status, 409);
+  assert.equal(store.state.answers.length, 0);
+});
+
+test('an answer can never land on another project\'s ask', async () => {
+  await freshWeek();
+  await ask.issueWeeklyAsk(store, { project: OTHER, now: NOW });
+  const otherAsk = store.state.asks.find((a) => a.project === OTHER);
+  const id = await store.tx((t) => t.insertAnswer({ project: PROJECT, askId: otherAsk.id, builderId: 7, choice: 'x', freeText: null }));
+  assert.equal(id, null);
+});
+
+// ---- untrusted text is escaped ------------------------------------------------
+
+test('members\' words and item names are escaped wherever the card draws them', () => {
+  const evil = '<img src=x onerror=alert(1)>';
+  const html = widget.cardHtml({
+    week_of: '2026-10-26', week_no: 44, next_on: '2026-11-02', streak: 2,
+    questions: [{ key: 'rival', prompt: 'what counts as a competitor?', options: [{ label: evil, example: `"${evil}` }] }],
+    team: [{ verb: 'Add', name: evil, tail: 'as a competitor', who: evil, agree: 1, status: 'open' }],
+  });
+  assert.ok(!html.includes('<img'), 'no member text becomes markup');
+  assert.ok(html.includes('&lt;img src=x onerror=alert(1)&gt;'));
+  assert.ok(!/data-mwask-choice="[^"]*"[^ >]*onerror/.test(html), 'an attribute cannot be broken out of');
+  assert.equal(widget.cardHtml(null), '', 'no card, no slice');
+  assert.deepEqual(widget.answerBody('2026-10-26', [{ question: 'watch', text: 'z'.repeat(120) }]).names[0].text.length, 80);
+});

package/tests/market_watch_ask_db.mjs

@@ -0,0 +1,122 @@
+// tests/market_watch_ask_db.mjs — the weekly ask's SQL store against a REAL Postgres (task
+// 1004940, goal 1000137).
+//
+// What only a real engine can say: the week's ask is issued once per project per week (the
+// UNIQUE constraint, not the caller's care); an answer cannot land on another project's ask
+// (the guard is in the INSERT ... SELECT); similar answers from three members file ONE
+// proposal whose agree count is three; a second tap is a no-op; and the rows satisfy the
+// proposals table's own CHECKs (a weekly_ask proposal carries its answer, a rule_change its
+// rules version).
+//
+// The module is default:false, so CI's migrate.sh does not apply its migrations; this file
+// applies market_watch_001, 002 and 003 itself. Its rows live under a project origin no real
+// instance has and are deleted before and after. Self-skips without a reachable Postgres;
+// in the INTEGRATION set (scripts/bongos/run-unit-tests.js). DB-free sibling:
+// tests/market_watch_ask.mjs.
+//
+// Run:  DATABASE_URL=... node tests/market_watch_ask_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { strict as assert } from 'node:assert';
+import { insertTestBuilders } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const ask = require('../modules/market-watch/ask.js');
+
+const M1 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_001_tables.sql', import.meta.url), 'utf8');
+const M2 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_002_run.sql', import.meta.url), 'utf8');
+const M3 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_003_ask_pool.sql', import.meta.url), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`market_watch_ask_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const P = 'https://t1004940-ask.example';
+const OTHER = 'https://t1004940-other.example';
+const ADA = 91004940, BEN = 91004941, CY = 91004942;
+const NOW = new Date('2026-10-29T12:00:00Z');
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  for (const project of [P, OTHER]) {
+    await q(`DELETE FROM market_watch_proposals WHERE project = $1`, [project]).catch(() => {});
+    await q(`DELETE FROM market_watch_ask_answers WHERE ask_id IN (SELECT id FROM market_watch_weekly_asks WHERE project = $1)`, [project]).catch(() => {});
+    await q(`DELETE FROM market_watch_weekly_asks WHERE project = $1`, [project]).catch(() => {});
+    await q(`DELETE FROM market_watch_items WHERE project = $1`, [project]).catch(() => {});
+    await q(`DELETE FROM market_watch_rule_versions WHERE project = $1`, [project]).catch(() => {});
+  }
+  await q(`DELETE FROM builders WHERE id = ANY($1::bigint[])`, [[ADA, BEN, CY]]).catch(() => {});
+}
+
+let failed = 0;
+async function check(name, fn) {
+  try { await fn(); console.log(`ok - ${name}`); } catch (e) { failed += 1; console.log(`not ok - ${name}\n  ${e && e.stack}`); }
+}
+
+try {
+  await q(M1);
+  await q(M2);
+  await q(M3);
+  await q(M3);
+  await cleanup();
+  await insertTestBuilders(pool, [{ id: ADA, login: 't1004940-ada' }, { id: BEN, login: 't1004940-ben' }, { id: CY, login: 't1004940-cy' }]);
+  await q(`INSERT INTO market_watch_rule_versions (project, version, status, reason) VALUES ($1, 1, 'active', 'test rules')`, [P]);
+  for (const [kind, name, category] of [
+    ['competitor', 'Lovable', 'AI app builder'], ['competitor', 'Bolt.new', 'AI app builder'],
+    ['competitor', 'Factory', 'AI software-engineering agent'], ['partner', 'Colony', 'DAO tooling'],
+  ]) await q(`INSERT INTO market_watch_items (project, kind, name, url, category) VALUES ($1, $2, $3, '', $4)`, [P, kind, name, category]);
+  const store = ask.createAskStore(pool);
+
+  await check('the week is issued once per project, with chips from the project\'s own items', async () => {
+    assert.equal((await ask.issueWeeklyAsk(store, { project: P, now: NOW })).created, 2);
+    assert.equal((await ask.issueWeeklyAsk(store, { project: P, now: NOW })).created, 0);
+    // Even a direct second insert is refused by the constraint, not by the caller.
+    assert.equal(await store.insertAsk(P, { weekOf: '2026-10-26', questionKey: 'rival', prompt: 'x', options: [], closesAt: NOW }), false);
+    const asks = await store.asksForWeek(P, '2026-10-26');
+    assert.deepEqual(asks.map((a) => a.question_key), ['rival', 'watch']);
+    assert.deepEqual(asks[0].options.map((o) => o.label), ['AI app builder', 'AI software-engineering agent']);
+    assert.deepEqual(asks[1].options.map((o) => o.label), ['DAO tooling']);
+  });
+
+  await check('three members, one pool: one proposal, three agree, and the card is gone for each', async () => {
+    const r1 = await ask.answer(store, { project: P, builderId: ADA, now: NOW, body: { picks: [{ question: 'rival', choice: 'AI app builder' }], names: [{ question: 'rival', text: 'Kilo Code' }] } });
+    assert.equal(r1.status, 200, JSON.stringify(r1.body));
+    assert.deepEqual([r1.body.answers, r1.body.proposals], [2, 2]);
+    const r2 = await ask.answer(store, { project: P, builderId: BEN, now: NOW, body: { names: [{ question: 'rival', text: 'kilo-code' }] } });
+    assert.deepEqual([r2.body.proposals, r2.body.pooled], [0, 1]);
+    const r3 = await ask.answer(store, { project: P, builderId: CY, now: NOW, body: { names: [{ question: 'rival', text: 'The Kilo Code' }] } });
+    assert.deepEqual([r3.body.proposals, r3.body.pooled], [0, 1]);
+    const again = await ask.answer(store, { project: P, builderId: ADA, now: NOW, body: { picks: [{ question: 'rival', choice: 'AI app builder' }] } });
+    assert.equal(again.body.answers, 0, 'a second tap is a no-op');
+    const team = await store.teamProposals(P, '2026-10-26');
+    assert.equal(team.length, 2);
+    assert.deepEqual([team[0].payload.name, team[0].agree, team[0].who], ['Kilo Code', 3, 't1004940-ada']);
+    const { rows } = await q(`SELECT kind, origin, answer_id, rule_version_id FROM market_watch_proposals WHERE project = $1 ORDER BY id`, [P]);
+    assert.equal(rows[0].kind, 'rule_change');
+    assert.ok(rows[0].rule_version_id && rows.every((r) => r.origin === 'weekly_ask' && r.answer_id));
+    for (const b of [ADA, BEN, CY]) assert.equal(await ask.cardFor(store, { project: P, builderId: b, now: NOW }), null);
+  });
+
+  await check('an answer cannot land on another project\'s ask', async () => {
+    await ask.issueWeeklyAsk(store, { project: OTHER, now: NOW });
+    const [other] = await store.asksForWeek(OTHER, '2026-10-26');
+    const id = await store.tx((t) => t.insertAnswer({ project: P, askId: other.id, builderId: ADA, choice: 'x', freeText: null }));
+    assert.equal(id, null);
+  });
+} finally {
+  await cleanup();
+  await pool.end();
+}
+
+if (failed) {
+  console.log(`market_watch_ask_db.mjs: ${failed} failed`);
+  process.exit(1);
+}
+console.log('market_watch_ask_db.mjs: all passed');

package/tests/market_watch_data_db.mjs

@@ -28,6 +28,7 @@ const db = require('../modules/market-watch/db.js');
 
 const MIGRATION = readFileSync(new URL('../modules/market-watch/migrations/market_watch_001_tables.sql', import.meta.url), 'utf8');
 const MIGRATION_002 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_002_run.sql', import.meta.url), 'utf8');
+const MIGRATION_003 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_003_ask_pool.sql', import.meta.url), 'utf8');
 const run = require('../modules/market-watch/run.js');
 const store = require('../modules/market-watch/store.js');
 
@@ -80,6 +81,9 @@ try {
     // 'run' proposal origin. A new migration here joins this file (CI never applies it).
     await q(MIGRATION_002);
     await q(MIGRATION_002);
+    // market_watch_003 (task 1004940): the weekly ask's pool-lookup index.
+    await q(MIGRATION_003);
+    await q(MIGRATION_003);
     const { rows } = await q(`SELECT count(*)::int AS n FROM information_schema.tables WHERE table_name LIKE 'market\\_watch\\_%'`);
     assert.ok(rows[0].n >= 10, `tables: ${rows[0].n}`);
   });

package/tests/market_watch_module.mjs

@@ -2,7 +2,7 @@
 // the loader, and an instance boots with it present and DISABLED (task 1004935, goal
 // 1000137). DB-free, so it runs in the unit lane.
 //
-// The module mounts no routes yet; task 1004936 gave it its tables and a one-shot hub seed
+// Task 1004940 mounted its first routes (the weekly ask); task 1004936 gave it its tables and a one-shot hub seed
 // poller (tests/market_watch_data.mjs covers those). What this file
 // pins is everything the later Market Watch tasks will stand on:
 //   1. the manifest validates, ships default:false, and declares spend.requiresPayer;
@@ -26,7 +26,7 @@ const mods = require('../src/modules.js');
 const bundles = require('../modules/provisioning/starter-bundles.js');
 const scopeMap = require('../src/bongos/module-scope-map.js');
 
-test('the manifest validates, ships disabled, declares a payer, and contributes only its data', () => {
+test('the manifest validates, ships disabled, declares a payer, and contributes what the goal has built', () => {
   const v = validateManifest(manifest);
   assert.equal(v.valid, true, `manifest errors: ${v.errors.join('; ')}`);
   assert.equal(manifest.key, KEY);
@@ -34,9 +34,13 @@ test('the manifest validates, ships disabled, declares a payer, and contributes
   assert.equal(manifest.spend && manifest.spend.requiresPayer, true,
     'every run spends the project AI budget, so the payer guard is declared before the first route');
   // Task 1004936 added its tables and the one-shot hub seed; task 1004937 the weekly-run
-  // poller. There are still no routes.
-  assert.deepEqual(manifest.contributes, { migrations: true, pollers: ['hub-seed', 'weekly-run'] },
-    'its tables, the hub seed and the weekly run, nothing to mount');
+  // poller; task 1004940 the weekly ask (its poller, its routes and its hall slice). Each
+  // screen task adds its own entries, so this pins what must be there, not the whole list.
+  const c = manifest.contributes;
+  assert.equal(c.migrations, true);
+  for (const p of ['hub-seed', 'weekly-run', 'weekly-ask']) assert.ok(c.pollers.includes(p), `poller ${p}`);
+  assert.ok(c.routes.includes('ask'), 'the weekly ask routes');
+  assert.ok(c.uiSections.includes('weekly-ask'), 'the weekly ask hall slice (hallWidgetScripts needs a uiSection)');
 });
 
 test('the loader discovers it from the live tree — loaded, not an error, not skipped', () => {

package/tests/project_settings_page.mjs

@@ -57,7 +57,7 @@ const fakeRes = () => ({
 // The router is built against the REAL module-api and the REAL goal-category; only
 // the two calls that would reach Postgres are swapped. Stubbing the row builders
 // instead would prove nothing about the shape the page actually receives.
-const WORKING_REWARD = { rewardConfig: () => ({ marginPct: 20, usdPeg: 1, mode: 'cost-plus-only', perTaskCredit: false, ideatorCredit: true }) };
+const WORKING_REWARD = { rewardConfig: () => ({ marginPct: 20, costScale: 1, mode: 'cost-plus-only', perTaskCredit: false, ideatorCredit: true }) };
 function buildRouterWithStubs({ timer, categories, reward = WORKING_REWARD }) {
   const saved = {
     resolveRotDays: api.resolveRotDays,