@bongos/core 1.24.5 → 1.24.6

package/tests/account_linking.mjs

@@ -0,0 +1,289 @@
+// tests/account_linking.mjs — GitHub and Google as two ways into ONE account,
+// linked and unlinked by the person (task 1004995, ADR 0393/0396).
+//
+// WHY. The owner's rules: a signed-in person can link the other provider and
+// both open the same account; never remove the last way in; when emails match,
+// suggest — never join; and an account that already exists separately is said
+// plainly and never merged. And the ADR 0393 carry-over: once linking exists,
+// every GitHub sign-in must find the person first, or a GitHub account linked to
+// someone who joined with Google signs in as a second person.
+// No database, no network: a recording fake pool, a stubbed fetch for GitHub,
+// and the db-kernel functions stubbed before the files that destructure them load.
+//
+// Run:  node --test tests/account_linking.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'gh-test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'gh-test-secret';
+process.env.BONGOS_OPEN_XENOS_ENROLLMENT = '1';
+
+function fakePool(script) {
+  const p = { log: [], script };
+  const run = async (sql, params = []) => {
+    p.log.push({ sql, params });
+    for (const [re, answer] of p.script) {
+      if (re.test(sql)) return typeof answer === 'function' ? answer(sql, params, p.log) : answer;
+    }
+    return { rows: [], rowCount: 0 };
+  };
+  p.query = run;
+  p.connect = async () => ({ query: run, release() {} });
+  return p;
+}
+
+// ── stubs, installed before anything destructures them ──
+const kernel = require('../src/bongos/db-kernel.js');
+const upserts = [];
+kernel.getBuilderByGithubId = async () => null;
+kernel.upsertBuilder = async (b) => { upserts.push(b); return { id: 9, github_id: String(b.githubId), github_login: b.githubLogin, status: 'active', rank: 'xenos' }; };
+kernel.createSession = async () => ({ id: 1 });
+const dbMod = require('../src/bongos/db.js');
+dbMod.createSession = kernel.createSession;
+const admission = require('../src/bongos/auth-admission.js');
+admission.safeSyncRankRole = async () => {};
+let ME = '-7';
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+const routePool = fakePool([]);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: routePool,
+  requireBuilder: (req, _res, next) => { req.builder = { id: 1, github_id: ME, github_login: '~ana' }; next(); },
+};
+const seams = require('../src/module-seams.js');
+const hub = { personKeyForGithub: async () => null, recordHubSignin: async () => {} };
+if (!seams.hasProvider('platform-identity.hub')) seams.registerProvider('platform-identity.hub', hub);
+const registered = seams.resolveOptional('platform-identity.hub');
+
+const logins = require('../modules/platform-identity/account-logins.js');
+const profileRoutes = require('../modules/platform-identity/routes/profile.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const { completeWebFlow } = require('../src/bongos/auth-github.js');
+const { linkLanding } = require('../src/bongos/routes/auth-link.js');
+const { renderExistingAccountHint } = require('../src/bongos/sign-in-pages.js');
+
+const dupe = () => { const e = new Error('duplicate key'); e.code = '23505'; throw e; };
+
+// ── 1. who a GitHub sign-in reaches ──────────────────────────────────────────
+
+test('a GitHub id linked to someone who joined with Google reaches THEIR key; an unknown one reaches no one', async () => {
+  const pool = fakePool([[/FROM platform_identity_account_logins l/, (_s, params) => (params[1] === '555' ? { rows: [{ account_id: 3, person_key: '-7' }] } : { rows: [] })]]);
+  assert.equal(await logins.personKeyForGithub('555', { pool }), '-7');
+  assert.equal(await logins.personKeyForGithub('556', { pool }), null);
+  assert.equal(await logins.personKeyForGithub('-7', { pool }), null, 'a minted key is never a GitHub id');
+});
+
+test('the hub’s GitHub web sign-in signs a linked GitHub account in as the person, not a second account', async () => {
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async (url) => ({
+    ok: true,
+    json: async () => (String(url).includes('access_token') ? { access_token: 't', scope: '' } : { id: 555, login: 'ana-gh', name: 'Ana', avatar_url: null, email: 'ana@example.com' }),
+  });
+  const asked = [];
+  const signins = [];
+  registered.personKeyForGithub = async (id) => { asked.push(id); return id === '555' ? '-7' : null; };
+  registered.recordHubSignin = async (r) => { signins.push(r); };
+  upserts.length = 0;
+  try {
+    await completeWebFlow({ code: 'c', redirectUri: 'https://hub.example/cb' });
+  } finally { globalThis.fetch = realFetch; }
+  assert.deepEqual(asked, ['555'], 'the hub is asked who the GitHub id reaches, first');
+  assert.equal(upserts[0].githubId, '-7', 'the builder row is the person’s, keyed on their minted key');
+  assert.equal(upserts[0].githubLogin, 'ana-gh', 'with the real GitHub login, now that GitHub is linked');
+  assert.equal(signins[0].githubId, '-7', 'the hub account touched is the person’s');
+  assert.equal(signins[0].githubUserId, '555', 'and the GitHub way in itself is stamped as used');
+});
+
+test('with no hub (any other instance) the GitHub id is the key, exactly as before', async () => {
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async (url) => ({ ok: true, json: async () => (String(url).includes('access_token') ? { access_token: 't' } : { id: 42, login: 'octo' }) });
+  const saved = registered.personKeyForGithub;
+  delete registered.personKeyForGithub;
+  upserts.length = 0;
+  try { await completeWebFlow({ code: 'c', redirectUri: 'https://x.example/cb' }); } finally { globalThis.fetch = realFetch; registered.personKeyForGithub = saved; }
+  assert.equal(upserts[0].githubId, '42');
+});
+
+// ── 2. linking — never a merge ───────────────────────────────────────────────
+
+const ownedBy = (key) => [/FROM platform_identity_account_logins l\s+JOIN/, key ? { rows: [{ account_id: 1, person_key: key }] } : { rows: [] }];
+
+test('a way in that already reaches ANOTHER person is refused as taken, and nothing is written', async () => {
+  const pool = fakePool([ownedBy('99')]);
+  assert.deepEqual(await logins.linkLogin({ personKey: '-7', provider: 'github', subject: '555', githubLogin: 'x' }, { pool }), { refused: 'taken' });
+  assert.equal(pool.log.filter((q) => /INSERT|UPDATE|DELETE/.test(q.sql)).length, 0);
+});
+
+test('linking what is already yours is a no-op success', async () => {
+  const pool = fakePool([ownedBy('-7')]);
+  assert.deepEqual(await logins.linkLogin({ personKey: '-7', provider: 'google', subject: 'g-1' }, { pool }), { linked: true, already: true });
+});
+
+test('linking GitHub adds the way in and writes the real login on the account', async () => {
+  const pool = fakePool([ownedBy(null), [/SELECT id FROM platform_identity_accounts WHERE github_id/, { rows: [{ id: 4 }] }]]);
+  assert.deepEqual(await logins.linkLogin({ personKey: '-7', provider: 'github', subject: '555', email: 'ana@example.com', githubLogin: 'ana-gh' }, { pool }), { linked: true, already: false });
+  const ins = pool.log.find((q) => /INSERT INTO platform_identity_account_logins/.test(q.sql));
+  assert.deepEqual(ins.params, [4, 'github', '555', 'ana@example.com']);
+  const upd = pool.log.find((q) => /UPDATE platform_identity_accounts SET github_login/.test(q.sql));
+  assert.deepEqual(upd.params, [4, 'ana-gh']);
+});
+
+test('linking Google writes no GitHub login', async () => {
+  const pool = fakePool([ownedBy(null), [/SELECT id FROM platform_identity_accounts WHERE github_id/, { rows: [{ id: 4 }] }]]);
+  await logins.linkLogin({ personKey: '42', provider: 'google', subject: 'g-1' }, { pool });
+  assert.equal(pool.log.filter((q) => /github_login/.test(q.sql) && /UPDATE/.test(q.sql)).length, 0);
+});
+
+test('a race: someone else took it a moment ago → taken; you already hold that provider → already_linked', async () => {
+  let n = 0;
+  const raced = fakePool([
+    [/FROM platform_identity_account_logins l\s+JOIN/, () => (n++ === 0 ? { rows: [] } : { rows: [{ account_id: 2, person_key: '99' }] })],
+    [/SELECT id FROM platform_identity_accounts WHERE github_id/, { rows: [{ id: 4 }] }],
+    [/INSERT INTO platform_identity_account_logins/, dupe],
+  ]);
+  assert.deepEqual(await logins.linkLogin({ personKey: '-7', provider: 'google', subject: 'g-1' }, { pool: raced }), { refused: 'taken' });
+  const held = fakePool([ownedBy(null), [/SELECT id FROM platform_identity_accounts WHERE github_id/, { rows: [{ id: 4 }] }], [/INSERT INTO platform_identity_account_logins/, dupe]]);
+  assert.deepEqual(await logins.linkLogin({ personKey: '-7', provider: 'google', subject: 'g-2' }, { pool: held }), { refused: 'already_linked' });
+});
+
+// ── 3. unlinking — never the last way in ─────────────────────────────────────
+
+test('the refusal rule: never the last way in; never GitHub from an account born with it', () => {
+  assert.equal(logins.unlinkRefusal({ personKey: '-7', provider: 'google', count: 1 }), 'last_way_in');
+  assert.equal(logins.unlinkRefusal({ personKey: '-7', provider: 'github', count: 2 }), null, 'a Google-born person may drop GitHub');
+  assert.equal(logins.unlinkRefusal({ personKey: '-7', provider: 'google', count: 2 }), null);
+  assert.equal(logins.unlinkRefusal({ personKey: '42', provider: 'github', count: 2 }), 'born_with', 'its key IS its GitHub id');
+  assert.equal(logins.unlinkRefusal({ personKey: '42', provider: 'google', count: 2 }), null);
+});
+
+const held = (...providers) => [/FOR UPDATE OF l/, { rows: providers.map((provider, i) => ({ id: 10 + i, provider, account_id: 4 })) }];
+
+test('unlink counts and deletes under one lock, and clears the GitHub login with GitHub', async () => {
+  const pool = fakePool([held('github', 'google')]);
+  assert.deepEqual(await logins.unlinkLogin({ personKey: '-7', provider: 'github' }, { pool }), { unlinked: true });
+  assert.ok(pool.log.some((q) => /BEGIN/i.test(q.sql)), 'inside a transaction');
+  assert.deepEqual(pool.log.find((q) => /DELETE FROM platform_identity_account_logins/.test(q.sql)).params, [10]);
+  assert.deepEqual(pool.log.find((q) => /SET github_login = NULL/.test(q.sql)).params, [4]);
+});
+
+test('unlink refuses the last way in, a GitHub-born account’s GitHub, and one not linked — deleting nothing', async () => {
+  for (const [key, provider, rows, want] of [
+    ['-7', 'google', ['google'], 'last_way_in'],
+    ['42', 'github', ['github', 'google'], 'born_with'],
+    ['-7', 'github', ['google'], 'not_linked'],
+  ]) {
+    const pool = fakePool([held(...rows)]);
+    assert.deepEqual(await logins.unlinkLogin({ personKey: key, provider }, { pool }), { refused: want }, `${key} ${provider}`);
+    assert.equal(pool.log.filter((q) => /^\s*(DELETE|UPDATE)/.test(q.sql)).length, 0);
+  }
+});
+
+// ── 4. a matching email suggests, never joins ────────────────────────────────
+
+test('the first-sign-in hint names providers only, and only while the identity reaches no one', async () => {
+  const pool = fakePool([ownedBy(null), [/SELECT DISTINCT provider/, { rows: [{ provider: 'github' }] }]]);
+  assert.deepEqual(await logins.existingAccountHint({ provider: 'google', subject: 'g-1', email: 'Ana@Example.com' }, { pool }), ['github']);
+  const q = pool.log.find((x) => /SELECT DISTINCT provider/.test(x.sql));
+  assert.match(q.sql, /provider <> \$1 AND lower\(email\) = lower\(\$2\)/);
+  assert.doesNotMatch(q.sql, /github_id|handle|account_id|SELECT[^F]*email/, 'it reads back no key, handle or address');
+  const known = fakePool([ownedBy('-7')]);
+  assert.deepEqual(await logins.existingAccountHint({ provider: 'google', subject: 'g-1', email: 'a@b.c' }, { pool: known }), [], 'a returning person is never stopped');
+  assert.deepEqual(await logins.existingAccountHint({ provider: 'google', subject: 'g-1', email: null }, { pool }), []);
+});
+
+test('the hint page offers the existing account or a new one, joins nothing and names no one', () => {
+  const html = renderExistingAccountHint({ githubHref: '/api/bongos/auth/web/start?via=github&return=%2Faccount%23aWaysIn', newAccountHref: '/api/bongos/auth/google/start?fresh=1' });
+  assert.match(html, /Sign in with GitHub/);
+  assert.match(html, /Make a new account with Google/);
+  assert.match(html, /href="\/api\/bongos\/auth\/google\/start\?fresh=1"/);
+  assert.match(html, /We never join accounts on our own, even when the emails match\./);
+});
+
+test('every link answer lands on the account page’s ways section', () => {
+  assert.equal(linkLanding('github', { linked: true }), '/account?linked=github#aWaysIn');
+  assert.equal(linkLanding('google', { refused: 'taken' }), '/account?link_refused=taken&provider=google#aWaysIn');
+  assert.equal(linkLanding('google', null), '/account?link_refused=failed&provider=google#aWaysIn');
+});
+
+// ── 5. the own-scoped routes ─────────────────────────────────────────────────
+
+let server; let port;
+before(async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use('/api/bongos', profileRoutes());
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(() => server.close());
+const call = (method, path) => new Promise((resolve, reject) => {
+  const r = http.request({ host: '127.0.0.1', port, path, method }, (resp) => {
+    let data = ''; resp.on('data', (c) => { data += c; }); resp.on('end', () => resolve({ status: resp.statusCode, body: data ? JSON.parse(data) : null }));
+  });
+  r.on('error', reject); r.end();
+});
+
+test('GET /me/sign-in-methods says, per way in, why it cannot be removed', async () => {
+  ME = '-7';
+  routePool.script = [[/FROM platform_identity_account_logins l\s+JOIN platform_identity_accounts a ON a.id = l.account_id\s+WHERE a.github_id/, { rows: [{ provider: 'google', email: 'ana@example.com' }] }]];
+  const res = await call('GET', '/api/bongos/me/sign-in-methods');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.body.methods, [{ provider: 'google', email: 'ana@example.com', unlink_refused: 'last_way_in' }]);
+});
+
+test('DELETE /me/sign-in-methods/:provider removes one, keyed on the session, and refuses in plain words', async () => {
+  ME = '-7';
+  routePool.script = [held('github', 'google')];
+  routePool.log.length = 0;
+  assert.equal((await call('DELETE', '/api/bongos/me/sign-in-methods/google')).status, 200);
+  assert.deepEqual(routePool.log.find((q) => /FOR UPDATE/.test(q.sql)).params, ['-7'], 'the person is the session’s, never a parameter');
+  routePool.script = [held('google')];
+  const last = await call('DELETE', '/api/bongos/me/sign-in-methods/google');
+  assert.equal(last.status, 409);
+  assert.equal(last.body.error.code, 'last_way_in');
+  assert.equal((await call('DELETE', '/api/bongos/me/sign-in-methods/discord')).status, 404, 'only the known providers');
+});
+
+// ── 6. Link GitHub, end to end through its callback ──────────────────────────
+
+test('Link GitHub: a GitHub account that already has its own account here is refused, never merged', async () => {
+  const auth = require('../src/bongos/auth.js');
+  const buildAuthLinkRouter = require('../src/bongos/routes/auth-link.js');
+  const linked = [];
+  registered.linkLogin = async (r) => { linked.push(r); return { linked: true, already: false }; };
+  const realSession = auth.resolveSession;
+  auth.resolveSession = async () => ({ github_id: '-7', display_name: 'Ana', status: 'active' });
+  const realFetch = globalThis.fetch;
+  globalThis.fetch = async (url) => ({ ok: true, json: async () => (String(url).includes('access_token') ? { access_token: 't' } : { id: 555, login: 'ana-gh' }) });
+  const realGet = dbMod.getBuilderByGithubId;
+  const app = express();
+  app.use(buildAuthLinkRouter());
+  const srv = http.createServer(app);
+  await new Promise((r) => srv.listen(0, '127.0.0.1', r));
+  const hit = () => new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port: srv.address().port, path: '/auth/web/callback/link?state=s1&code=c', headers: { cookie: 'bongos_link_state=s1' } },
+      (resp) => { resp.resume(); resolve(resp.headers.location); }).on('error', reject);
+  });
+  try {
+    dbMod.getBuilderByGithubId = async (id) => (id === '555' ? { id: 3 } : null);
+    assert.equal(await hit(), '/account?link_refused=taken&provider=github#aWaysIn');
+    assert.equal(linked.length, 0, 'the hub was never asked to link it');
+    dbMod.getBuilderByGithubId = async () => null;
+    upserts.length = 0;
+    assert.equal(await hit(), '/account?linked=github#aWaysIn');
+    assert.deepEqual(linked[0], { personKey: '-7', provider: 'github', subject: '555', email: null, githubLogin: 'ana-gh' });
+    assert.equal(upserts[0].githubId, '-7');
+    assert.equal(upserts[0].githubLogin, 'ana-gh', 'the hall shows the real login from now on');
+  } finally {
+    auth.resolveSession = realSession; globalThis.fetch = realFetch; dbMod.getBuilderByGithubId = realGet; srv.close();
+  }
+});

package/tests/account_logins_db.mjs

@@ -154,6 +154,62 @@ try {
   const after = await accountRow(first.personKey);
   same([after.github_login, after.profile_state], [null, 'active'], 'the hub sign-in activates the person and writes no login');
 
+  // 9 — linking and removing ways in (task 1004995), against the real constraints
+  // and real row locks, which a fake pool cannot execute.
+  await q(migrationSql('platform_identity_035_account_login_email_idx.sql'));
+  await q(migrationSql('platform_identity_035_account_login_email_idx.sql'));
+  ok((await q(`SELECT 1 FROM pg_indexes WHERE indexname = 'platform_identity_account_logins_lower_email_idx'`)).rows.length === 1,
+    'the address index exists, and its migration re-runs safely');
+
+  const GH_LINK = '90499203'; // a GitHub id nobody holds yet
+  const ana = await logins.signInWithLogin({ provider: 'google', subject: SUB('ana'), email: 'ana@example.com', displayName: 'Ana' }, { pool });
+  const bo = await logins.signInWithLogin({ provider: 'google', subject: SUB('bo'), email: 'bo@example.com', displayName: 'Bo' }, { pool });
+
+  // Two people link the same GitHub account at once: the UNIQUE (provider, subject)
+  // decides, so exactly one gets it and the other is told it is taken.
+  const racedLinks = await Promise.all([
+    logins.linkLogin({ personKey: ana.personKey, provider: 'github', subject: GH_LINK, githubLogin: 'ana-gh' }, { pool }),
+    logins.linkLogin({ personKey: bo.personKey, provider: 'github', subject: GH_LINK, githubLogin: 'ana-gh' }, { pool }),
+  ]);
+  same(racedLinks.map((r) => (r.linked ? 'linked' : r.refused)).sort(), ['linked', 'taken'], 'two people racing for one GitHub account: one links, one is refused, nothing merges');
+  const winner = racedLinks[0].linked ? ana : bo;
+  const loser = racedLinks[0].linked ? bo : ana;
+  same((await accountRow(winner.personKey)).github_login, 'ana-gh', 'the winner’s account now shows the real GitHub login');
+  same((await accountRow(loser.personKey)).github_login, null, 'the other account is untouched');
+  same(await logins.personKeyForGithub(GH_LINK, { pool }), winner.personKey, 'a GitHub sign-in with that id now reaches the winner');
+  same(await logins.linkLogin({ personKey: loser.personKey, provider: 'github', subject: GH_LINK, githubLogin: 'x' }, { pool }), { refused: 'taken' },
+    'linking it again later is still refused');
+  same(await logins.linkLogin({ personKey: winner.personKey, provider: 'github', subject: '90499204', githubLogin: 'y' }, { pool }), { refused: 'already_linked' },
+    'a person holds one GitHub way in; a second is refused by the database');
+
+  // Two removals at once on a person with two ways in: the row lock serialises
+  // them, so exactly one goes and the other finds it would be the last.
+  const removed = await Promise.all([
+    logins.unlinkLogin({ personKey: winner.personKey, provider: 'google' }, { pool }),
+    logins.unlinkLogin({ personKey: winner.personKey, provider: 'github' }, { pool }),
+  ]);
+  same(removed.filter((r) => r.unlinked).length, 1, 'two racing removals: exactly one goes through');
+  same(removed.filter((r) => r.refused === 'last_way_in').length, 1, 'the other is refused as the last way in');
+  same((await logins.listLoginsForPerson(winner.personKey, { pool })).length, 1, 'the person keeps one way in');
+
+  // GitHub never comes off an account born with it (its key IS its GitHub id).
+  same(await logins.unlinkLogin({ personKey: String(GH), provider: 'github' }, { pool }), { refused: 'born_with' }, 'a GitHub-born account keeps GitHub');
+  same((await logins.listLoginsForPerson(String(GH), { pool })).map((m) => m.provider), ['github', 'google'], 'and nothing was deleted');
+
+  // A GitHub way in removed from a person who joined with Google clears the login.
+  const cy = await logins.signInWithLogin({ provider: 'google', subject: SUB('cy'), email: 'cy@example.com', displayName: 'Cy' }, { pool });
+  await logins.linkLogin({ personKey: cy.personKey, provider: 'github', subject: '90499205', githubLogin: 'cy-gh' }, { pool });
+  same(await logins.unlinkLogin({ personKey: cy.personKey, provider: 'github' }, { pool }), { unlinked: true }, 'a linked GitHub comes off a Google-born person');
+  same([(await accountRow(cy.personKey)).github_login, await logins.personKeyForGithub('90499205', { pool })], [null, null],
+    'their login is cleared and that GitHub id reaches no one again');
+
+  // The first-sign-in hint: the address another way in shows, provider names only.
+  await logins.touchGithubLogin({ githubId: String(GH), email: 'Octo-GH@Example.com' }, { pool });
+  same(await logins.existingAccountHint({ provider: 'google', subject: SUB('newcomer'), email: 'octo-gh@example.com' }, { pool }), ['github'],
+    'a new Google identity with a GitHub way in’s address (any case) is offered GitHub');
+  same(await logins.existingAccountHint({ provider: 'google', subject: SUB('octo'), email: 'octo-gh@example.com' }, { pool }), [],
+    'a Google identity that already reaches someone is never stopped');
+
   console.log(`\naccount_logins_db.mjs: ${pass} passed`);
 } finally {
   await cleanup();

package/tests/claims_batch_routes.mjs

@@ -341,16 +341,78 @@ function chainFor(path) {
   return layer.route.stack.map((s) => s.handle.name || '<handler>');
 }
 
-test('POST /claims/batch middleware chain is pinned: requireBuilder → gateNewcomerClaim → handler', () => {
-  assert.deepEqual(chainFor('/claims/batch'), ['requireBuilder', 'gateNewcomerClaim', '<handler>']);
+test('POST /claims/batch middleware chain is pinned: requireBuilder → gateOneActiveClaimPerSession → gateNewcomerClaim → handler', () => {
+  assert.deepEqual(chainFor('/claims/batch'),
+    ['requireBuilder', 'gateOneActiveClaimPerSession', 'gateNewcomerClaim', '<handler>']);
 });
 
-test('POST /claims carries the one-claim-per-session gate that POST /claims/batch does not (the documented difference)', () => {
-  const single = chainFor('/claims');
-  assert.ok(single.includes('gateOneActiveClaimPerSession'));
-  assert.ok(single.includes('gateNewcomerClaim'));
-  assert.ok(!chainFor('/claims/batch').includes('gateOneActiveClaimPerSession'),
-    'if batch claim gains the session gate, update this pin (task 1005005 asks whether it should)');
+// task 1005005 (found by task 1004983): the batch route used to skip the
+// session gate. Both routes now run the SAME middleware function, in the same
+// order — one check, never a second copy of it.
+test('POST /claims and POST /claims/batch run the identical gate functions in the identical order', () => {
+  const gates = (p) => router.stack.find((l) => l.route && l.route.path === p && l.route.methods.post)
+    .route.stack.slice(0, -1).map((s) => s.handle);
+  const single = gates('/claims');
+  const batch = gates('/claims/batch');
+  assert.equal(batch.length, single.length);
+  single.forEach((fn, i) => assert.equal(batch[i], fn, `gate ${i} (${fn.name}) is the same function on both routes`));
+});
+
+// ── POST /claims/batch — the one-claim-per-session gate ──────────────────────
+
+test('a thetes session already holding a claim in this tree is refused 409 session_already_has_active_claim; nothing claimed', async () => {
+  caller = { id: '42', rank: 'thetes' };
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-A', worktree_name: 'wt', requested_worktree_name: 'wt' }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501, 502], worktree_name: 'wt' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'session_already_has_active_claim');
+  assert.equal(r.json.error.details.active_task_id, '700');
+  assert.equal(batchCalls, 0, 'claimTasksBatch never ran');
+  assert.equal(connects, 0, 'no transaction was opened');
+  assert.deepEqual(writes(), []);
+});
+
+test('the same session in a DIFFERENT tree may batch-claim (one claim per tree, as on POST /claims)', async () => {
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-A', worktree_name: 'other', requested_worktree_name: 'other' }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501], worktree_name: 'wt' });
+  assert.equal(r.status, 201);
+  assert.equal(batchCalls, 1);
+});
+
+test('a claim held by ANOTHER session in the same tree does not refuse this session', async () => {
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-Z', worktree_name: 'wt', requested_worktree_name: 'wt' }];
+  db.claimTasksBatch = async () => ({ claims: [] });
+  const r = await post(CLAIM, { task_ids: [501], worktree_name: 'wt' });
+  assert.equal(r.status, 201);
+});
+
+test('bind_session:false (the hall) has no session to scope to: no session lookup, claim proceeds', async () => {
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-A', worktree_name: null, requested_worktree_name: null }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501, 502], bind_session: false });
+  assert.equal(r.status, 201);
+  assert.equal(batchCalls, 1);
+  assert.deepEqual(calls, []);
+});
+
+test('the session lookup failing refuses the batch (fail closed), nothing claimed', async () => {
+  const realGet = db.getActiveClaimsForSession;
+  db.getActiveClaimsForSession = async () => { throw new Error('db down'); };
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  try {
+    const r = await post(CLAIM, { task_ids: [501] });
+    assert.equal(r.status, 409);
+    assert.equal(r.json.error.code, 'session_claim_check_failed');
+    assert.equal(batchCalls, 0);
+  } finally {
+    db.getActiveClaimsForSession = realGet;
+  }
 });
 
 test('POST /claims/batch/release middleware chain is pinned: requireBuilder → handler', () => {
@@ -371,10 +433,11 @@ test('a xenos with a claim in flight is refused by gateNewcomerClaim: 403, and n
   assert.equal(batchCalls, 0, 'claimTasksBatch never ran');
   assert.equal(connects, 0, 'no transaction was opened');
   assert.deepEqual(writes(), []);
-  assert.equal(calls.length, 1, 'only the gate\'s own active-claims read');
+  // The session gate's read (its claim is unbound, so it passes) + the newcomer gate's read.
+  assert.equal(calls.length, 2, 'only the two gates\' own active-claims reads');
 });
 
-test('a thetes with a claim in flight is NOT held by the newcomer gate — and makes no gate lookup', async () => {
+test('a thetes with an unbound claim in flight is NOT held by the newcomer gate — and makes no newcomer lookup', async () => {
   caller = { id: '42', rank: 'thetes' };
   activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task' }];
   let batchCalls = 0;
@@ -382,7 +445,9 @@ test('a thetes with a claim in flight is NOT held by the newcomer gate — and m
   const r = await post(CLAIM, { task_ids: [501] });
   assert.equal(r.status, 201);
   assert.equal(batchCalls, 1);
-  assert.deepEqual(calls, []);
+  // Only the session gate's read, keyed on the session id.
+  assert.equal(calls.length, 1);
+  assert.deepEqual(calls[0].params, ['sess-A']);
 });
 
 // ── POST /claims/batch — each documented error maps to its status and body ────
@@ -440,5 +505,7 @@ test('claim body: empty → 400 task_ids_required, 21 ids → 400, non-numeric
   assert.equal(bad.status, 400);
   assert.equal(bad.json.error.code, 'task_ids_must_be_numbers');
   assert.equal(batchCalls, 0);
-  assert.deepEqual(calls, []);
+  // The session gate runs before body validation (as on POST /claims): reads only.
+  assert.deepEqual(writes(), []);
+  assert.ok(calls.every((c) => /^\s*SELECT/i.test(c.sql)), 'only the session gate\'s reads');
 });

package/tests/copy_desk_page_release.mjs

@@ -184,6 +184,26 @@ try {
     assert.equal(task(7006).status, 'active');
     assert.equal((await lifecyclePort.releaseStuckTweak({ taskId: '7003', builderId: CARL, expectedStatus: 'active' })).outcome, 'round_moved');
   });
+
+  // task 1004976: the whole path, the sweep into the real lifecycle port. An idle
+  // draft expires after one day and its words are still on the task afterwards.
+  await test('an idle draft expires after a day through the real port, and the draft text stays in the record', async () => {
+    const autoClose = require('../modules/copy-desk/auto-close.js');
+    const draftLines = [{ key: 'L0002', section: 'hero', before: 'Build here', after: 'Build it right here', placement: 'placed' }];
+    const draftBlock = pages.composeDraftBlock({ page_id: 'status:explore', reading_hash: 'h', saved_at: '2026-09-19T00:00:00Z', lines: draftLines });
+    const body = `Page tweak round 2 for status:explore.\n\n${draftBlock}`;
+    const now = Date.parse('2026-09-21T00:00:00Z');
+    db.tasks.push({ id: '7010', status: 'ready', title: 'Tweak: Explore', description: body, source: 'page-tweak', source_ref: pages.roundSourceRef('status:explore', 2), touches: [], updated_at: '2026-09-19T23:00:00Z' });
+    db.tasks.push({ id: '7011', status: 'ready', title: 'Tweak: Explore', description: body, source: 'page-tweak', source_ref: pages.roundSourceRef('status:explore', 3), touches: [], updated_at: '2026-09-20T12:00:00Z' });
+    const r = await autoClose.runAutoClose({ now, founder: async () => ({ id: CARL }) });
+    const mine = r.closed.filter((c) => ['7010', '7011'].includes(c.task_id));
+    assert.deepEqual(mine.map((c) => [c.task_id, c.why, c.outcome]), [['7010', 'draft_expired', 'abandoned']], 'the draft touched 12 hours ago stays');
+    assert.equal(task(7010).status, 'abandoned');
+    assert.match(task(7010).value_summary, /^Abandoned: Closed by itself: the draft sat untouched for a day\./);
+    assert.equal(task(7010).description, body, 'the draft is kept: the description is not touched');
+    assert.equal(pages.parseDraftBlock(task(7010).description).ok, true, 'and still parses as the draft');
+    assert.equal(task(7011).status, 'ready');
+  });
 } finally {
   server.close();
   fs.rmSync(tmp, { recursive: true, force: true });

package/tests/copy_stuck_page_tweaks.mjs

@@ -56,7 +56,7 @@ await test('every state has an owner and a deadline: overdue only past it, told
   const approved = pages.composeWordsApprovedBlock({ at: ago(1), by: ARTIST });
   // [state, task shape, owner, days until overdue]
   const table = [
-    ['draft', (id) => ({ status: 'ready', description: desc(id, [draftBlock(id)]) }), 'artist', 7],
+    ['draft', (id) => ({ status: 'ready', description: desc(id, [draftBlock(id)]) }), 'artist', 1], // task 1004976: due when it expires, no reminder first,
     ['writing', () => ({ status: 'active', holder_id: ARTIST, holder_worktree: false }), 'artist', 7],
     ['words_review', (id) => ({ status: 'ready', description: desc(id, [batchBlock(id)]) }), 'artist', 3],
     ['submitted', (id) => ({ status: 'ready', description: desc(id, [batchBlock(id), approved]) }), 'appliers', 3],
@@ -82,7 +82,7 @@ await test('every state has an owner and a deadline: overdue only past it, told
   }
   const draft = status.composePages({ inventory: INVENTORY, readings: null, tasks: [round(51, 'landing:projects', { status: 'ready', description: desc('landing:projects', [draftBlock('landing:projects')]), updated_at: ago(2) })], now: NOW }).in_flight[0];
   assert.equal(Date.parse(draft.expires_at) - Date.parse(draft.since), status.DRAFT_EXPIRES_AFTER, 'a draft says when it expires');
-  assert.equal(status.DRAFT_EXPIRES_AFTER, 14 * D);
+  assert.equal(status.DRAFT_EXPIRES_AFTER, D, 'a draft expires after one day (owner, task 1004971)');
 });
 
 await test('submitted words left unreviewed wait on their artist, not the appliers (task 1004900)', () => {