@bongos/core 1.24.5 → 1.24.7

package/tests/claims_batch_routes.mjs

@@ -341,16 +341,78 @@ function chainFor(path) {
   return layer.route.stack.map((s) => s.handle.name || '<handler>');
 }
 
-test('POST /claims/batch middleware chain is pinned: requireBuilder → gateNewcomerClaim → handler', () => {
-  assert.deepEqual(chainFor('/claims/batch'), ['requireBuilder', 'gateNewcomerClaim', '<handler>']);
+test('POST /claims/batch middleware chain is pinned: requireBuilder → gateOneActiveClaimPerSession → gateNewcomerClaim → handler', () => {
+  assert.deepEqual(chainFor('/claims/batch'),
+    ['requireBuilder', 'gateOneActiveClaimPerSession', 'gateNewcomerClaim', '<handler>']);
 });
 
-test('POST /claims carries the one-claim-per-session gate that POST /claims/batch does not (the documented difference)', () => {
-  const single = chainFor('/claims');
-  assert.ok(single.includes('gateOneActiveClaimPerSession'));
-  assert.ok(single.includes('gateNewcomerClaim'));
-  assert.ok(!chainFor('/claims/batch').includes('gateOneActiveClaimPerSession'),
-    'if batch claim gains the session gate, update this pin (task 1005005 asks whether it should)');
+// task 1005005 (found by task 1004983): the batch route used to skip the
+// session gate. Both routes now run the SAME middleware function, in the same
+// order — one check, never a second copy of it.
+test('POST /claims and POST /claims/batch run the identical gate functions in the identical order', () => {
+  const gates = (p) => router.stack.find((l) => l.route && l.route.path === p && l.route.methods.post)
+    .route.stack.slice(0, -1).map((s) => s.handle);
+  const single = gates('/claims');
+  const batch = gates('/claims/batch');
+  assert.equal(batch.length, single.length);
+  single.forEach((fn, i) => assert.equal(batch[i], fn, `gate ${i} (${fn.name}) is the same function on both routes`));
+});
+
+// ── POST /claims/batch — the one-claim-per-session gate ──────────────────────
+
+test('a thetes session already holding a claim in this tree is refused 409 session_already_has_active_claim; nothing claimed', async () => {
+  caller = { id: '42', rank: 'thetes' };
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-A', worktree_name: 'wt', requested_worktree_name: 'wt' }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501, 502], worktree_name: 'wt' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'session_already_has_active_claim');
+  assert.equal(r.json.error.details.active_task_id, '700');
+  assert.equal(batchCalls, 0, 'claimTasksBatch never ran');
+  assert.equal(connects, 0, 'no transaction was opened');
+  assert.deepEqual(writes(), []);
+});
+
+test('the same session in a DIFFERENT tree may batch-claim (one claim per tree, as on POST /claims)', async () => {
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-A', worktree_name: 'other', requested_worktree_name: 'other' }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501], worktree_name: 'wt' });
+  assert.equal(r.status, 201);
+  assert.equal(batchCalls, 1);
+});
+
+test('a claim held by ANOTHER session in the same tree does not refuse this session', async () => {
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-Z', worktree_name: 'wt', requested_worktree_name: 'wt' }];
+  db.claimTasksBatch = async () => ({ claims: [] });
+  const r = await post(CLAIM, { task_ids: [501], worktree_name: 'wt' });
+  assert.equal(r.status, 201);
+});
+
+test('bind_session:false (the hall) has no session to scope to: no session lookup, claim proceeds', async () => {
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task', creator_session_id: 'sess-A', worktree_name: null, requested_worktree_name: null }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501, 502], bind_session: false });
+  assert.equal(r.status, 201);
+  assert.equal(batchCalls, 1);
+  assert.deepEqual(calls, []);
+});
+
+test('the session lookup failing refuses the batch (fail closed), nothing claimed', async () => {
+  const realGet = db.getActiveClaimsForSession;
+  db.getActiveClaimsForSession = async () => { throw new Error('db down'); };
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  try {
+    const r = await post(CLAIM, { task_ids: [501] });
+    assert.equal(r.status, 409);
+    assert.equal(r.json.error.code, 'session_claim_check_failed');
+    assert.equal(batchCalls, 0);
+  } finally {
+    db.getActiveClaimsForSession = realGet;
+  }
 });
 
 test('POST /claims/batch/release middleware chain is pinned: requireBuilder → handler', () => {
@@ -371,10 +433,11 @@ test('a xenos with a claim in flight is refused by gateNewcomerClaim: 403, and n
   assert.equal(batchCalls, 0, 'claimTasksBatch never ran');
   assert.equal(connects, 0, 'no transaction was opened');
   assert.deepEqual(writes(), []);
-  assert.equal(calls.length, 1, 'only the gate\'s own active-claims read');
+  // The session gate's read (its claim is unbound, so it passes) + the newcomer gate's read.
+  assert.equal(calls.length, 2, 'only the two gates\' own active-claims reads');
 });
 
-test('a thetes with a claim in flight is NOT held by the newcomer gate — and makes no gate lookup', async () => {
+test('a thetes with an unbound claim in flight is NOT held by the newcomer gate — and makes no newcomer lookup', async () => {
   caller = { id: '42', rank: 'thetes' };
   activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task' }];
   let batchCalls = 0;
@@ -382,7 +445,9 @@ test('a thetes with a claim in flight is NOT held by the newcomer gate — and m
   const r = await post(CLAIM, { task_ids: [501] });
   assert.equal(r.status, 201);
   assert.equal(batchCalls, 1);
-  assert.deepEqual(calls, []);
+  // Only the session gate's read, keyed on the session id.
+  assert.equal(calls.length, 1);
+  assert.deepEqual(calls[0].params, ['sess-A']);
 });
 
 // ── POST /claims/batch — each documented error maps to its status and body ────
@@ -440,5 +505,7 @@ test('claim body: empty → 400 task_ids_required, 21 ids → 400, non-numeric
   assert.equal(bad.status, 400);
   assert.equal(bad.json.error.code, 'task_ids_must_be_numbers');
   assert.equal(batchCalls, 0);
-  assert.deepEqual(calls, []);
+  // The session gate runs before body validation (as on POST /claims): reads only.
+  assert.deepEqual(writes(), []);
+  assert.ok(calls.every((c) => /^\s*SELECT/i.test(c.sql)), 'only the session gate\'s reads');
 });

package/tests/copy_desk_page_release.mjs

@@ -184,6 +184,26 @@ try {
     assert.equal(task(7006).status, 'active');
     assert.equal((await lifecyclePort.releaseStuckTweak({ taskId: '7003', builderId: CARL, expectedStatus: 'active' })).outcome, 'round_moved');
   });
+
+  // task 1004976: the whole path, the sweep into the real lifecycle port. An idle
+  // draft expires after one day and its words are still on the task afterwards.
+  await test('an idle draft expires after a day through the real port, and the draft text stays in the record', async () => {
+    const autoClose = require('../modules/copy-desk/auto-close.js');
+    const draftLines = [{ key: 'L0002', section: 'hero', before: 'Build here', after: 'Build it right here', placement: 'placed' }];
+    const draftBlock = pages.composeDraftBlock({ page_id: 'status:explore', reading_hash: 'h', saved_at: '2026-09-19T00:00:00Z', lines: draftLines });
+    const body = `Page tweak round 2 for status:explore.\n\n${draftBlock}`;
+    const now = Date.parse('2026-09-21T00:00:00Z');
+    db.tasks.push({ id: '7010', status: 'ready', title: 'Tweak: Explore', description: body, source: 'page-tweak', source_ref: pages.roundSourceRef('status:explore', 2), touches: [], updated_at: '2026-09-19T23:00:00Z' });
+    db.tasks.push({ id: '7011', status: 'ready', title: 'Tweak: Explore', description: body, source: 'page-tweak', source_ref: pages.roundSourceRef('status:explore', 3), touches: [], updated_at: '2026-09-20T12:00:00Z' });
+    const r = await autoClose.runAutoClose({ now, founder: async () => ({ id: CARL }) });
+    const mine = r.closed.filter((c) => ['7010', '7011'].includes(c.task_id));
+    assert.deepEqual(mine.map((c) => [c.task_id, c.why, c.outcome]), [['7010', 'draft_expired', 'abandoned']], 'the draft touched 12 hours ago stays');
+    assert.equal(task(7010).status, 'abandoned');
+    assert.match(task(7010).value_summary, /^Abandoned: Closed by itself: the draft sat untouched for a day\./);
+    assert.equal(task(7010).description, body, 'the draft is kept: the description is not touched');
+    assert.equal(pages.parseDraftBlock(task(7010).description).ok, true, 'and still parses as the draft');
+    assert.equal(task(7011).status, 'ready');
+  });
 } finally {
   server.close();
   fs.rmSync(tmp, { recursive: true, force: true });

package/tests/copy_stuck_page_tweaks.mjs

@@ -56,7 +56,7 @@ await test('every state has an owner and a deadline: overdue only past it, told
   const approved = pages.composeWordsApprovedBlock({ at: ago(1), by: ARTIST });
   // [state, task shape, owner, days until overdue]
   const table = [
-    ['draft', (id) => ({ status: 'ready', description: desc(id, [draftBlock(id)]) }), 'artist', 7],
+    ['draft', (id) => ({ status: 'ready', description: desc(id, [draftBlock(id)]) }), 'artist', 1], // task 1004976: due when it expires, no reminder first,
     ['writing', () => ({ status: 'active', holder_id: ARTIST, holder_worktree: false }), 'artist', 7],
     ['words_review', (id) => ({ status: 'ready', description: desc(id, [batchBlock(id)]) }), 'artist', 3],
     ['submitted', (id) => ({ status: 'ready', description: desc(id, [batchBlock(id), approved]) }), 'appliers', 3],
@@ -82,7 +82,7 @@ await test('every state has an owner and a deadline: overdue only past it, told
   }
   const draft = status.composePages({ inventory: INVENTORY, readings: null, tasks: [round(51, 'landing:projects', { status: 'ready', description: desc('landing:projects', [draftBlock('landing:projects')]), updated_at: ago(2) })], now: NOW }).in_flight[0];
   assert.equal(Date.parse(draft.expires_at) - Date.parse(draft.since), status.DRAFT_EXPIRES_AFTER, 'a draft says when it expires');
-  assert.equal(status.DRAFT_EXPIRES_AFTER, 14 * D);
+  assert.equal(status.DRAFT_EXPIRES_AFTER, D, 'a draft expires after one day (owner, task 1004971)');
 });
 
 await test('submitted words left unreviewed wait on their artist, not the appliers (task 1004900)', () => {

package/tests/credit_log_no_spend_db.mjs

@@ -0,0 +1,160 @@
+// tests/credit_log_no_spend_db.mjs — task 1004988 (goal 1000092; ADR 0385
+// decision 2, ADR 0387). Real DB.
+//
+// Builds credit_log in a throwaway schema, applies the REAL migration
+// (migrations/core_286_credit_log_no_spend.sql), and proves the DATABASE refuses a row that spends,
+// redeems or transfers credits, while every existing reversal path still books:
+//
+//   - task.confirmed_reversal — the only reversal path that exists today: the
+//     ADR 0120 clawback, migrations/core_194_confirmed_backlog_clawback.sql. It is
+//     re-run here, verbatim, AFTER the trigger, exactly as the integration suite's
+//     clawback_confirmed_backlog test re-runs it on a fully migrated database.
+//   - reversal:<id> — the general shape the trigger defines for any future one.
+//
+// modules/economy itself writes no negative row today (every writer there books
+// earnings, and the descent and idea writers drop a non-positive delta), so the
+// economy writers are covered by the "positive and zero rows are untouched"
+// cases rather than by a reversal of their own.
+//
+// The probe the task asks for is built in: the last block DROPS the trigger and
+// shows the same spend row is then admitted, so a test that kept passing without
+// the trigger would fail that block.
+//
+// Self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=... node tests/credit_log_no_spend_db.mjs
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const here = dirname(fileURLToPath(import.meta.url));
+const MIGRATION = 'core_286_credit_log_no_spend.sql';
+
+const pgPool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try { client = await pgPool.connect(); } catch (e) {
+  console.log(`credit_log_no_spend_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pgPool.end().catch(() => {});
+  process.exit(0);
+}
+const SCHEMA = `t1004988_${process.pid}`;
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+const refused = async (sql, params, m) => {
+  await client.query('SAVEPOINT s');
+  let err = null;
+  try { await client.query(sql, params); } catch (e) { err = e; }
+  await client.query('ROLLBACK TO SAVEPOINT s');
+  ok(err && err.code === '23514', `${m}${err ? '' : ' (it was admitted)'}`);
+};
+const ins = (builder, task, delta, reason) => client.query(
+  'INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES ($1, $2, $3, $4) RETURNING id',
+  [builder, task, delta, reason],
+).then((r) => r.rows[0].id);
+const balance = async (b) => Number((await client.query('SELECT total_credits FROM builders WHERE id = $1', [b])).rows[0].total_credits);
+
+try {
+  await client.query(`CREATE SCHEMA ${SCHEMA}`);
+  await client.query(`SET search_path TO ${SCHEMA}`);
+  // The columns credit_log and its balance trigger carry (migrations/003_pms.sql
+  // plus the later description/session columns), and the task columns core_194
+  // reads and writes.
+  await client.query(`CREATE TABLE builders (id bigserial PRIMARY KEY, total_credits integer NOT NULL DEFAULT 0)`);
+  await client.query(`CREATE TABLE tasks (id bigserial PRIMARY KEY, status text NOT NULL,
+    needs_rebase boolean NOT NULL DEFAULT false, needs_rebase_reason text, needs_rebase_at timestamptz, updated_at timestamptz)`);
+  await client.query(`CREATE TABLE credit_log (id bigserial PRIMARY KEY, builder_id bigint NOT NULL REFERENCES builders(id),
+    task_id bigint REFERENCES tasks(id), delta integer NOT NULL, reason text NOT NULL, description text,
+    session_id text, recorded_at timestamptz NOT NULL DEFAULT now())`);
+  await client.query(`CREATE FUNCTION pms_apply_credit() RETURNS trigger AS $$
+    BEGIN UPDATE builders SET total_credits = total_credits + NEW.delta WHERE id = NEW.builder_id; RETURN NEW; END;
+    $$ LANGUAGE plpgsql`);
+  await client.query('CREATE TRIGGER trg_credit_log_apply AFTER INSERT ON credit_log FOR EACH ROW EXECUTE FUNCTION pms_apply_credit()');
+  await client.query(readFileSync(join(here, '..', 'migrations', MIGRATION), 'utf8'));
+
+  await client.query('INSERT INTO builders DEFAULT VALUES'); // 1
+  await client.query('INSERT INTO builders DEFAULT VALUES'); // 2
+  await client.query('INSERT INTO builders DEFAULT VALUES'); // 3
+  await client.query("INSERT INTO tasks (status) VALUES ('confirmed'), ('shipped')"); // 1, 2
+  await client.query('BEGIN');
+
+  // Earning and audit rows are untouched.
+  const earned = await ins(1, 2, 30, 'task.shipped');
+  await ins(1, null, 12, 'session.token_reward');
+  await ins(1, null, 0, 'rank_change');
+  ok(await balance(1) === 42, 'positive and zero rows book as before');
+  // Every reason the economy writers book today (modules/economy/credits.js and
+  // achievements.js). All are positive; none may be caught by the spend names.
+  const ECONOMY_REASONS = [
+    'task.shipped', 'task.confirmed', 'session.token_reward', 'idea_promotion_bonus',
+    'ship.net_negative', 'tweak.page_approved:2', 'idea.credit.task_ship:7:2',
+    'idea.credit.full_pass:7', 'idea.credit.governance_pass:7', 'achievement.first-ship',
+  ];
+  for (const reason of ECONOMY_REASONS) await ins(3, null, 1, reason);
+  ok(await balance(3) === ECONOMY_REASONS.length, `every economy writer's reason still books (${ECONOMY_REASONS.join(', ')})`);
+
+  // Spend, redemption, transfer: refused.
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['spend'], 'a raw negative spend row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['redemption'], 'a raw negative redemption row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['module.purchase'], 'any other negative row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, NULL, 5, $1)', ['transfer.in'], 'the positive half of a transfer is refused too');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, 0, $1)', ['redemption'], 'a zero-value redemption row is refused');
+  ok(await balance(1) === 42, 'no refused row moved the balance');
+  // The refused names match as whole words, so a reason that only starts with
+  // the letters still books.
+  await ins(3, null, 1, 'achievement.spender-of-the-month');
+  await ins(3, null, 1, 'spender-of-the-month');
+  ok(await balance(3) === ECONOMY_REASONS.length + 2, 'a reason that merely starts with "spend" is not refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, 1, $1)', ['spend:7'], 'spend:<x> is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, 1, $1)', ['Transfer-out'], 'and the match ignores case');
+
+  // reversal:<id> — exists, same builder, positive, never more than booked.
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -5, $1)', ['reversal:999999'], 'a reversal naming no row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, NULL, -5, $1)', [`reversal:${earned}`], 'a reversal of another builder\'s row is refused');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -31, $1)', [`reversal:${earned}`], 'a reversal larger than the row is refused');
+  await ins(1, 2, -20, `reversal:${earned}`);
+  await ins(1, 2, -10, `reversal:${earned}`);
+  ok(await balance(1) === 12, 'reversal:<id> books, in parts, up to the whole row');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -1, $1)', [`reversal:${earned}`], 'a reversal past the row\'s total is refused');
+  const audit = (await client.query("SELECT id FROM credit_log WHERE reason = 'rank_change'")).rows[0].id;
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (1, NULL, -1, $1)', [`reversal:${audit}`], 'a zero row cannot be reversed');
+
+  // task.confirmed_reversal — the ADR 0120 clawback, re-run verbatim.
+  await ins(2, 1, 15, 'task.confirmed');
+  const core194 = readFileSync(join(here, '..', 'migrations', 'core_194_confirmed_backlog_clawback.sql'), 'utf8')
+    .replace(/^\s*(BEGIN|COMMIT);\s*$/gim, ''); // already inside this test's transaction
+  await client.query(core194);
+  ok(await balance(2) === 0, 'core_194 (task.confirmed_reversal) still reverses a confirmed task\'s credit');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, 1, -1, $1)', ['task.confirmed_reversal'], 'that reversal cannot go past what was booked');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, 2, -1, $1)', ['task.confirmed_reversal'], 'nor reverse a task that booked nothing');
+  await refused('INSERT INTO credit_log (builder_id, task_id, delta, reason) VALUES (2, NULL, -1, $1)', ['task.confirmed_reversal'], 'nor run without a task');
+
+  // Existing rows are never rewritten: the trigger is INSERT-only.
+  const { rows: trig } = await client.query(
+    "SELECT tgtype FROM pg_trigger WHERE tgname = 'trg_credit_log_refuse_spend' AND tgrelid = 'credit_log'::regclass");
+  // tgtype bits: 1 ROW, 2 BEFORE, 4 INSERT, 8 DELETE, 16 UPDATE.
+  ok(trig.length === 1 && (trig[0].tgtype & 2) && (trig[0].tgtype & 4) && !(trig[0].tgtype & 24), 'the trigger is BEFORE INSERT only');
+  const { rows: idx } = await client.query(
+    "SELECT pg_get_indexdef(indexrelid) AS def FROM pg_index WHERE indexrelid = 'idx_credit_log_reversals'::regclass");
+  ok(idx.length === 1 && /\(builder_id, reason\) WHERE \(delta < 0\)/.test(idx[0].def),
+    'the reversal sums read a partial index of negative rows only, not the whole ledger');
+  const { rows: cmt } = await client.query(`SELECT col_description('credit_log'::regclass,
+       (SELECT attnum FROM pg_attribute WHERE attrelid = 'credit_log'::regclass AND attname = 'delta')) AS d,
+     obj_description('credit_log'::regclass) AS t`);
+  ok(!/redemption|spent \(future\)/i.test(`${cmt[0].d} ${cmt[0].t}`), 'the comments no longer offer redemption or a future spend');
+
+  // The probe: without the trigger the same spend row is admitted.
+  await client.query('DROP TRIGGER trg_credit_log_refuse_spend ON credit_log');
+  await ins(1, null, -5, 'spend');
+  ok(await balance(1) === 7, 'probe: with the trigger dropped, the spend row books — the trigger is what refuses it');
+
+  await client.query('ROLLBACK');
+  console.log(`credit_log_no_spend_db: ${pass} passed`);
+} finally {
+  await client.query('ROLLBACK').catch(() => {});
+  await client.query('SET search_path TO public').catch(() => {});
+  await client.query(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pgPool.end();
+}

package/tests/effective_visibility_predicate.mjs

@@ -172,6 +172,14 @@ const NON_PUBLIC_READS = [
     fn: 'listLoginsForPerson',
     why: 'the own-scope read behind GET /me/sign-in-methods (task 1004992): which ways in the signed-in person has, keyed on their authenticated key only. It returns their own providers and addresses to themselves; a private account must still see its own sign-in methods.',
   },
+  {
+    fn: 'linkLogin',
+    why: 'linking a second way in (task 1004995): finds the signed-in person\'s own account row by their authenticated key to attach the login to. It returns only linked/refused to that person; a private account must still be able to link.',
+  },
+  {
+    fn: 'unlinkLogin',
+    why: 'removing a way in (task 1004995): locks the signed-in person\'s own logins by their authenticated key to count them. It returns only unlinked/refused to that person; a private account must still be able to unlink.',
+  },
   {
     fn: 'hiddenGithubIds',
     why: 'the closeness-graph consent gate — it answers only "which of these accounts set hide_stats", the OPPOSITE question to visibility. Its callers are requireBuilder-gated and it must stay fail-closed on hide alone (ADR 0171 D4); joining addressability would silently empty the graph of every private account for readers who are allowed to see the edge.',

package/tests/hub_account_page.mjs

@@ -83,8 +83,8 @@ test('the script builds no markup from strings, and the controls are real markup
 
 test('the door returns here, and the page calls only its own-scoped routes', () => {
   assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account&repos=1"/, 'sign-in lands back on /account, asking for repo access once (task 1004549)');
-  const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
-  assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile', 'GET /my-projects', 'POST /my-projects/', 'GET /me/guilds'].sort());
+  const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST|DELETE)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
+  assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile', 'GET /my-projects', 'POST /my-projects/', 'GET /me/guilds', 'GET /me/sign-in-methods', 'DELETE /me/sign-in-methods/'].sort());
   // the bar's two calls live in the shared asset: the identity read and sign out
   const barCalls = [...BAR.matchAll(/fetch\(API \+ '([^']+)', \{ method: '(GET|POST)'/g)].map((m) => `${m[2]} ${m[1]}`);
   assert.deepEqual(barCalls.sort(), ['GET /me', 'POST /auth/logout']);
@@ -183,7 +183,7 @@ const ACCOUNT = () => ({
 // A DOM stub just wide enough for this page: every id in the markup is an
 // element (hidden where the markup says so), every radio and link input is
 // addressable by the selectors the script uses, and fetch answers from a handler.
-function boot(answer) {
+function boot(answer, { search = '' } = {}) {
   const els = new Map();
   const listeners = (o) => { o._on = {}; o.addEventListener = (t, f) => { (o._on[t] ||= []).push(f); }; return o; };
   // textContent reads the node's own text plus its children's, and setting it
@@ -299,7 +299,7 @@ function boot(answer) {
   };
   const location = { hostname: 'cloudbongos.com', pathname: '/account' };
   // one global, as in the browser: hub-bar.js sets window.HubBar, then the page reads it
-  const ctx = vm.createContext({ document, fetch, location, window: { location: { assign(p) { dom.assigned = p; } } }, URL, Array, Object, JSON, Promise });
+  const ctx = vm.createContext({ document, fetch, location, window: { location: { search, assign(p) { dom.assigned = p; } } }, URL, Array, Object, JSON, Promise });
   vm.runInContext(BAR, ctx);
   vm.runInContext(SCRIPT, ctx);
   return dom;
@@ -498,7 +498,7 @@ test('the section ships inside the signed-in body, last, as a list with an empty
 test('signed in: the list is read once, after the account, and each row names its project and host with its own Leave', async () => {
   const dom = boot(building(BUILDING));
   await settle();
-  assert.deepEqual(dom.calls.filter((c) => c.method === 'GET' && c.path !== '/me').map((c) => c.path), ['/me/cross-project', '/my-projects', '/me/guilds']);
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'GET' && c.path !== '/me').map((c) => c.path), ['/me/cross-project', '/my-projects', '/me/guilds', '/me/sign-in-methods']);
   assert.equal(dom.els.get('buildingLoading').hidden, true);
   assert.equal(dom.els.get('buildingEmpty').hidden, true);
   const rows = rowsOf(dom);
@@ -857,3 +857,89 @@ test('the hall trusts only a bare https hub origin (OTB.hubOrigin, shared by Set
   assert.equal(origin('https://cloudbongos.com/account'), null, 'a value with a path is not an origin');
   assert.equal(origin('https://user@cloudbongos.com'), null);
 });
+
+// ── ways to sign in (task 1004995) ───────────────────────────────────────────
+// Link is a link to the sign-in routes; their answer comes back in the address.
+// A way in the server says cannot be removed shows why, never a Remove.
+
+const WAYS = (methods) => (m, p) => {
+  if (m === 'GET' && p === '/me/cross-project') return { status: 200, data: ACCOUNT() };
+  if (m === 'GET' && p === '/me/sign-in-methods') return { status: 200, data: { methods, providers: ['github', 'google'] } };
+  if (m === 'DELETE' && p === '/me/sign-in-methods/google') return { status: 200, data: { ok: true } };
+  if (m === 'DELETE' && p === '/me/sign-in-methods/github') return { status: 409, data: { error: { code: 'last_way_in', message: 'this is your only way in, so it cannot be removed — link another first' } } };
+  return { status: 500, data: null };
+};
+const waysOf = (dom) => dom.els.get('waysList').children;
+const actionOf = (row) => row.children[1].children[0];
+
+test('the ways section sits in the signed-in body with its list and status line', () => {
+  const body = PAGE.split('<div id="acctBody" hidden>')[1].split('</main>')[0];
+  const sec = (body.match(/<section class="aSec" id="aWaysIn" aria-labelledby="aWaysIn-h">[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(sec, 'ways to sign in is a section of the account body (the link routes land on #aWaysIn)');
+  assert.match(sec, /<ul class="mineRows" id="waysList"><\/ul>/);
+  assert.match(sec, /Linking never joins two accounts\./, 'the page says the no-merge rule up front');
+});
+
+test('one row per provider: a held way in shows its address and Remove; a missing one links to its sign-in', async () => {
+  const dom = boot(WAYS([
+    { provider: 'github', email: null, unlink_refused: 'born_with' },
+  ]));
+  await settle();
+  const rows = waysOf(dom);
+  assert.equal(rows.length, 2);
+  assert.equal(rows[0].children[0].children[0].textContent, 'GitHub');
+  assert.equal(rows[0].children[0].children[1].textContent, 'linked', 'no address shown → linked');
+  assert.equal(rows[0].children[0].children[2].textContent, 'Your account was made with GitHub, so GitHub stays linked.');
+  assert.equal(rows[0].children[1].children.length, 0, 'no Remove for a way in the server keeps');
+  assert.equal(rows[1].children[0].children[1].textContent, 'not linked');
+  assert.equal(actionOf(rows[1]).textContent, 'Link Google');
+  assert.equal(actionOf(rows[1]).href, '/api/bongos/auth/google/start?link=1');
+});
+
+test('Link GitHub goes to the GitHub link route; the only way in says why it stays', async () => {
+  const dom = boot(WAYS([{ provider: 'google', email: 'ana@example.com', unlink_refused: 'last_way_in' }]));
+  await settle();
+  const [gh, goo] = waysOf(dom);
+  assert.equal(actionOf(gh).href, '/api/bongos/auth/link/github/start');
+  assert.equal(goo.children[0].children[1].textContent, 'ana@example.com');
+  assert.match(goo.children[0].children[2].textContent, /^Your only way in, so it stays\./);
+});
+
+test('Remove sends one DELETE, says so, and re-reads the list', async () => {
+  const dom = boot(WAYS([
+    { provider: 'github', email: null, unlink_refused: null },
+    { provider: 'google', email: 'ana@example.com', unlink_refused: null },
+  ]));
+  await settle();
+  const google = waysOf(dom)[1];
+  dom.click(actionOf(google));
+  assert.equal(actionOf(google).textContent, 'Removing…');
+  await settle();
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'DELETE').map((c) => c.path), ['/me/sign-in-methods/google']);
+  assert.equal(dom.text('waysMsg'), 'Google is removed. It no longer opens this account.');
+  assert.equal(dom.calls.filter((c) => c.path === '/me/sign-in-methods' && c.method === 'GET').length, 2);
+});
+
+test('a refused Remove is said in the server’s words and keeps the button', async () => {
+  const dom = boot(WAYS([
+    { provider: 'github', email: null, unlink_refused: null },
+    { provider: 'google', email: null, unlink_refused: null },
+  ]));
+  await settle();
+  const gh = waysOf(dom)[0];
+  dom.click(actionOf(gh));
+  await settle();
+  assert.equal(dom.text('waysMsg'), 'This is your only way in, so it cannot be removed — link another first.');
+  assert.equal(actionOf(gh).disabled, false);
+  assert.equal(actionOf(gh).textContent, 'Remove');
+});
+
+test('a link’s answer is said plainly: linked, already its own account (never merged), cancelled', async () => {
+  const say = async (search) => { const d = boot(WAYS([]), { search }); await settle(); return [d.text('waysMsg'), d.els.get('waysMsg').className]; };
+  assert.deepEqual(await say('?linked=google'), ['Google is linked. You can now sign in with either.', 'projMsg ok']);
+  const [taken, cls] = await say('?link_refused=taken&provider=github');
+  assert.match(taken, /^That GitHub account already has its own account here, so it was not linked\. We never join two accounts; nothing changed\.$/);
+  assert.equal(cls, 'projMsg err');
+  assert.match((await say('?link_refused=cancelled&provider=google'))[0], /^You cancelled linking Google\. Nothing changed\.$/);
+  assert.match((await say('?link_refused=whatever&provider=google'))[0], /^Couldn’t link Google\. Try again\.$/);
+});

package/tests/project_settings_page.mjs

@@ -65,9 +65,11 @@ function buildRouterWithStubs({ timer, categories, reward = WORKING_REWARD }) {
     list: gc.listCategories,
     set: api.projectSettings.set,
     resolveShipMode: api.projectSettings.resolveShipMode,
+    resolveTweak: api.projectSettings.resolveTweakAutopickup,
   };
   api.resolveRotDays = async () => timer;
   api.projectSettings.resolveShipMode = async () => ({ mode: 'auto', source: 'default', chosen: false, invalid: null });
+  api.projectSettings.resolveTweakAutopickup = async () => ({ mode: 'off', cap: 200, rank_caps: {}, source: { mode: 'default', cap: 'default', rank_caps: 'default' }, invalid: [] });
   // reward: WORKING_REWARD (default) | null (port absent) | 'throws' (rewardConfig raises).
   const rewardPort = reward === 'throws'
     ? { rewardConfig: () => { throw new Error('reward boom'); } }
@@ -84,6 +86,7 @@ function buildRouterWithStubs({ timer, categories, reward = WORKING_REWARD }) {
     gc.listCategories = saved.list;
     api.projectSettings.set = saved.set;
     api.projectSettings.resolveShipMode = saved.resolveShipMode;
+    api.projectSettings.resolveTweakAutopickup = saved.resolveTweak;
   };
   // The handler is the LAST layer on the matching route (requireBuilder and the
   // permission gate sit in front); calling it directly is what keeps this a unit test
@@ -103,22 +106,22 @@ const CATS = [
   { id: 2, slug: 'retired-thing', label: 'Retired thing', sort_order: 20, active: false },
 ];
 
-test('one read returns all six fundamentals, each naming where its value came from', async () => {
+test('one read returns all seven fundamentals, each naming where its value came from', async () => {
   const { handlerFor, restore } = buildRouterWithStubs({ timer: TIMER_OK, categories: CATS });
   try {
     const res = fakeRes();
     await handlerFor('get', '/project-settings')({ query: {} }, res);
     const rows = res.payload.rows;
-    assert.equal(rows.length, 6, 'the page draws six rows, so the read returns six');
+    assert.equal(rows.length, 7, 'the page draws seven rows, so the read returns seven');
     assert.deepEqual(rows.map((r) => r.key),
-      ['ship_mode', 'rot_timer', 'work_categories', 'credit_calculation', 'equity_calculation', 'upmarket_percent']);
+      ['ship_mode', 'tweak_round_cap', 'rot_timer', 'work_categories', 'credit_calculation', 'equity_calculation', 'upmarket_percent']);
     // Provenance is the point of the page: every row says where its value came from.
     for (const r of rows) {
       assert.ok(r.reads && r.reads.file, `${r.key} names no file`);
       assert.ok(r.sentence && r.sentence.length > 20, `${r.key} has no readable sentence`);
     }
-    // Three knobs: the criterion's two, plus ship mode (task 1004628).
-    assert.deepEqual(rows.filter((r) => r.editable).map((r) => r.key), ['ship_mode', 'rot_timer', 'work_categories']);
+    // Four knobs: the criterion's two, ship mode (task 1004628) and the monthly tweak-round cap (task 1005003).
+    assert.deepEqual(rows.filter((r) => r.editable).map((r) => r.key), ['ship_mode', 'tweak_round_cap', 'rot_timer', 'work_categories']);
     // A no-store receipt: a cached settings read is wrong the moment a knob turns.
     assert.equal(res.headers['Cache-Control'], 'no-store');
   } finally { restore(); }