@omega.js/backend 0.1.0

package/test/boot/emulator-port-preflight.test.js

@@ -0,0 +1,126 @@
+/**
+ * The emulator boot's port handling ([#332](https://github.com/Omega-JS-Stack/omega/issues/332)):
+ *
+ *   1. The sweeps map a port to a pid with `lsof`, which stats every mounted
+ *      filesystem before it answers (seconds per call against an smbfs Time
+ *      Machine volume) and used to run once per port whether or not anything
+ *      was listening. A free port cannot have a holder, so the lookup is now
+ *      gated behind a bind probe and only a HELD port is ever looked up.
+ *   2. A boot whose plan cannot work says so before it spawns firebase,
+ *      naming the ports somebody else holds, instead of stalling until the
+ *      ready deadline expires.
+ */
+
+const net = require('net');
+const os = require('os');
+const EmulatorCommand = require('../../dist/cli/commands/emulator.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+// A command instance needs nothing from the project to sweep ports.
+function makeCommand() {
+  const command = new EmulatorCommand({ firebaseProjectPath: os.tmpdir(), argv: {}, options: {} });
+  command.log = () => {};
+  return command;
+}
+
+module.exports = defineCases({
+  description: 'Emulator port preflight and the gated port sweep (#332)',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'the-shutdown-sweep-is-gated-the-same-way',
+      async run({ assert }) {
+        const command = makeCommand();
+        const lookedUp = [];
+
+        await command.terminateOrphanedEmulatorProcesses({ functions: 5001, firestore: 8080, https: 5002 }, {
+          sweepShared: true,
+          isFree: async (port) => port !== 4400,
+          listPids: (port) => {
+            lookedUp.push(port);
+            return [];
+          },
+        });
+
+        assert.deepEqual(lookedUp, [4400], 'the shared hub port was the only one held, so it was the only lookup');
+      },
+    },
+    {
+      name: 'held-ports-are-the-only-ones-the-probe-reports',
+      async run({ assert }) {
+        const held = await EmulatorCommand.heldPorts([5001, 8080, 5001], async (port) => port === 5001);
+
+        assert.deepEqual(held, [8080], 'free ports drop out and duplicates collapse');
+        assert.deepEqual(await EmulatorCommand.heldPorts([5001, 8080], async () => true), [], 'an all-clear sweep has nothing to look up');
+      },
+    },
+    {
+      name: 'the-plan-is-every-port-the-child-will-bind-with-the-resolved-values-winning',
+      async run({ assert }) {
+        const planned = EmulatorCommand.plannedEmulatorPorts(
+          { auth: 9099, functions: 5001, eventarc: 9299, ui: 4050 },
+          { auth: 9100, functions: 5001, https: 5002 },
+        );
+
+        assert.deepEqual(planned, [
+          { name: 'auth', port: 9100 },
+          { name: 'functions', port: 5001 },
+          { name: 'eventarc', port: 9299 },
+          { name: 'ui', port: 4050 },
+        ], 'a bumped port replaces its declared value, an unmanaged declared port stays, and https (this process own proxy) is out');
+      },
+    },
+    {
+      name: 'a-held-port-fails-the-boot-with-a-report-naming-it',
+      async run({ assert }) {
+        const planned = [{ name: 'auth', port: 9099 }, { name: 'pubsub', port: 8085 }];
+        let threw = null;
+
+        try {
+          await EmulatorCommand.assertPlannedPortsFree(planned, async (port) => port !== 8085);
+        } catch (error) {
+          threw = error;
+        }
+
+        assert.ok(threw, 'a held port must stop the boot instead of stalling until the ready deadline');
+        assert.match(threw.message, /8085/, 'the report names the held port');
+        assert.match(threw.message, /pubsub/, 'the report names the emulator that wanted it');
+        assert.ok(!/9099/.test(threw.message), 'a free port is not reported as a blocker');
+        assert.match(threw.message, /omega dev/, 'the report says which other dev stack to stop');
+      },
+    },
+    {
+      name: 'an-all-clear-plan-proceeds',
+      async run({ assert }) {
+        const planned = [{ name: 'auth', port: 9099 }, { name: 'pubsub', port: 8085 }];
+        let threw = null;
+
+        try {
+          await EmulatorCommand.assertPlannedPortsFree(planned, async () => true);
+        } catch (error) {
+          threw = error;
+        }
+
+        assert.equal(threw, null, 'nothing holds a planned port, so the boot proceeds');
+      },
+    },
+    {
+      name: 'the-emulator-running-check-reads-a-real-listener-without-shelling-out',
+      async run({ assert }) {
+        const server = net.createServer();
+        const port = await new Promise((resolve) => {
+          server.listen(0, '127.0.0.1', () => resolve(server.address().port));
+        });
+
+        const command = makeCommand();
+
+        assert.equal(await command.isPortInUse(port), true, 'a live listener reads as in use');
+
+        await new Promise((resolve) => server.close(resolve));
+
+        assert.equal(await command.isPortInUse(port), false, 'the released port reads as free');
+      },
+    },
+  ],
+});

package/test/boot/emulator-ready-timeout.test.js

@@ -0,0 +1,46 @@
+/**
+ * The emulator ready deadline ([#332](https://github.com/Omega-JS-Stack/omega/issues/332)):
+ * a real boot can take past 60s when the port sweep stalls (lsof against a
+ * network mount), so the cap is env-tunable with a default that absorbs a slow
+ * boot. A junk value fails loudly instead of silently racing an unknown
+ * deadline (the #211 junk-multiplier precedent).
+ */
+
+const EmulatorCommand = require('../../dist/cli/commands/emulator.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  description: 'Emulator ready deadline — env-tunable, junk fails loudly (#332)',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'ready-timeout-defaults-high-enough-to-absorb-a-slow-port-sweep',
+      async run({ assert }) {
+        assert.equal(EmulatorCommand.resolveReadyTimeout(undefined), 180000, 'no override reads the default');
+        assert.equal(EmulatorCommand.resolveReadyTimeout(''), 180000, 'an empty override reads the default');
+      },
+    },
+    {
+      name: 'ready-timeout-env-override-is-respected-in-ms',
+      async run({ assert }) {
+        assert.equal(EmulatorCommand.resolveReadyTimeout('240000'), 240000, 'a numeric override wins');
+      },
+    },
+    {
+      name: 'a-junk-override-fails-loudly-instead-of-racing-an-unknown-deadline',
+      async run({ assert }) {
+        for (const junk of ['soon', '-5', '0', 'NaN']) {
+          let threw = null;
+          try {
+            EmulatorCommand.resolveReadyTimeout(junk);
+          } catch (error) {
+            threw = error;
+          }
+          assert.ok(threw, `"${junk}" must throw instead of racing an unknown deadline`);
+          assert.match(threw.message, /OMEGA_EMULATOR_READY_TIMEOUT/, 'the error names the knob');
+        }
+      },
+    },
+  ],
+});

package/test/boot/project-id-refresh.test.js

@@ -0,0 +1,73 @@
+/**
+ * Project-id consistency — the shared-context refresh contract.
+ *
+ * self.projectId is snapshotted from .firebaserc at setup boot; when the
+ * consistency fix rewrites .firebaserc FROM config (demo → real swap), it must
+ * ALSO refresh self.projectId/projectUrl/firebaseRC — otherwise every later
+ * check's isDemoProject gate keeps demo semantics for the rest of the run
+ * (caught live on omegajs-playground: check 39 skipped real campaign seeding
+ * because self still said demo-omega).
+ */
+
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const jetpack = require('fs-jetpack');
+
+const ProjectIdConsistencyTest = require('../../dist/cli/commands/setup-tests/project-id-consistency.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+function stage(configProjectId, firebasercProjectId) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'backend-pid-'));
+
+  jetpack.write(path.join(tmp, 'config', 'omega.json5'), [
+    '{',
+    '  brand: { id: "pid-brand", name: "PID Brand" },',
+    `  cloud: { provider: "firebase", config: { projectId: "${configProjectId}" } },`,
+    '  targets: { backend: {} },',
+    '}',
+  ].join('\n'));
+  jetpack.write(path.join(tmp, '.firebaserc'), `${JSON.stringify({ projects: { default: firebasercProjectId } }, null, 2)}\n`);
+  jetpack.dir(path.join(tmp, 'functions'));
+
+  return tmp;
+}
+
+module.exports = defineCases({
+  description: 'Project-id consistency — fix refreshes the shared setup context',
+  type: 'group',
+  timeout: 30000,
+
+  tests: [
+    {
+      name: 'demo-to-real-swap-refreshes-self-projectid',
+      async run({ assert }) {
+        const tmp = stage('real-project-abc', 'demo-stale');
+        const self = {
+          firebaseProjectPath: tmp,
+          projectId: 'demo-stale',
+          projectUrl: 'https://console.firebase.google.com/project/demo-stale',
+          firebaseRC: { projects: { default: 'demo-stale' } },
+        };
+
+        const check = new ProjectIdConsistencyTest({ main: self });
+        assert.equal(await check.run(), false, 'mismatch detected');
+
+        await check.fix();
+
+        // The derived artifact follows config…
+        const firebaserc = JSON.parse(jetpack.read(path.join(tmp, '.firebaserc')));
+        assert.equal(firebaserc.projects.default, 'real-project-abc', '.firebaserc rewritten from config');
+
+        // …and the SHARED context follows too — later checks must see truth
+        assert.equal(self.projectId, 'real-project-abc', 'self.projectId refreshed');
+        assert.equal(self.firebaseRC.projects.default, 'real-project-abc', 'self.firebaseRC refreshed');
+        assert.ok(self.projectUrl.includes('real-project-abc'), 'self.projectUrl refreshed');
+        assert.equal(check.isDemoProject, false, 'demo gate now reads the real id');
+
+        assert.equal(await check.run(), true, 'idempotent: rerun passes');
+        jetpack.remove(tmp);
+      },
+    },
+  ],
+});

package/test/boot/suite-portability.test.js

@@ -0,0 +1,278 @@
+/**
+ * Test: the framework suite that ships is the framework suite that RUNS
+ * ([#720](https://github.com/Omega-JS-Stack/omega/issues/720))
+ *
+ * @omega.js/backend ships its corpus as raw source (`files` lists `test/` beside
+ * `dist/`), so a consumer's `npx omega test mgr:` loads these very files out of
+ * node_modules. Two things break there and nowhere else:
+ *
+ *   - a require of a path the tarball does not carry (`../../src/...` — only
+ *     `dist/` ships, and it mirrors src 1:1)
+ *   - a bare require of a devDependency (`@omega.js/devkit`, `@omega.js/config`
+ *     and friends NEVER publish — their modules ride along vendored under
+ *     `dist/vendor/`)
+ *
+ * Both are invisible in the monorepo, where src/ is on disk and the workspace
+ * resolves every @omega.js package. So the suite audits ITSELF here: every
+ * require and every package-relative path literal in test/ must land on
+ * something the published package actually carries.
+ *
+ * The shipped set comes from the package's own `files` list, not from a pack
+ * run — `npm pack` runs `prepare`, which purges and rebuilds dist/ underneath
+ * the suite that is reading it.
+ *
+ * Run: npx omega test backend:boot/suite-portability
+ */
+const path = require('path');
+const { isBuiltin } = require('node:module');
+const jetpack = require('fs-jetpack');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+const PACKAGE_DIR = path.join(__dirname, '..', '..');
+const TEST_DIR = path.join(PACKAGE_DIR, 'test');
+const MANIFEST = jetpack.read(path.join(PACKAGE_DIR, 'package.json'), 'json');
+
+const RUNTIME_DEPENDENCIES = {
+  ...(MANIFEST.dependencies || {}),
+  ...(MANIFEST.peerDependencies || {}),
+  ...(MANIFEST.optionalDependencies || {}),
+};
+
+// Every require/require.resolve with a literal specifier. The leading class
+// keeps the match off requires that live INSIDE a string — test/helpers/
+// settings.test.js writes `'require("a-package-that-does-not-exist");'` as
+// fixture SOURCE, which is not a dependency of the suite.
+const REQUIRE_CALL = /(?:^|[^'"`\w.])require(?:\.resolve)?\(\s*(['"])([^'"]+)\1\s*\)/g;
+
+// The same call with a backtick specifier. An interpolated one resolves to a
+// name only at runtime (`require(`../../dist/…/${name}.js`)`), but everything
+// before the first `${` is static — and THAT directory has to ship.
+const TEMPLATE_REQUIRE = /(?:^|[^'"`\w.])require(?:\.resolve)?\(\s*`([^`]+)`\s*\)/g;
+
+// Any string literal, in any quote style, plus the shape of one that names the
+// package's own source tree — the tarball ships dist/ (a 1:1 mirror), never src/.
+const STRING_LITERAL = /(['"`])([^'"`\n]*)\1/g;
+const SRC_LITERAL = /^(\.\.\/)*src\//;
+
+// A path.join/path.resolve whose arguments are all string literals after a
+// __dirname-rooted base — the other way a test file names a file in the package
+// (`path.join(__dirname, '..', '..', 'src', ...)`), which no require regex sees.
+const PATH_CALL = /path\.(?:join|resolve)\(\s*([A-Za-z_$][\w$]*)\s*,([^()]*)\)/g;
+
+// File-local constants that are themselves __dirname-rooted, so a call through
+// one (`path.join(PACKAGE_DIR, 'src', ...)`) resolves like a direct __dirname call.
+const ROOT_CONSTANT = /const\s+([A-Za-z_$][\w$]*)\s*=\s*path\.(?:join|resolve)\(\s*__dirname\s*,([^()]*)\)/g;
+
+const LITERAL = /^(['"])(.*)\1$/;
+
+// npm packs these whatever `files` says, so a test may read them freely.
+const ALWAYS_SHIPPED = /^(package\.json|README(\..*)?|LICEN[CS]E(\..*)?)$/i;
+
+function testFiles() {
+  return jetpack.find(TEST_DIR, { matching: '**/*.js' }).map((file) => path.resolve(file));
+}
+
+// Source lines that carry code. A require or a path.join inside JSDoc prose is
+// documentation, not a dependency (devkit's vendor tool learned the same bite).
+function codeLines(file) {
+  return (jetpack.read(file) || '')
+    .split('\n')
+    .map((line, index) => ({ line, number: index + 1 }))
+    .filter(({ line }) => {
+      const trimmed = line.trim();
+      return !trimmed.startsWith('*') && !trimmed.startsWith('//') && !trimmed.startsWith('/*');
+    });
+}
+
+// Split a path.join argument list into its literal parts, or null when any
+// argument is an expression (a template literal, a variable) — an unresolvable
+// call is not a finding.
+function literalParts(args) {
+  const parts = [];
+  for (const argument of args.split(',')) {
+    const trimmed = argument.trim();
+    if (!trimmed) continue;
+    const match = LITERAL.exec(trimmed);
+    if (!match) return null;
+    parts.push(match[2]);
+  }
+  return parts;
+}
+
+// The __dirname-rooted bases a file can resolve a path against: __dirname
+// itself plus every file-local constant derived from it.
+function rootsFor(file) {
+  const roots = new Map([['__dirname', path.dirname(file)]]);
+  for (const match of (jetpack.read(file) || '').matchAll(ROOT_CONSTANT)) {
+    const parts = literalParts(match[2]);
+    if (parts) roots.set(match[1], path.resolve(path.dirname(file), ...parts));
+  }
+  return roots;
+}
+
+// Does the published package carry this path? `files` is the SSOT: an entry is
+// a shipped root, and the package root itself (the ancestor of every root) counts.
+function ships(absolute) {
+  const relative = path.relative(PACKAGE_DIR, absolute).split(path.sep).join('/');
+  if (relative === '') return true;
+  if (!jetpack.exists(absolute)) return false;
+  if (ALWAYS_SHIPPED.test(relative)) return true;
+
+  return (MANIFEST.files || []).some((entry) => {
+    const root = entry.replace(/\/$/, '');
+    return relative === root || relative.startsWith(`${root}/`) || root.startsWith(`${relative}/`);
+  });
+}
+
+// Resolve a relative specifier the way require does: as written, then .js, then /index.js.
+function resolveRequire(fromDir, specifier) {
+  const base = path.resolve(fromDir, specifier);
+  return [base, `${base}.js`, path.join(base, 'index.js')].find((candidate) => jetpack.exists(candidate) === 'file');
+}
+
+// The static leading segment of a specifier: everything before the first `${`,
+// or the whole thing when it carries no interpolation.
+function staticPrefix(specifier) {
+  return specifier.split('${')[0];
+}
+
+// The directory a specifier lands in. Appending a placeholder segment makes the
+// static prefix name a file inside that directory whether or not it ends in a separator.
+function staticDirectory(fromDir, specifier) {
+  return path.dirname(path.resolve(fromDir, `${staticPrefix(specifier)}#`));
+}
+
+module.exports = defineCases({
+  description: 'The shipped test suite resolves inside the published package',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'the-suite-and-its-targets-are-listed-in-files',
+      async run({ assert }) {
+        // Everything below reads `files` as the shipped set; these two entries
+        // are what make the suite runnable from an install at all.
+        for (const entry of ['test/', 'dist/']) {
+          assert.equal((MANIFEST.files || []).includes(entry), true, `package.json files must list ${entry}`);
+        }
+      },
+    },
+
+    {
+      name: 'relative-requires-resolve-inside-the-published-package',
+      async run({ assert }) {
+        const failures = [];
+
+        for (const file of testFiles()) {
+          for (const { line, number } of codeLines(file)) {
+            for (const match of line.matchAll(REQUIRE_CALL)) {
+              const specifier = match[2];
+              if (!specifier.startsWith('.')) continue;
+
+              const resolved = resolveRequire(path.dirname(file), specifier);
+              if (!resolved) {
+                failures.push(`${path.relative(PACKAGE_DIR, file)}:${number} requires '${specifier}', which does not resolve`);
+              } else if (!ships(resolved)) {
+                failures.push(`${path.relative(PACKAGE_DIR, file)}:${number} requires '${specifier}' → ${path.relative(PACKAGE_DIR, resolved)}, which the package does not ship`);
+              }
+            }
+
+            for (const match of line.matchAll(TEMPLATE_REQUIRE)) {
+              const specifier = match[1];
+              if (!specifier.startsWith('.')) continue;
+
+              const directory = staticDirectory(path.dirname(file), specifier);
+              if (!ships(directory)) {
+                failures.push(`${path.relative(PACKAGE_DIR, file)}:${number} requires \`${specifier}\` out of ${path.relative(PACKAGE_DIR, directory)}, which the package does not ship`);
+              }
+            }
+          }
+        }
+
+        assert.equal(failures.length, 0, `Requires that break in a consumer install:\n  ${failures.join('\n  ')}`);
+      },
+    },
+
+    {
+      name: 'bare-requires-are-builtins-or-runtime-dependencies',
+      async run({ assert }) {
+        const failures = [];
+
+        for (const file of testFiles()) {
+          for (const { line, number } of codeLines(file)) {
+            for (const match of line.matchAll(REQUIRE_CALL)) {
+              const specifier = match[2];
+              if (specifier.startsWith('.') || specifier.startsWith('/')) continue;
+
+              const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
+              if (isBuiltin(name) || RUNTIME_DEPENDENCIES[name]) continue;
+
+              failures.push(`${path.relative(PACKAGE_DIR, file)}:${number} requires '${specifier}', which is not a builtin or a runtime dependency`);
+            }
+          }
+        }
+
+        assert.equal(failures.length, 0, `Requires that break in a consumer install:\n  ${failures.join('\n  ')}`);
+      },
+    },
+
+    {
+      name: 'package-relative-path-literals-point-at-shipped-files',
+      async run({ assert }) {
+        const failures = [];
+
+        for (const file of testFiles()) {
+          const roots = rootsFor(file);
+
+          for (const { line, number } of codeLines(file)) {
+            for (const match of line.matchAll(PATH_CALL)) {
+              const root = roots.get(match[1]);
+              if (!root) continue;
+
+              const parts = literalParts(match[2]);
+              if (!parts) continue;
+
+              // Paths that stay inside test/ are fixtures and temp trees, which
+              // the suite creates for itself — only what it reaches OUT to must ship.
+              const resolved = path.resolve(root, ...parts);
+              if (resolved.startsWith(`${TEST_DIR}${path.sep}`)) continue;
+
+              if (!ships(resolved)) {
+                failures.push(`${path.relative(PACKAGE_DIR, file)}:${number} reads ${path.relative(PACKAGE_DIR, resolved)}, which the package does not ship`);
+              }
+            }
+          }
+        }
+
+        assert.equal(failures.length, 0, `Paths that break in a consumer install:\n  ${failures.join('\n  ')}`);
+      },
+    },
+
+    {
+      name: 'no-string-literal-names-the-source-tree',
+      async run({ assert }) {
+        const failures = [];
+
+        for (const file of testFiles()) {
+          for (const { line, number } of codeLines(file)) {
+            for (const match of line.matchAll(STRING_LITERAL)) {
+              const literal = match[2];
+              if (!SRC_LITERAL.test(literal)) continue;
+
+              // Resolve it the way its file would: a `../` literal is relative
+              // to the file, a bare `src/` one is package-rooted. One that names
+              // nothing on disk here is not a path into this package at all —
+              // it is prose, or a path in the CONSUMER's repo (`src/_posts/…`).
+              const from = literal.startsWith('..') ? path.dirname(file) : PACKAGE_DIR;
+              if (!jetpack.exists(path.resolve(from, staticPrefix(literal)))) continue;
+
+              failures.push(`${path.relative(PACKAGE_DIR, file)}:${number} names '${literal}', and only dist/ ships`);
+            }
+          }
+        }
+
+        assert.equal(failures.length, 0, `Paths that break in a consumer install:\n  ${failures.join('\n  ')}`);
+      },
+    },
+  ],
+});

package/test/boot/update-command.test.js

@@ -0,0 +1,63 @@
+/**
+ * `mgr update` wiring pin — the verb is the SHARED devkit implementation
+ * (npu-outdated semantics, 7-day release-age quarantine); @omega.js/backend
+ * only wires it into the colon-style CLI. Pins: the built command class
+ * loads from dist (so the vendored devkit module resolves), the dispatcher
+ * routes update/outdated/out, and the offline core behaves (report/apply
+ * selection with an injected registry + clock — no network).
+ */
+
+const table = require('../../dist/cli/command-table.js');
+const UpdateCommand = require('../../dist/cli/commands/update.js');
+const devkitUpdate = require('../../dist/vendor/devkit/update.js');
+const defineCases = require('../../dist/vendor/devkit/test/define-cases.js');
+
+module.exports = defineCases({
+  description: 'Update command — devkit-shared verb wired into the @omega.js/backend CLI',
+  type: 'group',
+
+  tests: [
+    {
+      name: 'dist-command-loads-and-exposes-execute',
+      async run({ assert }) {
+        assert.equal(typeof UpdateCommand, 'function', 'dist/cli/commands/update.js exports the command class');
+        assert.equal(typeof UpdateCommand.prototype.execute, 'function', 'command class implements execute()');
+      },
+    },
+    {
+      name: 'dispatcher-routes-update-outdated-out',
+      async run({ assert }) {
+        const update = table.COMMANDS.find((command) => command.name === 'update');
+        assert.ok(update, 'the command table carries the update verb');
+
+        for (const token of ['update', 'outdated', 'out']) {
+          assert.equal(table.matchCommand(update, { [token]: true }), true, `\`omega ${token}\` dispatches update`);
+        }
+      },
+    },
+    {
+      name: 'core-semantics-hold-offline (quarantine + major hold, injected clock)',
+      async run({ assert }) {
+        const NOW = Date.UTC(2026, 6, 21);
+        const day = (daysAgo) => new Date(NOW - daysAgo * 24 * 60 * 60 * 1000).toISOString();
+
+        assert.equal(devkitUpdate.DEFAULT_MIN_AGE_DAYS, 7, 'quarantine default is 7 days');
+
+        const rows = [{
+          name: 'fresh', group: 'prod', current: '1.0.0', installed: '1.0.0',
+          wanted: '1.1.0', latest: '1.1.0', minorTarget: '1.1.0', bump: 'minor',
+          time: { '1.1.0': day(2) }, error: null,
+        }, {
+          name: 'breaking', group: 'prod', current: '1.0.0', installed: '1.0.0',
+          wanted: '1.0.0', latest: '2.0.0', minorTarget: '1.0.0', bump: 'major',
+          time: { '2.0.0': day(90) }, error: null,
+        }];
+
+        const selection = devkitUpdate.selectUpdates(rows, { minAge: 7, now: NOW });
+        assert.equal(selection.updates.length, 0, 'fresh release quarantined, major held');
+        assert.equal(selection.quarantined[0].name, 'fresh');
+        assert.equal(selection.majorsHeld[0].name, 'breaking');
+      },
+    },
+  ],
+});