cursedbelt 2.7.0 → 3.0.0

package/src/server/mixins/domainVerticals.spec.ts

@@ -1,1232 +0,0 @@
-/**
- * §4 gate — one create→list→mutate→delete round-trip per engine through the
- * REAL mixin + REAL ops + REAL repository, exactly as 04 §4 demands:
- * "Kanban for knowledge, an album for asset, a calendar event for system."
- *
- * These are black-box HTTP tests against the production `composeServer`: the same
- * mixins, the same `guardVerify`, the same `instanceMixin` ops allowlist, the
- * same `createEngineOpHandlers` a generated app boots. Only the leaf is real
- * SQLite over `createLocalStorageProvider` — which is the point, because a
- * round-trip that never touches a repository proves nothing about persistence.
- *
- * Manifest fidelity (06 §4): the instances below are DERIVED by `verifyAppConfig` →
- * V2 from `VERTICALS_CONFIG`, not hand-built. Previously this file spoon-fed each
- * `EffectiveInstance.ops` array, so it proved the mixin ran once the op was on the
- * allowlist but never that V2 would PUT it there — precisely the blind spot that let
- * the op-allowlist bug ship. Now the same pipeline a generated app runs decides both
- * the effective features and the ops allowlist these round-trips exercise (Law #4).
- *
- * Three properties every vertical must show, per 04 §4's definition of done ("a
- * row created in the UI survives a reload and is tenant-isolated in SQL"):
- *
- *   1. **It persists.** A resource created through the route is readable back
- *      through the route (a reload) — the row is in the database, not a closure.
- *   2. **It CDC-emits on every write.** `auditCdc: true` makes a forgotten
- *      `ctx.emit` throw `CDC_EMIT_MISSING` (06 §2), so every mutation below is
- *      also an assertion that the invalidation the client's dirty ledger pulls
- *      against was actually published.
- *   3. **It is tenant-isolated in SQL.** A second tenant cannot read or mutate
- *      the first's rows — and gets a 404, never a 403, so existence stays
- *      undisclosed (J3-2).
- */
-import { Database } from 'bun:sqlite';
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import {
-  KNOWLEDGE_MIGRATIONS,
-  KNOWLEDGE_NAMESPACE,
-  MEDIA_MIGRATIONS,
-  MEDIA_NAMESPACE,
-  SYSTEM_MIGRATIONS,
-  SYSTEM_NAMESPACE,
-} from 'cwip/domains';
-import { type RepoScope, scopedExec, vaultRepo } from 'cwip/repositories';
-import { assertCcPragmas, runNamespacedMigrations } from 'cwip/sqlite';
-import { createLocalStorageProvider, type ObjectStore, type StorageProvider } from 'cwip/storage';
-import type { EffectiveManifest } from '../../verify/types';
-import { verifyAppConfig } from '../../verify/pipeline';
-import { createVerifyContext, createVerifyJobBroker, createVerifyTelemetry } from '../../verify/runtime/verifyContext';
-import { createAssetService } from '../services/assetService';
-import { createVaultMediaSource } from '../services/assetSources';
-import { createKnowledgeService } from '../services/knowledgeService';
-import { createSystemService } from '../services/systemService';
-import { createEngineOpHandlers } from '../ops';
-import type { CCHono } from './types';
-import { composeServer } from './index';
-import {
-  ASSET_SOURCES,
-  KNOWLEDGE_BOARD_CARDS,
-  KNOWLEDGE_BOARD_COLUMNS,
-  KNOWLEDGE_BOARDS,
-  KNOWLEDGE_RECORDS,
-  SYSTEM_CALENDAR,
-} from '../../react/data/engineResources';
-
-/* ------------------------------------------------------------ manifest ----- */
-
-/** An in-memory ObjectStore — the album gate is about metadata, not bytes. */
-const memoryObjectStore = (): ObjectStore => {
-  const objects = new Map<string, string>();
-  return {
-    async put(key, body) {
-      objects.set(key, await new Response(body).text());
-      return { key, size: 0, modifiedAt: '2026-07-24T00:00:00.000Z' };
-    },
-    async get(key) {
-      const value = objects.get(key);
-      return value === undefined ? null : new Response(value).body;
-    },
-    async stat(key) {
-      return objects.has(key) ? { key, size: 0, modifiedAt: '2026-07-24T00:00:00.000Z' } : null;
-    },
-    async delete(key) {
-      return objects.delete(key);
-    },
-    async signedUrl(key) {
-      return `memory://${key}`;
-    },
-  };
-};
-
-/* ------------------------------------------------------------ harness ------ */
-
-let knowledge: Database;
-let media: Database;
-let system: Database;
-let storage: StorageProvider;
-let app: CCHono;
-let mint: (over?: Record<string, unknown>) => string;
-
-const TENANT_A = { tenantId: 'tenant-a', userId: 'user-1' } as const;
-const TENANT_B = { tenantId: 'tenant-b', userId: 'user-2' } as const;
-
-/** Full capability profile so no effective-on feature is silently downgraded when the
- * manifest is derived through V2 (mirrors `pipeline.spec.ts`'s `FULL`). */
-const FULL_CAPS = { ffmpeg: true, wasm: true, shell: true, aiProvider: true, diskIndex: true, network: true, ocrRuntime: true, git: true };
-
-/**
- * The three-instance app-config this file's round-trips run against — the SAME
- * board/gallery/utility instances, but as a *config the compiler consumes* rather than
- * a hand-built manifest. `verifyAppConfig` → V2 derives each instance's `effective`
- * features AND its `ops` allowlist, so these tests now prove the ops they call are
- * genuinely reachable in a generated app (06 §4, Law #4), not just that the mixin runs
- * when the allowlist is spoon-fed. `oralHistory` requires the asset engine (present).
- */
-const VERTICALS_CONFIG = {
-  configVersion: 1,
-  app: { id: 'verticals-app', title: 'Verticals' },
-  engines: ['knowledge', 'asset', 'system'],
-  instances: [
-    { engine: 'knowledge', id: 'board', features: { kanban: true, airtableStyleLists: true, contacts: true, family: true, oralHistory: true } },
-    { engine: 'asset', id: 'gallery', features: { gallery: true, vaultSource: true } },
-    { engine: 'system', id: 'utility', features: { calendar: true, timeOff: true, budgets: true, subscriptions: true } },
-  ],
-};
-
-/** Compile a config through the real pipeline; fail loudly if it does not verify. */
-const derive = async (config: unknown): Promise<EffectiveManifest> => {
-  const result = await verifyAppConfig({ config, moment: 'ci', capabilities: FULL_CAPS });
-  expect(result.ok, `config must verify: ${JSON.stringify(result.diagnostics)}`).toBe(true);
-  if (!result.manifest) throw new Error('pipeline produced no manifest');
-  return result.manifest;
-};
-
-beforeEach(async () => {
-  knowledge = new Database(':memory:');
-  media = new Database(':memory:');
-  system = new Database(':memory:');
-  for (const db of [knowledge, media, system]) assertCcPragmas(db);
-  runNamespacedMigrations(knowledge, KNOWLEDGE_MIGRATIONS, { namespace: KNOWLEDGE_NAMESPACE });
-  runNamespacedMigrations(media, MEDIA_MIGRATIONS, { namespace: MEDIA_NAMESPACE });
-  runNamespacedMigrations(system, SYSTEM_MIGRATIONS, { namespace: SYSTEM_NAMESPACE });
-
-  // `auditCdc` turns every write below into a CDC-on-write assertion: a repo op
-  // that mutates a row without `ctx.emit` throws, failing the round-trip.
-  storage = createLocalStorageProvider({ handles: { knowledge, media, system }, auditCdc: true });
-
-  const broker = createVerifyJobBroker();
-  const telemetry = createVerifyTelemetry();
-  const objects = memoryObjectStore();
-  const services = {
-    knowledge: createKnowledgeService({ storage, broker }),
-    // The vault is registered as an extra source so a completed vault upload
-    // surfaces through the asset listing (§2b) — the same wiring `recipe.ts` does
-    // when `vaultSource` is effective-on.
-    asset: createAssetService({
-      storage,
-      objects,
-      broker,
-      telemetry,
-      sources: [createVaultMediaSource(storage)],
-    }),
-    system: createSystemService({ storage }),
-  };
-
-  const manifest = await derive(VERTICALS_CONFIG);
-
-  const { ctx, guard } = createVerifyContext({ manifest });
-  const handlers = createEngineOpHandlers({ services, broker, push: ctx.push });
-  app = composeServer({ ctx, services, instance: { handlers } });
-  mint = (over = {}) => guard.mint(over);
-});
-
-afterEach(async () => {
-  await storage.close();
-  for (const db of [knowledge, media, system]) db.close();
-});
-
-/* ------------------------------------------------------------ helpers ------ */
-
-interface Res {
-  status: number;
-  body: Record<string, unknown>;
-}
-
-const call = async (
-  method: string,
-  path: string,
-  opts: { token?: string; json?: unknown } = {},
-): Promise<Res> => {
-  const headers: Record<string, string> = { 'content-type': 'application/json' };
-  if (opts.token) headers.authorization = `Bearer ${opts.token}`;
-  const response = await app.fetch(
-    new Request(`http://localhost${path}`, {
-      method,
-      headers,
-      body: opts.json === undefined ? undefined : JSON.stringify(opts.json),
-    }),
-  );
-  return { status: response.status, body: (await response.json().catch(() => ({}))) as Record<string, unknown> };
-};
-
-/* ------------------------------------------------------------ kanban ------- */
-
-describe('§4 vertical — kanban (knowledge)', () => {
-  it('round-trips board→column→card through mixin + move/reorder ops + repo', async () => {
-    const token = mint(TENANT_A);
-
-    // CREATE a board, then reload it — persistence, not a closure.
-    const created = await call('POST', '/api/knowledge/boards', { token, json: { title: 'Sprint' } });
-    expect(created.status).toBe(201);
-    const boardId = (created.body.board as { id: string }).id;
-
-    const listed = await call('GET', '/api/knowledge/boards', { token });
-    expect((listed.body.boards as { id: string }[]).map((b) => b.id)).toEqual([boardId]);
-
-    // Two columns; a card in the first.
-    const col1 = await call('POST', `/api/knowledge/boards/${boardId}/columns`, {
-      token,
-      json: { title: 'Todo', position: 1 },
-    });
-    expect(col1.status).toBe(201);
-    const col1Id = (col1.body.column as { id: string }).id;
-    const col2 = await call('POST', `/api/knowledge/boards/${boardId}/columns`, {
-      token,
-      json: { title: 'Done', position: 2 },
-    });
-    const col2Id = (col2.body.column as { id: string }).id;
-
-    const card = await call('POST', `/api/knowledge/columns/${col1Id}/cards`, {
-      token,
-      json: { title: 'Ship it', position: 1 },
-    });
-    expect(card.status).toBe(201);
-    const cardId = (card.body.card as { id: string }).id;
-
-    // MUTATE via the move-card OP — the card lands in column 2.
-    const moved = await call('POST', '/api/instance/board/ops/move-card', {
-      token,
-      json: { cardId, toColumnId: col2Id, position: 1 },
-    });
-    expect(moved.status).toBe(200);
-    expect(moved.body.moved).toBe(true);
-
-    const inCol1 = await call('GET', `/api/knowledge/columns/${col1Id}/cards`, { token });
-    expect(inCol1.body.cards).toEqual([]);
-    const inCol2 = await call('GET', `/api/knowledge/columns/${col2Id}/cards`, { token });
-    expect((inCol2.body.cards as { id: string }[]).map((c) => c.id)).toEqual([cardId]);
-
-    // The BOARD-wide card read (03 §1b) — the read the kanban view renders. One
-    // request, a coherent snapshot; the per-column read above would take N.
-    const boardCards = await call('GET', `/api/knowledge/boards/${boardId}/cards`, { token });
-    expect((boardCards.body.cards as { id: string }[]).map((c) => c.id)).toEqual([cardId]);
-
-    // The reorder-column OP is ONE update; a good status is enough here (the
-    // ordering maths is the repo's own suite).
-    const reordered = await call('POST', '/api/instance/board/ops/reorder-column', {
-      token,
-      json: { columnId: col1Id, position: 5 },
-    });
-    expect(reordered.status).toBe(200);
-    expect(reordered.body.reordered).toBe(true);
-
-    // DELETE the board — columns and cards cascade.
-    expect((await call('DELETE', `/api/knowledge/boards/${boardId}`, { token })).status).toBe(200);
-    expect((await call('GET', '/api/knowledge/boards', { token })).body.boards).toEqual([]);
-    // The card is gone with its board (FK cascade), reachable through no column.
-    expect((await call('GET', `/api/knowledge/columns/${col2Id}/cards`, { token })).body.cards).toEqual([]);
-  });
-
-  it('is tenant-isolated in SQL: B cannot see or mutate A’s board (404, not 403)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const boardId = ((await call('POST', '/api/knowledge/boards', { token: a, json: { title: 'A-only' } }))
-      .body.board as { id: string }).id;
-
-    // B's listing is empty and B's direct read is a 404 — existence undisclosed.
-    expect((await call('GET', '/api/knowledge/boards', { token: b })).body.boards).toEqual([]);
-    const read = await call('GET', `/api/knowledge/boards/${boardId}`, { token: b });
-    expect(read.status).toBe(404);
-    expect((read.body.error as { code: string }).code).toBe('ENTITY_NOT_FOUND');
-
-    // B cannot plant a column under A's board: the repo guards the parent, so the
-    // route reports 404 rather than writing across the tenant boundary.
-    const foreignColumn = await call('POST', `/api/knowledge/boards/${boardId}/columns`, {
-      token: b,
-      json: { title: 'intruder', position: 1 },
-    });
-    expect(foreignColumn.status).toBe(404);
-    // …and A still sees zero columns.
-    expect((await call('GET', `/api/knowledge/boards/${boardId}/columns`, { token: a })).body.columns).toEqual([]);
-  });
-
-  it('feature-off means the kanban routes do not exist (404, never 403)', async () => {
-    // A knowledge engine with `kanban` OFF composes no board routes at all — derived
-    // through the real pipeline, so V2 (not the test) decides the routes are absent.
-    const { ctx, guard } = createVerifyContext({
-      manifest: await derive({
-        configVersion: 1,
-        app: { id: 'kanban-off', title: 'Kanban Off' },
-        engines: ['knowledge'],
-        instances: [{ engine: 'knowledge', id: 'notes', features: { kanban: false } }],
-      }),
-    });
-    const off = composeServer({
-      ctx,
-      services: { knowledge: createKnowledgeService({ storage, broker: createVerifyJobBroker() }) },
-    });
-    const response = await off.fetch(
-      new Request('http://localhost/api/knowledge/boards', {
-        headers: { authorization: `Bearer ${guard.mint(TENANT_A)}` },
-      }),
-    );
-    expect(response.status).toBe(404);
-  });
-});
-
-/* ------------------------------------------------------------ album -------- */
-
-describe('§4 vertical — album (asset)', () => {
-  // A vault asset is a fixture the album references; the vault-asset write path
-  // (upload staging) is its own repo suite, so we seed one directly here.
-  const seedVaultAsset = async (scope: RepoScope, checksum: string): Promise<string> => {
-    const result = await scopedExec(
-      storage.domain('media'),
-      scope,
-      vaultRepo.createAsset(scope, {
-        checksum,
-        objectKey: `${scope.tenantId}/${checksum}`,
-        mimeType: 'image/jpeg',
-        byteSize: 1234,
-        title: 'Sunset',
-      }),
-    );
-    return result.asset.id;
-  };
-
-  it('round-trips album CRUD + ordered membership through mixin + reorder op + repo', async () => {
-    const token = mint(TENANT_A);
-    const assetId = await seedVaultAsset(TENANT_A, 'hash-a-1');
-
-    const created = await call('POST', '/api/asset/albums', { token, json: { title: 'Trip' } });
-    expect(created.status).toBe(201);
-    const albumId = (created.body.album as { id: string }).id;
-
-    // Reload through the listing — persisted.
-    expect((await call('GET', '/api/asset/albums', { token })).body.albums).toHaveLength(1);
-
-    // Add the asset as a member, then read the membership back.
-    const added = await call('POST', `/api/asset/albums/${albumId}/assets`, {
-      token,
-      json: { assetId, position: 1 },
-    });
-    expect(added.status).toBe(201);
-    const members = await call('GET', `/api/asset/albums/${albumId}/assets`, { token });
-    expect((members.body.assets as { id: string }[]).map((a) => a.id)).toEqual([assetId]);
-
-    // MUTATE order via the reorder-album-member OP.
-    const reordered = await call('POST', '/api/instance/gallery/ops/reorder-album-member', {
-      token,
-      json: { albumId, assetId, position: 9 },
-    });
-    expect(reordered.status).toBe(200);
-    expect(reordered.body.reordered).toBe(true);
-
-    // Remove the member, then DELETE the album.
-    expect((await call('DELETE', `/api/asset/albums/${albumId}/assets/${assetId}`, { token })).status).toBe(200);
-    expect((await call('GET', `/api/asset/albums/${albumId}/assets`, { token })).body.assets).toEqual([]);
-    expect((await call('DELETE', `/api/asset/albums/${albumId}`, { token })).status).toBe(200);
-    expect((await call('GET', '/api/asset/albums', { token })).body.albums).toEqual([]);
-  });
-
-  it('is tenant-isolated: B cannot add A’s asset, read A’s album, or delete it', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const albumId = ((await call('POST', '/api/asset/albums', { token: a, json: { title: 'A-album' } }))
-      .body.album as { id: string }).id;
-
-    expect((await call('GET', '/api/asset/albums', { token: b })).body.albums).toEqual([]);
-    expect((await call('GET', `/api/asset/albums/${albumId}`, { token: b })).status).toBe(404);
-    expect((await call('DELETE', `/api/asset/albums/${albumId}`, { token: b })).status).toBe(404);
-  });
-});
-
-/* ------------------------------------------------------------ source ------- */
-
-describe('§4 vertical — vault source (asset)', () => {
-  /*
-   * `mv_sources` had repository ops and NO consumer for the whole arc: a customer
-   * could see the items a source yields and never the source itself, so the table
-   * that exists to keep source configuration out of a config file could only be
-   * written by a migration or by hand. This is the round trip that closes it.
-   */
-  it('round-trips source CRUD through mixin → service → repo', async () => {
-    const token = mint(TENANT_A);
-
-    const created = await call('POST', '/api/asset/sources', {
-      token,
-      json: { kind: 'directory', title: 'Photos', rootKey: 'media/photos' },
-    });
-    expect(created.status).toBe(201);
-    const source = created.body.source as { id: string; kind: string; rootKey: string; readOnly: boolean };
-    expect(source).toMatchObject({ kind: 'directory', rootKey: 'media/photos', readOnly: false });
-
-    // Reload through the listing — persisted, not merely echoed.
-    expect((await call('GET', '/api/asset/sources', { token })).body.sources).toHaveLength(1);
-    expect((await call('GET', `/api/asset/sources/${source.id}`, { token })).status).toBe(200);
-
-    const patched = await call('PATCH', `/api/asset/sources/${source.id}`, {
-      token,
-      json: { title: 'Family photos', readOnly: true },
-    });
-    expect(patched.status).toBe(200);
-    expect(patched.body.source).toMatchObject({ title: 'Family photos', readOnly: true });
-
-    expect((await call('DELETE', `/api/asset/sources/${source.id}`, { token })).status).toBe(200);
-    expect((await call('GET', '/api/asset/sources', { token })).body.sources).toEqual([]);
-    // A second delete is a 404, not a silent success — `remove` answers `false`.
-    expect((await call('DELETE', `/api/asset/sources/${source.id}`, { token })).status).toBe(404);
-  });
-
-  /*
-   * 🔴 The reason `rootKey` is not patchable. A source is root-bounded, and the
-   * entire point of moving this out of `mediaSources: [...]` config was that a
-   * config file can be edited to re-point a source at `/`. If PATCH ever accepts
-   * a root, this fails.
-   */
-  it('cannot be re-pointed by a PATCH — rootKey is fixed at creation', async () => {
-    const token = mint(TENANT_A);
-    const id = (
-      (await call('POST', '/api/asset/sources', {
-        token,
-        json: { kind: 'directory', title: 'Bounded', rootKey: 'media/bounded' },
-      })).body.source as { id: string }
-    ).id;
-
-    const patched = await call('PATCH', `/api/asset/sources/${id}`, {
-      token,
-      json: { title: 'Renamed', rootKey: '/' },
-    });
-
-    expect(patched.status).toBe(200);
-    expect(patched.body.source).toMatchObject({ title: 'Renamed', rootKey: 'media/bounded' });
-  });
-
-  it('refuses an unknown kind typed, rather than storing a row every reader must defend against', async () => {
-    const token = mint(TENANT_A);
-    const bad = await call('POST', '/api/asset/sources', {
-      token,
-      json: { kind: 'dropbox', title: 'Nope', rootKey: 'r' },
-    });
-    expect(bad.status).toBe(400);
-    expect(bad.body.error).toMatchObject({ code: 'SOURCE_KIND_UNKNOWN' });
-  });
-
-  it('names every missing field at once, so a form is not fixed one round trip at a time', async () => {
-    const token = mint(TENANT_A);
-    const bad = await call('POST', '/api/asset/sources', { token, json: { title: '  ' } });
-    expect(bad.status).toBe(400);
-    expect(bad.body.error).toMatchObject({
-      code: 'SOURCE_FIELDS_MISSING',
-      context: { missing: ['kind', 'title', 'rootKey'] },
-    });
-  });
-
-  it('feature-off means the source routes do not exist (404, never 403)', async () => {
-    // R-3: an asset engine with `vaultSource` OFF composes no source routes at
-    // all — derived through the real pipeline, so V2 (not the test) decides.
-    const { ctx, guard } = createVerifyContext({
-      manifest: await derive({
-        configVersion: 1,
-        app: { id: 'vault-off', title: 'Vault Off' },
-        engines: ['asset'],
-        instances: [{ engine: 'asset', id: 'gallery', features: { gallery: true, vaultSource: false } }],
-      }),
-    });
-    const off = composeServer({
-      ctx,
-      services: {
-        asset: createAssetService({ storage, objects: memoryObjectStore(), broker: createVerifyJobBroker(), telemetry: createVerifyTelemetry() }),
-      },
-    });
-    const response = await off.fetch(
-      new Request('http://localhost/api/asset/sources', {
-        headers: { authorization: `Bearer ${guard.mint(TENANT_A)}` },
-      }),
-    );
-    expect(response.status).toBe(404);
-  });
-
-  it('is tenant-isolated: B cannot list, read, patch or delete A’s source', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const id = (
-      (await call('POST', '/api/asset/sources', {
-        token: a,
-        json: { kind: 'vault', title: 'A-source', rootKey: 'vault/a' },
-      })).body.source as { id: string }
-    ).id;
-
-    expect((await call('GET', '/api/asset/sources', { token: b })).body.sources).toEqual([]);
-    expect((await call('GET', `/api/asset/sources/${id}`, { token: b })).status).toBe(404);
-    expect((await call('PATCH', `/api/asset/sources/${id}`, { token: b, json: { title: 'Stolen' } })).status).toBe(404);
-    expect((await call('DELETE', `/api/asset/sources/${id}`, { token: b })).status).toBe(404);
-    // …and A's row is untouched by any of it.
-    expect((await call('GET', `/api/asset/sources/${id}`, { token: a })).body.source).toMatchObject({
-      title: 'A-source',
-    });
-  });
-});
-
-/* ------------------------------------------------------------ vault upload - */
-
-describe('§4 vertical — vault upload (asset)', () => {
-  // POST raw bytes to the staging route the way a browser upload does — an
-  // un-buffered body stream, not a JSON envelope. The service hashes it WHILE
-  // streaming to the ObjectStore and promotes it to a content-addressed asset.
-  const uploadBytes = async (
-    token: string,
-    bytes: string,
-    over: { contentType?: string; fileName?: string } = {},
-  ): Promise<Res> => {
-    const headers: Record<string, string> = {
-      authorization: `Bearer ${token}`,
-      'content-type': over.contentType ?? 'image/jpeg',
-    };
-    if (over.fileName) headers['x-cc-filename'] = over.fileName;
-    const response = await app.fetch(
-      new Request('http://localhost/api/asset/vault/upload', { method: 'POST', headers, body: bytes }),
-    );
-    return { status: response.status, body: (await response.json().catch(() => ({}))) as Record<string, unknown> };
-  };
-
-  it('stages → checksums → promotes an upload to a vaulted asset that lists', async () => {
-    const token = mint(TENANT_A);
-
-    const up = await uploadBytes(token, 'the-sunset-bytes', { fileName: 'sunset.jpg' });
-    expect(up.status).toBe(201);
-    expect(up.body.deduped).toBe(false);
-    const asset = up.body.asset as { id: string; checksum: string; byteSize: number; mimeType: string };
-    // A real SHA-256 (64 hex chars) over the ACTUAL streamed bytes, and the byte
-    // count is the true stored size — not a declared Content-Length.
-    expect(asset.checksum).toMatch(/^[0-9a-f]{64}$/);
-    expect(asset.byteSize).toBe('the-sunset-bytes'.length);
-    expect(asset.mimeType).toBe('image/jpeg');
-
-    // The staging row settled `ready` and is pollable by id.
-    const uploadId = up.body.uploadId as string;
-    const status = await call('GET', `/api/asset/vault/uploads/${uploadId}`, { token });
-    expect((status.body.upload as { status: string }).status).toBe('ready');
-
-    // It flows through the vault SOURCE into the asset listing (§2b) — the whole
-    // point: AssetStudio lists vault assets through the same engine surface.
-    const items = (await call('GET', '/api/asset/items', { token })).body.items as { id: string }[];
-    expect(items.map((i) => i.id)).toContain(asset.id);
-  });
-
-  it('is content-addressed: re-uploading identical bytes dedupes onto one asset', async () => {
-    const token = mint(TENANT_A);
-
-    const first = await uploadBytes(token, 'identical-payload');
-    const second = await uploadBytes(token, 'identical-payload');
-    expect(first.body.deduped).toBe(false);
-    expect(second.body.deduped).toBe(true);
-    expect((second.body.asset as { id: string }).id).toBe((first.body.asset as { id: string }).id);
-
-    // Distinct bytes are a distinct asset — so the listing holds exactly two.
-    await uploadBytes(token, 'a-different-payload');
-    const items = (await call('GET', '/api/asset/items', { token })).body.items as { id: string }[];
-    expect(items).toHaveLength(2);
-  });
-
-  it('decodes a percent-encoded file name, and takes an un-encodable one as it stands', async () => {
-    const token = mint(TENANT_A);
-
-    // What the browser client sends (03 §1c): a header is ISO-8859-1 on the wire,
-    // so `café.jpg` must travel encoded or `fetch` throws before a byte leaves.
-    const encoded = await uploadBytes(token, 'accented-bytes', { fileName: encodeURIComponent('café.jpg') });
-    expect((encoded.body.asset as { title?: string }).title).toBe('café.jpg');
-
-    // A caller that never encoded (curl, or any pre-03 client) is not refused
-    // AFTER its bytes already streamed — a file name is a label, not a gate.
-    const raw = await uploadBytes(token, 'literal-percent-bytes', { fileName: '100%.jpg' });
-    expect((raw.body.asset as { title?: string }).title).toBe('100%.jpg');
-
-    // Plain ASCII decodes to itself — every existing caller is unaffected.
-    const plain = await uploadBytes(token, 'plain-bytes', { fileName: 'plain.jpg' });
-    expect((plain.body.asset as { title?: string }).title).toBe('plain.jpg');
-  });
-
-  it('is tenant-isolated: B cannot poll A’s upload nor see A’s vaulted asset', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-
-    const up = await uploadBytes(a, 'tenant-a-secret');
-    const uploadId = up.body.uploadId as string;
-    const assetId = (up.body.asset as { id: string }).id;
-
-    // B polling A's staging row is a 404 (existence undisclosed, never 403).
-    expect((await call('GET', `/api/asset/vault/uploads/${uploadId}`, { token: b })).status).toBe(404);
-    // B's asset listing does not contain A's vaulted asset.
-    const bItems = (await call('GET', '/api/asset/items', { token: b })).body.items as { id: string }[];
-    expect(bItems.map((i) => i.id)).not.toContain(assetId);
-  });
-});
-
-/* ------------------------------------------------------- detail reads ----- */
-
-/**
- * The two SINGLE-ENTITY reads the detail surfaces ride (03 §1e).
- *
- * Both are new far sides, and both have the same non-disclosure law as every
- * other read here: a foreign id is a 404, never a 403. What is specific to them:
- *
- *   * `GET /api/asset/items/:id` must be exactly as fail-closed as the BYTES
- *     route beside it — a detail read that could describe a sealed asset would
- *     leak its title through a route with no `requirePrivateScope`;
- *   * `GET /api/knowledge/entity/:id` must now answer with the BODY and the
- *     satellite. Those columns were written by the repository and joined by
- *     `getRecordFull` for two arcs while the service projected them away, so this
- *     is the assertion that the projection actually reaches the wire.
- */
-describe('§1e detail reads — one asset, one record', () => {
-  it('answers one catalogue item, and 404s a foreign one without disclosing it', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-
-    const uploaded = await app.fetch(
-      new Request('http://localhost/api/asset/vault/upload', {
-        method: 'POST',
-        headers: { authorization: `Bearer ${a}`, 'content-type': 'image/jpeg', 'x-cc-filename': 'sunset.jpg' },
-        body: 'detail-read-bytes',
-      }),
-    );
-    const asset = ((await uploaded.json()) as { asset: { id: string } }).asset;
-
-    const detail = await call('GET', `/api/asset/items/${asset.id}`, { token: a });
-    expect(detail.status).toBe(200);
-    const item = detail.body.item as { id: string; kind: string; title?: string; streamUrl?: string };
-    expect(item.id).toBe(asset.id);
-    expect(item.kind).toBe('photo');
-    expect(item.title).toBe('sunset.jpg');
-    // The transport URL is the SERVER's — the client never assembles one.
-    expect(item.streamUrl).toBe(`/api/asset/items/${asset.id}/bytes`);
-
-    // Tenant B gets the same answer an unknown id gets.
-    expect((await call('GET', `/api/asset/items/${asset.id}`, { token: b })).status).toBe(404);
-    expect((await call('GET', '/api/asset/items/itm_nope', { token: a })).status).toBe(404);
-  });
-
-  it('answers one record WITH its body and satellite, and 404s a foreign one', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-
-    const created = await call('POST', '/api/knowledge/records', {
-      token: a,
-      json: { type: 'note', title: 'Groceries', bodyMd: 'milk\neggs' },
-    });
-    expect(created.status).toBe(201);
-    const id = (created.body.entity as { id: string }).id;
-
-    const detail = await call('GET', `/api/knowledge/entity/${id}`, { token: a });
-    expect(detail.status).toBe(200);
-    const entity = detail.body.entity as { id: string; bodyMd?: string; pinned: boolean; archived: boolean };
-    expect(entity.id).toBe(id);
-    // The field the LISTING projection drops — and the reason this route changed.
-    expect(entity.bodyMd).toBe('milk\neggs');
-    expect(entity.pinned).toBe(false);
-    expect(entity.archived).toBe(false);
-
-    expect((await call('GET', `/api/knowledge/entity/${id}`, { token: b })).status).toBe(404);
-  });
-});
-
-/* ------------------------------------------------------------ calendar ----- */
-
-describe('§4 vertical — calendar event (system)', () => {
-  it('round-trips calendar→event through mixin + occurrence-mark ops + repo', async () => {
-    const token = mint(TENANT_A);
-
-    const cal = await call('POST', '/api/system/calendars', { token, json: { title: 'Work' } });
-    expect(cal.status).toBe(201);
-    const calendarId = (cal.body.calendar as { id: string }).id;
-    expect((await call('GET', '/api/system/calendars', { token })).body.calendars).toHaveLength(1);
-
-    // CREATE an event under the calendar; reload it by id.
-    const event = await call('POST', '/api/system/calendar/events', {
-      token,
-      json: { calendarId, title: 'Standup', startsAt: '2026-07-24T09:00:00.000Z', rrule: 'FREQ=DAILY' },
-    });
-    expect(event.status).toBe(201);
-    const eventId = (event.body.event as { id: string }).id;
-    const reloaded = await call('GET', `/api/system/calendar/events/${eventId}`, { token });
-    expect((reloaded.body.event as { title: string }).title).toBe('Standup');
-
-    // MUTATE: mark one occurrence done via the op, read it back through the marks
-    // route, then clear it.
-    const marked = await call('POST', '/api/instance/utility/ops/mark-occurrence', {
-      token,
-      json: { eventId, occurredOn: '2026-07-24', state: 'done' },
-    });
-    expect(marked.status).toBe(200);
-    expect((marked.body.mark as { state: string }).state).toBe('done');
-
-    const marks = await call('GET', `/api/system/calendars/${calendarId}/marks`, { token });
-    expect((marks.body.marks as { occurredOn: string }[]).map((m) => m.occurredOn)).toEqual(['2026-07-24']);
-
-    expect((await call('POST', '/api/instance/utility/ops/clear-occurrence', {
-      token,
-      json: { eventId, occurredOn: '2026-07-24' },
-    })).status).toBe(200);
-    expect((await call('GET', `/api/system/calendars/${calendarId}/marks`, { token })).body.marks).toEqual([]);
-
-    // PATCH the event, then DELETE it.
-    const patched = await call('PATCH', `/api/system/calendar/events/${eventId}`, {
-      token,
-      json: { title: 'Daily Standup' },
-    });
-    expect((patched.body.event as { title: string }).title).toBe('Daily Standup');
-    expect((await call('DELETE', `/api/system/calendar/events/${eventId}`, { token })).status).toBe(200);
-    expect((await call('GET', `/api/system/calendar/events/${eventId}`, { token })).status).toBe(404);
-    expect((await call('DELETE', `/api/system/calendars/${calendarId}`, { token })).status).toBe(200);
-  });
-
-  it('is tenant-isolated: an event under B’s claim cannot target A’s calendar (404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const calendarId = ((await call('POST', '/api/system/calendars', { token: a, json: { title: 'A-cal' } }))
-      .body.calendar as { id: string }).id;
-
-    // B naming A's calendar id writes nothing — the repo re-earns tenancy through
-    // the FK chain to `cal_calendars`, so the route reports 404.
-    const foreignEvent = await call('POST', '/api/system/calendar/events', {
-      token: b,
-      json: { calendarId, title: 'intruder', startsAt: '2026-07-24T09:00:00.000Z' },
-    });
-    expect(foreignEvent.status).toBe(404);
-    expect((await call('GET', '/api/system/calendars', { token: b })).body.calendars).toEqual([]);
-  });
-});
-
-/* ------------------------------------------------------------ lists -------- */
-
-describe('§4 vertical — lists (knowledge)', () => {
-  it('round-trips list→column→row→typed-cell through mixin + reorder op + repo', async () => {
-    const token = mint(TENANT_A);
-
-    const created = await call('POST', '/api/knowledge/lists', { token, json: { title: 'Inventory' } });
-    expect(created.status).toBe(201);
-    const listId = (created.body.list as { id: string }).id;
-    expect((await call('GET', '/api/knowledge/lists', { token })).body.lists).toHaveLength(1);
-
-    // A NUMBER column — the whole point of the typed-cell design.
-    const col = await call('POST', `/api/knowledge/lists/${listId}/columns`, {
-      token,
-      json: { name: 'Qty', colType: 'number', position: 1 },
-    });
-    expect(col.status).toBe(201);
-    const columnId = (col.body.column as { id: string }).id;
-
-    // Two rows, each with a numeric cell that would mis-sort under a shared TEXT column.
-    const rowIds: string[] = [];
-    for (const [i, qty] of [10, 2].entries()) {
-      const row = await call('POST', `/api/knowledge/lists/${listId}/rows`, { token, json: { position: i + 1 } });
-      expect(row.status).toBe(201);
-      const rowId = (row.body.row as { id: string }).id;
-      rowIds.push(rowId);
-      const cell = await call('PUT', `/api/knowledge/lists/rows/${rowId}/cells/${columnId}`, { token, json: { value: qty } });
-      expect(cell.status).toBe(200);
-    }
-
-    // A class mismatch is a typed 400 from the repo, not a silent coercion.
-    const bad = await call('PUT', `/api/knowledge/lists/rows/${rowIds[0]}/cells/${columnId}`, {
-      token,
-      json: { value: 'not-a-number' },
-    });
-    expect(bad.status).toBe(400);
-    expect((bad.body.error as { code: string }).code).toBe('LIST_VALUE_TYPE_MISMATCH');
-
-    // The typed sort returns 2,10 — not the class-first 10,2 a TEXT column gives.
-    const sorted = await call('GET', `/api/knowledge/lists/${listId}/sorted/${columnId}`, { token });
-    expect((sorted.body.rows as { value: number }[]).map((r) => r.value)).toEqual([2, 10]);
-
-    // The reorder-column OP is ONE update.
-    const reordered = await call('POST', '/api/instance/board/ops/reorder-list-column', {
-      token,
-      json: { columnId, position: 9 },
-    });
-    expect(reordered.status).toBe(200);
-    expect(reordered.body.reordered).toBe(true);
-
-    // DELETE the list — columns, rows and cells cascade.
-    expect((await call('DELETE', `/api/knowledge/lists/${listId}`, { token })).status).toBe(200);
-    expect((await call('GET', '/api/knowledge/lists', { token })).body.lists).toEqual([]);
-  });
-
-  it('reads every stored cell of a list, decoded to its declared class (03 §1b)', async () => {
-    // The grid read. Without it a client renders a list by issuing one sorted
-    // request per column and joining them by row id.
-    const token = mint(TENANT_A);
-    const listId = ((await call('POST', '/api/knowledge/lists', { token, json: { title: 'Grid' } })).body.list as { id: string }).id;
-    const textCol = ((await call('POST', `/api/knowledge/lists/${listId}/columns`, {
-      token,
-      json: { name: 'name', colType: 'text', position: 1 },
-    })).body.column as { id: string }).id;
-    const numCol = ((await call('POST', `/api/knowledge/lists/${listId}/columns`, {
-      token,
-      json: { name: 'count', colType: 'number', position: 2 },
-    })).body.column as { id: string }).id;
-    const rowId = ((await call('POST', `/api/knowledge/lists/${listId}/rows`, { token, json: { position: 1 } })).body.row as { id: string }).id;
-    await call('PUT', `/api/knowledge/lists/rows/${rowId}/cells/${textCol}`, { token, json: { value: 'alpha' } });
-    await call('PUT', `/api/knowledge/lists/rows/${rowId}/cells/${numCol}`, { token, json: { value: 10 } });
-
-    const cells = (await call('GET', `/api/knowledge/lists/${listId}/cells`, { token })).body.cells as {
-      rowId: string;
-      columnId: string;
-      value: unknown;
-    }[];
-    expect(cells).toHaveLength(2);
-    expect(cells.find((cell) => cell.columnId === textCol)?.value).toBe('alpha');
-    // A NUMBER, not the string "10" — the class the column declared.
-    expect(cells.find((cell) => cell.columnId === numCol)?.value).toBe(10);
-    expect(cells.every((cell) => cell.rowId === rowId)).toBe(true);
-
-    // Another tenant reads zero cells of the same list id — never a 403 that
-    // would confirm the list exists.
-    expect((await call('GET', `/api/knowledge/lists/${listId}/cells`, { token: mint(TENANT_B) })).body.cells).toEqual([]);
-  });
-
-  it('is tenant-isolated: B cannot read A’s list or plant a column under it (404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const listId = ((await call('POST', '/api/knowledge/lists', { token: a, json: { title: 'A-list' } }))
-      .body.list as { id: string }).id;
-
-    expect((await call('GET', '/api/knowledge/lists', { token: b })).body.lists).toEqual([]);
-    expect((await call('GET', `/api/knowledge/lists/${listId}`, { token: b })).status).toBe(404);
-    const foreignColumn = await call('POST', `/api/knowledge/lists/${listId}/columns`, {
-      token: b,
-      json: { name: 'x', colType: 'text', position: 1 },
-    });
-    expect(foreignColumn.status).toBe(404);
-  });
-});
-
-/* ------------------------------------------------------------ contacts ----- */
-
-describe('§4 vertical — contacts (knowledge)', () => {
-  it('round-trips contact CRUD + a vCard-UID conflict (409)', async () => {
-    const token = mint(TENANT_A);
-
-    const created = await call('POST', '/api/knowledge/contacts', {
-      token,
-      json: { displayName: 'Ada Lovelace', vcardUid: 'uid-ada', birthday: '1815-12-10' },
-    });
-    expect(created.status).toBe(201);
-    const id = (created.body.contact as { id: string }).id;
-    expect((await call('GET', '/api/knowledge/contacts', { token })).body.contacts).toHaveLength(1);
-
-    // A second contact with the SAME vCard UID is a typed 409, not a raw 500.
-    const dup = await call('POST', '/api/knowledge/contacts', {
-      token,
-      json: { displayName: 'Impostor', vcardUid: 'uid-ada' },
-    });
-    expect(dup.status).toBe(409);
-    expect((dup.body.error as { code: string }).code).toBe('CONTACT_VCARD_DUPLICATE');
-
-    // The birthday-window query finds Ada by her MM-DD, and PATCH leaves her
-    // display name intact (sparse patch — birthday is untouched).
-    const bdays = await call('GET', '/api/knowledge/contacts/birthdays?from=12-01&to=12-31', { token });
-    expect((bdays.body.contacts as { id: string }[]).map((c) => c.id)).toEqual([id]);
-
-    const patched = await call('PATCH', `/api/knowledge/contacts/${id}`, { token, json: { displayName: 'Ada L.' } });
-    expect((patched.body.contact as { displayName: string; birthday?: string }).displayName).toBe('Ada L.');
-    expect((patched.body.contact as { birthday?: string }).birthday).toBe('1815-12-10');
-
-    expect((await call('DELETE', `/api/knowledge/contacts/${id}`, { token })).status).toBe(200);
-    expect((await call('GET', '/api/knowledge/contacts', { token })).body.contacts).toEqual([]);
-  });
-
-  it('is tenant-isolated: B cannot read or delete A’s contact (404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const id = ((await call('POST', '/api/knowledge/contacts', { token: a, json: { displayName: 'A-only' } }))
-      .body.contact as { id: string }).id;
-    expect((await call('GET', `/api/knowledge/contacts/${id}`, { token: b })).status).toBe(404);
-    expect((await call('DELETE', `/api/knowledge/contacts/${id}`, { token: b })).status).toBe(404);
-  });
-});
-
-/* ------------------------------------------------------------ family ------- */
-
-describe('§4 vertical — family (knowledge)', () => {
-  it('round-trips people→partnership→event + subgraph through mixin + repo', async () => {
-    const token = mint(TENANT_A);
-
-    const a = ((await call('POST', '/api/knowledge/family/people', { token, json: { displayName: 'Alice' } }))
-      .body.person as { id: string }).id;
-    const b = ((await call('POST', '/api/knowledge/family/people', { token, json: { displayName: 'Bob' } }))
-      .body.person as { id: string }).id;
-    expect((await call('GET', '/api/knowledge/family/people', { token })).body.people).toHaveLength(2);
-
-    const partnership = await call('POST', '/api/knowledge/family/partnerships', {
-      token,
-      json: { aId: a, bId: b, kind: 'marriage' },
-    });
-    expect(partnership.status).toBe(201);
-
-    // The subgraph rooted at Alice reaches Bob through the partnership edge.
-    const graph = await call('GET', `/api/knowledge/family/people/${a}/subgraph?depth=2`, { token });
-    expect((graph.body.people as { id: string }[]).map((p) => p.id).sort()).toEqual([a, b].sort());
-    expect(graph.body.partnerships).toHaveLength(1);
-
-    const event = await call('POST', '/api/knowledge/family/events', {
-      token,
-      json: { personId: a, kind: 'birth', at: '1990-01-01' },
-    });
-    expect(event.status).toBe(201);
-    expect((await call('GET', `/api/knowledge/family/people/${a}/events`, { token })).body.events).toHaveLength(1);
-
-    // Deleting Alice cascades her partnerships and events.
-    expect((await call('DELETE', `/api/knowledge/family/people/${a}`, { token })).status).toBe(200);
-    expect((await call('GET', '/api/knowledge/family/partnerships', { token })).body.partnerships).toEqual([]);
-  });
-
-  it('is tenant-isolated: B cannot partner A’s person (404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const aliceId = ((await call('POST', '/api/knowledge/family/people', { token: a, json: { displayName: 'Alice' } }))
-      .body.person as { id: string }).id;
-    // B's own person, then B tries to partner it to A's Alice — the repo guards
-    // BOTH people, so a cross-tenant edge writes nothing → 404.
-    const bobId = ((await call('POST', '/api/knowledge/family/people', { token: b, json: { displayName: 'Bob' } }))
-      .body.person as { id: string }).id;
-    const foreign = await call('POST', '/api/knowledge/family/partnerships', {
-      token: b,
-      json: { aId: bobId, bId: aliceId },
-    });
-    expect(foreign.status).toBe(404);
-    expect((await call('GET', `/api/knowledge/family/people/${aliceId}`, { token: b })).status).toBe(404);
-  });
-});
-
-/* ------------------------------------------------------------ oral hist ---- */
-
-describe('§4 vertical — oral history (knowledge)', () => {
-  it('round-trips recording→segment through mixin + repo', async () => {
-    const token = mint(TENANT_A);
-
-    const created = await call('POST', '/api/knowledge/recordings', {
-      token,
-      json: { title: 'Grandpa’s story', mediaFileId: 'cc://asset/itm_1' },
-    });
-    expect(created.status).toBe(201);
-    const recordingId = (created.body.recording as { id: string }).id;
-    expect((await call('GET', '/api/knowledge/recordings', { token })).body.recordings).toHaveLength(1);
-
-    const segment = await call('POST', `/api/knowledge/recordings/${recordingId}/segments`, {
-      token,
-      json: { seq: 1, startMs: 0, endMs: 5000, transcript: 'Once upon a time' },
-    });
-    expect(segment.status).toBe(201);
-    const segmentId = (segment.body.segment as { id: string }).id;
-
-    const patched = await call('PATCH', `/api/knowledge/segments/${segmentId}`, {
-      token,
-      json: { transcript: 'Once upon a time, in a land far away' },
-    });
-    expect((patched.body.segment as { transcript: string }).transcript).toBe('Once upon a time, in a land far away');
-    // The other cells survive the sparse patch.
-    expect((patched.body.segment as { endMs: number }).endMs).toBe(5000);
-
-    expect((await call('GET', `/api/knowledge/recordings/${recordingId}/segments`, { token })).body.segments).toHaveLength(1);
-
-    // Deleting the recording cascades its segments.
-    expect((await call('DELETE', `/api/knowledge/recordings/${recordingId}`, { token })).status).toBe(200);
-    expect((await call('GET', `/api/knowledge/recordings/${recordingId}/segments`, { token })).body.segments).toEqual([]);
-  });
-
-  it('is tenant-isolated: B cannot add a segment to A’s recording (404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const recordingId = ((await call('POST', '/api/knowledge/recordings', { token: a, json: { title: 'A-only' } }))
-      .body.recording as { id: string }).id;
-    const foreign = await call('POST', `/api/knowledge/recordings/${recordingId}/segments`, {
-      token: b,
-      json: { seq: 1, startMs: 0, endMs: 1, transcript: 'intruder' },
-    });
-    expect(foreign.status).toBe(404);
-    expect((await call('GET', `/api/knowledge/recordings/${recordingId}`, { token: b })).status).toBe(404);
-  });
-});
-
-/* ------------------------------------------------------------ time off ----- */
-
-describe('§4 vertical — time off (system)', () => {
-  it('round-trips policy→request→approve/cancel through mixin + ops + repo, balance reconciling', async () => {
-    const token = mint(TENANT_A);
-
-    const policy = await call('POST', '/api/system/timeoff/policies', {
-      token,
-      json: { title: 'PTO', accrualDays: 20 },
-    });
-    expect(policy.status).toBe(201);
-    const policyId = (policy.body.policy as { id: string }).id;
-    expect((await call('GET', '/api/system/timeoff/policies', { token })).body.policies).toHaveLength(1);
-
-    // A fresh policy has a zero balance — nothing debited yet.
-    expect((await call('GET', `/api/system/timeoff/balance?policyId=${policyId}`, { token })).body.balance).toBe(0);
-
-    // File a 3-day request, then APPROVE it via the op — the approval debits the
-    // ledger exactly once, so the balance is -3 and the ledger has one row.
-    const request = await call('POST', '/api/system/timeoff/requests', {
-      token,
-      json: { policyId, startsOn: '2026-08-01', endsOn: '2026-08-03', days: 3 },
-    });
-    expect(request.status).toBe(201);
-    const requestId = (request.body.request as { id: string }).id;
-
-    const approved = await call('POST', '/api/instance/utility/ops/approve-timeoff', { token, json: { id: requestId } });
-    expect(approved.status).toBe(200);
-    expect((approved.body.request as { status: string }).status).toBe('approved');
-    expect((await call('GET', `/api/system/timeoff/balance?policyId=${policyId}`, { token })).body.balance).toBe(-3);
-    expect((await call('GET', `/api/system/timeoff/ledger?policyId=${policyId}`, { token })).body.ledger).toHaveLength(1);
-
-    // A SECOND approve is a no-op (the request is no longer pending) → typed 404.
-    expect((await call('POST', '/api/instance/utility/ops/approve-timeoff', { token, json: { id: requestId } })).status).toBe(404);
-
-    // Cancelling the approved request credits the 3 days back — the balance nets to 0.
-    const cancelled = await call('POST', '/api/instance/utility/ops/cancel-timeoff', { token, json: { id: requestId } });
-    expect(cancelled.status).toBe(200);
-    expect((cancelled.body.request as { status: string }).status).toBe('cancelled');
-    expect((await call('GET', `/api/system/timeoff/balance?policyId=${policyId}`, { token })).body.balance).toBe(0);
-  });
-
-  it('deny never debits, and is tenant-isolated (B cannot decide A’s request — 404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const policyId = ((await call('POST', '/api/system/timeoff/policies', { token: a, json: { title: 'PTO' } }))
-      .body.policy as { id: string }).id;
-    const requestId = ((await call('POST', '/api/system/timeoff/requests', {
-      token: a,
-      json: { policyId, startsOn: '2026-08-01', endsOn: '2026-08-02', days: 2 },
-    })).body.request as { id: string }).id;
-
-    // B naming A's request id decides nothing — the repo guards the row, so the op
-    // reports 404, existence undisclosed.
-    expect((await call('POST', '/api/instance/utility/ops/deny-timeoff', { token: b, json: { id: requestId } })).status).toBe(404);
-    expect((await call('GET', '/api/system/timeoff/requests', { token: b })).body.requests).toEqual([]);
-
-    // A's own deny transitions the request but moves no ledger — the balance stays 0.
-    const denied = await call('POST', '/api/instance/utility/ops/deny-timeoff', { token: a, json: { id: requestId } });
-    expect(denied.status).toBe(200);
-    expect((denied.body.request as { status: string }).status).toBe('denied');
-    expect((await call('GET', `/api/system/timeoff/balance?policyId=${policyId}`, { token: a })).body.balance).toBe(0);
-  });
-});
-
-/* ------------------------------------------------------------ budgets ------ */
-
-describe('§4 vertical — budgets (system)', () => {
-  it('round-trips budget→entries→spend through mixin + repo', async () => {
-    const token = mint(TENANT_A);
-
-    const budget = await call('POST', '/api/system/budgets', {
-      token,
-      json: { title: 'Groceries', period: 'monthly', amountCents: 50000, currency: 'USD' },
-    });
-    expect(budget.status).toBe(201);
-    const budgetId = (budget.body.budget as { id: string }).id;
-    expect((await call('GET', '/api/system/budgets', { token })).body.budgets).toHaveLength(1);
-
-    // Two entries; spend folds them in integer cents (no float touches money).
-    for (const [occurredOn, amountCents] of [['2026-08-02', 1299], ['2026-08-05', 3401]] as const) {
-      const entry = await call('POST', `/api/system/budgets/${budgetId}/entries`, {
-        token,
-        json: { occurredOn, amountCents, category: 'food' },
-      });
-      expect(entry.status).toBe(201);
-    }
-    expect((await call('GET', `/api/system/budgets/${budgetId}/entries`, { token })).body.entries).toHaveLength(2);
-    expect((await call('GET', `/api/system/budgets/${budgetId}/spend`, { token })).body.spend).toBe(4700);
-
-    // Sparse PATCH leaves the currency intact while raising the cap.
-    const patched = await call('PATCH', `/api/system/budgets/${budgetId}`, { token, json: { amountCents: 60000 } });
-    expect((patched.body.budget as { amountCents: number; currency: string }).amountCents).toBe(60000);
-    expect((patched.body.budget as { currency: string }).currency).toBe('USD');
-
-    // Deleting the budget cascades its entries.
-    expect((await call('DELETE', `/api/system/budgets/${budgetId}`, { token })).status).toBe(200);
-    expect((await call('GET', '/api/system/budgets', { token })).body.budgets).toEqual([]);
-  });
-
-  it('is tenant-isolated: B cannot plant an entry under A’s budget, or read/delete it (404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const budgetId = ((await call('POST', '/api/system/budgets', { token: a, json: { title: 'A-budget' } }))
-      .body.budget as { id: string }).id;
-
-    expect((await call('GET', '/api/system/budgets', { token: b })).body.budgets).toEqual([]);
-    // B naming A's budget id writes nothing — the repo guards the parent → 404.
-    const foreignEntry = await call('POST', `/api/system/budgets/${budgetId}/entries`, {
-      token: b,
-      json: { occurredOn: '2026-08-01', amountCents: 100 },
-    });
-    expect(foreignEntry.status).toBe(404);
-    expect((await call('DELETE', `/api/system/budgets/${budgetId}`, { token: b })).status).toBe(404);
-    // …and A's budget still has no entries.
-    expect((await call('GET', `/api/system/budgets/${budgetId}/entries`, { token: a })).body.entries).toEqual([]);
-  });
-});
-
-/* ------------------------------------------------------------ subs --------- */
-
-describe('§4 vertical — subscriptions (system)', () => {
-  it('round-trips subscription CRUD + idempotent cancel via the op', async () => {
-    const token = mint(TENANT_A);
-
-    const created = await call('POST', '/api/system/subscriptions', {
-      token,
-      json: { title: 'Streaming', amountCents: 1599, cadence: 'monthly' },
-    });
-    expect(created.status).toBe(201);
-    const id = (created.body.subscription as { id: string }).id;
-
-    // A default list excludes cancelled; it has our one active subscription.
-    expect((await call('GET', '/api/system/subscriptions', { token })).body.subscriptions).toHaveLength(1);
-
-    // Cancel via the op — idempotent: the second cancel is a no-op → typed 404.
-    const cancelled = await call('POST', '/api/instance/utility/ops/cancel-subscription', { token, json: { id } });
-    expect(cancelled.status).toBe(200);
-    expect((cancelled.body.subscription as { cancelledAt?: string }).cancelledAt).toBeTruthy();
-    expect((await call('POST', '/api/instance/utility/ops/cancel-subscription', { token, json: { id } })).status).toBe(404);
-
-    // The default list now hides it; includeCancelled surfaces it again.
-    expect((await call('GET', '/api/system/subscriptions', { token })).body.subscriptions).toEqual([]);
-    expect((await call('GET', '/api/system/subscriptions?includeCancelled=true', { token })).body.subscriptions).toHaveLength(1);
-  });
-
-  it('is tenant-isolated: B cannot cancel A’s subscription (404)', async () => {
-    const a = mint(TENANT_A);
-    const b = mint(TENANT_B);
-    const id = ((await call('POST', '/api/system/subscriptions', { token: a, json: { title: 'A-sub' } }))
-      .body.subscription as { id: string }).id;
-    expect((await call('POST', '/api/instance/utility/ops/cancel-subscription', { token: b, json: { id } })).status).toBe(404);
-    expect((await call('GET', '/api/system/subscriptions', { token: b })).body.subscriptions).toEqual([]);
-  });
-});
-
-/* ------------------------------------------------- server ↔ client wire ---- */
-
-/**
- * 🔴 The BOTH-DIRECTIONS gate for the wire contract (01 §6.2 items 3–4,
- * frontier item 16).
- *
- * Everything else about this contract is checked on one side or the other:
- * `rowSpecs.spec.ts` proves a spec cannot drift from its view interface,
- * `wireEnvelope.spec.ts` proves a bad body is refused, and the suites above
- * prove a route persists what it was given. None of them proves the thing that
- * actually broke here twice — that the body a REAL route emits is the body the
- * REAL client reader expects.
- *
- * So these cases take rows through the production `composeServer`, hand the
- * response to the catalog's own `resource.read`, and let it judge. The wire
- * policy is `throw` under `NODE_ENV=test`, so any disagreement — a renamed
- * envelope key, a row missing a field its view promises unconditionally, a
- * repository handing back a NULL where a string was declared — fails here,
- * on the author, instead of rendering an empty list for a customer.
- *
- * The rows are created rather than fixtured on purpose: a fixture asserts
- * against itself (`§D`), and an empty listing would prove the envelope while
- * proving nothing at all about the rows.
- */
-describe('the client reader and the real route agree (item 16)', () => {
-  it('kanban: boards, columns and cards all read through the catalog', async () => {
-    const token = mint(TENANT_A);
-    const boardId = ((await call('POST', '/api/knowledge/boards', { token, json: { title: 'Sprint' } })).body.board as { id: string }).id;
-    const columnId = ((
-      await call('POST', `/api/knowledge/boards/${boardId}/columns`, { token, json: { title: 'Todo', position: 1 } })
-    ).body.column as { id: string }).id;
-    await call('POST', `/api/knowledge/columns/${columnId}/cards`, { token, json: { title: 'Ship it', position: 1 } });
-
-    const boards = await call('GET', '/api/knowledge/boards', { token });
-    expect(KNOWLEDGE_BOARDS.read(boards.body, KNOWLEDGE_BOARDS.id).items).toHaveLength(1);
-
-    const columns = await call('GET', `/api/knowledge/boards/${boardId}/columns`, { token });
-    expect(KNOWLEDGE_BOARD_COLUMNS.read(columns.body, KNOWLEDGE_BOARD_COLUMNS.id).items).toHaveLength(1);
-
-    // `KanbanCardView.labels` is a REQUIRED array. A route that omitted it —
-    // trivially easy, since the column it comes from is a JSON string — would
-    // fail right here rather than in a board that renders no labels.
-    const cards = await call('GET', `/api/knowledge/boards/${boardId}/cards`, { token });
-    const page = KNOWLEDGE_BOARD_CARDS.read(cards.body, KNOWLEDGE_BOARD_CARDS.id);
-    expect(page.items).toHaveLength(1);
-    expect(Array.isArray(page.items[0]?.labels)).toBe(true);
-  });
-
-  it('asset: the vault-source listing reads through the catalog', async () => {
-    const token = mint(TENANT_A);
-    await call('POST', '/api/asset/sources', { token, json: { kind: 'directory', title: 'Photos', rootKey: 'media/photos' } });
-    const listed = await call('GET', '/api/asset/sources', { token });
-    // Five required fields, including the `readOnly` boolean that decides
-    // whether the UI offers a write control at all.
-    expect(ASSET_SOURCES.read(listed.body, ASSET_SOURCES.id).items[0]).toMatchObject({ readOnly: false });
-  });
-
-  it('system: the calendar listing reads through the catalog', async () => {
-    const token = mint(TENANT_A);
-    const calendarId = ((await call('POST', '/api/system/calendars', { token, json: { title: 'Work' } })).body.calendar as { id: string }).id;
-    await call('POST', '/api/system/calendar/events', {
-      token,
-      json: { calendarId, title: 'Standup', startsAt: '2026-07-24T09:00:00.000Z' },
-    });
-    // The range is REQUIRED (`400 CALENDAR_RANGE_MISSING`) and the descriptor now
-    // says so — `SYSTEM_CALENDAR.requiredParams`. Writing this test without them
-    // is how that gap was found.
-    expect(SYSTEM_CALENDAR.requiredParams).toEqual(['from', 'to']);
-    const events = await call('GET', '/api/system/calendar?from=2026-07-01&to=2026-07-31', { token });
-    expect(SYSTEM_CALENDAR.read(events.body, SYSTEM_CALENDAR.id).items[0]).toMatchObject({ title: 'Standup' });
-  });
-
-  it('knowledge: the PAGED records listing reads through the catalog', async () => {
-    // The paged envelope is a different reader from the keyed one — same
-    // contract, different code path, and the only one that also parses a cursor.
-    const token = mint(TENANT_A);
-    await call('POST', '/api/knowledge/records', { token, json: { type: 'note', title: 'Hello' } });
-    const listed = await call('GET', '/api/knowledge/records', { token });
-    const page = KNOWLEDGE_RECORDS.read(listed.body, KNOWLEDGE_RECORDS.id);
-    expect(page.items).toHaveLength(1);
-    // `tenantId` and `updatedAt` are required on `RecordView` and are exactly
-    // the two a hand-built projection forgets.
-    expect(page.items[0]).toMatchObject({ title: 'Hello', type: 'note' });
-  });
-});