cycle 16 docs: YOLO_NOTES ledger — server.js app export + inline-route tests

1d24359b706d296a23df04d6ab4c6f831b3108d0 · 2026-09-23 23:48:44 -0700 · Steve

Records the require.main-guarded app export (prod boot Cody-proven unchanged via
live pm2 fork-mode probe), the two-pool cleanup fix, the closed cycle-15 q-floor
route-test debt, and the new follow-up: consolidate server.js's duplicate pool
onto lib/db's shared one.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TouFkmUGKHtwqpZwgReVic

Files touched

M YOLO_NOTES.md

Diff

commit 1d24359b706d296a23df04d6ab4c6f831b3108d0
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Sep 23 23:48:44 2026 -0700

    cycle 16 docs: YOLO_NOTES ledger — server.js app export + inline-route tests
    
    Records the require.main-guarded app export (prod boot Cody-proven unchanged via
    live pm2 fork-mode probe), the two-pool cleanup fix, the closed cycle-15 q-floor
    route-test debt, and the new follow-up: consolidate server.js's duplicate pool
    onto lib/db's shared one.
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01TouFkmUGKHtwqpZwgReVic
---
 YOLO_NOTES.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/YOLO_NOTES.md b/YOLO_NOTES.md
index 1d049a2..53f60b9 100644
--- a/YOLO_NOTES.md
+++ b/YOLO_NOTES.md
@@ -376,3 +376,19 @@ Canonical apply order now: `004_marketplace → 005_apple → 006_contacts → 0
 **Cost:** $0 (local + one Cody pass — which independently ran EXPLAIN/benchmarks against the dev DB, confirming the 20x and the write cost rather than trusting my numbers).
 
 **Backlog:** approval-enforcement decision on Steve's desk; the inline-server-route test harness (export app for testability); provider-honored idempotency key + sig-encoding (live-only); processorFee schema prerequisite. Next cycle: the server.js testability refactor (unlocks testing ~20 inline routes), or another fresh Cody-driven audit.
+
+## /yoloforever CYCLE 16 (2026-09-23, yf-costa) — make inline server.js routes testable
+
+**Closed the test-harness gap Cody surfaced in cycle 15.** The ~20 inline `server.js` routes had ZERO coverage because server.js called `app.listen` on import and never exported the app.
+
+**Refactor:** `module.exports = app` + guard `preflight.runPreflight()` + `app.listen` behind `if (require.main === module)`; expose the module-scoped pg pool on `app.locals.pool` so tests can close it. **Prod boot unchanged** — server.js is started only via `node server.js` (pm2 fork mode + `npm start`), where `require.main === module` is true. Nothing in the repo imports `./server` (grep-confirmed) except the new test.
+
+**Cody gate — prod boot verified BULLETPROOF, empirically (not reasoned):** Cody read pm2 6.0.14 source AND ran a live fork-mode probe — `ProcessContainerFork` does `_load(script, null, /*isMain*/ true)`, so `require.main === module` is true the whole time server.js runs, and the same holds even if someone later adds cluster `instances`. preflight-below-export is behaviorally identical (a throw still crashes the pm2 child pre-listen → autorestart).
+
+**Cody caught a real latent TEST bug + fixed:** server.js maintains its OWN pg pool separate from `lib/db.js`'s shared pool (the mounted sub-routers use lib/db's). Importing server.js creates BOTH; the cleanup only closed `app.locals.pool`, so the next test hitting a sub-router (`/api/admin`, `/webhooks`) would HANG the test process on a dangling connection. Now closes both.
+
+**Tests (+5, suite 185 → 190, new `test/server-routes.test.js`, real dev DB via the exported app on an ephemeral port):** closes the cycle-15 debt — the **`/api/places` q>=2 floor now has a real route test** (1-char q → full unfiltered count; a >=2 term filters) — plus the basic-auth gate (401 unauthenticated), pagination Link header, limit clamp, `/health` liveness.
+
+**Cost:** $0 (local + one Cody pass — which read pm2's source and ran a live fork-mode probe to prove the boot path rather than trust the grep).
+
+**Backlog:** **NEW follow-up (Cody root-cause):** server.js duplicates `lib/db`'s "single shared" pool instead of requiring it — consolidate to one pool (the test-hang was just the first symptom). Plus: approval-enforcement decision on Steve's desk; provider-honored idempotency key + sig-encoding (live-only); processorFee schema prerequisite; per-event webhook auto-reply try/catch. Next cycle: the pool consolidation, more inline-route coverage now that they're testable, or another fresh Cody audit.

← 2d3cca4 costa-rica: export the app from server.js so inline routes a · back to Costa Rica · costa-rica: consolidate server.js onto lib/db's shared pool f45a796 →