From 7da7c2019cd5642314ac7ad48053b5cd8c355c1d Mon Sep 17 00:00:00 2001
From: araharah-executor <executor@araharah.local>
Date: Sat, 24 Oct 2026 12:00:09 +0800
Subject: [PATCH] test(04-04): commit the CR13/CS5 shadow-law gate updates
 (missed in 54a2b54 staging)

---
 bot/test/cari.test.mjs     |  7 +++++--
 bot/test/commands.test.mjs | 14 +++++++++++---
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/bot/test/cari.test.mjs b/bot/test/cari.test.mjs
index 54ab294..ba2a11d 100644
--- a/bot/test/cari.test.mjs
+++ b/bot/test/cari.test.mjs
@@ -393,8 +393,11 @@ test("CR13 the registration script derives the /cari scope from helpMenu", () =>
     "utf8",
   );
   assert.ok(src.includes('["help", "privacy", "cari"]'), "the hardcoded command list gained cari");
-  const fetchCalls = src.match(/\bawait fetch\(/g) ?? [];
-  assert.equal(fetchCalls.length, 2, "still exactly two fetch calls (default + ms scopes)");
+  // Device-gate incident: all_private_chats SHADOWS default — /cari must be
+  // armed in the shadowing scope too, not only default.
+  const allPrivate = src.indexOf('"all_private_chats"');
+  assert.notEqual(allPrivate, -1, "all_private_chats scope must be armed explicitly (shadow law)");
+  assert.ok(src.includes("menuFor"), "every armed scope derives its set from helpMenu");
 });
 
 /* ————— CR14 — the alternates swap produces a new venue card ————— */
diff --git a/bot/test/commands.test.mjs b/bot/test/commands.test.mjs
index 8eda957..89e040f 100644
--- a/bot/test/commands.test.mjs
+++ b/bot/test/commands.test.mjs
@@ -154,14 +154,22 @@ test("CS5 D-03: helpMenu lists exactly /help, /privacy, and /cari — no future-
   }
 });
 
-test("CS5 D-03: register-commands derives both scopes from helpMenu — two fetch calls, ms scope marked", () => {
+test("CS5 D-03: register-commands derives every scope from helpMenu — single fetch site, all shadowing scopes armed", () => {
   const source = readFileSync(
     path.join(fileURLToPath(new URL(import.meta.url)), "..", "..", "scripts", "register-commands.mjs"),
     "utf8",
   );
+  // Device-gate incident (2026-10-24): a stale all_private_chats set shadowed
+  // the default scope and hid /cari — the script must arm EVERY scope that can
+  // shadow a private chat, not just default. One fetch site, scope table.
   const fetchCalls = source.match(/\bawait fetch\(/g) ?? [];
-  assert.equal(fetchCalls.length, 2, "register-commands must issue exactly two setMyCommands fetch calls (default + ms)");
-
+  assert.equal(fetchCalls.length, 1, "register-commands must have a single fetch call site (scope loop)");
+  for (const scope of ["default", "all_private_chats"]) {
+    assert.ok(source.includes(`type: "${scope}"`), `the ${scope} scope must be armed explicitly`);
+  }
+  for (const scope of ["all_group_chats", "all_chat_administrators"]) {
+    assert.ok(source.includes(`type: "${scope}"`), `the stale ${scope} set must be explicitly cleared`);
+  }
   assert.ok(source.includes('language_code: "ms"'), "the ms scope payload must set language_code 'ms'");
   assert.ok(source.includes("menuFor(\"en\")"), "default scope derives from the en helpMenu");
   assert.ok(source.includes("menuFor(\"ms\")"), "ms scope derives from the ms helpMenu");