feat(board): Board Programs — the complete twelve-program catalog (Phases 1-3) (#699)

* feat(board): Pest Control — the first project-scoped Board Program

The Product Owner hunts latent defects (what the org records but nobody
reads): a weekly cycle — accelerated off-schedule when the trailing-7-day
rework rate crosses pest_rework_threshold, with the cheap dedup/scope gates
evaluated before the metrics queries — opens one held exploration task
against the least-recently-explored opted-in project (deterministic
round-robin; opted_in_projects gains a stable ORDER BY), with server-
assembled evidence in the spawn prompt (rework hotspots, recurring-findings
and waived-minor ledger aggregates, all capped) plus prior-cycle LEARN
context. The PO calls the new PO-only propose_bug_hunt verb once: ≤5 items,
evidence required per item, targets validated against pest_control
participation. CEO decides per item — approve materializes a BACKLOG task
(source pest_control, never auto-starts), reject records the reason; both
feed the LEARN ledger by exploration task id; all-terminal completes the
cycle. Telegram queue pushes carry working Approve/Reject handlers
mirroring the roadmap kind. Doctrine: board.md Pest Control section +
product-owner verb entry + regenerated verb tables.

* feat(panel): Pest Control review queue

Command Center gains the pest review queue (per-item approve/reject with
reason, mirroring the roadmap queue); the Programs card and the project
settings participates-in checkboxes pick the new program up registry-driven
— the settings section renders for the first time now that a project-scoped
program exists.

* feat(board): Periscope — HoM market-research brief program

Weekly org-scoped cycle: a solo HoM spawn researches the market (web
research with mandatory source URLs — uncited findings are rejected) and
files one structured brief via the new HoM-only propose_market_brief verb:
headline, cited findings, threats/opportunities, positioning note, all
soup-checked and screened through the injection guard at persist time
(web-derived text later reaches prompts; flags recorded, content never
dropped). A brief is a report, not a proposal: the verb completes the
exploration in the same call (the x_feature asymmetry), the cycle ledger
auto-closes, and the CEO gets a best-effort notification with no
approve/reject surface (periscope deliberately never joins Telegram's
action kinds). The latest brief is injected into the roadmap exploration
prompt — Periscope feeds Printer, the first cross-role program input.

* feat(panel): Market Briefs tab (read-only)

Business page gains a Market Briefs tab listing Periscope briefs —
headline, cited findings, threats/opportunities — read-only by design; a
report has nothing to approve.

* feat(board): Coroner — event-triggered Auditor postmortems

The first EVENT program: no cron — three best-effort hooks open an autopsy
when a task bounces to its 3rd revision (the audit chokepoint), is
cancelled after work started, or is budget-blocked; all gated on arming +
one-open-autopsy dedup, none can fail the underlying transition. A solo
Auditor spawn reads the incident (server-assembled findings + transition
context) and files one propose_postmortem: incident summary, root cause,
failed stage (validated against the real status vocabulary), and ONE
process change — a playbook-kind change drafts via PlaybookService
directly into the normal pending-curation queue; the briefed draft_playbook
manifest grant was deliberately NOT added, preserving the existing
'auditor curates but never drafts' invariant test. Complete-at-propose
(report asymmetry), cycle ledger auto-closes, CEO notified link-only.
Integrated as a union with Periscope across the shared program surfaces.

* feat(panel): Coroner postmortems card

Read-only postmortems list under Business → Programs — incident, root
cause, failed stage, process change; nothing to approve, the process-change
artifact (a draft playbook) rides the existing curation queue.

* feat(board): Sentinel — Auditor drift-watch quality reports

Weekly org-scoped cycle: a solo Auditor spawn receives a server-assembled
drift context (waived-findings trend, open findings by severity,
conventions-violation hotspots, top spend — all capped, pure ORM) and files
one propose_quality_report: headline, 1-7 area-validated items with
evidence and suggested actions, overall assessment. Report semantics —
complete-at-propose, cycle auto-closes, CEO notified display-only (never on
Telegram's approve/reject surface); items are structured so a later
convert-to-task control is cheap. Integration adopts Sentinel's module-
level dict-dispatch for board-program routing (xenon-driven), folding all
prior programs in; app router mounting extracted to a helper for the same
budget.

* feat(panel): Quality Reports tab (read-only)

Business page gains the Sentinel quality-reports tab — headline, per-area
observations with evidence and suggested actions; read-only, a report has
nothing to approve.

* feat(board): Spackle — gap-fill audit program

Biweekly project-scoped PO cycle over the half-shipped surface area: API
routes without panel surfaces (and vice versa), armed flags without docs,
docs promises the code doesn't keep, dead-end tabs — the inventory diffing
is the PO's own read-tool work, ordered by the spawn prompt with file:line
citations required; the server injects only prior-cycle LEARN and the
rotation target. Rotation is now a shared module-level helper
(pick_rotation_target, parameterized by source) both project-scoped
engines use — pest_control delegates to it, behavior-identical, with a
cross-pollution test proving the two programs' rotations stay independent.
propose_gap_fill mirrors the bug-hunt verb (≤5 items, two-sided evidence
required, participation gate); per-item CEO decide materializes BACKLOG
source=spackle tasks; full Telegram kind incl. approve/reject handlers.
All seven program routers now mount from one helper.

* feat(panel): Spackle gap-fill review queue

Command Center gains the gap-fill queue mirroring the pest-control one —
per-item approve/reject with the two-sided gap evidence rendered.

* feat(board): Scales — monthly portfolio rebalance

Org-scoped PO cycle over the stale backlog: the spawn receives a capped
stale-task snapshot (BACKLOG/PENDING unclaimed >30 days) plus the charter
and prior-cycle LEARN, and files one propose_rebalance — 1-7 items, each a
resolvable task_ref with action reprioritize (validated new priority) or
cancel, rationale required. Per-item CEO decide: approve EXECUTES the
action (audited priority update, or the normal cancel path) — the first
program whose materializer mutates existing tasks instead of creating
them; reject records the reason; LEARN by exploration task id;
all-terminal completes the cycle. Full Telegram decide-kind wiring.
Integrated as the eight-program union (registry, dict dispatch, routers
helper, teardown enumerations).

* feat(panel): Scales rebalance review queue

Command Center gains the rebalance queue — per-item approve/reject with
the action, target task, and rationale rendered.

* feat(board): Mirror — quarterly positioning audit

Project-scoped HoM cycle over messaging surfaces: README claims vs shipped
reality, docs-site promises vs code, charter alignment — the audit is the
HoM's own read-tool work with citations required; the server injects the
charter, prior-cycle LEARN, and the shared rotation target. propose_
messaging_fixes mirrors the gap-fill verb (≤5 items, drift evidence naming
claim + contradicting reality, participation gate); per-item CEO decide
materializes BACKLOG source=mirror documentation tasks; full Telegram
decide-kind wiring. Nine-program union across the shared surfaces.

* feat(panel): Mirror messaging-fixes review queue

* feat(board): Megaphone — HoM standing editorial calendar

Cron cycle (3 days, org-scoped, gated on X credentials — drafting content
nobody can post is pointless): the HoM receives a shipped-this-week digest
plus Unreleased changelog bullets and files one propose_editorial_post
(angle-validated, ≤280, brand voice) that materializes a held x_editorial
draft through the SAME X-queue origination chokepoint release posts use —
zero new approval surface, notifications and CEO decide for free.
Complete-at-propose; cycle auto-closes. Ten-program union.

* feat(panel): x_editorial source labels in the X queue surfaces

* feat(board): Librarian — proactive playbook mining

Biweekly org-scoped Auditor cycle: mines recurring non-private learning
journals (≥2-count grouping with a recency fallback) against the existing
playbook-title inventory and files one propose_playbook_drafts — 1-3
drafts, each with the repeated-pattern evidence that justifies it,
duplicate titles rejected in-batch and against the live store. Drafts are
created via PlaybookService directly (the Coroner precedent — the
'auditor curates but never drafts' do-verb invariant stays intact and
tested) and land in the normal pending-curation queue the Auditor's own
triage already surfaces; no new panel surface. Complete-at-propose;
display-only CEO notification. Eleven-program union.

* feat(board): War Room — release campaign planning

EVENT program with a REAL originator (unlike coroner's stub): a release
publish hooks a campaign brief beside the release-post seam, and the CEO's
run-now originates on demand — the cron loop never fires it. The HoM
designs a 2-6 post arc (teaser → launch → follow-up → spotlight; 280-cap,
future strictly-ascending publish_after, stage vocabulary) and one
propose_campaign call materializes each post as a held x_campaign draft
through the X-queue chokepoint. V1 is manual-cadence by design: publish_
after renders as queue guidance and the CEO approves each post at its
moment — nothing auto-posts, ever; the auto-schedule upgrade is a
documented ceiling. Twelve-program union: full registry complete.

* feat(panel): x_campaign labels + publish-after guidance in the X queue

* feat(board): Barfly — adjacent-conversation replies

Cron cycle (2 days, org-scoped, X-credentials gated): the engine searches
X for conversations where RoboCo is relevant but unmentioned (new OAuth-
signed search_recent on the client; queries + candidate cap configurable),
screens every fetched tweet through the injection guard (stored unclamped
— a clamp was truncating the candidate under the envelope, caught by the
dev's own tests), dedupes via the existing x_seen_mentions ledger (no
migration; also prevents double-drafting against the mentions poll), and
opens one held HoM exploration carrying the screened candidates. propose_
conversation_replies enforces candidate-id-only replies (≤5, 280-cap);
each materializes a held x_barfly draft through the X-queue chokepoint,
threaded via a new in_reply_to seam on post_tweet that only x_barfly
drafts use. The X redraft machinery is now dict-dispatch over per-source
extractors with reply-ref carry for x_barfly. Thirteen-program registry.
War Room's test fakes gained the new abstract search_recent stub.

* feat(board): Dogfood — the PO walks the product

The fourteenth and final registry entry, completing the catalog. EVENT
program (release-publish hook beside the war-room hook + CEO run-now, both
through the same real originator; the cron loop never fires it), project-
scoped with shared rotation. The permission surface is the careful part:
the PO's dogfood spawn — and ONLY that spawn — gets the Playwright MCP
mounted, via a task-scoped fail-closed probe mirroring the video-authoring
precedent (a PO spawned for roadmap/pest/scales never sees browser tools;
tested both ways); the PM agent image bakes chromium unconditionally like
the ux image, the mount stays task-gated in code. The walk targets the
rotation target's live surfaces (panel_base_url only when the target is
the org's own project, honest degradation otherwise); propose_friction_
fixes files ≤5 walked-path-evidenced items; per-item CEO decide
materializes BACKLOG source=dogfood tasks; full Telegram decide kind.
Also: megaphone/librarian/war_room arming keys restored to the settings
validator — their panel toggles would have been rejected (dropped in
earlier unions; the same silent-arming class the drill killed once
already).

* feat(panel): Dogfood friction review queue

* chore(board): final whole-branch sweep fixes

The night's closing adversarial pass over the integrated fourteen-program
registry found ONE functional defect — the war-room test fakes' post_tweet
predated Barfly's in_reply_to_tweet_id kwarg (LSP violation, the only red
in an otherwise fully green gate) — plus doc/test drift, all fixed: the
source-parity test completes to fourteen (spackle/mirror were silently
absent while its neighboring comment claimed full coverage), the PO
identity doc gains its missing Dogfood verb, the auditor quick-list gains
propose_postmortem, three stale comments corrected (rotation docstring,
panel registry header, X source enumerations), the dogfood release-hook
gains the exception-swallow test its four sibling hooks already had, and
the CHANGELOG's Unreleased section documents the whole Board Programs
train. Full make quality: exit 0, all gates green.

* docs: full documentation sweep for the Board Programs train

CLAUDE.md's roadmap-engine entry superseded by the Board Program registry
entry (all fourteen programs, arming, scoping, LEARN, guardrails) with the
role verb tables and playwright row refreshed; docs/rag gains the agent-
facing architecture doc plus full propose_* call-shape sections in the
three board role docs, and corrects the strategy-engine section to shipped
reality (only idle→roadmap is wired); docs/map covers the registry + all
twelve engines with flags, gotchas, and drift notes. The 0.27.0 reference
inventory confirmed only the release-executor's canonical set carries the
version — left for the 0.28.0 cut.

* feat(board): human titles + descriptions on every program surface

Raw registry keys rendered as bare panel labels — an operator reading
x_feature had no idea what enabling or running it does. The registry
dataclass gains title/description (test-enforced non-empty for every
entry, unique titles), the API passes them through, and every surface
renders title-with-description-tooltip instead of the key: the Programs
card (label, toggle hint, run-now toast), and the project settings
participates-in/excluded-from checkboxes.

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/services/test_board_program_engine.py

@@ -22,7 +22,12 @@ from roboco.db.tables import (
     TaskTable,
 )
 from roboco.foundation import identity as _foundation
-from roboco.foundation.policy.board_programs import PROGRAMS, BoardProgram, TriggerKind
+from roboco.foundation.policy.board_programs import (
+    PROGRAMS,
+    WEEK_SECONDS,
+    BoardProgram,
+    TriggerKind,
+)
 from roboco.models.base import (
     AgentRole,
     AgentStatus,
@@ -37,7 +42,19 @@ from roboco.models.base import (
 from roboco.services import board_programs as bp_module
 from roboco.services.board_programs import BoardProgramEngine
 from roboco.services.task import (
+    BARFLY_SOURCE,
+    CORONER_SOURCE,
+    DOGFOOD_SOURCE,
+    LIBRARIAN_SOURCE,
+    MEGAPHONE_SOURCE,
+    MIRROR_SOURCE,
+    PERISCOPE_SOURCE,
+    PEST_CONTROL_SOURCE,
     ROADMAP_SOURCE,
+    SCALES_SOURCE,
+    SENTINEL_SOURCE,
+    SPACKLE_SOURCE,
+    WAR_ROOM_SOURCE,
     X_FEATURE_EXPLORATION_SOURCE,
     TaskCreateRequest,
     get_task_service,
@@ -73,7 +90,24 @@ async def _purge_board_program_pollution(db_session: AsyncSession) -> None:
     await db_session.execute(
         update(TaskTable)
         .where(
-            TaskTable.source.in_([ROADMAP_SOURCE, X_FEATURE_EXPLORATION_SOURCE]),
+            TaskTable.source.in_(
+                [
+                    ROADMAP_SOURCE,
+                    X_FEATURE_EXPLORATION_SOURCE,
+                    PEST_CONTROL_SOURCE,
+                    PERISCOPE_SOURCE,
+                    CORONER_SOURCE,
+                    SENTINEL_SOURCE,
+                    SCALES_SOURCE,
+                    SPACKLE_SOURCE,
+                    MIRROR_SOURCE,
+                    MEGAPHONE_SOURCE,
+                    LIBRARIAN_SOURCE,
+                    WAR_ROOM_SOURCE,
+                    BARFLY_SOURCE,
+                    DOGFOOD_SOURCE,
+                ]
+            ),
             TaskTable.status.notin_([TS.COMPLETED, TS.CANCELLED]),
         )
         .values(status=TS.CANCELLED)
@@ -444,6 +478,173 @@ def test_originators_cover_exactly_the_registry() -> None:
 def test_program_sources_match_service_layer_constants() -> None:
     assert PROGRAMS["roadmap"].source == ROADMAP_SOURCE
     assert PROGRAMS["x_feature"].source == X_FEATURE_EXPLORATION_SOURCE
+    assert PROGRAMS["pest_control"].source == PEST_CONTROL_SOURCE
+    assert PROGRAMS["periscope"].source == PERISCOPE_SOURCE
+    assert PROGRAMS["coroner"].source == CORONER_SOURCE
+    assert PROGRAMS["sentinel"].source == SENTINEL_SOURCE
+    assert PROGRAMS["spackle"].source == SPACKLE_SOURCE
+    assert PROGRAMS["scales"].source == SCALES_SOURCE
+    assert PROGRAMS["mirror"].source == MIRROR_SOURCE
+    assert PROGRAMS["megaphone"].source == MEGAPHONE_SOURCE
+    assert PROGRAMS["librarian"].source == LIBRARIAN_SOURCE
+    assert PROGRAMS["war_room"].source == WAR_ROOM_SOURCE
+    assert PROGRAMS["barfly"].source == BARFLY_SOURCE
+    assert PROGRAMS["dogfood"].source == DOGFOOD_SOURCE
+
+
+@pytest.mark.asyncio
+async def test_coroner_originator_is_a_never_originating_stub(
+    db_session: AsyncSession,
+) -> None:
+    """EVENT programs are never cron/metric-originated — the registered
+    ``_ORIGINATORS["coroner"]`` callable exists only so the parity test above
+    holds; it must always return None (a real cycle opens via
+    ``CoronerEngine.open_for_incident``, bypassing this dict — see
+    ``_originate_coroner``'s docstring)."""
+    assert await bp_module._ORIGINATORS["coroner"](db_session) is None
+
+
+@pytest.mark.asyncio
+async def test_run_due_programs_never_opens_coroner_even_when_armed(
+    db_session: AsyncSession,
+) -> None:
+    """EVENT programs are opened only by their own hooks, never the loop —
+    ``run_due_programs`` must skip ``coroner`` entirely regardless of
+    arming, mirroring ``test_program_due_event_never_cron_fires`` at the
+    foundation layer."""
+    db_session.add(
+        SystemSettingTable(key="board_program.coroner.enabled", value="true")
+    )
+    await db_session.flush()
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert "coroner" not in opened
+
+
+def _patch_war_room_originator(
+    monkeypatch: pytest.MonkeyPatch, holder: dict[str, TaskTable | None]
+) -> None:
+    monkeypatch.setitem(bp_module._ORIGINATORS, "war_room", _fake_originator(holder))
+
+
+@pytest.mark.asyncio
+async def test_war_room_originator_is_real_unarmed_no_op(
+    db_session: AsyncSession,
+) -> None:
+    """Unlike Coroner's always-None ``_originate_coroner`` stub, War Room's
+    ``_ORIGINATORS["war_room"]`` entry genuinely calls into
+    ``WarRoomEngine.run_cycle`` — proven by NOT patching it here: it returns
+    None because the program isn't armed in this bare session, a real
+    arming decision (see test_war_room_engine.py for the engine's own full
+    arm/creds/dedup coverage), not a hardcoded stub."""
+    assert await bp_module._ORIGINATORS["war_room"](db_session) is None
+
+
+@pytest.mark.asyncio
+async def test_run_due_programs_never_opens_war_room_even_when_armed(
+    db_session: AsyncSession,
+) -> None:
+    """EVENT programs are opened only by their own hooks, never the loop —
+    ``run_due_programs`` must skip ``war_room`` entirely regardless of
+    arming. War Room's originator is REAL (unlike coroner's stub), so this
+    specifically proves the trigger-kind guard in ``run_due_programs``
+    itself — not an originator that happens to no-op."""
+    db_session.add(
+        SystemSettingTable(key="board_program.war_room.enabled", value="true")
+    )
+    await db_session.flush()
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert "war_room" not in opened
+
+
+@pytest.mark.asyncio
+async def test_run_due_programs_never_opens_dogfood_even_when_armed(
+    db_session: AsyncSession,
+) -> None:
+    """EVENT programs are opened only by their own hooks/run-now, never the
+    cron loop — ``run_due_programs`` must skip ``dogfood`` entirely
+    regardless of arming, mirroring ``test_run_due_programs_never_opens_
+    coroner_even_when_armed``. Unlike Coroner, Dogfood DOES have a real
+    project-scoped originator (see ``test_open_program_cycle_originates_
+    dogfood_for_real`` below) — this proves the cron loop's own trigger-kind
+    gate is what blocks it, not a missing opt-in."""
+    await _seed(db_session)
+    project = (
+        await db_session.execute(select(ProjectTable).where(ProjectTable.slug == SLUG))
+    ).scalar_one()
+    project.board_programs = ["dogfood"]
+    db_session.add(
+        SystemSettingTable(key="board_program.dogfood.enabled", value="true")
+    )
+    await db_session.flush()
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert "dogfood" not in opened
+
+
+@pytest.mark.asyncio
+async def test_open_program_cycle_drives_war_room_via_real_originator(
+    db_session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """THE run-now-works-for-EVENT proof: ``open_program_cycle`` never
+    checks trigger kind at all, so once war_room is armed + dedup-clear it
+    genuinely originates through the REAL ``_ORIGINATORS["war_room"]``
+    entry — unlike coroner, whose run-now would 409 forever (its originator
+    is a stub that always returns None)."""
+    await _seed(db_session)
+    monkeypatch.setattr(cfg, "self_heal_project_slug", SLUG)
+    db_session.add(
+        SystemSettingTable(key="board_program.war_room.enabled", value="true")
+    )
+    new_task = await _make_exploration(db_session, source=WAR_ROOM_SOURCE)
+    holder: dict[str, TaskTable | None] = {"task": new_task}
+    _patch_war_room_originator(monkeypatch, holder)
+    await db_session.flush()
+
+    engine = BoardProgramEngine(db_session)
+    task = await engine.open_program_cycle("war_room")
+    assert task is not None
+    assert task.id == new_task.id
+
+    rows = (
+        (
+            await db_session.execute(
+                select(BoardProgramCycleTable).where(
+                    BoardProgramCycleTable.program_key == "war_room"
+                )
+            )
+        )
+        .scalars()
+        .all()
+    )
+    assert len(rows) == ONE
+
+
+@pytest.mark.asyncio
+async def test_open_program_cycle_originates_dogfood_for_real(
+    db_session: AsyncSession,
+) -> None:
+    """Unlike Coroner's never-firing stub, Dogfood registers a REAL
+    originator (``roboco.services.board_programs._originate_dogfood``) — a
+    CEO "run now" (and the release-publish hook, which calls the exact same
+    ``open_program_cycle`` path) must actually open a cycle when armed and
+    an opted-in project exists."""
+    await _seed(db_session)
+    project = (
+        await db_session.execute(select(ProjectTable).where(ProjectTable.slug == SLUG))
+    ).scalar_one()
+    project.board_programs = ["dogfood"]
+    db_session.add(
+        SystemSettingTable(key="board_program.dogfood.enabled", value="true")
+    )
+    await db_session.flush()
+
+    engine = BoardProgramEngine(db_session)
+    task = await engine.open_program_cycle("dogfood")
+    assert task is not None
+    assert task.source == DOGFOOD_SOURCE
+    assert task.project_id == project.id
 
 
 # ---------------------------------------------------------------------------
@@ -557,3 +758,195 @@ async def test_run_due_programs_originates_project_scoped_program_with_opt_in(
     engine = BoardProgramEngine(db_session)
     opened = await engine.run_due_programs()
     assert opened == ["pest_control"]
+
+
+# ---------------------------------------------------------------------------
+# Pest Control's metric-predicate accelerator (spec §4: "weekly cron OR
+# rework-rate spike") — the predicate opens a cycle off-schedule, still gated
+# by enabled + scope + dedup exactly like the cron path.
+# ---------------------------------------------------------------------------
+
+# A far-future cron cadence so the cron pass never fires within these tests —
+# only the metric predicate can open the cycle.
+_NEVER_DUE = BoardProgram(
+    key="pest_control",
+    role="product_owner",
+    trigger=TriggerKind.CRON,
+    source="board_pest_control",
+    default_interval_seconds=WEEK_SECONDS * 100,
+    scope="project",
+)
+
+
+async def _seed_recently_closed_cycle(session: AsyncSession) -> None:
+    """A CLOSED ledger row opened just now — makes the CRON pass genuinely
+    NOT due (recent + a huge interval) so a test can isolate the metric-
+    predicate path. Needs no linked task: ``_dedup_state`` never runs the
+    auto-close reconciliation on a row whose ``closed_at`` is already set."""
+    session.add(
+        BoardProgramCycleTable(
+            program_key="pest_control",
+            exploration_task_id=None,
+            opened_at=datetime.now(UTC),
+            closed_at=datetime.now(UTC),
+        )
+    )
+    await session.flush()
+
+
+@pytest.mark.asyncio
+async def test_metric_predicate_opens_cycle_off_schedule_when_it_fires(
+    db_session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    await _seed(db_session)
+    project = (
+        await db_session.execute(select(ProjectTable).where(ProjectTable.slug == SLUG))
+    ).scalar_one()
+    project.board_programs = ["pest_control"]
+    monkeypatch.setitem(bp_module.PROGRAMS, "pest_control", _NEVER_DUE)
+    _arm_setting(db_session, "board_program.pest_control.enabled")
+    await _seed_recently_closed_cycle(db_session)
+    new_task = await _make_exploration(db_session, source="board_pest_control")
+    holder: dict[str, TaskTable | None] = {"task": new_task}
+    monkeypatch.setitem(
+        bp_module._ORIGINATORS, "pest_control", _fake_originator(holder)
+    )
+    monkeypatch.setitem(
+        bp_module._METRIC_PREDICATES,
+        "pest_control",
+        _fake_predicate(True),
+    )
+    await db_session.flush()
+
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert opened == ["pest_control"]
+
+
+@pytest.mark.asyncio
+async def test_metric_predicate_below_threshold_opens_nothing(
+    db_session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    await _seed(db_session)
+    project = (
+        await db_session.execute(select(ProjectTable).where(ProjectTable.slug == SLUG))
+    ).scalar_one()
+    project.board_programs = ["pest_control"]
+    monkeypatch.setitem(bp_module.PROGRAMS, "pest_control", _NEVER_DUE)
+    _arm_setting(db_session, "board_program.pest_control.enabled")
+    await _seed_recently_closed_cycle(db_session)
+    monkeypatch.setitem(
+        bp_module._METRIC_PREDICATES,
+        "pest_control",
+        _fake_predicate(False),
+    )
+    await db_session.flush()
+
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert opened == []
+
+
+@pytest.mark.asyncio
+async def test_metric_predicate_never_consulted_when_disabled(
+    db_session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A disabled program's predicate must never even run (cheap, isolated —
+    no wasted MetricsService query on a dormant program)."""
+    await _seed(db_session)
+    monkeypatch.setitem(bp_module.PROGRAMS, "pest_control", _NEVER_DUE)
+    called = {"n": 0}
+
+    async def _boom(_session: AsyncSession) -> bool:
+        called["n"] += 1
+        raise AssertionError("predicate must not run while disabled")
+
+    monkeypatch.setitem(bp_module._METRIC_PREDICATES, "pest_control", _boom)
+    await db_session.flush()
+
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert opened == []
+    assert called["n"] == 0
+
+
+@pytest.mark.asyncio
+async def test_metric_predicate_never_evaluated_when_dedup_blocked(
+    db_session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """An already-open cycle blocks the metric predicate from ever running —
+    the cheap dedup gate must run BEFORE the (8-11 query) rework-rate check,
+    so an open cycle costs the metrics service nothing on every tick."""
+    await _seed(db_session)
+    project = (
+        await db_session.execute(select(ProjectTable).where(ProjectTable.slug == SLUG))
+    ).scalar_one()
+    project.board_programs = ["pest_control"]
+    monkeypatch.setitem(bp_module.PROGRAMS, "pest_control", _NEVER_DUE)
+    _arm_setting(db_session, "board_program.pest_control.enabled")
+    open_task = await _make_exploration(db_session, source="board_pest_control")
+    db_session.add(
+        BoardProgramCycleTable(
+            program_key="pest_control",
+            exploration_task_id=open_task.id,
+            opened_at=datetime.now(UTC),
+        )
+    )
+    called = {"n": 0}
+
+    async def _boom(_session: AsyncSession) -> bool:
+        called["n"] += 1
+        raise AssertionError("predicate must not run while dedup-blocked")
+
+    monkeypatch.setitem(bp_module._METRIC_PREDICATES, "pest_control", _boom)
+    await db_session.flush()
+
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert opened == []
+    assert called["n"] == 0
+
+
+@pytest.mark.asyncio
+async def test_metric_predicate_never_evaluated_when_scope_empty(
+    db_session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """No project opted into pest_control — the cheap scope gate blocks the
+    metric predicate from ever running (no project ever opts SLUG in here,
+    unlike the sibling tests)."""
+    await _seed(db_session)
+    monkeypatch.setitem(bp_module.PROGRAMS, "pest_control", _NEVER_DUE)
+    _arm_setting(db_session, "board_program.pest_control.enabled")
+    called = {"n": 0}
+
+    async def _boom(_session: AsyncSession) -> bool:
+        called["n"] += 1
+        raise AssertionError("predicate must not run with no project opted in")
+
+    monkeypatch.setitem(bp_module._METRIC_PREDICATES, "pest_control", _boom)
+    await db_session.flush()
+
+    engine = BoardProgramEngine(db_session)
+    opened = await engine.run_due_programs()
+    assert opened == []
+    assert called["n"] == 0
+
+
+@pytest.mark.asyncio
+async def test_real_rework_predicate_fires_above_threshold(
+    db_session: AsyncSession, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Exercises the REAL predicate (not a fake) against MetricsService's
+    rework rate — proves the threshold wiring, not just the engine seam."""
+    monkeypatch.setattr(cfg, "pest_rework_threshold", 0.3)
+    result = await bp_module._pest_control_rework_spike(db_session)
+    assert result is False  # no completed/reworked tasks seeded -> rate 0.0
+
+
+def _fake_predicate(
+    verdict: bool,
+) -> Callable[[AsyncSession], Awaitable[bool]]:
+    async def _predicate(_session: AsyncSession) -> bool:
+        return verdict
+
+    return _predicate