The terminal is proved by tests: src/tty.ts has none, and it is 348 lines of role-gated screens #74

src/tty.ts is the app's ssh interface and the one module no test imports. src/desk.ts — its gate and its typed commands — is covered, so what is untested is the terminal itself: which key opens which tab for which role, what a key does when the role may not press it, how a typed line reaches desk and what is drawn back. It boots on import (it reads process.env, opens the database and starts drawing), which is why no test has managed to load it; that seam is the work.

Done looks like

• [ ] src/tty.ts can be imported without starting: the screen loop lives behind an exported function (run() or equivalent) that import.meta.main calls, and importing the module draws nothing, reads no key and writes no row.
• [ ] Key handling is a pure-ish function of (who, tab, key) returning the next screen state, testable without a terminal: no process.stdout writes inside it.
• [ ] src/tty.test.ts starts with await freshData("tty") and covers, at minimum: an anon keyboard (FORGE_APP_USER_ROLE unset) sees only what anon may see and every admin key is refused; a user keyboard sees their own orders and no one else's; an admin keyboard reaches the orders, stock and codes tabs; an unknown key changes nothing; a typed line that is too long or malformed is refused with a message rather than throwing.
• [ ] The refusals name desk's rule rather than re-implementing it — no second copy of the gate.
• [ ] FORGE_APP_SSH is printed verbatim where the terminal says how to connect, and a test asserts the unset case says the terminal is off.
• [ ] bun test and bun test --randomize are green; the new tests fail if the extraction or a gate is reverted.

Files src/tty.ts (the seam and any pure extraction), src/tty.test.ts (new), src/desk.ts only if a rule has to be exported, README.md if the run line changes.

Risks The module's import-time work is load-bearing for forge.json's tty command — bun run src/tty.ts must still start the terminal exactly as it does now. Drawing code that writes to stdout during tests would make the suite unreadable; keep the loop out of the tested surface. Do not weaken a gate to make it testable.

Suggested mason, with sentinel reading the pull — the tests are about who may do what.