@bongos/core 1.19.1034 → 1.19.1036

package/modules/government/catalog.js

@@ -108,7 +108,7 @@ const PERMISSIONS = [
   // owner holds: the catalog's own invariant forbids granting a system key to metic,
   // so this cannot be delegated downward by a custom rank. The web tier still gains
   // no shell - the route only QUEUES an intent the control-plane runner drains.
-  { key: 'core.pin.move', system: true, floor: 'archon', guards: 'POST /provisioning/instances/:id/core-upgrade — gate 3 of the release pipeline (ADR 0293)' },
+  { key: 'core.pin.move', system: true, floor: 'archon', guards: 'POST /provisioning/instances/:id/core-upgrade — gate 3 of the release pipeline (ADR 0293); also the reads GET /core-update (the upgrade banner) and GET /core-upgrades (the upgrade ledger, task 1002669)' },
   // autonomy.fence.manage (task 1003908, ADR 0307 §6) — THE AUTOBONGOS KILL
   // SWITCH and the allowlist of goals an unattended runner may work. system:true
   // + archon for core.pin.move's reason, in a slightly sharper form: this decides
@@ -253,7 +253,7 @@ const PERMISSIONS = [
   { key: 'security.report.adjudicate', system: false, floor: 'metic', guards: 'GET /security/reports, POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD (ADR 0157, was archon)' },
   { key: 'provisioning.fleet.manage', system: false, floor: 'metic', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown (ADR 0157, was archon)' },
   { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', verb: 'manage', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
-  { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon)' },
+  { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon); also GET /autonomy/runs, the gate\'s past decisions (task 1002669)' },
   { key: 'discord.channels.manage', system: false, floor: 'metic', guards: 'GET /discord/channels/plan, POST .../reconcile (ADR 0157, was archon)' },
   // Metic by the discord.channels.manage analogue — configuring a project-wide
   // social surface — rather than archon. The blast radius is bounded by the OTHER

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/collab.html

@@ -148,7 +148,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goals.html

@@ -235,7 +235,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b" defer></script>
+<script src="/builders/shell.js?v=2026-09-26-own1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/people.html

@@ -66,7 +66,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -344,7 +344,12 @@
       // The deploy door (task 1003159, ADR 0293). Gated 'archon' here to mirror the
       // `core.pin.move` atom its page and both its routes check — cosmetic only, as
       // every item in this list is; the wall is server-side.
-      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon' },
+      //
+      // THE DOOR IS THE PROVISIONING MODULE'S, and a hosted project does not run it, so
+      // there this link opened a page with nothing behind it (task 1004174). It is
+      // dropped where the module is off, and re-pointed at the hub's own door for THIS
+      // project once /core-update names one (pointDeployAtHub, ADR 0339).
+      { id: 'deploy', label: 'Deploy', icon: 'admin', href: '/deploy', gate: 'archon', module: 'provisioning' },
       // task 1001949: what each hosted project costs. 'government' mirrors the metic floor
       // of `provisioning.fleet.manage`, the atom its page and its one read check (the
       // Deploy precedent above); dropped where the provisioning module is not enabled.
@@ -622,16 +627,40 @@
     if (!perms || perms['core.pin.move'] !== true) return;
     coreUpdateAsked = true;
     api.request('GET', '/api/bongos/core-update').then(function (res) {
-      if (!res || res.status !== 200 || !res.data || !res.data.update) return;
-      renderCoreUpdateBanner(res.data.update);
+      if (!res || res.status !== 200 || !res.data) return;
+      var handoff = hubHandoff(res.data.deploy_url);
+      if (handoff) pointDeployAtHub(handoff);
+      if (res.data.update) renderCoreUpdateBanner(res.data.update, handoff);
     }, function () { /* fail-soft: no banner is the correct answer to no answer */ });
   }
 
+  // task 1004174 (ADR 0339) — where a HOSTED project's owner takes the upgrade: the
+  // hub's own deploy door scoped to this project, which the server names as
+  // `deploy_url` when this project is federated with a hub. Only where this hall has no
+  // door of its own: on the platform the local /deploy is the door, and a link away
+  // from it would be a second road to the same button. An address that is not a plain
+  // http(s) URL is ignored rather than trusted into an href.
+  function hubHandoff(url) {
+    if (moduleOn('provisioning')) return null;
+    if (typeof url !== 'string' || !/^https?:\/\/[^\s"'<>]+$/i.test(url)) return null;
+    return url;
+  }
+
+  // The rail's Deploy item is hidden on a hosted project (its module gate); this gives
+  // it back, aimed at the hub. Its rank gate still applies, exactly as on the platform.
+  function pointDeployAtHub(url) {
+    var item = document.getElementById('nav-deploy');
+    if (!item) return;
+    item.setAttribute('href', url);
+    if (item.dataset) delete item.dataset.module;
+    item.hidden = !gateAllows(item.dataset && item.dataset.gate);
+  }
+
   // SAY NOTHING WHEN THERE IS NOTHING TO SAY. `behind` is false both when the box
   // is current AND when the registry could not be read; `reading` separates them,
   // and neither renders. A banner is a claim about being out of date, and a wrong
   // one on a project that is actually current is worse than silence.
-  function renderCoreUpdateBanner(update) {
+  function renderCoreUpdateBanner(update, handoff) {
     if (!update || update.reading !== 'ok' || !update.behind || !update.latest) return;
     // A dismissal is remembered PER VERSION, not forever: the next release is new
     // news and must re-announce itself, or the surface is dead after one click.
@@ -659,8 +688,10 @@
     // happen": nothing had, and nothing had been asked for. The control is on that page
     // already, so on it the banner informs and points, and does not pretend to act.
     var onDeploy = window.location && String(window.location.pathname || '').replace(/\/+$/, '') === '/deploy';
+    // A hosted project has no door of its own; it hands its owner to the hub's door for
+    // this project when the server named one (task 1004174), and otherwise only informs.
     var action = !moduleOn('provisioning')
-      ? ''
+      ? (handoff ? '<a class="core-update-notice__action" href="' + esc(handoff) + '">Upgrade</a>' : '')
       : (onDeploy
         ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
         : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>');

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/lifecycle/ship-assurance.js

@@ -74,10 +74,26 @@ async function deriveShipAssurance({ taskId, body = {}, db, githubPush, onProbeE
   // before landProvenForTask ever saw a recorded tip, so a commit provably on main
   // was refused as "not proven" (strands 1003285/1003286, task 1003434). Each step
   // now fails on its own: a status miss degrades to status=null, never to no-proof.
+  //
+  // The status probe needs a BRANCH (task 1004275). It used to be called with
+  // { taskId, publishedSha }, which getPublishStatus does not read, so it threw
+  // BAD_BRANCH every time and both PR-witness proofs in landProvenForTask (the
+  // squash/out-of-band land, and the no-tip fallback) could never fire on this path,
+  // while the reconciler proved the same land ~5 min later. So find the task's own PR
+  // first, by the "task <id>: …" title both publish paths give it (the same lookup
+  // GET /publish-status does since task 1003764), and ask about that branch. No PR,
+  // or a failed search, leaves status=null: the tip proof still runs.
   let publishedSha = null;
   try { publishedSha = await db.getClaimPublishedSha(taskId); } catch (e) { report(e); }
+  let branch = null;
+  try {
+    const found = await githubPush.findTaskPullRequest({ taskId });
+    branch = (found && found.branch) || null;
+  } catch (e) { report(e); }
   let status = null;
-  try { status = await githubPush.getPublishStatus({ taskId, publishedSha }); } catch (e) { report(e); }
+  if (branch) {
+    try { status = await githubPush.getPublishStatus({ branch }); } catch (e) { report(e); }
+  }
   try {
     const proof = await githubPush.landProvenForTask({ taskId, publishedSha, status });
     if (proof && proof.proven) return { assurance: { kind: 'proof', reason: proof.reason } };

package/modules/provisioning/core-upgrade-authz.js

@@ -0,0 +1,85 @@
+'use strict';
+
+// modules/provisioning/core-upgrade-authz.js — who may move ONE hosted project's core
+// pin: its owner, or a holder of `core.pin.move` (task 1004174, ADR 0339).
+//
+// THE OWNER'S RULING, 2026-09-26: only a project's owner upgrades it — "owners and
+// archons are the same" for the platform operator, because the operator owns the
+// platform. Until this file the deploy door was `core.pin.move` alone: archon-floor
+// and system:true, so the owner of a hosted project below Archon could see that they
+// were behind and could never act on it. The door stays on the control plane (ADR
+// 0293 D1): a hosted project hands its owner off to this hub's /deploy?project=<slug>
+// and gains no capability of its own.
+//
+// THE SHAPE IS THE ONE THE MODULE ALREADY USES FOR "OWNER OR OPERATOR" (ADR 0328
+// Decision 2, and platform-identity's requireScoutingReader, ADR 0210). Ownership is
+// asked FIRST; on any "no" — not the owner, no such row, an unreadable id, a database
+// blip — the request falls through to the UNMODIFIED permission gate. So a caller who
+// is neither gets byte-for-byte the refusal the door has always given, whether or not
+// the id exists, and the widening can only ever admit. The atom is still spelled in
+// the route's middleware list, where route-rank-check.js and gen-api-docs.js read it.
+//
+// THE PLATFORM'S OWN ROW IS NOT A PROJECT AN OWNER MAY MOVE HERE. Moving the control
+// plane changes the code every hosted project is driven by, so it stays on the atom:
+// OWNER_SHAPES admits the two tenant shapes and nothing else, and a shape added later
+// is excluded by omission.
+
+// The tenant shapes the runner can actually reach (UPGRADE_SHAPES minus the platform).
+const OWNER_SHAPES = Object.freeze(new Set(['co-tenant', 'cloud-host']));
+
+// An id as the route names it: a positive integer and nothing else. Anything else is
+// not looked up at all — it falls to the permission gate, and the handler's own
+// parseId gives the 400 an admitted caller would get.
+const ID_RE = /^[1-9][0-9]{0,15}$/;
+
+/**
+ * Does this builder own this instance in a way that lets them move its core? PURE.
+ * Fail-closed on every missing piece: no row, no builder, no recorded owner, or a
+ * shape that is not a tenant.
+ */
+function ownsUpgradableProject(inst, builder) {
+  return !!inst && !!builder && builder.id != null
+    && OWNER_SHAPES.has(inst.hosting_shape)
+    && inst.owner_builder_id != null
+    && String(inst.owner_builder_id) === String(builder.id);
+}
+
+/**
+ * The OR gate, as one middleware mounted after requireBuilder. `pinGate` is the
+ * ALREADY-BUILT `requirePermission('core.pin.move')` middleware.
+ *
+ * It records WHICH door admitted the caller on `req.coreUpgradeAuthority`, because
+ * the intent's actor has to say so truthfully (coreUpgradeActor below).
+ */
+function requireOwnProjectOrPin({ pinGate, provisioning, pool, log }) {
+  return async function ownProjectOrPinGate(req, res, next) {
+    const raw = req.params ? req.params.id : undefined;
+    if (typeof raw === 'string' && ID_RE.test(raw)) {
+      try {
+        const inst = await provisioning.getInstanceById(pool, Number(raw));
+        if (ownsUpgradableProject(inst, req.builder)) {
+          req.coreUpgradeAuthority = 'owner';
+          return next();
+        }
+      } catch (err) {
+        // Message only: a query error can carry row data. The permission gate below
+        // then decides, so a blip here can deny an owner but never admit anyone.
+        if (log && log.error) log.error(`core-upgrade owner check failed, falling back to core.pin.move: ${err && err.message}`);
+      }
+    }
+    req.coreUpgradeAuthority = 'pin';
+    return pinGate(req, res, next);
+  };
+}
+
+/**
+ * The actor recorded on the intent and the event. Both forms carry the builder id,
+ * because the runner hands it to the core_upgrades ledger as `--requested-by` and
+ * ADR 0293 D5 refuses an unattributed row for a move an HTTP request started.
+ */
+function coreUpgradeActor(req) {
+  const door = req.coreUpgradeAuthority === 'owner' ? 'owner' : 'archon';
+  return `api:${door}:${req.builder.id}`;
+}
+
+module.exports = { OWNER_SHAPES, ownsUpgradableProject, requireOwnProjectOrPin, coreUpgradeActor };

package/modules/provisioning/core-upgrade.js

@@ -177,7 +177,8 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
       // The actor rides the intent, and the runner carries it through to the
       // core_upgrades ledger (ADR 0293 D5): a privileged action with an
       // unattributed row is not acceptable here.
-      const actor = `api:archon:${req.builder.id}`;
+      // `api:owner:<id>` when the project's owner pressed it (task 1004174), else `api:archon:<id>`.
+      const actor = require('./core-upgrade-authz').coreUpgradeActor(req);
       // `dry_run: true` asks what the move WOULD do and moves nothing (task 1004121).
       // Queued the same way as the move, through the same single-open-intent slot, so a
       // preview cannot be requested on top of a move that is already running — and, just

package/modules/provisioning/provisioning.js

@@ -1158,9 +1158,9 @@ async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion
 // delete hostage would repeat 1002691. A pending 'restart' or 'repo-private' (task 1004193) joins them for the same
 // reason (task 1003238) — and more sharply, since the owner reaches for Restart
 // precisely when a project looks broken, which is also when they give up and delete
-// it. A RUNNING intent is mid-flight and never yanked —
-// the caller gets { conflict: 'open_intent' } with the blocking intent so the route
-// can answer truthfully. Each statement is atomic and the index stays the arbiter:
+// it. A RUNNING intent is mid-flight and never yanked — the caller gets { conflict: 'open_intent' } with the blocking intent so the route
+// can answer truthfully. The control-plane row is never superseded, in the same statement (task 1004286): enqueueIntent's guard refuses its
+// teardown, and a refused teardown must cancel nothing (it used to cancel a pending restart). Each statement is atomic, the index the arbiter:
 // any interleaving with the runner or a concurrent enqueue lands on one of these
 // truthful outcomes.
 async function enqueueTeardown(db, instanceId, requestedBy) {
@@ -1169,7 +1169,7 @@ async function enqueueTeardown(db, instanceId, requestedBy) {
         SET state = 'error', last_error = 'superseded: teardown requested',
             updated_at = now(), resolved_at = now()
       WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private') AND state = 'pending'
-      RETURNING id`,
+        AND NOT EXISTS (SELECT 1 FROM provisioning_instances WHERE id = $1 AND hosting_shape = 'control-plane') RETURNING id`,
     [instanceId]
   );
   const { intent, created } = await enqueueIntent(db, instanceId, 'teardown', requestedBy);

package/modules/provisioning/routes/core-upgrade.js

@@ -26,6 +26,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
 const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler } = require('../core-upgrade');
+const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
 
@@ -40,6 +41,11 @@ module.exports = function buildCoreUpgradeRouter() {
   // and not `requireRank`: tests/government_require_permission.mjs fails the build
   // on a new requireRank in a modules/*/routes gate.
   //
+  // OR THE PROJECT'S OWN OWNER (task 1004174, ADR 0339 — the owner's ruling that only
+  // a project's owner upgrades it). Ownership of a TENANT row is asked first; any other
+  // caller meets the unmodified `core.pin.move` gate and its unchanged refusal. The
+  // platform's own row is not an owner's to move here — it stays on the atom.
+  //
   // Body: { to: "1.19.757" } — and requiring it IS the second step of the two-step
   // the owner asked for (ADR 0293 D4). A request that cannot fire without naming
   // its target cannot fire from a stray click, and "move to whatever is newest",
@@ -55,7 +61,7 @@ module.exports = function buildCoreUpgradeRouter() {
   router.post(
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
-    api.requirePermission('core.pin.move'),
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
     makeCoreUpgradeHandler({
       provisioning,
       pool: api.pool,
@@ -71,19 +77,19 @@ module.exports = function buildCoreUpgradeRouter() {
   // core version and how far behind it is, which is a vulnerability-window disclosure —
   // precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview
   // anyone could read would also let an attacker time a request against a known-stale
-  // window. The read being no cheaper than the write costs the owner nothing: they hold
-  // the atom by construction, because they are the only one who can press the button.
+  // window. The read being no cheaper than the write costs the owner nothing: whoever
+  // may press the button may read what it would do — the same two doors as the POST.
   router.get(
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
-    api.requirePermission('core.pin.move'),
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
     makeCoreUpgradePreviewHandler({ provisioning, pool: api.pool, parseId: api.parseId, log }),
   );
 
   // GET /provisioning/control-plane — "which row is this platform, and where does it
   // stand?" The deploy page's first call: the self row is created once by hand at
-  // install time, so its id is per-install and nobody's to memorise. Same atom again,
-  // so the entrance is no wider than the door it leads to.
+  // install time, so its id is per-install and nobody's to memorise. The atom ALONE
+  // here, with no owner door: this is the platform's own row (ADR 0339).
   router.get(
     '/provisioning/control-plane',
     api.requireBuilder,