@bongos/core 1.19.1046 → 1.19.1047

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1046",
-  "core_contract": "1.19.1046",
-  "source_commit": "e319f60c3630db9d566a402e2b7ce9604c72ba82",
+  "core_version": "1.19.1047",
+  "core_contract": "1.19.1047",
+  "source_commit": "a83322a2af0bab901b143a098fb0a5cc337f9e64",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T19:22:25.895Z",
+  "built_at": "2026-09-26T23:42:01.064Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 543,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3082,
-  "tree_sha256": "928acc82709aeebb76b1b0be69082adaebccaa8bd9e6697408c945b85406c1a8",
+  "tree_sha256": "0fdbcc97739c2b07898a2eb701e2f0a991cf6b1f173450143e6df73720b60231",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "00718f6a26dafa79be474121370153e96be1931395f4ca24da7f53f25e1de0ac"
+      "sha256": "de85c4f3489d17d7b82c0cc64a3049a1cba09589f67e551ffcafbc9354ec3a8d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2892,7 +2892,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "4f006e07e58a861399d8d04ab0b52a1752f4ff605475288d60b60bffb7e123e7"
+      "sha256": "1558473dea0e6c41e623ede06f0bf006fcd58cb1ab388b7e7e149872fcdbb00b"
     },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
@@ -8497,12 +8497,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4ef150815146dadfcc78e160733153e875b5c015c86bc837b3972b31eb3d9406"
+      "sha256": "71c9088d184288d783c7ca384d4cff140ec48251157bb3557c5c76854d1829e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "310d214694937411a160474d6b971db66ed5c1f968cf4d573e94f980d5a394b1"
+      "sha256": "888aceb332ce59d940cc7c4b42b63a896d773a387b957e7581a10f9b4d2a56be"
     },
     {
       "path": "public-docs/index.html",
@@ -8522,7 +8522,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "d8ecbe8ede04357e6201a6acea252912d6f123b39dc7e382b18599af424a7bb3"
+      "sha256": "b2e95686e68d9e0321f3dba1807d8747ff43f2739aa3738c7d0eed8516eb20cd"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9197,7 +9197,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "3ff8b2370bd93c5469708900ba3d36066aa82f4858831ce6e4b1b7e817e29dcb"
+      "sha256": "cf1e7da0a1a386a73c5ecf9bb37b2e3f593217bf8250f574cf95b9fbf73b1910"
     },
     {
       "path": "scripts/gds/goal-names.js",
@@ -10592,7 +10592,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "95535ac13b1e19fcb5537fa9bf72cc8a182db008c1247c0920bd6a221bad9b7d"
+      "sha256": "948f2239e756563cee5b97cc98254d5041e1edcb283139087f7e07bbf3368441"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12102,7 +12102,7 @@
     {
       "path": "tests/go_live.mjs",
       "mode": "0000644",
-      "sha256": "fb937d66f8efa9fdcfb58715785a0c9d94e52034d04175aec78310c70bd53a7f"
+      "sha256": "e62b39da9f1e5538dfc4d642a82c75ac400885b371170e722690b3adc756d1f5"
     },
     {
       "path": "tests/goal_abuse_matrix.mjs",

package/docs/module-api-changelog.md

@@ -2579,5 +2579,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1044 with no explicit bump. run 36263855490. (task 1002620)
   1.19.1046 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1045 with no explicit bump. run 36265788618. (task 1002620)
+  1.19.1047 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1046 with no explicit bump. run 36280220559. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/core-release-pipeline.md

@@ -222,6 +222,25 @@ answerable without going and looking. Two different unknowns, two different verd
   will not answer, and a broken read must never be a quieter way past it than the owner's own
   override. The fix is in the instance's logs, not on anyone's review queue.
 
+**What `--apply` does, in order** (task 1004306):
+
+1. **Rehearse.** It runs the exact `bongos upgrade` it is about to run, plus `--dry-run`. That
+   asks every refusal the bump has (the artist gate, module compatibility, the database
+   identity, the downgrade guard) and changes nothing. A refusal stops here: no timer stopped,
+   no backup written, and the report says "Nothing changed". Before this, the backup came
+   first, so on cloudbongos.com every attempt the artist gate refused had already written a
+   65 MB dump: one a day at the daily cadence, a full disk in about three days at every fifteen
+   minutes.
+2. **Stop the pull-deploy timer and back up** to `backupDir` as
+   `pre-<version>-<timestamp>.sql.gz`. A dump that fails now fails the go-live (before, a failed
+   `pg_dump` still left a tiny gzip that read as a backup) and the timer is put back.
+3. **Prune:** keep the newest **10** of those pre-upgrade dumps, by time, and delete the rest.
+   Only that exact name pattern is touched: a dump named by hand (`pre-lane-sweep-…`) and the
+   nightly backups (`db-backup-nightly.sh`, `<db>-<timestamp>.sql.gz`, kept 30 days by that
+   script) are never pruned here. A
+   prune that cannot run is a ⚠ warning, not a failed deploy.
+4. **Bump, restart, read back**, as before.
+
 Host topology (ssh alias, box paths, service names, health URL) lives in a host-owned
 `config/go-live.json`, never in the core — run `node scripts/gds/go-live.js --help` for the
 schema. A core that named one instance's box would not be a core.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1046",
+  "version": "1.19.1047",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1046",
+      "version": "1.19.1047",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1046",
+  "version": "1.19.1047",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7577,5 +7577,11 @@
       "id": "1003444",
       "text": "The hall's People page is gone, as you asked. An old People link now opens the Builders page instead, and People is no longer in the side menu. Searching for builders across projects comes back when the hub's community page is"
     }
+  ],
+  "1.19.1047": [
+    {
+      "id": "1004306",
+      "text": "An update that would be refused no longer takes a database backup first, and the server keeps only the ten newest pre-update backups, so frequent update checks can't fill the disk."
+    }
   ]
 }

package/scripts/gds/go-live.js

@@ -571,7 +571,23 @@ function renderReport(r) {
   L.push(`  Go-live · ${r.targetName}`);
   L.push(BAR);
   L.push(`  ${r.from} → ${r.to}`);
-  for (const step of r.steps || []) L.push(`  ${step.ok ? '✓' : '✖'} ${step.name}${step.detail ? ` — ${step.detail}` : ''}`);
+  for (const step of r.steps || []) L.push(`  ${step.ok ? (step.warn ? '⚠' : '✓') : '✖'} ${step.name}${step.detail ? ` — ${step.detail}` : ''}`);
+
+  // A refused rehearsal moved nothing, so the pin and read-back lines below would only
+  // alarm: "pin committed NO — the next reset will revert this bump" about a bump that
+  // never started (task 1004306).
+  if (r.failedAt === 'PREFLIGHT') {
+    const ex = failureExcerpt(r.raw);
+    if (ex.length) {
+      L.push('');
+      L.push('  what the upgrade said:');
+      for (const l of ex) L.push(`    ${l}`);
+    }
+    L.push('');
+    L.push(`  Nothing changed — still on ${r.from || 'the current core'}. No timer was stopped and no backup was written.`);
+    L.push('');
+    return L.join('\n');
+  }
 
   if (!r.ok) {
     const ex = failureExcerpt(r.raw);
@@ -681,24 +697,96 @@ function pinStep(mode, pinDirty, head) {
   };
 }
 
+// How many pre-upgrade dumps a backupDir keeps (task 1004306). Nothing pruned them, so
+// the directory grew by one dump per attempt for as long as the lane ran: 37 dumps and
+// 1.7 GB on cloudbongos.com by 2026-09-26, at about ONE attempt a day. The count, not an age,
+// is the bound because the cadence is what varies — ten is ten at daily or at every
+// fifteen minutes. These are the extra copies taken right before a pin move; the
+// nightly backup (db-backup-nightly.sh, 30 days) is the history and is not touched.
+const PRE_UPGRADE_KEEP = 10;
+// Exactly the name Phase A writes: pre-<version>-<YYYYMMDDTHHMMSSZ>.sql.gz. A looser
+// `pre-*` would also take a dump an operator named by hand — the box has a
+// `pre-lane-sweep-<ts>.sql.gz` in that directory, and it is not ours to delete.
+const D8 = '[0-9]'.repeat(8);
+const D6 = '[0-9]'.repeat(6);
+const PRE_UPGRADE_GLOB = `pre-[0-9]*-${D8}T${D6}Z.sql.gz`;
+
+// Delete all but the newest PRE_UPGRADE_KEEP pre-upgrade dumps and print how many went.
+// Newest by mtime, never by name: the name sorts 1.19.99 after 1.19.100. It runs only
+// after a dump succeeded, so a run of failures can never empty the directory, and the
+// dump just written is always the newest and always kept. No `$` anywhere, so the
+// outer shell that feeds this to `bash -c` expands nothing in it.
+function pruneCommand(dir, keep = PRE_UPGRADE_KEEP) {
+  return `bash -c "cd ${dir} && ls -1t -- ${PRE_UPGRADE_GLOB} 2>/dev/null | tail -n +${keep + 1} | xargs -r rm -v -- | wc -l"`;
+}
+
+// Read the prune section back into a step. A prune that could not run is a WARNING,
+// not a failure: the dump it follows is good, and refusing the upgrade over a full
+// cleanup would trade a real deploy for tidiness. It still says so on screen.
+function pruneStep(section, keep = PRE_UPGRADE_KEEP) {
+  const name = `prune old pre-upgrade backups (keep the newest ${keep})`;
+  const s = String(section == null ? '' : section).trim();
+  if (/^\d+$/.test(s)) return { name, ok: true, detail: s === '0' ? 'nothing to remove' : `removed ${s}` };
+  return { name, ok: true, warn: true, detail: `could not prune${s ? ` (${s.split('\n').pop()})` : ''} — the directory will keep growing until this is fixed` };
+}
+
 function applyGoLive(target, targetName, targetVersion, from, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
   const pinMode = pinModeOf(target);
   const steps = [];
+  const upgrade = upgradeCommand(target, targetVersion);
+
+  // Phase 0 — ask the upgrade whether it WILL go, before anything is stopped or copied
+  // (task 1004306). `bongos upgrade --dry-run` runs every refusal the real bump has —
+  // the artist gate, module compatibility, the database identity, the downgrade guard —
+  // and returns before it changes anything. Phase A used to come first, so on
+  // cloudbongos.com (2026-09-26 17:10 and 17:15 UTC) each attempt the artist gate
+  // refused had already stopped the deploy timer and written a 65 MB dump: one a day at
+  // the daily cadence, a full disk in about three days at every fifteen minutes.
+  // runGoLive's own gate read did not stop those runs either, and left no trace of what
+  // it saw: on --apply a plan with no halts is never printed, notes included. The bump's
+  // pre-flight asks the instance directly, and it was the first thing to say no.
+  const rehearsal = remote(target, `
+set -uo pipefail
+${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade} --dry-run"`)}
+`, opts);
+  steps.push({
+    name: 'pre-flight (the upgrade, rehearsed with --dry-run)',
+    ok: rehearsal.ok,
+    detail: rehearsal.ok ? null : 'refused — nothing was stopped and nothing was backed up',
+  });
+  if (!rehearsal.ok) return { ok: false, steps, from, to: targetVersion, targetName, pinMode, failedAt: 'PREFLIGHT', refused: true, raw: rehearsal };
 
   // Phase A — stop the pull-deploy timer, then back up. The timer's `reset --hard`
   // is the hazard: it would revert an uncommitted pin mid-flight. A co-tenant has no
   // such timer (see REQUIRED_FIELDS), so there is nothing to stop and no hazard.
+  //
+  // The dump must FAIL when pg_dump fails. `pg_dump | gzip > f` without pipefail
+  // reports gzip's success, leaving a 20-byte file that reads as a backup — harmless
+  // while nothing pruned, but the prune below keeps the newest ten, so a streak of
+  // those would retire every real dump (task 1004306). A failed dump removes its file
+  // and fails the phase, which stops the go-live before the pin moves: a bump with no
+  // backup behind it is not one to make unattended. $TS is expanded once by this
+  // script so the dump and its cleanup name the same file.
+  const backupDir = target.backupDir || '~/backups';
+  const dumpFile = `${backupDir}/pre-${targetVersion}-$TS.sql.gz`;
   const backup = target.backupDb
-    ? asOwner(target, `bash -c "mkdir -p ${target.backupDir || '~/backups'} && pg_dump ${target.backupDb} | gzip > ${target.backupDir || '~/backups'}/pre-${targetVersion}-$(date -u +%Y%m%dT%H%M%SZ).sql.gz"`)
+    ? asOwner(target, `bash -c "set -o pipefail; mkdir -p ${backupDir} && { pg_dump ${target.backupDb} | gzip > ${dumpFile} || { rm -f ${dumpFile}; exit 1; }; }"`)
     : 'echo "(no backupDb configured — skipping)"';
+  // `|| echo`: under `set -e` a failed prune would otherwise fail the whole phase and
+  // stop a deploy whose backup is already safely on disk (see pruneStep).
+  const prune = target.backupDb
+    ? `echo "##PRUNE##"; ${asOwner(target, pruneCommand(backupDir))} || echo "prune exited non-zero"`
+    : '';
   const phaseA = remote(target, `
 set -euo pipefail
 ${SUDO_PREAMBLE}
 echo "##TIMER##"; ${target.deployTimer
     ? `$SUDO systemctl stop ${target.deployTimer} && $SUDO systemctl is-active ${target.deployTimer} || true`
     : 'echo "(no deployTimer configured — no pull-deploy to stop)"'}
+TS="$(date -u +%Y%m%dT%H%M%SZ)"
 echo "##BACKUP##"; ${backup}
+${prune}
 echo "##END##"
 `, opts);
   steps.push({
@@ -706,11 +794,19 @@ echo "##END##"
     ok: phaseA.ok,
     detail: phaseA.ok ? null : (phaseA.stderr || '').trim().split('\n').pop(),
   });
-  if (!phaseA.ok) return { ok: false, steps, from, to: targetVersion, targetName, pinMode, failedAt: 'PREPARE', raw: phaseA };
+  if (!phaseA.ok) {
+    // The timer may already be stopped — Phase A stops it before the dump, and a dump
+    // can now fail on its own (above). Put it back, as a failed upgrade does below.
+    if (target.deployTimer) remote(target, `${SUDO_PREAMBLE}\n$SUDO systemctl start ${target.deployTimer} || true`, opts);
+    return { ok: false, steps, from, to: targetVersion, targetName, pinMode, failedAt: 'PREPARE', raw: phaseA };
+  }
+  if (target.backupDb) {
+    const m = (phaseA.stdout || '').split('##PRUNE##')[1];
+    steps.push(pruneStep(m === undefined ? null : m.split('##')[0]));
+  }
 
   // Phase B — the upgrade itself. --commit-pin makes the bump durable against the
   // pull-deploy reset; auto-rollback stays ON (do NOT pass --no-rollback-on-failure).
-  const upgrade = upgradeCommand(target, targetVersion);
   const phaseB = remote(target, `
 set -uo pipefail
 ${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`)}
@@ -970,6 +1066,6 @@ module.exports = {
   loadConfig, selectTarget, validateTarget, planGoLive, artistGateEntries, readArtistGate, ARTIST_GATE_PATH, ARTIST_GATE_LEVELS,
   parseMarker, parseMarkerHits,
   renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
-  applyGoLive, upgradeCommand, pinStep, pinModeOf,
+  applyGoLive, upgradeCommand, pinStep, pinModeOf, pruneCommand, pruneStep, PRE_UPGRADE_KEEP, PRE_UPGRADE_GLOB,
   CONFIG_TEMPLATE, HALTS, SEMVER_RE, PIN_MODES, DEFAULT_PIN_MODE,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1046'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1047'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/go_live.mjs

@@ -595,15 +595,22 @@ const phaseC = ({ timer = true, pin = '', version = '1.19.306', installed = '1.1
   '##END##',
 ].filter(Boolean).join('\n');
 
-// Records every script fed to a shell. `upgradeFails` drives the rollback path.
-function fakeShell({ upgradeFails = false, phaseCOut = phaseC() } = {}) {
+// Records every script fed to a shell. `upgradeFails` drives the rollback path;
+// `rehearsalRefuses` makes the --dry-run pre-flight say no (task 1004306).
+function fakeShell({ upgradeFails = false, rehearsalRefuses = false, backupFails = false, pruned = '0', phaseCOut = phaseC() } = {}) {
   const scripts = [];
   const fn = (cmd, args, opts = {}) => {
     const input = opts.input || '';
     scripts.push(input);
+    if (backupFails && input.includes('##BACKUP##')) return { status: 1, stdout: '##TIMER##\n##BACKUP##\n', stderr: 'pg_dump: error: connection to server failed' };
+    if (input.includes('bongos upgrade') && input.includes('--dry-run')) {
+      return rehearsalRefuses
+        ? { status: 1, stdout: '', stderr: "\n✖ 5 unresolved artist reviews hold this deploy — the project runs artist_gate 'strict'\n" }
+        : { status: 0, stdout: '  [dry-run] would pin', stderr: '' };
+    }
     if (input.includes('bongos upgrade')) return { status: upgradeFails ? 1 : 0, stdout: '', stderr: upgradeFails ? 'boom' : '' };
     if (input.includes('##PIN##')) return { status: 0, stdout: phaseCOut, stderr: '' };
-    return { status: 0, stdout: '##TIMER##\n##BACKUP##\n##END##', stderr: '' };
+    return { status: 0, stdout: `##TIMER##\n##BACKUP##\n${input.includes('##PRUNE##') ? `##PRUNE##\n${pruned}\n` : ''}##END##`, stderr: '' };
   };
   fn.scripts = scripts;
   fn.all = () => scripts.join('\n');
@@ -660,7 +667,7 @@ test('with no deployTimer, nothing is stopped, started, or reported as restarted
   assert.ok(!/systemctl (stop|start)/.test(run.all()), 'must not touch a timer it has not got');
   assert.ok(!run.all().includes('undefined'), 'no field may interpolate as undefined');
   assert.ok(!stepNames(r).some((n) => /restart/.test(n)), 'no restart step for a timer that does not exist');
-  assert.match(stepNames(r)[0], /^backup \(no pull-deploy timer\)$/);
+  assert.match(stepNames(r)[1], /^backup \(no pull-deploy timer\)$/);
 });
 
 test('the platform instance still stops the timer and puts it back', () => {
@@ -728,3 +735,135 @@ test('the shipped co-tenant template is itself valid config', () => {
   assert.equal(sel.target.pinMode, 'local-commit');
   assert.equal(sel.target.deployTimer, undefined);
 });
+
+// ---------------------------------------------------------------------------
+// Refuse before you copy; keep ten (task 1004306)
+//
+// On cloudbongos.com, 2026-09-26, the artist gate refused two upgrades at 17:10 and
+// 17:15 UTC — and each had already stopped the deploy timer and written a 65 MB
+// pg_dump, because the backup was Phase A and the refusal lived inside Phase B.
+// Nothing pruned the directory (37 dumps, 1.7 GB, at about one attempt a day). At a
+// fifteen-minute cadence that fills the disk in about three days.
+// ---------------------------------------------------------------------------
+
+const withBackup = { ...okTarget, backupDb: 'instdb', backupDir: '~/backups', runAs: 'me' };
+
+test('a refused rehearsal stops the go-live before any timer is stopped or any dump is written', () => {
+  const run = fakeShell({ rehearsalRefuses: true });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+
+  assert.equal(r.ok, false);
+  assert.equal(r.failedAt, 'PREFLIGHT');
+  assert.equal(r.refused, true);
+  assert.equal(run.scripts.length, 1, 'the rehearsal is the only thing that may run');
+  assert.ok(!/pg_dump/.test(run.all()), 'no backup may be written for a refused move');
+  assert.ok(!/systemctl stop/.test(run.all()), 'the deploy timer must be left running');
+  assert.deepEqual(stepNames(r), ['pre-flight (the upgrade, rehearsed with --dry-run)']);
+});
+
+test('the rehearsal is the REAL upgrade command plus --dry-run, and it runs first', () => {
+  const run = fakeShell();
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, true, `expected a clean run, got ${JSON.stringify(r.steps)}`);
+
+  // Same flags as the bump, so it asks exactly the gates the bump will ask — a
+  // rehearsal of a different command would be a check of something else.
+  assert.ok(run.scripts[0].includes(`${G.upgradeCommand(withBackup, '1.19.306')} --dry-run`));
+  const order = (needle) => run.scripts.findIndex((s) => s.includes(needle));
+  assert.ok(order('--dry-run') < order('pg_dump'), 'rehearse before the backup');
+  assert.ok(order('--dry-run') < order('systemctl stop'), 'rehearse before the timer stops');
+  assert.ok(order('pg_dump') < run.scripts.findIndex((s) => s.includes('bongos upgrade') && !s.includes('--dry-run')), 'the backup still precedes the real bump');
+});
+
+test('a refusal renders as "nothing changed", never as an unpushed pin', () => {
+  const run = fakeShell({ rehearsalRefuses: true });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  const out = G.renderReport(r);
+  assert.match(out, /Nothing changed — still on 1\.19\.300\. No timer was stopped and no backup was written\./);
+  assert.match(out, /5 unresolved artist reviews hold this deploy/, "the upgrade's own reason is shown");
+  assert.ok(!/pin committed/.test(out), 'no pin line for a bump that never started');
+});
+
+test('a successful dump is followed by a prune, and the step says what it removed', () => {
+  const run = fakeShell({ pruned: '3' });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, true);
+  const phaseA = run.scripts.find((s) => s.includes('##BACKUP##'));
+  assert.ok(phaseA.indexOf('##PRUNE##') > phaseA.indexOf('pg_dump'), 'prune only after the dump');
+  const step = r.steps.find((s) => /prune/.test(s.name));
+  assert.equal(step.name, `prune old pre-upgrade backups (keep the newest ${G.PRE_UPGRADE_KEEP})`);
+  assert.equal(step.detail, 'removed 3');
+  assert.equal(G.PRE_UPGRADE_KEEP, 10);
+});
+
+test('no backupDb, no dump, and no prune', () => {
+  const run = fakeShell();
+  const r = G.applyGoLive(okTarget, 'web', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, true);
+  assert.ok(!/##PRUNE##/.test(run.all()));
+  assert.ok(!r.steps.some((s) => /prune/.test(s.name)));
+});
+
+test('a prune that cannot run warns and does not fail the deploy', () => {
+  const step = G.pruneStep('prune exited non-zero');
+  assert.equal(step.ok, true, 'the dump is good; tidiness must not cost the deploy');
+  assert.equal(step.warn, true);
+  assert.match(step.detail, /could not prune \(prune exited non-zero\)/);
+  assert.equal(G.pruneStep(null).warn, true, 'a missing section is not "nothing to remove"');
+  assert.equal(G.pruneStep('0').detail, 'nothing to remove');
+  assert.match(G.renderReport({ targetName: 'x', from: 'a', to: 'b', ok: true, steps: [step] }), /⚠ prune old pre-upgrade backups/);
+});
+
+test('the dump fails when pg_dump fails, and a failed dump puts the stopped timer back', () => {
+  // The composed command: pipefail inside, and the partial file removed on failure.
+  const run = fakeShell();
+  G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run });
+  const phaseA = run.scripts.find((s) => s.includes('##BACKUP##'));
+  assert.ok(phaseA.includes('bash -c "set -o pipefail; mkdir -p ~/backups && { pg_dump instdb | gzip > ~/backups/pre-1.19.306-$TS.sql.gz || { rm -f ~/backups/pre-1.19.306-$TS.sql.gz; exit 1; }; }"'), phaseA);
+  assert.match(phaseA, /^TS="\$\(date -u \+%Y%m%dT%H%M%SZ\)"$/m, 'one timestamp for the dump and its cleanup');
+
+  const failing = fakeShell({ backupFails: true });
+  const r = G.applyGoLive(withBackup, 'web', '1.19.306', '1.19.300', { run: failing });
+  assert.equal(r.ok, false);
+  assert.equal(r.failedAt, 'PREPARE');
+  assert.ok(!failing.scripts.some((s) => s.includes('bongos upgrade') && !s.includes('--dry-run')), 'no bump without a backup');
+  assert.match(failing.scripts[failing.scripts.length - 1], /systemctl start inst-deploy\.timer/, 'the stopped timer is restarted');
+});
+
+// The prune command itself, run for real in a scratch directory. The composed-string
+// tests above cannot tell a glob that matches nothing from one that matches too much.
+test('the prune keeps the newest ten by time, and leaves every other file alone', { skip: process.platform === 'win32' && 'needs a POSIX shell' }, async () => {
+  const { spawnSync } = await import('node:child_process');
+  const os = await import('node:os');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'golive-prune-'));
+  try {
+    const dumps = [];
+    // 13 dumps, oldest first, whose NAME order disagrees with their TIME order.
+    for (let i = 0; i < 13; i++) {
+      const name = `pre-1.19.${i % 2 ? 99 - i : 100 + i}-202609${String(10 + i).padStart(2, '0')}T000000Z.sql.gz`;
+      const f = path.join(dir, name);
+      fs.writeFileSync(f, 'x');
+      const t = Date.UTC(2026, 8, 10 + i) / 1000;
+      fs.utimesSync(f, t, t);
+      dumps.push(name);
+    }
+    const others = ['pre-lane-sweep-20260823T203810Z.sql.gz', 'cloudbongos-2026-09-26T040000Z.sql.gz', 'notes.txt'];
+    for (const o of others) {
+      fs.writeFileSync(path.join(dir, o), 'x');
+      fs.utimesSync(path.join(dir, o), 1, 1); // older than every dump
+    }
+
+    const res = spawnSync('sh', ['-c', G.pruneCommand(dir)], { encoding: 'utf8' });
+    assert.equal(res.status, 0, res.stderr);
+    assert.equal(res.stdout.trim(), '3');
+    const left = new Set(fs.readdirSync(dir));
+    for (const d of dumps.slice(0, 3)) assert.ok(!left.has(d), `${d} is one of the three oldest and must go`);
+    for (const d of dumps.slice(3)) assert.ok(left.has(d), `${d} is one of the newest ten and must stay`);
+    for (const o of others) assert.ok(left.has(o), `${o} is not a pre-upgrade dump and must never be pruned`);
+
+    // A second run has nothing left to do.
+    assert.equal(spawnSync('sh', ['-c', G.pruneCommand(dir)], { encoding: 'utf8' }).stdout.trim(), '0');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});