@bongos/core 1.19.1081 → 1.20.1

package/tests/render_deploy.mjs

@@ -0,0 +1,495 @@
+// tests/render_deploy.mjs — the render-deploy module (task 1004270): the deploy page of a
+// project whose app deploys through Render.
+//
+// WHAT IS AT RISK. A press on this page acts on the OWNER's Render account, so the failures
+// that matter are quiet ones: a deploy or rollback that goes ahead without the second step, or
+// against a picture that went stale; a rollback to a deploy that never ran; an act that reaches
+// a service in someone else's workspace; the key ending up in a response; a module that is off
+// still answering. Each case below pins one of them.
+//
+// NOTHING HERE TOUCHES RENDER. The client is a stub (or the real client over a recording fake
+// fetch), and the pool is a stub. No key, no network.
+//
+// Run:  node tests/render_deploy.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const deploys = require('../modules/render-deploy/deploys.js');
+const buildApp = require('../modules/render-deploy/routes/app.js');
+const buildHistory = require('../modules/render-deploy/routes/history.js');
+const buildAct = require('../modules/render-deploy/routes/act.js');
+const { RenderApi } = require('../scripts/gds/render-api.js');
+
+const KEY = 'rnd_TESTKEYTESTKEYTESTKEY1234';
+const OWNER = 'tea-ownerownerowner';
+const SERVICE = 'srv-serviceservice1';
+const APP = { owner_id: OWNER, service_id: SERVICE, service_name: 'shop' };
+
+// Newest first, as Render lists them.
+const D = (id, status, commitId, message, at) => ({ id, status, trigger: 'new_commit', createdAt: at, finishedAt: at, commit: { id: commitId, message, createdAt: at } });
+const DEPLOYS = [
+  D('dep-live00000001', 'live', 'c3c3c3c3c3', 'Merge pull request from x/task-1004057\n\nbody', '2026-09-29T12:00:00Z'),
+  D('dep-old000000002', 'deactivated', 'c2c2c2c2c2', 'a change with no id', '2026-09-28T12:00:00Z'),
+  D('dep-fail00000003', 'build_failed', 'c1c1c1c1c1', 'broken build', '2026-09-27T12:00:00Z'),
+  D('dep-first0000004', 'deactivated', 'c0c0c0c0c0', 'the first deploy shown', '2026-09-26T12:00:00Z'),
+];
+const SERVICE_OBJ = { id: SERVICE, name: 'shop', ownerId: OWNER, serviceDetails: { plan: 'starter', url: 'https://shop.onrender.com' }, previews: { generation: 'off' } };
+
+function fakePool({ ledger = [], titles = {}, app = APP } = {}) {
+  const calls = [];
+  return {
+    calls,
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (/FROM render_deploy_app/.test(sql)) return { rows: app ? [app] : [] };
+      if (/INSERT INTO render_deploy_app/.test(sql)) return { rows: [{ owner_id: params[0], service_id: params[1], service_name: params[2], connected_at: 'now' }] };
+      if (/WHERE status = ANY/.test(sql)) return { rows: ledger };
+      if (/WHERE id = ANY/.test(sql)) return { rows: params[0].filter((id) => titles[id]).map((id) => ({ id, title: titles[id] })) };
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+
+// A stub Render client that records every call. `list` is what Render's deploy list says.
+function stubClient({ list = DEPLOYS, owners = [{ id: OWNER }], service = SERVICE_OBJ } = {}) {
+  const calls = [];
+  return {
+    calls,
+    async listOwners() { calls.push('listOwners'); return owners; },
+    async getService(id) { calls.push(`getService ${id}`); return service; },
+    async listDeploys() { calls.push('listDeploys'); return list; },
+    async rollbackTo(sid, did) { calls.push(`rollbackTo ${did}`); return { id: 'dep-new000000009' }; },
+    async triggerDeploy(sid) { calls.push('triggerDeploy'); return { id: 'dep-new000000009' }; },
+  };
+}
+
+// Drive a route's LAST handler (after its gates) with a fake req/res.
+function handlerOf(router, method, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  return layer.route.stack.at(-1).handle;
+}
+async function call(handler, { body, headers = {}, builder = { id: 3 } } = {}) {
+  const out = { status: 200, body: null };
+  const res = { status(s) { out.status = s; return this; }, json(v) { out.body = v; return this; } };
+  await handler({ body, headers, builder, query: {} }, res);
+  return out;
+}
+const withKey = { 'x-render-key': KEY };
+
+// ---- the history: tasks in each deploy, and what is live ---------------------------------
+
+test('a deploy carries the tasks its commit names, and the tasks the ledger shipped in its range', () => {
+  const h = deploys.shapeHistory({
+    service: SERVICE_OBJ,
+    deploys: DEPLOYS,
+    ledger: [
+      { id: '2001', title: 'Shipped between the old and the live commit', at: '2026-09-29T06:00:00Z' },
+      { id: '2002', title: 'Shipped before that range', at: '2026-09-28T06:00:00Z' },
+    ],
+    titles: { 1004057: 'The named task' },
+  });
+  const live = h.deploys[0];
+  assert.deepEqual(live.tasks.map((t) => [t.id, t.via]), [['1004057', 'named'], ['2001', 'window']]);
+  assert.equal(live.tasks[0].title, 'The named task');
+  // 2002 falls in the range of the older deploy (26th, 27th and 28th), not the live one's.
+  assert.ok(!live.tasks.some((t) => t.id === '2002'));
+  assert.ok(h.deploys[1].tasks.some((t) => t.id === '2002'), 'and it lands in the range it belongs to');
+});
+
+test('the oldest deploy shown says its range starts there, and gets no window tasks', () => {
+  const h = deploys.shapeHistory({ service: SERVICE_OBJ, deploys: DEPLOYS, ledger: [{ id: '2003', title: 'x', at: '2026-09-20T00:00:00Z' }] });
+  const oldest = h.deploys.at(-1);
+  assert.equal(oldest.rangeStartsHere, true);
+  assert.deepEqual(oldest.tasks, []);
+  assert.equal(h.deploys[0].rangeStartsHere, false);
+});
+
+test('two deploys of one commit carry nothing new: the range runs back to the previous DIFFERENT commit', () => {
+  const list = [
+    D('dep-redeploy00001', 'live', 'cbcbcbcbcb', 'same commit', '2026-09-29T12:00:00Z'),
+    D('dep-firstdeploy02', 'deactivated', 'cbcbcbcbcb', 'same commit', '2026-09-29T12:00:00Z'),
+    D('dep-earlier000003', 'deactivated', 'caca000000', 'earlier', '2026-09-28T12:00:00Z'),
+  ];
+  const h = deploys.shapeHistory({ service: SERVICE_OBJ, deploys: list, ledger: [{ id: '77', title: 't', at: '2026-09-29T00:00:00Z' }] });
+  assert.equal(h.deploys[0].tasks.some((t) => t.id === '77'), true, 'the redeploy spans back past its twin');
+});
+
+test('exactly the live deploy is marked live, and the page is told which it is', () => {
+  const h = deploys.shapeHistory({ service: SERVICE_OBJ, deploys: DEPLOYS });
+  assert.equal(h.liveDeployId, 'dep-live00000001');
+  assert.deepEqual(h.deploys.filter((d) => d.live).map((d) => d.id), ['dep-live00000001']);
+  const none = deploys.shapeHistory({ service: SERVICE_OBJ, deploys: DEPLOYS.slice(1) });
+  assert.equal(none.liveDeployId, null, 'nothing live is said as nothing live, not guessed');
+});
+
+test('only a deploy that ran and was replaced can be rolled back to', () => {
+  const h = deploys.shapeHistory({ service: SERVICE_OBJ, deploys: DEPLOYS });
+  const by = Object.fromEntries(h.deploys.map((d) => [d.id, d.canRollbackTo]));
+  assert.deepEqual(by, { 'dep-live00000001': false, 'dep-old000000002': true, 'dep-fail00000003': false, 'dep-first0000004': true });
+});
+
+test('a status is shown in words, never as the slug', () => {
+  const h = deploys.shapeHistory({ service: SERVICE_OBJ, deploys: DEPLOYS });
+  assert.equal(h.deploys[2].statusWords, 'The build failed');
+  assert.doesNotMatch(JSON.stringify(h.deploys.map((d) => d.statusWords)), /build_failed|deactivated/);
+});
+
+test('every deploy says whether it can be previewed, and where it cannot it says so and why', () => {
+  const h = deploys.shapeHistory({ service: SERVICE_OBJ, deploys: DEPLOYS });
+  for (const d of h.deploys) {
+    assert.equal(d.preview.available, false);
+    assert.match(d.preview.reason, /roll back to it/);
+  }
+  const withPr = deploys.previewOf({ previews: { generation: 'automatic' } });
+  assert.equal(withPr.available, false, 'a plan with preview environments still has no per-deploy address');
+  assert.match(withPr.reason, /pull requests/);
+});
+
+test('a press says what it costs, one sentence per action, and the plan it lands on', () => {
+  const c = deploys.costOf(SERVICE_OBJ);
+  assert.match(c.deploy, /starter/);
+  assert.match(c.deploy, /build minutes/);
+  assert.match(c.rollback, /no new build/);
+});
+
+test('the history reading goes through the guarded client and the ledger, and names the service', async () => {
+  const client = stubClient();
+  const pool = fakePool({ ledger: [{ id: '2001', title: 'Shipped in range', at: new Date('2026-09-29T06:00:00Z') }], titles: { 1004057: 'Named' } });
+  const h = await deploys.readHistory({ pool, client, app: APP });
+  assert.equal(h.app.serviceName, 'shop');
+  assert.equal(h.service.plan, 'starter');
+  assert.equal(h.deploys[0].tasks.length, 2);
+  assert.deepEqual(client.calls.slice(0, 2), [`getService ${SERVICE}`, 'listDeploys']);
+});
+
+// ---- the routes ---------------------------------------------------------------------------
+
+test('history: no connected app, then no key, then the reading', async () => {
+  const off = await call(handlerOf(buildHistory({ makeClient: () => stubClient(), pool: fakePool({ app: null }) }), 'get', '/render-deploy/history'), { headers: withKey });
+  assert.deepEqual(off.body, { connected: false });
+  const client = stubClient();
+  const h = handlerOf(buildHistory({ makeClient: () => client, pool: fakePool() }), 'get', '/render-deploy/history');
+  const nokey = await call(h, {});
+  assert.equal(nokey.body.needsKey, true);
+  assert.equal(client.calls.length, 0, 'no key, no call to Render');
+  const read = await call(h, { headers: withKey });
+  assert.equal(read.body.liveDeployId, 'dep-live00000001');
+});
+
+test('history: the key is used for the client and never appears in an answer', async () => {
+  let seenKey = null;
+  const h = handlerOf(buildHistory({ makeClient: ({ key, ownerId }) => { seenKey = key; assert.equal(ownerId, OWNER, 'the client is bound to the connected workspace'); return stubClient(); }, pool: fakePool() }), 'get', '/render-deploy/history');
+  const r = await call(h, { headers: withKey });
+  assert.equal(seenKey, KEY);
+  assert.ok(!JSON.stringify(r.body).includes(KEY));
+});
+
+test('a key of the wrong shape is treated as no key', async () => {
+  const client = stubClient();
+  const h = handlerOf(buildHistory({ makeClient: () => client, pool: fakePool() }), 'get', '/render-deploy/history');
+  const r = await call(h, { headers: { 'x-render-key': 'not-a-render-key' } });
+  assert.equal(r.body.needsKey, true);
+  assert.equal(client.calls.length, 0);
+});
+
+function actHandler(client, pool = fakePool()) { return handlerOf(buildAct({ makeClient: () => client, pool }), 'post', '/render-deploy/act'); }
+const press = (over = {}) => ({ action: 'rollback', deployId: 'dep-old000000002', confirm: true, expectLiveDeployId: 'dep-live00000001', ...over });
+
+test('step two: an act without confirm true does nothing, and never reaches Render', async () => {
+  for (const body of [press({ confirm: undefined }), press({ confirm: 'yes' }), press({ confirm: false })]) {
+    const client = stubClient();
+    const r = await call(actHandler(client), { body, headers: withKey });
+    assert.equal(r.status, 400);
+    assert.equal(r.body.error.code, 'confirm_needed');
+    assert.equal(client.calls.length, 0);
+  }
+});
+
+test('step two: a confirm that names no live deploy is refused', async () => {
+  const client = stubClient();
+  const r = await call(actHandler(client), { body: press({ expectLiveDeployId: undefined }), headers: withKey });
+  assert.equal(r.body.error.code, 'expectation_needed');
+  assert.equal(client.calls.length, 0);
+});
+
+test('a stale confirm is refused: what was live when step one was drawn is not live now', async () => {
+  const client = stubClient();
+  const r = await call(actHandler(client), { body: press({ expectLiveDeployId: 'dep-someother0005' }), headers: withKey });
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error.code, 'stale_history');
+  assert.ok(!client.calls.some((c) => /^rollbackTo|triggerDeploy/.test(c)), 'nothing was sent to Render');
+});
+
+test('a rollback to a deploy that is the live one, never ran, or is not in this service is refused before any write', async () => {
+  for (const [deployId, code] of [['dep-live00000001', 'already_live'], ['dep-fail00000003', 'not_rollbackable'], ['dep-elsewhere0007', 'deploy_not_found']]) {
+    const client = stubClient();
+    const r = await call(actHandler(client), { body: press({ deployId }), headers: withKey });
+    assert.equal(r.body.error.code, code, deployId);
+    assert.ok(!client.calls.some((c) => /^rollbackTo|triggerDeploy/.test(c)), `${deployId}: no write`);
+  }
+});
+
+test('a confirmed rollback sends exactly one rollback, and reads Render back', async () => {
+  const client = stubClient();
+  const r = await call(actHandler(client), { body: press(), headers: withKey });
+  assert.equal(r.status, 200);
+  assert.deepEqual(client.calls.filter((c) => /^rollbackTo|triggerDeploy/.test(c)), ['rollbackTo dep-old000000002']);
+  assert.equal(r.body.started.deployId, 'dep-new000000009');
+  assert.equal(r.body.render.deployId, 'dep-live00000001', 'the answer carries what Render lists now, not just its own 2xx');
+});
+
+test('a confirmed deploy sends exactly one deploy trigger', async () => {
+  const client = stubClient();
+  const r = await call(actHandler(client), { body: { action: 'deploy', confirm: true, expectLiveDeployId: 'dep-live00000001' }, headers: withKey });
+  assert.equal(r.status, 200);
+  assert.deepEqual(client.calls.filter((c) => /^rollbackTo|triggerDeploy/.test(c)), ['triggerDeploy']);
+});
+
+test('an act with no key, no app, or an unknown action does nothing', async () => {
+  const c1 = stubClient();
+  assert.equal((await call(actHandler(c1), { body: press() })).body.error.code, 'render_key_needed');
+  assert.equal((await call(actHandler(c1, fakePool({ app: null })), { body: press(), headers: withKey })).body.error.code, 'not_connected');
+  assert.equal((await call(actHandler(c1), { body: press({ action: 'delete' }), headers: withKey })).body.error.code, 'bad_action');
+  assert.equal(c1.calls.length, 0);
+});
+
+test('a Render refusal is answered without the key, and a 401 from Render is not a Bongos sign-out', async () => {
+  const bad = stubClient();
+  bad.listDeploys = async () => { const e = new Error(`Render GET failed: bearer ${KEY}`); e.name = 'RenderApiError'; e.status = 401; throw e; };
+  const r = await call(actHandler(bad), { body: press(), headers: withKey });
+  assert.equal(r.status, 422, 'never 401: the page would send the browser to sign in');
+  assert.ok(!JSON.stringify(r.body).includes(KEY));
+});
+
+test('an answer from another workspace stops the act', async () => {
+  const bad = stubClient();
+  bad.listDeploys = async () => { const e = new Error('mismatch'); e.name = 'RenderOwnerMismatch'; throw e; };
+  const r = await call(actHandler(bad), { body: press(), headers: withKey });
+  assert.equal(r.status, 403);
+  assert.equal(r.body.error.code, 'wrong_workspace');
+});
+
+test('connect: the workspace must be one the key can act in, and the service one inside it', async () => {
+  const pool = fakePool({ app: null });
+  const put = (client) => handlerOf(buildApp({ makeClient: () => client, pool }), 'put', '/render-deploy/app');
+  const body = { ownerId: OWNER, serviceId: SERVICE };
+
+  const out = stubClient({ owners: [{ id: 'tea-someoneelse0001' }] });
+  const r1 = await call(put(out), { body, headers: withKey });
+  assert.equal(r1.body.error.code, 'workspace_not_reachable');
+  assert.ok(!pool.calls.some((c) => /INSERT/.test(c.sql)), 'nothing was saved');
+
+  const mismatched = stubClient();
+  mismatched.getService = async () => { const e = new Error('other workspace'); e.name = 'RenderOwnerMismatch'; throw e; };
+  const r2 = await call(put(mismatched), { body, headers: withKey });
+  assert.equal(r2.status, 403);
+  assert.ok(!pool.calls.some((c) => /INSERT/.test(c.sql)));
+
+  const r3 = await call(put(stubClient()), { body, headers: withKey });
+  assert.equal(r3.status, 200);
+  assert.equal(r3.body.app.serviceName, 'shop');
+  assert.ok(pool.calls.some((c) => /INSERT/.test(c.sql)));
+  assert.ok(!JSON.stringify(pool.calls).includes(KEY), 'the key is in no query');
+
+  for (const bad of [{ ownerId: 'nope', serviceId: SERVICE }, { ownerId: OWNER, serviceId: 'nope' }]) {
+    assert.equal((await call(put(stubClient()), { body: bad, headers: withKey })).status, 400);
+  }
+});
+
+test('the routes are gated on the deploy door atom, and none is a bare requireRank', () => {
+  for (const f of ['app', 'history', 'act']) {
+    const src = fs.readFileSync(path.join(ROOT, 'modules/render-deploy/routes', `${f}.js`), 'utf8');
+    const routes = src.match(/router\.(get|put|post)\(/g) || [];
+    const gated = src.match(/api\.requireBuilder, api\.requirePermission\('core\.pin\.move'\)/g) || [];
+    assert.equal(gated.length, routes.length, `${f}: every route carries the gate`);
+    assert.doesNotMatch(src, /api\.requireRank\(/);
+  }
+});
+
+test('the key is never stored, logged or written: no module file puts it in a query, a log line or storage', () => {
+  const dir = path.join(ROOT, 'modules/render-deploy');
+  const files = ['deploys.js', 'render.js', 'routes/app.js', 'routes/history.js', 'routes/act.js', 'public/deploy.js'];
+  for (const f of files) {
+    const src = fs.readFileSync(path.join(dir, f), 'utf8');
+    assert.doesNotMatch(src, /localStorage|sessionStorage|document\.cookie/, `${f} keeps nothing in the browser`);
+    assert.doesNotMatch(src, /log\.(info|warn|error)\([^)]*\bkey\b/, `${f} logs no key`);
+  }
+  const migration = fs.readFileSync(path.join(dir, 'migrations/render_deploy_001_app.sql'), 'utf8');
+  const cols = [...migration.matchAll(/^ {2}([a-z_]+) /gm)].map((m) => m[1]);
+  assert.deepEqual(cols, ["id", "owner_id", "service_id", "service_name", "connected_by", "connected_at"], "no column could hold a key");
+});
+
+// ---- the one client, and its workspace guard ---------------------------------------------
+
+test('the real client refuses a rollback into another workspace before any write', async () => {
+  const seen = [];
+  const fetchImpl = async (url, init) => {
+    seen.push(`${init.method} ${url.replace('https://api.render.com/v1', '')}`);
+    return { ok: true, status: 200, text: async () => JSON.stringify({ id: SERVICE, ownerId: 'tea-someoneelse0001' }) };
+  };
+  const api = new RenderApi({ token: KEY, ownerId: OWNER, dryRun: false, fetchImpl });
+  await assert.rejects(() => api.rollbackTo(SERVICE, 'dep-old000000002'), (e) => e.name === 'RenderOwnerMismatch');
+  await assert.rejects(() => api.listDeploys(SERVICE), (e) => e.name === 'RenderOwnerMismatch');
+  assert.ok(!seen.some((s) => s.startsWith('POST')), 'no POST was sent');
+});
+
+test('the real client lists deploys in either of Render\'s shapes and posts the rollback to the service', async () => {
+  const seen = [];
+  const fetchImpl = async (url, init) => {
+    const p = url.replace('https://api.render.com/v1', '');
+    seen.push(`${init.method} ${p}${init.body ? ' ' + init.body : ''}`);
+    if (p === `/services/${SERVICE}`) return { ok: true, status: 200, text: async () => JSON.stringify(SERVICE_OBJ) };
+    if (p.startsWith(`/services/${SERVICE}/deploys`)) return { ok: true, status: 200, text: async () => JSON.stringify([{ deploy: DEPLOYS[0], cursor: 'a' }, DEPLOYS[1]]) };
+    return { ok: true, status: 200, text: async () => JSON.stringify({ id: 'dep-new000000009' }) };
+  };
+  const api = new RenderApi({ token: KEY, ownerId: OWNER, dryRun: false, fetchImpl });
+  assert.deepEqual((await api.listDeploys(SERVICE)).map((d) => d.id), ['dep-live00000001', 'dep-old000000002']);
+  await api.rollbackTo(SERVICE, 'dep-old000000002');
+  assert.ok(seen.includes(`POST /services/${SERVICE}/rollback {"deployId":"dep-old000000002"}`));
+});
+
+// ---- the module: on and off ----------------------------------------------------------------
+
+test('the manifest is default-off, and declares the three routes it ships', () => {
+  const m = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/render-deploy/module.json'), 'utf8'));
+  assert.equal(m.default, false);
+  assert.deepEqual(m.contributes.routes.sort(), ['act', 'app', 'history']);
+  for (const r of m.contributes.routes) assert.ok(fs.existsSync(path.join(ROOT, 'modules/render-deploy/routes', `${r}.js`)));
+});
+
+test('turned off, the loader mounts none of its routes; turned on, it mounts all three', () => {
+  const loader = require('../src/module-loader/loader.js');
+  const mountedFor = (isEnabled) => {
+    loader._reset();
+    const routers = [];
+    loader.mountModuleRoutes({ use: (r) => routers.push(r) }, { isEnabled });
+    const paths = routers.flatMap((r) => (r.stack || []).filter((l) => l.route).map((l) => l.route.path));
+    return paths.filter((p) => p.startsWith('/render-deploy/'));
+  };
+  const on = mountedFor((k) => k === 'render-deploy' || k === 'government' || k === 'lifecycle' || k === 'hall-ui' || k === 'memory');
+  assert.deepEqual([...new Set(on)].sort(), ['/render-deploy/act', '/render-deploy/app', '/render-deploy/history']);
+  const off = mountedFor((k) => k !== 'render-deploy');
+  assert.deepEqual(off, [], 'no route of a module that is off');
+  loader._reset();
+});
+
+test('the hall serves /deploy where the module is on, and sends every other hall to Settings', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
+  assert.match(src, /isModuleEnabled\('provisioning'\) \|\| isModuleEnabled\('render-deploy'\)/);
+});
+
+// ---- the page --------------------------------------------------------------------------------
+
+function pageHarness({ responses }) {
+  const els = {};
+  const mk = (id) => (els[id] = els[id] || { id, hidden: true, value: '', handlers: {}, _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; }, addEventListener(t, fn) { this.handlers[t] = fn; } });
+  const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  class Element {}
+  const requests = [];
+  let click = null;
+  const KNOWN = ['rd-panel', 'rd-list', 'rd-key', 'rd-owner', 'rd-service'];
+  const document = {
+    getElementById: (id) => (KNOWN.includes(id) ? mk(id) : null),
+    addEventListener: (t, fn) => { if (t === 'click') click = fn; },
+    createElement: () => ({}),
+    head: { appendChild() {} },
+  };
+  mk('rd-panel').contains = () => true;
+  const window = {
+    OTB: { escapeHtml },
+    BongosClient: { createClient: () => ({ request: async (method, url, o) => { requests.push({ method, url, headers: (o && o.headers) || {}, body: o && o.body }); return responses(method, url, o); } }) },
+    location: { assign() {} },
+  };
+  const ctx = vm.createContext({ window, document, Element, Date, Number, String, Promise, setTimeout });
+  vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/render-deploy/public/deploy.js'), 'utf8'), ctx);
+  const tick = () => new Promise((r) => setTimeout(r, 15));
+  // A press on whatever matches `selector`, with an optional data attribute value.
+  const press = async (selector, attr) => {
+    const t = new Element();
+    t.closest = (sel) => (sel === selector || (attr && sel === `[${attr[0]}]`) ? { getAttribute: () => attr && attr[1] } : null);
+    click({ target: t });
+    await tick();
+  };
+  const typeKey = (v) => els['rd-key'].handlers.input({ target: { value: v } });
+  return { els, requests, press, typeKey, tick, list: () => els['rd-list'].innerHTML };
+}
+const url_ends = (u, tail) => String(u).endsWith(tail);
+const ok = (data) => ({ ok: true, status: 200, data });
+const HIST = () => ({ connected: true, needsKey: false, app: { serviceName: 'shop', serviceId: SERVICE }, service: { plan: 'starter' }, ...deploys.shapeHistory({ service: SERVICE_OBJ, deploys: DEPLOYS, titles: { 1004057: 'The named task' } }) });
+const APPRES = ok({ app: { serviceName: 'shop', serviceId: SERVICE } });
+
+function livePage(actAnswer) {
+  return pageHarness({ responses: (m, url) => {
+    if (url_ends(url, "/render-deploy/app")) return APPRES;
+    if (url_ends(url, "/render-deploy/act")) return actAnswer || ok({ ok: true, render: { statusWords: 'Building' } });
+    return ok(HIST());
+  } });
+}
+
+test('the page asks for the key before it reads anything, and sends none until one is typed', async () => {
+  const h = livePage();
+  await h.tick();
+  assert.match(h.list(), /Read from Render/);
+  assert.ok(!h.requests.some((r) => r.headers['x-render-key']), 'no key on the wire yet');
+  h.typeKey(KEY);
+  await h.press('#rd-read');
+  const read = h.requests.at(-1);
+  assert.equal(read.headers['x-render-key'], KEY, 'the key rides the header');
+  assert.ok(!/rnd_/.test(read.url), 'and never the address');
+  assert.ok(!('key' in (read.body || {})), 'and never a body');
+});
+
+test('the page draws the live mark, the tasks in each deploy, and the plain word on previews', async () => {
+  const h = livePage();
+  await h.tick(); h.typeKey(KEY); await h.press('#rd-read');
+  const html = h.list();
+  assert.match(html, /Live now/);
+  assert.match(html, /The named task/);
+  assert.match(html, /named in the commit/);
+  assert.match(html, /the oldest deploy shown, so its range starts here/);
+  await h.press('[data-view]', ['data-view', 'dep-old000000002']);
+  assert.match(h.list(), /You’re viewing deploy c2c2c2c/);
+  assert.match(h.list(), /roll back to it/);
+  await h.press('#rd-unview');
+  assert.doesNotMatch(h.list(), /You’re viewing/);
+});
+
+test('pressing Roll back only opens step two: what happens, what it costs, and no request', async () => {
+  const h = livePage();
+  await h.tick(); h.typeKey(KEY); await h.press('#rd-read');
+  const before = h.requests.length;
+  await h.press('[data-rollback]', ['data-rollback', 'dep-old000000002']);
+  assert.equal(h.requests.length, before, 'no request was sent by the first press');
+  assert.match(h.list(), /Check this before you confirm/);
+  assert.match(h.list(), /runs no new build/);
+  assert.match(h.list(), /Confirm roll back/);
+  await h.press('#rd-cancel');
+  assert.doesNotMatch(h.list(), /Confirm roll back/);
+});
+
+test('the confirm sends the deploy that was shown, confirm true, and the deploy that was live', async () => {
+  const h = livePage();
+  await h.tick(); h.typeKey(KEY); await h.press('#rd-read');
+  await h.press('[data-rollback]', ['data-rollback', 'dep-old000000002']);
+  await h.press('#rd-confirm');
+  const act = h.requests.find((r) => url_ends(r.url, "/render-deploy/act"));
+  assert.deepEqual(JSON.parse(JSON.stringify(act.body)), { action: 'rollback', deployId: 'dep-old000000002', confirm: true, expectLiveDeployId: 'dep-live00000001' });
+  assert.equal(act.headers['x-render-key'], KEY);
+  assert.match(h.list(), /Render accepted it/);
+});
+
+test('a refusal from the server is shown, with the words that nothing was changed', async () => {
+  const h = livePage({ ok: false, status: 409, data: { error: { code: 'stale_history', message: 'What is live on Render changed since you were shown this step.' } } });
+  await h.tick(); h.typeKey(KEY); await h.press('#rd-read');
+  await h.press('#rd-deploy');
+  await h.press('#rd-confirm');
+  assert.match(h.list(), /Nothing was changed/);
+  assert.match(h.list(), /changed since you were shown this step/);
+});

package/tests/ship_preflight.mjs

@@ -321,23 +321,22 @@ test('findMainWorktree: returns null outside any git repo', () => {
 // ---- closeoutPlan (task 932) ----
 
 test('closeoutPlan: clean tree → clean:true, no leftover', () => {
-  const plan = closeoutPlan('', 932);
+  const plan = closeoutPlan('');
   assert.equal(plan.clean, true);
   assert.deepEqual(plan.leftover, []);
-  assert.equal(plan.stashLabel, 'otb-postship-932');
 });
 
 test('closeoutPlan: null porcelain is treated as clean', () => {
-  const plan = closeoutPlan(null, 7);
+  const plan = closeoutPlan(null);
   assert.equal(plan.clean, true);
   assert.deepEqual(plan.leftover, []);
 });
 
 test('closeoutPlan: untracked-only scratch counts as leftover (preflight lets it through)', () => {
   // The preflight (trackedDirty) IGNORES untracked, so untracked scratch is the
-  // common post-ship leftover — closeoutPlan must still flag it for stashing.
+  // common post-ship leftover — closeoutPlan must still flag it.
   const out = '?? scratch/notes.md\n?? art/tmp.png\n';
-  const plan = closeoutPlan(out, 100);
+  const plan = closeoutPlan(out);
   assert.equal(plan.clean, false);
   assert.deepEqual(plan.leftover, ['scratch/notes.md', 'art/tmp.png']);
   // trackedDirty would have seen these as clean — the two helpers differ on purpose.
@@ -346,13 +345,67 @@ test('closeoutPlan: untracked-only scratch counts as leftover (preflight lets it
 
 test('closeoutPlan: tracked + untracked mix → all paths, clean:false', () => {
   const out = ' M scripts/gds/ship.js\n?? scratch.txt\nR  a.js -> b.js\n';
-  const plan = closeoutPlan(out, 932);
+  const plan = closeoutPlan(out);
   assert.equal(plan.clean, false);
   assert.deepEqual(plan.leftover, ['scripts/gds/ship.js', 'scratch.txt', 'b.js']);
 });
 
-test('closeoutPlan: stashLabel embeds the task id', () => {
-  assert.equal(closeoutPlan('?? x\n', 1234).stashLabel, 'otb-postship-1234');
+// task 1004254: the close-out REPORTS leftovers and leaves them in place. The
+// stash stack is repo-global across every worktree, so stashing there put one
+// builder's scratch (and an owner's review renders) where another agent's pop
+// could apply it to the wrong branch. Run the real close-out in a throwaway repo.
+test('postShipCloseout: lists leftovers, leaves them in place, never touches the stash', () => {
+  const { postShipCloseout } = require('../scripts/gds/ship-finish.js');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'closeout-'));
+  const prevCwd = process.cwd();
+  const origLog = console.log;
+  const lines = [];
+  try {
+    execSync('git init -q', { cwd: tmp });
+    execSync('git config user.email t@t.t && git config user.name t', { cwd: tmp, shell: true });
+    fs.writeFileSync(path.join(tmp, 'a.txt'), 'one\n');
+    execSync('git add a.txt && git commit -q -m init', { cwd: tmp, shell: true });
+    fs.writeFileSync(path.join(tmp, 'a.txt'), 'edited\n');
+    fs.writeFileSync(path.join(tmp, 'render-after.png'), 'png');
+    process.chdir(tmp);
+    console.log = (...a) => lines.push(a.join(' '));
+    postShipCloseout(1004254);
+  } finally {
+    console.log = origLog;
+    process.chdir(prevCwd);
+  }
+  try {
+    const out = lines.join('\n');
+    assert.match(out, /2 uncommitted\/untracked path\(s\)/);
+    assert.match(out, /^  a\.txt$/m); // the whole path — gitOk's trim() once listed it as '.txt'
+    assert.match(out, /render-after\.png/);
+    assert.match(out, /left in place/);
+    assert.doesNotMatch(out, /stash/i);
+    assert.equal(execSync('git stash list', { cwd: tmp, encoding: 'utf8' }).trim(), '');
+    assert.equal(fs.readFileSync(path.join(tmp, 'render-after.png'), 'utf8'), 'png');
+    assert.equal(fs.readFileSync(path.join(tmp, 'a.txt'), 'utf8'), 'edited\n');
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('postShipCloseout: a clean tree reports archive-ready', () => {
+  const { postShipCloseout } = require('../scripts/gds/ship-finish.js');
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'closeout-'));
+  const prevCwd = process.cwd();
+  const origLog = console.log;
+  const lines = [];
+  try {
+    execSync('git init -q', { cwd: tmp });
+    process.chdir(tmp);
+    console.log = (...a) => lines.push(a.join(' '));
+    postShipCloseout(7);
+  } finally {
+    console.log = origLog;
+    process.chdir(prevCwd);
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+  assert.match(lines.join('\n'), /working tree clean/);
 });
 
 // ---- the residual phantom ship: untracked files left behind (task 1001436) ----

package/tests/smoke_dependencies_witness.mjs

@@ -0,0 +1,46 @@
+// tests/smoke_dependencies_witness.mjs
+//
+// task 1004191 (finding 62 of the task 1000379 audit): scripts/gds/smoke-dependencies.sh
+// is the only round-trip for the auto-promotion trigger, and its status check used
+// to assert on task A — which the script itself promotes BY HAND in an earlier
+// step. "A is ready after B ships" therefore passed with the trigger broken.
+//
+// The fix adds C: a dependent of B that nothing ever promotes by hand, checked to
+// be 'backlog' before B ships and 'ready' after. This pins that shape statically
+// (the smoke itself writes live tasks, so CI cannot run it).
+//
+// Run:  node tests/smoke_dependencies_witness.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { makeRunner } from './helpers.mjs';
+
+const { test, summary } = makeRunner();
+const src = readFileSync(new URL('../scripts/gds/smoke-dependencies.sh', import.meta.url), 'utf8');
+const code = src.split('\n').filter((l) => !/^\s*#/.test(l)).join('\n');
+
+await test('a second dependent C is created at backlog and wired to B', () => {
+  assert.match(code, /__smoke__ dep-test C [^"]*\\",\\"description\\":\\"smoke\\",\\"status\\":\\"backlog\\"/);
+  assert.match(code, /tasks\/\$C_ID\/dependencies"[\s\S]*depends_on_task_id\\": \$B_ID/);
+});
+
+await test('C is never promoted by hand', () => {
+  assert.doesNotMatch(code, /tasks\/\$C_ID\/promote/);
+});
+
+await test('C is asserted backlog BEFORE B ships and ready AFTER', () => {
+  const pre = code.indexOf('[ "$C_PRE" = "backlog" ]');
+  const ship = code.indexOf('tasks/$B_ID/ship');
+  const post = code.indexOf('[ "$C_STATUS" = "ready" ]');
+  assert.ok(pre >= 0 && ship > pre && post > ship, 'pre-check, ship, post-check in that order');
+});
+
+await test('the post-ship status assertion is not made on the hand-promoted A', () => {
+  assert.doesNotMatch(code, /\[ "\$A_STATUS" = "ready" \]/);
+});
+
+await test('C is cleaned up (abandoned) like A', () => {
+  assert.match(code, /tasks\/\$C_ID\/abandon/);
+});
+
+summary();