@bongos/core 1.19.788 → 1.19.790

package/docs/copy-registry.json

@@ -3,17 +3,17 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1776,
-    "unique_ids": 1535,
-    "certain": 1776,
+    "strings": 1793,
+    "unique_ids": 1549,
+    "certain": 1793,
     "heuristic": 0,
-    "duplicate_ids": 167
+    "duplicate_ids": 169
   },
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 82,
-      "strings": 1286
+      "files": 84,
+      "strings": 1303
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -86,6 +86,20 @@
         "modules/public-landing/public/projects.html:1162"
       ]
     },
+    {
+      "id": "9a685b01e2c6",
+      "surface": "builders-hall",
+      "text": "This page opens at a higher rank.",
+      "occurrences": 6,
+      "at": [
+        "modules/hall-ui/public/deploy.html:31",
+        "modules/hall-ui/public/gate.html:37",
+        "modules/hall-ui/public/government.html:37",
+        "modules/hall-ui/public/harbor.html:37",
+        "modules/hall-ui/public/project-settings.html:36",
+        "modules/hall-ui/public/watch.html:40"
+      ]
+    },
     {
       "id": "5df2baabf82e",
       "surface": "landing",
@@ -152,19 +166,6 @@
         "modules/hall-ui/public/watch.js:1306"
       ]
     },
-    {
-      "id": "9a685b01e2c6",
-      "surface": "builders-hall",
-      "text": "This page opens at a higher rank.",
-      "occurrences": 5,
-      "at": [
-        "modules/hall-ui/public/gate.html:37",
-        "modules/hall-ui/public/government.html:37",
-        "modules/hall-ui/public/harbor.html:37",
-        "modules/hall-ui/public/project-settings.html:36",
-        "modules/hall-ui/public/watch.html:40"
-      ]
-    },
     {
       "id": "4d8ee7d68974",
       "surface": "builders-hall",
@@ -247,7 +248,7 @@
         "modules/hall-ui/public/hall-render.js:275",
         "modules/hall-ui/public/hall-render.js:346",
         "modules/hall-ui/public/hall-render.js:415",
-        "modules/hall-ui/public/shell.js:418"
+        "modules/hall-ui/public/shell.js:422"
       ]
     },
     {
@@ -742,6 +743,16 @@
         "modules/hall-ui/public/settings.html:95"
       ]
     },
+    {
+      "id": "7ec7dc1adaa6",
+      "surface": "builders-hall",
+      "text": "Deploy — {{worldName}}",
+      "occurrences": 2,
+      "at": [
+        "modules/hall-ui/public/deploy.html:6",
+        "modules/hall-ui/public/deploy.html:6"
+      ]
+    },
     {
       "id": "457f4967541b",
       "surface": "builders-hall",
@@ -1002,6 +1013,16 @@
         "modules/hall-ui/public/modules.html:6"
       ]
     },
+    {
+      "id": "e77d5f3beaef",
+      "surface": "builders-hall",
+      "text": "Move to {…}",
+      "occurrences": 2,
+      "at": [
+        "modules/hall-ui/public/deploy.js:103",
+        "modules/hall-ui/public/deploy.js:161"
+      ]
+    },
     {
       "id": "4a167ef6e515",
       "surface": "landing",
@@ -1348,8 +1369,8 @@
       "text": "Sign out",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/shell.js:436",
-        "modules/hall-ui/public/shell.js:593"
+        "modules/hall-ui/public/shell.js:440",
+        "modules/hall-ui/public/shell.js:597"
       ]
     },
     {
@@ -4358,6 +4379,24 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "7ec7dc1adaa6",
+      "surface": "builders-hall",
+      "text": "Deploy — {{worldName}}",
+      "file": "modules/hall-ui/public/deploy.html",
+      "line": 6,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
+    {
+      "id": "7ec7dc1adaa6",
+      "surface": "builders-hall",
+      "text": "Deploy — {{worldName}}",
+      "file": "modules/hall-ui/public/deploy.html",
+      "line": 6,
+      "origin": "html-title",
+      "confidence": "certain"
+    },
     {
       "id": "8cac6be8afdf",
       "surface": "builders-hall",
@@ -5893,7 +5932,7 @@
       "surface": "builders-hall",
       "text": "Jump to a page or record",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 457,
+      "line": 461,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5902,7 +5941,7 @@
       "surface": "builders-hall",
       "text": "Jump to…",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 459,
+      "line": 463,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6347,6 +6386,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "c4b39de1e478",
+      "surface": "builders-hall",
+      "text": "Make it live",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 128,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "6b3d660e0e31",
       "surface": "builders-hall",
@@ -6383,6 +6431,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "6bd456635167",
+      "surface": "builders-hall",
+      "text": "Merging work does not put it in front of anyone. This is the step that does: it moves this instance onto a newer core, waits for the box to answer, and puts itself back if it does not.",
+      "file": "modules/hall-ui/public/deploy.html",
+      "line": 39,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "7637613c231b",
       "surface": "builders-hall",
@@ -6500,6 +6557,24 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "e77d5f3beaef",
+      "surface": "builders-hall",
+      "text": "Move to {…}",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 103,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "e77d5f3beaef",
+      "surface": "builders-hall",
+      "text": "Move to {…}",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 161,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "ae84ebe1d735",
       "surface": "builders-hall",
@@ -7049,6 +7124,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "9ac63d97239a",
+      "surface": "builders-hall",
+      "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 126,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "ad9a17a8a5eb",
       "surface": "builders-hall",
@@ -7225,7 +7309,7 @@
       "surface": "builders-hall",
       "text": "Open navigation",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 448,
+      "line": 452,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8543,6 +8627,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "55cde0774831",
+      "surface": "builders-hall",
+      "text": "See what would change",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 91,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "75dc5463facc",
       "surface": "builders-hall",
@@ -8597,6 +8690,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "fcd68c6a21fd",
+      "surface": "builders-hall",
+      "text": "Serving now",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 115,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "64a1f055129e",
       "surface": "builders-hall",
@@ -8872,7 +8974,7 @@
       "surface": "builders-hall",
       "text": "Sign in with GitHub",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 418,
+      "line": 422,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8881,7 +8983,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 436,
+      "line": 440,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8890,7 +8992,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 593,
+      "line": 597,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8917,7 +9019,7 @@
       "surface": "builders-hall",
       "text": "Skip to content",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 584,
+      "line": 588,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -9097,7 +9199,7 @@
       "surface": "builders-hall",
       "text": "Switch theme",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 463,
+      "line": 467,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9259,7 +9361,7 @@
       "surface": "builders-hall",
       "text": "Text size",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 462,
+      "line": 466,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10001,6 +10103,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "9a685b01e2c6",
+      "surface": "builders-hall",
+      "text": "This page opens at a higher rank.",
+      "file": "modules/hall-ui/public/deploy.html",
+      "line": 31,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "9a685b01e2c6",
       "surface": "builders-hall",
@@ -10046,6 +10157,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "77e3b8f5318b",
+      "surface": "builders-hall",
+      "text": "This restarts the platform onto core",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 103,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "69e8beced2ff",
       "surface": "builders-hall",
@@ -10433,6 +10553,15 @@
       "origin": "html-attr:placeholder",
       "confidence": "certain"
     },
+    {
+      "id": "04b3ff4c4f4c",
+      "surface": "builders-hall",
+      "text": "What users can see",
+      "file": "modules/hall-ui/public/deploy.html",
+      "line": 35,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "1d5bfd09068c",
       "surface": "builders-hall",
@@ -11711,6 +11840,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "d0e722302840",
+      "surface": "builders-hall",
+      "text": "is published and this box is not on it yet.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 91,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "aa530bd15088",
       "surface": "builders-hall",
@@ -11846,6 +11984,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "9e194a57d054",
+      "surface": "builders-hall",
+      "text": "no reading",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 74,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "33ca71bef112",
       "surface": "builders-hall",
@@ -12089,6 +12236,15 @@
       "origin": "html-attr:placeholder",
       "confidence": "certain"
     },
+    {
+      "id": "41a4b66c21e5",
+      "surface": "builders-hall",
+      "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 132,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "f83f0a9d6b6a",
       "surface": "builders-hall",
@@ -12953,6 +13109,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "d9b4ae2db0f4",
+      "surface": "builders-hall",
+      "text": "{…} — read from the box itself, {…}.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 115,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "085f93f3f775",
       "surface": "builders-hall",
@@ -12962,6 +13127,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "b814cb35ce2f",
+      "surface": "builders-hall",
+      "text": "{…} — the box this platform runs on",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 168,
+      "origin": "js-text-assign",
+      "confidence": "certain"
+    },
     {
       "id": "f75ee96a7511",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -2050,5 +2050,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.786 with no explicit bump. run 35158163962. (task 1002620)
   1.19.788 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.787 with no explicit bump. run 35159266737. (task 1002620)
+  1.19.789 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.788 with no explicit bump. run 35159544354. (task 1002620)
+  1.19.790 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.789 with no explicit bump. run 35163350575. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/core-release-pipeline.md

@@ -112,6 +112,18 @@ node scripts/gds/package-core.js --publish --live   # permanent
 
 ## Gate 3 — move the instance's pin
 
+> **There is now a control for this, and it is the owner's** (task 1003159, [ADR 0293](../adr/0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md)). Everything below still describes what actually happens on the box, and is what you need when something goes wrong — but the ordinary path no longer requires a shell or an ssh key.
+>
+> **Hall → Deploy** (`/deploy`) shows the version the box is actually serving, what it could move to, and moves it on an explicit second click. It is gated on the `core.pin.move` atom — archon-floor and `system: true` — and every move lands in the `core_upgrades` ledger with the builder who asked. The web tier never gains a shell: it queues a `core-upgrade` intent and the control-plane runner drains it, driving exactly the `bongos upgrade` invocation documented below, with its health gate and auto-rollback intact.
+>
+> **One install-time step enables it.** The door needs a `provisioning_instances` row to point at, and the control plane has never had one:
+>
+> ```bash
+> node scripts/gds/enroll-control-plane.js --owner <builderId> --apply
+> ```
+>
+> Until that is run, `/deploy` says so and names this command. The self row carries `hosting_shape='control-plane'`, which every destructive intent action refuses by name — a teardown aimed at it would destroy the platform from inside its own UI, so the guard is an allow-list (`core-upgrade`, `restart`) enforced at `enqueueIntent`, the one place every intent passes.
+
 Each instance decides, independently, when to take a release. **Which mechanism it uses is a per-instance fact you must establish before prescribing anything** — read its `package.json`:
 
 | Pin in `package.json` | Path | How it updates |

package/docs/recipes/upgrading-the-core.md

@@ -110,6 +110,8 @@ node .claude/scheduled-tasks/core-update-subscription/subscribe.js --apply    #
 
 Each subscribed instance: read its installed core → ask the registry (`npm view`, no credential needed — the package is public) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
 
+> **Enrolling a `file:`-pinned instance resolves NOTHING — convert the pin first** (task 1003915). A scaffolded co-tenant declares its core as `"@bongos/core": "file:vendor/bongos-core-<v>.tgz"`, a local path with no registry channel to follow, so the sweep has nothing to compare against and the instance sits frozen while the roster reports it enrolled. The conversion is not a separate chore: one manual `bongos upgrade --to <v> --registry` rewrites the pin to a bare registry semver on its way through, and every later sweep then works. Measured on the cloudbongos droplet 2026-09-13, **20 of 22 co-tenants** were `file:`-pinned, which is why enrolment alone had never moved any of them.
+
 **Triple-gated, so nothing moves by accident:** the `core-update-subscription` routine is `requiresAutonomy: true` + **default OFF** in [`config/scheduled-routines.json`](../../config/scheduled-routines.json), the roster ships empty, and every upgrade is health-gated. Arm it by enabling the routine's timer on the control plane once autonomy is on.
 
 **Not covered:** multi-host / SSH orchestration across a real fleet (the deferred fleet-control-plane epic, task [#1948](https://example.com/builders#/task/1948)); and *publishing* new patches, which stays a gated owner step (ADR 0134) — a follow-up task decides whether merges auto-publish.
@@ -119,7 +121,11 @@ Each subscribed instance: read its installed core → ask the registry (`npm vie
 - **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
   *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.
 - **A green `publish` run is not evidence of a publish.** The publish-on-merge lane succeeds on its no-op paths too (cascade terminator, armed-gate). Read the run's **job summary**, which now states the verdict explicitly: `PUBLISHED @bongos/core@<v>` vs `NO-OP — nothing was published this run`.
-- **`PGDATABASE` is load-bearing on a co-tenant droplet.** `migrate.sh` defaults `PGDATABASE` to `example` — **production**. Always set `PGDATABASE=<instance-db>` explicitly, or you migrate the wrong database.
+- **`PGDATABASE` is load-bearing on a co-tenant droplet.** `migrate.sh` defaults `PGDATABASE` to `example` — **production**. Always set `PGDATABASE=<instance-db>` explicitly, or you migrate the wrong database. The dry run checks this *before* the pin moves, so `--dry-run` first costs seconds and saves a full rollback.
+- **The pin push to a co-tenant's `origin` always fails, and that is not the bump failing.** A co-tenant's remote is `git@github-instances:example-owner/<slug>.git` and the alias carries no usable key, so `--commit-pin` commits locally and the push is refused — reported as a failure even though the core installed, restarted, passed its health check and is serving. Read the **served version** before believing the tally.
+- **⚠ An enrolled co-tenant upgrades ONCE, then wedges itself out of the sweep** (proven on `charter` 2026-09-16, task 1003915). The upgrade's own *materialize* and *regen doc assets* steps rewrite tracked files (`.claude/skills/*`, `clients/*` — 14 of them), and the pin-commit step commits only `package.json`/`package-lock.json`. So a bump that genuinely succeeded — installed, restarted, health 200, **serving** the new core — exits `failed=1`, and the **next** sweep refuses the instance: `worktree not clean and the changes are NOT the pin … skipped, a human needs to look`. Every later run skips it, and a skip is not a failure in the tally, so nothing surfaces it. Until this is fixed, `git add -A && git commit` inside the instance after each sweep; that un-wedges it immediately.
+- **Survey co-tenant git state as `lars`, never as root.** `ssh cloudbongos` lands you as root, where `git config --get remote.origin.url` on a `lars`-owned repo returns **nothing** — which reads exactly like "this instance has no remote" and is wrong. They do: `git@github-instances:example-owner/<slug>.git`. Prefix every probe with `sudo -u lars`.
+- **A scaffold's `migrate` script is not guaranteed.** 21 of the 22 co-tenants have `scripts.migrate`; `mercury` has **no `scripts` block at all** and is started directly by its systemd `ExecStart`, so the normal lane cannot complete on it. `--skip-migrate` gets the install through but silently skips every schema change in the window — check what that window carries before reaching for it, rather than after.
 - **The health check polls the restart** (fixed in task [#1984](https://example.com/builders#/task/1984)). The service binds its port ~1s after `systemctl restart`, so `--health-url` now polls up to ~30s for a 2xx before reporting a warning — an immediate `fetch failed` no longer means a failed upgrade. (Pre-1984 cores fetched once and spuriously reported `fetch failed`; there, confirm with `is-active` + a manual `curl`.)
 - **The ledger auto-inserts via `PGDATABASE` too** (fixed in task [#1984](https://example.com/builders#/task/1984)). A consumer on `PGDATABASE` + peer auth now gets its `core_upgrades` row written automatically — the channel delegates the insert to `psql -d "$PGDATABASE"`, exactly like `migrate.sh`, so no manual `psql INSERT` is needed. (`DATABASE_URL` still works, via the `pg` driver.) Pre-1984 cores only auto-wrote with `DATABASE_URL`; on those, record the row manually.
 - **No deploy key on the droplet** → deploys/upgrades ride a `git bundle`, not `git pull` (idea 509).

package/migrations/core_241_core_upgrades_actor.sql

@@ -0,0 +1,65 @@
+-- core_241_core_upgrades_actor.sql — who asked for this upgrade (task 1003159,
+-- ADR 0293 D5).
+--
+-- core_189 built the per-instance core-upgrade ledger with from_version, to_version,
+-- source_commit and a free-text `note`. That was right for the world it was written
+-- in: every upgrade came from a human at a shell, and the note carried "who ran it"
+-- as prose when someone remembered.
+--
+-- Task 1003159 makes an upgrade something an HTTP request can START. That is the
+-- most privileged act in the system — it restarts a service and changes what code
+-- the platform runs — and the task's own non-negotiable is that **every invocation
+-- lands in this ledger with an actor**. Prose in a nullable note is not an actor:
+-- it cannot be joined, cannot be audited, and is absent exactly when someone was in
+-- a hurry.
+--
+-- NULLABLE, DELIBERATELY. An upgrade run the old way — a human at a shell on the
+-- box — has no builder to attribute and must keep working unchanged; this column is
+-- not a gate on the CLI path. NULL therefore reads as "not requested through the
+-- door", which is a true and useful statement rather than missing data. The route
+-- is what makes it non-null in practice: it has an authenticated builder by
+-- construction, and a request it cannot attribute is refused before it reaches here.
+--
+-- ON DELETE SET NULL matches every other actor reference in the schema: deleting a
+-- person must not erase the record of what the platform did.
+--
+-- Additive, idempotent, no down-migration.
+
+BEGIN;
+
+ALTER TABLE core_upgrades ADD COLUMN IF NOT EXISTS requested_by_builder_id bigint
+  REFERENCES builders(id) ON DELETE SET NULL;
+
+-- How the upgrade was started. 'shell' is every pre-existing row and every future
+-- CLI run; 'owner-control' is the door this task builds. Text + CHECK rather than
+-- an enum type, the fail-closed shape the rest of the schema uses: an unwired
+-- source is refused at insert, and widening later is a one-line constraint change.
+ALTER TABLE core_upgrades ADD COLUMN IF NOT EXISTS source text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'core_upgrades_source_chk') THEN
+    ALTER TABLE core_upgrades ADD CONSTRAINT core_upgrades_source_chk
+      CHECK (source IS NULL OR source IN ('shell', 'owner-control'));
+  END IF;
+
+  -- An upgrade that came through the DOOR must name its actor. A shell run need
+  -- not, and pre-existing rows carry neither. NOT VALID so the constraint binds
+  -- every future write without scanning history that predates the concept — the
+  -- same trade agents_002_payer.sql made for the same reason.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'core_upgrades_door_needs_actor_chk') THEN
+    ALTER TABLE core_upgrades ADD CONSTRAINT core_upgrades_door_needs_actor_chk
+      CHECK (source IS DISTINCT FROM 'owner-control' OR requested_by_builder_id IS NOT NULL) NOT VALID;
+  END IF;
+END $$;
+
+-- "What has this builder deployed?" — the audit read. Partial: a shell run has no
+-- actor and would only dilute the scan.
+CREATE INDEX IF NOT EXISTS core_upgrades_actor_idx
+  ON core_upgrades (requested_by_builder_id, applied_at DESC)
+  WHERE requested_by_builder_id IS NOT NULL;
+
+INSERT INTO schema_migrations (version) VALUES ('core_241_core_upgrades_actor')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/migrations/core_242_core_version_snapshot.sql

@@ -0,0 +1,54 @@
+-- core_242_core_version_snapshot.sql — what the box serves and what it could take
+-- (task 1003159, ADR 0293 D3 + D6).
+--
+-- THE PROBLEM THIS SOLVES IS A LAYERING ONE, not a storage one. The deploy control has
+-- to show the owner two facts before they press anything: the version the box is
+-- ACTUALLY serving, and the versions it could be moved to. Neither is reachable from the
+-- web tier:
+--
+--   • the served version is `curl 127.0.0.1:<port>/version` ON the box (ADR 0293 D6) —
+--     the apex sits behind pre-launch basic_auth and its HTML rides a CDN, so a public
+--     read can report a stale answer with total confidence;
+--   • the available versions are `npm view`, which update-channel.js runs via spawnSync.
+--     On a single-process web server that blocks every other request for the seconds npm
+--     takes — and npm took 8–13 minutes to publish on 2026-09-16 (learnings 1000263,
+--     1000266), so this is not a theoretical stall.
+--
+-- Both ARE cheap for the control-plane runner, which is a CLI process on the box and
+-- already wakes on a timer. So the runner writes what it sees; the web tier reads a row.
+-- That is the same direction of travel as the intent queue itself (ADR 0293 D1): the
+-- privileged side acts and reports, the web side asks and displays.
+--
+-- ONE ROW PER INSTANCE, REPLACED IN PLACE. This is a cache of an observation, not a
+-- ledger — core_upgrades is the ledger and keeps every move forever. Keeping history
+-- here would grow a row per instance per tick to answer a question only ever asked about
+-- the present.
+--
+-- observed_at IS PART OF THE ANSWER, NOT METADATA. A cache that renders as though it
+-- were live is how a control tells someone the box is on a version it left an hour ago.
+-- The UI is expected to say how old this is, which it can only do if the age is stored.
+--
+-- Additive, idempotent, no down-migration.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS core_version_snapshot (
+  instance_id      bigint PRIMARY KEY REFERENCES provisioning_instances(id) ON DELETE CASCADE,
+  -- What 127.0.0.1/version answered. NULL means the box did not answer — a real and
+  -- different state from "answered with an old version", and the control must not
+  -- collapse the two into a confident number.
+  served_version   text,
+  -- Versions the registry reports, newest last, as update-channel.js parsed them.
+  -- jsonb rather than text[]: it is written whole and read whole, never queried inside.
+  available        jsonb NOT NULL DEFAULT '[]'::jsonb,
+  -- What the channel policy would actually take from `available` right now. Stored
+  -- rather than recomputed in the browser so the control and the runner cannot disagree
+  -- about what pressing the button would do.
+  recommended      text,
+  observed_at      timestamptz NOT NULL DEFAULT now()
+);
+
+INSERT INTO schema_migrations (version) VALUES ('core_242_core_version_snapshot')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -688,6 +688,8 @@ function createClient(opts = {}) {
       postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
     },
     "provisioning": {
+      // GET /provisioning/control-plane — rank: archon — GET /provisioning/control-plane
+      getProvisioningControlPlane: (args) => request("GET", "/provisioning/control-plane", { hasBody: false }, args),
       // GET /provisioning/fleet — rank: metic+archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
       // GET /provisioning/fleet/cost-ledger — rank: metic+archon — GET /provisioning/fleet/cost-ledger
@@ -704,6 +706,10 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/core-upgrade — rank: archon — GET /provisioning/instances/:id/core-upgrade
+      getProvisioningInstancesIdCoreUpgrade: (args) => request("GET", "/provisioning/instances/{id}/core-upgrade", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/core-upgrade — rank: archon — POST /provisioning/instances/:id/core-upgrade
+      postProvisioningInstancesIdCoreUpgrade: (args) => request("POST", "/provisioning/instances/{id}/core-upgrade", { hasBody: true }, args),
       // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
       patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/disconnect — rank: any-builder — POST /provisioning/instances/:id/disconnect

package/modules/government/catalog.js

@@ -101,6 +101,14 @@ const PERMISSIONS = [
   // enforced out of band and can never be delegated by a row in this database.
   { key: 'builder.rank.set', system: true, floor: 'archon', guards: 'PATCH /builders/:id/rank — the single rank writer' },
   { key: 'version.close', system: true, floor: 'archon', guards: 'version close disposition (never delegated below Archon)' },
+  // core.pin.move (task 1003159, ADR 0293) — MOVE AN INSTANCE'S CORE PIN: the act
+  // that makes shipped work visible to users, and the most privileged thing an HTTP
+  // request can start here (it restarts a service and changes what code runs).
+  // system:true + archon, alongside version.close, because it is a HARD GATE the
+  // owner holds: the catalog's own invariant forbids granting a system key to metic,
+  // so this cannot be delegated downward by a custom rank. The web tier still gains
+  // no shell - the route only QUEUES an intent the control-plane runner drains.
+  { key: 'core.pin.move', system: true, floor: 'archon', guards: 'POST /provisioning/instances/:id/core-upgrade — gate 3 of the release pipeline (ADR 0293)' },
   // BV1.R21 (task 1003608, goal 1000086). ADR 0250 §6 amends ADR 0157 for exactly
   // this key: `version.create` returns to the Archon floor.
   //