@bongos/core 1.19.789 → 1.19.791

package/tests/core_upgrade_runner.mjs

@@ -0,0 +1,377 @@
+// tests/core_upgrade_runner.mjs — the control-plane half of the owner's deploy door
+// (task 1003159, ADR 0293).
+//
+// core_upgrade_door.mjs covers the WEB tier: what may be asked for, by whom, and that
+// asking never escalates. This file covers what happens when the runner drains that
+// request — the half that actually restarts the live service and changes what code the
+// platform runs.
+//
+// WHAT IS ACTUALLY AT RISK HERE, in the order it would hurt:
+//
+//   1. THE SELF-ROW GUARD AT THE CHOKE POINT. Every enqueue funnels through
+//      enqueueIntent. Until task 1003159 the guard existed and nothing called it for any
+//      action but core-upgrade, so a teardown aimed at the control-plane row would have
+//      been queued and drained. A test that only checks the pure predicate would have
+//      passed the whole time.
+//   2. A TARGET THAT IS NOT PUBLISHED YET. The release lane mints a git tag BEFORE the
+//      npm publish completes — 8–13 minutes on 2026-09-16 (learnings 1000263, 1000266).
+//      A door that trusted the request would routinely queue a version that does not
+//      exist and die inside npm.
+//   3. A REFUSAL THAT MARKS A HEALTHY INSTANCE BROKEN. The drain loop's catch flips the
+//      instance to 'error'. Every expected refusal here must RETURN, never throw, or the
+//      one act the owner was finally given would leave their project labelled broken.
+//   4. THE READ-BACK LYING. The box's own /version is the only honest answer (ADR 0293
+//      D6), and a body this parser cannot read must report "unconfirmed", never a
+//      mismatch — a mismatch rolls back a deploy that worked.
+//
+// Run:  node tests/core_upgrade_runner.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const R = require('../scripts/gds/provision-core-upgrade.js');
+const U = require('../scripts/gds/upgrade.js');
+const P = require('../modules/provisioning/provisioning.js');
+const G = require('../modules/provisioning/control-plane-guard.js');
+
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// A runner dependency bag whose every side effect is observable and whose clock is
+// instant. `apply:true` because the interesting behaviour is the applied path.
+function makeDeps({ shape = 'control-plane', served = '1.19.760', available = ['1.19.758', '1.19.760', '1.19.762'], installed = '1.19.760', queries = [] } = {}) {
+  const ran = [];
+  const exec = (cmd) => {
+    ran.push(cmd);
+    if (/\/version/.test(cmd)) return { ok: true, stdout: served == null ? '' : JSON.stringify({ coreVersion: served }) };
+    return { ok: true, stdout: '' };
+  };
+  return {
+    ran,
+    queries,
+    db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
+    provisioning: { recordEvent: async () => {}, clearErrorNote: async () => {} },
+    exec,
+    log: () => {},
+    apply: true,
+    privileged: false,
+    sleep: async () => {},
+    readInstalledCoreVersion: () => installed,
+    updateChannel: {
+      DEFAULT_CHANNEL: 'patch',
+      normalizeChannel: (c) => c,
+      channelAllows: () => true,
+      resolveChannelTarget: ({ available: a }) => (a.length ? a[a.length - 1] : null),
+      listAvailableVersions: () => ({ ok: true, versions: available }),
+    },
+    _shape: shape,
+  };
+}
+
+const inst = (over = {}) => ({ id: 7, slug: 'cloudbongos', port: 3002, status: 'active', hosting_shape: 'control-plane', owner_builder_id: 1, ...over });
+const intent = (over = {}) => ({ id: 99, action: 'core-upgrade', target_version: '1.19.762', requested_by: 'api:archon:42', ...over });
+
+console.log('\nthe choke point — what may be aimed at the platform itself:');
+
+await t('enqueueIntent REFUSES a teardown aimed at the control-plane row', async () => {
+  const db = { query: async (sql) => {
+    if (/SELECT hosting_shape/.test(sql)) return { rows: [{ hosting_shape: 'control-plane' }] };
+    throw new Error('the INSERT must never be reached');
+  } };
+  await assert.rejects(() => P.enqueueIntent(db, 7, 'teardown', 'api:archon:42'),
+    (e) => e.code === 'control_plane_protected');
+});
+
+await t('and every other action in the vocabulary is refused there too, except the two named', async () => {
+  for (const action of P.INTENT_ACTIONS) {
+    const db = { query: async (sql) => {
+      if (/SELECT hosting_shape/.test(sql)) return { rows: [{ hosting_shape: 'control-plane' }] };
+      return { rows: [{ id: 1, action, state: 'pending' }] };
+    } };
+    const allowed = G.CONTROL_PLANE_ACTIONS.includes(action);
+    if (allowed) {
+      const r = await P.enqueueIntent(db, 7, action, 'api:archon:42', action === 'core-upgrade' ? '1.19.762' : null);
+      assert.equal(r.created, true, `${action} is allowed on the self row`);
+    } else {
+      await assert.rejects(() => P.enqueueIntent(db, 7, action, 'api:archon:42'),
+        (e) => e.code === 'control_plane_protected', `${action} must be refused on the self row`);
+    }
+  }
+});
+
+await t('an ORDINARY instance is untouched by the guard — it is not a general gate', async () => {
+  const seen = [];
+  const db = { query: async (sql, params) => {
+    seen.push(sql);
+    if (/SELECT hosting_shape/.test(sql)) return { rows: [{ hosting_shape: 'co-tenant' }] };
+    return { rows: [{ id: 1, action: params[1], state: 'pending' }] };
+  } };
+  const r = await P.enqueueIntent(db, 7, 'teardown', 'api:self');
+  assert.equal(r.created, true);
+  assert.ok(seen.some((s) => /INSERT INTO provisioning_intents/.test(s)));
+});
+
+await t('a row that does NOT exist is left to the FK, not answered with the wrong refusal', async () => {
+  const db = { query: async (sql) => {
+    if (/SELECT hosting_shape/.test(sql)) return { rows: [] };
+    const e = new Error('violates foreign key constraint'); e.code = '23503'; throw e;
+  } };
+  await assert.rejects(() => P.enqueueIntent(db, 404, 'teardown', 'api:self'),
+    (e) => e.code === '23503', 'the FK error survives — a missing row is not "control plane protected"');
+});
+
+console.log('\nwhat the runner refuses, and the shape of the refusal:');
+
+await t('a non-active instance is a clean NO-OP — it must not burn the retry budget or look broken', async () => {
+  for (const status of ['requested', 'provisioning', 'tearing_down', 'torn_down', 'error']) {
+    const r = await R.coreUpgradeInstance(inst({ status }), makeDeps(), intent());
+    assert.equal(r.ok, true, status);
+    assert.equal(r.noop, true, status);
+  }
+});
+
+await t('a dedicated droplet is refused — the runner has no exec path to it, so queueing one would never land', async () => {
+  const r = await R.coreUpgradeInstance(inst({ hosting_shape: 'dedicated' }), makeDeps(), intent());
+  assert.equal(r.ok, false);
+  assert.match(r.error, /not automated/);
+});
+
+await t('an intent with no target is refused rather than guessed at', async () => {
+  const r = await R.coreUpgradeInstance(inst(), makeDeps(), intent({ target_version: null }));
+  assert.equal(r.ok, false);
+  assert.match(r.error, /refusing to guess/);
+});
+
+await t('EVERY refusal returns ok:false — none of them throws, because the drain loop marks a throw as a broken instance', async () => {
+  const cases = [
+    [inst({ hosting_shape: 'dedicated' }), makeDeps(), intent()],
+    [inst(), makeDeps(), intent({ target_version: null })],
+    [inst(), makeDeps({ available: [] }), intent()],
+    [inst(), makeDeps({ available: ['1.19.758'] }), intent({ target_version: '1.19.999' })],
+  ];
+  for (const [i, d, n] of cases) {
+    const r = await R.coreUpgradeInstance(i, d, n);
+    assert.equal(typeof r.ok, 'boolean');
+  }
+});
+
+await t('A SLUG THAT IS NOT A SLUG NEVER REACHES THE SHELL, whatever the DB holds', async () => {
+  // The slug is interpolated into the `bongos upgrade` command. isValidSlug is
+  // enforced on the CREATE route, but the control-plane self row is written by an
+  // operator script and any future write path is one more place to remember — so the
+  // check that matters is the one at the point of use.
+  for (const bad of ['cloud bongos', 'a;rm -rf /', '$(id)', '`id`', 'UPPER', 'x', '--lead', 'a--b', '']) {
+    const d = makeDeps();
+    const r = await R.coreUpgradeInstance(inst({ slug: bad }), d, intent());
+    assert.equal(r.ok, false, `'${bad}' must be refused`);
+    assert.match(r.error, /is not a valid slug/, `'${bad}'`);
+    assert.equal(d.ran.length, 0, `'${bad}' must not reach an executor`);
+  }
+});
+
+await t('and an ordinary slug still runs', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst({ slug: 'cloud-bongos-2' }), d, intent());
+  assert.equal(r.ok, true);
+  assert.ok(d.ran.some((c) => c.includes('--service cloud-bongos-2')));
+});
+
+await t('the guard error carries a status and a sentence, so a route CAN answer with it', async () => {
+  // No route maps it today — reaching it means a route forgot its own check, which
+  // deserves a 500 and a stack. The fields exist so that stays a choice rather than a
+  // rewrite, and so the wording is settled once.
+  const selfRow = { query: async () => ({ rows: [{ hosting_shape: 'control-plane' }] }) };
+  await assert.rejects(() => G.assertIntentAllowed(selfRow, 1, 'teardown'), (err) => {
+    assert.equal(err.code, 'control_plane_protected');
+    assert.equal(err.status, 409);
+    assert.match(err.publicMessage, /cannot be aimed at the machine the platform itself runs on/);
+    assert.ok(!/hosting_shape|provisioning_instances/.test(err.publicMessage),
+      'and the public sentence names no column or table');
+    return true;
+  });
+});
+
+console.log('\nthe target has to be REAL (ADR 0293 D3):');
+
+await t('a version that is not published yet is refused, and the message says the tag precedes the package', () => {
+  const f = R.targetFault('1.19.999', ['1.19.758', '1.19.760'], '1.19.758', 'patch', () => true);
+  assert.match(f, /not published yet/);
+  assert.match(f, /tag appears several minutes before/);
+});
+
+await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
+  const empty = R.targetFault('1.19.760', [], '1.19.758', 'patch', () => true);
+  assert.match(empty, /could not read the published core versions/);
+  assert.ok(!/not published yet/.test(empty), 'the two states must not be collapsed into one sentence');
+});
+
+await t('a published version the CHANNEL forbids is refused, and says so rather than claiming it does not exist', () => {
+  const f = R.targetFault('2.0.0', ['1.19.758', '2.0.0'], '1.19.758', 'stable', () => false);
+  assert.match(f, /outside this project's 'stable' update channel/);
+});
+
+await t('a published, permitted version is admitted', () => {
+  assert.equal(R.targetFault('1.19.760', ['1.19.758', '1.19.760'], '1.19.758', 'patch', () => true), null);
+});
+
+await t('the runner refuses an unpublished target BEFORE it runs anything', async () => {
+  const d = makeDeps({ available: ['1.19.758', '1.19.760'] });
+  const r = await R.coreUpgradeInstance(inst(), d, intent({ target_version: '1.19.999' }));
+  assert.equal(r.ok, false);
+  assert.equal(d.ran.length, 0, 'nothing was executed on the box');
+});
+
+console.log('\nthe move itself:');
+
+await t('drives upgrade.js with the registry, the health gate, the version read-back and the committed pin', async () => {
+  // served === the target: the state after a move that worked, which is what the flags
+  // are being asserted for.
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, true);
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(cmd, 'it ran the upgrade CLI');
+  for (const flag of ['--registry', '--to 1.19.762', '--service cloudbongos', '--health-url', '--version-url', '--commit-pin']) {
+    assert.ok(cmd.includes(flag), `carries ${flag}`);
+  }
+  // --commit-pin is the one that cannot be dropped: without it the pin lives only in
+  // the working tree and the next pull-deploy resets it away. That is the silent
+  // thirteen-release revert upgrade.js's own header records.
+  assert.ok(cmd.includes('--commit-pin'));
+});
+
+await t('the health URL and the version URL are LOOPBACK — the apex is behind basic_auth and a CDN (ADR 0293 D6)', async () => {
+  const d = makeDeps();
+  await R.coreUpgradeInstance(inst(), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(cmd.includes('--health-url http://127.0.0.1:3002/healthz'));
+  assert.ok(cmd.includes('--version-url http://127.0.0.1:3002/version'));
+});
+
+await t('the ACTOR rides through to the ledger — a privileged act with no attributed row is the thing ADR 0293 D5 refuses', async () => {
+  const d = makeDeps();
+  await R.coreUpgradeInstance(inst(), d, intent());
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(cmd.includes('--requested-by 42'), 'the builder id is carried, not the decorated string');
+  assert.ok(cmd.includes('--upgrade-source owner-control'));
+});
+
+await t('a CLI-shaped requester (no builder behind it) carries NEITHER flag rather than a half-attributed row', async () => {
+  const d = makeDeps();
+  await R.coreUpgradeInstance(inst(), d, intent({ requested_by: 'runner' }));
+  const cmd = d.ran.find((c) => /upgrade\.js/.test(c));
+  assert.ok(!cmd.includes('--requested-by'));
+  // The DB constraint core_upgrades_door_needs_actor_chk refuses source='owner-control'
+  // with no actor, so emitting one without the other would fail at the insert.
+  assert.ok(!cmd.includes('--upgrade-source'));
+});
+
+await t('asking for the version already installed changes nothing', async () => {
+  const d = makeDeps({ installed: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent({ target_version: '1.19.762' }));
+  assert.equal(r.ok, true);
+  assert.equal(r.noop, true);
+  assert.equal(d.ran.length, 0);
+});
+
+console.log('\nreading the box back (ADR 0293 D6):');
+
+await t('the served version is read from 127.0.0.1/version, and a match confirms the move', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, true);
+  assert.equal(r.served, '1.19.762');
+  assert.equal(r.confirmed, true);
+  assert.ok(d.ran.some((c) => c.includes('http://127.0.0.1:3002/version')));
+});
+
+await t('a box serving something ELSE is reported as a move that did not take', async () => {
+  const d = makeDeps({ served: '1.19.758' });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, false);
+  assert.match(r.error, /serving core 1\.19\.758, not the requested 1\.19\.762/);
+});
+
+await t('a box that will not answer is UNCONFIRMED, not failed — an unfamiliar reply must never roll back a good deploy', async () => {
+  const d = makeDeps({ served: null });
+  const r = await R.coreUpgradeInstance(inst(), d, intent());
+  assert.equal(r.ok, true, 'silence is not a failure verdict');
+  assert.equal(r.served, null);
+  assert.equal(r.confirmed, false);
+});
+
+await t('parseServedVersion reads the shapes a /version endpoint actually answers with', () => {
+  assert.equal(R.parseServedVersion(JSON.stringify({ coreVersion: '1.19.762' })), '1.19.762');
+  assert.equal(R.parseServedVersion(JSON.stringify({ core_version: '1.19.762' })), '1.19.762');
+  assert.equal(R.parseServedVersion(JSON.stringify({ version: '1.19.762' })), '1.19.762');
+  // An OLDER core is exactly what this reads, so a shape this parser has never seen is
+  // the expected case, not the exotic one.
+  assert.equal(R.parseServedVersion('cloudbongos 1.19.762 (ok)'), '1.19.762');
+  assert.equal(R.parseServedVersion(''), null);
+  assert.equal(R.parseServedVersion(null), null);
+  assert.equal(R.parseServedVersion('{"coreVersion":'), null, 'malformed JSON with no number in it is null, never a throw');
+});
+
+console.log('\nthe ledger carries who asked (ADR 0293 D5):');
+
+await t('no actor → the original four columns, so this still works against a DB without core_241', () => {
+  const s = U.ledgerInsert({ fromVersion: '1.19.758', toVersion: '1.19.762' });
+  assert.deepEqual(s.cols, ['from_version', 'to_version', 'source_commit', 'note']);
+  assert.ok(!s.sql.includes('requested_by_builder_id'));
+  assert.equal(s.vals.length, 4);
+});
+
+await t('an actor → the two attribution columns join the INSERT, in lockstep with the values', () => {
+  const s = U.ledgerInsert({ fromVersion: '1.19.758', toVersion: '1.19.762', requestedByBuilderId: 42, source: 'owner-control' });
+  assert.deepEqual(s.cols.slice(-2), ['requested_by_builder_id', 'source']);
+  assert.equal(s.cols.length, s.vals.length, 'a column list longer than its values is how a bound-parameter INSERT goes wrong');
+  assert.equal(s.vals[4], '42');
+  assert.equal(s.vals[5], 'owner-control');
+  assert.match(s.sql, /\$6\)$/, 'the placeholders grow with the columns');
+});
+
+console.log('\nthe snapshot the deploy control reads:');
+
+await t('the snapshot records the served version, the registry list and what the channel would take', async () => {
+  const queries = [];
+  const d = makeDeps({ served: '1.19.760', available: ['1.19.758', '1.19.760', '1.19.762'], queries });
+  await R.snapshotCoreVersions(inst(), d);
+  const w = queries.find((q) => /core_version_snapshot/.test(q.sql));
+  assert.ok(w, 'it wrote the snapshot');
+  assert.equal(w.params[1], '1.19.760', 'the served version');
+  assert.deepEqual(JSON.parse(w.params[2]), ['1.19.758', '1.19.760', '1.19.762']);
+  assert.equal(w.params[3], '1.19.762', 'and the version the channel would actually take');
+});
+
+await t('a box that does not answer still writes a snapshot — a NULL reading is a real state, not a missing row', async () => {
+  const queries = [];
+  const d = makeDeps({ served: null, queries });
+  await R.snapshotCoreVersions(inst(), d);
+  const w = queries.find((q) => /core_version_snapshot/.test(q.sql));
+  assert.ok(w);
+  assert.equal(w.params[1], null);
+  assert.equal(w.params[3], null, 'and nothing is recommended against a version we could not read');
+});
+
+await t('a shape the runner cannot reach is skipped entirely — no snapshot, no claim about it', async () => {
+  const queries = [];
+  const r = await R.snapshotCoreVersions(inst({ hosting_shape: 'dedicated' }), makeDeps({ queries }));
+  assert.equal(r.skipped, true);
+  assert.equal(queries.length, 0);
+});
+
+await t('the snapshot NEVER fails a tick — a registry hiccup leaves the old reading and its visibly older timestamp', async () => {
+  const d = makeDeps();
+  d.updateChannel.listAvailableVersions = () => { throw new Error('npm exploded'); };
+  const r = await R.snapshotCoreVersions(inst(), d);
+  assert.equal(r.ok, true);
+  assert.equal(r.skipped, true);
+});
+
+console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/fixtures/accessibility-replay.json

@@ -0,0 +1,93 @@
+{
+  "_comment": "The fixed beginner-prompt set for the accessibility replay regression (task 1002517, clauses 5 and 8 of criterion accessibility-fluency-profile). EIGHT prompts a newcomer to this instance actually asks; each one is the documented trigger of a real surface, so the click-paths named in the non-technical replies are paths that EXIST (Settings -> API keys, Settings -> Session, Settings -> Interaction, the hall task list, the hall blockers page, the hall leaderboard, the hall Deploy page). Prompt 'make-it-live' is the owner's own words, verbatim, 2026-08-22 (task 1003159). Each prompt carries TWO answer runs: the same question answered in the register each profile asks for. The runs are the CONTROLLED variable and the prompt set is fixed - that is what makes this a replay rather than a fixture parade. Nothing here is tuned to a target score: the replies are written in each register and the harness measures what falls out, so a detector that goes blind moves these numbers.",
+  "floor": 6.0,
+  "_floor_comment": "6.0 is not a new number. It is bandFor()'s 'workable' boundary in modules/sessions/accessibility.js - the point the scorer itself calls the difference between prose a newcomer can work with and prose that is merely dense. accessibility_replay.mjs asserts the two stay tied, so retuning the bands cannot silently move the floor.",
+  "prompts": [
+    { "id": "what-to-work-on", "prompt": "What can I work on?" },
+    { "id": "make-it-live", "prompt": "I don't think I can make anything live." },
+    { "id": "art-key", "prompt": "My image generation stopped working." },
+    { "id": "session-expired", "prompt": "It says my session expired." },
+    { "id": "how-you-talk", "prompt": "Can you stop using so much jargon with me?" },
+    { "id": "credits", "prompt": "How do credits work here?" },
+    { "id": "stuck", "prompt": "What's stuck waiting on me?" },
+    { "id": "why-slow", "prompt": "Why is that page so slow?" }
+  ],
+  "runs": {
+    "non_technical": {
+      "_comment": "The register the non-technical profile asks for: lead with the answer, name the click-path before the terminal, define a term the first time it is needed, and frame the trade-off as cost, time and what the reader will see. Two turns deliberately exercise the scorer's FORGIVING paths rather than dodging them - 'why-slow' turn 1 uses the word migration and defines it in the same breath, and turn 2 names the architecture AND what it costs - because a run that scores well only by avoiding every trigger proves nothing about the detectors.",
+      "profile": { "technical_level": "non_technical", "toolchain_familiarity": "new" },
+      "replies": {
+        "what-to-work-on": [
+          "Four jobs are open to you right now. They are on the hall task list, newest first, and each row shows what it pays and roughly how long it takes.",
+          "The second one is the quickest - about twenty minutes, and it pays thirty credits. Tell me its number and I will take it on for you."
+        ],
+        "make-it-live": [
+          "You can do this yourself now, and it is two clicks. In the hall, open Deploy: the page shows the version your site is actually serving and the newer one it would move to.",
+          "The first click previews the move and the second makes it. If the new version does not answer within a minute it puts the old one back on its own, so a bad release cannot leave your site down. It costs nothing and takes about two minutes."
+        ],
+        "art-key": [
+          "Your free art coverage has ended, so pictures now come out of an art key of your own - think of a key as a password that lets us make images on your account, and you pay only for what you make.",
+          "Add it in Settings, under API keys. Do not paste it to me in chat; the Settings page is the only place it should ever go. Most people spend a few dollars per month on this."
+        ],
+        "session-expired": [
+          "That message means your sign-in has timed out. Nothing is lost, and it happens every few weeks on purpose.",
+          "Open Settings, then Session, and choose Re-issue. That hands you a fresh code and I take it from there. It takes under a minute."
+        ],
+        "how-you-talk": [
+          "Yes - and it is a setting, so you will not have to keep asking. Open Settings, then Interaction, and set your technical level to non-technical.",
+          "Every session after that starts already knowing to define a term the first time it comes up, and to talk in cost, time and what you will see on screen. You will notice the difference in the very next reply."
+        ],
+        "credits": [
+          "Credits are the record of what building here actually cost. When a piece of work ships you earn what the session really cost plus twenty per cent, and one credit is one dollar.",
+          "The figure on a task row is only a guide - you are paid on the real cost, never the estimate. Your running total sits on the hall leaderboard."
+        ],
+        "stuck": [
+          "Four things are waiting on you rather than on me. Two need a yes or no and two need a number I cannot guess for you.",
+          "They are all on the hall blockers page, oldest first. The one at the top has been sitting eleven days and is holding up two other jobs, so it is the one worth five minutes."
+        ],
+        "why-slow": [
+          "The page re-reads the whole list every time someone opens it. The fix is a migration - that is a one-off change to the way the information is kept - and it would take about an hour.",
+          "The architecture underneath is fine; the cost is that repeated reading. After the change the page should open in under a second instead of four."
+        ]
+      }
+    },
+    "engineer": {
+      "_comment": "The same eight questions answered the way an engineer profile asks to be answered: terse, command-first, and in the vocabulary of the trade with nothing defined. This run is DELIBERATELY dense in all three signals - that is the point. Under the engineer profile it must not be scored for any of it; under the non-technical profile the very same prose must fall through the floor. One run, two profiles, opposite verdicts is what proves the dimension is profile-relative rather than a taste test.",
+      "profile": { "technical_level": "engineer", "toolchain_familiarity": "comfortable" },
+      "replies": {
+        "what-to-work-on": [
+          "Four ready. Run `node scripts/gds/start.js`, then claim a task by id.",
+          "Second row is a refactor behind the module boundary. The claim is idempotent, so re-running it is a no-op."
+        ],
+        "make-it-live": [
+          "Pin move is gate 3. `bongos upgrade --registry --to <ver> --commit-pin` on the control plane, or the Deploy page enqueues the same intent.",
+          "The control flow is enqueue, drain, health-gate, rollback. SIGTERM on a failed probe and the symlink goes back."
+        ],
+        "art-key": [
+          "Art key is unset. Run `node scripts/gds/api.js` against the settings route, or set it in Settings - either path ends up in the same env file.",
+          "The upstream call is async and the error surfaces on stderr, not in the hall."
+        ],
+        "session-expired": [
+          "Session token expired. Run `bongos auth --reissue`.",
+          "The JWT is short-lived by design and the refresh is idempotent, so a double call is harmless."
+        ],
+        "how-you-talk": [
+          "That is the interaction profile. Run `node scripts/gds/api.js PATCH /settings`, or set it in Settings.",
+          "It is injected per session by the Conductor hook and never memoized, so the change takes on the next turn."
+        ],
+        "credits": [
+          "Cost-plus. Run `node scripts/gds/api.js GET /builders/me` for your balance, or read the leaderboard.",
+          "The write is an upsert keyed on the session, so a replayed ship cannot double-pay."
+        ],
+        "stuck": [
+          "Four open blockers. Run `node scripts/gds/blocker-review.js` to walk them.",
+          "Resolving one will upsert the linked rows to ready inside the same transaction."
+        ],
+        "why-slow": [
+          "N+1 on the list read.",
+          "The ORM will hydrate each row separately. Fold it into one query against the schema with a jsonb aggregate."
+        ]
+      }
+    }
+  }
+}

package/tests/hall_nav.mjs

@@ -281,7 +281,10 @@ test('sidebar groups read by audience, in order', () => {
   // 'board-room' LED this group from the ADR 0266 carve until task 1003744 moved
   // it to the project group — see the note on nav[0]. What is left is rank surface
   // throughout, which is what lets the group keep its metic head honestly.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
+  // 'deploy' (task 1003159, ADR 0293) is the SECOND archon item, beside 'government':
+  // its gate is the `core.pin.move` atom, archon-floor and system:true. It sits with
+  // the steering surfaces because that is what it is — the owner's third release gate.
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'deploy', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {

package/tests/hall_page_gate_map.mjs

@@ -81,6 +81,13 @@ const ORACLE = {
   // its neighbours: a steering surface, metic+ per ADR 0157. Its two WRITES gate
   // independently on `project.settings.manage`, so this row is only about the shell.
   '/builders/project-settings': 'requireGovernmentPage',
+  // The deploy door (task 1003159, ADR 0293) — the NARROWEST gate in this table, on
+  // the `core.pin.move` atom: archon-floor and system:true, the same key its preview
+  // and its move both check. Correct for the one page whose button restarts the live
+  // service and changes what code the platform runs. Its READ is gated as tightly as
+  // its write on purpose: the preview discloses the exact core version the box serves
+  // and how far behind it is, which is a vulnerability window.
+  '/builders/deploy': 'requireCorePinPage',
 
   // Metic+ via the `project.curate` atom — the exact permission GET /scouting
   // checks, so the page can never drift wider than the API it fronts. Its

package/tests/hall_studio_world.mjs

@@ -106,15 +106,17 @@ test('the verdict is offered only to a viewer the routes will accept', () => {
   assert.match(JS, /studio-verdict__sealed/, 'a viewer below the floor gets a sentence, not three dead buttons');
 });
 
-test('the review card shows the reviewed work\'s picture, through the kit', () => {
-  // "the picture is the card" — and drawn by the kit's ONE full-size renderer
-  // rather than a third hand-rolled <figure> (the task's own instruction).
-  assert.match(JS, /kit\.taskVisualFigureHtml\(/, 'the plate comes from the kit renderer');
+test('the review card shows the reviewed work\'s picture, through the shared renderer', () => {
+  // "the picture is the card" — and drawn by the ONE full-size renderer rather
+  // than a hand-rolled <figure>. That renderer moved out of hall-kit.js into
+  // hall-visual.js in task 1003835, so the Studio now reaches for OTBVisual; the
+  // rule this pins is unchanged, only where the one copy lives.
+  assert.match(JS, /vis\.taskVisualFigureHtml\(/, 'the plate comes from the shared renderer');
   assert.ok(!/<figure/.test(JS), 'studio.js builds no <figure> of its own');
-  assert.match(HTML, /hall-kit\.js/, 'and the page loads the kit that owns it');
+  assert.match(HTML, /hall-visual\.js/, 'and the page loads the file that owns it');
   // The degrade: a review with no visual (or one that could not be read) draws
   // nothing at all rather than an empty frame, so it still reads as a review.
-  assert.match(JS, /if \(!p\.shipped \|\| !kit/, 'no reviewed task, no kit → no plate');
+  assert.match(JS, /if \(!p\.shipped \|\| !vis/, 'no reviewed task, no renderer → no plate');
   // The reviewed task is read for the card in focus, once — not 50 times up front.
   assert.match(JS, /p\.hydrated = true;/, 'the read is made once per review');
   assert.match(JS, /\$\{API\}\/tasks\/\$\{encodeURIComponent\(p\.shippedId\)\}/, 'and it reads the SHIPPED task the review names');
@@ -204,7 +206,8 @@ test('the accent is spent only where the rule allows', () => {
 });
 
 // ---------------------------------------------------------------------------
-// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js beside it
+// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js and
+// hall-visual.js beside it
 // (the bootShell pattern below, pointed at the page script). The static-source
 // assertions above pin the wiring; these render the card and read what it
 // actually says, which is the only way to pin a DEGRADE — "no picture" and
@@ -215,11 +218,15 @@ test('the accent is spent only where the rule allows', () => {
 // NEW_TASK_ID so the "needs work" pair can be followed to its merge.
 const NEW_TASK_ID = '2001';
 async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags = null, onWrite = null } = {}) {
-  // The REAL kit, not a stub — the plate's URL guard and escaping are its code,
-  // and a stub here would make the degrade tests below pass for the wrong reason
-  // (no kit also means no plate). It is node-require-safe by its own contract.
+  // The REAL modules, not stubs — the plate's URL guard and escaping are their
+  // code, and a stub here would make the degrade tests below pass for the wrong
+  // reason (no renderer also means no plate). Both are node-require-safe by their
+  // own contract. hall-visual.js carries the renderer since task 1003835; the kit
+  // is still loaded because the page still uses the rest of it.
   const kit = (await import(`file://${path.join(HALL, 'hall-kit.js').replace(/\\/g, '/')}`)).default;
-  assert.equal(typeof kit.taskVisualFigureHtml, 'function', 'the real kit loaded');
+  const vis = (await import(`file://${path.join(HALL, 'hall-visual.js').replace(/\\/g, '/')}`)).default;
+  assert.equal(typeof vis.taskVisualFigureHtml, 'function', 'the real visual module loaded');
+  assert.equal(typeof kit.taskVisualFigureHtml, 'undefined', 'and the kit no longer carries a second copy');
   const els = new Map();
   const el = (id) => {
     if (!els.has(id)) els.set(id, { id, innerHTML: '', textContent: '', hidden: false, value: '' });
@@ -258,6 +265,7 @@ async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags =
       errMessage: (d) => (d && d.error && d.error.message) || '',
     },
     OTBKit: kit,
+    OTBVisual: vis,
     scrollTo: () => {},
   };
   const document = { addEventListener: (t, h) => handlers.push({ t, h }) };

package/tests/provisioning_disconnect.mjs

@@ -22,7 +22,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
@@ -43,14 +43,31 @@ const PROMISE = /shortly|briefly|minute|second|soon\b/i;
 
 console.log('the schema:');
 
-t("INTENT_ACTIONS includes 'disconnect', in strict lockstep with the provisioning_016 CHECK (the newest action migration)", () => {
+t("INTENT_ACTIONS includes 'disconnect', and 016 ADMITTED it while the LAST action migration must still carry it", () => {
   assert.ok(provisioning.INTENT_ACTIONS.includes('disconnect'));
   const sql = readFileSync(new URL('../modules/provisioning/migrations/provisioning_016_disconnect.sql', import.meta.url), 'utf8');
   const m = /CHECK \(action IN \(([^)]*)\)\)/.exec(sql);
   assert.ok(m, 'the migration widens the action CHECK');
-  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
-  assert.deepEqual(inSql, [...provisioning.INTENT_ACTIONS].sort(), 'the CHECK a live DB ends with and INTENT_ACTIONS carry the same set');
+  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, ''));
+  assert.ok(inSql.includes('disconnect'), 'this migration is the one that admitted it');
   assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_016_disconnect'\)/, 'self-registers');
+
+  // THE SET EQUALITY BELONGS TO WHICHEVER MIGRATION RUNS LAST, not to this one.
+  // Each of these files REPLACES the action CHECK rather than adding to it, so the
+  // constraint a live DB ends up with is the last one applied in name order — and
+  // a later migration that forgot 'disconnect' would silently drop it while this
+  // file still read as correct. 016 and 018 (task 1003159's core-upgrade) landed on
+  // separate branches, which is exactly how that goes wrong.
+  const migDir = new URL('../modules/provisioning/migrations/', import.meta.url);
+  const defining = readdirSync(migDir)
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /CHECK \(action IN \(/.test(readFileSync(new URL(f, migDir), 'utf8')))
+    .sort();
+  const lastSql = readFileSync(new URL(defining[defining.length - 1], migDir), 'utf8');
+  const lastIn = /CHECK \(action IN \(([^)]*)\)\)/.exec(lastSql)[1]
+    .split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
+  assert.deepEqual(lastIn, [...provisioning.INTENT_ACTIONS].sort(),
+    `the LAST action migration (${defining[defining.length - 1]}) and INTENT_ACTIONS carry the same set`);
 });
 
 console.log('\nthe queue:');
@@ -61,6 +78,11 @@ function queueDb({ open = null } = {}) {
   return {
     inserts, deletes,
     query: async (sql, params) => {
+      // The self-row guard's shape lookup (task 1003159, ADR 0293 D2) — every enqueue
+      // now asks "is this the control plane?" first. A tenant shape is the honest
+      // answer here; answering 'control-plane' would refuse the disconnect outright,
+      // which is itself correct behaviour and is covered in core_upgrade_runner.mjs.
+      if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) return { rows: [{ hosting_shape: 'co-tenant' }] };
       if (/SELECT \* FROM provisioning_intents/.test(sql)) return { rows: open ? [open] : [] };
       if (/INSERT INTO provisioning_intents/.test(sql)) {
         if (open) { const e = new Error('dup'); e.code = '23505'; throw e; }
@@ -77,7 +99,10 @@ await ta('an idle project queues a disconnect intent', async () => {
   const db = queueDb();
   const r = await disconnect.enqueueDisconnect(db, 7, 'api:self');
   assert.equal(r.created, true);
-  assert.deepEqual(db.inserts, [[7, 'disconnect', 'api:self']]);
+  // The trailing null is the target_version enqueueIntent gained in task 1003159:
+  // only a 'core-upgrade' names one, and the column's CHECK is an EQUIVALENCE, so a
+  // disconnect carrying a target would be refused by the database.
+  assert.deepEqual(db.inserts, [[7, 'disconnect', 'api:self', null]]);
 });
 
 for (const [action, state] of [['provision', 'pending'], ['provision', 'running'], ['teardown', 'running'], ['restart', 'pending']]) {