@bongos/core 1.19.789 → 1.19.791

package/docs/module-api-changelog.md

@@ -2052,5 +2052,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.787 with no explicit bump. run 35159266737. (task 1002620)
   1.19.789 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.788 with no explicit bump. run 35159544354. (task 1002620)
+  1.19.790 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.789 with no explicit bump. run 35163350575. (task 1002620)
+  1.19.791 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.790 with no explicit bump. run 35165066743. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/core-release-pipeline.md

@@ -112,6 +112,18 @@ node scripts/gds/package-core.js --publish --live   # permanent
 
 ## Gate 3 — move the instance's pin
 
+> **There is now a control for this, and it is the owner's** (task 1003159, [ADR 0293](../adr/0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md)). Everything below still describes what actually happens on the box, and is what you need when something goes wrong — but the ordinary path no longer requires a shell or an ssh key.
+>
+> **Hall → Deploy** (`/deploy`) shows the version the box is actually serving, what it could move to, and moves it on an explicit second click. It is gated on the `core.pin.move` atom — archon-floor and `system: true` — and every move lands in the `core_upgrades` ledger with the builder who asked. The web tier never gains a shell: it queues a `core-upgrade` intent and the control-plane runner drains it, driving exactly the `bongos upgrade` invocation documented below, with its health gate and auto-rollback intact.
+>
+> **One install-time step enables it.** The door needs a `provisioning_instances` row to point at, and the control plane has never had one:
+>
+> ```bash
+> node scripts/gds/enroll-control-plane.js --owner <builderId> --apply
+> ```
+>
+> Until that is run, `/deploy` says so and names this command. The self row carries `hosting_shape='control-plane'`, which every destructive intent action refuses by name — a teardown aimed at it would destroy the platform from inside its own UI, so the guard is an allow-list (`core-upgrade`, `restart`) enforced at `enqueueIntent`, the one place every intent passes.
+
 Each instance decides, independently, when to take a release. **Which mechanism it uses is a per-instance fact you must establish before prescribing anything** — read its `package.json`:
 
 | Pin in `package.json` | Path | How it updates |

package/migrations/core_241_core_upgrades_actor.sql

@@ -0,0 +1,65 @@
+-- core_241_core_upgrades_actor.sql — who asked for this upgrade (task 1003159,
+-- ADR 0293 D5).
+--
+-- core_189 built the per-instance core-upgrade ledger with from_version, to_version,
+-- source_commit and a free-text `note`. That was right for the world it was written
+-- in: every upgrade came from a human at a shell, and the note carried "who ran it"
+-- as prose when someone remembered.
+--
+-- Task 1003159 makes an upgrade something an HTTP request can START. That is the
+-- most privileged act in the system — it restarts a service and changes what code
+-- the platform runs — and the task's own non-negotiable is that **every invocation
+-- lands in this ledger with an actor**. Prose in a nullable note is not an actor:
+-- it cannot be joined, cannot be audited, and is absent exactly when someone was in
+-- a hurry.
+--
+-- NULLABLE, DELIBERATELY. An upgrade run the old way — a human at a shell on the
+-- box — has no builder to attribute and must keep working unchanged; this column is
+-- not a gate on the CLI path. NULL therefore reads as "not requested through the
+-- door", which is a true and useful statement rather than missing data. The route
+-- is what makes it non-null in practice: it has an authenticated builder by
+-- construction, and a request it cannot attribute is refused before it reaches here.
+--
+-- ON DELETE SET NULL matches every other actor reference in the schema: deleting a
+-- person must not erase the record of what the platform did.
+--
+-- Additive, idempotent, no down-migration.
+
+BEGIN;
+
+ALTER TABLE core_upgrades ADD COLUMN IF NOT EXISTS requested_by_builder_id bigint
+  REFERENCES builders(id) ON DELETE SET NULL;
+
+-- How the upgrade was started. 'shell' is every pre-existing row and every future
+-- CLI run; 'owner-control' is the door this task builds. Text + CHECK rather than
+-- an enum type, the fail-closed shape the rest of the schema uses: an unwired
+-- source is refused at insert, and widening later is a one-line constraint change.
+ALTER TABLE core_upgrades ADD COLUMN IF NOT EXISTS source text;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'core_upgrades_source_chk') THEN
+    ALTER TABLE core_upgrades ADD CONSTRAINT core_upgrades_source_chk
+      CHECK (source IS NULL OR source IN ('shell', 'owner-control'));
+  END IF;
+
+  -- An upgrade that came through the DOOR must name its actor. A shell run need
+  -- not, and pre-existing rows carry neither. NOT VALID so the constraint binds
+  -- every future write without scanning history that predates the concept — the
+  -- same trade agents_002_payer.sql made for the same reason.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'core_upgrades_door_needs_actor_chk') THEN
+    ALTER TABLE core_upgrades ADD CONSTRAINT core_upgrades_door_needs_actor_chk
+      CHECK (source IS DISTINCT FROM 'owner-control' OR requested_by_builder_id IS NOT NULL) NOT VALID;
+  END IF;
+END $$;
+
+-- "What has this builder deployed?" — the audit read. Partial: a shell run has no
+-- actor and would only dilute the scan.
+CREATE INDEX IF NOT EXISTS core_upgrades_actor_idx
+  ON core_upgrades (requested_by_builder_id, applied_at DESC)
+  WHERE requested_by_builder_id IS NOT NULL;
+
+INSERT INTO schema_migrations (version) VALUES ('core_241_core_upgrades_actor')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/migrations/core_242_core_version_snapshot.sql

@@ -0,0 +1,54 @@
+-- core_242_core_version_snapshot.sql — what the box serves and what it could take
+-- (task 1003159, ADR 0293 D3 + D6).
+--
+-- THE PROBLEM THIS SOLVES IS A LAYERING ONE, not a storage one. The deploy control has
+-- to show the owner two facts before they press anything: the version the box is
+-- ACTUALLY serving, and the versions it could be moved to. Neither is reachable from the
+-- web tier:
+--
+--   • the served version is `curl 127.0.0.1:<port>/version` ON the box (ADR 0293 D6) —
+--     the apex sits behind pre-launch basic_auth and its HTML rides a CDN, so a public
+--     read can report a stale answer with total confidence;
+--   • the available versions are `npm view`, which update-channel.js runs via spawnSync.
+--     On a single-process web server that blocks every other request for the seconds npm
+--     takes — and npm took 8–13 minutes to publish on 2026-09-16 (learnings 1000263,
+--     1000266), so this is not a theoretical stall.
+--
+-- Both ARE cheap for the control-plane runner, which is a CLI process on the box and
+-- already wakes on a timer. So the runner writes what it sees; the web tier reads a row.
+-- That is the same direction of travel as the intent queue itself (ADR 0293 D1): the
+-- privileged side acts and reports, the web side asks and displays.
+--
+-- ONE ROW PER INSTANCE, REPLACED IN PLACE. This is a cache of an observation, not a
+-- ledger — core_upgrades is the ledger and keeps every move forever. Keeping history
+-- here would grow a row per instance per tick to answer a question only ever asked about
+-- the present.
+--
+-- observed_at IS PART OF THE ANSWER, NOT METADATA. A cache that renders as though it
+-- were live is how a control tells someone the box is on a version it left an hour ago.
+-- The UI is expected to say how old this is, which it can only do if the age is stored.
+--
+-- Additive, idempotent, no down-migration.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS core_version_snapshot (
+  instance_id      bigint PRIMARY KEY REFERENCES provisioning_instances(id) ON DELETE CASCADE,
+  -- What 127.0.0.1/version answered. NULL means the box did not answer — a real and
+  -- different state from "answered with an old version", and the control must not
+  -- collapse the two into a confident number.
+  served_version   text,
+  -- Versions the registry reports, newest last, as update-channel.js parsed them.
+  -- jsonb rather than text[]: it is written whole and read whole, never queried inside.
+  available        jsonb NOT NULL DEFAULT '[]'::jsonb,
+  -- What the channel policy would actually take from `available` right now. Stored
+  -- rather than recomputed in the browser so the control and the runner cannot disagree
+  -- about what pressing the button would do.
+  recommended      text,
+  observed_at      timestamptz NOT NULL DEFAULT now()
+);
+
+INSERT INTO schema_migrations (version) VALUES ('core_242_core_version_snapshot')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -688,6 +688,8 @@ function createClient(opts = {}) {
       postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
     },
     "provisioning": {
+      // GET /provisioning/control-plane — rank: archon — GET /provisioning/control-plane
+      getProvisioningControlPlane: (args) => request("GET", "/provisioning/control-plane", { hasBody: false }, args),
       // GET /provisioning/fleet — rank: metic+archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
       // GET /provisioning/fleet/cost-ledger — rank: metic+archon — GET /provisioning/fleet/cost-ledger
@@ -704,6 +706,10 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/core-upgrade — rank: archon — GET /provisioning/instances/:id/core-upgrade
+      getProvisioningInstancesIdCoreUpgrade: (args) => request("GET", "/provisioning/instances/{id}/core-upgrade", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/core-upgrade — rank: archon — POST /provisioning/instances/:id/core-upgrade
+      postProvisioningInstancesIdCoreUpgrade: (args) => request("POST", "/provisioning/instances/{id}/core-upgrade", { hasBody: true }, args),
       // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
       patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/disconnect — rank: any-builder — POST /provisioning/instances/:id/disconnect

package/modules/government/catalog.js

@@ -101,6 +101,14 @@ const PERMISSIONS = [
   // enforced out of band and can never be delegated by a row in this database.
   { key: 'builder.rank.set', system: true, floor: 'archon', guards: 'PATCH /builders/:id/rank — the single rank writer' },
   { key: 'version.close', system: true, floor: 'archon', guards: 'version close disposition (never delegated below Archon)' },
+  // core.pin.move (task 1003159, ADR 0293) — MOVE AN INSTANCE'S CORE PIN: the act
+  // that makes shipped work visible to users, and the most privileged thing an HTTP
+  // request can start here (it restarts a service and changes what code runs).
+  // system:true + archon, alongside version.close, because it is a HARD GATE the
+  // owner holds: the catalog's own invariant forbids granting a system key to metic,
+  // so this cannot be delegated downward by a custom rank. The web tier still gains
+  // no shell - the route only QUEUES an intent the control-plane runner drains.
+  { key: 'core.pin.move', system: true, floor: 'archon', guards: 'POST /provisioning/instances/:id/core-upgrade — gate 3 of the release pipeline (ADR 0293)' },
   // BV1.R21 (task 1003608, goal 1000086). ADR 0250 §6 amends ADR 0157 for exactly
   // this key: `version.create` returns to the Archon floor.
   //

package/modules/government/migrations/government_014_core_pin_move.sql

@@ -0,0 +1,46 @@
+-- government_014_core_pin_move.sql — grant `core.pin.move` to the Archon
+-- rank-role (task 1003159, ADR 0293).
+--
+-- The atom gates the owner's deploy door: POST /provisioning/instances/:id/
+-- core-upgrade, which queues an intent the control-plane runner drains to move an
+-- instance's core pin. That is gate 3 of the release pipeline (ADR 0137) and the
+-- only act that makes shipped work visible to users.
+--
+-- ARCHON ONLY, AND system:true. Two separate statements about the same key:
+--
+--   • the FLOOR is archon because deploy is one of the hard gates the owner holds.
+--     Cloud Bongos is AI-first — agents write the code, the human holds the gates —
+--     and this task exists because that gate had no instrument, not because it
+--     should be widely held.
+--
+--   • `system: true` is what makes the floor un-delegatable. The catalog's own
+--     invariant (tests/government_catalog.mjs) forbids granting a system key to
+--     metic, so no custom rank can be handed this without clearing the flag first —
+--     a deliberate, visible edit. It sits beside `version.close` and
+--     `task.confirm.grade_bypass` for exactly the reason ADR 0157 gives about the
+--     escalation keys: a power that can be delegated downward by someone holding it
+--     is not really a gate.
+--
+-- ONLY archon is granted, so unlike government_007 this adds exactly one row.
+-- There is no metic grant to write, which is the point.
+--
+-- The compat seed (governance_002) is RUN-ONCE, so a new atom cannot be added by
+-- editing it — every already-migrated database would never see the grant. This is
+-- the follow-on grant migration that header calls for.
+--
+-- tests/governance_seed.mjs reads the UNION of the seed and every later government_*
+-- grant migration and asserts it equals catalog.js's floor-derived RANK_ROLE_SEED,
+-- so this file is what keeps the SQL snapshot equal to the catalog entry.
+--
+-- Additive, idempotent (ON CONFLICT DO NOTHING), forward-safe: INSERT only, nothing
+-- dropped or retyped, no down-migration.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'core.pin.move'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/deploy.html

@@ -0,0 +1,64 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Deploy — {{worldName}}</title>
+  <meta name="description" content="Move this instance onto a newer core and read back the version the box actually serves — the deploy gate, without a shell or an ssh key.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <link rel="stylesheet" href="/builders/oversight.css">
+  <link rel="stylesheet" href="/builders/project-settings.css">
+</head>
+<body data-page="deploy" data-page-title="Deploy">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <div class="app-content">
+      <div class="page-head page-head--board">
+        <h1 class="page-head__h">Deploy</h1>
+        <p class="page-head__sub" id="dp-sub">Loading…</p>
+      </div>
+
+      <main id="hall-main">
+        <section class="scroll" id="dp-sealed" aria-labelledby="dp-sealed-h" hidden>
+          <h2 class="scroll__h" id="dp-sealed-h">Restricted</h2>
+          <p class="scroll__lede" id="dp-sealed-body">This page opens at a higher rank.</p>
+        </section>
+
+        <section class="scroll" id="dp-body" aria-labelledby="dp-body-h" hidden>
+          <h2 class="scroll__h" id="dp-body-h">What users can see</h2>
+          <!-- The honest framing, and the one thing a reader must not misread:
+               shipping work and deploying it are different acts. "Merged" does not
+               mean visible (ADR 0137's three gates); this page is the third one. -->
+          <p class="scroll__lede">
+            Merging work does not put it in front of anyone. This is the step that does:
+            it moves this instance onto a newer core, waits for the box to answer, and
+            puts itself back if it does not.
+          </p>
+          <!-- One mount, written by deploy.js. Nothing here is authored as markup with
+               a version in it: every number on this page is a reading the control plane
+               took, carrying the time it took it. -->
+          <div id="dp-panel"><span class="kit-skel"></span></div>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/palette.js" defer></script>
+<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
+<script src="/builders/hall-kit.js"></script>
+<script src="/builders/deploy.js?v=2026-09-16-deploy1"></script>
+</body>
+</html>

package/modules/hall-ui/public/deploy.js

@@ -0,0 +1,188 @@
+// deploy.js — the owner's deploy door (task 1003159, ADR 0293).
+//
+// WHAT THIS PAGE IS FOR. The owner, twice in a month: "I don't think I can make anything
+// live", then "this is above my paygrade." Moving this instance's core pin is gate 3 of
+// the release pipeline and the ONLY act that makes shipped work visible to users — and it
+// was reachable from exactly one place, a shell on the control-plane box holding an ssh
+// key. An agent could not close the loop either: the permission classifier blocks a
+// mutating `sudo -u lars` over ssh by design. So the one gate that is the owner's to hold
+// was the one gate with no instrument. This page is the instrument.
+//
+// THE RULE THAT SHAPES EVERY LINE HERE: this page KNOWS NOTHING. Every version on it is a
+// reading the control-plane runner took on the box, carried through the server with the
+// time it was taken. Nothing is computed here, no version is compared here, and "up to
+// date" is never inferred from an absence — the server says `behind` or it does not, and
+// a missing reading renders as a missing reading. A deploy control that guesses is worse
+// than none, because it is trusted.
+//
+// TWO STEPS, NEVER ONE (ADR 0293 D4). The owner asked for the confirmation. Auto-rollback
+// already guards the bad release; this guards the wrong button. Step one shows what would
+// move; step two names the version it saw and sends that. The confirm button is built
+// FROM the previewed version, so a release that lands between the two steps cannot
+// silently change what the press does.
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg);
+  const $ = (id) => document.getElementById(id);
+
+  // The preview the server last handed us. The confirm step reads its version from HERE
+  // rather than from the DOM, so what is sent is what was previewed even if a poll
+  // repaints between the two clicks.
+  let previewed = null;
+
+  async function fetchJson(path) {
+    const res = await api.request('GET', `${API}${path}`);
+    if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw { kind: '401' }; }
+    if (res.status === 403) { throw { kind: '403' }; }
+    if (!res.ok) {
+      const err = (res.data && res.data.error) || {};
+      throw new Error(err.message && err.message !== err.code ? err.message : (err.code || `${path} → ${res.status}`));
+    }
+    return res.data;
+  }
+
+  async function sendJson(method, path, body) {
+    const res = await api.request(method, `${API}${path}`, { body: body || {} });
+    if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw { kind: '401' }; }
+    const data = res.data || {};
+    if (!res.ok) {
+      const err = data.error || {};
+      // The server's sentence when it wrote one — its refusals name what to do instead,
+      // and re-wording them here would lose that. Never a message invented on this page.
+      throw new Error(err.message && err.message !== err.code ? err.message : (err.code || `${path} → ${res.status}`));
+    }
+    return data;
+  }
+
+  // "3 minutes ago" for a reading's age. The age is part of the answer, not decoration:
+  // every number on this page came from a cache, and a cache rendered as though it were
+  // live is how someone is told their box is on a version it left an hour ago.
+  function ago(iso) {
+    if (!iso) return 'never';
+    const secs = Math.max(0, Math.round((Date.now() - new Date(iso).getTime()) / 1000));
+    if (secs < 90) return `${secs}s ago`;
+    const mins = Math.round(secs / 60);
+    if (mins < 90) return `${mins} min ago`;
+    return `${Math.round(mins / 60)}h ago`;
+  }
+
+  function versionHtml(v) {
+    return v ? `<span class="ov-mono">${escapeHtml(String(v))}</span>` : '<span class="ps-pill ps-pill--absent">no reading</span>';
+  }
+
+  // ---- the three states this page can be in --------------------------------
+
+  // Something is already running. The press is not offered at all — offering a button
+  // that the server will refuse with 'intent_conflict' is a worse experience than saying
+  // plainly that the box is busy.
+  function busyHtml(p) {
+    const i = p.open_intent;
+    return `
+      <p class="ov-row__sub">A <strong>${escapeHtml(i.action)}</strong> is ${escapeHtml(i.state)} for this box${
+        i.target_version ? ` (to core ${escapeHtml(i.target_version)})` : ''}.
+        Nothing else can be queued until it settles; this page will notice when it does.</p>`;
+  }
+
+  function stepOneHtml(p) {
+    return `
+      <p class="ov-row__sub">Core <strong>${escapeHtml(String(p.recommended_version))}</strong> is published and
+        this box is not on it yet.</p>
+      <div class="ps-controls">
+        <button type="button" class="btn" id="dp-preview">See what would change</button>
+      </div>`;
+  }
+
+  // Step two. The version is written into the button's own label and into `previewed`,
+  // so the owner confirms the thing they were shown rather than "the newest", which is a
+  // different act by the time it is resolved.
+  function stepTwoHtml(p) {
+    return `
+      <div class="ps-controls" id="dp-confirm-wrap">
+        <p class="ov-row__sub">This restarts the platform onto core
+          <strong>${escapeHtml(String(p.recommended_version))}</strong>. It waits for the box to answer and
+          puts itself back on ${escapeHtml(String(p.served_version))} if it does not.</p>
+        <button type="button" class="btn btn--primary" id="dp-confirm">Move to ${escapeHtml(String(p.recommended_version))}</button>
+        <button type="button" class="btn" id="dp-cancel">Cancel</button>
+      </div>`;
+  }
+
+  function panelHtml(p, step) {
+    const rows = [
+      `<li class="ov-row"><div class="ov-row__main">
+         <span class="ov-row__title">Serving now</span>
+         <p class="ov-row__sub">${versionHtml(p.served_version)} — read from the box itself, ${escapeHtml(ago(p.observed_at))}.</p>
+         ${p.reading === 'no_answer'
+           ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
+           : ''}
+       </div></li>`,
+    ];
+    let action = '';
+    if (p.open_intent) action = busyHtml(p);
+    else if (p.reading === 'no_answer') action = '';
+    else if (!p.behind) action = `<p class="ov-row__sub">Nothing newer is published that this box can take. There is nothing to deploy.</p>`;
+    else action = step === 'confirm' ? stepTwoHtml(p) : stepOneHtml(p);
+    rows.push(`<li class="ov-row"><div class="ov-row__main">
+        <span class="ov-row__title">Make it live</span>
+        ${action}
+      </div></li>`);
+    return `<ul class="ov-lines">${rows.join('')}</ul>
+      <p class="ps-prov">reads the control plane's own observation · ADR 0293 · every move is recorded with who asked</p>`;
+  }
+
+  // ---- wiring --------------------------------------------------------------
+
+  function render(p, step) {
+    previewed = p;
+    $('dp-panel').innerHTML = panelHtml(p, step);
+    const preview = $('dp-preview');
+    if (preview) preview.addEventListener('click', () => render(p, 'confirm'));
+    const cancel = $('dp-cancel');
+    if (cancel) cancel.addEventListener('click', () => render(p, 'preview'));
+    const confirm = $('dp-confirm');
+    if (confirm) confirm.addEventListener('click', () => move(p));
+  }
+
+  async function move(p) {
+    const btn = $('dp-confirm');
+    if (btn) { btn.disabled = true; btn.textContent = 'Queueing…'; }
+    try {
+      // `p.recommended_version` — the version this owner was SHOWN, not whatever is
+      // newest at the moment of the click.
+      const r = await sendJson('POST', `/provisioning/instances/${p.instance_id}/core-upgrade`, { to: p.recommended_version });
+      toast(r.message || 'Queued.');
+      await load();
+    } catch (e) {
+      if (e && e.kind === '401') return;
+      toast(e.message || 'Could not queue the move.');
+      if (btn) { btn.disabled = false; btn.textContent = `Move to ${p.recommended_version}`; }
+    }
+  }
+
+  async function load() {
+    try {
+      const d = await fetchJson('/provisioning/control-plane');
+      $('dp-sub').textContent = `${d.preview.slug} — the box this platform runs on`;
+      $('dp-body').hidden = false;
+      render(d.preview, 'preview');
+    } catch (e) {
+      if (e && e.kind === '401') return;
+      if (e && e.kind === '403') {
+        $('dp-sealed').hidden = false;
+        $('dp-sub').textContent = 'Restricted';
+        return;
+      }
+      // Including 'control_plane_not_enrolled', whose message names the one command
+      // that fixes it — which is why the server's sentence is shown rather than a
+      // generic failure line.
+      $('dp-body').hidden = false;
+      $('dp-sub').textContent = 'Unavailable';
+      $('dp-panel').innerHTML = `<p class="ps-invalid">${escapeHtml(e.message || 'Could not read the deploy state.')}</p>`;
+    }
+  }
+
+  document.addEventListener('DOMContentLoaded', load);
+})();

package/modules/hall-ui/public/hall-kit.js

@@ -579,70 +579,14 @@
     };
   }
 
-  // ---- ship-time task visual (task 1003109, goal 1000072) -------------------
+  // ---- ship-time task visual — MOVED OUT (task 1003835) ---------------------
   //
-  // A shipped task may carry an optional IMAGE alongside its value summary — the
-  // same claim in another medium, so a non-engineer can SEE what changed rather
-  // than read about it. In a FEED the summary is one line in a list, so the image
-  // appears as a small thumbnail linking to the full-size file; the task page
-  // renders it properly (task.js taskVisualHtml).
-  //
-  // Lives here because three separate feeds render it (Standing's ship ledger,
-  // a profile's recent ships, the status dashboard) and a fourth copy of an
-  // HTML-building helper is how the pre-kit drift started.
-
-  // Same-origin, SERVER-MINTED paths only. The URL arrives from our own API, but
-  // it lands in an href and a src, so it is matched literally against the shape
-  // modules/lifecycle/task-visuals.js mints rather than trusted. Anything else
-  // renders nothing at all.
-  const VISUAL_URL_RE = /^\/api\/(gds|bongos)\/task-visuals\/task-\d+-[0-9a-f]{16}\.(png|jpg|gif|webp)$/;
-  function isTaskVisualUrl(url) {
-    return VISUAL_URL_RE.test(String(url ?? ''));
-  }
-
-  // The compact thumbnail. Returns '' when the row carries no visual — a task
-  // without one must never look incomplete, so nothing is drawn (no placeholder).
-  function shipVisualThumbHtml(row) {
-    const url = String((row && row.visual_url) ?? '');
-    if (!isTaskVisualUrl(url)) return '';
-    const alt = String((row && row.visual_alt) || `Visual for task ${(row && row.id) ?? ''}`).trim();
-    return `<a href="${esc(url)}" target="_blank" rel="noopener" title="${esc(alt)}">` +
-      `<img class="ship-visual-thumb" src="${esc(url)}" alt="${esc(alt)}" loading="lazy"></a>`;
-  }
-
-  // The FULL-SIZE form: the picture as the thing being looked at, with
-  // visual_alt as its caption. The thumbnail above is for a FEED, where the
-  // summary is one line in a list; this is for a surface whose subject IS the
-  // image — the task record, and the Studio's review card (task 1003829).
-  //
-  // It lives here so the Studio did not become the THIRD hand-rolled <figure>
-  // for this one image. Be precise about what that did and did not fix: the two
-  // that already existed — task.js's taskVisualHtml (.tk-visual) and
-  // task-detail.js's overlay (.td-visual) — are NOT converged onto this yet and
-  // are untouched by the task that added it (1003829). Neither page loads the
-  // kit, so migrating them means adding it to task.html, which is a call of its
-  // own. So: one canonical renderer exists and new callers take it; the two
-  // legacy copies are a known, named cleanup rather than a claim already met.
-  //
-  // `className` is the caller's BEM base, because the size is the surface's
-  // decision and not the kit's: the task record caps at 52vh inside a record
-  // column (.tk-visual), the Studio gives the plate the card's whole width.
-  // The markup, the URL guard and the escaping are the kit's and identical
-  // everywhere. Returns '' with no visual, like the thumbnail.
-  function taskVisualFigureHtml(row, { className = 'task-visual' } = {}) {
-    const url = String((row && row.visual_url) ?? '');
-    if (!isTaskVisualUrl(url)) return '';
-    const written = String((row && row.visual_alt) || '').trim();
-    const alt = written || `Visual for task ${(row && row.id) ?? ''}`;
-    const base = String(className).replace(/[^A-Za-z0-9_-]/g, '');
-    // The caption is only drawn when the shipper WROTE one — the fallback alt is
-    // a machine sentence for a screen reader, not a caption to show a reader.
-    const caption = written ? `<figcaption class="${base}__caption">${esc(written)}</figcaption>` : '';
-    return `<figure class="${base}">` +
-      `<a href="${esc(url)}" target="_blank" rel="noopener">` +
-      `<img class="${base}__img" src="${esc(url)}" alt="${esc(alt)}" loading="lazy">` +
-      `</a>${caption}</figure>`;
-  }
+  // isTaskVisualUrl / shipVisualThumbHtml / taskVisualFigureHtml now live in
+  // hall-visual.js. They left because the task record page renders a visual and
+  // needs nothing else in this file, so converging it here would have loaded 61KB
+  // on the hall's most-visited record page for one function. A page that draws a
+  // visual loads hall-visual.js; pages that only use the kit no longer carry the
+  // renderers at all. Callers read window.OTBVisual, not OTBKit.
 
   // ---- charts (task 1003445) ------------------------------------------------
   //
@@ -1218,8 +1162,6 @@
     plotBox, plotWindow,
     // states
     emptyStateHtml, skeletonRows, collapsibleCard,
-    // ship-time task visual (task 1003109; the full-size figure, task 1003829)
-    isTaskVisualUrl, shipVisualThumbHtml, taskVisualFigureHtml,
     // age (task 1002955)
     fmtAge, fmtAbsDate, ageChipHtml, AGE_STALE_DAYS,
   };

package/modules/hall-ui/public/hall-render.js

@@ -1100,7 +1100,7 @@
         <td>
           <div>${escapeHtml(s.title)}</div>
           ${s.value_summary ? `<div style="color:var(--ink-soft);font-size:0.88rem;font-style:italic;margin-top:2px">${escapeHtml(s.value_summary)}</div>` : ''}
-          ${s.visual_url ? `<div style="margin-top:6px">${window.OTBKit.shipVisualThumbHtml(s)}</div>` : ''}
+          ${s.visual_url && window.OTBVisual ? `<div style="margin-top:6px">${window.OTBVisual.shipVisualThumbHtml(s)}</div>` : ''}
         </td>
         <td class="ledger__drachmae">${fmtNum(window.OTBBranding?.taskCreditValue?.(s) ?? s.credits_reward)}</td>
         <td class="ledger__date">${fmtDate(s.shipped_at)}</td>