@bongos/core 1.19.872 → 1.19.874

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.872",
-  "core_contract": "1.19.872",
-  "source_commit": "847fc8087c9a995a4d3cd60606d594d66e209773",
+  "core_version": "1.19.874",
+  "core_contract": "1.19.874",
+  "source_commit": "57108fe11dd040dbf550355c6ff492141c283504",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T03:43:12.261Z",
+  "built_at": "2026-09-19T03:56:27.228Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 500,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2300,
+    "functional_verbatim": 2301,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2826,
-  "tree_sha256": "5535807e0c119bfd1e626826227726d034838568c556eb76fe7d367566a79155",
+  "file_count": 2827,
+  "tree_sha256": "28457c8c4f76254953c87b849337aa0804581b4ee7e2c2a696b93afb5338b8dc",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1382,7 +1382,7 @@
     {
       "path": "docs/adr/0180-dependency-intake-and-drift-policy.md",
       "mode": "0000644",
-      "sha256": "9d50f2f71de5c4eba8d5af40aca201c6e054b1eec937a9e1342d1bb3b4ce45c1"
+      "sha256": "d302683d028895648062a8128815c9a54db95ef174eee14f06af676587a380e5"
     },
     {
       "path": "docs/adr/0181-teardown-state-gate-and-address-retention.md",
@@ -2072,12 +2072,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "c6ed9bece0a261ff37a10f36ac6179566d0ee757c95bb68e2a19bf3c0f02b300"
+      "sha256": "4671a9e1ebce9a803afcd531d5da4ce939a2b228c62c916100c6748b37f6e72e"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "e06a5c2011c25018fcceb437fdfc5c61a1dd7cd7415d5096ad1da58da20cc8d2"
+      "sha256": "33e3a3376c0d444bb20d0b0f8ae7fc4808539963e7adf17d614ded6fcbd3a1d3"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a581f0b40b8f6ba0fe33d5ae858c3c4048ba0bdec90f212d4e28de1191533565"
+      "sha256": "688d9a2c95e934fca0e1df1a685f0cc72844cbe98b718e40f8ae7c49e3f65c9e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2812,7 +2812,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "6d488eff1dd8201debb991ba854c59b5404235b1a433403dbedecaf0638128e4"
+      "sha256": "5e4213d19d7f13ff0a378f996c7e909e00cf262516e72f96e44d4ddf0d4cc861"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -4872,12 +4872,12 @@
     {
       "path": "modules/hall-ui/public/deploy.html",
       "mode": "0000644",
-      "sha256": "23e54a15a796a7f7176cea0fcfcc72f92e5a008c851de25e443b74a2af8951ed"
+      "sha256": "1dabc13d4c3dc59e10918348e0607ab7162522ba91d0269e3d4db3fbf5f0001e"
     },
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "a44f3c64894c8f51b50e28ad42c9e8e52d60eb1a1d6098cdaf514f16492ba0b2"
+      "sha256": "6676d4b7f5eb4a55d7cc4070824fc174f0ce7a74ce25441834e1d6175367fadc"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -7932,12 +7932,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "05e6bfd775abf8fa8ae50d6f40600767660564b8a4873d52beea120773cf5d96"
+      "sha256": "7ae11b1bc6205785da22165907051680ba4abe00c7536b9c668488bb0667b78b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bc23e285afda64a58c1480f713447d5d5b18d6aa6e0fc5ccd77d0f275e297103"
+      "sha256": "ef1cb37663f2cde6765b0ec2dc9df5bdc85ae91bbc63abdebe7aa607d436a6d4"
     },
     {
       "path": "public-docs/index.html",
@@ -8892,7 +8892,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "b04300749c4f119912ecfb2e6df4a6703f004130570e47a4e5bfaffacd7e2118"
+      "sha256": "2ce976a62d123a284172c054bbc378c33977d2efda44e4b94ef2751a2626944d"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -9922,7 +9922,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "cb2d09a82fc7149dafd2ec0934ae6304481ce2c14e56fa75f3516fab2d37d974"
+      "sha256": "1f7faccdbfb12ca1f1802d7703733b8bf9dd7ff9c2d5fd0bf96ea4c897a5d162"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10949,6 +10949,11 @@
       "mode": "0000644",
       "sha256": "1abfa6c8bb119d010d2a53f71373508a31a9cc3c28207ca1dbac2138a7eda595"
     },
+    {
+      "path": "tests/deploy_page_projects.mjs",
+      "mode": "0000644",
+      "sha256": "2de9feef1fa6be72e8f9866a28b262149628316042f277c20d1bc00a088ec5d4"
+    },
     {
       "path": "tests/design_tokens_sync.mjs",
       "mode": "0000644",
@@ -12572,7 +12577,7 @@
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",
-      "sha256": "7d64e3c217274af48f24557d49deeb2cb54d7929bd9e939f15b3d3ceb757336c"
+      "sha256": "dafc62752d62949ed465d102b1bc5598ca3d4210a6d5d01d0be8bcf93f8413fc"
     },
     {
       "path": "tests/parallel-load.mjs",

package/docs/adr/0180-dependency-intake-and-drift-policy.md

@@ -37,6 +37,12 @@ The publish-on-merge lane (ADR 0161) authenticates with a long-lived `NPM_TOKEN`
 > - **Provenance had to be turned OFF.** Trusted publishing enables it by default and npm *refuses* to generate provenance from a **private source repository** — so the "provenance for free" clause above does not apply to this repo, and leaving the default would have failed every publish.
 > - **The registry could no longer answer "is this version taken?".** `@bongos/core` is private, so an unauthenticated `npm view` is a flat `E404` rather than a "no", and OIDC authenticates `npm publish` and nothing else. Keeping that check would have skipped the auto-bump on every run and collided on the published version — **breaking after exactly one release**. The lane now reads its own `release: core X.Y.Z` commits (`laneReleasedVersions`), which need no auth and are the source the cascade terminator already trusts.
 
+> **Closed 2026-09-18 — task 1003262. Migrating the lane is not the same as deleting the credential, and for three weeks only the first had happened.** `publish.yml` stopped using `NPM_TOKEN` on 2026-08-25 and the repository secret was removed, after which this ADR, [ADR 0161](0161-publish-on-merge.md) and the red-team follow-up all recorded that "no long-lived npm credential exists to steal". That was true of the *repo* and false of the *npm account*: the granular write token `ci-publish-on-merge` (scope `@bongos`, package:write, 2FA-bypass, expiring 2026-11-06) was never revoked — it simply stopped being used, which produces no signal at all. A credential nothing reads is not a credential nothing can use.
+>
+> The same shape a second time, for reads: `droplet-registry-read` outlived [ADR 0283](0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md)'s public flip and `fcea51ca`'s deletion of every code path that consumed it — and that one had already leaked, in cleartext, into the droplet's persistent journal (blocker 1000118).
+>
+> **The rule this adds: a credential is retired when it is revoked at the issuer, not when the last caller stops passing it.** Removing the use is the safe half and the reversible half; it is not the finish. Both tokens are enumerated in this task's ship notes, and `npm token list` is the check — the repo cannot answer this question about itself, which is why nothing caught it.
+
 ## What this deliberately does not cover
 
 New-dependency *intake vetting* (registry existence/age/download checks — the slopsquatting defense) lives in the weekly patrol (task 1003128), and one-off vulnerability *fixes* (sharp ≥ 0.35 for the libvips CVEs, the colyseus chain for nanoid) are ordinary tasks that shrink the baseline — filed in the idea inbox at adoption time.

package/docs/copy-inventory.md

@@ -348,6 +348,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:260` |
 | `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:297` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:640` |
+| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:157` |
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:1153` |
 | `4cf6bc8b377b` | certain | Could not remove. Try again. | `modules/hall-ui/public/settings.js:1152` |
 | `7a778d188e87` | certain | Could not remove: {…} | `modules/hall-ui/public/government.js:369` |
@@ -629,14 +630,13 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `73677b6839d7` | certain | Looks good | `modules/hall-ui/public/studio.js:162` |
 | `a93ca2841b96` | certain | Mac (Intel) | `modules/hall-ui/public/hall-render.js:825` |
 | `06b4ede3fb58` | certain | Machine principals | `modules/hall-ui/public/government.html:122` |
-| `c4b39de1e478` | certain | Make it live | `modules/hall-ui/public/deploy.js:128` |
 | `6b3d660e0e31` | certain | Map view | `modules/hall-ui/public/atlas.html:46` |
 | `8bdec961e84a` | certain | Markets, incentives, and how to price them. | `modules/hall-ui/public/settings.html:308` |
 | `6e73716aec6c` | certain | May be offered for sale later | `modules/hall-ui/public/settings.html:324` |
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/hall-render.js:563` |
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/profile.js:94` |
 | `c7a670e9552d` | certain | Merged into | `modules/hall-ui/public/profile.js:406` |
-| `6bd456635167` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this instance onto a new | `modules/hall-ui/public/deploy.html:39` |
+| `dce0546c9e34` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this platform — or any p | `modules/hall-ui/public/deploy.html:39` |
 | `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:790` |
 | `91328a97fe68` | certain | Mingle pairs you with someone from another role. Saying no costs nothing. | `modules/hall-ui/public/collab.html:80` |
 | `d7ce4a3bb745` | certain | Minimize the welcome panel | `modules/hall-ui/public/hall-widgets.js:52` |
@@ -650,8 +650,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1ae18e58fead` | certain | Most recent first. Each load of this page is itself recorded in the audit log. | `modules/hall-ui/public/sessions.js:340` |
 | `f14a91b3f625` | certain | Most recent first. Each row is one recorded work session; every id on it opens its record. | `modules/hall-ui/public/sessions.html:56` |
 | `e52ae74f0052` | certain | Move to goal | `modules/hall-ui/public/task.js:577` |
-| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:103` |
-| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:161` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:122` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:217` |
 | `ae84ebe1d735` | certain | Name cannot be blank. | `modules/hall-ui/public/settings.js:763` |
 | `31e91ee6ce03` | certain | Name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:768` |
 | `5e8199266a8a` | certain | Name unvouched | `modules/hall-ui/public/watch.js:374` |
@@ -687,6 +687,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2a6d7552e21f` | certain | No other sessions. | `modules/hall-ui/public/settings-sessions.js:64` |
 | `9f73b3f3dad0` | certain | No rank floor — any builder can claim this task | `modules/hall-ui/public/task-lib.js:62` |
 | `3fd0c6fcb92e` | certain | No request and no invite needed. Sign in with GitHub, and a step-by-step guide takes you the rest of the way. | `modules/hall-ui/public/hall-render.js:277` |
+| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:195` |
 | `9fb9f766450d` | certain | No sections yet | `modules/hall-ui/public/primer.js:131` |
 | `bef9fe43ba84` | certain | No sessions recorded yet. They land here as builders ship and end sessions. | `modules/hall-ui/public/sessions.js:146` |
 | `4485497d87bb` | certain | No specialities yet. Create one below — it takes a name and a craft, and you can train it afterwards. | `modules/hall-ui/public/settings-specialities.js:169` |
@@ -717,7 +718,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:1105` |
 | `905e99f158c2` | certain | Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps  | `modules/hall-ui/public/goals-render.js:1007` |
 | `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:543` |
-| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:126` |
+| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:140` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:242` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/work.js:1066` |
 | `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:258` |
@@ -901,7 +902,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `324af64c8b6e` | certain | See all {…} goals {…} | `modules/hall-ui/public/roadmap.js:214` |
 | `a9c398651862` | certain | See the cross-project record | `modules/hall-ui/public/profile-canonical.js:114` |
 | `17d5b5739f46` | certain | See the work board → | `modules/hall-ui/public/hall-render.js:1019` |
-| `55cde0774831` | certain | See what would change | `modules/hall-ui/public/deploy.js:91` |
+| `55cde0774831` | certain | See what would change | `modules/hall-ui/public/deploy.js:108` |
 | `75dc5463facc` | certain | Select at least 2 waiting tasks to copy a parallel-session prompt. | `modules/hall-ui/public/work.js:816` |
 | `a98882faa482` | certain | Select at least 2 waiting tasks to copy a sequential prompt. | `modules/hall-ui/public/work.js:841` |
 | `582bdd9435eb` | certain | Select task {…} for bulk actions | `modules/hall-ui/public/work.js:452` |
@@ -909,7 +910,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7e1d54119e08` | certain | Select task {…} for bulk release | `modules/hall-ui/public/work.js:242` |
 | `ae43a132699b` | certain | Selectable today | `modules/hall-ui/public/government.js:799` |
 | `53cc6d8dd23c` | certain | Send invitation | `modules/hall-ui/public/goals-render.js:1206` |
-| `fcd68c6a21fd` | certain | Serving now | `modules/hall-ui/public/deploy.js:115` |
+| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:142` |
 | `64a1f055129e` | certain | Session card richness | `modules/hall-ui/public/settings-render.js:83` |
 | `d14e8e9acaff` | certain | Session ended. | `modules/hall-ui/public/settings-sessions.js:81` |
 | `55e0a34bafed` | certain | Session log{…} | `modules/hall-ui/public/task.js:487` |
@@ -1090,7 +1091,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/harbor.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/project-settings.html:36` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:40` |
-| `77e3b8f5318b` | certain | This restarts the platform onto core | `modules/hall-ui/public/deploy.js:103` |
+| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:187` |
+| `6e9dfe1fb903` | certain | This restarts {…} onto core | `modules/hall-ui/public/deploy.js:122` |
 | `69e8beced2ff` | certain | This sends the idea back to its author. Say why, and which section. | `modules/hall-ui/public/board-room.js:276` |
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:422` |
 | `c9e50a67988a` | certain | This task has shipped and its credits have landed. Neither Ship it nor Confirm is available. | `modules/hall-ui/public/task.js:715` |
@@ -1296,7 +1298,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `77ad318bb546` | certain | invited — awaiting their response | `modules/hall-ui/public/goals-render.js:1395` |
 | `af0777cd098b` | certain | is hardcoded back inside this | `modules/hall-ui/public/index.html:56` |
 | `c767b3e07826` | certain | is only the screen; the | `modules/hall-ui/public/diagrams.html:74` |
-| `d0e722302840` | certain | is published and this box is not on it yet. | `modules/hall-ui/public/deploy.js:91` |
+| `d0e722302840` | certain | is published and this box is not on it yet. | `modules/hall-ui/public/deploy.js:108` |
 | `aa530bd15088` | certain | itself). The registry stays the single source of truth for what the hall shows; a fitness check (scripts/gds/f | `modules/hall-ui/public/index.html:53` |
 | `9018bf6e99eb` | certain | last used {…} · signed in {…} | `modules/hall-ui/public/settings-sessions.js:46` |
 | `2ce7738b1eb0` | certain | loading goals… | `modules/hall-ui/public/task-detail.js:482` |
@@ -1313,7 +1315,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b9f2e0d43c94` | certain | no clock | `modules/hall-ui/public/government.js:607` |
 | `e3317d58ec83` | certain | no cost logged | `modules/hall-ui/public/hall-render.js:352` |
 | `e02979266baf` | certain | no data | `modules/hall-ui/public/hall-kit.js:735` |
-| `9e194a57d054` | certain | no reading | `modules/hall-ui/public/deploy.js:74` |
+| `9e194a57d054` | certain | no reading | `modules/hall-ui/public/deploy.js:91` |
 | `33ca71bef112` | certain | no tasks yet | `modules/hall-ui/public/goals-render.js:163` |
 | `739a4bd6bd83` | certain | node scripts/setup-builder.js | `modules/hall-ui/public/hall-render.js:892` |
 | `61f0f4b2f4ab` | certain | not categorised yet | `modules/hall-ui/public/goals-page.js:277` |
@@ -1343,7 +1345,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fb1dad96280` | certain | pending, on the People tab | `modules/hall-ui/public/watch.html:46` |
 | `3b22c5af029b` | certain | rank or above, or that it is your own. | `modules/hall-ui/public/copy-desk.html:47` |
 | `80ddf28baee7` | certain | rank-key (kebab-case) | `modules/hall-ui/public/government.html:82` |
-| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:132` |
+| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:199` |
 | `f83f0a9d6b6a` | certain | recorded, on the Operations tab | `modules/hall-ui/public/watch.html:49` |
 | `26da1df6fd4a` | certain | reflects it. | `modules/hall-ui/public/settings.html:136` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:84` |
@@ -1445,9 +1447,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a6e4ed98fbea` | certain | {…} · revoke it any time under Active sessions. | `modules/hall-ui/public/settings.js:942` |
 | `d73256fbc395` | certain | {…} · who votes, and how it {…} | `modules/hall-ui/public/board-room.js:357` |
 | `cab2a4296aec` | certain | {…} · {…} · {…}{…} | `modules/hall-ui/public/goal-inbox.js:326` |
-| `d9b4ae2db0f4` | certain | {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:115` |
 | `085f93f3f775` | certain | {…} — see all standings | `modules/hall-ui/public/hall-render.js:80` |
-| `b814cb35ce2f` | certain | {…} — the box this platform runs on | `modules/hall-ui/public/deploy.js:168` |
 | `f75ee96a7511` | certain | {…} — total payout from shipped work. | `modules/hall-ui/public/profile.js:94` |
 | `2a2728a4ec4f` | certain | {…}% of tasks complete | `modules/hall-ui/public/roadmap.js:70` |
 | `15e545eb3ce2` | certain | {…}, no such task | `modules/hall-ui/public/task.js:959` |

package/docs/copy-registry.json

@@ -1075,8 +1075,8 @@
       "text": "Move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:103",
-        "modules/hall-ui/public/deploy.js:161"
+        "modules/hall-ui/public/deploy.js:122",
+        "modules/hall-ui/public/deploy.js:217"
       ]
     },
     {
@@ -4265,6 +4265,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "21c2f33168a3",
+      "surface": "builders-hall",
+      "text": "Could not read this project's deploy state: {…}",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 157,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "8b470cebf53d",
       "surface": "builders-hall",
@@ -6794,15 +6803,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "c4b39de1e478",
-      "surface": "builders-hall",
-      "text": "Make it live",
-      "file": "modules/hall-ui/public/deploy.js",
-      "line": 128,
-      "origin": "js-markup",
-      "confidence": "certain"
-    },
     {
       "id": "6b3d660e0e31",
       "surface": "builders-hall",
@@ -6858,9 +6858,9 @@
       "confidence": "certain"
     },
     {
-      "id": "6bd456635167",
+      "id": "dce0546c9e34",
       "surface": "builders-hall",
-      "text": "Merging work does not put it in front of anyone. This is the step that does: it moves this instance onto a newer core, waits for the box to answer, and puts itself back if it does not.",
+      "text": "Merging work does not put it in front of anyone. This is the step that does: it moves this platform — or any project it hosts — onto a newer core, waits for that box to answer, and puts it back if it does not.",
       "file": "modules/hall-ui/public/deploy.html",
       "line": 39,
       "origin": "html-text",
@@ -6988,7 +6988,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 103,
+      "line": 122,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6997,7 +6997,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 161,
+      "line": 217,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7316,6 +7316,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "2947c1ddea9a",
+      "surface": "builders-hall",
+      "text": "No running box to deploy.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 195,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "9fb9f766450d",
       "surface": "builders-hall",
@@ -7591,7 +7600,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 126,
+      "line": 140,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9247,7 +9256,7 @@
       "surface": "builders-hall",
       "text": "See what would change",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 91,
+      "line": 108,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9315,11 +9324,11 @@
       "confidence": "certain"
     },
     {
-      "id": "fcd68c6a21fd",
+      "id": "a39b0f9d86e5",
       "surface": "builders-hall",
-      "text": "Serving now",
+      "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 115,
+      "line": 142,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10944,11 +10953,20 @@
       "confidence": "certain"
     },
     {
-      "id": "77e3b8f5318b",
+      "id": "f93fcb24c6ba",
       "surface": "builders-hall",
-      "text": "This restarts the platform onto core",
+      "text": "This platform",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 103,
+      "line": 187,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "6e9dfe1fb903",
+      "surface": "builders-hall",
+      "text": "This restarts {…} onto core",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 122,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12802,7 +12820,7 @@
       "surface": "builders-hall",
       "text": "is published and this box is not on it yet.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 91,
+      "line": 108,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12955,7 +12973,7 @@
       "surface": "builders-hall",
       "text": "no reading",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 74,
+      "line": 91,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13225,7 +13243,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 132,
+      "line": 199,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14138,15 +14156,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "d9b4ae2db0f4",
-      "surface": "builders-hall",
-      "text": "{…} — read from the box itself, {…}.",
-      "file": "modules/hall-ui/public/deploy.js",
-      "line": 115,
-      "origin": "js-markup",
-      "confidence": "certain"
-    },
     {
       "id": "085f93f3f775",
       "surface": "builders-hall",
@@ -14156,15 +14165,6 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
-    {
-      "id": "b814cb35ce2f",
-      "surface": "builders-hall",
-      "text": "{…} — the box this platform runs on",
-      "file": "modules/hall-ui/public/deploy.js",
-      "line": 168,
-      "origin": "js-text-assign",
-      "confidence": "certain"
-    },
     {
       "id": "f75ee96a7511",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -2218,5 +2218,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.870 with no explicit bump. run 35393164740. (task 1002620)
   1.19.872 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.871 with no explicit bump. run 35419318693. (task 1002620)
+  1.19.873 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.872 with no explicit bump. run 35419621747. (task 1002620)
+  1.19.874 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.873 with no explicit bump. run 35419921833. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/private-npm-distribution.md

@@ -23,10 +23,11 @@ The generated typed client (`node scripts/gds/gen-api-client.js` → `clients/bo
 These involve payment and permanent, account-level actions. They are **not** done inside a build session.
 
 1. **Put the `bongos` npm org on a paid plan.** Private scoped publishing requires it. On npmjs.com → your org → Billing → upgrade to a plan that allows private packages (npm Teams, ~$7/member/month). Add as members only the people who need to publish or install during pre-launch — each is a billed seat.
-2. **Create an access token.** npm retired classic (Automation/Publish) tokens — use a **granular access token**: npmjs.com → Access Tokens → *Generate New Token* → **Granular Access Token**, scoped to the `@bongos` packages with **Read and write** permission, and — for a token that publishes — enable **"Bypass two-factor authentication"** (npm otherwise requires interactive 2FA at publish). A **Read-only** granular token is enough for machines that only install. Granular tokens **expire** (pick the longest expiry the policy allows and calendar the rotation — a silently expired token is a 404 on the private package, the same symptom as a missing one). Store it as an environment variable, never in a committed file:
-   ```sh
-   export NPM_TOKEN=<redacted>
-   ```
+2. **Register a trusted publisher — do NOT create a token.** The automatic lane publishes with **OIDC trusted publishing** ([ADR 0180](../adr/0180-dependency-intake-and-drift-policy.md) decision 4, [task 1003202](https://cloudbongos.com/builders#/task/1003202)): npmjs.com → the `@bongos/core` package → Settings → Trusted publisher → GitHub Actions, naming this repo and the workflow filename `publish.yml`. The runner mints a short-lived identity token per run; nothing long-lived exists to steal or rotate. **If the workflow is ever renamed, update the trusted-publisher entry in the same change** or every publish starts failing 403.
+
+   A **manual** `package-core.js --publish --live` still needs a human `npm login` (+ 2FA) on that machine — an interactive session, not a stored credential.
+
+   > **No install token, and none can be issued to any purpose.** `@bongos/core` is public ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md)), so nothing needs a credential to *read* it, and [`fcea51ca`](https://github.com/example-owner/cloud-bongos/commit/fcea51ca) deleted the auth plumbing that used to consume one. A read-only `NPM_TOKEN` in an environment here buys nothing and is one more thing to leak — which is exactly how it leaked: the value sat in the droplet's journal in cleartext for a week (blocker 1000118).
 
 ## Publish (the real, permanent step — owner)
 
@@ -54,7 +55,7 @@ npm publish ./clients/bongos-client               # real (publishConfig makes it
 
 ## Cutting a core release (the policy — [ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137)
 
-**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check, auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it (repo variable `PUBLISH_ON_MERGE=1` + secrets `NPM_TOKEN`, `RELEASE_PUSH_TOKEN`). A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
+**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check, auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
 
 The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):
 
@@ -71,35 +72,29 @@ The steps below remain as the **manual fallback** (lane disarmed, npm outage, or
 
 > **Automating this** (a tag-triggered CI publish) is deferred to the managed-fleet epic ([#1948](https://example.com/builders#/task/1948)); revisit when the manual step becomes a real bottleneck. See [ADR 0137](../adr/0137-upstream-publish-policy-manual-owner-gated.md) "When to revisit".
 
-## Install a private package (any consumer machine or instance)
-
-Add a one-line `.npmrc` (repo-root or `~/.npmrc`) that reads the token from the environment:
+## Install the core (any consumer machine or instance)
 
-```
-//registry.npmjs.org/:_authToken=<redacted>
+```sh
+npm install -g @bongos/core   # global → the `bongos` command, then `bongos init`
 ```
 
-Then, with `NPM_TOKEN` set in the environment:
+That is the whole step. No `.npmrc`, no token, no org membership — `@bongos/core` is public ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md)). Verify from a clean environment rather than trusting a logged-in shell, which would succeed either way:
 
 ```sh
-npm install -g @bongos/core   # global → the `bongos` command, then `bongos init`
+npm pack @bongos/core --userconfig /dev/null      # no credential is read at all
 ```
 
 (A project that calls the API vendors the generated client instead — it is not installable.)
 
-Without a valid token + org membership the install 404s — that is the private gate working.
-
-## Provisioning: registry pull vs vendored tarball (task 2090)
+> **This section used to say the opposite**, and the difference was invisible: a tokenless read of a *restricted* package returns a flat `E404`, indistinguishable from "no such package". That one ambiguity is what killed the nightly auto-upgrade sweep silently for three weeks, reporting `failed=0` the whole time — the sweep's unit passed no `NPM_TOKEN`, the env-fed `.npmrc` expanded to empty, and a skip is not a failure in that script's accounting. Do not reintroduce an install credential here.
 
-Provisioning defaults to installing the core from a **vendored tarball** committed into each instance repo (task 2053) — offline, needs no token, and stays the default/fallback until the registry path is proven on a real greenfield standup. The registry pull is **opt-in and fail-soft**:
+## Provisioning: how a new instance gets its core
 
-- **Turn it on** by setting `PROVISION_CORE_FROM_REGISTRY=1` in the control-plane runner's environment (e.g. `/etc/cloudbongos/box.env`) **and** providing a read-only `NPM_TOKEN` (a **granular access token** — Read-only on the `@bongos` packages — from the paid `bongos` org; mind its expiry). With both present, the standalone scaffold pins `@bongos/core@<version>` from the registry and writes an env-fed `.npmrc` (`_authToken=<redacted> instead of vendoring a tarball; `npm ci` then pulls the private package (the token is inherited from the runner env — never committed).
-- **Fail-soft**: if the flag is set but `NPM_TOKEN` is absent, provisioning logs a notice and **falls back to the vendored tarball**, so a tokenless standup still works.
-- **Directly**: `bongos init --registry-core` scaffolds the registry shape (caret pin + `.npmrc`; generates the lockfile when `NPM_TOKEN` is set). `bongos upgrade --to <v> --registry` bumps a consumer to a registry version. Both are mutually exclusive with the vendored `--vendor-core` / `--from` inputs.
+Provisioning vendors a **tarball** into each new instance repo, and the instance pins it as `file:vendor/bongos-core-<v>.tgz`. `resolveVendorTarball` in [`provision-repo.js`](../../scripts/gds/provision-repo.js) walks a ladder for the freshest correct one: reuse the control plane's own `file:`-pinned tarball → `npm pack` the control plane's registry-installed core ([ADR 0168](../adr/0168-scaffold-packs-installed-core.md)) → rebuild from source. A child is therefore born on the same core its parent is actually running.
 
-A tokenless registry `npm ci` 404s cleanly (`E404 … @bongos/core … could not be found or you do not have permission to access it`) — the expected pre-launch outcome.
+**There is no token in any of this, and no opt-in fork either.** An earlier design gated a registry pull behind `PROVISION_CORE_FROM_REGISTRY=1` plus a read-only `NPM_TOKEN`, fail-soft to vendoring when the credential was absent. [`fcea51ca`](https://github.com/example-owner/cloud-bongos/commit/fcea51ca) deleted that whole path along with `scripts/gds/npmrc.js`: two install modes diverging on an environment variable is a defect shape, and the credential they diverged on stopped being necessary the moment the package went public. `bongos init --registry-core` and the env-fed `.npmrc` it used to write are gone with it.
 
-> **Proven end-to-end (2026-07-08, task 2118 / blocker 71).** A real `bongos init --registry-core` scaffold, with a valid read-only token in `NPM_TOKEN`, resolved `@bongos/core@1.17.0` straight from `registry.npmjs.org` and generated a reproducible `package-lock.json`. Both legs are confirmed: the registry pull works with a token and fails closed (404) without one. Provisioning still defaults to the vendored tarball until an owner explicitly sets `PROVISION_CORE_FROM_REGISTRY=1` on a live runner.
+> **Vendoring is not a stale-by-design choice.** It is what keeps twenty co-tenant instances pinned to a local path with no registry channel to follow — going public was necessary to fix that, and is not sufficient ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md)). Moving a co-tenant forward is still the `package-core` → scp → `bongos upgrade` path.
 
 ## Going public — DONE 2026-09-13
 

package/modules/hall-ui/public/deploy.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Deploy — {{worldName}}</title>
-  <meta name="description" content="Move this instance onto a newer core and read back the version the box actually serves — the deploy gate, without a shell or an ssh key.">
+  <meta name="description" content="Move this platform or any project it hosts onto a newer core, and read back the version each box actually serves — the deploy gate, without a shell or an ssh key.">
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
@@ -38,8 +38,8 @@
                mean visible (ADR 0137's three gates); this page is the third one. -->
           <p class="scroll__lede">
             Merging work does not put it in front of anyone. This is the step that does:
-            it moves this instance onto a newer core, waits for the box to answer, and
-            puts itself back if it does not.
+            it moves this platform — or any project it hosts — onto a newer core, waits
+            for that box to answer, and puts it back if it does not.
           </p>
           <!-- One mount, written by deploy.js. Nothing here is authored as markup with
                a version in it: every number on this page is a reading the control plane
@@ -59,6 +59,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/deploy.js?v=2026-09-16-deploy1"></script>
+<script src="/builders/deploy.js?v=2026-09-18-deploy2"></script>
 </body>
 </html>

package/modules/hall-ui/public/deploy.js

@@ -1,25 +1,43 @@
-// deploy.js — the owner's deploy door (task 1003159, ADR 0293).
+// deploy.js — the owner's deploy door (task 1003159, ADR 0293; widened to the
+// hosted projects by task 1004046).
 //
 // WHAT THIS PAGE IS FOR. The owner, twice in a month: "I don't think I can make anything
-// live", then "this is above my paygrade." Moving this instance's core pin is gate 3 of
-// the release pipeline and the ONLY act that makes shipped work visible to users — and it
-// was reachable from exactly one place, a shell on the control-plane box holding an ssh
-// key. An agent could not close the loop either: the permission classifier blocks a
-// mutating `sudo -u lars` over ssh by design. So the one gate that is the owner's to hold
-// was the one gate with no instrument. This page is the instrument.
+// live", then "this is above my paygrade." Moving a core pin is gate 3 of the release
+// pipeline and the ONLY act that makes shipped work visible to users — and it was
+// reachable from exactly one place, a shell on the control-plane box holding an ssh key.
+// An agent could not close the loop either: the permission classifier blocks a mutating
+// `sudo -u lars` over ssh by design. So the one gate that is the owner's to hold was the
+// one gate with no instrument. This page is the instrument.
+//
+// WHY THE PROJECTS ARE HERE AND NOT IN THEIR OWN HALLS. The obvious shape — each owner
+// pressing Upgrade in their own project's hall — is not buildable: the upgrade route and
+// the intent queue belong to the PROVISIONING module, and a hosted project does not run
+// it. Probed 2026-09-18: /api/bongos/provisioning/health answers 200 here and 404 on
+// every tenant. The control plane is the only place that can act on them, so this is
+// where the button lives. Their own halls get the banner instead (task 1004045), which
+// each instance derives for itself from the registry and needs nothing from us.
+//
+// Nothing about the ENGINE had to change for this. UPGRADE_SHAPES already admitted
+// 'co-tenant' and 'standalone' alongside 'control-plane', coreUpgradeInstance already
+// resolved each shape's own checkout and built that box's own health and version URLs,
+// and the preview route already took any instance id. Only this page was single-row.
 //
 // THE RULE THAT SHAPES EVERY LINE HERE: this page KNOWS NOTHING. Every version on it is a
 // reading the control-plane runner took on the box, carried through the server with the
 // time it was taken. Nothing is computed here, no version is compared here, and "up to
 // date" is never inferred from an absence — the server says `behind` or it does not, and
 // a missing reading renders as a missing reading. A deploy control that guesses is worse
-// than none, because it is trusted.
+// than none, because it is trusted. That rule is now load-bearing for boxes the owner has
+// never logged into, which is the harder case, not the easier one.
 //
 // TWO STEPS, NEVER ONE (ADR 0293 D4). The owner asked for the confirmation. Auto-rollback
 // already guards the bad release; this guards the wrong button. Step one shows what would
 // move; step two names the version it saw and sends that. The confirm button is built
 // FROM the previewed version, so a release that lands between the two steps cannot
-// silently change what the press does.
+// silently change what the press does. With several boxes on one page the step is held
+// PER BOX, and each button's handler CLOSES OVER the preview object it was built from —
+// so the version sent is the one that box displayed, and a repaint cannot swap it. A
+// page-wide "currently previewing" would be a wrong-box press waiting to happen.
 (() => {
   'use strict';
 
@@ -29,10 +47,9 @@
   const toast = (msg) => window.OTB.toast(msg);
   const $ = (id) => document.getElementById(id);
 
-  // The preview the server last handed us. The confirm step reads its version from HERE
-  // rather than from the DOM, so what is sent is what was previewed even if a poll
-  // repaints between the two clicks.
-  let previewed = null;
+  // instance_id -> 'preview' | 'confirm'. Held per box so opening the confirm on one does
+  // not arm it on another.
+  const steps = new Map();
 
   async function fetchJson(path) {
     const res = await api.request('GET', `${API}${path}`);
@@ -74,7 +91,7 @@
     return v ? `<span class="ov-mono">${escapeHtml(String(v))}</span>` : '<span class="ps-pill ps-pill--absent">no reading</span>';
   }
 
-  // ---- the three states this page can be in --------------------------------
+  // ---- the states ONE box can be in ----------------------------------------
 
   // Something is already running. The press is not offered at all — offering a button
   // that the server will refuse with 'intent_conflict' is a worse experience than saying
@@ -92,69 +109,108 @@
       <p class="ov-row__sub">Core <strong>${escapeHtml(String(p.recommended_version))}</strong> is published and
         this box is not on it yet.</p>
       <div class="ps-controls">
-        <button type="button" class="btn" id="dp-preview">See what would change</button>
+        <button type="button" class="btn" id="dp-preview-${escapeHtml(String(p.instance_id))}">See what would change</button>
       </div>`;
   }
 
-  // Step two. The version is written into the button's own label and into `previewed`,
-  // so the owner confirms the thing they were shown rather than "the newest", which is a
-  // different act by the time it is resolved.
-  function stepTwoHtml(p) {
+  // Step two. The version is written into the button's own label, and the handler wired
+  // to that button closes over this same preview object — so the owner confirms the thing
+  // they were shown rather than "the newest", which is a different act by the time it is
+  // resolved.
+  function stepTwoHtml(p, isSelf) {
+    const id = escapeHtml(String(p.instance_id));
     return `
-      <div class="ps-controls" id="dp-confirm-wrap">
-        <p class="ov-row__sub">This restarts the platform onto core
+      <div class="ps-controls">
+        <p class="ov-row__sub">This restarts ${isSelf ? 'the platform' : escapeHtml(String(p.slug))} onto core
           <strong>${escapeHtml(String(p.recommended_version))}</strong>. It waits for the box to answer and
           puts itself back on ${escapeHtml(String(p.served_version))} if it does not.</p>
-        <button type="button" class="btn btn--primary" id="dp-confirm">Move to ${escapeHtml(String(p.recommended_version))}</button>
-        <button type="button" class="btn" id="dp-cancel">Cancel</button>
+        <button type="button" class="btn btn--primary" id="dp-confirm-${id}">Move to ${escapeHtml(String(p.recommended_version))}</button>
+        <button type="button" class="btn" id="dp-cancel-${id}">Cancel</button>
       </div>`;
   }
 
-  function panelHtml(p, step) {
-    const rows = [
-      `<li class="ov-row"><div class="ov-row__main">
-         <span class="ov-row__title">Serving now</span>
-         <p class="ov-row__sub">${versionHtml(p.served_version)} — read from the box itself, ${escapeHtml(ago(p.observed_at))}.</p>
-         ${p.reading === 'no_answer'
-           ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
-           : ''}
-       </div></li>`,
-    ];
-    let action = '';
+  // One box's card. `isSelf` only changes the words, never what is offered: the runner
+  // treats the platform's own row and a tenant's identically, and a page that implied
+  // otherwise would be describing a rule that does not exist.
+  function boxHtml(p, isSelf) {
+    const step = steps.get(p.instance_id) || 'preview';
+    let action;
     if (p.open_intent) action = busyHtml(p);
     else if (p.reading === 'no_answer') action = '';
     else if (!p.behind) action = `<p class="ov-row__sub">Nothing newer is published that this box can take. There is nothing to deploy.</p>`;
-    else action = step === 'confirm' ? stepTwoHtml(p) : stepOneHtml(p);
-    rows.push(`<li class="ov-row"><div class="ov-row__main">
-        <span class="ov-row__title">Make it live</span>
+    else action = step === 'confirm' ? stepTwoHtml(p, isSelf) : stepOneHtml(p);
+    return `
+      <li class="ov-row" id="dp-box-${escapeHtml(String(p.instance_id))}"><div class="ov-row__main">
+        <span class="ov-row__title">${escapeHtml(String(p.slug))}${isSelf ? ' — the box this platform runs on' : ''}</span>
+        <p class="ov-row__sub">Serving ${versionHtml(p.served_version)} — read from the box itself, ${escapeHtml(ago(p.observed_at))}.</p>
+        ${p.reading === 'no_answer'
+          ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
+          : ''}
         ${action}
-      </div></li>`);
-    return `<ul class="ov-lines">${rows.join('')}</ul>
-      <p class="ps-prov">reads the control plane's own observation · ADR 0293 · every move is recorded with who asked</p>`;
+      </div></li>`;
+  }
+
+  // A project whose preview could not be read at all. It is LISTED rather than dropped:
+  // a box silently missing from a deploy page reads as a box that does not need
+  // deploying, which is the one wrong impression this page must never give.
+  function unreadableHtml(inst, message) {
+    return `
+      <li class="ov-row"><div class="ov-row__main">
+        <span class="ov-row__title">${escapeHtml(String(inst.slug))}</span>
+        <p class="ps-invalid">Could not read this project's deploy state: ${escapeHtml(message)}</p>
+      </div></li>`;
   }
 
   // ---- wiring --------------------------------------------------------------
 
-  function render(p, step) {
-    previewed = p;
-    $('dp-panel').innerHTML = panelHtml(p, step);
-    const preview = $('dp-preview');
-    if (preview) preview.addEventListener('click', () => render(p, 'confirm'));
-    const cancel = $('dp-cancel');
-    if (cancel) cancel.addEventListener('click', () => render(p, 'preview'));
-    const confirm = $('dp-confirm');
+  function wire(p) {
+    const id = String(p.instance_id);
+    const preview = $(`dp-preview-${id}`);
+    if (preview) preview.addEventListener('click', () => { steps.set(p.instance_id, 'confirm'); repaint(); });
+    const cancel = $(`dp-cancel-${id}`);
+    if (cancel) cancel.addEventListener('click', () => { steps.set(p.instance_id, 'preview'); repaint(); });
+    const confirm = $(`dp-confirm-${id}`);
     if (confirm) confirm.addEventListener('click', () => move(p));
   }
 
+  // What the page is currently showing: the self row (or null), the readable project
+  // previews, and the ones that would not read. Held so a repaint after a click does not
+  // have to re-fetch everything.
+  let view = { self: null, boxes: [], unreadable: [], notEnrolled: null };
+
+  function repaint() {
+    const items = [];
+    if (view.self) items.push(boxHtml(view.self, true));
+    else if (view.notEnrolled) {
+      // The server's own sentence names the one command that fixes it, which is why it
+      // is shown rather than a generic failure line.
+      items.push(`<li class="ov-row"><div class="ov-row__main">
+        <span class="ov-row__title">This platform</span>
+        <p class="ps-invalid">${escapeHtml(view.notEnrolled)}</p>
+      </div></li>`);
+    }
+    for (const p of view.boxes) items.push(boxHtml(p, false));
+    for (const u of view.unreadable) items.push(unreadableHtml(u.inst, u.message));
+    if (!items.length) {
+      items.push(`<li class="ov-row"><div class="ov-row__main">
+        <p class="ov-row__sub">No running box to deploy.</p>
+      </div></li>`);
+    }
+    $('dp-panel').innerHTML = `<ul class="ov-lines">${items.join('')}</ul>
+      <p class="ps-prov">reads the control plane's own observation · ADR 0293 · every move is recorded with who asked</p>`;
+    if (view.self) wire(view.self);
+    for (const p of view.boxes) wire(p);
+  }
+
   async function move(p) {
-    const btn = $('dp-confirm');
+    const btn = $(`dp-confirm-${p.instance_id}`);
     if (btn) { btn.disabled = true; btn.textContent = 'Queueing…'; }
     try {
-      // `p.recommended_version` — the version this owner was SHOWN, not whatever is
-      // newest at the moment of the click.
+      // `p.recommended_version` — the version this owner was SHOWN for THIS box, not
+      // whatever is newest at the moment of the click.
       const r = await sendJson('POST', `/provisioning/instances/${p.instance_id}/core-upgrade`, { to: p.recommended_version });
       toast(r.message || 'Queued.');
-      await load();
+      await refreshOne(p);
     } catch (e) {
       if (e && e.kind === '401') return;
       toast(e.message || 'Could not queue the move.');
@@ -162,12 +218,90 @@
     }
   }
 
+  // Re-read ONLY the box that just changed. The full load() fans out one probe per
+  // hosted project, and firing all of them to refresh one row is cache invalidation
+  // far wider than the change — it also re-probes boxes the owner never touched. A
+  // failure here falls back to the full read, because a stale row on a deploy page is
+  // the one thing worse than an extra request.
+  async function refreshOne(p) {
+    const id = String(p.instance_id);
+    const isSelf = view.self && String(view.self.instance_id) === id;
+    try {
+      const d = await fetchJson(isSelf ? '/provisioning/control-plane' : `/provisioning/instances/${id}/core-upgrade`);
+      if (isSelf) view.self = d.preview;
+      else view.boxes = view.boxes.map((b) => (String(b.instance_id) === id ? d.preview : b));
+      steps.set(p.instance_id, 'preview');
+      repaint();
+    } catch (e) {
+      if (e && e.kind === '401') return;
+      await load();
+    }
+  }
+
+  // The projects this control plane hosts. `/provisioning/fleet` is the whole roster and
+  // needs its own atom; a holder of core.pin.move who lacks it still gets their OWN
+  // projects rather than an error, because the pin move itself is gated server-side per
+  // instance either way — this choice only decides what the page can LIST.
+  async function hostedProjects() {
+    try {
+      const d = await fetchJson('/provisioning/fleet');
+      return d.instances || [];
+    } catch (e) {
+      if (e && e.kind === '403') {
+        const d = await fetchJson('/provisioning/instances');
+        return d.instances || [];
+      }
+      throw e;
+    }
+  }
+
+  // Only a RUNNING box can have its pin moved, and the runner refuses every other shape.
+  // Filtering here keeps torn-down rows — there are far more of them than live ones — off
+  // a page whose whole job is naming what is live.
+  const UPGRADEABLE = new Set(['standalone', 'co-tenant']);
+  const isLive = (i) => i && i.status === 'active' && UPGRADEABLE.has(i.hosting_shape);
+
   async function load() {
     try {
-      const d = await fetchJson('/provisioning/control-plane');
-      $('dp-sub').textContent = `${d.preview.slug} — the box this platform runs on`;
+      let self = null;
+      let notEnrolled = null;
+      try {
+        const d = await fetchJson('/provisioning/control-plane');
+        self = d.preview;
+      } catch (e) {
+        if (e && e.kind === '401') return;
+        if (e && e.kind === '403') throw e;
+        notEnrolled = e.message || 'This platform has no deploy door yet.';
+      }
+
+      const live = (await hostedProjects()).filter(isLive);
+      // One preview per project, in parallel and INDEPENDENTLY: one project that cannot
+      // be read must not blank the page for the others. The request count scales with the
+      // fleet, which is deliberate and bounded — each is a cached server-side reading, not
+      // a live probe of the box, and this page exists precisely to show every box's state
+      // at once. It is re-read on OPEN only; a move refreshes just its own row.
+      const settled = await Promise.all(live.map(async (inst) => {
+        try {
+          const d = await fetchJson(`/provisioning/instances/${inst.id}/core-upgrade`);
+          return { ok: true, preview: d.preview };
+        } catch (e) {
+          if (e && e.kind === '401') return { ok: false, inst, message: 'not signed in' };
+          return { ok: false, inst, message: (e && e.message) || 'unknown error' };
+        }
+      }));
+
+      view = {
+        self,
+        notEnrolled,
+        boxes: settled.filter((s) => s.ok).map((s) => s.preview),
+        unreadable: settled.filter((s) => !s.ok).map((s) => ({ inst: s.inst, message: s.message })),
+      };
+      const n = view.boxes.length + view.unreadable.length;
+      $('dp-sub').textContent = n
+        ? `This platform and ${n} hosted project${n === 1 ? '' : 's'}`
+        : 'This platform';
       $('dp-body').hidden = false;
-      render(d.preview, 'preview');
+      repaint();
     } catch (e) {
       if (e && e.kind === '401') return;
       if (e && e.kind === '403') {
@@ -175,9 +309,6 @@
         $('dp-sub').textContent = 'Restricted';
         return;
       }
-      // Including 'control_plane_not_enrolled', whose message names the one command
-      // that fixes it — which is why the server's sentence is shown rather than a
-      // generic failure line.
       $('dp-body').hidden = false;
       $('dp-sub').textContent = 'Unavailable';
       $('dp-panel').innerHTML = `<p class="ps-invalid">${escapeHtml(e.message || 'Could not read the deploy state.')}</p>`;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.872",
+  "version": "1.19.874",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.872",
+      "version": "1.19.874",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.872",
+  "version": "1.19.874",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-repo.js

@@ -374,8 +374,10 @@ function installedCoreTarball({ instanceRoot, fsImpl = fs } = {}) {
 // abort of task 1002275, resurrected by the cutover). The installed package itself is
 // still the exact core this hub runs: return its node_modules dir + version + the
 // `npm pack` tarball name so the scaffold can pack it into a vendorable .tgz. The child
-// stays file:-pinned — its owner needs no npm token (the registry package is PRIVATE
-// until the ADR 0134 go-public step). Returns { dir, version, tarballName } or null
+// stays file:-pinned — its owner needs no npm token. (That was originally because the
+// registry package was PRIVATE; since ADR 0283 it is public and a token would buy
+// nothing either way. The file: pin is kept for the reason in ADR 0168 — a child is born
+// on the core its parent actually runs — not for access control.) Returns { dir, version, tarballName } or null
 // (a file: pin, an uninstalled dep, or a source checkout). fs reads only → dry-run safe.
 function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
   const root = instanceRoot || process.env.BONGOS_INSTANCE_ROOT || process.cwd();

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.872'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.874'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/deploy_page_projects.mjs

@@ -0,0 +1,193 @@
+// tests/deploy_page_projects.mjs — the deploy page now drives every hosted project,
+// not only the control plane's own row (task 1004046).
+//
+// These EXECUTE deploy.js in a DOM stub and read what it painted. The sibling suite
+// (core_upgrade_door.mjs) asserts the page's invariants against its SOURCE, which is
+// right for "never computes a version comparison" but cannot see the thing that broke
+// when this page went multi-box: whether a click on one box arms that box and not
+// another. That is behaviour, so it is tested as behaviour.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deploy.js'), 'utf8');
+
+const preview = (id, slug, over = {}) => ({
+  instance_id: id, slug, hosting_shape: 'standalone',
+  served_version: '1.19.800', recommended_version: '1.19.871',
+  behind: true, reading: 'ok', observed_at: new Date().toISOString(), open_intent: null,
+  ...over,
+});
+
+// The fleet as the control plane really reports it: mostly torn down, a couple live.
+const FLEET = [
+  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'standalone' },
+  { id: '32', slug: 'hoodify-finance', status: 'active', hosting_shape: 'co-tenant' },
+  { id: '33', slug: 'walk-lantern', status: 'torn_down', hosting_shape: 'standalone' },
+  { id: '34', slug: 'testccc', status: 'torn_down', hosting_shape: 'standalone' },
+  { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'standalone' },
+];
+
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200 } = {}) {
+  const els = new Map();
+  const posts = [];
+  const gets = [];
+  const makeEl = () => ({
+    _on: {}, _html: '', hidden: false, textContent: '', disabled: false,
+    addEventListener(ev, fn) { this._on[ev] = fn; },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const documentObj = {
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    addEventListener(ev, fn) { if (ev === 'DOMContentLoaded') this._ready = fn; },
+  };
+  const request = async (method, url, opts) => {
+    const p = url.replace('/api/bongos', '');
+    if (method === 'GET') gets.push(p);
+    if (method === 'POST') { posts.push({ path: p, body: opts && opts.body }); return { ok: true, status: 200, data: { message: 'Queued.' } }; }
+    if (p === '/provisioning/control-plane') {
+      if (controlPlaneStatus !== 200) {
+        return { ok: false, status: controlPlaneStatus, data: { error: { code: 'control_plane_not_enrolled', message: 'This platform has no deploy door yet. Run enroll-control-plane.js once.' } } };
+      }
+      return { ok: true, status: 200, data: { preview: controlPlane } };
+    }
+    if (p === '/provisioning/fleet') {
+      if (fleetStatus !== 200) return { ok: false, status: fleetStatus, data: { error: { code: 'forbidden' } } };
+      return { ok: true, status: 200, data: { instances: fleet } };
+    }
+    if (p === '/provisioning/instances') return { ok: true, status: 200, data: { instances: fleet } };
+    const m = /^\/provisioning\/instances\/(\w+)\/core-upgrade$/.exec(p);
+    if (m) {
+      const inst = fleet.find((f) => f.id === m[1]);
+      if (!inst || inst.slug === 'unreadable-one') {
+        return { ok: false, status: 500, data: { error: { code: 'core_upgrade_preview_failed', message: 'internal error' } } };
+      }
+      return { ok: true, status: 200, data: { preview: preview(inst.id, inst.slug, { hosting_shape: inst.hosting_shape }) } };
+    }
+    return { ok: false, status: 404, data: { error: { code: 'not_found' } } };
+  };
+  const windowObj = {
+    BongosClient: { createClient: () => ({ request }) },
+    OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast() {} },
+    location: { assign() {} },
+  };
+  const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
+  documentObj._ready();
+  const settle = async () => { for (let i = 0; i < 12; i++) await new Promise((r) => setTimeout(r, 0)); };
+  return { els, posts, gets, settle, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
+}
+
+test('the platform AND every live hosted project get a row', async () => {
+  const b = boot();
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /cloudbongos/, 'the platform is still here');
+  assert.match(html, /mercury/, 'a standalone project');
+  assert.match(html, /hoodify-finance/, 'a co-tenant project');
+  assert.match(b.sub(), /3 hosted projects/);
+});
+
+test('torn-down projects never appear — the page is about what is live', async () => {
+  const b = boot();
+  await b.settle();
+  const html = b.panel();
+  assert.doesNotMatch(html, /walk-lantern/);
+  assert.doesNotMatch(html, /testccc/);
+});
+
+test('a project whose state cannot be read is LISTED, not silently dropped', async () => {
+  // A box missing from a deploy page reads as a box that needs no deploying.
+  const b = boot();
+  await b.settle();
+  assert.match(b.panel(), /unreadable-one/);
+  assert.match(b.panel(), /Could not read this project/);
+});
+
+test('opening the confirm on one project does not arm another', async () => {
+  const b = boot();
+  await b.settle();
+  b.els.get('dp-preview-31')._on.click();
+  const html = b.panel();
+  assert.match(html, /id="dp-confirm-31"/, 'mercury is armed');
+  assert.doesNotMatch(html, /id="dp-confirm-32"/, 'hoodify-finance is NOT');
+  assert.match(html, /id="dp-preview-32"/, 'and is still at step one');
+});
+
+test('confirming sends THAT project’s id and the version it was shown', async () => {
+  const b = boot();
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  assert.equal(b.posts.length, 1);
+  assert.equal(b.posts[0].path, '/provisioning/instances/32/core-upgrade');
+  // Field-wise, not deepEqual: the body is built inside the vm realm, so its
+  // prototype is not this realm's Object and deepStrictEqual rejects it on identity
+  // alone — a harness artifact that says nothing about the payload.
+  assert.equal(b.posts[0].body.to, '1.19.871');
+  assert.deepEqual(Object.keys(b.posts[0].body), ['to'], 'and nothing else is sent');
+});
+
+test('a box with nothing newer offers no button', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { behind: false, recommended_version: null }) });
+  await b.settle();
+  assert.match(b.panel(), /There is nothing to deploy/);
+});
+
+test('a box that did not answer is never rendered as up to date', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { reading: 'no_answer', served_version: null, behind: false }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /unknown rather than unchanged/);
+  assert.doesNotMatch(html, /id="dp-preview-1"/, 'and is offered no move');
+});
+
+test('an unenrolled control plane still lets the projects through', async () => {
+  // The regression this pins: the platform's own missing row used to be the whole
+  // page, so one un-run setup command would hide every project too.
+  const b = boot({ controlPlaneStatus: 404 });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /has no deploy door yet/, 'the server’s own sentence, naming the fix');
+  assert.match(html, /mercury/, 'and the projects are still listed');
+});
+
+test('a viewer without the fleet atom falls back to their own projects', async () => {
+  const b = boot({ fleetStatus: 403 });
+  await b.settle();
+  assert.match(b.panel(), /mercury/);
+});
+
+test('a move re-reads ONLY the box it moved, not every project again', async () => {
+  // The grader's finding on the first round: refreshing one row by re-running the
+  // whole page load fans a probe out at every hosted project, including ones the
+  // owner never touched.
+  const b = boot();
+  await b.settle();
+  b.gets.length = 0;
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  const previewReads = b.gets.filter((g) => g.endsWith('/core-upgrade'));
+  assert.deepEqual(previewReads, ['/provisioning/instances/32/core-upgrade'],
+    'exactly one preview re-read, and it is the moved box');
+  assert.ok(!b.gets.includes('/provisioning/fleet'), 'the fleet is not re-listed');
+});
+
+test('a move on the platform row re-reads the control plane, not a tenant preview', async () => {
+  const b = boot();
+  await b.settle();
+  b.gets.length = 0;
+  b.els.get('dp-preview-1')._on.click();
+  b.els.get('dp-confirm-1')._on.click();
+  await b.settle();
+  assert.ok(b.gets.includes('/provisioning/control-plane'), 'the self row is read from its own endpoint');
+  assert.ok(!b.gets.some((g) => /instances\/3\d\/core-upgrade/.test(g)), 'and no tenant is re-probed');
+});

package/tests/package_core.mjs

@@ -419,6 +419,37 @@ t('the publish workflow publishes PUBLIC, matching publishArgs', () => {
   );
 });
 
+// THE CREDENTIAL, NOT THE CALLER (task 1003262). Migrating the lane to OIDC is only half
+// of "delete NPM_TOKEN" — the half a future edit can quietly undo. If either token env is
+// ever SET here, npm takes the legacy path and never attempts the OIDC exchange, so the
+// migration would read as done while depending on a long-lived secret again. Asserted on
+// ASSIGNMENTS, not on the string: the workflow names NPM_TOKEN three times on purpose, in
+// comments that say there deliberately is none, and a naive grep would forbid saying so.
+t('the publish lane sets no long-lived npm credential (OIDC only)', () => {
+  const yml = readFileSync(new URL('../.github/workflows/publish.yml', import.meta.url), 'utf8');
+  const uncommented = yml
+    .split('\n')
+    .filter((line) => !/^\s*#/.test(line))
+    .join('\n');
+
+  for (const name of ['NPM_TOKEN', 'NODE_AUTH_TOKEN']) {
+    assert.ok(
+      !new RegExp(`^\\s*${name}\\s*:`, 'm').test(uncommented),
+      `${name} must never be assigned in publish.yml — setting it sends npm down the legacy `
+        + 'token path and silently skips the OIDC exchange (ADR 0180 decision 4)',
+    );
+  }
+  assert.ok(
+    !/_authToken/.test(uncommented),
+    'no .npmrc auth line may reappear in the lane',
+  );
+  assert.ok(
+    /id-token:\s*write/.test(uncommented),
+    'publish.yml must request id-token: write — without it the runner mints no OIDC token '
+      + 'and npm publishes unauthenticated, failing with a misleading 404',
+  );
+});
+
 t('buildPackageJson: omits `overrides` when the source has none', () => {
   const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   assert.equal(pkg.overrides, undefined);