@bongos/core 1.19.922 → 1.19.924

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1832,
-    "unique_ids": 1589,
-    "certain": 1832,
+    "strings": 1839,
+    "unique_ids": 1596,
+    "certain": 1839,
     "heuristic": 0,
     "duplicate_ids": 166
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 84,
-      "strings": 1342
+      "strings": 1349
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -1011,8 +1011,8 @@
       "text": "Move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:122",
-        "modules/hall-ui/public/deploy.js:217"
+        "modules/hall-ui/public/deploy.js:218",
+        "modules/hall-ui/public/deploy.js:314"
       ]
     },
     {
@@ -1840,6 +1840,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "af615fa9f404",
+      "surface": "builders-hall",
+      "text": "(checked {…})",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 152,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "544794f1ec8f",
       "surface": "builders-hall",
@@ -3154,6 +3163,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "f66f5cdaa732",
+      "surface": "builders-hall",
+      "text": "Checked against {…} — nothing blocks this move.{…}",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 155,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "f8725cf3ba62",
       "surface": "builders-hall",
@@ -3172,6 +3190,15 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
+    {
+      "id": "69da40d030b0",
+      "surface": "builders-hall",
+      "text": "Checking what this would do…",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 145,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "aa3ba7d28a76",
       "surface": "builders-hall",
@@ -3942,7 +3969,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 157,
+      "line": 254,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6588,7 +6615,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 122,
+      "line": 218,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6597,7 +6624,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 217,
+      "line": 314,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6921,7 +6948,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 195,
+      "line": 292,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7033,6 +7060,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "428a62539050",
+      "surface": "builders-hall",
+      "text": "Not checked yet — the runner takes this reading on its own tick.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 150,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "c72e0bdb834a",
       "surface": "builders-hall",
@@ -7200,7 +7236,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 140,
+      "line": 237,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8775,7 +8811,7 @@
       "surface": "builders-hall",
       "text": "See what would change",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 108,
+      "line": 121,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8847,7 +8883,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 142,
+      "line": 239,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10120,6 +10156,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "8c991355687d",
+      "surface": "builders-hall",
+      "text": "The upgrade checked {…} and refused:{…}",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 160,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "a42a37c43bfb",
       "surface": "builders-hall",
@@ -10431,7 +10476,7 @@
       "surface": "builders-hall",
       "text": "This platform",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 187,
+      "line": 284,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10440,7 +10485,7 @@
       "surface": "builders-hall",
       "text": "This restarts {…} onto core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 122,
+      "line": 218,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10480,6 +10525,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "4301ecd67891",
+      "surface": "builders-hall",
+      "text": "This would fail.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 160,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "2ad5823d2cd7",
       "surface": "builders-hall",
@@ -11173,6 +11227,15 @@
       "origin": "js-notice",
       "confidence": "certain"
     },
+    {
+      "id": "921cb15a8188",
+      "surface": "builders-hall",
+      "text": "You can still press Move — the runner will refuse it the same way, and the box is left where it is.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 160,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "b31fc908c962",
       "surface": "builders-hall",
@@ -12168,7 +12231,7 @@
       "surface": "builders-hall",
       "text": "is published and this box is not on it yet.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 108,
+      "line": 121,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12303,7 +12366,7 @@
       "surface": "builders-hall",
       "text": "no reading",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 91,
+      "line": 104,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12555,7 +12618,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 199,
+      "line": 296,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2318,5 +2318,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.920 with no explicit bump. run 35534076467. (task 1002620)
   1.19.922 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.921 with no explicit bump. run 35536293721. (task 1002620)
+  1.19.923 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.922 with no explicit bump. run 35541278656. (task 1002620)
+  1.19.924 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.923 with no explicit bump. run 35541674047. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/economy/reward.js

@@ -21,6 +21,7 @@ const cost = require('./cost');
 const streak = require('./streak');
 const ideaSizeLib = require('./idea-size');
 const ideaSizeHistorical = require('./idea-size-historical');
+const ideaBrightnessLib = require('./idea-brightness');
 
 module.exports = {
   // credit allocation — transaction-participant: caller passes its tx `client`
@@ -110,6 +111,16 @@ module.exports = {
   // projection and quietly drops a field the pricing needs.
   descentRowsFromTrail: (...a) => ideaSizeHistorical.descentRowsFromTrail(...a),
   get IDEA_SIZE_SCALE_REF() { return ideaSizeLib.IDEA_SIZE_SCALE_REF; },
+  // BRIGHTNESS — the live share of that descent (task 1004099 / BV2.R16), on the
+  // port for the same reason size is. It is the SECOND of the two channels, and
+  // the pair is what BV2.R17 resolves the five states from: a thought that
+  // earned nothing (`hasWork: false`) and one whose work was all torn out
+  // (`share: 0`) are different objects in the sky, and only a caller holding
+  // BOTH fields can tell them apart. Shipping size without this left the ideas
+  // module able to draw how big a thought was and unable to say whether it was
+  // still alive.
+  ideaBrightness: (...a) => ideaBrightnessLib.ideaBrightness(...a),
+  ideaBrightnesses: (...a) => ideaBrightnessLib.ideaBrightnesses(...a),
   computeStreak: (...a) => streak.computeStreak(...a),
   wouldExtendStreak: (...a) => streak.wouldExtendStreak(...a),
 };

package/modules/hall-ui/public/deploy.html

@@ -59,6 +59,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/deploy.js?v=2026-09-18-deploy2"></script>
+<script src="/builders/deploy.js?v=2026-09-20-preflight2"></script>
 </body>
 </html>

package/modules/hall-ui/public/deploy.js

@@ -50,6 +50,19 @@
   // instance_id -> 'preview' | 'confirm'. Held per box so opening the confirm on one does
   // not arm it on another.
   const steps = new Map();
+  // Rows whose dry run is in flight — per box, like `steps`, because a page-wide flag
+  // would spin every other project's row on one project's check.
+  const checking = new Set();
+  // How long the page waits for the runner to answer. Read off `window` when present so
+  // a harness can drive the loop without sleeping through it — a test that injects the
+  // real timer spends 30s of wall-clock per non-converging case and keeps repainting a
+  // sandbox that has already been torn down.
+  // `|| 2000` would be a bug here: an override of 0 — the one a harness wants — is
+  // falsy, so the fallback would swallow it and the test would sleep the full interval
+  // anyway while appearing to be driven.
+  const num = (v, dflt) => (Number.isFinite(v) ? v : dflt);
+  const POLL_MS = typeof window !== 'undefined' ? num(window.__deployPollMs, 2000) : 2000;
+  const POLL_TRIES = typeof window !== 'undefined' ? num(window.__deployPollTries, 15) : 15;
 
   async function fetchJson(path) {
     const res = await api.request('GET', `${API}${path}`);
@@ -117,10 +130,94 @@
   // to that button closes over this same preview object — so the owner confirms the thing
   // they were shown rather than "the newest", which is a different act by the time it is
   // resolved.
+  // What the dry run said, from the runner's own tick (task 1004121). Before this, step
+  // one made NO network call — it redrew a fixed sentence and called that a preview. The
+  // owner pressed it four times on 2026-09-20, restarted four live boxes, and learned
+  // three different pre-flight refusals one production restart at a time. Every one of
+  // them was in this verdict already.
+  //
+  // A REFUSAL DOES NOT DISABLE THE BUTTON. The runner refuses on its own, and this
+  // reading can be minutes old; a control that blocked on a stale ✖ would be lying in
+  // the other direction. Say what will happen and let the owner decide.
+  function preflightHtml(p) {
+    const pf = p.preflight;
+    if (checking.has(String(p.instance_id)) && !(pf && pf.target === p.recommended_version)) {
+      return `<p class="ov-row__sub dp-preflight dp-preflight--checking">Checking what this would do…</p>`;
+    }
+    // No verdict is its own state, and it is NOT "fine". A silent gap here is how the
+    // page used to promise a preview it never performed.
+    if (!pf) {
+      return `<p class="ov-row__sub dp-preflight dp-preflight--none">Not checked yet — the runner takes this reading on its own tick.</p>`;
+    }
+    const when = pf && p.preflight_at ? ` <span class="dp-preflight__age">(checked ${escapeHtml(ago(p.preflight_at))})</span>` : '';
+    if (pf.ok) {
+      const lines = (pf.lines || []).map((l) => `<li>${escapeHtml(String(l))}</li>`).join('');
+      return `<div class="dp-preflight dp-preflight--ok">
+          <p class="ov-row__sub">Checked against ${escapeHtml(String(pf.target))} — nothing blocks this move.${when}</p>
+          ${lines ? `<ul class="dp-preflight__list">${lines}</ul>` : ''}
+        </div>`;
+    }
+    return `<div class="dp-preflight dp-preflight--blocked">
+        <p class="ov-row__sub"><strong>This would fail.</strong> The upgrade checked ${escapeHtml(String(pf.target))} and refused:${when}</p>
+        <pre class="dp-preflight__error">${escapeHtml(String(pf.error || 'no reason given'))}</pre>
+        <p class="ov-row__sub">You can still press Move — the runner will refuse it the same way, and the box is left where it is.</p>
+      </div>`;
+  }
+
+  // Arming ASKS for the check (task 1004121). The web tier has no shell — it queues the
+  // dry run as an intent and the runner answers, which is the same division of labour as
+  // every other fact on this page. Then it re-reads the preview until the verdict lands.
+  //
+  // Only when there isn't already a fresh one: a verdict for THIS target is the answer,
+  // and re-asking would spend a subprocess to reprint it.
+  const asked = new Set();
+  async function askPreflight(p) {
+    const id = String(p.instance_id);
+    if (p.preflight && p.preflight.target === p.recommended_version) return;
+    if (asked.has(id)) return;
+    asked.add(id);
+    checking.add(id);
+    repaint();
+    try {
+      await sendJson('POST', `/provisioning/instances/${id}/core-upgrade`, {
+        to: p.recommended_version, dry_run: true,
+      });
+    } catch (e) {
+      if (e && e.kind === '401') return;
+      // A refused REQUEST is not a refused upgrade, and must not be painted as one:
+      // fall back to "not checked", which is honest about what is known.
+      checking.delete(id); asked.delete(id); repaint();
+      return;
+    }
+    // The runner drains on its own tick, so this waits rather than assuming. Bounded:
+    // a check that never lands leaves the row saying it was never checked, which is
+    // true, instead of spinning for ever.
+    //
+    // AND IT STOPS WHEN NOBODY IS LOOKING. The loop is started from a click and not
+    // awaited by it, so without this it outlives whatever closed the row — cancelling,
+    // confirming, or a reload — and goes on repainting a step the owner has left. It
+    // also made every test that never converges sit through the full ~30s in real time.
+    for (let i = 0; i < POLL_TRIES; i++) {
+      await new Promise((r) => setTimeout(r, POLL_MS));
+      if (steps.get(p.instance_id) !== 'confirm') break;   // the row was closed; stop.
+      try {
+        await refreshOne(p, { keepStep: true });
+        const now = (view.self && String(view.self.instance_id) === id)
+          ? view.self
+          : view.boxes.find((b) => String(b.instance_id) === id);
+        if (now && now.preflight && now.preflight.target === now.recommended_version) break;
+      } catch (e) { break; }
+    }
+    checking.delete(id);
+    asked.delete(id);
+    repaint();
+  }
+
   function stepTwoHtml(p, isSelf) {
     const id = escapeHtml(String(p.instance_id));
     return `
       <div class="ps-controls">
+        ${preflightHtml(p)}
         <p class="ov-row__sub">This restarts ${isSelf ? 'the platform' : escapeHtml(String(p.slug))} onto core
           <strong>${escapeHtml(String(p.recommended_version))}</strong>. It waits for the box to answer and
           puts itself back on ${escapeHtml(String(p.served_version))} if it does not.</p>
@@ -166,7 +263,7 @@
   function wire(p) {
     const id = String(p.instance_id);
     const preview = $(`dp-preview-${id}`);
-    if (preview) preview.addEventListener('click', () => { steps.set(p.instance_id, 'confirm'); repaint(); });
+    if (preview) preview.addEventListener('click', () => { steps.set(p.instance_id, 'confirm'); repaint(); askPreflight(p); });
     const cancel = $(`dp-cancel-${id}`);
     if (cancel) cancel.addEventListener('click', () => { steps.set(p.instance_id, 'preview'); repaint(); });
     const confirm = $(`dp-confirm-${id}`);
@@ -223,14 +320,17 @@
   // far wider than the change — it also re-probes boxes the owner never touched. A
   // failure here falls back to the full read, because a stale row on a deploy page is
   // the one thing worse than an extra request.
-  async function refreshOne(p) {
+  // `keepStep` is for the pre-flight poll (task 1004121): a refresh AFTER a move should
+  // return the row to step one, but a refresh DURING the wait must not — it would close
+  // the panel the owner is reading, under them, every two seconds.
+  async function refreshOne(p, { keepStep = false } = {}) {
     const id = String(p.instance_id);
     const isSelf = view.self && String(view.self.instance_id) === id;
     try {
       const d = await fetchJson(isSelf ? '/provisioning/control-plane' : `/provisioning/instances/${id}/core-upgrade`);
       if (isSelf) view.self = d.preview;
       else view.boxes = view.boxes.map((b) => (String(b.instance_id) === id ? d.preview : b));
-      steps.set(p.instance_id, 'preview');
+      if (!keepStep) steps.set(p.instance_id, 'preview');
       repaint();
     } catch (e) {
       if (e && e.kind === '401') return;

package/modules/hall-ui/public/project-settings.css

@@ -88,3 +88,42 @@
   color: var(--ink-soft);
 }
 .ps-sibling strong { color: inherit; font-weight: 600; }
+
+/* The deploy control's pre-flight verdict (task 1004121) — what the upgrade says it
+   would do, taken by the runner's dry run. Three states, and "not checked" is one of
+   them: the page used to show a confident sentence where it had performed no check at
+   all, so silence here must look like silence, not like a pass. */
+.dp-preflight { margin: 0 0 0.6rem; }
+.dp-preflight--none,
+.dp-preflight--checking { color: var(--ink-soft); font-style: italic; }
+/* The pass state earns a mark of its own. Without one, "nothing blocks this" and "not
+   checked" differ only in wording, and the three-state legibility this file claims is
+   two states and a sentence. */
+.dp-preflight--ok {
+  border-left: 3px solid var(--ok);
+  padding-left: 0.7rem;
+}
+.dp-preflight__age { color: var(--ink-soft); font-weight: normal; }
+.dp-preflight__list {
+  margin: 0.25rem 0 0;
+  padding-left: 1.1rem;
+  color: var(--ink-soft);
+  font-size: 0.86rem;
+  line-height: 1.5;
+}
+.dp-preflight--blocked {
+  border-left: 3px solid var(--danger);
+  padding-left: 0.7rem;
+}
+/* The refusal is upgrade.js's own words, multi-line and already indented to name the
+   fix — preserved rather than reflowed, because the wording IS the instruction. */
+.dp-preflight__error {
+  margin: 0.35rem 0;
+  padding: 0.5rem 0.6rem;
+  background: var(--surface-2);
+  border-radius: 6px;
+  font-size: 0.82rem;
+  line-height: 1.45;
+  white-space: pre-wrap;
+  overflow-x: auto;
+}