@bongos/core 1.19.923 → 1.19.925

package/scripts/gds/provision-repo.js

@@ -91,6 +91,31 @@ const CORE_PKG_DIR = 'node_modules/@bongos/core';
 // one constant so the backup dir owner + the backup unit's User= can't drift from it.
 const APP_USER = 'lars';
 function standaloneRoot(inst, { base = CONFIG.standaloneBase } = {}) { return path.posix.join(base, inst.slug); }
+// WHERE THE INSTANCE THIS CORE SERVES ACTUALLY LIVES (task 1004123).
+//
+// REPO_ROOT is `path.resolve(__dirname, '..', '..')` — it points at whatever copy of
+// the core is EXECUTING, which is not the same place as the instance being upgraded.
+// Two shapes, and the code had only ever met the first:
+//
+//   • a core CHECKOUT run in place (`/home/lars/cloudbongos`) — the instance root IS
+//     the checkout, so REPO_ROOT was right by coincidence;
+//   • a VENDORED core (`<instance>/node_modules/@bongos/core`) — REPO_ROOT is the
+//     package, and the instance is three directories up.
+//
+// The live control plane became the second shape when its runner unit was re-homed
+// (`WorkingDirectory=/home/lars/cloudbongos-instance`, ExecStart into the vendored
+// core), and nothing noticed: REPO_ROOT still resolved, just to the wrong tree. So
+// `readInstalledCoreVersion` answered null instead of 1.19.917, every guard that
+// reads `installed` silently stopped guarding, and an upgrade would have pinned and
+// npm-installed INSIDE the core package while the instance's own pin stayed put.
+//
+// This is a string question, not a filesystem one: the vendored layout is the only
+// way a core ends up under `node_modules/`, so the suffix IS the answer. Keeping it
+// pure means the control-plane path is testable without a box.
+function selfInstanceRoot(repoRoot = REPO_ROOT) {
+  const suffix = path.sep + CORE_PKG_DIR.split('/').join(path.sep);
+  return repoRoot.endsWith(suffix) ? repoRoot.slice(0, -suffix.length) : repoRoot;
+}
 // Sync the instance's own repo (host content + the core pin). Mirrors deploy-instance.sh
 // step 1 — assumes the repo is already cloned at standaloneRoot (initial clone is a
 // precondition, like the runbook's `git pull`). Run with cwd = standaloneRoot.
@@ -1107,6 +1132,7 @@ module.exports = {
   safeVersionLabel,
   scaffoldStandaloneRepo,
   seedFirstVersionCmd,
+  selfInstanceRoot,
   standaloneInstallCmd,
   standaloneMigrateCmd,
   standalonePullCmd,

package/scripts/gds/provision.js

@@ -58,7 +58,7 @@ const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.
 const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
 const { disconnectInstance } = require('./provision-disconnect.js');
-const { coreUpgradeInstance, snapshotAllCoreVersions } = require('./provision-core-upgrade.js'); // the owner's deploy door, ADR 0293
+const { coreUpgradeInstance, preflightCoreUpgrade, snapshotAllCoreVersions } = require('./provision-core-upgrade.js'); // the owner's deploy door, ADR 0293
 
 // WHAT supervises an instance's service (ADR 0306). systemd on every box we run — the
 // seam exists so a plane without systemd is not a dead end. Injectable for tests.
@@ -1288,6 +1288,7 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'restart') result = await restartInstance(inst, deps);
       else if (intent.action === 'disconnect') result = await disconnectInstance(inst, deps);
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
+      else if (intent.action === 'core-upgrade-preflight') result = await preflightCoreUpgrade(inst, deps, intent); // changes nothing; caches what the move WOULD say (task 1004121)
       else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
         if (intent.attempts >= MAX_INTENT_ATTEMPTS) {

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.923'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.925'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -15,7 +15,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
@@ -52,10 +52,24 @@ await t('the shape and the action both reach the DB constraints', () => {
   // The JS list and the CHECK are two spellings of one vocabulary; a widening that
   // lands in only one of them fails at insert time, in production, on the first
   // real use. (The bug class task 1003913 shipped a fix for, in another file.)
-  const mig = read('modules', 'provisioning', 'migrations', 'provisioning_018_core_upgrade_intent.sql')
+  // Read the NEWEST migration that widens the action CHECK, not a fixed filename: the
+  // vocabulary grows, and a test pinned to one file passes forever while the constraint
+  // it is meant to guard falls behind (task 1004121 added an action 018 does not carry).
+  const migDir = join(__dirname, '..', 'modules', 'provisioning', 'migrations');
+  const widenings = readdirSync(migDir).filter((f) => f.endsWith('.sql'))
+    .filter((f) => /ADD CONSTRAINT provisioning_intents_action_check/.test(readFileSync(join(migDir, f), 'utf8')))
+    .sort();
+  assert.ok(widenings.length, 'some migration defines the action CHECK');
+  const mig = readFileSync(join(migDir, widenings[widenings.length - 1]), 'utf8')
+    .replace(/^\s*--.*$/gm, ' ').replace(/\s+/g, ' ');
+  const shapes = read('modules', 'provisioning', 'migrations', 'provisioning_018_core_upgrade_intent.sql')
     .replace(/^\s*--.*$/gm, ' ').replace(/\s+/g, ' ');
-  assert.match(mig, /CHECK \(action IN \([^)]*'core-upgrade'\)\)/, 'the intents CHECK admits the new action');
-  assert.match(mig, /CHECK \(hosting_shape IN \([^)]*'control-plane'\)\)/, 'the instances CHECK admits the new shape');
+  // Membership, not POSITION. The old spelling required 'core-upgrade' to be the last
+  // item before the closing paren, so the next action appended after it failed a test
+  // that had nothing to say about the next action.
+  assert.match(mig, /CHECK \(action IN \(/, 'the intents CHECK is an action allow-list');
+  assert.ok(mig.includes("'core-upgrade'"), 'and it still admits the move itself');
+  assert.match(shapes, /CHECK \(hosting_shape IN \([^)]*'control-plane'\)\)/, 'the instances CHECK admits the new shape');
   for (const a of P.INTENT_ACTIONS) {
     assert.ok(mig.includes(`'${a}'`), `the widened CHECK must still carry '${a}' — a rewrite drops what it forgets`);
   }
@@ -404,5 +418,43 @@ await t('THE DEPLOY PAGE NEVER COMPUTES A VERSION COMPARISON — every number on
   assert.match(js, /p\.behind/, 'and asks the server whether there is anything to do');
 });
 
+console.log('\nthe pre-flight verdict, and when it may be shown (task 1004121):');
+
+const snapOf = (over = {}) => ({
+  served_version: '1.19.917', available: ['1.19.917', '1.19.921'], recommended: '1.19.921',
+  observed_at: new Date().toISOString(), preflight_at: new Date().toISOString(), ...over,
+});
+const box = { id: '1', slug: 'cloudbongos', hosting_shape: 'control-plane' };
+
+await t('a verdict taken against the version ON OFFER is shown', () => {
+  const p = CU.previewFromSnapshot(box, snapOf({
+    preflight: { target: '1.19.921', ok: true, lines: ['database reachable'], error: null } }), null);
+  assert.ok(p.preflight, 'it reaches the control');
+  assert.equal(p.preflight.target, '1.19.921');
+  assert.ok(p.preflight_at, 'with its own age, not the probe’s');
+});
+
+await t('a verdict taken against a SUPERSEDED version is withheld, not shown as a pass', () => {
+  // The whole point of storing `target` with the verdict. A pass checked against
+  // 1.19.920 says nothing true about a button labelled 1.19.921 — and a stale pass is
+  // worse than no answer, because it reads as a guarantee.
+  const p = CU.previewFromSnapshot(box, snapOf({
+    preflight: { target: '1.19.920', ok: true, lines: ['database reachable'], error: null } }), null);
+  assert.equal(p.preflight, null, 'withheld');
+  assert.equal(p.preflight_at, null, 'and so is its timestamp — no age for an answer not given');
+});
+
+await t('a stale REFUSAL is withheld too — it must not veto a move it never checked', () => {
+  const p = CU.previewFromSnapshot(box, snapOf({
+    preflight: { target: '1.19.900', ok: false, lines: [], error: 'working tree not clean' } }), null);
+  assert.equal(p.preflight, null, 'the guard is symmetric: it withholds fails as well as passes');
+});
+
+await t('no verdict at all is null — never an implied pass', () => {
+  const p = CU.previewFromSnapshot(box, snapOf({ preflight: null, preflight_at: null }), null);
+  assert.equal(p.preflight, null);
+  assert.equal(p.behind, true, 'and the rest of the reading is unaffected');
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/core_upgrade_runner.mjs

@@ -36,6 +36,7 @@ const R = require('../scripts/gds/provision-core-upgrade.js');
 const U = require('../scripts/gds/upgrade.js');
 const P = require('../modules/provisioning/provisioning.js');
 const G = require('../modules/provisioning/control-plane-guard.js');
+const RP = require('../scripts/gds/provision-repo.js');
 
 let passed = 0;
 let failed = 0;
@@ -471,5 +472,180 @@ await t('an UNPRIVILEGED runner still adds no sudo and no env at all', async ()
   assert.match(cmd, /^node \S*scripts\/gds\/upgrade\.js /, 'it still invokes the CLI directly');
 });
 
+console.log('\nthe dry run behind "see what would change" (task 1004121):');
+
+await t('a passing dry run is parsed into its pre-flight lines, with no error', () => {
+  const { checks, error } = R.parsePreflight([
+    'bongos upgrade — @bongos/core: 1.19.917 → 1.19.921',
+    '  ✓ pre-flight: no modules/ — nothing to pre-check',
+    '  ✓ pre-flight: database "cloudbongos" reachable as the current user',
+  ].join('\n'));
+  assert.equal(error, null);
+  assert.equal(checks.length, 2);
+});
+
+await t('a REFUSAL is carried verbatim — its wording is the instruction', () => {
+  const { error } = R.parsePreflight(
+    '  ✖ cannot determine which database to migrate.\n    Set PGDATABASE, or give this instance a db.database in config/branding.json.');
+  assert.match(error, /Set PGDATABASE/, 'the remedy rides along, not just the complaint');
+});
+
+await t('ONE builder serves both legs — the preview and the move cannot drift apart', () => {
+  // Two hand-copied builders are how "what you were shown" stops matching "what runs".
+  // Everything deciding whether the upgrade is ALLOWED must be identical; only the tail
+  // that describes what happens AFTER the pin moves may differ, because a dry run stops
+  // before it.
+  const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone', db_name: 'test4' };
+  const move = R.upgradeInvocation(box, '1.19.921', { privileged: true, requestedBy: '42' });
+  const peek = R.upgradeInvocation(box, '1.19.921', { privileged: true, dryRun: true });
+  for (const shared of ['sudo -u bongos-test4 ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry']) {
+    assert.ok(move.cmd.includes(shared), `move carries ${shared}`);
+    assert.ok(peek.cmd.includes(shared), `preview carries the same ${shared}`);
+  }
+  assert.equal(move.instanceDir, peek.instanceDir, 'same target directory');
+  assert.equal(move.runAs, peek.runAs, 'same account');
+  // And the tail genuinely differs — asserted rather than assumed, so this test cannot
+  // quietly pass a preview that would restart the box.
+  assert.match(peek.cmd, /--dry-run/);
+  for (const post of ['--service', '--health-url', '--version-url', '--commit-pin', '--requested-by']) {
+    assert.ok(move.cmd.includes(post), `the move carries ${post}`);
+    assert.ok(!peek.cmd.includes(post), `the preview must NOT carry ${post} — it never gets that far`);
+  }
+});
+
+await t('an invalid slug is refused at the BUILDER, not left to a helper to throw', () => {
+  // The slug reaches a shell through instanceUser()/dbName(). Depending on another
+  // function's internals for that is one refactor away from an injection path.
+  assert.throws(() => R.upgradeInvocation({ slug: 'a; rm -rf /', port: 1, hosting_shape: 'standalone' }, '1.19.921', {}),
+    /invalid slug/);
+});
+
+await t('a dry run that fails WITHOUT a recognisable marker is still a refusal, never a pass', () => {
+  const deps = { privileged: false, exec: () => ({ ok: false, stdout: 'something went sideways' }) };
+  const r = R.preflightUpgrade({ id: 7, slug: 'test4', port: 3006, hosting_shape: 'standalone' }, '1.19.921', deps);
+  assert.equal(r.ok, false, 'a non-zero exit is a refusal whatever it printed');
+  assert.ok(r.error);
+});
+
+await t('the TICK never dry-runs — the verdict is asked for, not produced on a schedule', async () => {
+  // Re-running a check every tick for a box behind for hours spends a subprocess to
+  // re-learn the same answer, and is still missing in the window that matters.
+  const d = makeDeps({ served: '1.19.762' });
+  let spawned = 0;
+  d.preflightUpgrade = () => { spawned++; return { ok: true }; };
+  await R.snapshotCoreVersions(inst(), d);
+  assert.equal(spawned, 0, 'the version probe is per-tick; the dry run is not');
+});
+
+await t('the on-demand leg caches the verdict, and a REFUSAL is still a successful preview', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  d.preflightUpgrade = () => ({ target: '1.19.921', ok: false, lines: [], error: 'working tree not clean' });
+  const r = await R.preflightCoreUpgrade(inst(), d, intent({ target_version: '1.19.921' }));
+  assert.equal(r.ok, true, 'the CHECK ran — a refusal is what it was for, not a failure of it');
+  const write = d.queries.find((q) => /INSERT INTO provisioning_core_version_snapshot/.test(q.sql));
+  assert.ok(write, 'the verdict is cached');
+  assert.match(String(write.params[1]), /working tree not clean/);
+});
+
+await t('a preview of nothing is refused rather than cached as a pass', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  const r = await R.preflightCoreUpgrade(inst(), d, intent({ target_version: null }));
+  assert.equal(r.ok, false);
+  assert.equal(d.queries.filter((q) => /INSERT INTO provisioning_core_version_snapshot/.test(q.sql)).length, 0);
+});
+
+console.log('\nwhere the instance actually is (task 1004123):');
+
+// The vendored layout the live control plane runs in: the core is a PACKAGE inside the
+// instance, so the directory the core executes from is three levels below the directory
+// that must be upgraded.
+const VENDORED = '/home/lars/cloudbongos-instance/node_modules/@bongos/core';
+const INSTANCE = '/home/lars/cloudbongos-instance';
+const LEGACY = '/home/lars/cloudbongos';
+
+await t('selfInstanceRoot walks out of a vendored core, and leaves a plain checkout alone', () => {
+  assert.equal(RP.selfInstanceRoot(VENDORED), INSTANCE, 'the package is not the instance');
+  assert.equal(RP.selfInstanceRoot(LEGACY), LEGACY, 'a checkout run in place IS the instance');
+});
+
+await t('a path that merely CONTAINS the package name is not mistaken for one', () => {
+  // Guarding the string test itself: only a trailing segment means "I am the vendored
+  // core", and an instance that happens to live under a similarly-named directory must
+  // not be truncated into nonsense.
+  const decoy = '/srv/node_modules/@bongos/core-tools';
+  assert.equal(RP.selfInstanceRoot(decoy), decoy);
+  assert.equal(RP.selfInstanceRoot('/srv/node_modules/@bongos/core/sub'), '/srv/node_modules/@bongos/core/sub');
+});
+
+await t('the runner reads the installed version from the INSTANCE, not from the core package', async () => {
+  // The defect this replaces: readInstalledCoreVersion was handed REPO_ROOT, which in
+  // the vendored shape holds no node_modules/@bongos/core at all — so it answered null
+  // on the live control plane for as long as the shape has existed.
+  const asked = [];
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => INSTANCE };
+  d.readInstalledCoreVersion = (dir) => { asked.push(dir); return '1.19.760'; };
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  assert.deepEqual(asked, [INSTANCE], 'asked the instance root exactly once');
+});
+
+await t('the CLI runs where it lives and NAMES the instance it is aimed at', async () => {
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => INSTANCE };
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  const cmd = upgradeCall(d);
+  assert.ok(cmd.includes(`--instance ${INSTANCE} `),
+    `without this the upgrade pins and installs inside the core package and the real pin never moves — got: ${cmd}`);
+});
+
+await t('the legacy shape still omits --instance, because there is nothing to disambiguate', async () => {
+  const d = { ...makeDeps({ served: '1.19.762' }), selfInstanceRoot: () => require('../scripts/gds/provision-config.js').REPO_ROOT };
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  assert.doesNotMatch(upgradeCall(d), /--instance /, 'a checkout run in place is its own instance');
+});
+
+await t('the version snapshot asks the registry from the instance, not from inside the package', async () => {
+  // Weakest of the three sites — `recommended` is derived from the box's own /version,
+  // so aiming this one wrongly changes no answer today. It is guarded anyway: npm reads
+  // its configuration from the directory it runs in, and an unguarded line is a line
+  // that regresses quietly. Found by mutating each of the three sites in turn; this was
+  // the one no test noticed.
+  const cwds = [];
+  const d = makeDeps({ served: '1.19.760' });
+  d.selfInstanceRoot = () => INSTANCE;
+  d.updateChannel = { ...d.updateChannel, listAvailableVersions: ({ cwd }) => { cwds.push(cwd); return { ok: true, versions: ['1.19.760', '1.19.762'] }; } };
+  await R.snapshotCoreVersions(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d);
+  assert.deepEqual(cwds, [INSTANCE]);
+});
+
+await t('the PREVIEW aims at the instance too — a dry run of the wrong directory is the lie', async () => {
+  // This is the shape that made the defect dangerous rather than merely broken: dry-run
+  // against the core package and upgrade.js reports `(none) → <target>` with green
+  // pre-flight ticks, so the owner is shown a clean bill of health for a run that will
+  // restart production and roll back. Both legs share one builder; both must aim.
+  const box = { id: 41, slug: 'cloudbongos', port: 3002, hosting_shape: 'control-plane', db_name: 'cloudbongos' };
+  const selfRoot = () => INSTANCE;
+  const move = R.upgradeInvocation(box, '1.19.922', { privileged: true, selfRoot });
+  const peek = R.upgradeInvocation(box, '1.19.922', { privileged: true, dryRun: true, selfRoot });
+  assert.ok(peek.cmd.includes(`--instance ${INSTANCE} `), `the preview names its target — got: ${peek.cmd}`);
+  assert.equal(move.instanceDir, peek.instanceDir, 'and it is the same target the move would take');
+  assert.equal(peek.instanceDir, INSTANCE);
+});
+
+await t('an unreadable installed version is a REFUSAL, not a skipped channel check', () => {
+  // Fail-closed. This is the guard that would have caught the directory bug on the
+  // first press instead of after four live restarts.
+  const f = R.targetFault('1.19.760', ['1.19.758', '1.19.760'], null, 'patch', () => true);
+  assert.match(f, /could not read the core version installed/);
+  assert.match(f, /cannot be bounded by the 'patch' channel/);
+});
+
+await t('the runner refuses, and runs NOTHING, when it cannot see where the instance is', async () => {
+  const d = makeDeps({ served: '1.19.762' });
+  d.readInstalledCoreVersion = () => null;
+  const r = await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
+  assert.equal(r.ok, false);
+  assert.match(r.error, /could not read the core version installed/);
+  assert.equal(d.ranWith.filter((c) => /upgrade\.js/.test(c.cmd)).length, 0, 'the box was not touched');
+});
+
 console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/deploy_page_projects.mjs

@@ -75,12 +75,18 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
     OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast() {} },
     location: { assign() {} },
   };
+  // The page's poll interval, driven rather than slept through. Injecting the REAL
+  // setTimeout made every case whose preview never converges sit out the page's full
+  // ~30s wait in wall-clock, still repainting after the test had finished — slow, and
+  // flaky against a torn-down sandbox.
+  windowObj.__deployPollMs = 0;
+  windowObj.__deployPollTries = 3;
   const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
   documentObj._ready();
-  const settle = async () => { for (let i = 0; i < 12; i++) await new Promise((r) => setTimeout(r, 0)); };
+  const settle = async () => { for (let i = 0; i < 40; i++) await new Promise((r) => setTimeout(r, 0)); };
   return { els, posts, gets, settle, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
 }
 
@@ -126,13 +132,20 @@ test('confirming sends THAT project’s id and the version it was shown', async
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
   await b.settle();
-  assert.equal(b.posts.length, 1);
-  assert.equal(b.posts[0].path, '/provisioning/instances/32/core-upgrade');
+  // Arming also asks for a dry run now (task 1004121), so the MOVE is the post that is
+  // not one — separated by its payload rather than by its position, because "the second
+  // post" would silently start asserting about the wrong request the next time the order
+  // changes.
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1, 'exactly one move is sent');
+  assert.equal(moves[0].path, '/provisioning/instances/32/core-upgrade');
   // Field-wise, not deepEqual: the body is built inside the vm realm, so its
   // prototype is not this realm's Object and deepStrictEqual rejects it on identity
   // alone — a harness artifact that says nothing about the payload.
-  assert.equal(b.posts[0].body.to, '1.19.871');
-  assert.deepEqual(Object.keys(b.posts[0].body), ['to'], 'and nothing else is sent');
+  assert.equal(moves[0].body.to, '1.19.871');
+  assert.deepEqual(Object.keys(moves[0].body), ['to'], 'and nothing else is sent');
+  // And the move must never carry the flag that would turn it into a no-op.
+  assert.equal(moves[0].body.dry_run, undefined, 'a move is not a dry run');
 });
 
 test('a box with nothing newer offers no button', async () => {
@@ -191,3 +204,89 @@ test('a move on the platform row re-reads the control plane, not a tenant previe
   assert.ok(b.gets.includes('/provisioning/control-plane'), 'the self row is read from its own endpoint');
   assert.ok(!b.gets.some((g) => /instances\/3\d\/core-upgrade/.test(g)), 'and no tenant is re-probed');
 });
+
+// ---- the pre-flight verdict on step two (task 1004121) ---------------------------
+// The defect: step one was called "see what would change" and changed nothing but a
+// local flag. These read what step two actually PAINTS, because the bug was invisible
+// to every assertion about what the page fetched — it fetched nothing.
+
+test('step two shows what the dry run found, not just a restatement of the action', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: ['database "cloudbongos" reachable as the current user'], error: null },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /nothing blocks this move/i, 'it states a verdict');
+  assert.match(html, /database &quot;cloudbongos&quot; reachable|database "cloudbongos" reachable/, 'and shows what was checked');
+});
+
+test('a BLOCKED move says so, in the upgrade’s own words, and still offers the button', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: false, lines: [], error: 'working tree not clean — commit/stash first, or pass --force.' },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /This would fail/, 'the owner is told before pressing');
+  assert.match(html, /working tree not clean/, 'verbatim — the wording names the fix');
+  // Deliberate: the runner refuses on its own, and this reading can be minutes old.
+  assert.match(html, /id="dp-confirm-1"/, 'the button is still there — a stale ✖ must not lock the owner out');
+});
+
+test('with no verdict yet, arming ASKS for one and says so — never an implied pass', async () => {
+  // The whole failure mode in one test: silence where a check should be must not look
+  // like a clean bill of health, and the page must actually go and get the answer rather
+  // than wait for a background tick that may be minutes away.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  // While it is in flight the row says so — asserted BEFORE settling, because the whole
+  // point is what the owner sees during the wait.
+  assert.match(b.panel(), /Checking what this would do/, 'it states that a check is under way');
+  await b.settle();
+  const asks = b.posts.filter((x) => x.body && x.body.dry_run === true);
+  assert.equal(asks.length, 1, 'exactly one check is requested');
+  assert.equal(asks[0].body.to, '1.19.871', 'against the version on offer');
+  // And when the answer never arrives (this harness never converges), it falls back to
+  // the honest state rather than to a pass — which is the failure mode being guarded.
+  const settled = b.panel();
+  assert.match(settled, /Not checked yet/, 'an answer that never came is stated as such');
+  assert.doesNotMatch(settled, /nothing blocks this move/i, 'and never dressed up as a pass');
+});
+
+test('the poll does not close the panel the owner is reading', async () => {
+  // refreshOne() returns a row to step one — right after a MOVE, wrong during the wait.
+  // Polling with it un-armed the row under the owner every interval, so the confirm
+  // button vanished mid-check.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  await b.settle();
+  assert.match(b.panel(), /id="dp-confirm-1"/, 'still armed after the poll has run and given up');
+});
+
+test('a poll whose row is closed stops instead of repainting a step nobody is on', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  b.els.get('dp-cancel-1')._on.click();
+  await b.settle();
+  assert.match(b.panel(), /id="dp-preview-1"/, 'back at step one');
+  assert.doesNotMatch(b.panel(), /Checking what this would do/, 'and not still claiming to be checking');
+});
+
+test('a verdict already in hand is NOT re-requested', async () => {
+  // Re-asking would spend a subprocess on the box to reprint an answer already shown.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: ['database reachable'], error: null },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  await b.settle();
+  assert.equal(b.posts.filter((x) => x.body && x.body.dry_run).length, 0, 'no check requested');
+  assert.match(b.panel(), /nothing blocks this move/i, 'the held verdict is shown');
+});