@bongos/core 1.19.927 → 1.19.929

package/scripts/gds/provision-core-upgrade.js

@@ -203,7 +203,11 @@ async function coreUpgradeInstance(inst, deps, intent) {
     : '';
   // Built by the SAME function the preview uses, so "what you were shown" and "what runs"
   // cannot drift apart into two hand-maintained flag lists (task 1004121).
-  const { cmd, runDir } = upgradeInvocation(inst, to, { privileged, requestedBy, selfRoot });
+  // The preview probes; the move must probe identically or the two commands diverge on
+  // the one field task 1004121 exists to keep identical. Skipped when !apply, where the
+  // command is printed and never run — a plan should not spend a subprocess per tick.
+  const { runAs } = resolveRunAs(inst, deps, { probe: apply });
+  const { cmd, runDir } = upgradeInvocation(inst, to, { privileged, requestedBy, selfRoot, runAs });
 
   if (!apply) {
     // A --dry-run runner tick used to only PRINT this command. It now runs the CLI's own
@@ -269,6 +273,53 @@ function parsePreflight(out) {
   return { checks, error };
 }
 
+/**
+ * Which unix account should this instance's upgrade run as? Asks the box (task 1004128).
+ *
+ * The fleet is heterogeneous: instances provisioned before task 1003369 run as the
+ * shared APP_USER, instances provisioned after run as their own `bongos-<slug>`. Neither
+ * is guessable from the row, and getting it wrong is not a soft failure — `sudo` refuses
+ * an unknown user and the upgrade dies before pre-flight, which is exactly how the
+ * tenant leg has been broken.
+ *
+ * Falling back is NOT a privilege escalation: an instance with no account of its own is
+ * already running as APP_USER (its unit says so), so this runs the upgrade as precisely
+ * the account that owns the files and the database it is about to touch. It IS reported,
+ * because a missing per-instance account is a provisioning gap someone should close, and
+ * a silent fallback would hide it forever.
+ */
+function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
+  if (inst.hosting_shape === 'control-plane') return { runAs: APP_USER, fellBack: false };
+  // Re-checked HERE rather than left to instanceUser()'s own throw, for the reason
+  // upgradeInvocation states about itself: a call site whose safety depends on a
+  // helper's internals is one refactor away from a shell-interpolation path.
+  if (!isValidSlug(inst && inst.slug)) {
+    throw new Error(`resolveRunAs: refusing to probe an account for invalid slug ${JSON.stringify(inst && inst.slug)}`);
+  }
+  const wanted = instanceUser(inst);
+  if (!allowProbe) return { runAs: wanted, fellBack: false };
+  // THE SAME EXECUTOR THE UPGRADE ITSELF WILL USE. Every sibling here picks
+  // `standalone ? (controlExec || exec) : exec`, because under PROVISION_REMOTE_HOST
+  // (ADR 0130) `exec` is the REMOTE ssh executor while `controlExec` stays local. A
+  // probe on `exec` would then ask the co-hosting box whether an account exists while
+  // the command it is deciding for runs on the control plane — a wrong answer that
+  // looks like a right one.
+  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || deps.exec) : deps.exec;
+  const r = boxExec(`id -u ${wanted}`, { allowFail: true });
+  const failed = !r || r.softFailed === true || r.ok === false;
+  if (!failed) return { runAs: wanted, fellBack: false };
+  // ONLY A DEFINITIVE "no such user" JUSTIFIES THE FALLBACK. A probe that could not
+  // answer — an exec timeout, an NSS hiccup — must not silently narrow the per-instance
+  // isolation of task 1003369 for this operation. So an inconclusive probe keeps the
+  // intended account: if it really is missing the upgrade fails loudly, and since this
+  // task a failure now carries the reason instead of "the dry run did not complete".
+  const said = `${(r && r.stdout) || ''}\n${(r && r.stderr) || ''}`;
+  if (!/no such user|unknown user/i.test(said)) {
+    return { runAs: wanted, fellBack: false, probeInconclusive: true };
+  }
+  return { runAs: APP_USER, fellBack: true, wanted };
+}
+
 // ONE BUILDER FOR BOTH LEGS (task 1004121).
 //
 // The preview and the move must be the same command or the preview is worthless — and
@@ -282,7 +333,7 @@ function parsePreflight(out) {
 // HERE rather than left to instanceUser()'s own throw: that throw is correct today, but
 // a call site whose safety depends on a helper's internals is one refactor away from a
 // shell-injection path (and the apply leg's own guard sits at the route, not here).
-function upgradeInvocation(inst, to, { privileged = false, dryRun = false, requestedBy = '', selfRoot = selfInstanceRoot } = {}) {
+function upgradeInvocation(inst, to, { privileged = false, dryRun = false, requestedBy = '', selfRoot = selfInstanceRoot, runAs = null } = {}) {
   if (!isValidSlug(inst && inst.slug)) {
     throw new Error(`upgradeInvocation: refusing to build a shell command from an invalid slug ${JSON.stringify(inst && inst.slug)}`);
   }
@@ -300,10 +351,25 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
   // the project. So ask, rather than assume; in the legacy shape the answer is
   // REPO_ROOT and the command below is byte-identical to what it always was.
   const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
-  // The control plane is not a provisioned tenant and has no `bongos-` account; every
-  // other shape runs as its own, which is also its Postgres login role (task 1004119).
-  const runAs = inst.hosting_shape === 'control-plane' ? APP_USER : instanceUser(inst);
-  const sudoP = privileged ? `sudo -u ${runAs} env PGDATABASE=${dbName(inst)} ` : '';
+  // WHICH ACCOUNT, AND WHY IT IS RESOLVED RATHER THAN DERIVED (task 1004128).
+  //
+  // Task 1004119 wrote this as `control-plane ? APP_USER : instanceUser(inst)` and was
+  // half right. The control-plane leg is correct and verified live. The tenant leg
+  // assumed the per-instance account model of task 1003369 is provisioned everywhere —
+  // and on the live box NO `bongos-*` account exists, no such Postgres role exists, and
+  // every instance unit still says `User=lars`. So the fix for "Postgres has no role
+  // root" swapped one absent account for another, and every tenant upgrade died with
+  // `sudo: unknown user bongos-test4`.
+  //
+  // The account model is a real security control, not an accident — a distinct uid per
+  // instance is what stops a co-tenant reading a sibling's /proc/<pid>/environ. So the
+  // answer is NOT to route everyone back to the shared account. It is to run as the
+  // account the instance ACTUALLY runs as, which a caller establishes by probing
+  // (resolveRunAs below) instead of either side assuming. Passing it in keeps this
+  // builder pure; the default preserves the old derivation for callers that have not
+  // probed.
+  const account = runAs || (inst.hosting_shape === 'control-plane' ? APP_USER : instanceUser(inst));
+  const sudoP = privileged ? `sudo -u ${account} env PGDATABASE=${dbName(inst)} ` : '';
   const cli = path.posix.join('scripts', 'gds', 'upgrade.js');
   const shared = [`${sudoP}node ${cli}`, '--registry', `--to ${to}`,
     instanceDir === REPO_ROOT ? '' : `--instance ${instanceDir}`];  // REPO_ROOT is where the CLI runs (runDir below)
@@ -315,7 +381,7 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
       '--commit-pin',
       requestedBy ? `--requested-by ${requestedBy}` : '',
       requestedBy ? '--upgrade-source owner-control' : ''];
-  return { cmd: [...shared, ...tail].filter(Boolean).join(' '), runDir: REPO_ROOT, instanceDir, runAs };
+  return { cmd: [...shared, ...tail].filter(Boolean).join(' '), runDir: REPO_ROOT, instanceDir, runAs: account };
 }
 
 // Ask the upgrade CLI what it WOULD do, changing nothing. `allowFail` because a refusal
@@ -326,7 +392,8 @@ function preflightUpgrade(inst, to, deps) {
   // A distinct local name: `deps.selfInstanceRoot || selfInstanceRoot` with a const of
   // the same name would TDZ-shadow the import and crash every uninjected call.
   const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
-  const { cmd, runDir } = upgradeInvocation(inst, to, { privileged, dryRun: true, selfRoot });
+  const { runAs, fellBack, wanted } = resolveRunAs(inst, deps);
+  const { cmd, runDir } = upgradeInvocation(inst, to, { privileged, dryRun: true, selfRoot, runAs });
   const r = boxExec(cmd, { cwd: runDir, allowFail: true });
   const out = `${(r && r.stdout) || ''}\n${(r && r.stderr) || ''}`;
   const { checks, error } = parsePreflight(out);
@@ -334,7 +401,20 @@ function preflightUpgrade(inst, to, deps) {
   // recognisable ✖ is still a refusal, and reporting it as a pass is the failure mode
   // this whole task exists to remove.
   const ok = !!(r && !r.softFailed && r.ok !== false) && !error;
-  return { target: to, ok, lines: checks, error: error || (ok ? null : 'the dry run did not complete') };
+  // WHEN THERE IS NO ✖, SAY WHAT THE COMMAND SAID (task 1004128). The generic sentence
+  // is the LAST resort, not the first: the first live pre-flight reported "the dry run
+  // did not complete" while `sudo: unknown user bongos-test4` sat in the journal, and
+  // the second did the same over `✖ already on 1.19.927`. Both were in hand. The trim
+  // is because this reaches a DOM.
+  const raw = out.trim().split('\n').filter(Boolean).slice(-4).join('\n').slice(0, 600);
+  const why = error || (raw || null);
+  const note = fellBack
+    ? `ran as ${runAs} — this instance has no ${wanted} account yet (it predates the per-instance account model)`
+    : null;
+  return {
+    target: to, ok, lines: checks, ran_as: runAs, account_note: note,
+    error: ok ? null : (why || 'the dry run did not complete, and said nothing this could report'),
+  };
 }
 
 // Run a dry run for one instance and cache its verdict — the ON-DEMAND leg, drained from
@@ -439,4 +519,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, versionCmd, parseServedVersion, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/gds/provision.js

@@ -49,7 +49,7 @@ const path = require('node:path');
 const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
-const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
+const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, accountPreflight, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
@@ -95,7 +95,7 @@ function makeExec({ apply, log = console.log, remoteHost = null, remoteCwd = nul
         // `shown` call site is secret-bearing by declaration: log the exit status
         // alone, never stderr (a remote shell may echo the failing line back).
         const why = shownAs ? `exit status ${e && e.status != null ? e.status : '?'}` : (e.stderr || e.message || '').toString().trim().slice(0, 120);
-        if (allowFail) { log(`    ~ ${shown} (non-fatal: ${why})`); return { ok: true, stdout: '', softFailed: true }; }
+        if (allowFail) { log(`    ~ ${shown} (non-fatal: ${why})`); return softFailResult(e, !!shownAs); }
         log(`    ✖ ${shown}`);
         throw e;
       }
@@ -113,7 +113,7 @@ function makeExec({ apply, log = console.log, remoteHost = null, remoteCwd = nul
       // non-fatal line carries only the exit status — never e.message, whose
       // "Command failed: <cmd>" would echo the command back into the journal.
       const why = shownAs ? `exit status ${e && e.status != null ? e.status : '?'}` : (e.stderr || e.message || '').toString().trim().slice(0, 120);
-      if (allowFail) { log(`    ~ ${label} (non-fatal: ${why})`); return { ok: true, stdout: '', softFailed: true }; }
+      if (allowFail) { log(`    ~ ${label} (non-fatal: ${why})`); return softFailResult(e, !!shownAs); }
       log(`    ✖ ${label}`);
       throw e;
     }

package/src/bongos/serve-internal.js

@@ -1154,8 +1154,14 @@ function mountInternalSurfaces(app) {
   // shells — and matched no gate at all. The shell carries no data and every
   // read behind it is gated server-side, so this closed an inconsistency rather
   // than an exposure; the point is that one URL cannot be two tiers at once.
+  // task 1004098 (BV2.R03): `thinking` — THE ROOM, a builder's own idea trail —
+  // joins the tier `ideas` sits on, for the same settled reason: there is no
+  // permission gate on having a thought. It needs no floor ABOVE sign-in either,
+  // because the page reads the VIEWER's own trail and nobody else's — the id it
+  // asks for comes from GET /me, never from the URL, so a rank could protect
+  // nothing here that the session does not already.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|thinking|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.927'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.929'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_runner.mjs

@@ -647,5 +647,158 @@ await t('the runner refuses, and runs NOTHING, when it cannot see where the inst
   assert.equal(d.ranWith.filter((c) => /upgrade\.js/.test(c.cmd)).length, 0, 'the box was not touched');
 });
 
+
+console.log('\nwhich account, and saying what went wrong (task 1004128):');
+
+// A deps bag whose `id -u` probe can be made to succeed or fail, and whose upgrade
+// invocation can be made to soft-fail with real command output.
+function acctDeps({ accountExists = true, dryRunStdout = '', dryRunStderr = '', softFail = false } = {}) {
+  const d = makeDeps({ served: '1.19.762' });
+  d.privileged = true;
+  const ran = [];
+  d.ranWith = ran;
+  d.exec = (cmd, opts) => {
+    ran.push({ cmd, cwd: opts && opts.cwd });
+    if (/^id -u /.test(cmd)) {
+      if (accountExists) return { ok: true, stdout: '1001\n' };
+      // What `id -u` really says for an absent account — the definitive answer the
+      // fallback is allowed to act on.
+      return { ok: true, stdout: '', stderr: `id: '${cmd.split(' ').pop()}': no such user\n`, softFailed: true };
+    }
+    if (/\/version/.test(cmd)) return { ok: true, stdout: JSON.stringify({ coreVersion: '1.19.762' }) };
+    if (/upgrade\.js/.test(cmd)) {
+      return softFail
+        ? { ok: true, stdout: dryRunStdout, stderr: dryRunStderr, softFailed: true }
+        : { ok: true, stdout: dryRunStdout, stderr: dryRunStderr };
+    }
+    return { ok: true, stdout: '' };
+  };
+  return d;
+}
+
+await t('a tenant WITH its own account runs as that account — the security model is kept', () => {
+  // task 1003369: a distinct uid per instance is what stops a co-tenant reading a
+  // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it.
+  const d = acctDeps({ accountExists: true });
+  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'bongos-test4', fellBack: false });
+});
+
+await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
+  // The live box has no bongos-* account at all, so every tenant upgrade died on
+  // `sudo: unknown user bongos-test4`. Falling back is not an escalation — the
+  // instance's own unit already says User=lars — but it IS a provisioning gap, so it
+  // is reported rather than silently papered over.
+  const d = acctDeps({ accountExists: false });
+  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  assert.equal(r.runAs, 'lars');
+  assert.equal(r.fellBack, true);
+  assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
+});
+
+await t('the control plane is never probed — it has no instance account by design', () => {
+  const d = acctDeps({ accountExists: false });
+  const r = R.resolveRunAs(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos' }), d);
+  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'lars', fellBack: false });
+  assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 0, 'no probe was spent');
+});
+
+await t('the dry run is invoked as the account that actually exists', async () => {
+  const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
+  await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
+  assert.match(cmd, /sudo -u lars /, `must not sudo to an account that does not exist — got: ${cmd}`);
+  assert.doesNotMatch(cmd, /bongos-test4/);
+});
+
+await t('the MOVE probes identically, so preview and move cannot diverge on the account', async () => {
+  const d = acctDeps({ accountExists: false });
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
+  assert.match(cmd, /sudo -u lars /, 'the move follows the same probe as the preview');
+});
+
+await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly widening it', () => {
+  // A probe that could not answer (exec timeout, NSS hiccup) is not evidence the
+  // account is absent. Falling back on it would narrow task 1003369's per-instance
+  // /proc isolation for that operation, silently, on a fleet where the account may
+  // well exist. Only `no such user` is evidence.
+  const d = makeDeps({ served: '1.19.762' });
+  d.exec = () => ({ ok: true, stdout: '', stderr: 'id: cannot connect to name service\n', softFailed: true });
+  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  assert.equal(r.runAs, 'bongos-test4', 'the intended account is kept');
+  assert.equal(r.fellBack, false);
+  assert.equal(r.probeInconclusive, true, 'and the caller can tell it was not a clean answer');
+});
+
+await t('the probe uses the SAME executor the upgrade will use', () => {
+  // Under PROVISION_REMOTE_HOST (ADR 0130) `exec` is the remote ssh executor while
+  // `controlExec` stays local, and every sibling here picks controlExec for a
+  // standalone. A probe on the other one asks the wrong machine and gets a confident
+  // wrong answer.
+  const asked = { control: [], remote: [] };
+  const d = makeDeps({ served: '1.19.762' });
+  d.controlExec = (cmd) => { asked.control.push(cmd); return { ok: true, stdout: '1001\n' }; };
+  d.exec = (cmd) => { asked.remote.push(cmd); return { ok: true, stdout: '', stderr: "id: 'x': no such user\n", softFailed: true }; };
+  const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
+  assert.deepEqual(asked.remote, [], 'the remote executor was not asked');
+  assert.equal(asked.control.length, 1, 'the control-plane executor was');
+  assert.equal(r.runAs, 'bongos-test4', 'and its answer is the one that counts');
+});
+
+await t('a planning tick probes ONCE, not twice', async () => {
+  // The non-apply path prints the move it would make AND runs the CLI's own dry run, so
+  // one probe is real work. The second — for a command string that is only logged — was
+  // a subprocess per tick for nothing.
+  const d = acctDeps({ accountExists: false });
+  d.apply = false;
+  await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
+  assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 1,
+    'exactly one probe: the dry run that actually executes');
+});
+
+await t('an invalid slug is refused by THIS call site, not merely by the helper it calls', () => {
+  // Asserting /invalid slug/ alone proves nothing: instanceUser() throws its own
+  // message matching that, so the test passes with this guard deleted — verified by
+  // deleting it. The point of the finding is that safety here must not DEPEND on the
+  // helper's internals, so the assertion names the thrower.
+  const d = acctDeps({});
+  assert.throws(
+    () => R.resolveRunAs({ hosting_shape: 'standalone', slug: 'bad slug;rm -rf /' }, d),
+    /resolveRunAs: refusing to probe/,
+    'the refusal must come from this function, not from instanceUser further down',
+  );
+  assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 0, 'and nothing was executed');
+});
+
+await t('a refusal reports what the command SAID, not "did not complete"', async () => {
+  const d = acctDeps({ softFail: true, dryRunStderr: 'sudo: unknown user bongos-test4\n' });
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  assert.equal(v.ok, false);
+  assert.match(v.error, /unknown user bongos-test4/,
+    `the reason was in hand and must travel — got: ${JSON.stringify(v.error)}`);
+});
+
+await t('a ✖ line still wins over the raw tail', async () => {
+  const d = acctDeps({ softFail: true, dryRunStdout: 'noise\n  ✖ already on 1.19.927 (pass --force to re-run)\n' });
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  assert.match(v.error, /already on 1\.19\.927/);
+  assert.doesNotMatch(v.error, /^noise/, 'the parsed refusal is preferred to the raw tail');
+});
+
+await t('a fallback is recorded on the verdict the owner reads', async () => {
+  const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  assert.equal(v.ran_as, 'lars');
+  assert.match(v.account_note, /no bongos-test4 account yet/);
+});
+
+await t('and a silent failure STILL refuses rather than inventing a pass', async () => {
+  const d = acctDeps({ softFail: true, dryRunStdout: '', dryRunStderr: '' });
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
+  assert.equal(v.ok, false, 'a command that said nothing is not a pass');
+  assert.match(v.error, /said nothing/);
+});
+
 console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/hall_nav.mjs

@@ -258,7 +258,7 @@ test('sidebar groups read by audience, in order', () => {
   // task 1003455 (goal 1000089): 'blockers' joins the same group, after Tasks —
   // its subject is the project (what's stuck on the owner), not a person or a
   // craft, and its one data source (GET /blockers) is public like Roadmap's.
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'blockers', 'board-room', 'ideas', 'copy-desk', 'studio'],
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'work', 'blockers', 'board-room', 'ideas', 'thinking', 'copy-desk', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.

package/tests/hall_page_gate_map.mjs

@@ -60,6 +60,12 @@ const ORACLE = {
   // themselves server-side.
   '/builders/studio': 'requireBuilderPage',
   '/builders/ideas': 'requireBuilderPage',
+  // THE ROOM (task 1004098 / BV2.R03) — a builder's own idea trail. Sign-in and
+  // no rank floor, the tier /ideas sits on: there is no permission gate on
+  // having a thought, and the page reads the VIEWER's own trail (the id comes
+  // from GET /me, never from the URL), so a rank could protect nothing the
+  // session does not already.
+  '/builders/thinking': 'requireBuilderPage',
   '/builders/collab': 'requireBuilderPage',
   // task 1002710: the orientation reading rooms moved DOWN to this tier from a
   // thetes+ gate. They are the onboarding documents, so gating them above xenos