@bongos/core 1.19.951 → 1.19.953

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -8,7 +8,7 @@
   <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <link rel="stylesheet" href="/builders/style.css?v=2026-09-22-movefeedback1">
   <link rel="stylesheet" href="/builders/oversight.css">
   <link rel="stylesheet" href="/builders/project-settings.css">
 </head>
@@ -55,10 +55,10 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/deploy.js?v=2026-09-20-preflight2"></script>
+<script src="/builders/deploy.js?v=2026-09-22-movefeedback1"></script>
 </body>
 </html>

package/modules/hall-ui/public/deploy.js

@@ -63,6 +63,15 @@
   const num = (v, dflt) => (Number.isFinite(v) ? v : dflt);
   const POLL_MS = typeof window !== 'undefined' ? num(window.__deployPollMs, 2000) : 2000;
   const POLL_TRIES = typeof window !== 'undefined' ? num(window.__deployPollTries, 15) : 15;
+  // A MOVE NEEDS A LONGER LEASH THAN A PREVIEW (task 1004145). The intent waits for the
+  // runner's 2-minute tick, and then the upgrade itself installs, migrates, restarts and
+  // health-checks — so the preview's 30s ceiling would time out on every healthy deploy
+  // and report "still running" as if something were wrong. 5 minutes covers the worst
+  // case with the tick included.
+  const MOVE_TRIES = typeof window !== 'undefined' ? num(window.__deployMoveTries, 150) : 150;
+  // Boxes with a move in flight, and what each was asked to move TO — so the row can say
+  // which version it is waiting for, and the settled check knows what "worked" means.
+  const moving = new Map();
 
   async function fetchJson(path) {
     const res = await api.request('GET', `${API}${path}`);
@@ -109,12 +118,54 @@
   // Something is already running. The press is not offered at all — offering a button
   // that the server will refuse with 'intent_conflict' is a worse experience than saying
   // plainly that the box is busy.
+  // NOT "this page will notice when it does" any more (task 1004145). It said that and
+  // did not: only a move STARTED from this page polls, and even that stops at its bound.
+  // This branch is what an owner sees for someone else's press, or for their own after a
+  // reload, and neither is being watched — so it says what is true instead.
   function busyHtml(p) {
     const i = p.open_intent;
     return `
       <p class="ov-row__sub">A <strong>${escapeHtml(i.action)}</strong> is ${escapeHtml(i.state)} for this box${
         i.target_version ? ` (to core ${escapeHtml(i.target_version)})` : ''}.
-        Nothing else can be queued until it settles; this page will notice when it does.</p>`;
+        Nothing else can be queued until it settles. Reload to see where it got to.</p>`;
+  }
+
+  // WHAT THE OWNER SEES WHILE IT RUNS. busyHtml already covered "something is running",
+  // but only when the server still reports an open intent — and it offered no version,
+  // no elapsed sense, and nothing when the intent had settled. This one is driven by the
+  // press itself, so it is on screen from the click rather than from the next poll.
+  function movingHtml(p) {
+    const to = moving.get(p.instance_id);
+    const state = (p.open_intent && p.open_intent.state) || 'queued';
+    return `
+      <p class="ov-row__sub dp-moving">Moving to core <strong>${escapeHtml(String(to))}</strong> — ${escapeHtml(state)}.
+        The project restarts as part of this, and puts itself back on
+        ${escapeHtml(String(p.served_version))} if the new core does not answer.
+        This page is watching and will say when it lands.</p>`;
+  }
+
+  // AND WHAT IT SEES AFTERWARDS. Three outcomes, and the failure is the one that had no
+  // surface at all before this: an errored intent is not an OPEN intent, so the payload
+  // after a rolled-back upgrade used to be identical to the payload before it.
+  function settledHtml(p) {
+    const m = p.last_move;
+    if (!m) return '';
+    if (m.state === 'error') {
+      return `
+        <div class="dp-settled dp-settled--failed">
+          <p class="ov-row__sub"><strong>The move to core ${escapeHtml(String(m.target_version))} did not land</strong>
+            — this project was put back on ${escapeHtml(String(p.served_version))} and is running.</p>
+          ${m.error ? `<pre class="dp-preflight__error">${escapeHtml(String(m.error))}</pre>` : ''}
+        </div>`;
+    }
+    if (m.state === 'done' && m.target_version === p.served_version) {
+      return `
+        <div class="dp-settled dp-settled--ok">
+          <p class="ov-row__sub"><strong>Now running core ${escapeHtml(String(m.target_version))}</strong>
+            — moved ${escapeHtml(ago(m.at))}, and the box confirmed it.</p>
+        </div>`;
+    }
+    return '';
   }
 
   function stepOneHtml(p) {
@@ -232,10 +283,15 @@
   function boxHtml(p, isSelf) {
     const step = steps.get(p.instance_id) || 'preview';
     let action;
-    if (p.open_intent) action = busyHtml(p);
+    // The owner's own press wins over every other state: it is true from the click,
+    // before the server has an intent to report, and it must not be replaced by
+    // "nothing to deploy" the moment served_version catches up mid-poll.
+    if (moving.has(p.instance_id)) action = movingHtml(p);
+    else if (p.open_intent) action = busyHtml(p);
     else if (p.reading === 'no_answer') action = '';
     else if (!p.behind) action = `<p class="ov-row__sub">Nothing newer is published that this box can take. There is nothing to deploy.</p>`;
     else action = step === 'confirm' ? stepTwoHtml(p, isSelf) : stepOneHtml(p);
+    if (!moving.has(p.instance_id)) action += settledHtml(p);
     return `
       <li class="ov-row" id="dp-box-${escapeHtml(String(p.instance_id))}"><div class="ov-row__main">
         <span class="ov-row__title">${escapeHtml(String(p.slug))}${isSelf ? ' — the box this platform runs on' : ''}</span>
@@ -302,17 +358,53 @@
   async function move(p) {
     const btn = $(`dp-confirm-${p.instance_id}`);
     if (btn) { btn.disabled = true; btn.textContent = 'Queueing…'; }
+    const id = String(p.instance_id);
+    const to = p.recommended_version;
     try {
       // `p.recommended_version` — the version this owner was SHOWN for THIS box, not
       // whatever is newest at the moment of the click.
-      const r = await sendJson('POST', `/provisioning/instances/${p.instance_id}/core-upgrade`, { to: p.recommended_version });
+      const r = await sendJson('POST', `/provisioning/instances/${p.instance_id}/core-upgrade`, { to });
       toast(r.message || 'Queued.');
-      await refreshOne(p);
     } catch (e) {
       if (e && e.kind === '401') return;
       toast(e.message || 'Could not queue the move.');
-      if (btn) { btn.disabled = false; btn.textContent = `Move to ${p.recommended_version}`; }
+      if (btn) { btn.disabled = false; btn.textContent = `Move to ${to}`; }
+      return;   // nothing was queued, so there is nothing to watch
     }
+    // WATCH IT (task 1004145). busyHtml has always promised "this page will notice when
+    // it does", and until now it did not: move() refreshed ONCE, immediately — before
+    // the runner's tick had even fired — and then fell silent for the whole upgrade. The
+    // owner got a toast, a row that snapped back to its pre-press state, and nothing
+    // else, which is indistinguishable from the press having been lost.
+    moving.set(p.instance_id, to);
+    steps.set(p.instance_id, 'preview');   // the two-step is spent; the row now reports
+    repaint();
+    let settled = false;
+    for (let i = 0; i < MOVE_TRIES; i++) {
+      await new Promise((r) => setTimeout(r, POLL_MS));
+      if (moving.get(p.instance_id) !== to) return;   // superseded or the row is gone
+      let now;
+      try {
+        // keepStep, for the reason the pre-flight poll documents: a refresh that resets
+        // the row would fight the state this loop is painting, every interval.
+        await refreshOne(p, { keepStep: true });
+        now = (view.self && String(view.self.instance_id) === id)
+          ? view.self
+          : view.boxes.find((b) => String(b.instance_id) === id);
+      } catch (e) { break; }
+      if (!now) break;
+      // Settled two ways, and BOTH need the intent to be closed: served_version can
+      // read the new core while the runner is still committing the pin, and calling
+      // that "done" would drop the row out of its in-flight state early.
+      if (!now.open_intent && now.served_version === to) { settled = true; break; }
+      if (!now.open_intent && now.last_move && now.last_move.state === 'error') { settled = true; break; }
+    }
+    moving.delete(p.instance_id);
+    repaint();
+    // A poll that ran out is NOT a failure, and must not be painted as one. The upgrade
+    // is still the runner's to finish; saying so beats going quiet, which is the exact
+    // complaint this task came from.
+    if (!settled) toast(`Still working on core ${to}. It keeps going without this page — reload to see where it got to.`);
   }
 
   // Re-read ONLY the box that just changed. The full load() fans out one probe per

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/goal-map.html

@@ -56,7 +56,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/goals.html

@@ -223,7 +223,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -199,7 +199,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -102,7 +102,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-20-room1" defer></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -80,7 +80,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/people.html

@@ -55,7 +55,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.css

@@ -127,3 +127,19 @@
   white-space: pre-wrap;
   overflow-x: auto;
 }
+
+/* A move in flight, and how it ended (task 1004145). The owner pressed Upgrade and got
+   a toast and then silence; these are the two states that silence was hiding. */
+.dp-moving {
+  border-left: 3px solid var(--accent);
+  padding-left: 0.7rem;
+}
+.dp-settled { margin: 0.4rem 0 0; }
+.dp-settled--ok {
+  border-left: 3px solid var(--ok);
+  padding-left: 0.7rem;
+}
+.dp-settled--failed {
+  border-left: 3px solid var(--danger);
+  padding-left: 0.7rem;
+}

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -68,7 +68,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -416,7 +416,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -637,9 +637,18 @@
     // (probed: /api/bongos/provisioning/health is 404 on a tenant, 200 on the
     // platform) — so on those the banner informs and does not offer a button that
     // would 404. Task 1004046 is what gives those halls a real action.
-    var action = moduleOn('provisioning')
-      ? '<a class="core-update-notice__action" href="/deploy">Upgrade</a>'
-      : '';
+    // NOT A LINK TO THE PAGE YOU ARE ALREADY ON (task 1004145). This reads as the action
+    // button — it is labelled with the verb and styled like one — but it is a plain
+    // navigation to /deploy. On /deploy itself that is a no-op, and the owner who
+    // pressed it there reasonably reported "I clicked update, but I didn't see anything
+    // happen": nothing had, and nothing had been asked for. The control is on that page
+    // already, so on it the banner informs and points, and does not pretend to act.
+    var onDeploy = window.location && String(window.location.pathname || '').replace(/\/+$/, '') === '/deploy';
+    var action = !moduleOn('provisioning')
+      ? ''
+      : (onDeploy
+        ? '<span class="core-update-notice__hint">Use the control below to take it.</span>'
+        : '<a class="core-update-notice__action" href="/deploy">Upgrade</a>');
     el.innerHTML =
       '<span>Core <strong>' + esc(update.latest) + '</strong> is available — this project runs ' +
       esc(update.running || 'an unknown version') + '.</span>' +

package/modules/hall-ui/public/sky.html

@@ -65,7 +65,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The SAME shared vocabulary the room loads, at the same version: the server

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/style.css

@@ -897,6 +897,12 @@ main:focus { outline: none; }
   font-weight: 600;
   color: inherit;
 }
+/* The banner on /deploy itself: it still announces the release, but points at the
+   control instead of linking to the page the reader is already on (task 1004145). */
+.core-update-notice__hint {
+  margin-left: auto;
+  color: var(--ink-soft);
+}
 .core-update-notice__close {
   min-width: 24px;
   min-height: 24px;

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -62,7 +62,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The filter strip is the kit's tab strip (makeTabs) rather than a fifth

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -151,7 +151,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-20-room1"></script>
+<script src="/builders/shell.js?v=2026-09-22-movefeedback1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/provisioning/core-upgrade.js

@@ -239,7 +239,7 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
  * empty one — a control that renders a cache as though it were live is how someone is
  * told their box is on a version it left an hour ago.
  */
-function previewFromSnapshot(inst, snap, openIntent) {
+function previewFromSnapshot(inst, snap, openIntent, lastMove) {
   const served = (snap && snap.served_version) || null;
   const pf = (snap && snap.preflight) || null;
   const available = (snap && Array.isArray(snap.available) ? snap.available : []);
@@ -266,13 +266,45 @@ function previewFromSnapshot(inst, snap, openIntent) {
     preflight: pf && recommended && pf.target === recommended ? pf : null,
     preflight_at: pf && recommended && pf.target === recommended ? (snap.preflight_at || null) : null,
     open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null } : null,
+    // THE LAST MOVE, WHATEVER BECAME OF IT (task 1004145).
+    //
+    // `open_intent` is `state IN ('pending','running')` — by the index's own definition.
+    // So an intent that reaches `error` stops being open, and until this field existed
+    // the payload after a FAILED upgrade was byte-identical to the payload before it:
+    // same served_version, open_intent null, no error anywhere. Intents 77/78/79 on
+    // 2026-09-20 all ended "failed and was rolled back" and the page could not say so;
+    // the owner's only signal was a number that never changed, which is indistinguishable
+    // from never having pressed the button. It is also what lets a SUCCESS be attributed:
+    // "the version is different now" and "what you asked for worked" are not the same
+    // sentence, and only one of them answers the press.
+    last_move: lastMove ? {
+      target_version: lastMove.target_version || null,
+      state: lastMove.state,
+      at: lastMove.resolved_at || lastMove.updated_at || null,
+      // Truncated because it reaches a DOM and upgrade.js's refusals can carry a whole
+      // `git status` (the dirty-tree one lists every file).
+      error: lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
+    } : null,
   };
 }
 
+// The newest core-pin MOVE for this box, in any terminal or live state. Deliberately
+// not `getOpenIntent`, which filters to pending|running, and deliberately not widened to
+// `core-upgrade-preflight` — a preview already reports itself through `preflight`, and
+// folding the two together would let a preview's refusal read as a failed deploy.
+async function lastCoreMove(pool, instanceId) {
+  const { rows } = await pool.query(
+    `SELECT * FROM provisioning_intents
+      WHERE instance_id = $1 AND action = 'core-upgrade'
+      ORDER BY created_at DESC, id DESC LIMIT 1`,
+    [instanceId]);
+  return rows[0] || null;
+}
+
 async function loadPreview(pool, provisioning, inst) {
   const { rows } = await pool.query('SELECT * FROM provisioning_core_version_snapshot WHERE instance_id = $1', [inst.id]);
   const openIntent = provisioning.getOpenIntent ? await provisioning.getOpenIntent(pool, inst.id) : null;
-  return previewFromSnapshot(inst, rows[0], openIntent);
+  return previewFromSnapshot(inst, rows[0], openIntent, await lastCoreMove(pool, inst.id));
 }
 
 function makeCoreUpgradePreviewHandler({ provisioning, pool, parseId, log }) {
@@ -321,5 +353,5 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
   };
 }
 
-module.exports = { CORE_UPGRADE_FROM, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { CORE_UPGRADE_FROM, lastCoreMove, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/migrations/provisioning_022_last_core_move_index.sql

@@ -0,0 +1,25 @@
+-- provisioning_022 — an index for "the last core move on this box" (task 1004145).
+--
+-- Numbered 022, not 021: this branch and the byo-host shape change (task 1004141) each
+-- allocated max+1 from their own branch point, and 1004141 landed first. migrate.sh
+-- applies in BASENAME order, so two 021s would have their order decided alphabetically
+-- and a fresh replay could differ from the order prod applied. The one that has NOT been
+-- applied anywhere is the one that renumbers — renaming an applied migration re-runs it.
+--
+-- lastCoreMove() reads:
+--   WHERE instance_id = $1 AND action = 'core-upgrade' ORDER BY created_at DESC LIMIT 1
+--
+-- and neither existing index serves it. `ux_provisioning_intents_open` is partial on
+-- state IN ('pending','running') — this query is ABOUT the terminal rows it excludes —
+-- and `idx_provisioning_intents_pending` is created_at under the same partial predicate.
+-- So the read was a filter-and-sort over every intent for the instance.
+--
+-- It runs on EVERY preview of every box, including the fleet fan-out on /deploy, and
+-- provisioning_intents only grows: one row per press, retained as the audit trail
+-- (ADR 0293 D5). Small today at fewer than a hundred rows, so this is a cheap fix now
+-- rather than a puzzling page later.
+--
+-- DESC on created_at so the LIMIT 1 is the leading edge; id is the tiebreak for two
+-- presses inside the same clock tick, which a test-driven double-press can produce.
+CREATE INDEX IF NOT EXISTS idx_provisioning_intents_last_action
+  ON provisioning_intents (instance_id, action, created_at DESC, id DESC);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.951",
+  "version": "1.19.953",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.951",
+      "version": "1.19.953",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.951",
+  "version": "1.19.953",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",