@bongos/core 1.19.951 → 1.19.953

package/scripts/gds/adopt-preflight.js

@@ -12,7 +12,7 @@
 //   • CI collisions — the repo's workflows vs core's expected unit/secret-scan/
 //     gate-review checks.
 //   • IGNORED incoming files — a pre-existing .gitignore rule that would swallow what
-//     adopt is about to commit (task 1003400). This is the check that was missing when
+//     adopt is about to commit (task 1003881). This is the check that was missing when
 //     Cloud Bongos was adopted onto a repo whose .gitignore already carried `.claude/`:
 //     the skills, hooks and settings.json were materialized onto disk and then dropped
 //     by `git add`, so the adopt commit landed 8 files with no methodology surface at

package/scripts/gds/device-flow-help.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 // scripts/gds/device-flow-help.js — the one explanation of a Device-Flow refusal, shared
-// by `bongos setup` and `bongos login` (task 1003400).
+// by `bongos setup` and `bongos login` (task 1003881).
 //
 // WHY IT EXISTS AT ALL. GitHub creates an App from a manifest with Device Flow OFF and
 // exposes no API to switch it on — only a checkbox in the App's settings. So on every

package/scripts/gds/init.js

@@ -497,7 +497,8 @@ async function interview({ adopt = false } = {}) {
 // ---------------------------------------------------------------------------
 
 // PURE (exported for tests) — the root START-HERE guide (task 1002404, goal
-// 1000052). A freshly-CLONED instance must tell a human what to run FIRST: the
+// 1000052; task 1003881 made it LAYER onto an existing README instead of
+// skipping one — see layerReadme below). A freshly-CLONED instance must tell a human what to run FIRST: the
 // `bongos` CLI ships INSIDE the not-yet-installed @bongos/core package, so
 // `npm install` has to come before any `bongos` command (including `bongos dev`).
 // `bongos init` runs npm install during scaffolding, but a later `git clone` of
@@ -637,8 +638,9 @@ function writeConfigs(spec, { dir, force, dryRun, coreDep, log = console.log })
   log(`  ✓ wrote ${path.relative(dir, modulesPath)}`);
   log(`  ✓ wrote ${path.relative(dir, hierarchyPath)}`);
   log(`  ✓ wrote ${path.relative(dir, pkgPath)} (pins ${CORE_PKG} → ${pinNote})`);
-  // README START-HERE (task 1002404): mint it when absent, else APPEND the marked
-  // section. Never a blind overwrite — an owner's own README content always survives.
+  // README START-HERE (task 1002404, layering added by task 1003881): mint it when
+  // absent, else APPEND the marked section. Never a blind overwrite — an owner's own
+  // README content always survives, which is why the guide stopped being skipped.
   layerReadme(branding, { dir, dryRun: false, log });
   return { brandingPath, modulesPath, hierarchyPath, pkgPath, readmePath, wrote: true };
 }

package/scripts/gds/login.js

@@ -23,7 +23,7 @@
 const readline = require('node:readline');
 const { spawnSync } = require('node:child_process');
 const { saveSession, loadStoredSession, listStoredSessions } = require('./cli-lib');
-// The device-flow refusal detector + its plain-language cure (task 1003400). A leaf
+// The device-flow refusal detector + its plain-language cure (task 1003881). A leaf
 // module, NOT setup.js: setup requires this file for runDeviceFlow, so requiring it
 // back would close a require cycle. Both callers depend on the leaf instead.
 const { isDeviceFlowDisabled, deviceFlowFallbackLines } = require('./device-flow-help');

package/scripts/gds/setup.js

@@ -274,7 +274,7 @@ async function promptOnboardingConsent() {
 }
 
 // ── W1: the manifest-born App has Device Flow OFF (task 1003051) ─────────────
-// The detector + the guidance moved to ./device-flow-help (task 1003400) so
+// The detector + the guidance moved to ./device-flow-help (task 1003881) so
 // `bongos login` can use the same words without closing a require cycle back
 // through this file (setup requires login for runDeviceFlow). Re-exported here
 // because both are part of setup.js's tested public surface.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.951'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.953'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/adopt_preflight.mjs

@@ -101,7 +101,7 @@ t('preflightAdopt: a clean repo → no blocking; every category reports', () =>
   } finally { rmSync(dir, { recursive: true, force: true }); }
 });
 
-// ---- ignored-incoming: the check that was missing (task 1003400) ----------
+// ---- ignored-incoming: the check that was missing (task 1003881) ----------
 //
 // The failure it exists to stop: adopt onto a repo whose .gitignore already carries
 // `.claude/`. The skills/hooks/settings are written to disk, `git add` drops them, the

package/tests/bongos_login.mjs

@@ -45,7 +45,7 @@ test('pollDecision maps the /access-requests/status body to a loop action', () =
   assert.equal(pollDecision({}), 'wait');
 });
 
-// ---- the Device-Flow dead end (task 1003400) -------------------------------
+// ---- the Device-Flow dead end (task 1003881) -------------------------------
 //
 // Device Flow is OFF on every GitHub App created from a manifest and GitHub offers no
 // API to switch it on, so terminal sign-in is broken from birth on a fresh instance —

package/tests/core_update_banner.mjs

@@ -202,7 +202,7 @@ test('a real request through the assembled router returns the verdict, not a 500
 
 // ── the banner ────────────────────────────────────────────────────────────────
 
-function boot({ permissions, update, status = 200, dismissed = null, provisioning = true } = {}) {
+function boot({ permissions, update, status = 200, dismissed = null, provisioning = true, pathname = '/settings' } = {}) {
   const els = new Map();
   const inserted = [];
   const stored = {};
@@ -227,7 +227,7 @@ function boot({ permissions, update, status = 200, dismissed = null, provisionin
     addEventListener() {}, dispatchEvent() {},
     get cookie() { return ''; }, set cookie(_v) {},
   };
-  const location = { hostname: 'h', origin: 'https://h', pathname: '/settings', hash: '', assign() {}, replace() {} };
+  const location = { hostname: 'h', origin: 'https://h', pathname, hash: '', assign() {}, replace() {} };
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: { provisioning } },
     BongosClient: {
@@ -334,3 +334,31 @@ test('the banner renders from the projection /me ACTUALLY sends, not one written
     'gates on is outside NAV_PERMISSION_ATOMS and the feature is dead for everyone (task 1004118)',
   );
 });
+
+// ── the banner must not offer the page you are on (task 1004145) ──────────────
+// The owner pressed this on /deploy and reported "I clicked update, but I didn't see
+// anything happen". Nothing had: it is an <a href="/deploy"> styled as a button and
+// labelled with the verb, so on /deploy it navigates to the current page and does
+// nothing at all. No request was ever made — verified against the live box, which had
+// no core-upgrade POST in three hours and no queued intent from that press.
+
+test('on /deploy the banner points at the control instead of linking to /deploy', async () => {
+  const b = boot({ pathname: '/deploy', permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  const html = b.banner().innerHTML;
+  assert.doesNotMatch(html, /href="\/deploy"/, 'no link to the page already open');
+  assert.match(html, /control below/i, 'it says where the real control is');
+  assert.match(html, /1\.19\.871/, 'and still announces the release');
+});
+
+test('everywhere else the banner still offers the link', async () => {
+  const b = boot({ pathname: '/settings', permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.match(b.banner().innerHTML, /href="\/deploy"/, 'the action is real from any other page');
+});
+
+test('a trailing slash is still /deploy', async () => {
+  const b = boot({ pathname: '/deploy/', permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/);
+});

package/tests/core_upgrade_door.mjs

@@ -697,5 +697,55 @@ await t('every strict body schema in this module declares each field its handler
     'under strict, a field the schema does not name is a 400 BEFORE the handler runs, so reading it is unreachable code and a broken endpoint');
 });
 
+
+console.log('\nthe last move, whatever became of it (task 1004145):');
+
+const SNAP = { served_version: '1.19.900', available: ['1.19.900', '1.19.949'], recommended: '1.19.949', observed_at: new Date().toISOString() };
+
+await t('a FAILED move is visible — the payload is no longer identical to before it', () => {
+  // open_intent is `state IN ('pending','running')` by the index's own definition, so an
+  // errored intent is not open. Before last_move, the payload after a rolled-back
+  // upgrade matched the payload before it exactly, and the owner's only signal was a
+  // number that never changed — indistinguishable from never having pressed.
+  const failed = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'working tree not clean — commit/stash first, or pass --force.' };
+  const p = CU.previewFromSnapshot(ACTIVE, SNAP, null, failed);
+  assert.equal(p.open_intent, null, 'it is not an OPEN intent');
+  assert.equal(p.last_move.state, 'error');
+  assert.equal(p.last_move.target_version, '1.19.949');
+  assert.match(p.last_move.error, /working tree not clean/, 'and the reason travels');
+});
+
+await t('a SUCCESSFUL move is attributable, not merely finished', () => {
+  const done = { action: 'core-upgrade', state: 'done', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: null };
+  const p = CU.previewFromSnapshot({ ...ACTIVE }, { ...SNAP, served_version: '1.19.949', recommended: null }, null, done);
+  assert.equal(p.last_move.state, 'done');
+  assert.equal(p.last_move.target_version, p.served_version, 'the move names the version the box now serves');
+  assert.equal(p.last_move.error, null);
+});
+
+await t('a long refusal is truncated — it reaches a DOM', () => {
+  // The dirty-tree refusal carries a whole `git status`; test4's ran to dozens of lines.
+  const huge = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'x'.repeat(5000) };
+  const p = CU.previewFromSnapshot(ACTIVE, SNAP, null, huge);
+  assert.ok(p.last_move.error.length <= 600, `bounded — got ${p.last_move.error.length}`);
+});
+
+await t('no move ever made is null, not an invented success', () => {
+  const p = CU.previewFromSnapshot(ACTIVE, SNAP, null, null);
+  assert.equal(p.last_move, null);
+});
+
+await t('lastCoreMove reads MOVES only — a preview refusal is not a failed deploy', async () => {
+  // Folding core-upgrade-preflight in here would let a dry run's refusal render as
+  // "the move did not land". The preview reports itself through `preflight`.
+  const seen = [];
+  const pool = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [] }; } };
+  await CU.lastCoreMove(pool, 41);
+  assert.match(seen[0].sql, /action = 'core-upgrade'/, 'scoped to the move action');
+  assert.doesNotMatch(seen[0].sql, /preflight/, 'and never widened to the preview');
+  assert.doesNotMatch(seen[0].sql, /state IN/, 'and not filtered to open states — the point is the terminal ones');
+  assert.deepEqual(seen[0].params, [41]);
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/deploy_page_projects.mjs

@@ -32,10 +32,15 @@ const FLEET = [
   { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'standalone' },
 ];
 
-function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200 } = {}) {
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200 } = {}) {
   const els = new Map();
   const posts = [];
   const gets = [];
+  // How many times each box has been re-read. A move POLLS, so a test of the move has to
+  // be able to change what the server says between reads — otherwise the only reachable
+  // assertion is "it asked", never "it noticed".
+  const reads = new Map();
+  const toasts = [];
   const makeEl = () => ({
     _on: {}, _html: '', hidden: false, textContent: '', disabled: false,
     addEventListener(ev, fn) { this._on[ev] = fn; },
@@ -48,7 +53,13 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   const request = async (method, url, opts) => {
     const p = url.replace('/api/bongos', '');
     if (method === 'GET') gets.push(p);
-    if (method === 'POST') { posts.push({ path: p, body: opts && opts.body }); return { ok: true, status: 200, data: { message: 'Queued.' } }; }
+    if (method === 'POST') {
+      posts.push({ path: p, body: opts && opts.body });
+      if (postStatus !== 200) {
+        return { ok: false, status: postStatus, data: { error: { code: 'intent_conflict', message: 'A core-upgrade run is currently running for this project.' } } };
+      }
+      return { ok: true, status: 200, data: { message: 'Queued.' } };
+    }
     if (p === '/provisioning/control-plane') {
       if (controlPlaneStatus !== 200) {
         return { ok: false, status: controlPlaneStatus, data: { error: { code: 'control_plane_not_enrolled', message: 'This platform has no deploy door yet. Run enroll-control-plane.js once.' } } };
@@ -66,13 +77,16 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
       if (!inst || inst.slug === 'unreadable-one') {
         return { ok: false, status: 500, data: { error: { code: 'core_upgrade_preview_failed', message: 'internal error' } } };
       }
-      return { ok: true, status: 200, data: { preview: preview(inst.id, inst.slug, { hosting_shape: inst.hosting_shape }) } };
+      const n = (reads.get(inst.id) || 0) + 1;
+      reads.set(inst.id, n);
+      const over = instanceOver ? instanceOver(inst, n) : {};
+      return { ok: true, status: 200, data: { preview: preview(inst.id, inst.slug, { hosting_shape: inst.hosting_shape, ...over }) } };
     }
     return { ok: false, status: 404, data: { error: { code: 'not_found' } } };
   };
   const windowObj = {
     BongosClient: { createClient: () => ({ request }) },
-    OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast() {} },
+    OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast(m) { toasts.push(String(m)); } },
     location: { assign() {} },
   };
   // The page's poll interval, driven rather than slept through. Injecting the REAL
@@ -81,13 +95,18 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   // flaky against a torn-down sandbox.
   windowObj.__deployPollMs = 0;
   windowObj.__deployPollTries = 3;
+  windowObj.__deployMoveTries = moveTries;
   const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
   documentObj._ready();
   const settle = async () => { for (let i = 0; i < 40; i++) await new Promise((r) => setTimeout(r, 0)); };
-  return { els, posts, gets, settle, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
+  // A SHORT advance, for observing a state that exists only while the poll is running.
+  // `settle` drains the whole loop (POLL_MS is 0 here), so an assertion about the
+  // in-flight row has to look before the loop finishes, not after it.
+  const tick = async (n = 3) => { for (let i = 0; i < n; i++) await new Promise((r) => setTimeout(r, 0)); };
+  return { els, posts, gets, reads, toasts, settle, tick, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
 }
 
 test('the platform AND every live hosted project get a row', async () => {
@@ -189,8 +208,12 @@ test('a move re-reads ONLY the box it moved, not every project again', async ()
   b.els.get('dp-confirm-32')._on.click();
   await b.settle();
   const previewReads = b.gets.filter((g) => g.endsWith('/core-upgrade'));
-  assert.deepEqual(previewReads, ['/provisioning/instances/32/core-upgrade'],
-    'exactly one preview re-read, and it is the moved box');
+  // Since task 1004145 a move POLLS, so the count is no longer one — and the count was
+  // only ever a proxy for the thing that matters. Asserted directly instead: every
+  // re-read is the moved box, and no other box is touched.
+  assert.ok(previewReads.length > 0, 'the moved box is re-read');
+  assert.deepEqual([...new Set(previewReads)], ['/provisioning/instances/32/core-upgrade'],
+    'and it is the ONLY box re-read — no fan-out across the fleet');
   assert.ok(!b.gets.includes('/provisioning/fleet'), 'the fleet is not re-listed');
 });
 
@@ -290,3 +313,104 @@ test('a verdict already in hand is NOT re-requested', async () => {
   assert.equal(b.posts.filter((x) => x.body && x.body.dry_run).length, 0, 'no check requested');
   assert.match(b.panel(), /nothing blocks this move/i, 'the held verdict is shown');
 });
+
+// ── the press has to show something (task 1004145) ────────────────────────────
+// The owner pressed Upgrade and reported "I didn't see anything happen". Two reasons:
+// the banner's Upgrade is a link to /deploy (fixed in shell.js), and move() refreshed
+// once — before the runner's tick — then fell silent for the whole upgrade.
+
+test('confirming a move says so IMMEDIATELY, naming the version it is taking', async () => {
+  const b = boot();
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.tick();
+  const html = b.panel();
+  assert.match(html, /Moving to core/i, 'the row reports the move, rather than snapping back');
+  assert.match(html, /1\.19\.871/, 'and names the target');
+  assert.match(html, /restarts as part of this/i, 'and warns what it costs');
+});
+
+test('the in-flight state survives the poll — it does not close under the reader', async () => {
+  // refreshOne() returns a row to step one, which is right after a move and wrong
+  // DURING one; without keepStep the poll wipes its own message on the first interval.
+  // Observed after a poll has actually run, but before the bound is exhausted.
+  // A long bound so the loop cannot exhaust mid-assertion: the state under test exists
+  // only WHILE it polls.
+  const b = boot({ moveTries: 500, instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.tick(8);
+  assert.ok(b.reads.get('32') >= 1, 'at least one poll has landed');
+  assert.match(b.panel(), /Moving to core/i, 'still reporting after a refresh');
+  assert.doesNotMatch(b.panel(), /id="dp-preview-32"/, 'and has not reverted to step one');
+});
+
+test('when the box lands on the new core, it CONFIRMS it', async () => {
+  // The whole ask: "confirmation when it updates". A changed number is not a
+  // confirmation — nothing tied it to the press.
+  const b = boot({
+    instanceOver: (inst, n) => (n >= 2
+      ? { served_version: '1.19.871', behind: false, open_intent: null, last_move: { target_version: '1.19.871', state: 'done', at: new Date().toISOString(), error: null } }
+      : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
+  });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /Now running core 1\.19\.871/i, 'the move is confirmed, not merely finished');
+  assert.doesNotMatch(html, /Moving to core/i, 'and the in-flight state is gone');
+});
+
+test('a FAILED move is reported, with the reason, instead of looking untouched', async () => {
+  // An errored intent is not an OPEN intent, so before last_move existed the payload
+  // after a rolled-back upgrade was identical to the payload before it.
+  const b = boot({
+    instanceOver: (inst, n) => (n >= 2
+      ? { open_intent: null, last_move: { target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'working tree not clean — commit/stash first, or pass --force.' } }
+      : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
+  });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /did not land/i, 'the failure is stated');
+  assert.match(html, /working tree not clean/, 'and carries the runner’s own reason');
+  assert.match(html, /put back on 1\.19\.800/i, 'and says the project is still running');
+});
+
+test('a poll that runs out says it is still working, not that it failed', async () => {
+  // MOVE_TRIES is a bound on this page's patience, not on the runner's work.
+  const b = boot({ instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  for (let i = 0; i < 6; i++) await b.settle();
+  assert.ok(b.toasts.some((t) => /Still working on core 1\.19\.871/i.test(t)),
+    `it says where things stand — got ${JSON.stringify(b.toasts)}`);
+  assert.doesNotMatch(b.panel(), /did not land/i, 'and never claims a failure it did not see');
+});
+
+test('a queue that is REFUSED leaves no in-flight state to wait on', async () => {
+  // THIS TEST USED TO PASS WITHOUT CLICKING ANYTHING. Its setup read
+  // `b.els.get('dp-confirm-32')._on = el._on` — a self-assignment no-op — and set
+  // `b.postFails`, a property the harness never read. So it asserted "no in-flight
+  // state" on a row where no move had been attempted, which is true of every row on the
+  // page. The grader caught it. It now refuses the POST for real and presses the button.
+  const b = boot({ postStatus: 409 });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  // Counted on the MOVE specifically: arming the row also POSTs a dry_run pre-flight,
+  // so a bare posts.length would have been satisfied by the preview alone — the same
+  // class of mistake this test is being fixed for.
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1, `the press really happened — posts: ${JSON.stringify(b.posts)}`);
+  assert.doesNotMatch(b.panel(), /Moving to core/i, 'nothing was queued, so nothing is watched');
+  assert.ok(b.toasts.some((t) => /currently running/i.test(t)), 'and the refusal is reported');
+  assert.match(b.panel(), /id="dp-confirm-32"/, 'the button comes back so it can be retried');
+});

package/tests/discord_approvals.mjs

@@ -170,7 +170,7 @@ await t('a DB error returns {error}, never throws', async () => {
   assert.equal(r.outcome, 'error');
 });
 
-// ---- the outbound half must not outlive the inbound half (task 1003400) ----
+// ---- the outbound half must not outlive the inbound half (task 1003881) ----
 //
 // The 👍 this line invites is applied ONLY by discord-approvals.js, which lives in the
 // `discord` module. onboarding (which posts) is default-ON; discord is default-OFF; and

package/tests/module_api.mjs

@@ -48,7 +48,7 @@ const PUBLISHED_SURFACE = [
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
-  'isModuleEnabled', // task 1003400: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask
+  'isModuleEnabled', // task 1003881: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',
   'on', 'emit', 'emitAsync', 'listEvents', 'seamSnapshot',
   'contribute', 'contributions', 'collectContributions', 'listContributionPoints',

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '8a93e0b4ca715b9c';
+const SHELL_SHA = '02de48ca2ae07995';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);