@bongos/core 1.19.956 → 1.19.958

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.956",
-  "core_contract": "1.19.956",
-  "source_commit": "b5f9ec6f9c84cf59195511dea0bef9cd2f607e00",
+  "core_version": "1.19.958",
+  "core_contract": "1.19.958",
+  "source_commit": "8b7c56c98aae1497c594219c7ae761ce54c60f8b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T05:46:01.341Z",
+  "built_at": "2026-09-22T13:42:54.493Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2357,
+    "functional_verbatim": 2358,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2897,
-  "tree_sha256": "37422b79ea02e637ca3a28a909c2d299c5f309190fbda25845bcb1ad6d2765c1",
+  "file_count": 2898,
+  "tree_sha256": "1dd23da0216fa29e9f848ba037a788cf0cfa9d0a55fea04ffb7eba833b142541",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2117,12 +2117,12 @@
     {
       "path": "docs/adr/0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md",
       "mode": "0000644",
-      "sha256": "cf6e701b8791462057fa5bc53dc716ef8f80b8ee2efa12a07581305f788a5e48"
+      "sha256": "6ae902e7626feb915300f4b21b6d20ae3369116a86bf624bd614ac9616c3ac11"
     },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "8d2b9a793fed7214d50fa667848b6c3037f129bff3e33113071bdbcd5acc34cf"
+      "sha256": "5db407e3565216666055365b11a5ff05b8901ff9c7fbaee011c93784c40762e6"
     },
     {
       "path": "docs/api-reference.md",
@@ -2157,12 +2157,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "ea08a06744310c312420c4af1e0f67154e324fe2be552b6d5c2fc683e18a63e8"
+      "sha256": "77cb83609d2a80e2c7520746181ef858839d37e8c0997b5dce42127d0c4c119c"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "45091c4acfe82fa8968be566f8b14f414ee3df68772b13617cba55735de93d1e"
+      "sha256": "8d83ca0d16a1f9d0efc89f0331f6940592ce34e0dd6f92c448575497bce96548"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e5152e6018b9378631ce08e502ef244efca8db514fdb5acca5f6da21a6fca155"
+      "sha256": "25f1d655a540764066d47dcd30fc53451e253377c57ac1647d3dc3128928a385"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4822,7 +4822,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "fca8216900a7ff1d0b48f87e3fd223ae15e61346980ba68e7721801fb971157a"
+      "sha256": "e3a4fa62e761dddfb54a1f13680eb64ff87c4d37e83fa41a846ebfe1f41d44c8"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -6542,7 +6542,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "d6ba41f0bdb775191f94a1b57903a3f22cee68a8e7552be92f6112d86b4090fd"
+      "sha256": "96c6b73411a489e5c41fd567123fa8ef35f7a757db0e1df0c0cafd720674b05f"
     },
     {
       "path": "modules/provisioning/credential-preflight.js",
@@ -6674,6 +6674,11 @@
       "mode": "0000644",
       "sha256": "1fb60b17c411d9529f4c0ecd0b3d1efc9b2061567a1b31bf74fa706e2e83b3d7"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_024_snapshot_schema_pending.sql",
+      "mode": "0000644",
+      "sha256": "1287440b0088a6451dd4df234e578e06fc6f3e892915e64cd6c6e1f09dadd9d5"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -8077,12 +8082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "984830848a268de5d21b596133f328532da98025312eb19c55bab1f59bcefd3d"
+      "sha256": "83b00099cd3853c2bf7ca568043852caec477bace90cb26921122a525ed0bfc8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3b5369b5abd11bc15832bd5f20582f76fb70e492e9cf2c79060e01ffd5f288df"
+      "sha256": "8f3e2b77a4b6f11f1eb2ffe270ea5fe212d959a1dd0db7eab501808423df8ef4"
     },
     {
       "path": "public-docs/index.html",
@@ -9027,7 +9032,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "4a84f48518a6427e95bf23e273865b6b2753489b40737b9256191fd2a65562e1"
+      "sha256": "f22c31d00a50a312d7228922cbe70fedc503e704cc7f2cb33a8686a4954c1c1e"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -10087,7 +10092,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "77129f6f2f9471813d98976e7fcac4b9f219507c10960a7b3c6aaa219e862421"
+      "sha256": "afe264ed7d639f350d12b51e28f13d9a5a604bac89b110dcad7b38a415334df3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10992,12 +10997,12 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "7333e05011a080e5ac3a54bb1b07fb421db848ee2eb54c786f36c43058b9e587"
+      "sha256": "c4238e2f2e2c52f23fb6948f5e6545bc4880efe75eb9af229a455db6017db05c"
     },
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "f8bc5b5329c4de27b41a9172e6b5023c4854d864f532aac3ed062e0d35633f00"
+      "sha256": "85bc665f5d80ff1c7e8134e6be7dd8fa336b4fb50344164b034b0e72a963f04d"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11142,7 +11147,7 @@
     {
       "path": "tests/deploy_page_projects.mjs",
       "mode": "0000644",
-      "sha256": "cec0141f75e41dc268d9377db4925d8b8f0f6e9eb9b6b3c6b6c7c1eb07e75ac8"
+      "sha256": "5c582192ddd83ef289be692b12d898c8837b54312348751082478d036987a647"
     },
     {
       "path": "tests/design_tokens_sync.mjs",

package/docs/adr/0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md

@@ -7,7 +7,7 @@
 - **Supersedes in part:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7 (the "managed layer is greenfield, deferred, spec-first" sequencing)
 - **Depends on:** [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) (the shapes and the platform this operates)
 - **Gates:** [task 1004142](https://cloudbongos.com/builders#/task/1004142) (the platform leg) · [task 1001949](https://cloudbongos.com/builders#/task/1001949) (metering) · [task 1001621](https://cloudbongos.com/builders#/task/1001621) (the spend rollup)
-- **Filed by this ADR:** [task 1004149](https://cloudbongos.com/builders#/task/1004149) (the $0 cost ledger — decision 6) · [task 1004150](https://cloudbongos.com/builders#/task/1004150) (the subscription roster — decision 5)
+- **Filed by this ADR:** [task 1004148](https://cloudbongos.com/builders#/task/1004148) (the $0 cost ledger — decision 6) · [task 1004150](https://cloudbongos.com/builders#/task/1004150) (the subscription roster — decision 5)
 
 ## Context
 
@@ -63,7 +63,7 @@ This ADR records the direction and files it as [task 1004150](https://cloudbongo
 
 `costEstimateUsd` returns **0** for `standalone` — correct when a project was a process on a box we already paid for, and wrong the moment it becomes a ~$14/month Render service. Until it is fixed the fleet cost ledger reports \$0 for every project the platform is about to be billed for, and it reports it with no error.
 
-That is a defect, not a deferral, and it is filed as [task 1004149](https://cloudbongos.com/builders#/task/1004149). The metering and invoicing track ([task 1001949](https://cloudbongos.com/builders#/task/1001949)) and the spend rollup ([task 1001621](https://cloudbongos.com/builders#/task/1001621)) stay separate work, as [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) already says.
+That is a defect, not a deferral, and it is filed as [task 1004148](https://cloudbongos.com/builders#/task/1004148). The metering and invoicing track ([task 1001949](https://cloudbongos.com/builders#/task/1001949)) and the spend rollup ([task 1001621](https://cloudbongos.com/builders#/task/1001621)) stay separate work, as [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) already says.
 
 ## Consequences
 

package/docs/adr/README.md

@@ -416,4 +416,4 @@ This keeps the decision history honest and traceable.
 | 0322 | [**The five states are derived once, and a remnant needs evidence** ([task 1004103](https://cloudbongos.com/builders#/task/1004103), goal 1000095 — BONGOS-V2). The ideator surface draws a thought as one of five objects — star, protostar, satellite, remnant, cold body — and three surfaces are about to draw them (the room, the descent, the sky). Every fact already existed: `idea_inbox.status` (`core_195`), [ADR 0321](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md)’s `hasWork` / `share` / `attributable`, and `tasks.goal_id` + `tasks.status`. What was missing was ONE place that reads them: a state inferred in three renderers is three states, and the sky can say a thought went out while the room beside it still calls it alive, with nothing erroring. **Decision:** one pure resolver (`modules/ideas/idea-state.js`), brightness exposed on the `reward` port (ideas may not reach `credit_log` any other way — [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 — and already declares `reward` in `consumes`), and the ORDER of the tests IS the decision. **MERGED wins over everything:** a folded thought keeps its own money (`trail-size.js` is emphatic) but is no longer its own point in the sky, so letting work win draws one idea twice, beside the thought that absorbed it. **WORK beats a DISCARD:** a cold body “never ignited, so it has no size at all” is a stated PROPERTY, and testing work first makes it true by construction — triage really can discard a duplicate whose twin already routed and paid, and `updateIdea` never touches the ledger. **A REMNANT needs EVIDENCE, never the absence of an answer:** `share: 0` is a confirmed removal, `share: null` is an unreadable one, and ADR 0321 pays for that distinction upstream — so an idea with work and no readable facts is a STAR carrying `attributable: false`, because reading a falsy share as death turns one unmounted module into a sky of hollow rings. **A PROTOSTAR is the absence of WORK, not of a status:** ignition is being PAID for something, so a promoted-but-unshipped idea is still unignited, which is exactly what the nod queue exists for. **Position is a second axis** (`well` / `open-space` / `awaitingNod`) because the design says the object alone cannot carry it, and the nod is asked of EVERY task, not only the one that named the well. **`suggested_goal_id` is deliberately NOT a well** — `projection.js` records it as strictly advisory, the routing hint on a filing that did not convert, so reading it would put a thought in a nod queue with no task to promote; the binding `tasks.goal_id` now rides on both of the trail’s task joins at no extra round trip. The page reads the ledger ONCE: the state attach hands economy back the `byTask` breakdown size just computed, all of them or none (a partial map reads a missing entry as “no work” and draws a paid star as a protostar). An absent `reward` port does not empty the sky — states still resolve, flagged unattributable. Nothing writes; ADR 0313 stands. Rejected: resolving in each renderer; deriving from `share` alone (it merges a protostar with a remnant, the exact BV2.R19 distinction); treating an unreadable share as zero; status-first ordering; reading the hint as a home; a sixth object for “unknown brightness” (the vocabulary is the owner’s and is five — the uncertainty is a flag on the answer, not a new thing in the sky).](0322-a-remnant-needs-evidence-and-merged-wins.md) | ideas / economy |
 | 0323 | [**Hosting is three shapes, and we are not the landlord** ([task 1004140](https://cloudbongos.com/builders#/task/1004140), goal 1000106 — BONGOS-V2). Five projects ran as one Node process each on the control-plane droplet, about $0.80/month apiece — the cheapest arrangement available, bought with ~4,600 lines of `provision*.js` that write systemd units, create unix accounts, render Caddy snippets, `createdb`, install backup timers and count memory against a ceiling. That is the cost nobody priced: **we are a landlord.** The owner reframed the question — build on what others maintain, and let an owner keep the deployment platform they already use. **Seven decisions.** The shapes become `byo-host` (the owner runs it), `cloud-host` (we stand it up for them) and `dedicated-cloud-host` (the same path, larger plan); `co-tenant` is **retired, not renamed**, because it means *a process on our box from our checkout* — the opposite of bring-your-own-host, so reusing the name would make every existing comment lie. **DigitalOcean hosts hubs only**, which closes [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 by removing its precondition rather than hardening the cookie: with no customer code on a `cloudbongos.com` subdomain there is no tenant to receive the hub session. **Render is the default** — its Postgres carries PITR and automated backups on every paid tier; Fly's managed Postgres starts ~$38/mo and Railway's is explicitly unmanaged, which is the exact responsibility being shed. **Cloudflare is the front door, not the compute**: Workers is a V8-isolate runtime that would require rewriting Express and `pg`, and Containers is built for bursty workloads that sleep, which a hall with background sweeps and a live event stream does not survive. **No deployment-platform adapter is built at all** — their application already deploys itself from the repository, so the platform we do not talk to is the platform we do not have to add. **Secrets: the platform is the system of record and Bongos stores names, never values** — a manifest of name, purpose and environment, no application secret, no platform API token, no "is it set?" probe, because each of those makes us custodian of other companies' credentials for convenience the manifest already delivers; `byo-host` marks the manifest unverifiable rather than opening an exception. **The free tier becomes a capped trial**, since ~$14/project cannot be subsidised indefinitely. Per-project cost rises ~17×, which is the price of not being a landlord and the reason metering stops being deferred work. Mostly a DELETION: [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)'s supervision seam is not extended (Render supervises its own processes), [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) stays true and stops being load-bearing with its queued resize held rather than spent, and the hub's offsite backup becomes the highest-consequence open item. Rejected: AWS/GCP (2–3× the cost for a bare instance, plus an IAM and billing surface to learn — maintenance added where the goal is to remove it); keeping the shared box and fixing only the cookie (cheaper, closes the finding, leaves the landlord runner and answers nothing else); a Vercel/Netlify/Render adapter layer (speculative pluggability); Bongos as the secrets vault pushing values through platform APIs.](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) | hosting / provisioning / cost |
 | 0324 | [**The public npm CLI channel is retired** ([task 1004144](https://cloudbongos.com/builders#/task/1004144), goal 1000091 — BONGOS-V2). The owner deleted `@cloudbongos/cli` from the registry on 2026-09-22 (`npm view` → E404; the `@cloudbongos` scope is empty). This supersedes [ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) and [ADR 0292](0292-both-install-paths-stay-and-vendoring-is-the-production-one.md) §2 — the latter titled "`@cloudbongos/cli` STAYS, on a new justification" and written *because* task 1003872 proposed removing it once the public core flip dissolved its original reason. 0292's measured argument (~0.5 MB front door vs a 46 MB core pull to print a task list) is still true and is NOT what changed; the owner's decision about carrying a public channel at all is. `scripts/gds/build-cli-package.js` + `tests/cli_package.mjs` are deleted, no doc offers `npx @cloudbongos/cli`, and the way in is the hall at `<origin>/builders` or a checkout. The COMPILED binary channel (`build-bongos.js` → `/downloads/bongos/*` via `config/bongos-cli.json`) is a different artifact and is untouched — the same near-twin task 1003889 warned about. Three tests used the package's FILES manifest as a stand-in for "what a terminal user can run" and now read `bin/bongos.js`'s verb table, which is what that set always meant.](0324-the-public-npm-cli-channel-is-retired.md) | distribution / CLI |
-| 0325 | [**The managed fleet control plane is the hub we already run** ([task 1001948](https://cloudbongos.com/builders#/task/1001948), goal 1000106 — BONGOS-V2). The spike was written against [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7, which deferred the managed offering as **"genuinely greenfield (no fleet registry exists)"** behind two gates — Mercury and a real `bongos upgrade`. Both gates are shipped and **the premise is not**: measuring the call sites first changed the answer, as it did for [task 1004141](https://cloudbongos.com/builders#/task/1004141). The registry is `provisioning_instances` (owner, shape, domain, database, port, lifecycle, cost estimate, module selection, the liveness overlay and the served/available core-version snapshot), with `provisioning_intents` as the queue and `provisioning_events` as the audit trail; the operator is `scripts/gds/provision.js`, the single token-holder draining that queue behind ADR 0111 §2's trust boundary; oversight is `GET /provisioning/fleet` and `/fleet/cost-ledger`; and the update channel is not one mechanism but two shipped ones — the owner's per-instance deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md), health-gated with auto-rollback) and the opt-in patch-only sweep ([ADR 0136](0136-update-channel-subscription-policy.md)). **Decision: there is no greenfield fleet control plane to design, and none will be built — the hub IS it.** It never needed to sit *above* the per-repo databases [ADR 0100](0100-two-repo-instance-model.md) §3 locks: the roster is a hub table and the operator has never read one. The genuinely missing leg is a **platform leg** — `grep -rl RENDER_API scripts modules src` returns nothing, and after [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) a `cloud-host` is a Render service — and this ADR **deliberately specifies none of it**, because that is [task 1004142](https://cloudbongos.com/builders#/task/1004142)'s with those files open and a second spec for one implementation is how two drift. The fleet **driven** and the fleet **observed** are different populations: `byo-host` is in the registry and operated by nobody, its liveness the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull, so every operator surface must state which it counts — a roster that mixes them reports a fleet-wide upgrade as complete while an unknown number were never asked. The operator holds **exactly one** credential and it is **its own** (the platform account token, root-only on the control plane, never the web tier, never per-customer); ADR 0323 D6's "names, never values" rule is about the CUSTOMER's secrets and is unchanged. Two gaps are filed rather than fixed here: the subscription roster living in `config/update-subscriptions.json` is the one fleet fact the roster route cannot report and a restored backup can lose independently of the rows it describes ([task 1004150](https://cloudbongos.com/builders#/task/1004150), a recommendation and not a ruling), and **`costEstimateUsd` returns 0 for every shape but `dedicated`** — measured live, all 24 fleet rows report `$0`, confidently and with no error, for projects about to cost ~\$14/month each ([task 1004149](https://cloudbongos.com/builders#/task/1004149)). **No fleet-wide "upgrade everything" button**: both channels are per-instance by construction, and one action that moves the whole fleet is the shape most likely to take every customer down at once. AGPL posture unchanged — ADR 0111 §5's one-sentence rule survives its own table. Rejected: building the separate control plane §5 described (a second registry and a second operator holding the same rows with nothing keeping them equal); specifying Render here; reading per-instance databases for fleet reporting; and continuing to defer the whole layer, which is now the reason the ledger reads \$0 for a fleet about to cost real money.](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) | hosting / fleet / provisioning |
+| 0325 | [**The managed fleet control plane is the hub we already run** ([task 1001948](https://cloudbongos.com/builders#/task/1001948), goal 1000106 — BONGOS-V2). The spike was written against [ADR 0111](0111-instance-hosting-provisioning-module.md) §5/§7, which deferred the managed offering as **"genuinely greenfield (no fleet registry exists)"** behind two gates — Mercury and a real `bongos upgrade`. Both gates are shipped and **the premise is not**: measuring the call sites first changed the answer, as it did for [task 1004141](https://cloudbongos.com/builders#/task/1004141). The registry is `provisioning_instances` (owner, shape, domain, database, port, lifecycle, cost estimate, module selection, the liveness overlay and the served/available core-version snapshot), with `provisioning_intents` as the queue and `provisioning_events` as the audit trail; the operator is `scripts/gds/provision.js`, the single token-holder draining that queue behind ADR 0111 §2's trust boundary; oversight is `GET /provisioning/fleet` and `/fleet/cost-ledger`; and the update channel is not one mechanism but two shipped ones — the owner's per-instance deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md), health-gated with auto-rollback) and the opt-in patch-only sweep ([ADR 0136](0136-update-channel-subscription-policy.md)). **Decision: there is no greenfield fleet control plane to design, and none will be built — the hub IS it.** It never needed to sit *above* the per-repo databases [ADR 0100](0100-two-repo-instance-model.md) §3 locks: the roster is a hub table and the operator has never read one. The genuinely missing leg is a **platform leg** — `grep -rl RENDER_API scripts modules src` returns nothing, and after [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) a `cloud-host` is a Render service — and this ADR **deliberately specifies none of it**, because that is [task 1004142](https://cloudbongos.com/builders#/task/1004142)'s with those files open and a second spec for one implementation is how two drift. The fleet **driven** and the fleet **observed** are different populations: `byo-host` is in the registry and operated by nobody, its liveness the [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull, so every operator surface must state which it counts — a roster that mixes them reports a fleet-wide upgrade as complete while an unknown number were never asked. The operator holds **exactly one** credential and it is **its own** (the platform account token, root-only on the control plane, never the web tier, never per-customer); ADR 0323 D6's "names, never values" rule is about the CUSTOMER's secrets and is unchanged. Two gaps are filed rather than fixed here: the subscription roster living in `config/update-subscriptions.json` is the one fleet fact the roster route cannot report and a restored backup can lose independently of the rows it describes ([task 1004150](https://cloudbongos.com/builders#/task/1004150), a recommendation and not a ruling), and **`costEstimateUsd` returns 0 for every shape but `dedicated`** — measured live, all 24 fleet rows report `$0`, confidently and with no error, for projects about to cost ~\$14/month each ([task 1004148](https://cloudbongos.com/builders#/task/1004148)). **No fleet-wide "upgrade everything" button**: both channels are per-instance by construction, and one action that moves the whole fleet is the shape most likely to take every customer down at once. AGPL posture unchanged — ADR 0111 §5's one-sentence rule survives its own table. Rejected: building the separate control plane §5 described (a second registry and a second operator holding the same rows with nothing keeping them equal); specifying Render here; reading per-instance databases for fleet reporting; and continuing to defer the whole layer, which is now the reason the ledger reads \$0 for a fleet about to cost real money.](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) | hosting / fleet / provisioning |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1922 strings** across 3 surfaces · 1661 distinct pieces of copy · 1922 certain, 0 heuristic · 179 shown in more than one place.
+**1924 strings** across 3 surfaces · 1663 distinct pieces of copy · 1924 certain, 0 heuristic · 179 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 92 | 1427 |
+| `builders-hall` | `modules/hall-ui/public` | 92 | 1429 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 395 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `07f422cbdb7e` | 2x | ) and capture-resistant by design. | modules/public-landing/public/projects.html:1030, modules/public-landing/public/projects.html:1057 |
 | … | | _139 more in the JSON registry_ | |
 
-## `builders-hall` — 1427 strings
+## `builders-hall` — 1429 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -327,7 +327,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
 | `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:297` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:640` |
-| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:310` |
+| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:322` |
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:1133` |
 | `4cf6bc8b377b` | certain | Could not remove. Try again. | `modules/hall-ui/public/settings.js:1132` |
 | `7a778d188e87` | certain | Could not remove: {…} | `modules/hall-ui/public/government.js:369` |
@@ -376,6 +376,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/profile.html:94` |
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/settings.html:95` |
 | `24013a074724` | certain | Custom rank | `modules/hall-ui/public/government.html:113` |
+| `cf7d7d5d5e83` | certain | Database behind. | `modules/hall-ui/public/deploy.js:286` |
 | `6744aed3d15e` | certain | Dated exploit-detail engagement reports — kept out of the repo (threat-model §6.3) and served only to Archons. | `modules/hall-ui/public/watch.html:131` |
 | `7c6891813679` | certain | Default ({…}) | `modules/hall-ui/public/settings.js:63` |
 | `7ec7dc1adaa6` | certain | Deploy — {{worldName}} | `modules/hall-ui/public/deploy.html:6` |
@@ -639,7 +640,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f14a91b3f625` | certain | Most recent first. Each row is one recorded work session; every id on it opens its record. | `modules/hall-ui/public/sessions.html:56` |
 | `e52ae74f0052` | certain | Move to goal | `modules/hall-ui/public/task.js:581` |
 | `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:269` |
-| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:371` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:383` |
 | `393139f648b8` | certain | Moving to core | `modules/hall-ui/public/deploy.js:140` |
 | `ae84ebe1d735` | certain | Name cannot be blank. | `modules/hall-ui/public/settings.js:761` |
 | `31e91ee6ce03` | certain | Name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:766` |
@@ -676,7 +677,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2a6d7552e21f` | certain | No other sessions. | `modules/hall-ui/public/settings-sessions.js:64` |
 | `9f73b3f3dad0` | certain | No rank floor — any builder can claim this task | `modules/hall-ui/public/task-lib.js:62` |
 | `3fd0c6fcb92e` | certain | No request and no invite needed. Sign in with GitHub, and a step-by-step guide takes you the rest of the way. | `modules/hall-ui/public/hall-render.js:277` |
-| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:348` |
+| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:360` |
 | `9fb9f766450d` | certain | No sections yet | `modules/hall-ui/public/primer.js:130` |
 | `bef9fe43ba84` | certain | No sessions recorded yet. They land here as builders ship and end sessions. | `modules/hall-ui/public/sessions.js:146` |
 | `4485497d87bb` | certain | No specialities yet. Create one below — it takes a name and a craft, and you can train it afterwards. | `modules/hall-ui/public/settings-specialities.js:169` |
@@ -708,7 +709,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:1107` |
 | `905e99f158c2` | certain | Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps  | `modules/hall-ui/public/goals-render.js:1012` |
 | `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:843` |
-| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:292` |
+| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:303` |
 | `073d7fb013ae` | certain | Nothing of yours is {…} right now. | `modules/hall-ui/public/thinking.js:311` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:242` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/work.js:1068` |
@@ -899,7 +900,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7e1d54119e08` | certain | Select task {…} for bulk release | `modules/hall-ui/public/work.js:242` |
 | `ae43a132699b` | certain | Selectable today | `modules/hall-ui/public/government.js:799` |
 | `53cc6d8dd23c` | certain | Send invitation | `modules/hall-ui/public/goals-render.js:1211` |
-| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:295` |
+| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:306` |
 | `64a1f055129e` | certain | Session card richness | `modules/hall-ui/public/settings-render.js:83` |
 | `d14e8e9acaff` | certain | Session ended. | `modules/hall-ui/public/settings-sessions.js:81` |
 | `55e0a34bafed` | certain | Session log{…} | `modules/hall-ui/public/task.js:487` |
@@ -954,7 +955,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ec1c2dae4a90` | certain | Standing there | `modules/hall-ui/public/profile.js:314` |
 | `eaad12cacb9d` | certain | Start over | `modules/hall-ui/public/studio.js:235` |
 | `efe530c0e3a7` | certain | Still open | `modules/hall-ui/public/profile.js:494` |
-| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:407` |
+| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:419` |
 | `9a4ced1afb6c` | certain | Stop waiting on task {…} | `modules/hall-ui/public/task.js:278` |
 | `b0861c874a2f` | certain | Stopped using it. | `modules/hall-ui/public/settings-specialities.js:200` |
 | `6c6544f5c011` | certain | Stored encrypted; never shown again after saving — only its last four digits. | `modules/hall-ui/public/settings.html:193` |
@@ -1082,7 +1083,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/government.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/project-settings.html:36` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:40` |
-| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:340` |
+| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:352` |
+| `3c8aaec39c40` | certain | This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies | `modules/hall-ui/public/deploy.js:286` |
 | `6e9dfe1fb903` | certain | This restarts {…} onto core | `modules/hall-ui/public/deploy.js:269` |
 | `69e8beced2ff` | certain | This sends the idea back to its author. Say why, and which section. | `modules/hall-ui/public/board-room.js:363` |
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:422` |
@@ -1348,7 +1350,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fb1dad96280` | certain | pending, on the People tab | `modules/hall-ui/public/watch.html:46` |
 | `3b22c5af029b` | certain | rank or above, or that it is your own. | `modules/hall-ui/public/copy-desk.html:47` |
 | `80ddf28baee7` | certain | rank-key (kebab-case) | `modules/hall-ui/public/government.html:82` |
-| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:352` |
+| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:364` |
 | `f83f0a9d6b6a` | certain | recorded, on the Operations tab | `modules/hall-ui/public/watch.html:49` |
 | `26da1df6fd4a` | certain | reflects it. | `modules/hall-ui/public/settings.html:136` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:84` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1922,
-    "unique_ids": 1661,
-    "certain": 1922,
+    "strings": 1924,
+    "unique_ids": 1663,
+    "certain": 1924,
     "heuristic": 0,
     "duplicate_ids": 179
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 92,
-      "strings": 1427
+      "strings": 1429
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -1067,7 +1067,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/deploy.js:269",
-        "modules/hall-ui/public/deploy.js:371"
+        "modules/hall-ui/public/deploy.js:383"
       ]
     },
     {
@@ -4122,7 +4122,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 310,
+      "line": 322,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4558,6 +4558,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "cf7d7d5d5e83",
+      "surface": "builders-hall",
+      "text": "Database behind.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 286,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "6744aed3d15e",
       "surface": "builders-hall",
@@ -6930,7 +6939,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 371,
+      "line": 383,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7263,7 +7272,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 348,
+      "line": 360,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7551,7 +7560,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 292,
+      "line": 303,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9270,7 +9279,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 295,
+      "line": 306,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9765,7 +9774,7 @@
       "surface": "builders-hall",
       "text": "Still working on core {…}. It keeps going without this page — reload to see where it got to.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 407,
+      "line": 419,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -10917,7 +10926,16 @@
       "surface": "builders-hall",
       "text": "This platform",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 340,
+      "line": 352,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "3c8aaec39c40",
+      "surface": "builders-hall",
+      "text": "This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies on {…} may fail until the migrations run.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 286,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13311,7 +13329,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 352,
+      "line": 364,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2386,5 +2386,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.954 with no explicit bump. run 35690089430. (task 1002620)
   1.19.956 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.955 with no explicit bump. run 35691908420. (task 1002620)
+  1.19.957 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.956 with no explicit bump. run 35692861666. (task 1002620)
+  1.19.958 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.957 with no explicit bump. run 35735231183. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/deploy.js

@@ -277,6 +277,17 @@
       </div>`;
   }
 
+  // "Database behind" (task 1004153): the box's code ships migrations its database has not
+  // applied, e.g. after an upgrade with --skip-migrate. Silent at 0 AND at null — null is an
+  // unknown reading, and the no-answer note above already speaks for a box that did not answer.
+  function schemaBehindHtml(p) {
+    const n = p.schema_pending;
+    if (!Number.isInteger(n) || n <= 0) return '';
+    return `<p class="ps-invalid"><strong>Database behind.</strong> This project's code expects
+      ${escapeHtml(String(n))} database change${n === 1 ? '' : 's'} that its database has not applied yet.
+      Anything that relies on ${n === 1 ? 'it' : 'them'} may fail until the migrations run.</p>`;
+  }
+
   // One box's card. `isSelf` only changes the words, never what is offered: the runner
   // treats the platform's own row and a tenant's identically, and a page that implied
   // otherwise would be describing a rule that does not exist.
@@ -299,6 +310,7 @@
         ${p.reading === 'no_answer'
           ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
           : ''}
+        ${schemaBehindHtml(p)}
         ${action}
       </div></li>`;
   }

package/modules/provisioning/core-upgrade.js

@@ -259,6 +259,9 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     // Named so the UI cannot accidentally render "up to date" over a missing reading.
     reading: served ? 'ok' : 'no_answer',
     observed_at: (snap && snap.observed_at) || null,
+    // Migrations the box's code ships that its database has not applied (task 1004153).
+    // null is UNKNOWN, not zero — an old core, or a box that did not answer.
+    schema_pending: snap && Number.isInteger(snap.schema_pending) ? snap.schema_pending : null,
     // What the upgrade SAYS it would do, from the runner's dry run (task 1004121).
     // Withheld unless it was taken against the move now on offer: a verdict about
     // 1.19.920 tells the owner nothing true about pressing a button that says 1.19.921,

package/modules/provisioning/migrations/provisioning_024_snapshot_schema_pending.sql

@@ -0,0 +1,17 @@
+-- provisioning_024 — each box's schemaPending in the core-version snapshot (task 1004153,
+-- from idea 1001088).
+--
+-- /version reports `schemaPending`: core + enabled-module migrations the running code ships
+-- that the instance's own database has not recorded. Only the instance a checkout talks to
+-- was ever watched for it (the SessionStart divergence line); co-tenants were not. A
+-- co-tenant upgraded with --skip-migrate (mercury has no scripts.migrate) serves new code
+-- over an old schema and nothing said so. The runner already reads each box's loopback
+-- /version on every tick for served_version; this stores the other half of that answer.
+--
+-- NULL means UNKNOWN — the box did not answer, or runs a core older than the field — and
+-- is a different state from 0. The control must not render one as the other.
+--
+-- Additive, idempotent, no down-migration.
+
+ALTER TABLE provisioning_core_version_snapshot
+  ADD COLUMN IF NOT EXISTS schema_pending integer;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.956",
+  "version": "1.19.958",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.956",
+      "version": "1.19.958",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.956",
+  "version": "1.19.958",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-core-upgrade.js

@@ -72,6 +72,21 @@ function parseServedVersion(stdout) {
   return m ? m[0] : null;
 }
 
+/**
+ * The `schemaPending` count from a /version body — migrations the box's code ships that its
+ * own database has not recorded (task 1004153). PURE.
+ *
+ * null means UNKNOWN (no answer, not JSON, or a core older than the field), never 0: a
+ * co-tenant that cannot say must not read as one whose database is current. Bounded the
+ * same way scripts/gds/deploy-divergence.js bounds it, since the body is a network answer.
+ */
+function parseSchemaPending(stdout) {
+  if (!stdout || typeof stdout !== 'string') return null;
+  let n;
+  try { n = JSON.parse(stdout).schemaPending; } catch { return null; }
+  return Number.isInteger(n) && n >= 0 && n <= 100000 ? n : null;
+}
+
 /**
  * Is this target a version the instance may actually be moved to? PURE.
  *
@@ -466,7 +481,9 @@ async function snapshotCoreVersions(inst, deps) {
   const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
   try {
     const probe = boxExec(versionCmd(inst), { allowFail: true });
-    const served = parseServedVersion(probe && !probe.softFailed ? (probe.stdout || '') : null);
+    const body = probe && !probe.softFailed ? (probe.stdout || '') : null;
+    const served = parseServedVersion(body);
+    const schemaPending = parseSchemaPending(body);
     const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
     const available = (listed && listed.versions) || [];
     // What the channel would take FROM the version the box is actually on. Resolving it
@@ -486,18 +503,19 @@ async function snapshotCoreVersions(inst, deps) {
     const preflight = null;
     await db.query(
       `INSERT INTO provisioning_core_version_snapshot
-         (instance_id, served_version, available, recommended, observed_at, preflight, preflight_at)
-       VALUES ($1, $2, $3::jsonb, $4, now(), $5::jsonb, $6)
+         (instance_id, served_version, available, recommended, observed_at, preflight, preflight_at, schema_pending)
+       VALUES ($1, $2, $3::jsonb, $4, now(), $5::jsonb, $6, $7)
        ON CONFLICT (instance_id) DO UPDATE
          SET served_version = EXCLUDED.served_version, available = EXCLUDED.available,
              recommended = EXCLUDED.recommended, observed_at = now(),
+             schema_pending = EXCLUDED.schema_pending,
              -- A tick with nothing to preview must not ERASE the last verdict; it simply
              -- has nothing newer to say. Only a real dry run overwrites one.
              preflight = COALESCE(EXCLUDED.preflight, provisioning_core_version_snapshot.preflight),
              preflight_at = COALESCE(EXCLUDED.preflight_at, provisioning_core_version_snapshot.preflight_at)`,
       [inst.id, served, JSON.stringify(available), recommended || null,
-       preflight ? JSON.stringify(preflight) : null, preflight ? new Date() : null]);
-    return { ok: true, served, available: available.length, preflight };
+       preflight ? JSON.stringify(preflight) : null, preflight ? new Date() : null, schemaPending]);
+    return { ok: true, served, available: available.length, preflight, schemaPending };
   } catch (e) {
     log(`  ~ core-version snapshot for ${inst.slug} skipped (${(e && e.message) || e})`);
     return { ok: true, skipped: true };
@@ -519,4 +537,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.956'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.958'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -404,6 +404,15 @@ await t('no snapshot at all reports observed_at:null rather than a confident-loo
   assert.equal(p.available_count, 0);
 });
 
+await t('schema_pending passes through as a count, and UNKNOWN stays null rather than reading as 0 (task 1004153)', () => {
+  const snap = { served_version: '1.19.758', available: [], recommended: null, observed_at: 'x' };
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: 3 }, null).schema_pending, 3);
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: 0 }, null).schema_pending, 0);
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: null }, null).schema_pending, null);
+  assert.equal(CU.previewFromSnapshot(previewInst, snap, null).schema_pending, null, 'a row written before provisioning_024');
+  assert.equal(CU.previewFromSnapshot(previewInst, undefined, null).schema_pending, null, 'no snapshot at all');
+});
+
 await t('an open intent is surfaced with its target, so the page can say what is already running', () => {
   const p = CU.previewFromSnapshot(previewInst, { served_version: '1.19.758', available: [], recommended: null },
     { action: 'core-upgrade', state: 'running', target_version: '1.19.762' });

package/tests/core_upgrade_runner.mjs

@@ -30,6 +30,8 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+// An ESM named import, not R.parseSchemaPending: knip credits a CJS export only when a test imports it this way.
+import { parseSchemaPending } from '../scripts/gds/provision-core-upgrade.js';
 
 const require = createRequire(import.meta.url);
 const R = require('../scripts/gds/provision-core-upgrade.js');
@@ -404,6 +406,37 @@ await t('a box that does not answer still writes a snapshot — a NULL reading i
   assert.equal(w.params[3], null, 'and nothing is recommended against a version we could not read');
 });
 
+await t('parseSchemaPending reads the count, and anything it cannot trust is null — never 0 (task 1004153)', () => {
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.953', schemaPending: 3 })), 3);
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.953', schemaPending: 0 })), 0);
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.700' })), null, 'a core older than the field');
+  assert.equal(parseSchemaPending(JSON.stringify({ schemaPending: null })), null, 'the box itself does not know');
+  for (const bad of [-1, 1.5, '3', 100001]) {
+    assert.equal(parseSchemaPending(JSON.stringify({ schemaPending: bad })), null, `schemaPending=${JSON.stringify(bad)}`);
+  }
+  assert.equal(parseSchemaPending('cloudbongos 1.19.762 (ok)'), null, 'not JSON');
+  assert.equal(parseSchemaPending(''), null);
+  assert.equal(parseSchemaPending(null), null);
+});
+
+await t('the snapshot stores the box\'s schemaPending next to its served version (task 1004153)', async () => {
+  const queries = [];
+  const d = makeDeps({ queries });
+  d.exec = (cmd) => ({ ok: true, stdout: /\/version/.test(cmd) ? JSON.stringify({ coreVersion: '1.19.760', schemaPending: 4 }) : '' });
+  const r = await R.snapshotCoreVersions(inst(), d);
+  const w = queries.find((q) => /provisioning_core_version_snapshot/.test(q.sql));
+  assert.match(w.sql, /schema_pending = EXCLUDED\.schema_pending/, 'a re-read replaces the old count');
+  assert.equal(w.params[6], 4);
+  assert.equal(r.schemaPending, 4);
+});
+
+await t('a box that does not answer stores schema_pending NULL, not a clean 0', async () => {
+  const queries = [];
+  await R.snapshotCoreVersions(inst(), makeDeps({ served: null, queries }));
+  const w = queries.find((q) => /provisioning_core_version_snapshot/.test(q.sql));
+  assert.equal(w.params[6], null);
+});
+
 await t('a shape the runner cannot reach is skipped entirely — no snapshot, no claim about it', async () => {
   const queries = [];
   const r = await R.snapshotCoreVersions(inst({ hosting_shape: 'dedicated' }), makeDeps({ queries }));

package/tests/deploy_page_projects.mjs

@@ -181,6 +181,20 @@ test('a box that did not answer is never rendered as up to date', async () => {
   assert.doesNotMatch(html, /id="dp-preview-1"/, 'and is offered no move');
 });
 
+test('a box whose database is behind its code says so (task 1004153)', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { schema_pending: 2 }) });
+  await b.settle();
+  assert.match(b.panel(), /Database behind\.<\/strong> This project's code expects\s+2 database changes/);
+});
+
+test('a database that is current, or whose state is unknown, gets no "behind" flag', async () => {
+  for (const schema_pending of [0, null, undefined]) {
+    const b = boot({ controlPlane: preview('1', 'cloudbongos', { schema_pending }) });
+    await b.settle();
+    assert.doesNotMatch(b.panel(), /Database behind/, `schema_pending=${schema_pending}`);
+  }
+});
+
 test('an unenrolled control plane still lets the projects through', async () => {
   // The regression this pins: the platform's own missing row used to be the whole
   // page, so one un-run setup command would hide every project too.