@bongos/core 1.19.957 → 1.19.958

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.957",
-  "core_contract": "1.19.957",
-  "source_commit": "48e752cc136cf78939c24f100a08934f3516ed57",
+  "core_version": "1.19.958",
+  "core_contract": "1.19.958",
+  "source_commit": "8b7c56c98aae1497c594219c7ae761ce54c60f8b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T05:59:48.593Z",
+  "built_at": "2026-09-22T13:42:54.493Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 514,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2357,
+    "functional_verbatim": 2358,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2897,
-  "tree_sha256": "3689a1fe6b51b1bde5cd80dc5e42e2111685ccd0ebc8f39c411ac17f4e1ff040",
+  "file_count": 2898,
+  "tree_sha256": "1dd23da0216fa29e9f848ba037a788cf0cfa9d0a55fea04ffb7eba833b142541",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2157,12 +2157,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "ea08a06744310c312420c4af1e0f67154e324fe2be552b6d5c2fc683e18a63e8"
+      "sha256": "77cb83609d2a80e2c7520746181ef858839d37e8c0997b5dce42127d0c4c119c"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "45091c4acfe82fa8968be566f8b14f414ee3df68772b13617cba55735de93d1e"
+      "sha256": "8d83ca0d16a1f9d0efc89f0331f6940592ce34e0dd6f92c448575497bce96548"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2692,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d24452f51a99862ee117d68ebed98474ef8599cbbad464ad4ea07f19e760f528"
+      "sha256": "25f1d655a540764066d47dcd30fc53451e253377c57ac1647d3dc3128928a385"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4822,7 +4822,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "fca8216900a7ff1d0b48f87e3fd223ae15e61346980ba68e7721801fb971157a"
+      "sha256": "e3a4fa62e761dddfb54a1f13680eb64ff87c4d37e83fa41a846ebfe1f41d44c8"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -6542,7 +6542,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "d6ba41f0bdb775191f94a1b57903a3f22cee68a8e7552be92f6112d86b4090fd"
+      "sha256": "96c6b73411a489e5c41fd567123fa8ef35f7a757db0e1df0c0cafd720674b05f"
     },
     {
       "path": "modules/provisioning/credential-preflight.js",
@@ -6674,6 +6674,11 @@
       "mode": "0000644",
       "sha256": "1fb60b17c411d9529f4c0ecd0b3d1efc9b2061567a1b31bf74fa706e2e83b3d7"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_024_snapshot_schema_pending.sql",
+      "mode": "0000644",
+      "sha256": "1287440b0088a6451dd4df234e578e06fc6f3e892915e64cd6c6e1f09dadd9d5"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -8077,12 +8082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e6926dbbee5927840a3de03f03dff14b05a04ecdc2dd974941f93cca760c745e"
+      "sha256": "83b00099cd3853c2bf7ca568043852caec477bace90cb26921122a525ed0bfc8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4f9672ddf0e6238c689b8884f85fdb3a5c85174b934d0ab57c79d8bd49acab6a"
+      "sha256": "8f3e2b77a4b6f11f1eb2ffe270ea5fe212d959a1dd0db7eab501808423df8ef4"
     },
     {
       "path": "public-docs/index.html",
@@ -9027,7 +9032,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "4a84f48518a6427e95bf23e273865b6b2753489b40737b9256191fd2a65562e1"
+      "sha256": "f22c31d00a50a312d7228922cbe70fedc503e704cc7f2cb33a8686a4954c1c1e"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -10087,7 +10092,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fdab385d81b456d0cf1197085a21cac0e3e57b6d89a8a7c890d10248a16f25bf"
+      "sha256": "afe264ed7d639f350d12b51e28f13d9a5a604bac89b110dcad7b38a415334df3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10992,12 +10997,12 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "7333e05011a080e5ac3a54bb1b07fb421db848ee2eb54c786f36c43058b9e587"
+      "sha256": "c4238e2f2e2c52f23fb6948f5e6545bc4880efe75eb9af229a455db6017db05c"
     },
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "f8bc5b5329c4de27b41a9172e6b5023c4854d864f532aac3ed062e0d35633f00"
+      "sha256": "85bc665f5d80ff1c7e8134e6be7dd8fa336b4fb50344164b034b0e72a963f04d"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11142,7 +11147,7 @@
     {
       "path": "tests/deploy_page_projects.mjs",
       "mode": "0000644",
-      "sha256": "cec0141f75e41dc268d9377db4925d8b8f0f6e9eb9b6b3c6b6c7c1eb07e75ac8"
+      "sha256": "5c582192ddd83ef289be692b12d898c8837b54312348751082478d036987a647"
     },
     {
       "path": "tests/design_tokens_sync.mjs",

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1922 strings** across 3 surfaces · 1661 distinct pieces of copy · 1922 certain, 0 heuristic · 179 shown in more than one place.
+**1924 strings** across 3 surfaces · 1663 distinct pieces of copy · 1924 certain, 0 heuristic · 179 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 92 | 1427 |
+| `builders-hall` | `modules/hall-ui/public` | 92 | 1429 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 5 | 395 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `07f422cbdb7e` | 2x | ) and capture-resistant by design. | modules/public-landing/public/projects.html:1030, modules/public-landing/public/projects.html:1057 |
 | … | | _139 more in the JSON registry_ | |
 
-## `builders-hall` — 1427 strings
+## `builders-hall` — 1429 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -327,7 +327,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
 | `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:297` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:640` |
-| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:310` |
+| `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:322` |
 | `8b470cebf53d` | certain | Could not remove your key. Try again. | `modules/hall-ui/public/settings.js:1133` |
 | `4cf6bc8b377b` | certain | Could not remove. Try again. | `modules/hall-ui/public/settings.js:1132` |
 | `7a778d188e87` | certain | Could not remove: {…} | `modules/hall-ui/public/government.js:369` |
@@ -376,6 +376,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/profile.html:94` |
 | `a55e423263f0` | certain | Cross-project record | `modules/hall-ui/public/settings.html:95` |
 | `24013a074724` | certain | Custom rank | `modules/hall-ui/public/government.html:113` |
+| `cf7d7d5d5e83` | certain | Database behind. | `modules/hall-ui/public/deploy.js:286` |
 | `6744aed3d15e` | certain | Dated exploit-detail engagement reports — kept out of the repo (threat-model §6.3) and served only to Archons. | `modules/hall-ui/public/watch.html:131` |
 | `7c6891813679` | certain | Default ({…}) | `modules/hall-ui/public/settings.js:63` |
 | `7ec7dc1adaa6` | certain | Deploy — {{worldName}} | `modules/hall-ui/public/deploy.html:6` |
@@ -639,7 +640,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f14a91b3f625` | certain | Most recent first. Each row is one recorded work session; every id on it opens its record. | `modules/hall-ui/public/sessions.html:56` |
 | `e52ae74f0052` | certain | Move to goal | `modules/hall-ui/public/task.js:581` |
 | `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:269` |
-| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:371` |
+| `e77d5f3beaef` | certain | Move to {…} | `modules/hall-ui/public/deploy.js:383` |
 | `393139f648b8` | certain | Moving to core | `modules/hall-ui/public/deploy.js:140` |
 | `ae84ebe1d735` | certain | Name cannot be blank. | `modules/hall-ui/public/settings.js:761` |
 | `31e91ee6ce03` | certain | Name must be {…} characters or fewer. | `modules/hall-ui/public/settings.js:766` |
@@ -676,7 +677,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2a6d7552e21f` | certain | No other sessions. | `modules/hall-ui/public/settings-sessions.js:64` |
 | `9f73b3f3dad0` | certain | No rank floor — any builder can claim this task | `modules/hall-ui/public/task-lib.js:62` |
 | `3fd0c6fcb92e` | certain | No request and no invite needed. Sign in with GitHub, and a step-by-step guide takes you the rest of the way. | `modules/hall-ui/public/hall-render.js:277` |
-| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:348` |
+| `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:360` |
 | `9fb9f766450d` | certain | No sections yet | `modules/hall-ui/public/primer.js:130` |
 | `bef9fe43ba84` | certain | No sessions recorded yet. They land here as builders ship and end sessions. | `modules/hall-ui/public/sessions.js:146` |
 | `4485497d87bb` | certain | No specialities yet. Create one below — it takes a name and a craft, and you can train it afterwards. | `modules/hall-ui/public/settings-specialities.js:169` |
@@ -708,7 +709,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fec5d78497e8` | certain | Nothing in the backlog right now. | `modules/hall-ui/public/work.js:1107` |
 | `905e99f158c2` | certain | Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps  | `modules/hall-ui/public/goals-render.js:1012` |
 | `2ec0fbb20a42` | certain | Nothing is waiting. A spark appears here when its author offers a quick idea up for development. | `modules/hall-ui/public/ideas.js:843` |
-| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:292` |
+| `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:303` |
 | `073d7fb013ae` | certain | Nothing of yours is {…} right now. | `modules/hall-ui/public/thinking.js:311` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:242` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/work.js:1068` |
@@ -899,7 +900,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7e1d54119e08` | certain | Select task {…} for bulk release | `modules/hall-ui/public/work.js:242` |
 | `ae43a132699b` | certain | Selectable today | `modules/hall-ui/public/government.js:799` |
 | `53cc6d8dd23c` | certain | Send invitation | `modules/hall-ui/public/goals-render.js:1211` |
-| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:295` |
+| `a39b0f9d86e5` | certain | Serving {…} — read from the box itself, {…}. | `modules/hall-ui/public/deploy.js:306` |
 | `64a1f055129e` | certain | Session card richness | `modules/hall-ui/public/settings-render.js:83` |
 | `d14e8e9acaff` | certain | Session ended. | `modules/hall-ui/public/settings-sessions.js:81` |
 | `55e0a34bafed` | certain | Session log{…} | `modules/hall-ui/public/task.js:487` |
@@ -954,7 +955,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ec1c2dae4a90` | certain | Standing there | `modules/hall-ui/public/profile.js:314` |
 | `eaad12cacb9d` | certain | Start over | `modules/hall-ui/public/studio.js:235` |
 | `efe530c0e3a7` | certain | Still open | `modules/hall-ui/public/profile.js:494` |
-| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:407` |
+| `490a3cbb8c1c` | certain | Still working on core {…}. It keeps going without this page — reload to see where it got to. | `modules/hall-ui/public/deploy.js:419` |
 | `9a4ced1afb6c` | certain | Stop waiting on task {…} | `modules/hall-ui/public/task.js:278` |
 | `b0861c874a2f` | certain | Stopped using it. | `modules/hall-ui/public/settings-specialities.js:200` |
 | `6c6544f5c011` | certain | Stored encrypted; never shown again after saving — only its last four digits. | `modules/hall-ui/public/settings.html:193` |
@@ -1082,7 +1083,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/government.html:37` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/project-settings.html:36` |
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:40` |
-| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:340` |
+| `f93fcb24c6ba` | certain | This platform | `modules/hall-ui/public/deploy.js:352` |
+| `3c8aaec39c40` | certain | This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies | `modules/hall-ui/public/deploy.js:286` |
 | `6e9dfe1fb903` | certain | This restarts {…} onto core | `modules/hall-ui/public/deploy.js:269` |
 | `69e8beced2ff` | certain | This sends the idea back to its author. Say why, and which section. | `modules/hall-ui/public/board-room.js:363` |
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:422` |
@@ -1348,7 +1350,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fb1dad96280` | certain | pending, on the People tab | `modules/hall-ui/public/watch.html:46` |
 | `3b22c5af029b` | certain | rank or above, or that it is your own. | `modules/hall-ui/public/copy-desk.html:47` |
 | `80ddf28baee7` | certain | rank-key (kebab-case) | `modules/hall-ui/public/government.html:82` |
-| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:352` |
+| `41a4b66c21e5` | certain | reads the control plane's own observation · ADR 0293 · every move is recorded with who asked | `modules/hall-ui/public/deploy.js:364` |
 | `f83f0a9d6b6a` | certain | recorded, on the Operations tab | `modules/hall-ui/public/watch.html:49` |
 | `26da1df6fd4a` | certain | reflects it. | `modules/hall-ui/public/settings.html:136` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:84` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1922,
-    "unique_ids": 1661,
-    "certain": 1922,
+    "strings": 1924,
+    "unique_ids": 1663,
+    "certain": 1924,
     "heuristic": 0,
     "duplicate_ids": 179
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 92,
-      "strings": 1427
+      "strings": 1429
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -1067,7 +1067,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/deploy.js:269",
-        "modules/hall-ui/public/deploy.js:371"
+        "modules/hall-ui/public/deploy.js:383"
       ]
     },
     {
@@ -4122,7 +4122,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 310,
+      "line": 322,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4558,6 +4558,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "cf7d7d5d5e83",
+      "surface": "builders-hall",
+      "text": "Database behind.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 286,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "6744aed3d15e",
       "surface": "builders-hall",
@@ -6930,7 +6939,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 371,
+      "line": 383,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7263,7 +7272,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 348,
+      "line": 360,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7551,7 +7560,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 292,
+      "line": 303,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9270,7 +9279,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 295,
+      "line": 306,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9765,7 +9774,7 @@
       "surface": "builders-hall",
       "text": "Still working on core {…}. It keeps going without this page — reload to see where it got to.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 407,
+      "line": 419,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -10917,7 +10926,16 @@
       "surface": "builders-hall",
       "text": "This platform",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 340,
+      "line": 352,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "3c8aaec39c40",
+      "surface": "builders-hall",
+      "text": "This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies on {…} may fail until the migrations run.",
+      "file": "modules/hall-ui/public/deploy.js",
+      "line": 286,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13311,7 +13329,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 352,
+      "line": 364,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2388,5 +2388,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.955 with no explicit bump. run 35691908420. (task 1002620)
   1.19.957 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.956 with no explicit bump. run 35692861666. (task 1002620)
+  1.19.958 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.957 with no explicit bump. run 35735231183. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/deploy.js

@@ -277,6 +277,17 @@
       </div>`;
   }
 
+  // "Database behind" (task 1004153): the box's code ships migrations its database has not
+  // applied, e.g. after an upgrade with --skip-migrate. Silent at 0 AND at null — null is an
+  // unknown reading, and the no-answer note above already speaks for a box that did not answer.
+  function schemaBehindHtml(p) {
+    const n = p.schema_pending;
+    if (!Number.isInteger(n) || n <= 0) return '';
+    return `<p class="ps-invalid"><strong>Database behind.</strong> This project's code expects
+      ${escapeHtml(String(n))} database change${n === 1 ? '' : 's'} that its database has not applied yet.
+      Anything that relies on ${n === 1 ? 'it' : 'them'} may fail until the migrations run.</p>`;
+  }
+
   // One box's card. `isSelf` only changes the words, never what is offered: the runner
   // treats the platform's own row and a tenant's identically, and a page that implied
   // otherwise would be describing a rule that does not exist.
@@ -299,6 +310,7 @@
         ${p.reading === 'no_answer'
           ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
           : ''}
+        ${schemaBehindHtml(p)}
         ${action}
       </div></li>`;
   }

package/modules/provisioning/core-upgrade.js

@@ -259,6 +259,9 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     // Named so the UI cannot accidentally render "up to date" over a missing reading.
     reading: served ? 'ok' : 'no_answer',
     observed_at: (snap && snap.observed_at) || null,
+    // Migrations the box's code ships that its database has not applied (task 1004153).
+    // null is UNKNOWN, not zero — an old core, or a box that did not answer.
+    schema_pending: snap && Number.isInteger(snap.schema_pending) ? snap.schema_pending : null,
     // What the upgrade SAYS it would do, from the runner's dry run (task 1004121).
     // Withheld unless it was taken against the move now on offer: a verdict about
     // 1.19.920 tells the owner nothing true about pressing a button that says 1.19.921,

package/modules/provisioning/migrations/provisioning_024_snapshot_schema_pending.sql

@@ -0,0 +1,17 @@
+-- provisioning_024 — each box's schemaPending in the core-version snapshot (task 1004153,
+-- from idea 1001088).
+--
+-- /version reports `schemaPending`: core + enabled-module migrations the running code ships
+-- that the instance's own database has not recorded. Only the instance a checkout talks to
+-- was ever watched for it (the SessionStart divergence line); co-tenants were not. A
+-- co-tenant upgraded with --skip-migrate (mercury has no scripts.migrate) serves new code
+-- over an old schema and nothing said so. The runner already reads each box's loopback
+-- /version on every tick for served_version; this stores the other half of that answer.
+--
+-- NULL means UNKNOWN — the box did not answer, or runs a core older than the field — and
+-- is a different state from 0. The control must not render one as the other.
+--
+-- Additive, idempotent, no down-migration.
+
+ALTER TABLE provisioning_core_version_snapshot
+  ADD COLUMN IF NOT EXISTS schema_pending integer;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.957",
+  "version": "1.19.958",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.957",
+      "version": "1.19.958",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.957",
+  "version": "1.19.958",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-core-upgrade.js

@@ -72,6 +72,21 @@ function parseServedVersion(stdout) {
   return m ? m[0] : null;
 }
 
+/**
+ * The `schemaPending` count from a /version body — migrations the box's code ships that its
+ * own database has not recorded (task 1004153). PURE.
+ *
+ * null means UNKNOWN (no answer, not JSON, or a core older than the field), never 0: a
+ * co-tenant that cannot say must not read as one whose database is current. Bounded the
+ * same way scripts/gds/deploy-divergence.js bounds it, since the body is a network answer.
+ */
+function parseSchemaPending(stdout) {
+  if (!stdout || typeof stdout !== 'string') return null;
+  let n;
+  try { n = JSON.parse(stdout).schemaPending; } catch { return null; }
+  return Number.isInteger(n) && n >= 0 && n <= 100000 ? n : null;
+}
+
 /**
  * Is this target a version the instance may actually be moved to? PURE.
  *
@@ -466,7 +481,9 @@ async function snapshotCoreVersions(inst, deps) {
   const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
   try {
     const probe = boxExec(versionCmd(inst), { allowFail: true });
-    const served = parseServedVersion(probe && !probe.softFailed ? (probe.stdout || '') : null);
+    const body = probe && !probe.softFailed ? (probe.stdout || '') : null;
+    const served = parseServedVersion(body);
+    const schemaPending = parseSchemaPending(body);
     const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
     const available = (listed && listed.versions) || [];
     // What the channel would take FROM the version the box is actually on. Resolving it
@@ -486,18 +503,19 @@ async function snapshotCoreVersions(inst, deps) {
     const preflight = null;
     await db.query(
       `INSERT INTO provisioning_core_version_snapshot
-         (instance_id, served_version, available, recommended, observed_at, preflight, preflight_at)
-       VALUES ($1, $2, $3::jsonb, $4, now(), $5::jsonb, $6)
+         (instance_id, served_version, available, recommended, observed_at, preflight, preflight_at, schema_pending)
+       VALUES ($1, $2, $3::jsonb, $4, now(), $5::jsonb, $6, $7)
        ON CONFLICT (instance_id) DO UPDATE
          SET served_version = EXCLUDED.served_version, available = EXCLUDED.available,
              recommended = EXCLUDED.recommended, observed_at = now(),
+             schema_pending = EXCLUDED.schema_pending,
              -- A tick with nothing to preview must not ERASE the last verdict; it simply
              -- has nothing newer to say. Only a real dry run overwrites one.
              preflight = COALESCE(EXCLUDED.preflight, provisioning_core_version_snapshot.preflight),
              preflight_at = COALESCE(EXCLUDED.preflight_at, provisioning_core_version_snapshot.preflight_at)`,
       [inst.id, served, JSON.stringify(available), recommended || null,
-       preflight ? JSON.stringify(preflight) : null, preflight ? new Date() : null]);
-    return { ok: true, served, available: available.length, preflight };
+       preflight ? JSON.stringify(preflight) : null, preflight ? new Date() : null, schemaPending]);
+    return { ok: true, served, available: available.length, preflight, schemaPending };
   } catch (e) {
     log(`  ~ core-version snapshot for ${inst.slug} skipped (${(e && e.message) || e})`);
     return { ok: true, skipped: true };
@@ -519,4 +537,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.957'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.958'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -404,6 +404,15 @@ await t('no snapshot at all reports observed_at:null rather than a confident-loo
   assert.equal(p.available_count, 0);
 });
 
+await t('schema_pending passes through as a count, and UNKNOWN stays null rather than reading as 0 (task 1004153)', () => {
+  const snap = { served_version: '1.19.758', available: [], recommended: null, observed_at: 'x' };
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: 3 }, null).schema_pending, 3);
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: 0 }, null).schema_pending, 0);
+  assert.equal(CU.previewFromSnapshot(previewInst, { ...snap, schema_pending: null }, null).schema_pending, null);
+  assert.equal(CU.previewFromSnapshot(previewInst, snap, null).schema_pending, null, 'a row written before provisioning_024');
+  assert.equal(CU.previewFromSnapshot(previewInst, undefined, null).schema_pending, null, 'no snapshot at all');
+});
+
 await t('an open intent is surfaced with its target, so the page can say what is already running', () => {
   const p = CU.previewFromSnapshot(previewInst, { served_version: '1.19.758', available: [], recommended: null },
     { action: 'core-upgrade', state: 'running', target_version: '1.19.762' });

package/tests/core_upgrade_runner.mjs

@@ -30,6 +30,8 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+// An ESM named import, not R.parseSchemaPending: knip credits a CJS export only when a test imports it this way.
+import { parseSchemaPending } from '../scripts/gds/provision-core-upgrade.js';
 
 const require = createRequire(import.meta.url);
 const R = require('../scripts/gds/provision-core-upgrade.js');
@@ -404,6 +406,37 @@ await t('a box that does not answer still writes a snapshot — a NULL reading i
   assert.equal(w.params[3], null, 'and nothing is recommended against a version we could not read');
 });
 
+await t('parseSchemaPending reads the count, and anything it cannot trust is null — never 0 (task 1004153)', () => {
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.953', schemaPending: 3 })), 3);
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.953', schemaPending: 0 })), 0);
+  assert.equal(parseSchemaPending(JSON.stringify({ coreVersion: '1.19.700' })), null, 'a core older than the field');
+  assert.equal(parseSchemaPending(JSON.stringify({ schemaPending: null })), null, 'the box itself does not know');
+  for (const bad of [-1, 1.5, '3', 100001]) {
+    assert.equal(parseSchemaPending(JSON.stringify({ schemaPending: bad })), null, `schemaPending=${JSON.stringify(bad)}`);
+  }
+  assert.equal(parseSchemaPending('cloudbongos 1.19.762 (ok)'), null, 'not JSON');
+  assert.equal(parseSchemaPending(''), null);
+  assert.equal(parseSchemaPending(null), null);
+});
+
+await t('the snapshot stores the box\'s schemaPending next to its served version (task 1004153)', async () => {
+  const queries = [];
+  const d = makeDeps({ queries });
+  d.exec = (cmd) => ({ ok: true, stdout: /\/version/.test(cmd) ? JSON.stringify({ coreVersion: '1.19.760', schemaPending: 4 }) : '' });
+  const r = await R.snapshotCoreVersions(inst(), d);
+  const w = queries.find((q) => /provisioning_core_version_snapshot/.test(q.sql));
+  assert.match(w.sql, /schema_pending = EXCLUDED\.schema_pending/, 'a re-read replaces the old count');
+  assert.equal(w.params[6], 4);
+  assert.equal(r.schemaPending, 4);
+});
+
+await t('a box that does not answer stores schema_pending NULL, not a clean 0', async () => {
+  const queries = [];
+  await R.snapshotCoreVersions(inst(), makeDeps({ served: null, queries }));
+  const w = queries.find((q) => /provisioning_core_version_snapshot/.test(q.sql));
+  assert.equal(w.params[6], null);
+});
+
 await t('a shape the runner cannot reach is skipped entirely — no snapshot, no claim about it', async () => {
   const queries = [];
   const r = await R.snapshotCoreVersions(inst({ hosting_shape: 'dedicated' }), makeDeps({ queries }));

package/tests/deploy_page_projects.mjs

@@ -181,6 +181,20 @@ test('a box that did not answer is never rendered as up to date', async () => {
   assert.doesNotMatch(html, /id="dp-preview-1"/, 'and is offered no move');
 });
 
+test('a box whose database is behind its code says so (task 1004153)', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { schema_pending: 2 }) });
+  await b.settle();
+  assert.match(b.panel(), /Database behind\.<\/strong> This project's code expects\s+2 database changes/);
+});
+
+test('a database that is current, or whose state is unknown, gets no "behind" flag', async () => {
+  for (const schema_pending of [0, null, undefined]) {
+    const b = boot({ controlPlane: preview('1', 'cloudbongos', { schema_pending }) });
+    await b.settle();
+    assert.doesNotMatch(b.panel(), /Database behind/, `schema_pending=${schema_pending}`);
+  }
+});
+
 test('an unenrolled control plane still lets the projects through', async () => {
   // The regression this pins: the platform's own missing row used to be the whole
   // page, so one un-run setup command would hide every project too.