@bongos/core 1.19.971 → 1.19.973

package/tests/deploy_page_projects.mjs

@@ -1,11 +1,16 @@
-// tests/deploy_page_projects.mjs — the deploy page now drives every hosted project,
-// not only the control plane's own row (task 1004046).
+// tests/deploy_page_projects.mjs — the deploy page is about ONE project: the hall's own,
+// or the one a ?project= scope names (task 1004171, narrowing task 1004046's fleet list).
 //
 // These EXECUTE deploy.js in a DOM stub and read what it painted. The sibling suite
 // (core_upgrade_door.mjs) asserts the page's invariants against its SOURCE, which is
-// right for "never computes a version comparison" but cannot see the thing that broke
-// when this page went multi-box: whether a click on one box arms that box and not
-// another. That is behaviour, so it is tested as behaviour.
+// right for "never computes a version comparison" but cannot see what this page is for:
+// WHICH box it renders, and whether a press lands on that box. That is behaviour, so it
+// is tested as behaviour.
+//
+// WHY THE FLEET FIXTURE SURVIVES a task that removed the fleet listing: the scope lookup
+// still resolves a slug through it, and the regression worth pinning is not "the roster
+// read is gone" but "the roster is never LISTED". A harness with no fleet could not tell
+// those two apart.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';
@@ -32,7 +37,7 @@ const FLEET = [
   { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'standalone' },
 ];
 
-function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200 } = {}) {
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null } = {}) {
   const els = new Map();
   const posts = [];
   const gets = [];
@@ -87,7 +92,9 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   const windowObj = {
     BongosClient: { createClient: () => ({ request }) },
     OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast(m) { toasts.push(String(m)); } },
-    location: { assign() {} },
+    // `search` is what decides which project the page is about. A stub without it is the
+    // shape the page has to survive, and the default here keeps that path exercised.
+    location: { assign() {}, search: scope ? `?project=${encodeURIComponent(scope)}` : '' },
   };
   // The page's poll interval, driven rather than slept through. Injecting the REAL
   // setTimeout made every case whose preview never converges sit out the page's full
@@ -96,7 +103,7 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   windowObj.__deployPollMs = 0;
   windowObj.__deployPollTries = 3;
   windowObj.__deployMoveTries = moveTries;
-  const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise };
+  const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise, decodeURIComponent };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
@@ -109,64 +116,88 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   return { els, posts, gets, reads, toasts, settle, tick, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
 }
 
-test('the platform AND every live hosted project get a row', async () => {
+// ---- WHICH project the page is about (task 1004171) -------------------------------
+
+test('unscoped, the page is the hall’s OWN project and nothing else', async () => {
   const b = boot();
   await b.settle();
   const html = b.panel();
-  assert.match(html, /cloudbongos/, 'the platform is still here');
-  assert.match(html, /mercury/, 'a standalone project');
-  assert.match(html, /hoodify-finance/, 'a co-tenant project');
-  assert.match(b.sub(), /3 hosted projects/);
+  assert.match(html, /cloudbongos/, 'the hall’s own project');
+  assert.doesNotMatch(html, /mercury/, 'and not another project');
+  assert.doesNotMatch(html, /hoodify-finance/);
+  assert.match(b.sub(), /^cloudbongos$/);
 });
 
-test('torn-down projects never appear — the page is about what is live', async () => {
+test('unscoped, it never LISTS the fleet or probes a project it is not about', async () => {
+  // The defect this replaces: one hall’s page fanned a preview request at every live
+  // instance, including two belonging to other builders, and offered a move on each.
   const b = boot();
   await b.settle();
+  assert.ok(!b.gets.includes('/provisioning/fleet'), 'no roster read');
+  assert.ok(!b.gets.includes('/provisioning/instances'), 'and no fallback roster read');
+  assert.deepEqual(b.gets.filter((g) => /\/instances\/\w+\/core-upgrade$/.test(g)), [],
+    'and no per-project probe');
+  assert.equal(b.reads.size, 0, 'no tenant box was touched at all');
+});
+
+test('?project= renders THAT project, by slug, and still only one row', async () => {
+  const b = boot({ scope: 'mercury' });
+  await b.settle();
   const html = b.panel();
-  assert.doesNotMatch(html, /walk-lantern/);
-  assert.doesNotMatch(html, /testccc/);
+  assert.match(html, /mercury/);
+  assert.doesNotMatch(html, /cloudbongos/, 'the self row is not added beside it');
+  assert.doesNotMatch(html, /hoodify-finance/, 'nor any other project');
+  assert.equal(b.sub(), 'mercury');
+  assert.ok(!b.gets.includes('/provisioning/control-plane'), 'and the self row is not even read');
 });
 
-test('a project whose state cannot be read is LISTED, not silently dropped', async () => {
-  // A box missing from a deploy page reads as a box that needs no deploying.
-  const b = boot();
+test('a scoped project is offered its own move, on its own id', async () => {
+  const b = boot({ scope: 'mercury' });
+  await b.settle();
+  b.els.get('dp-preview-31')._on.click();
+  b.els.get('dp-confirm-31')._on.click();
+  await b.settle();
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1);
+  assert.equal(moves[0].path, '/provisioning/instances/31/core-upgrade');
+  assert.equal(moves[0].body.to, '1.19.871', 'the version it was SHOWN');
+});
+
+test('a ?project= nobody hosts is NAMED, not left blank', async () => {
+  // A deploy page that renders nothing reads as a project with nothing to deploy, which
+  // is the one wrong impression this page must never give.
+  const b = boot({ scope: 'not-a-project' });
+  await b.settle();
+  assert.match(b.panel(), /not-a-project/);
+  assert.match(b.panel(), /no project by that name is hosted here/);
+});
+
+test('a scoped project whose state cannot be read is LISTED, not silently dropped', async () => {
+  const b = boot({ scope: 'unreadable-one' });
   await b.settle();
   assert.match(b.panel(), /unreadable-one/);
   assert.match(b.panel(), /Could not read this project/);
 });
 
-test('opening the confirm on one project does not arm another', async () => {
-  const b = boot();
+test('a scope resolves through the roster the viewer can actually see', async () => {
+  // A holder of core.pin.move who lacks the fleet atom still arrives from their own
+  // project's hall, so the lookup falls back to their own projects rather than erroring.
+  const b = boot({ scope: 'mercury', fleetStatus: 403 });
   await b.settle();
-  b.els.get('dp-preview-31')._on.click();
-  const html = b.panel();
-  assert.match(html, /id="dp-confirm-31"/, 'mercury is armed');
-  assert.doesNotMatch(html, /id="dp-confirm-32"/, 'hoodify-finance is NOT');
-  assert.match(html, /id="dp-preview-32"/, 'and is still at step one');
+  assert.match(b.panel(), /mercury/);
+  assert.ok(b.gets.includes('/provisioning/instances'), 'via the own-projects roster');
 });
 
-test('confirming sends THAT project’s id and the version it was shown', async () => {
+test('a window with no location.search is the unscoped case, not a crash', async () => {
+  // The vm harness is the honest version of a browser that has not given us one; a page
+  // that threw here would take the whole deploy door down for an ordinary visit.
   const b = boot();
   await b.settle();
-  b.els.get('dp-preview-32')._on.click();
-  b.els.get('dp-confirm-32')._on.click();
-  await b.settle();
-  // Arming also asks for a dry run now (task 1004121), so the MOVE is the post that is
-  // not one — separated by its payload rather than by its position, because "the second
-  // post" would silently start asserting about the wrong request the next time the order
-  // changes.
-  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
-  assert.equal(moves.length, 1, 'exactly one move is sent');
-  assert.equal(moves[0].path, '/provisioning/instances/32/core-upgrade');
-  // Field-wise, not deepEqual: the body is built inside the vm realm, so its
-  // prototype is not this realm's Object and deepStrictEqual rejects it on identity
-  // alone — a harness artifact that says nothing about the payload.
-  assert.equal(moves[0].body.to, '1.19.871');
-  assert.deepEqual(Object.keys(moves[0].body), ['to'], 'and nothing else is sent');
-  // And the move must never carry the flag that would turn it into a no-op.
-  assert.equal(moves[0].body.dry_run, undefined, 'a move is not a dry run');
+  assert.match(b.panel(), /cloudbongos/);
 });
 
+// ---- the one box's states ---------------------------------------------------------
+
 test('a box with nothing newer offers no button', async () => {
   const b = boot({ controlPlane: preview('1', 'cloudbongos', { behind: false, recommended_version: null }) });
   await b.settle();
@@ -195,43 +226,35 @@ test('a database that is current, or whose state is unknown, gets no "behind" fl
   }
 });
 
-test('an unenrolled control plane still lets the projects through', async () => {
-  // The regression this pins: the platform's own missing row used to be the whole
-  // page, so one un-run setup command would hide every project too.
+test('an unenrolled control plane says so, in the server’s own words', async () => {
   const b = boot({ controlPlaneStatus: 404 });
   await b.settle();
-  const html = b.panel();
-  assert.match(html, /has no deploy door yet/, 'the server’s own sentence, naming the fix');
-  assert.match(html, /mercury/, 'and the projects are still listed');
-});
-
-test('a viewer without the fleet atom falls back to their own projects', async () => {
-  const b = boot({ fleetStatus: 403 });
-  await b.settle();
-  assert.match(b.panel(), /mercury/);
+  assert.match(b.panel(), /has no deploy door yet/, 'the server’s own sentence, naming the fix');
 });
 
-test('a move re-reads ONLY the box it moved, not every project again', async () => {
-  // The grader's finding on the first round: refreshing one row by re-running the
-  // whole page load fans a probe out at every hosted project, including ones the
-  // owner never touched.
+test('confirming sends the version it was shown, and nothing else', async () => {
   const b = boot();
   await b.settle();
-  b.gets.length = 0;
-  b.els.get('dp-preview-32')._on.click();
-  b.els.get('dp-confirm-32')._on.click();
+  b.els.get('dp-preview-1')._on.click();
+  b.els.get('dp-confirm-1')._on.click();
   await b.settle();
-  const previewReads = b.gets.filter((g) => g.endsWith('/core-upgrade'));
-  // Since task 1004145 a move POLLS, so the count is no longer one — and the count was
-  // only ever a proxy for the thing that matters. Asserted directly instead: every
-  // re-read is the moved box, and no other box is touched.
-  assert.ok(previewReads.length > 0, 'the moved box is re-read');
-  assert.deepEqual([...new Set(previewReads)], ['/provisioning/instances/32/core-upgrade'],
-    'and it is the ONLY box re-read — no fan-out across the fleet');
-  assert.ok(!b.gets.includes('/provisioning/fleet'), 'the fleet is not re-listed');
+  // Arming also asks for a dry run now (task 1004121), so the MOVE is the post that is
+  // not one — separated by its payload rather than by its position, because "the second
+  // post" would silently start asserting about the wrong request the next time the order
+  // changes.
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1, 'exactly one move is sent');
+  assert.equal(moves[0].path, '/provisioning/instances/1/core-upgrade');
+  // Field-wise, not deepEqual: the body is built inside the vm realm, so its
+  // prototype is not this realm's Object and deepStrictEqual rejects it on identity
+  // alone — a harness artifact that says nothing about the payload.
+  assert.equal(moves[0].body.to, '1.19.871');
+  assert.deepEqual(Object.keys(moves[0].body), ['to'], 'and nothing else is sent');
+  // And the move must never carry the flag that would turn it into a no-op.
+  assert.equal(moves[0].body.dry_run, undefined, 'a move is not a dry run');
 });
 
-test('a move on the platform row re-reads the control plane, not a tenant preview', async () => {
+test('a move re-reads its own box from its own endpoint, and no other', async () => {
   const b = boot();
   await b.settle();
   b.gets.length = 0;
@@ -239,7 +262,8 @@ test('a move on the platform row re-reads the control plane, not a tenant previe
   b.els.get('dp-confirm-1')._on.click();
   await b.settle();
   assert.ok(b.gets.includes('/provisioning/control-plane'), 'the self row is read from its own endpoint');
-  assert.ok(!b.gets.some((g) => /instances\/3\d\/core-upgrade/.test(g)), 'and no tenant is re-probed');
+  assert.ok(!b.gets.some((g) => /instances\/3\d\/core-upgrade/.test(g)), 'and no tenant is probed');
+  assert.ok(!b.gets.includes('/provisioning/fleet'), 'the fleet is not listed');
 });
 
 // ---- the pre-flight verdict on step two (task 1004121) ---------------------------
@@ -259,6 +283,82 @@ test('step two shows what the dry run found, not just a restatement of the actio
   assert.match(html, /database &quot;cloudbongos&quot; reachable|database "cloudbongos" reachable/, 'and shows what was checked');
 });
 
+// ── what the move would CARRY (task 1004173) ─────────────────────────────────────
+
+const CHANGES = {
+  from: '1.19.800', to: '1.19.871', more: 0,
+  entries: [
+    { text: 'Builders can now tick one box to see only their own work.' },
+    { id: '1004167', text: 'Groundwork for letting an owner make their code repository private.' },
+  ],
+};
+
+test('step two names what the move BRINGS IN, in the ships’ own words', async () => {
+  // The whole complaint: "I don't actually see what would change when I hit the button."
+  // The pre-flight answers whether the machinery will allow it, which is a different
+  // question, and answering it was being presented as the preview.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: [], error: null, changes: CHANGES },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /What this brings in/, 'the question the owner asked is answered');
+  assert.match(html, /2\s+pieces of work landed between core 1\.19\.800\s+and 1\.19\.871/);
+  assert.match(html, /tick one box to see only their own work/, 'in the ship’s own sentence');
+  assert.match(html, /code repository private/);
+  assert.match(html, /nothing blocks this move/i, 'and the verdict is STILL there below it');
+});
+
+test('a capped list says how many it did not show', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: [], error: null, changes: { ...CHANGES, more: 94 } },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  assert.match(b.panel(), /and 94 more, not listed/);
+});
+
+test('A RANGE THE RUNNER COULD NOT READ SAYS SO — never an empty list', async () => {
+  // "Nothing changed" over ninety-one releases is the one wrong impression this section
+  // could give, and it is exactly the shape a silent failure takes.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: [], error: null,
+      changes: { from: '1.19.800', to: '1.19.871', error: 'could not find those releases in the core history on this machine' } },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /Could not read what this would bring in/);
+  assert.match(html, /could not find those releases/, 'in the runner’s own words');
+  assert.doesNotMatch(html, /What this brings in/, 'and never dressed up as a list');
+});
+
+test('no change list at all renders nothing, rather than an empty heading', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: ['database reachable'], error: null },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.doesNotMatch(html, /What this brings in/);
+  assert.doesNotMatch(html, /Could not read what this would bring in/);
+  assert.match(html, /nothing blocks this move/i, 'the verdict still shows');
+});
+
+test('the wait names what it is waiting for, and that the machine is being asked', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /what it would bring in/, 'both halves of what is being fetched');
+  assert.match(html, /can take a couple of minutes/, 'and that the pause is expected');
+});
+
 test('a BLOCKED move says so, in the upgrade’s own words, and still offers the button', async () => {
   const b = boot({ controlPlane: preview('1', 'cloudbongos', {
     preflight: { target: '1.19.871', ok: false, lines: [], error: 'working tree not clean — commit/stash first, or pass --force.' },
@@ -334,7 +434,7 @@ test('a verdict already in hand is NOT re-requested', async () => {
 // once — before the runner's tick — then fell silent for the whole upgrade.
 
 test('confirming a move says so IMMEDIATELY, naming the version it is taking', async () => {
-  const b = boot();
+  const b = boot({ scope: 'hoodify-finance' });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
@@ -348,10 +448,9 @@ test('confirming a move says so IMMEDIATELY, naming the version it is taking', a
 test('the in-flight state survives the poll — it does not close under the reader', async () => {
   // refreshOne() returns a row to step one, which is right after a move and wrong
   // DURING one; without keepStep the poll wipes its own message on the first interval.
-  // Observed after a poll has actually run, but before the bound is exhausted.
   // A long bound so the loop cannot exhaust mid-assertion: the state under test exists
   // only WHILE it polls.
-  const b = boot({ moveTries: 500, instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  const b = boot({ scope: 'hoodify-finance', moveTries: 500, instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
@@ -365,6 +464,7 @@ test('when the box lands on the new core, it CONFIRMS it', async () => {
   // The whole ask: "confirmation when it updates". A changed number is not a
   // confirmation — nothing tied it to the press.
   const b = boot({
+    scope: 'hoodify-finance',
     instanceOver: (inst, n) => (n >= 2
       ? { served_version: '1.19.871', behind: false, open_intent: null, last_move: { target_version: '1.19.871', state: 'done', at: new Date().toISOString(), error: null } }
       : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
@@ -378,10 +478,65 @@ test('when the box lands on the new core, it CONFIRMS it', async () => {
   assert.doesNotMatch(html, /Moving to core/i, 'and the in-flight state is gone');
 });
 
+// ── a failure is dated, and stops being the headline once the box moves on (task 1004172)
+
+test('a live failure is DATED and says what the project is running now, in the present tense', async () => {
+  // The sentence this replaces said "was put back on 1.19.969" — a past-tense claim about
+  // a rollback, built by substituting the CURRENT reading into it. Present tense is a
+  // statement about the reading in hand, and true whenever the reading is.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.871', state: 'error', at: new Date(Date.now() - 3 * 60 * 1000).toISOString(), error: 'working tree not clean', superseded: false },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /did not land/i, 'the failure is stated');
+  assert.match(html, /attempted\s+\d+\s*(s|min|h) ago/i, 'and DATED — an undated failure reads as the present forever');
+  assert.match(html, /is still running core 1\.19\.800/i, 'present tense about the reading in hand');
+  assert.doesNotMatch(html, /was put back on/i, 'never a past-tense claim built from a current reading');
+});
+
+test('a failure the box has moved past is demoted to history, not painted as the current state', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.700', state: 'error', at: new Date(Date.now() - 2 * 24 * 3600 * 1000).toISOString(), error: 'Postgres has no role "root"', superseded: true },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /An earlier attempt did not land/i, 'it is framed as history');
+  assert.match(html, /has moved on since/i, 'and says the box recovered');
+  assert.match(html, /dp-settled--past/, 'and wears the history mark, not the danger one');
+  assert.doesNotMatch(html, /dp-settled--failed/, 'the live-failure treatment is NOT applied');
+  // "55h ago" is arithmetic the reader has to do before they can tell whether it is news.
+  assert.match(html, /failed 2 days ago/, 'past two days the age reads in days, not hours');
+});
+
+test('the runner’s shell output is folded behind a disclosure, never the headline', async () => {
+  // upgrade.js's dirty-tree refusal prints a whole `git status` — 33 lines on test4 —
+  // and names a fix addressed to whoever holds a shell, which the owner does not.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'working tree not clean — commit/stash first', superseded: false },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /<details class="dp-settled__detail"><summary>What the upgrade said<\/summary>/, 'folded');
+  assert.match(html, /working tree not clean/, 'and the words are still all there');
+  assert.ok(html.indexOf('did not land') < html.indexOf('<details'), 'the plain sentence comes first');
+});
+
+test('a failure with no recorded time says nothing about when, rather than inventing one', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.871', state: 'error', at: null, error: 'x', superseded: false },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /did not land/i);
+  assert.doesNotMatch(html, /attempted never/i, 'the "never" the age formatter returns must not reach the copy as a date');
+});
+
 test('a FAILED move is reported, with the reason, instead of looking untouched', async () => {
   // An errored intent is not an OPEN intent, so before last_move existed the payload
   // after a rolled-back upgrade was identical to the payload before it.
   const b = boot({
+    scope: 'hoodify-finance',
     instanceOver: (inst, n) => (n >= 2
       ? { open_intent: null, last_move: { target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'working tree not clean — commit/stash first, or pass --force.' } }
       : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
@@ -393,12 +548,12 @@ test('a FAILED move is reported, with the reason, instead of looking untouched',
   const html = b.panel();
   assert.match(html, /did not land/i, 'the failure is stated');
   assert.match(html, /working tree not clean/, 'and carries the runner’s own reason');
-  assert.match(html, /put back on 1\.19\.800/i, 'and says the project is still running');
+  assert.match(html, /is still running core 1\.19\.800/i, 'and says what the project is running now');
 });
 
 test('a poll that runs out says it is still working, not that it failed', async () => {
   // MOVE_TRIES is a bound on this page's patience, not on the runner's work.
-  const b = boot({ instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  const b = boot({ scope: 'hoodify-finance', instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
@@ -414,7 +569,7 @@ test('a queue that is REFUSED leaves no in-flight state to wait on', async () =>
   // `b.postFails`, a property the harness never read. So it asserted "no in-flight
   // state" on a row where no move had been attempted, which is true of every row on the
   // page. The grader caught it. It now refuses the POST for real and presses the button.
-  const b = boot({ postStatus: 409 });
+  const b = boot({ scope: 'hoodify-finance', postStatus: 409 });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();

package/tests/fitness_scope_roster.mjs

@@ -0,0 +1,117 @@
+// tests/fitness_scope_roster.mjs
+//
+// Task 1002900 — the scope roster in src/bongos/module-scope-map.js (MODULE_GLOBS) is
+// maintained by hand, and nothing asserted that every carved module has a covering key.
+// A module lands in modules/<key>/, nobody adds the entry, and any goal scoped to that
+// work hits an authorize-NOTHING wall: goal-scope-check.check() denies with
+// empty_scope / unknown_scope. It surfaces only when someone tries to set a goal's wall.
+//
+// Three hand-fixed instances before this check existed: task 1002690 (provisioning +
+// public-landing), task 1002322 (platform-identity), and `agents` — the one this row
+// was filed for, since added at module-scope-map.js:322.
+//
+// SUBSET, NOT EQUALITY. The roster legitimately carries keys with no modules/<key>/ dir,
+// for two distinct reasons, and equality would fail on all five in this tree:
+//   - non-module SCOPES: kernel, methodology, devsecops
+//   - modules ABSENT from this instance: art-pipeline, game (ADR 0108)
+// So the invariant is one-directional. These tests pin that direction explicitly,
+// because getting it wrong turns a useful check into one nobody can keep green.
+//
+// Run:  node --test tests/fitness_scope_roster.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { discoveredModuleKeys } = require(path.join(REPO_ROOT, 'scripts/gds/fitness.js'));
+// The check lives in its own file (the role-pack-guard.js precedent) so fitness.js stays
+// under the size ratchet; module discovery stays in fitness.js, which owns it.
+const { scanScopeRosterCoverage } = require(path.join(REPO_ROOT, 'scripts/gds/scope-roster-guard.js'));
+const scopeMap = require(path.join(REPO_ROOT, 'src/bongos/module-scope-map.js'));
+
+const nothingExists = () => false;
+const allExist = () => true;
+
+test('THE BUG: a discovered module with no roster key is a violation', () => {
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['lifecycle', 'agents'],
+    rostered: ['lifecycle'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /'agents'/, 'must name the uncovered module');
+  assert.match(violations[0], /empty_scope|unknown_scope/,
+    'and must name the symptom, since that is how this is actually discovered');
+});
+
+test('SUBSET NOT EQUALITY: a rostered key with no module is NOT a fault', () => {
+  // kernel/methodology/devsecops are surfaces, not modules; art-pipeline/game may be
+  // absent from a given instance. Failing on these would make the check unkeepable.
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['lifecycle'],
+    rostered: ['lifecycle', 'kernel', 'methodology', 'devsecops', 'art-pipeline', 'game'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.deepEqual(violations, []);
+});
+
+test('several uncovered modules are all reported, sorted', () => {
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['zeta', 'alpha', 'lifecycle'],
+    rostered: ['lifecycle'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.equal(violations.length, 2, 'one line per uncovered module — not just the first');
+  assert.match(violations[0], /'alpha'/);
+  assert.match(violations[1], /'zeta'/);
+});
+
+test('a dead exact-file glob is a WARNING, never a failure', () => {
+  // The mirror-image rot: a roster entry naming a file that no longer exists cannot wall
+  // anything off, but it breaks no build either — so it is reported, not enforced.
+  const { violations, warnings } = scanScopeRosterCoverage({
+    discovered: [], rostered: [],
+    globs: { kernel: ['server.js'] },
+    exists: nothingExists,
+  });
+  assert.deepEqual(violations, [], 'a dead glob must not fail the build');
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /server\.js/);
+  assert.match(warnings[0], /walls nothing/);
+});
+
+test('directory and wildcard globs are exempt from the existence warning', () => {
+  // A directory glob may legitimately point at an optional module absent from this
+  // instance — warning on those would bury the real signal in noise.
+  const { warnings } = scanScopeRosterCoverage({
+    discovered: [], rostered: [],
+    globs: { game: ['modules/game/', 'src/**/game-*.js'] },
+    exists: nothingExists,
+  });
+  assert.deepEqual(warnings, []);
+});
+
+test('THE REAL TREE: every discovered module is rostered (the check must land green)', () => {
+  // Last, and paired with the fixtures above: alone this would pass against a scanner
+  // that always returns [].
+  const { violations } = scanScopeRosterCoverage({
+    discovered: discoveredModuleKeys(),
+    rostered: scopeMap.moduleKeys(),
+    globs: {},
+    exists: allExist,
+  });
+  assert.deepEqual(violations, [],
+    'a module was carved without a MODULE_GLOBS key — any goal scoped to it denies everything');
+});
+
+test('agents specifically is rostered (the instance this row was filed for)', () => {
+  assert.ok(scopeMap.moduleKeys().includes('agents'));
+  assert.ok(discoveredModuleKeys().includes('agents'), 'and it is a real discovered module, not just a roster entry');
+});