@bongos/core 1.19.972 → 1.19.973

package/tests/core_upgrade_runner.mjs

@@ -836,5 +836,137 @@ await t('and a silent failure STILL refuses rather than inventing a pass', async
   assert.match(v.error, /said nothing/);
 });
 
+
+console.log('\nwhat the move would CARRY, not just whether it is allowed (task 1004173):');
+
+// The two merge shapes a real core history holds, as `git log --merges
+// --format=%s%x1f%b%x1e` emits them. The second shape is the COMMON one: measured over
+// 1.19.881→1.19.972, 98 of 114 usable summaries came from the CI auto-merge's body.
+const REC = (subject, body = '') => `${subject}\x1f${body}\x1e`;
+const LOG = [
+  REC('Merge scoperoster-1002900: The build now catches a missing registration at the moment it happens.'),
+  REC('Merge pull request #1108 from an-owner/task-1004167', 'task 1004167: Groundwork for letting an owner make their code repository private.\n'),
+  REC('Merge origin/main into scoperoster-1002900 (pre-stage freshness, task 1068)'),
+  REC('Merge remote-tracking branch \'origin/main\' into errshape-1003658'),
+  REC('Merge pull request #1107 from an-owner/task-1001621'),
+  REC('chore: regen repo-map after merge'),
+].join('');
+
+await t('BOTH merge shapes are read — the CI auto-merge carries its summary in the BODY', () => {
+  const out = R.parseChangeRecords(LOG);
+  assert.equal(out.length, 2, `two usable summaries — got ${JSON.stringify(out)}`);
+  assert.match(out[0].text, /catches a missing registration/, 'the hand-landed shape, from the subject');
+  assert.equal(out[1].id, '1004167', 'and the CI shape, from the body, with its task id');
+  assert.match(out[1].text, /make their code repository private/);
+});
+
+await t('the mechanics of landing are DROPPED — they are not the work', () => {
+  // Over a real range these outnumber the summaries roughly ten to one, so listing them
+  // buries every sentence the owner wants.
+  const out = R.parseChangeRecords(LOG).map((e) => e.text).join(' | ');
+  assert.doesNotMatch(out, /pre-stage freshness/);
+  assert.doesNotMatch(out, /remote-tracking/);
+  assert.doesNotMatch(out, /regen repo-map/);
+  assert.doesNotMatch(out, /pull request/, 'a merge with no body summary contributes nothing');
+});
+
+await t('a branch merged twice says its sentence once', () => {
+  const dup = LOG + REC('Merge scoperoster-1002900: The build now catches a missing registration at the moment it happens.');
+  assert.equal(R.parseChangeRecords(dup).length, 2);
+});
+
+await t('a paragraph-long summary is bounded — it reaches a DOM', () => {
+  const out = R.parseChangeRecords(REC(`Merge x-1: ${'y'.repeat(5000)}`));
+  assert.ok(out[0].text.length <= 400, `bounded — got ${out[0].text.length}`);
+  assert.match(out[0].text, /…$/, 'and says it was cut');
+});
+
+// --- the range, and every way it can fail to resolve ------------------------------
+
+const changeDeps = ({ shas = { '1.19.900': 'a'.repeat(40), '1.19.949': 'b'.repeat(40) }, log = LOG, logOk = true } = {}) => {
+  const ran = [];
+  return {
+    ran,
+    selfInstanceRoot: () => '/srv/core',
+    exec: (cmd) => {
+      ran.push(cmd);
+      const m = /--grep='release: core ([0-9.]+) '/.exec(cmd);
+      if (m) return { ok: true, stdout: `${shas[m[1]] || ''}\n` };
+      if (!logOk) return { ok: false, softFailed: true, stdout: '' };
+      return { ok: true, stdout: log };
+    },
+  };
+};
+
+await t('the range resolves through the release commits and lists what landed between', () => {
+  const d = changeDeps();
+  const r = R.changesBetween('1.19.900', '1.19.949', d);
+  assert.equal(r.error, undefined);
+  assert.equal(r.from, '1.19.900');
+  assert.equal(r.to, '1.19.949');
+  assert.equal(r.entries.length, 2);
+  assert.ok(d.ran.some((c) => /--merges/.test(c) && /a{40}\.\.b{40}/.test(c)), 'the log is asked for the resolved range');
+});
+
+await t('IT READS THE CONTROL PLANE’S OWN CHECKOUT, whichever instance is previewed', () => {
+  // A tenant's directory is a checkout of the TENANT's repo with the core vendored in
+  // from npm — no core history in it, and the wrong history if you squint. Under
+  // PROVISION_REMOTE_HOST `exec` is the remote box, so the executor matters too.
+  const d = changeDeps();
+  d.controlExec = d.exec;
+  d.exec = () => { throw new Error('the instance executor must not be used for core history'); };
+  const r = R.changesBetween('1.19.900', '1.19.949', d);
+  assert.equal(r.entries.length, 2);
+  for (const c of d.ran) assert.match(c, /git -C \/srv\/core /, 'always the control plane’s own core checkout');
+});
+
+await t('A RANGE THAT CANNOT BE RESOLVED IS AN ERROR, NEVER AN EMPTY LIST', () => {
+  // An empty list reads as "nothing changed", which over ninety-one releases is the one
+  // wrong impression this section could give — and it is the shape a missing checkout,
+  // a shallow clone or an unknown release all take.
+  const missing = R.changesBetween('1.19.900', '9.9.9', changeDeps());
+  assert.equal(missing.entries, undefined, 'no list at all');
+  assert.match(missing.error, /could not find those releases/);
+
+  const unreadable = R.changesBetween('1.19.900', '1.19.949', changeDeps({ logOk: false }));
+  assert.equal(unreadable.entries, undefined);
+  assert.match(unreadable.error, /could not read the core history/);
+});
+
+await t('a version that is not three numbers never reaches the shell', () => {
+  const d = changeDeps();
+  const r = R.changesBetween("1.19.900'; rm -rf /; echo '", '1.19.949', d);
+  assert.match(r.error, /could not work out which releases/);
+  assert.deepEqual(d.ran, [], 'and nothing was run at all');
+  assert.match(R.changesBetween(null, '1.19.949', changeDeps()).error, /could not work out/, 'an unknown starting point too');
+});
+
+await t('a long range is capped, and says how many it did not list', () => {
+  const many = Array.from({ length: R.CHANGE_CAP + 5 }, (_, i) => REC(`Merge b-${i}: summary number ${i}`)).join('');
+  const r = R.changesBetween('1.19.900', '1.19.949', changeDeps({ log: many }));
+  assert.equal(r.entries.length, R.CHANGE_CAP);
+  assert.equal(r.more, 5, 'the remainder is counted, not silently dropped');
+});
+
+await t('the dry run records the list beside the verdict, keyed to where the box IS', async () => {
+  // Both answers are about ONE move, so they are stored together — and `from` is stored
+  // with them because the list is only true of that starting point.
+  const d = makeDeps({ served: '1.19.762' });
+  d.queries.length = 0;
+  d.db = { query: async (sql, params) => {
+    d.queries.push({ sql, params });
+    if (/SELECT served_version/.test(sql)) return { rows: [{ served_version: '1.19.900' }] };
+    return { rows: [] };
+  } };
+  d.preflightUpgrade = () => ({ target: '1.19.949', ok: true, lines: [], error: null });
+  d.changesBetween = (from, to) => ({ from, to, entries: [{ text: 'a thing landed' }], more: 0 });
+  await R.preflightCoreUpgrade(inst(), d, intent({ target_version: '1.19.949' }));
+  const write = d.queries.find((q) => /INSERT INTO provisioning_core_version_snapshot/.test(q.sql));
+  const stored = JSON.parse(String(write.params[1]));
+  assert.equal(stored.changes.from, '1.19.900', 'the version the box is on right now');
+  assert.equal(stored.changes.to, '1.19.949');
+  assert.equal(stored.changes.entries[0].text, 'a thing landed');
+});
+
 console.log(`\ncore_upgrade_runner: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/deploy_page_projects.mjs

@@ -1,11 +1,16 @@
-// tests/deploy_page_projects.mjs — the deploy page now drives every hosted project,
-// not only the control plane's own row (task 1004046).
+// tests/deploy_page_projects.mjs — the deploy page is about ONE project: the hall's own,
+// or the one a ?project= scope names (task 1004171, narrowing task 1004046's fleet list).
 //
 // These EXECUTE deploy.js in a DOM stub and read what it painted. The sibling suite
 // (core_upgrade_door.mjs) asserts the page's invariants against its SOURCE, which is
-// right for "never computes a version comparison" but cannot see the thing that broke
-// when this page went multi-box: whether a click on one box arms that box and not
-// another. That is behaviour, so it is tested as behaviour.
+// right for "never computes a version comparison" but cannot see what this page is for:
+// WHICH box it renders, and whether a press lands on that box. That is behaviour, so it
+// is tested as behaviour.
+//
+// WHY THE FLEET FIXTURE SURVIVES a task that removed the fleet listing: the scope lookup
+// still resolves a slug through it, and the regression worth pinning is not "the roster
+// read is gone" but "the roster is never LISTED". A harness with no fleet could not tell
+// those two apart.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';
@@ -32,7 +37,7 @@ const FLEET = [
   { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'standalone' },
 ];
 
-function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200 } = {}) {
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null } = {}) {
   const els = new Map();
   const posts = [];
   const gets = [];
@@ -87,7 +92,9 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   const windowObj = {
     BongosClient: { createClient: () => ({ request }) },
     OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast(m) { toasts.push(String(m)); } },
-    location: { assign() {} },
+    // `search` is what decides which project the page is about. A stub without it is the
+    // shape the page has to survive, and the default here keeps that path exercised.
+    location: { assign() {}, search: scope ? `?project=${encodeURIComponent(scope)}` : '' },
   };
   // The page's poll interval, driven rather than slept through. Injecting the REAL
   // setTimeout made every case whose preview never converges sit out the page's full
@@ -96,7 +103,7 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   windowObj.__deployPollMs = 0;
   windowObj.__deployPollTries = 3;
   windowObj.__deployMoveTries = moveTries;
-  const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise };
+  const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise, decodeURIComponent };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
@@ -109,64 +116,88 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   return { els, posts, gets, reads, toasts, settle, tick, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
 }
 
-test('the platform AND every live hosted project get a row', async () => {
+// ---- WHICH project the page is about (task 1004171) -------------------------------
+
+test('unscoped, the page is the hall’s OWN project and nothing else', async () => {
   const b = boot();
   await b.settle();
   const html = b.panel();
-  assert.match(html, /cloudbongos/, 'the platform is still here');
-  assert.match(html, /mercury/, 'a standalone project');
-  assert.match(html, /hoodify-finance/, 'a co-tenant project');
-  assert.match(b.sub(), /3 hosted projects/);
+  assert.match(html, /cloudbongos/, 'the hall’s own project');
+  assert.doesNotMatch(html, /mercury/, 'and not another project');
+  assert.doesNotMatch(html, /hoodify-finance/);
+  assert.match(b.sub(), /^cloudbongos$/);
 });
 
-test('torn-down projects never appear — the page is about what is live', async () => {
+test('unscoped, it never LISTS the fleet or probes a project it is not about', async () => {
+  // The defect this replaces: one hall’s page fanned a preview request at every live
+  // instance, including two belonging to other builders, and offered a move on each.
   const b = boot();
   await b.settle();
+  assert.ok(!b.gets.includes('/provisioning/fleet'), 'no roster read');
+  assert.ok(!b.gets.includes('/provisioning/instances'), 'and no fallback roster read');
+  assert.deepEqual(b.gets.filter((g) => /\/instances\/\w+\/core-upgrade$/.test(g)), [],
+    'and no per-project probe');
+  assert.equal(b.reads.size, 0, 'no tenant box was touched at all');
+});
+
+test('?project= renders THAT project, by slug, and still only one row', async () => {
+  const b = boot({ scope: 'mercury' });
+  await b.settle();
   const html = b.panel();
-  assert.doesNotMatch(html, /walk-lantern/);
-  assert.doesNotMatch(html, /testccc/);
+  assert.match(html, /mercury/);
+  assert.doesNotMatch(html, /cloudbongos/, 'the self row is not added beside it');
+  assert.doesNotMatch(html, /hoodify-finance/, 'nor any other project');
+  assert.equal(b.sub(), 'mercury');
+  assert.ok(!b.gets.includes('/provisioning/control-plane'), 'and the self row is not even read');
 });
 
-test('a project whose state cannot be read is LISTED, not silently dropped', async () => {
-  // A box missing from a deploy page reads as a box that needs no deploying.
-  const b = boot();
+test('a scoped project is offered its own move, on its own id', async () => {
+  const b = boot({ scope: 'mercury' });
+  await b.settle();
+  b.els.get('dp-preview-31')._on.click();
+  b.els.get('dp-confirm-31')._on.click();
+  await b.settle();
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1);
+  assert.equal(moves[0].path, '/provisioning/instances/31/core-upgrade');
+  assert.equal(moves[0].body.to, '1.19.871', 'the version it was SHOWN');
+});
+
+test('a ?project= nobody hosts is NAMED, not left blank', async () => {
+  // A deploy page that renders nothing reads as a project with nothing to deploy, which
+  // is the one wrong impression this page must never give.
+  const b = boot({ scope: 'not-a-project' });
+  await b.settle();
+  assert.match(b.panel(), /not-a-project/);
+  assert.match(b.panel(), /no project by that name is hosted here/);
+});
+
+test('a scoped project whose state cannot be read is LISTED, not silently dropped', async () => {
+  const b = boot({ scope: 'unreadable-one' });
   await b.settle();
   assert.match(b.panel(), /unreadable-one/);
   assert.match(b.panel(), /Could not read this project/);
 });
 
-test('opening the confirm on one project does not arm another', async () => {
-  const b = boot();
+test('a scope resolves through the roster the viewer can actually see', async () => {
+  // A holder of core.pin.move who lacks the fleet atom still arrives from their own
+  // project's hall, so the lookup falls back to their own projects rather than erroring.
+  const b = boot({ scope: 'mercury', fleetStatus: 403 });
   await b.settle();
-  b.els.get('dp-preview-31')._on.click();
-  const html = b.panel();
-  assert.match(html, /id="dp-confirm-31"/, 'mercury is armed');
-  assert.doesNotMatch(html, /id="dp-confirm-32"/, 'hoodify-finance is NOT');
-  assert.match(html, /id="dp-preview-32"/, 'and is still at step one');
+  assert.match(b.panel(), /mercury/);
+  assert.ok(b.gets.includes('/provisioning/instances'), 'via the own-projects roster');
 });
 
-test('confirming sends THAT project’s id and the version it was shown', async () => {
+test('a window with no location.search is the unscoped case, not a crash', async () => {
+  // The vm harness is the honest version of a browser that has not given us one; a page
+  // that threw here would take the whole deploy door down for an ordinary visit.
   const b = boot();
   await b.settle();
-  b.els.get('dp-preview-32')._on.click();
-  b.els.get('dp-confirm-32')._on.click();
-  await b.settle();
-  // Arming also asks for a dry run now (task 1004121), so the MOVE is the post that is
-  // not one — separated by its payload rather than by its position, because "the second
-  // post" would silently start asserting about the wrong request the next time the order
-  // changes.
-  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
-  assert.equal(moves.length, 1, 'exactly one move is sent');
-  assert.equal(moves[0].path, '/provisioning/instances/32/core-upgrade');
-  // Field-wise, not deepEqual: the body is built inside the vm realm, so its
-  // prototype is not this realm's Object and deepStrictEqual rejects it on identity
-  // alone — a harness artifact that says nothing about the payload.
-  assert.equal(moves[0].body.to, '1.19.871');
-  assert.deepEqual(Object.keys(moves[0].body), ['to'], 'and nothing else is sent');
-  // And the move must never carry the flag that would turn it into a no-op.
-  assert.equal(moves[0].body.dry_run, undefined, 'a move is not a dry run');
+  assert.match(b.panel(), /cloudbongos/);
 });
 
+// ---- the one box's states ---------------------------------------------------------
+
 test('a box with nothing newer offers no button', async () => {
   const b = boot({ controlPlane: preview('1', 'cloudbongos', { behind: false, recommended_version: null }) });
   await b.settle();
@@ -195,43 +226,35 @@ test('a database that is current, or whose state is unknown, gets no "behind" fl
   }
 });
 
-test('an unenrolled control plane still lets the projects through', async () => {
-  // The regression this pins: the platform's own missing row used to be the whole
-  // page, so one un-run setup command would hide every project too.
+test('an unenrolled control plane says so, in the server’s own words', async () => {
   const b = boot({ controlPlaneStatus: 404 });
   await b.settle();
-  const html = b.panel();
-  assert.match(html, /has no deploy door yet/, 'the server’s own sentence, naming the fix');
-  assert.match(html, /mercury/, 'and the projects are still listed');
-});
-
-test('a viewer without the fleet atom falls back to their own projects', async () => {
-  const b = boot({ fleetStatus: 403 });
-  await b.settle();
-  assert.match(b.panel(), /mercury/);
+  assert.match(b.panel(), /has no deploy door yet/, 'the server’s own sentence, naming the fix');
 });
 
-test('a move re-reads ONLY the box it moved, not every project again', async () => {
-  // The grader's finding on the first round: refreshing one row by re-running the
-  // whole page load fans a probe out at every hosted project, including ones the
-  // owner never touched.
+test('confirming sends the version it was shown, and nothing else', async () => {
   const b = boot();
   await b.settle();
-  b.gets.length = 0;
-  b.els.get('dp-preview-32')._on.click();
-  b.els.get('dp-confirm-32')._on.click();
+  b.els.get('dp-preview-1')._on.click();
+  b.els.get('dp-confirm-1')._on.click();
   await b.settle();
-  const previewReads = b.gets.filter((g) => g.endsWith('/core-upgrade'));
-  // Since task 1004145 a move POLLS, so the count is no longer one — and the count was
-  // only ever a proxy for the thing that matters. Asserted directly instead: every
-  // re-read is the moved box, and no other box is touched.
-  assert.ok(previewReads.length > 0, 'the moved box is re-read');
-  assert.deepEqual([...new Set(previewReads)], ['/provisioning/instances/32/core-upgrade'],
-    'and it is the ONLY box re-read — no fan-out across the fleet');
-  assert.ok(!b.gets.includes('/provisioning/fleet'), 'the fleet is not re-listed');
+  // Arming also asks for a dry run now (task 1004121), so the MOVE is the post that is
+  // not one — separated by its payload rather than by its position, because "the second
+  // post" would silently start asserting about the wrong request the next time the order
+  // changes.
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1, 'exactly one move is sent');
+  assert.equal(moves[0].path, '/provisioning/instances/1/core-upgrade');
+  // Field-wise, not deepEqual: the body is built inside the vm realm, so its
+  // prototype is not this realm's Object and deepStrictEqual rejects it on identity
+  // alone — a harness artifact that says nothing about the payload.
+  assert.equal(moves[0].body.to, '1.19.871');
+  assert.deepEqual(Object.keys(moves[0].body), ['to'], 'and nothing else is sent');
+  // And the move must never carry the flag that would turn it into a no-op.
+  assert.equal(moves[0].body.dry_run, undefined, 'a move is not a dry run');
 });
 
-test('a move on the platform row re-reads the control plane, not a tenant preview', async () => {
+test('a move re-reads its own box from its own endpoint, and no other', async () => {
   const b = boot();
   await b.settle();
   b.gets.length = 0;
@@ -239,7 +262,8 @@ test('a move on the platform row re-reads the control plane, not a tenant previe
   b.els.get('dp-confirm-1')._on.click();
   await b.settle();
   assert.ok(b.gets.includes('/provisioning/control-plane'), 'the self row is read from its own endpoint');
-  assert.ok(!b.gets.some((g) => /instances\/3\d\/core-upgrade/.test(g)), 'and no tenant is re-probed');
+  assert.ok(!b.gets.some((g) => /instances\/3\d\/core-upgrade/.test(g)), 'and no tenant is probed');
+  assert.ok(!b.gets.includes('/provisioning/fleet'), 'the fleet is not listed');
 });
 
 // ---- the pre-flight verdict on step two (task 1004121) ---------------------------
@@ -259,6 +283,82 @@ test('step two shows what the dry run found, not just a restatement of the actio
   assert.match(html, /database &quot;cloudbongos&quot; reachable|database "cloudbongos" reachable/, 'and shows what was checked');
 });
 
+// ── what the move would CARRY (task 1004173) ─────────────────────────────────────
+
+const CHANGES = {
+  from: '1.19.800', to: '1.19.871', more: 0,
+  entries: [
+    { text: 'Builders can now tick one box to see only their own work.' },
+    { id: '1004167', text: 'Groundwork for letting an owner make their code repository private.' },
+  ],
+};
+
+test('step two names what the move BRINGS IN, in the ships’ own words', async () => {
+  // The whole complaint: "I don't actually see what would change when I hit the button."
+  // The pre-flight answers whether the machinery will allow it, which is a different
+  // question, and answering it was being presented as the preview.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: [], error: null, changes: CHANGES },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /What this brings in/, 'the question the owner asked is answered');
+  assert.match(html, /2\s+pieces of work landed between core 1\.19\.800\s+and 1\.19\.871/);
+  assert.match(html, /tick one box to see only their own work/, 'in the ship’s own sentence');
+  assert.match(html, /code repository private/);
+  assert.match(html, /nothing blocks this move/i, 'and the verdict is STILL there below it');
+});
+
+test('a capped list says how many it did not show', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: [], error: null, changes: { ...CHANGES, more: 94 } },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  assert.match(b.panel(), /and 94 more, not listed/);
+});
+
+test('A RANGE THE RUNNER COULD NOT READ SAYS SO — never an empty list', async () => {
+  // "Nothing changed" over ninety-one releases is the one wrong impression this section
+  // could give, and it is exactly the shape a silent failure takes.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: [], error: null,
+      changes: { from: '1.19.800', to: '1.19.871', error: 'could not find those releases in the core history on this machine' } },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /Could not read what this would bring in/);
+  assert.match(html, /could not find those releases/, 'in the runner’s own words');
+  assert.doesNotMatch(html, /What this brings in/, 'and never dressed up as a list');
+});
+
+test('no change list at all renders nothing, rather than an empty heading', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    preflight: { target: '1.19.871', ok: true, lines: ['database reachable'], error: null },
+    preflight_at: new Date().toISOString(),
+  }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.doesNotMatch(html, /What this brings in/);
+  assert.doesNotMatch(html, /Could not read what this would bring in/);
+  assert.match(html, /nothing blocks this move/i, 'the verdict still shows');
+});
+
+test('the wait names what it is waiting for, and that the machine is being asked', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { preflight: null, preflight_at: null }) });
+  await b.settle();
+  b.els.get('dp-preview-1')._on.click();
+  const html = b.panel();
+  assert.match(html, /what it would bring in/, 'both halves of what is being fetched');
+  assert.match(html, /can take a couple of minutes/, 'and that the pause is expected');
+});
+
 test('a BLOCKED move says so, in the upgrade’s own words, and still offers the button', async () => {
   const b = boot({ controlPlane: preview('1', 'cloudbongos', {
     preflight: { target: '1.19.871', ok: false, lines: [], error: 'working tree not clean — commit/stash first, or pass --force.' },
@@ -334,7 +434,7 @@ test('a verdict already in hand is NOT re-requested', async () => {
 // once — before the runner's tick — then fell silent for the whole upgrade.
 
 test('confirming a move says so IMMEDIATELY, naming the version it is taking', async () => {
-  const b = boot();
+  const b = boot({ scope: 'hoodify-finance' });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
@@ -348,10 +448,9 @@ test('confirming a move says so IMMEDIATELY, naming the version it is taking', a
 test('the in-flight state survives the poll — it does not close under the reader', async () => {
   // refreshOne() returns a row to step one, which is right after a move and wrong
   // DURING one; without keepStep the poll wipes its own message on the first interval.
-  // Observed after a poll has actually run, but before the bound is exhausted.
   // A long bound so the loop cannot exhaust mid-assertion: the state under test exists
   // only WHILE it polls.
-  const b = boot({ moveTries: 500, instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  const b = boot({ scope: 'hoodify-finance', moveTries: 500, instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
@@ -365,6 +464,7 @@ test('when the box lands on the new core, it CONFIRMS it', async () => {
   // The whole ask: "confirmation when it updates". A changed number is not a
   // confirmation — nothing tied it to the press.
   const b = boot({
+    scope: 'hoodify-finance',
     instanceOver: (inst, n) => (n >= 2
       ? { served_version: '1.19.871', behind: false, open_intent: null, last_move: { target_version: '1.19.871', state: 'done', at: new Date().toISOString(), error: null } }
       : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
@@ -378,10 +478,65 @@ test('when the box lands on the new core, it CONFIRMS it', async () => {
   assert.doesNotMatch(html, /Moving to core/i, 'and the in-flight state is gone');
 });
 
+// ── a failure is dated, and stops being the headline once the box moves on (task 1004172)
+
+test('a live failure is DATED and says what the project is running now, in the present tense', async () => {
+  // The sentence this replaces said "was put back on 1.19.969" — a past-tense claim about
+  // a rollback, built by substituting the CURRENT reading into it. Present tense is a
+  // statement about the reading in hand, and true whenever the reading is.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.871', state: 'error', at: new Date(Date.now() - 3 * 60 * 1000).toISOString(), error: 'working tree not clean', superseded: false },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /did not land/i, 'the failure is stated');
+  assert.match(html, /attempted\s+\d+\s*(s|min|h) ago/i, 'and DATED — an undated failure reads as the present forever');
+  assert.match(html, /is still running core 1\.19\.800/i, 'present tense about the reading in hand');
+  assert.doesNotMatch(html, /was put back on/i, 'never a past-tense claim built from a current reading');
+});
+
+test('a failure the box has moved past is demoted to history, not painted as the current state', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.700', state: 'error', at: new Date(Date.now() - 2 * 24 * 3600 * 1000).toISOString(), error: 'Postgres has no role "root"', superseded: true },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /An earlier attempt did not land/i, 'it is framed as history');
+  assert.match(html, /has moved on since/i, 'and says the box recovered');
+  assert.match(html, /dp-settled--past/, 'and wears the history mark, not the danger one');
+  assert.doesNotMatch(html, /dp-settled--failed/, 'the live-failure treatment is NOT applied');
+  // "55h ago" is arithmetic the reader has to do before they can tell whether it is news.
+  assert.match(html, /failed 2 days ago/, 'past two days the age reads in days, not hours');
+});
+
+test('the runner’s shell output is folded behind a disclosure, never the headline', async () => {
+  // upgrade.js's dirty-tree refusal prints a whole `git status` — 33 lines on test4 —
+  // and names a fix addressed to whoever holds a shell, which the owner does not.
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'working tree not clean — commit/stash first', superseded: false },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /<details class="dp-settled__detail"><summary>What the upgrade said<\/summary>/, 'folded');
+  assert.match(html, /working tree not clean/, 'and the words are still all there');
+  assert.ok(html.indexOf('did not land') < html.indexOf('<details'), 'the plain sentence comes first');
+});
+
+test('a failure with no recorded time says nothing about when, rather than inventing one', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', {
+    last_move: { target_version: '1.19.871', state: 'error', at: null, error: 'x', superseded: false },
+  }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /did not land/i);
+  assert.doesNotMatch(html, /attempted never/i, 'the "never" the age formatter returns must not reach the copy as a date');
+});
+
 test('a FAILED move is reported, with the reason, instead of looking untouched', async () => {
   // An errored intent is not an OPEN intent, so before last_move existed the payload
   // after a rolled-back upgrade was identical to the payload before it.
   const b = boot({
+    scope: 'hoodify-finance',
     instanceOver: (inst, n) => (n >= 2
       ? { open_intent: null, last_move: { target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'working tree not clean — commit/stash first, or pass --force.' } }
       : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
@@ -393,12 +548,12 @@ test('a FAILED move is reported, with the reason, instead of looking untouched',
   const html = b.panel();
   assert.match(html, /did not land/i, 'the failure is stated');
   assert.match(html, /working tree not clean/, 'and carries the runner’s own reason');
-  assert.match(html, /put back on 1\.19\.800/i, 'and says the project is still running');
+  assert.match(html, /is still running core 1\.19\.800/i, 'and says what the project is running now');
 });
 
 test('a poll that runs out says it is still working, not that it failed', async () => {
   // MOVE_TRIES is a bound on this page's patience, not on the runner's work.
-  const b = boot({ instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  const b = boot({ scope: 'hoodify-finance', instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();
@@ -414,7 +569,7 @@ test('a queue that is REFUSED leaves no in-flight state to wait on', async () =>
   // `b.postFails`, a property the harness never read. So it asserted "no in-flight
   // state" on a row where no move had been attempted, which is true of every row on the
   // page. The grader caught it. It now refuses the POST for real and presses the button.
-  const b = boot({ postStatus: 409 });
+  const b = boot({ scope: 'hoodify-finance', postStatus: 409 });
   await b.settle();
   b.els.get('dp-preview-32')._on.click();
   b.els.get('dp-confirm-32')._on.click();