@bongos/core 1.19.972 → 1.19.974

package/modules/hall-ui/public/deploy.js

@@ -1,5 +1,5 @@
 // deploy.js — the owner's deploy door (task 1003159, ADR 0293; widened to the
-// hosted projects by task 1004046).
+// hosted projects by task 1004046, narrowed back to ONE project by task 1004171).
 //
 // WHAT THIS PAGE IS FOR. The owner, twice in a month: "I don't think I can make anything
 // live", then "this is above my paygrade." Moving a core pin is gate 3 of the release
@@ -9,18 +9,27 @@
 // `sudo -u <app user>` over ssh by design. So the one gate that is the owner's to hold was the
 // one gate with no instrument. This page is the instrument.
 //
-// WHY THE PROJECTS ARE HERE AND NOT IN THEIR OWN HALLS. The obvious shape — each owner
-// pressing Upgrade in their own project's hall — is not buildable: the upgrade route and
-// the intent queue belong to the PROVISIONING module, and a hosted project does not run
-// it. Probed 2026-09-18: /api/bongos/provisioning/health answers 200 here and 404 on
-// every tenant. The control plane is the only place that can act on them, so this is
-// where the button lives. Their own halls get the banner instead (task 1004045), which
-// each instance derives for itself from the registry and needs nothing from us.
+// ONE PAGE, ONE PROJECT (task 1004171). The owner, 2026-09-22: "Should not show core pin
+// upgrades for all of the projects", and then the rule — "it should only show the project
+// of that builders hall", "every project has the option to upgrade its version of bongos
+// including bongos itself."
 //
-// Nothing about the ENGINE had to change for this. UPGRADE_SHAPES already admitted
-// 'co-tenant' and 'standalone' alongside 'control-plane', coreUpgradeInstance already
-// resolved each shape's own checkout and built that box's own health and version URLs,
-// and the preview route already took any instance id. Only this page was single-row.
+// So the default view is the hall's OWN project and nothing else. On the control plane
+// that is the self row. What this replaces is task 1004046's shape, which listed every
+// live instance here because a hosted project cannot act on itself: the upgrade route and
+// the intent queue belong to the PROVISIONING module, and a tenant does not run it
+// (probed 2026-09-18: /api/bongos/provisioning/health answers 200 here, 404 on every
+// tenant). That reasoning still holds — the ACT still has to happen on the control plane —
+// but it does not license a page in one project's hall that offers to restart five other
+// projects, two of them belonging to builders who never asked. On 2026-09-22 this page
+// listed six boxes and the owner wanted one.
+//
+// WHICH IS WHY ?project= EXISTS, and it is not a fleet browser. A hosted project's hall
+// hands its owner off to this page scoped to THAT project (task 1004174), because the
+// hand-off is how a tenant reaches a working control without the tenant's web tier
+// gaining any capability — the split ADR 0293 D1 and ADR 0043 both turn on. Scoped or
+// not, the page renders exactly one row, and authority is still resolved server-side per
+// request: a slug in a query string decides what is LOOKED at, never what is allowed.
 //
 // THE RULE THAT SHAPES EVERY LINE HERE: this page KNOWS NOTHING. Every version on it is a
 // reading the control-plane runner took on the box, carried through the server with the
@@ -34,10 +43,11 @@
 // already guards the bad release; this guards the wrong button. Step one shows what would
 // move; step two names the version it saw and sends that. The confirm button is built
 // FROM the previewed version, so a release that lands between the two steps cannot
-// silently change what the press does. With several boxes on one page the step is held
-// PER BOX, and each button's handler CLOSES OVER the preview object it was built from —
-// so the version sent is the one that box displayed, and a repaint cannot swap it. A
-// page-wide "currently previewing" would be a wrong-box press waiting to happen.
+// silently change what the press does. The step is still keyed BY INSTANCE rather than
+// held page-wide, and each button's handler still CLOSES OVER the preview object it was
+// built from — so the version sent is the one that was displayed and a repaint cannot
+// swap it. That survives the narrowing to one row on purpose: the identity being carried
+// is the box's, and keying it to the box is what made a wrong-box press unrepresentable.
 (() => {
   'use strict';
 
@@ -106,7 +116,14 @@
     if (secs < 90) return `${secs}s ago`;
     const mins = Math.round(secs / 60);
     if (mins < 90) return `${mins} min ago`;
-    return `${Math.round(mins / 60)}h ago`;
+    const hours = Math.round(mins / 60);
+    // PAST TWO DAYS, HOURS STOP BEING A DURATION AND BECOME A NUMBER (task 1004172).
+    // The failure that motivated dating these at all rendered "55h ago", which is
+    // arithmetic the reader has to do before they can tell whether it is news. Days are
+    // the unit a two-day-old attempt is actually read in.
+    if (hours < 48) return `${hours}h ago`;
+    const days = Math.round(hours / 24);
+    return `${days} day${days === 1 ? '' : 's'} ago`;
   }
 
   function versionHtml(v) {
@@ -147,15 +164,47 @@
   // AND WHAT IT SEES AFTERWARDS. Three outcomes, and the failure is the one that had no
   // surface at all before this: an errored intent is not an OPEN intent, so the payload
   // after a rolled-back upgrade used to be identical to the payload before it.
+  //
+  // A FAILURE IS DATED, AND STOPS BEING THE HEADLINE ONCE THE BOX HAS MOVED ON
+  // (task 1004172). What this block used to render, undated, at the top of the page:
+  // "The move to core 1.19.921 did not land — this project was put back on 1.19.969 and
+  // is running." The attempt was two days old, the box had reached 1.19.969 by another
+  // road, and the cause it named had been fixed and released in between. Three defects in
+  // one sentence: no date, a PAST-tense claim ("was put back on") built from a PRESENT
+  // reading, and no notion that a box can recover.
+  //
+  // The rollback clause is present-tense now, which is the whole fix for the false half:
+  // "is still running core X" is a statement about the reading in hand, and true whenever
+  // the reading is. The page does not decide whether a failure is history — `superseded`
+  // is the server's answer (modules/provisioning/core-upgrade.js), because this page
+  // compares no versions.
   function settledHtml(p) {
     const m = p.last_move;
     if (!m) return '';
+    const when = m.at ? ` ${escapeHtml(ago(m.at))}` : '';
+    // The runner's own words, which name a fix addressed to someone holding a shell. Kept
+    // verbatim and kept CLOSED: the owner cannot run `sudo -u`, so 30 lines of it (the
+    // dirty-tree refusal prints a whole `git status`) is not what a deploy page leads on.
+    const detail = m.error
+      ? `<details class="dp-settled__detail"><summary>What the upgrade said</summary>
+          <pre class="dp-preflight__error">${escapeHtml(String(m.error))}</pre></details>`
+      : '';
+    if (m.state === 'error' && m.superseded) {
+      return `
+        <div class="dp-settled dp-settled--past">
+          <p class="ov-row__sub"><strong>An earlier attempt did not land.</strong> A move to core
+            ${escapeHtml(String(m.target_version))} failed${when} — this project has moved on since,
+            and is serving ${escapeHtml(String(p.served_version))} now. Whatever stopped that one
+            may or may not still apply; the check above is the live answer.</p>
+          ${detail}
+        </div>`;
+    }
     if (m.state === 'error') {
       return `
         <div class="dp-settled dp-settled--failed">
           <p class="ov-row__sub"><strong>The move to core ${escapeHtml(String(m.target_version))} did not land</strong>
-            — this project was put back on ${escapeHtml(String(p.served_version))} and is running.</p>
-          ${m.error ? `<pre class="dp-preflight__error">${escapeHtml(String(m.error))}</pre>` : ''}
+            — attempted${when}. This project is still running core ${escapeHtml(String(p.served_version))}.</p>
+          ${detail}
         </div>`;
     }
     if (m.state === 'done' && m.target_version === p.served_version) {
@@ -193,7 +242,11 @@
   function preflightHtml(p) {
     const pf = p.preflight;
     if (checking.has(String(p.instance_id)) && !(pf && pf.target === p.recommended_version)) {
-      return `<p class="ov-row__sub dp-preflight dp-preflight--checking">Checking what this would do…</p>`;
+      // NAME WHAT THE WAIT IS FOR (task 1004173). The runner picks this up on its own
+      // ~2-minute tick and then reads the box, so a bare spinner leaves the owner watching
+      // an unexplained pause on the one page where a pause could mean a live box is busy.
+      return `<p class="ov-row__sub dp-preflight dp-preflight--checking">Checking what this would do, and what it would bring in.
+        The answer comes from the machine itself, so it can take a couple of minutes.</p>`;
     }
     // No verdict is its own state, and it is NOT "fine". A silent gap here is how the
     // page used to promise a preview it never performed.
@@ -253,9 +306,7 @@
       if (steps.get(p.instance_id) !== 'confirm') break;   // the row was closed; stop.
       try {
         await refreshOne(p, { keepStep: true });
-        const now = (view.self && String(view.self.instance_id) === id)
-          ? view.self
-          : view.boxes.find((b) => String(b.instance_id) === id);
+        const now = view.box && String(view.box.instance_id) === id ? view.box : null;
         if (now && now.preflight && now.preflight.target === now.recommended_version) break;
       } catch (e) { break; }
     }
@@ -264,10 +315,51 @@
     repaint();
   }
 
+  // WHAT THE MOVE WOULD CARRY (task 1004173). The owner: "I don't actually see what would
+  // change when I hit the button." The pre-flight below answers whether the machinery will
+  // allow the move; this answers what taking it buys, in the words the ships themselves
+  // wrote — which are already addressed to this reader, because ship.js demands a summary
+  // an owner can read and posts it to Discord.
+  //
+  // AN EMPTY LIST IS NEVER RENDERED AS "NOTHING CHANGED". A range the runner could not
+  // resolve — no core history on the machine, a release it cannot find — comes back as an
+  // error and says so. "Nothing changed" over ninety-one releases is the one wrong
+  // impression this section could give, and it is the shape a silent failure takes.
+  function changesHtml(p) {
+    const pf = p.preflight;
+    const c = pf && pf.changes;
+    if (!c) return '';
+    if (c.error) {
+      return `<div class="dp-changes dp-changes--unknown">
+          <p class="ov-row__sub">Could not read what this would bring in: ${escapeHtml(String(c.error))}.
+            The check below still applies.</p>
+        </div>`;
+    }
+    const entries = Array.isArray(c.entries) ? c.entries : [];
+    if (!entries.length) {
+      return `<div class="dp-changes dp-changes--unknown">
+          <p class="ov-row__sub">No shipped work is recorded between core ${escapeHtml(String(c.from))} and
+            ${escapeHtml(String(c.to))}.</p>
+        </div>`;
+    }
+    const items = entries.map((e) => `<li>${escapeHtml(String(e.text))}</li>`).join('');
+    const more = c.more > 0
+      ? `<p class="ov-row__sub dp-changes__more">…and ${escapeHtml(String(c.more))} more, not listed.</p>`
+      : '';
+    return `<div class="dp-changes">
+        <p class="ov-row__sub"><strong>What this brings in</strong> — ${escapeHtml(String(entries.length))}
+          ${entries.length === 1 ? 'piece' : 'pieces'} of work landed between core ${escapeHtml(String(c.from))}
+          and ${escapeHtml(String(c.to))}${c.more > 0 ? ', newest first' : ''}:</p>
+        <ul class="dp-changes__list">${items}</ul>
+        ${more}
+      </div>`;
+  }
+
   function stepTwoHtml(p, isSelf) {
     const id = escapeHtml(String(p.instance_id));
     return `
       <div class="ps-controls">
+        ${changesHtml(p)}
         ${preflightHtml(p)}
         <p class="ov-row__sub">This restarts ${isSelf ? 'the platform' : escapeHtml(String(p.slug))} onto core
           <strong>${escapeHtml(String(p.recommended_version))}</strong>. It waits for the box to answer and
@@ -315,13 +407,13 @@
       </div></li>`;
   }
 
-  // A project whose preview could not be read at all. It is LISTED rather than dropped:
-  // a box silently missing from a deploy page reads as a box that does not need
-  // deploying, which is the one wrong impression this page must never give.
-  function unreadableHtml(inst, message) {
+  // The one project's preview could not be read. It is still RENDERED, named, rather
+  // than leaving the page blank: a box missing from a deploy page reads as a box that
+  // does not need deploying, which is the one wrong impression this page must never give.
+  function unreadableHtml(name, message) {
     return `
       <li class="ov-row"><div class="ov-row__main">
-        <span class="ov-row__title">${escapeHtml(String(inst.slug))}</span>
+        <span class="ov-row__title">${escapeHtml(String(name))}</span>
         <p class="ps-invalid">Could not read this project's deploy state: ${escapeHtml(message)}</p>
       </div></li>`;
   }
@@ -338,33 +430,30 @@
     if (confirm) confirm.addEventListener('click', () => move(p));
   }
 
-  // What the page is currently showing: the self row (or null), the readable project
-  // previews, and the ones that would not read. Held so a repaint after a click does not
-  // have to re-fetch everything.
-  let view = { self: null, boxes: [], unreadable: [], notEnrolled: null };
+  // What the page is currently showing: the ONE box this hall is about, whether that box
+  // is this platform itself, and — instead of a box — the reason there isn't one. Held so
+  // a repaint after a click does not have to re-fetch.
+  let view = { box: null, isSelf: true, name: 'This platform', notEnrolled: null, unreadable: null };
 
   function repaint() {
-    const items = [];
-    if (view.self) items.push(boxHtml(view.self, true));
+    let item;
+    if (view.box) item = boxHtml(view.box, view.isSelf);
     else if (view.notEnrolled) {
       // The server's own sentence names the one command that fixes it, which is why it
       // is shown rather than a generic failure line.
-      items.push(`<li class="ov-row"><div class="ov-row__main">
-        <span class="ov-row__title">This platform</span>
+      item = `<li class="ov-row"><div class="ov-row__main">
+        <span class="ov-row__title">${escapeHtml(String(view.name))}</span>
         <p class="ps-invalid">${escapeHtml(view.notEnrolled)}</p>
-      </div></li>`);
-    }
-    for (const p of view.boxes) items.push(boxHtml(p, false));
-    for (const u of view.unreadable) items.push(unreadableHtml(u.inst, u.message));
-    if (!items.length) {
-      items.push(`<li class="ov-row"><div class="ov-row__main">
+      </div></li>`;
+    } else if (view.unreadable) item = unreadableHtml(view.name, view.unreadable);
+    else {
+      item = `<li class="ov-row"><div class="ov-row__main">
         <p class="ov-row__sub">No running box to deploy.</p>
-      </div></li>`);
+      </div></li>`;
     }
-    $('dp-panel').innerHTML = `<ul class="ov-lines">${items.join('')}</ul>
+    $('dp-panel').innerHTML = `<ul class="ov-lines">${item}</ul>
       <p class="ps-prov">reads the control plane's own observation · ADR 0293 · every move is recorded with who asked</p>`;
-    if (view.self) wire(view.self);
-    for (const p of view.boxes) wire(p);
+    if (view.box) wire(view.box);
   }
 
   async function move(p) {
@@ -400,9 +489,7 @@
         // keepStep, for the reason the pre-flight poll documents: a refresh that resets
         // the row would fight the state this loop is painting, every interval.
         await refreshOne(p, { keepStep: true });
-        now = (view.self && String(view.self.instance_id) === id)
-          ? view.self
-          : view.boxes.find((b) => String(b.instance_id) === id);
+        now = view.box && String(view.box.instance_id) === id ? view.box : null;
       } catch (e) { break; }
       if (!now) break;
       // Settled two ways, and BOTH need the intent to be closed: served_version can
@@ -419,21 +506,18 @@
     if (!settled) toast(`Still working on core ${to}. It keeps going without this page — reload to see where it got to.`);
   }
 
-  // Re-read ONLY the box that just changed. The full load() fans out one probe per
-  // hosted project, and firing all of them to refresh one row is cache invalidation
-  // far wider than the change — it also re-probes boxes the owner never touched. A
-  // failure here falls back to the full read, because a stale row on a deploy page is
-  // the one thing worse than an extra request.
+  // Re-read the box. Its own endpoint, never the full load(): the self row and a scoped
+  // project are read from different places, and load() also re-resolves the scope. A
+  // failure here falls back to the full read, because a stale row on a deploy page is the
+  // one thing worse than an extra request.
   // `keepStep` is for the pre-flight poll (task 1004121): a refresh AFTER a move should
   // return the row to step one, but a refresh DURING the wait must not — it would close
   // the panel the owner is reading, under them, every two seconds.
   async function refreshOne(p, { keepStep = false } = {}) {
     const id = String(p.instance_id);
-    const isSelf = view.self && String(view.self.instance_id) === id;
     try {
-      const d = await fetchJson(isSelf ? '/provisioning/control-plane' : `/provisioning/instances/${id}/core-upgrade`);
-      if (isSelf) view.self = d.preview;
-      else view.boxes = view.boxes.map((b) => (String(b.instance_id) === id ? d.preview : b));
+      const d = await fetchJson(view.isSelf ? '/provisioning/control-plane' : `/provisioning/instances/${id}/core-upgrade`);
+      view.box = d.preview;
       if (!keepStep) steps.set(p.instance_id, 'preview');
       repaint();
     } catch (e) {
@@ -442,68 +526,73 @@
     }
   }
 
-  // The projects this control plane hosts. `/provisioning/fleet` is the whole roster and
-  // needs its own atom; a holder of core.pin.move who lacks it still gets their OWN
-  // projects rather than an error, because the pin move itself is gated server-side per
-  // instance either way — this choice only decides what the page can LIST.
-  async function hostedProjects() {
+  // Which project is this page about? The hall's own unless a scope was asked for.
+  //
+  // READ OFF `location`, DEFENSIVELY. The page runs in a vm harness whose `window.location`
+  // is a stub with no `search`, and a page that threw there would be untestable — but the
+  // deeper reason is that a missing scope is the ORDINARY case and must cost nothing.
+  function scopeSlug() {
+    try {
+      const q = String((window.location && window.location.search) || '');
+      const m = /[?&]project=([^&#]+)/.exec(q);
+      return m ? decodeURIComponent(m[1]) : null;
+    } catch (e) { return null; }
+  }
+
+  // Resolve a scoped slug to the instance the control plane knows by that name.
+  //
+  // `/provisioning/fleet` is the whole roster and needs its own atom; a holder of
+  // core.pin.move who lacks it falls back to their OWN projects, which is the set a
+  // project's owner is arriving from anyway. This is a LOOKUP, not a listing: exactly one
+  // row survives it, and the pin move is gated server-side per instance regardless — the
+  // slug decides what is looked at, never what is allowed.
+  async function findBySlug(slug) {
+    let rows = [];
     try {
-      const d = await fetchJson('/provisioning/fleet');
-      return d.instances || [];
+      rows = (await fetchJson('/provisioning/fleet')).instances || [];
     } catch (e) {
-      if (e && e.kind === '403') {
-        const d = await fetchJson('/provisioning/instances');
-        return d.instances || [];
-      }
-      throw e;
+      if (e && e.kind !== '403') throw e;
+      rows = (await fetchJson('/provisioning/instances')).instances || [];
     }
+    return rows.find((i) => i && String(i.slug) === slug) || null;
   }
 
-  // Only a RUNNING box can have its pin moved, and the runner refuses every other shape.
-  // Filtering here keeps torn-down rows — there are far more of them than live ones — off
-  // a page whose whole job is naming what is live.
-  const UPGRADEABLE = new Set(['standalone', 'co-tenant']);
-  const isLive = (i) => i && i.status === 'active' && UPGRADEABLE.has(i.hosting_shape);
-
   async function load() {
+    const slug = scopeSlug();
     try {
-      let self = null;
-      let notEnrolled = null;
-      try {
-        const d = await fetchJson('/provisioning/control-plane');
-        self = d.preview;
-      } catch (e) {
-        if (e && e.kind === '401') return;
-        if (e && e.kind === '403') throw e;
-        notEnrolled = e.message || 'This platform has no deploy door yet.';
-      }
-
-      const live = (await hostedProjects()).filter(isLive);
-      // One preview per project, in parallel and INDEPENDENTLY: one project that cannot
-      // be read must not blank the page for the others. The request count scales with the
-      // fleet, which is deliberate and bounded — each is a cached server-side reading, not
-      // a live probe of the box, and this page exists precisely to show every box's state
-      // at once. It is re-read on OPEN only; a move refreshes just its own row.
-      const settled = await Promise.all(live.map(async (inst) => {
+      if (!slug) {
+        // THE HALL'S OWN PROJECT. On the control plane that is the self row, which is why
+        // this endpoint exists: the row is created once at install time and its id differs
+        // per install, so the page cannot be expected to know it.
+        view = { box: null, isSelf: true, name: 'This platform', notEnrolled: null, unreadable: null };
         try {
-          const d = await fetchJson(`/provisioning/instances/${inst.id}/core-upgrade`);
-          return { ok: true, preview: d.preview };
+          view.box = (await fetchJson('/provisioning/control-plane')).preview;
+          view.name = (view.box && view.box.slug) || 'This platform';
         } catch (e) {
-          if (e && e.kind === '401') return { ok: false, inst, message: 'not signed in' };
-          return { ok: false, inst, message: (e && e.message) || 'unknown error' };
+          if (e && e.kind === '401') return;
+          if (e && e.kind === '403') throw e;
+          view.notEnrolled = e.message || 'This platform has no deploy door yet.';
         }
-      }));
-
-      view = {
-        self,
-        notEnrolled,
-        boxes: settled.filter((s) => s.ok).map((s) => s.preview),
-        unreadable: settled.filter((s) => !s.ok).map((s) => ({ inst: s.inst, message: s.message })),
-      };
-      const n = view.boxes.length + view.unreadable.length;
-      $('dp-sub').textContent = n
-        ? `This platform and ${n} hosted project${n === 1 ? '' : 's'}`
-        : 'This platform';
+        $('dp-sub').textContent = (view.box && view.box.slug) || 'This platform';
+      } else {
+        view = { box: null, isSelf: false, name: slug, notEnrolled: null, unreadable: null };
+        const inst = await findBySlug(slug);
+        if (!inst) {
+          // NAMED, NOT BLANK. A project the control plane cannot find is a wrong link or a
+          // torn-down project, and both are worth saying out loud — a deploy page that
+          // renders nothing reads as a project with nothing to deploy.
+          view.unreadable = 'no project by that name is hosted here.';
+        } else {
+          try {
+            view.box = (await fetchJson(`/provisioning/instances/${inst.id}/core-upgrade`)).preview;
+          } catch (e) {
+            if (e && e.kind === '401') return;
+            if (e && e.kind === '403') throw e;
+            view.unreadable = (e && e.message) || 'unknown error';
+          }
+        }
+        $('dp-sub').textContent = slug;
+      }
       $('dp-body').hidden = false;
       repaint();
     } catch (e) {

package/modules/hall-ui/public/project-settings.css

@@ -128,6 +128,23 @@
   overflow-x: auto;
 }
 
+/* What the move would BRING IN (task 1004173) — the ships' own summaries between the two
+   releases. It sits above the pre-flight because it is the question the owner asked
+   ("I don't actually see what would change"); the verdict below it is the machinery's
+   answer to a different one. No mark of its own: this is the body of step two, not a
+   state, and a coloured bar here would compete with the three that DO mean something. */
+.dp-changes { margin: 0 0 0.7rem; }
+.dp-changes__list {
+  margin: 0.35rem 0 0;
+  padding-left: 1.1rem;
+  color: var(--ink-soft);
+  font-size: 0.86rem;
+  line-height: 1.55;
+}
+.dp-changes__list li { margin-bottom: 0.35rem; }
+.dp-changes__more { color: var(--ink-soft); font-style: italic; }
+.dp-changes--unknown { color: var(--ink-soft); }
+
 /* A move in flight, and how it ended (task 1004145). The owner pressed Upgrade and got
    a toast and then silence; these are the two states that silence was hiding. */
 .dp-moving {
@@ -143,3 +160,22 @@
   border-left: 3px solid var(--danger);
   padding-left: 0.7rem;
 }
+/* A failure the box has already moved past (task 1004172). It keeps a mark, because it
+   is still a thing that happened and worth reading — but not the danger mark, which on
+   this page means "your project is in this state now". A two-day-old refusal wearing the
+   same red as a live one is how the owner read a solved problem as the current one. */
+.dp-settled--past {
+  border-left: 3px solid var(--rule);
+  padding-left: 0.7rem;
+  color: var(--ink-soft);
+}
+/* The runner's own output, folded. It runs to thirty lines when the refusal is a dirty
+   tree (it prints the whole `git status`) and it addresses whoever holds a shell, which
+   the owner does not — so the sentence above it leads and this opens on request. */
+.dp-settled__detail > summary {
+  cursor: pointer;
+  font-size: 0.82rem;
+  color: var(--ink-soft);
+  padding: 0.35rem 0;
+  min-height: 24px;
+}

package/modules/provisioning/core-upgrade.js

@@ -225,6 +225,60 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
   };
 }
 
+/**
+ * Has the box moved on from the last move this control would report? PURE (task 1004172).
+ *
+ * WHY THIS QUESTION EXISTS. On 2026-09-22 the deploy page's most prominent element was:
+ * "The move to core 1.19.921 did not land — this project was put back on 1.19.969 and is
+ * running", with no date on it. That move was attempted two days earlier, the box had
+ * since reached 1.19.969 by a different route, and the cause it named (`sudo` with no
+ * `-u`) had been fixed and released in 1.19.928. Every word of it was history rendered as
+ * the present, and the owner read it, correctly, as the page having no feedback to give.
+ *
+ * THE TEST IS THE ONE `preflight` ALREADY USES, and deliberately so: a verdict about
+ * 1.19.920 tells the owner nothing true about pressing a button that says 1.19.972, and
+ * neither does a failure about it. So a move is superseded when the box now SERVES what
+ * that move was reaching for — it got there, by whatever road — or when the move on offer
+ * is a different one entirely.
+ *
+ * NO VERSION ORDERING IS COMPUTED, here or anywhere else in this file. "Is 1.19.969 newer
+ * than 1.19.921" is a question this layer does not need to ask to answer "is this news",
+ * and not asking it is what keeps the one comparison in the system (the runner's channel
+ * resolution) the only one that can be wrong.
+ *
+ * An unknown `recommended` — the registry could not be read — leaves a failure STANDING.
+ * Not knowing what is on offer is not evidence that the box recovered, and the direction
+ * to fail in is showing an old failure, never hiding a live one.
+ */
+function lastMoveSuperseded(target, served, recommended) {
+  if (!target) return false;
+  if (served && String(served) === String(target)) return true;
+  return !!(recommended && String(recommended) !== String(target));
+}
+
+/**
+ * The cached dry-run verdict, IF it is about the move now on offer. PURE (task 1004173).
+ *
+ * Two independent staleness questions, and they have different answers:
+ *
+ *   • the VERDICT is about a target — a pass taken against 1.19.920 says nothing true
+ *     about a button that reads 1.19.972, and a stale pass is worse than no answer
+ *     because it reads as a guarantee. Withheld whole.
+ *   • the CHANGE LIST is about a RANGE, so it also depends on where the box is starting
+ *     from. Its `from` is the version that was live when the dry run ran; if the box has
+ *     moved since, the list still describes a real stretch of history but not the one
+ *     this move covers. Only the list is dropped — the verdict beside it is still true.
+ *
+ * Collapsing the two would mean either throwing away a good verdict or showing a range
+ * that starts somewhere the box no longer is.
+ */
+function preflightForOffer(pf, served, recommended) {
+  if (!pf || !recommended || pf.target !== recommended) return null;
+  const ch = pf.changes;
+  if (!ch || !ch.from || String(ch.from) === String(served || '')) return pf;
+  return { ...pf, changes: null };
+}
+
 /**
  * What the control shows BEFORE anything is pressed — step one of the two-step (D4).
  *
@@ -266,7 +320,7 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     // Withheld unless it was taken against the move now on offer: a verdict about
     // 1.19.920 tells the owner nothing true about pressing a button that says 1.19.921,
     // and a stale pass is worse than no answer because it reads as a guarantee.
-    preflight: pf && recommended && pf.target === recommended ? pf : null,
+    preflight: preflightForOffer(pf, served, recommended),
     preflight_at: pf && recommended && pf.target === recommended ? (snap.preflight_at || null) : null,
     open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null } : null,
     // THE LAST MOVE, WHATEVER BECAME OF IT (task 1004145).
@@ -284,6 +338,11 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
       target_version: lastMove.target_version || null,
       state: lastMove.state,
       at: lastMove.resolved_at || lastMove.updated_at || null,
+      // Whether this is still news about the box's CURRENT state, or history the box has
+      // already moved past (task 1004172 — lastMoveSuperseded says why at length). The
+      // CLIENT must not work this out: the page's standing rule is that it compares no
+      // versions, and this is a version question wearing a different hat.
+      superseded: lastMoveSuperseded(lastMove.target_version, served, recommended),
       // Truncated because it reaches a DOM and upgrade.js's refusals can carry a whole
       // `git status` (the dirty-tree one lists every file).
       error: lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
@@ -356,5 +415,5 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
   };
 }
 
-module.exports = { CORE_UPGRADE_FROM, lastCoreMove, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/public-landing/public/contact.html

@@ -68,6 +68,6 @@
   </section>
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a></nav></footer>
 </body>
 </html>

package/modules/public-landing/public/index.html

@@ -897,7 +897,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
 
 <footer>
   <div class="footrow">
-    <p><!--apex-only:start-->A non-profit, capture-resistant commons. <!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.</p>
+    <p><!--apex-only:start-->A non-profit, capture-resistant commons. <!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).</p>
     <a href="#about">About</a>
     <a href="/docs">Docs</a>
     <a href="/privacy">Privacy</a>

package/modules/public-landing/public/privacy.html

@@ -77,6 +77,6 @@
   </section>
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a></nav></footer>
 </body>
 </html>

package/modules/public-landing/public/projects.html

@@ -1407,7 +1407,7 @@ summary{min-height:24px;padding:3px 0;}
 
 </main>
 
-<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">Open source (AGPL-3.0)</a>.<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
+<footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
 
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this