@bongos/core 1.20.30 → 1.20.31

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.30",
-  "core_contract": "1.20.30",
-  "source_commit": "b56a05d974ae5208394507078971bf8e22f415f3",
+  "core_version": "1.20.31",
+  "core_contract": "1.20.31",
+  "source_commit": "7d9880eac50e580874638a8cca10da6606c18228",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T21:06:55.806Z",
+  "built_at": "2026-09-30T21:24:24.438Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 562,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2663,
+    "functional_verbatim": 2666,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3251,
-  "tree_sha256": "3b45f4c67302ad870157396c60f693712b46bcdc86a9236e964c914418657c35",
+  "file_count": 3254,
+  "tree_sha256": "88a5431f2eb9f9248c57014423f4881035e2d1b9a6cee88740a6800ab933ba38",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "fca494d7f518bc42742fde6c5ba2e45cfbf0605d5a7a79024bba190ec4c3c1da"
+      "sha256": "fd78a2ab7d52f77fbd7181a64af68b8cf4c45c25693bf7dbf31e1b9bba69ada7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7282,7 +7282,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "7604ea4c137c5c1cedca41329cfd6fce49458d454f2e956944f7fb8d0c4ab10a"
+      "sha256": "5467ab673dfad5969dec0029188d0be18ea82732a26f99bca720de6680e1d618"
     },
     {
       "path": "modules/provisioning/cost-ledger.js",
@@ -7464,6 +7464,11 @@
       "mode": "0000644",
       "sha256": "7287181b4b42d3e391cd97e19ffa5fbc76026e81ad6f54648eb12a69dfea55a1"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_031_intent_not_before.sql",
+      "mode": "0000644",
+      "sha256": "a93d8946cbe4631b2af64b2e3638dca188981032a08f5d29d63e4d0adb22d235"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -7512,7 +7517,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "f2dd673e30cf17abbfbadd3c0142616a1c40b3b680c865b57db8330933816405"
+      "sha256": "fb4f09b621654eebe595dcbca305773ea11ed063506a6e4116391e43566a540d"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -8982,12 +8987,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "872b4c6ad6eacb09cbcd5698c892fc798ce6e632b505304b5665c7f04ea99325"
+      "sha256": "892ad66ccaa864ee07860cd8578f134a72f8cc48625f728f186eaa0f994ac8ad"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6c29a554265b6c3e6fa7f29fbf9b334c3a73e30b240b393498b89304876b5495"
+      "sha256": "fdebee1582c5673a44b97471f05814ab6bc8e850958ca3131e4a356f3a663d90"
     },
     {
       "path": "public-docs/index.html",
@@ -9007,7 +9012,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "1ce998432070110f9c3a9b128145bf8d44c032aa2ff55437207ecaf5efe8943a"
+      "sha256": "4398d89d420cf704f3030db8752e1f9e67321e43e49b0765e23329c26160385e"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9739,6 +9744,11 @@
       "mode": "0000644",
       "sha256": "7b2402543c3b1eadbafc14907e6dc6689b434ac65fb9c709115dd81a92eb13eb"
     },
+    {
+      "path": "scripts/gds/intent-retry.js",
+      "mode": "0000644",
+      "sha256": "056622ecd8327527f4fb98b37ce8af90778d42c816455431ed3dd2f76800a75b"
+    },
     {
       "path": "scripts/gds/key-card.js",
       "mode": "0000644",
@@ -10022,7 +10032,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "0f7a9cd81a78ef3ed30a40e9f048f8905b6a88e99a930f7cbdcdcd5c1661f71d"
+      "sha256": "4da6314b41905bcffbc51abe127911512743ad14f8130b4c6a25c23600a3eb7f"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -11132,7 +11142,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4002317dabfa7084c1b541e2a6a605197ce8c1e45df90f81bfa2ef186b0d6776"
+      "sha256": "8acd38044812dee3022427fad27e12cc7f9d81a90c1a0d921e860135a30f9e43"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12077,7 +12087,7 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "24f41ed750fc24003e31cd1e551256162119016ab299a94dda5e4c4fe030ff69"
+      "sha256": "8c8b03b8a3bb83b0c733726f3aa1256b6af5ac61c76e6af465fe2bc4f792ea6b"
     },
     {
       "path": "tests/core_upgrade_owner_door.mjs",
@@ -13744,6 +13754,11 @@
       "mode": "0000644",
       "sha256": "9e69603c05fae6c39e2db7336d6569327f17365ff46ef05b1074943dc34a49e7"
     },
+    {
+      "path": "tests/intent_retry.mjs",
+      "mode": "0000644",
+      "sha256": "750745cf866dcf1012f2677881738aa64ae2b8ceaed078ab688612a8b0d2208c"
+    },
     {
       "path": "tests/interaction_posture.mjs",
       "mode": "0000644",
@@ -14702,7 +14717,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "6b4405a5a4e0263f321a49e04d25cad87a042d5d9a296ba65ff3d14a1941deb0"
+      "sha256": "46b2235ee186ba304c18f5cf3002a9e5311f7bda11fa230bbada8a7a43bec3cd"
     },
     {
       "path": "tests/provision_account_identity.mjs",

package/docs/module-api-changelog.md

@@ -2717,5 +2717,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.28 with no explicit bump. run 36775277990. (task 1002620)
   1.20.30 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.29 with no explicit bump. run 36777226204. (task 1002620)
+  1.20.31 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.30 with no explicit bump. run 36779142919. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/core-upgrade.js

@@ -128,6 +128,16 @@ function coreUpgradeFault(inst, to, live = null) {
 async function enqueueCoreUpgrade(provisioning, db, instanceId, to, requestedBy, action = 'core-upgrade') {
   const { intent, created } = await provisioning.enqueueIntent(db, instanceId, action, requestedBy, to);
   if (created) return { intent, created: true };
+  // THE SAME MOVE, WAITING OUT A RETRY (task 1004447). A transient failure re-pends the
+  // intent with a not_before up to six hours away, and it keeps the single open slot all
+  // that time — so without this, the owner pressing Move again was told "a run is pending,
+  // try again later" about the very move they were asking for. Same action, same target,
+  // still pending: bring its next attempt forward instead. Anything else stays a conflict.
+  if (intent && intent.state === 'pending' && intent.action === action && String(intent.target_version || '') === String(to)
+    && intent.not_before && new Date(intent.not_before).getTime() > Date.now()) {
+    await db.query("UPDATE provisioning_intents SET not_before = NULL, updated_at = now() WHERE id = $1 AND state = 'pending'", [intent.id]);
+    return { intent: { ...intent, not_before: null }, created: false, retryNow: true };
+  }
   return { intent, created: false, conflict: 'open_intent' };
 }
 
@@ -336,7 +346,9 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     // and a stale pass is worse than no answer because it reads as a guarantee.
     preflight: preflightForOffer(pf, served, recommended),
     preflight_at: pf && recommended && pf.target === recommended ? (snap.preflight_at || null) : null,
-    open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null } : null,
+    // not_before: a failed move waiting out its retry backoff (task 1004447) — the page can
+    // say "trying again at …" instead of an unexplained "pending" for up to six hours.
+    open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null, not_before: openIntent.not_before || null, last_error: openIntent.not_before && openIntent.last_error ? String(openIntent.last_error).slice(0, 600) : null } : null,
     // THE LAST MOVE, WHATEVER BECAME OF IT (task 1004145).
     //
     // `open_intent` is `state IN ('pending','running')` — by the index's own definition.

package/modules/provisioning/migrations/provisioning_031_intent_not_before.sql

@@ -0,0 +1,19 @@
+-- provisioning_031_intent_not_before.sql — a failed intent waits before its next attempt
+-- (task 1004447, goal 1000090 deploy self-heal).
+--
+-- WHY. A failed intent was re-pended with no delay, and the drain loop claims the oldest
+-- pending row — so one runner tick ran the same failing move up to MAX_INTENT_ATTEMPTS
+-- times back to back, restarting the service each time a pin had moved, and then gave up.
+-- A registry blip or a release still publishing needs minutes, not milliseconds.
+--
+-- not_before: the earliest time the runner may claim this row again. NULL = now (every row
+-- written before this column, and every fresh request). claimNextIntent skips a row whose
+-- not_before is still in the future; scripts/gds/provision.js sets it on each re-pend.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_intents ADD COLUMN IF NOT EXISTS not_before timestamptz;
+
+COMMIT;

package/modules/provisioning/provisioning.js

@@ -1254,7 +1254,7 @@ async function claimNextIntent(db) {
         SET state = 'running', attempts = attempts + 1, updated_at = now()
       WHERE id = (
         SELECT id FROM provisioning_intents
-         WHERE state = 'pending'
+         WHERE state = 'pending' AND (not_before IS NULL OR not_before <= now()) -- a re-pended failure waits out its backoff (task 1004447)
          ORDER BY created_at
          FOR UPDATE SKIP LOCKED
          LIMIT 1

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.30",
+  "version": "1.20.31",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.30",
+      "version": "1.20.31",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.30",
+  "version": "1.20.31",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8252,5 +8252,11 @@
       "id": "1004446",
       "text": "When a software update fails, the system now records what kind of failure it was — a temporary glitch, a known snag, a rule only the owner can change, or something unknown — and tells the truth about it instead of always sayin"
     }
+  ],
+  "1.20.31": [
+    {
+      "id": "1004447",
+      "text": "A software update that fails for a temporary reason now waits and tries again later — after 15 minutes, then an hour, then six hours — instead of hammering the same failing step three times in a row. Failures that retrying can"
+    }
   ]
 }

package/scripts/gds/intent-retry.js

@@ -0,0 +1,52 @@
+'use strict';
+//
+// scripts/gds/intent-retry.js — when a failed provisioning intent is tried again, and when it
+// is retired instead (task 1004447, goal 1000090 deploy self-heal).
+//
+// WHY. The drain loop re-pended a failure with no delay and claims the oldest pending row, so
+// one tick ran the same failing move up to MAX_INTENT_ATTEMPTS times back to back — seconds
+// apart, restarting the service after every pin move — and then gave up. That is the wrong
+// answer for each kind of failure upgrade-outcome.js now names:
+//   transient       — the registry blipped, the release is still publishing: WAIT, then retry
+//                     (about 15 minutes, 1 hour, 6 hours), which is what a person would do.
+//   known_wedge, needs_decision, unknown — trying the same thing again cannot change the
+//                     answer, so the intent is RETIRED at once and the failure left standing
+//                     for the next step (a fix, the owner, a person) to act on.
+// A failure with no class (every action other than a core move) keeps its old attempt budget,
+// but each retry now waits DEFAULT_RETRY_DELAY_MS — at least the next tick, never the same one.
+//
+// PURE: no I/O. The drain loop (scripts/gds/provision.js cmdRunIntents) asks and obeys.
+
+const MINUTE = 60 * 1000;
+const TRANSIENT_BACKOFF_MS = Object.freeze([15 * MINUTE, 60 * MINUTE, 6 * 60 * MINUTE]);
+const DEFAULT_RETRY_DELAY_MS = MINUTE;
+
+/**
+ * What to do with an intent whose run just failed. PURE.
+ * @param {object} p
+ * @param {number} p.attempts     the attempt that just ran (claimNextIntent increments first)
+ * @param {object} [p.failure]    `{ class, reason }` from the result, when classified
+ * @param {boolean} [p.terminal]  the leg said it must not be retried unattended
+ * @param {number} p.maxAttempts  the runner's budget for unclassified failures
+ * @returns {{ action: 'retire' } | { action: 'retry', delayMs: number }}
+ */
+function retryDecision({ attempts, failure, terminal, maxAttempts }) {
+  if (terminal) return { action: 'retire' };
+  if (failure && failure.class) {
+    if (failure.class !== 'transient') return { action: 'retire' };
+    const i = Math.max(0, (attempts || 1) - 1);
+    return i < TRANSIENT_BACKOFF_MS.length ? { action: 'retry', delayMs: TRANSIENT_BACKOFF_MS[i] } : { action: 'retire' };
+  }
+  return (attempts || 0) >= maxAttempts ? { action: 'retire' } : { action: 'retry', delayMs: DEFAULT_RETRY_DELAY_MS };
+}
+
+/**
+ * The attempt ceiling checked BEFORE an intent runs. A row waiting out a transient backoff
+ * has one attempt per backoff step plus the first, so the pre-run guard must not retire it
+ * on the default budget before its last scheduled try. PURE.
+ */
+function maxAttemptsFor(intent, maxAttempts) {
+  return intent && intent.failure_class === 'transient' ? Math.max(maxAttempts, TRANSIENT_BACKOFF_MS.length + 1) : maxAttempts;
+}
+
+module.exports = { TRANSIENT_BACKOFF_MS, DEFAULT_RETRY_DELAY_MS, retryDecision, maxAttemptsFor };

package/scripts/gds/provision.js

@@ -46,6 +46,7 @@ const path = require('node:path');
 const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
+const retry = require('./intent-retry.js'); // when a failed intent is tried again (task 1004447)
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { accountPreflight, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
@@ -1171,8 +1172,8 @@ async function cmdRunIntents(deps) {
     const intent = await provisioning.claimNextIntent(db);
     if (!intent) break;
     ran++;
-    if (intent.attempts > MAX_INTENT_ATTEMPTS) {
-      await provisioning.resolveIntent(db, intent.id, 'error', `exceeded ${MAX_INTENT_ATTEMPTS} attempts`);
+    if (intent.attempts > retry.maxAttemptsFor(intent, MAX_INTENT_ATTEMPTS)) { // a transient core move gets one try per backoff step (task 1004447)
+      await provisioning.resolveIntent(db, intent.id, 'error', `exceeded ${retry.maxAttemptsFor(intent, MAX_INTENT_ATTEMPTS)} attempts`);
       errors++; log(`  ✖ intent #${intent.id} retired (too many attempts)`); continue;
     }
     try {
@@ -1192,7 +1193,11 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'repo-private' || intent.action === 'render-standup') result = intent.action === 'repo-private' ? await require('./provision-repo-private.js').repoPrivateInstance(inst, deps) : await require('./provision-render.js').renderStandupInstance(inst, deps, intent); // wire the deploy key, THEN flip (task 1004193) · spend the borrowed Render key once (task 1004183); required here — this file is at the size ratchet
       else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
-        if (intent.attempts >= MAX_INTENT_ATTEMPTS || result.terminal) { // terminal: a leg that must not be retried unattended (the Render leg's key is already gone — task 1004183)
+        // WAIT OR RETIRE (task 1004447, intent-retry.js): a transient failure waits ~15m/1h/6h; a
+        // classified non-transient one is retired at once (retrying cannot change its answer);
+        // an unclassified one keeps its budget but never re-runs in the same tick.
+        const next = retry.retryDecision({ attempts: intent.attempts, failure: result.failure, terminal: result.terminal, maxAttempts: MAX_INTENT_ATTEMPTS });
+        if (next.action === 'retire') { // terminal: a leg that must not be retried unattended (the Render leg's key is already gone — task 1004183)
           await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');
           // A retired intent stops silently otherwise (F19): record the reason
           // on the instance WITHOUT changing its lifecycle status — passing the
@@ -1202,7 +1207,7 @@ async function cmdRunIntents(deps) {
           await provisioning.setInstanceStatus(db, intent.instance_id, inst.status, { error_note: result.error || 'op failed', error_note_action: intent.action }).catch(() => {});
           if (result.failure) await recordFailureClass(db, intent.id, result.failure); // WHAT KIND of failure, beside the sentence (task 1004446)
         } else {
-          await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed']);
+          await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, not_before = now() + ($3 * interval '1 millisecond'), updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed', next.delayMs]);
           if (result.failure) await recordFailureClass(db, intent.id, result.failure);
         }
         errors++;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.30'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.31'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -431,7 +431,7 @@ await t('schema_pending passes through as a count, and UNKNOWN stays null rather
 await t('an open intent is surfaced with its target, so the page can say what is already running', () => {
   const p = CU.previewFromSnapshot(previewInst, { served_version: '1.19.758', available: [], recommended: null },
     { action: 'core-upgrade', state: 'running', target_version: '1.19.762' });
-  assert.deepEqual(p.open_intent, { action: 'core-upgrade', state: 'running', target_version: '1.19.762' });
+  assert.deepEqual(p.open_intent, { action: 'core-upgrade', state: 'running', target_version: '1.19.762', not_before: null, last_error: null });
 });
 
 console.log('\nthe deploy page is gated on the same atom as its routes:');
@@ -973,5 +973,39 @@ await t('a failed move carries its class to the page; a move that worked carries
   assert.equal(CU.previewFromSnapshot(ACTIVE, null, null, old).last_move.failure, null, 'a row from before the columns');
 });
 
+console.log('\na move waiting out its retry (task 1004447):');
+
+const waiting = (over = {}) => ({ id: 5, action: 'core-upgrade', state: 'pending', target_version: '1.20.1', not_before: new Date(Date.now() + 3600e3).toISOString(), ...over });
+const enqueueAgainst = async (open, to = '1.20.1') => {
+  const writes = [];
+  const provisioning = { enqueueIntent: async () => ({ intent: open, created: false }) };
+  const db = { query: async (sql, params) => { writes.push({ sql, params }); return { rows: [] }; } };
+  return { r: await CU.enqueueCoreUpgrade(provisioning, db, 7, to, 'api:archon:42'), writes };
+};
+
+await t('pressing Move for the SAME waiting move brings its retry forward instead of refusing', async () => {
+  const { r, writes } = await enqueueAgainst(waiting());
+  assert.equal(r.retryNow, true);
+  assert.ok(!r.conflict);
+  assert.match(writes[0].sql, /SET not_before = NULL/);
+  assert.deepEqual(writes[0].params, [5]);
+});
+
+await t('a DIFFERENT target, a running move, or one not waiting is still a conflict', async () => {
+  for (const open of [waiting({ target_version: '1.20.2' }), waiting({ state: 'running' }), waiting({ not_before: null }), waiting({ action: 'restart' })]) {
+    const { r, writes } = await enqueueAgainst(open);
+    assert.equal(r.conflict, 'open_intent');
+    assert.equal(writes.length, 0);
+  }
+});
+
+await t('the preview says when a waiting move will try again, and why it is waiting', () => {
+  const p = CU.previewFromSnapshot(ACTIVE, null, waiting({ last_error: 'core 1.20.1 is not published yet' }), null);
+  assert.ok(p.open_intent.not_before);
+  assert.match(p.open_intent.last_error, /not published yet/);
+  assert.equal(CU.previewFromSnapshot(ACTIVE, null, waiting({ not_before: null, last_error: 'x' }), null).open_intent.last_error, null,
+    'an ordinary pending intent shows no error');
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/intent_retry.mjs

@@ -0,0 +1,57 @@
+// tests/intent_retry.mjs — a failed intent waits, or is retired, by what kind of failure it
+// was (task 1004447, goal 1000090 deploy self-heal).
+//
+// WHAT IS AT RISK. One runner tick used to run the same failing core move up to three times
+// back to back, restarting the service each time, then give up. These cases pin the policy
+// that replaced it; tests/provision.mjs drives the drain loop with it.
+//
+// Run:  node tests/intent_retry.mjs
+
+import { strict as assert } from 'node:assert';
+import { retryDecision, maxAttemptsFor, TRANSIENT_BACKOFF_MS, DEFAULT_RETRY_DELAY_MS } from '../scripts/gds/intent-retry.js';
+
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+const MIN = 60 * 1000;
+const transient = { class: 'transient', reason: 'not_published' };
+
+await t('a transient failure waits about 15 minutes, then 1 hour, then 6 hours', () => {
+  assert.deepEqual([...TRANSIENT_BACKOFF_MS], [15 * MIN, 60 * MIN, 360 * MIN]);
+  for (const [attempts, ms] of [[1, 15 * MIN], [2, 60 * MIN], [3, 360 * MIN]]) {
+    assert.deepEqual(retryDecision({ attempts, failure: transient, maxAttempts: 3 }), { action: 'retry', delayMs: ms });
+  }
+});
+
+await t('and is retired after its last scheduled try', () => {
+  assert.deepEqual(retryDecision({ attempts: 4, failure: transient, maxAttempts: 3 }), { action: 'retire' });
+});
+
+await t('every NON-transient class is retired at once — retrying cannot change the answer', () => {
+  for (const c of ['known_wedge', 'needs_decision', 'unknown']) {
+    assert.deepEqual(retryDecision({ attempts: 1, failure: { class: c, reason: 'x' }, maxAttempts: 3 }), { action: 'retire' }, c);
+  }
+});
+
+await t('terminal always retires, even a transient class', () => {
+  assert.deepEqual(retryDecision({ attempts: 1, failure: transient, terminal: true, maxAttempts: 3 }), { action: 'retire' });
+});
+
+await t('an UNCLASSIFIED failure keeps its budget, but never retries in the same tick', () => {
+  assert.deepEqual(retryDecision({ attempts: 1, maxAttempts: 3 }), { action: 'retry', delayMs: DEFAULT_RETRY_DELAY_MS });
+  assert.ok(DEFAULT_RETRY_DELAY_MS >= MIN, 'at least a minute: the runner ticks about every two');
+  assert.deepEqual(retryDecision({ attempts: 3, maxAttempts: 3 }), { action: 'retire' });
+});
+
+await t('the pre-run guard gives a transient row room for its last scheduled try', () => {
+  assert.equal(maxAttemptsFor({ failure_class: 'transient' }, 3), 4);
+  assert.equal(maxAttemptsFor({ failure_class: 'unknown' }, 3), 3);
+  assert.equal(maxAttemptsFor({}, 3), 3);
+  assert.equal(maxAttemptsFor({ failure_class: 'transient' }, 9), 9, 'never lowers a configured budget');
+});
+
+console.log(`\nintent_retry: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/provision.mjs

@@ -2564,38 +2564,63 @@ await ta('F19: a NON-final failure re-pends the intent and writes nothing on the
   assert.equal(statusWrites.length, 0, 'no instance write until the intent actually retires');
 });
 
-// A failed core move stores WHAT KIND of failure beside its sentence (task 1004446).
-const classifiedRun = async (attempts) => {
-  let claims = 0; const resolved = []; const classWrites = [];
+// A failed core move stores WHAT KIND of failure beside its sentence (task 1004446), and
+// waits or retires by that kind (task 1004447). The queue here is STATEFUL — a fake
+// claimNextIntent that honours not_before the way the real query does — so "one tick runs a
+// failing move at most once" is measured, not assumed.
+const queueRun = async ({ attempts = 0, transient = false } = {}) => {
+  const row = { id: 11, instance_id: 18, action: 'core-upgrade', target_version: '1.20.1', attempts, state: 'pending', not_before: null, failure_class: attempts && transient ? 'transient' : null }; // a re-tried row carries the class its last attempt wrote
+  let runs = 0; const resolved = []; const classWrites = []; const repends = [];
   const deps = {
     apply: true, log: () => {},
-    db: { query: async (sql, params) => { if (/SET failure_class/.test(sql)) classWrites.push(params); return { rows: [] }; } },
+    db: { query: async (sql, params) => {
+      if (/SET failure_class/.test(sql)) { classWrites.push(params); row.failure_class = params[1]; }
+      if (/SET state='pending'/.test(sql)) { repends.push(params); row.state = 'pending'; row.not_before = new Date(Date.now() + params[2]); }
+      return { rows: [] };
+    } },
     provisioning: {
-      claimNextIntent: async () => (claims++ === 0
-        ? { id: 11, instance_id: 18, action: 'core-upgrade', target_version: '1.20.1', attempts } : null),
-      // 'dedicated' is a shape the runner cannot move — a classified refusal, no exec needed.
-      getInstanceById: async () => ({ ...activeStandalone, hosting_shape: 'dedicated' }),
-      resolveIntent: async (_db, id, state) => { resolved.push({ id, state }); },
+      claimNextIntent: async () => {
+        if (row.state !== 'pending' || (row.not_before && row.not_before > new Date())) return null;
+        row.state = 'running'; row.attempts += 1; runs += 1; return { ...row };
+      },
+      // 'dedicated' is a shape the runner cannot move (needs_decision); the control plane with
+      // an unreadable registry is the transient case. Neither needs an exec.
+      getInstanceById: async () => (transient ? { ...activeStandalone, hosting_shape: 'control-plane' } : { ...activeStandalone, hosting_shape: 'dedicated' }),
+      resolveIntent: async (_db, id, state) => { resolved.push({ id, state }); row.state = state; },
       setInstanceStatus: async () => {}, recordEvent: async () => {},
       claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
     },
     exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
+    readInstalledCoreVersion: () => '1.19.1081', selfInstanceRoot: () => '/srv/cb',
+    updateChannel: { DEFAULT_CHANNEL: 'patch', normalizeChannel: (c) => c || 'patch', channelAllows: () => true, listAvailableVersions: () => ({ ok: false, versions: [] }) },
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }), checkCaddyWiring: () => null,
   };
   await P.cmdRunIntents(deps);
-  return { resolved, classWrites };
+  return { runs, resolved, classWrites, repends, row };
 };
 
-await ta('a re-pended core move records its failure class and reason', async () => {
-  const { resolved, classWrites } = await classifiedRun(1);
-  assert.equal(resolved.length, 0);
+await ta('a needs-decision core move is RETIRED at once with its class — retrying cannot change it', async () => {
+  const { runs, resolved, classWrites } = await queueRun();
+  assert.equal(runs, 1);
+  assert.equal(resolved[0].state, 'error');
   assert.deepEqual(classWrites, [[11, 'needs_decision', 'shape_not_automated']]);
 });
 
-await ta('a RETIRED core move records its failure class and reason too', async () => {
-  const { resolved, classWrites } = await classifiedRun(3); // = MAX_INTENT_ATTEMPTS: the last real attempt, retired after it runs
+await ta('a TRANSIENT core move runs ONCE per tick and waits ~15 minutes before its next try', async () => {
+  const { runs, resolved, repends, classWrites } = await queueRun({ transient: true });
+  assert.equal(runs, 1, 'the same failing move is not re-run inside one tick');
+  assert.equal(resolved.length, 0, 'not retired — it waits');
+  assert.equal(repends.length, 1);
+  assert.equal(repends[0][2], 15 * 60 * 1000, 'not_before = now + 15 minutes');
+  assert.deepEqual(classWrites, [[11, 'transient', 'registry_unreadable']]);
+});
+
+await ta('a transient move on its LAST scheduled try (the 6-hour one) is retired after it', async () => {
+  const { runs, resolved } = await queueRun({ transient: true, attempts: 3 });
+  // attempt 4 RUNS (the pre-run guard allows it for a transient row) and is then retired.
+  assert.equal(runs, 1, 'the 6-hour try actually ran — not retired unrun by the pre-run guard');
+  assert.equal(resolved.length, 1);
   assert.equal(resolved[0].state, 'error');
-  assert.deepEqual(classWrites, [[11, 'needs_decision', 'shape_not_automated']]);
 });
 
 console.log('\nreview-panel hardening (task 1002720 — the loopback/latch/birth-note seams):');