@bongos/core 1.20.35 → 1.20.36

package/modules/hall-ui/public/deploy.js

@@ -130,6 +130,178 @@
     return v ? `<span class="ov-mono">${escapeHtml(String(v))}</span>` : '<span class="ps-pill ps-pill--absent">no reading</span>';
   }
 
+  // ---- why a move stopped, in words (task 1004450) ---------------------------
+  //
+  // The runner classifies every failed move (scripts/gds/upgrade-outcome.js) into one of
+  // four kinds, each with a fixed reason code. The page used to show only the runner's raw
+  // output, addressed to someone holding a shell. These are the same reasons in the
+  // owner's words. A code with no entry falls back to a plain "no words for this" rather
+  // than a guess — the raw output is still one click away.
+  const REASON_WORDS = {
+    registry_unreadable: 'the list of published versions could not be read',
+    not_published: 'that version is not published yet',
+    npm_install: 'installing the new core stopped part-way',
+    dirty_tree: 'the project had unsaved file changes on its machine',
+    disk_full: 'the machine ran out of disk space',
+    schema_pending: 'the project’s database was behind its code',
+    outside_channel: 'that version is outside this project’s update rule',
+    shape_not_automated: 'this kind of project is not moved from this page',
+    downgrade: 'that version is older than the one running',
+    artist_gate: 'an artist review has to pass first',
+    module_incompatible: 'a module this project uses is not ready for that core',
+    remedy_did_not_hold: 'the automatic fix was tried once and the same problem came back',
+    remedy_failed: 'the automatic fix itself did not work',
+    health: 'the project did not answer after restarting on the new core',
+    migrate: 'updating the project’s database failed',
+    restart: 'the project would not restart',
+    rollback_failed: 'the new core failed, and putting the old one back failed too',
+    no_target: 'the move did not say which version to go to',
+    bad_slug: 'the project’s name on the machine could not be used',
+    installed_unreadable: 'the version installed on the machine could not be read',
+    served_mismatch: 'the project was not serving the version its machine had installed',
+    already_on: 'the project is already on that version',
+    db_unresolvable: 'the machine could not tell which database belongs to this project',
+    db_identity: 'the project’s database did not match the one the move expected',
+    health_url_missing: 'there was no address to check the project was answering after the move',
+    core_source: 'the new core could not be found to install',
+    integrity_pin: 'the new core did not match the checksum it was published with',
+  };
+  const reasonWords = (f) => (f && REASON_WORDS[f.reason]) || 'the upgrade stopped for a reason this page has no words for yet';
+  // What the runner's one automatic fix (scripts/gds/wedge-remedy.js) did for a known snag.
+  const REMEDY_WORDS = {
+    dirty_tree: 'saved those changes',
+    disk_full: 'cleared out old backups',
+    schema_pending: 'brought the database up to date',
+  };
+
+  // A pending move whose next try is in the FUTURE is waiting out a retry, not moving. The
+  // runner re-queues a failed move as pending with a not_before (task 1004447), so "pending"
+  // alone cannot tell the two apart — and treating a six-hour wait as a move in flight is
+  // how the page used to poll for five minutes and then say "still working".
+  function waitingOf(i) {
+    return !!(i && i.state === 'pending' && i.not_before && new Date(i.not_before).getTime() > Date.now());
+  }
+
+  // "14:05, in about 40 min" — when a waiting move tries again, as a clock time the owner
+  // can hold the page to, and the distance to it.
+  function whenNext(iso) {
+    const t = new Date(iso);
+    const mins = Math.max(1, Math.round((t.getTime() - Date.now()) / 60000));
+    const dist = mins < 90 ? `${mins} min` : `${Math.round(mins / 60)}h`;
+    let clock = '';
+    try { clock = t.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' }); } catch (e) { clock = ''; }
+    return clock ? `${clock}, in about ${dist}` : `in about ${dist}`;
+  }
+
+  // A move waiting to try again. The press it offers is the SAME move, sooner: the route
+  // brings a waiting move's retry forward rather than refusing it (enqueueCoreUpgrade).
+  function waitingHtml(p) {
+    const i = p.open_intent;
+    const f = i.failure;
+    const at = escapeHtml(whenNext(i.not_before));
+    const to = escapeHtml(String(i.target_version || ''));
+    let body;
+    if (f && f.class === 'known_wedge') {
+      const did = REMEDY_WORDS[f.reason];
+      body = `<strong>A known snag stopped the move to core ${to}:</strong> ${escapeHtml(reasonWords(f))}.
+        ${did ? `It ${escapeHtml(did)} on its own, and` : 'It'} tries the move once more at ${at}.`;
+    } else if (f && f.class === 'transient') {
+      body = `<strong>Waiting to try core ${to} again at ${at}.</strong> The last try stopped because
+        ${escapeHtml(reasonWords(f))} — that is usually temporary, so it tries again on its own.`;
+    } else {
+      body = `<strong>Waiting to try core ${to} again at ${at}.</strong>`;
+    }
+    return `
+      <div class="dp-settled dp-settled--waiting">
+        <p class="ov-row__sub">${body} Nothing needs doing — this page shows the result when it lands.</p>
+        <div class="ps-controls">
+          <button type="button" class="btn" id="dp-retry-${escapeHtml(String(p.instance_id))}">Try now</button>
+        </div>
+      </div>`;
+  }
+
+  // A move that stopped for good, worded by what KIND of stop it was. Each kind says what
+  // happens next, because that is the question the owner is left with: is anything still
+  // being done about this, and is any of it mine to do?
+  const BLOCKERS_LINK = '<a href="/blockers">the owner’s blockers</a>';
+  function failureHtml(p, m, when, detail) {
+    const f = m.failure;
+    const cls = f && f.class;
+    const id = escapeHtml(String(p.instance_id));
+    const to = escapeHtml(String(m.target_version));
+    const still = `This project is still running core ${escapeHtml(String(p.served_version))}.`;
+    const card = (mod, head, rest, action = '') => `
+        <div class="dp-settled dp-settled--${mod}">
+          <p class="ov-row__sub"><strong>${head}</strong>${rest}</p>
+          ${action}
+          ${detail}
+        </div>`;
+    // A row from before the runner classified failures: the old wording, unchanged.
+    if (!cls) return card('failed', `The move to core ${to} did not land`, ` — attempted${when}. ${still}`);
+    const why = escapeHtml(reasonWords(f));
+    if (f.reason === 'rollback_failed') {
+      return card('failed', `The move to core ${to} failed, and the old core could not be put back`,
+        ` — attempted${when}. This project may be down. A person needs to look; it has been filed in ${BLOCKERS_LINK}.`);
+    }
+    if (cls === 'needs_decision') {
+      let action = '';
+      if (f.reason === 'outside_channel' && p.update_channel !== 'minor') {
+        action = `<div class="ps-controls">
+            <button type="button" class="btn btn--primary" id="dp-allow-${id}">Allow new releases and move to ${to}</button>
+          </div>`;
+      }
+      const next = {
+        outside_channel: action ? ' Allowing new releases changes this project’s update rule, then makes the move.' : ' Change the update rule below, then move again.',
+        artist_gate: ' Approve the artist review, or change the artist gate in this project’s settings, then move again.',
+        downgrade: ' Nothing to do unless you meant to go back to an older core.',
+        module_incompatible: ' Turn that module off in this project’s settings and move again, or wait for a core it works with — the technical detail below names the module.',
+        shape_not_automated: ' Whoever runs this project’s machine moves its core there.',
+      }[f.reason] || '';
+      return card('decision', `Your call: the move to core ${to} is waiting on a decision`,
+        ` — ${why}. Attempted${when}. ${still}${next}`, action);
+    }
+    if (cls === 'transient') {
+      const retry = String(m.target_version) === String(p.recommended_version)
+        ? `<div class="ps-controls"><button type="button" class="btn" id="dp-again-${id}">Try again</button></div>` : '';
+      return card('failed', `The move to core ${to} kept stopping`,
+        ` — ${why}. That is usually temporary, so it tried again on its own over several hours, then gave up${when}. ${still}`, retry);
+    }
+    // NO blockers link here, deliberately: move-escalation.js files one only for an unknown
+    // failure or a failed rollback, so pointing at the list would send the owner to look for
+    // a row that does not exist. The step is named instead.
+    if (cls === 'known_wedge') {
+      return card('failed', `The move to core ${to} hit a known snag it could not fix here`,
+        ` — ${why}. Attempted${when}. ${still} The automatic fix could not be applied on this project’s
+          machine, so whoever runs that machine clears the snag; the technical detail below says what it is.
+          After that, the move can be pressed again.`);
+    }
+    return card('failed', `The move to core ${to} did not land, and nothing automatic can fix it`,
+      ` — ${why}. Attempted${when}. ${still} It has been filed in ${BLOCKERS_LINK} for a person to look at.`);
+  }
+
+  // The project's update rule (task 1004445): how far the runner may move its core. A
+  // RULE, never a move — saving one queues nothing and restarts nothing.
+  const RULES = [
+    ['pinned', 'Stay put', 'no new versions are offered; this project stays on the core it runs'],
+    ['patch', 'Fixes only', 'takes fixes within the release line it is on'],
+    ['minor', 'Fixes and new releases', 'also takes the next release line when one comes out'],
+  ];
+  function ruleHtml(p) {
+    const cur = RULES.find((r) => r[0] === p.update_channel);
+    if (!cur) return '';
+    const id = escapeHtml(String(p.instance_id));
+    const opts = RULES.map(([k, label]) => `<option value="${k}"${k === cur[0] ? ' selected' : ''}>${escapeHtml(label)}</option>`).join('');
+    return `
+      <div class="dp-rule">
+        <p class="ov-row__sub"><strong>Update rule: ${escapeHtml(cur[1])}</strong> — ${escapeHtml(cur[2])}.</p>
+        <div class="ps-controls">
+          <label class="dp-rule__label" for="dp-rule-sel-${id}">Change to</label>
+          <select id="dp-rule-sel-${id}" class="dp-rule__select">${opts}</select>
+          <button type="button" class="btn" id="dp-rule-save-${id}">Save rule</button>
+        </div>
+      </div>`;
+  }
+
   // ---- the states ONE box can be in ----------------------------------------
 
   // Something is already running. The press is not offered at all — offering a button
@@ -141,6 +313,7 @@
   // reload, and neither is being watched — so it says what is true instead.
   function busyHtml(p) {
     const i = p.open_intent;
+    if (waitingOf(i)) return waitingHtml(p);
     return `
       <p class="ov-row__sub">A <strong>${escapeHtml(i.action)}</strong> is ${escapeHtml(i.state)} for this box${
         i.target_version ? ` (to core ${escapeHtml(i.target_version)})` : ''}.
@@ -186,7 +359,7 @@
     // verbatim and kept CLOSED: the owner cannot run `sudo -u`, so 30 lines of it (the
     // dirty-tree refusal prints a whole `git status`) is not what a deploy page leads on.
     const detail = m.error
-      ? `<details class="dp-settled__detail"><summary>What the upgrade said</summary>
+      ? `<details class="dp-settled__detail"><summary>Technical detail — what the upgrade said</summary>
           <pre class="dp-preflight__error">${escapeHtml(String(m.error))}</pre></details>`
       : '';
     if (m.state === 'error' && m.superseded) {
@@ -199,14 +372,7 @@
           ${detail}
         </div>`;
     }
-    if (m.state === 'error') {
-      return `
-        <div class="dp-settled dp-settled--failed">
-          <p class="ov-row__sub"><strong>The move to core ${escapeHtml(String(m.target_version))} did not land</strong>
-            — attempted${when}. This project is still running core ${escapeHtml(String(p.served_version))}.</p>
-          ${detail}
-        </div>`;
-    }
+    if (m.state === 'error') return failureHtml(p, m, when, detail);
     // LANDED, BUT GITHUB DID NOT GET IT (task 1004065). The runner pushes a hosted
     // project's new pin to its repo after the move; when it could not, the move is still
     // done — the site runs the new core — and `warning` says why the repo was not updated.
@@ -439,6 +605,7 @@
           : ''}
         ${schemaBehindHtml(p)}
         ${action}
+        ${ruleHtml(p)}
       </div></li>`;
   }
 
@@ -463,6 +630,54 @@
     if (cancel) cancel.addEventListener('click', () => { steps.set(p.instance_id, 'preview'); repaint(); });
     const confirm = $(`dp-confirm-${id}`);
     if (confirm) confirm.addEventListener('click', () => move(p));
+    // Task 1004450: the waiting move, sooner; a stopped temporary one, again; the one-click
+    // answer to an update-rule refusal; and the rule itself.
+    const retry = $(`dp-retry-${id}`);
+    if (retry && p.open_intent) retry.addEventListener('click', () => move(p, p.open_intent.target_version));
+    const again = $(`dp-again-${id}`);
+    if (again && p.last_move) again.addEventListener('click', () => move(p, p.last_move.target_version));
+    const allow = $(`dp-allow-${id}`);
+    if (allow && p.last_move) allow.addEventListener('click', () => allowAndMove(p, p.last_move.target_version, allow));
+    const save = $(`dp-rule-save-${id}`);
+    if (save) save.addEventListener('click', () => saveRule(p, save));
+  }
+
+  // Change the rule, then report the server's own sentence and re-read the row.
+  async function setRule(p, channel) {
+    const r = await sendJson('POST', `/provisioning/instances/${p.instance_id}/update-channel`, { channel });
+    toast(r.message || 'Update rule saved.');
+    return r;
+  }
+
+  async function saveRule(p, btn) {
+    const sel = $(`dp-rule-sel-${p.instance_id}`);
+    const channel = sel && sel.value;
+    if (!channel) return;
+    btn.disabled = true;
+    try {
+      await setRule(p, channel);
+    } catch (e) {
+      if (e && e.kind === '401') return;
+      toast(e.message || 'Could not change the update rule.');
+      btn.disabled = false;
+      return;
+    }
+    await refreshOne(p);
+  }
+
+  // "Allow new releases and move": the rule first, and only if it took, the move — a move
+  // queued under the old rule would be refused the same way again.
+  async function allowAndMove(p, to, btn) {
+    if (btn) { btn.disabled = true; btn.textContent = 'Changing the rule…'; }
+    try {
+      await setRule(p, 'minor');
+    } catch (e) {
+      if (e && e.kind === '401') return;
+      toast(e.message || 'Could not change the update rule.');
+      if (btn) { btn.disabled = false; btn.textContent = `Allow new releases and move to ${to}`; }
+      return;
+    }
+    await move(p, to);
   }
 
   // What the page is currently showing: the ONE box this hall is about, whether that box
@@ -491,11 +706,12 @@
     if (view.box) wire(view.box);
   }
 
-  async function move(p) {
+  // `to` defaults to the version the owner was SHOWN; the retry buttons pass the move they
+  // are retrying, which is also a version on screen.
+  async function move(p, to = p.recommended_version) {
     const btn = $(`dp-confirm-${p.instance_id}`);
     if (btn) { btn.disabled = true; btn.textContent = 'Queueing…'; }
     const id = String(p.instance_id);
-    const to = p.recommended_version;
     try {
       // `p.recommended_version` — the version this owner was SHOWN for THIS box, not
       // whatever is newest at the moment of the click.
@@ -532,6 +748,10 @@
       // that "done" would drop the row out of its in-flight state early.
       if (!now.open_intent && now.served_version === to) { settled = true; break; }
       if (!now.open_intent && now.last_move && now.last_move.state === 'error') { settled = true; break; }
+      // WAITING IS SETTLED TOO (task 1004450). A pending move whose next try is minutes or
+      // hours away is not in flight; the row says when it tries again, and watching it for
+      // five minutes would end in a "still working" toast about a move that is not running.
+      if (waitingOf(now.open_intent)) { settled = true; break; }
     }
     moving.delete(p.instance_id);
     repaint();

package/modules/hall-ui/public/project-settings.css

@@ -186,3 +186,31 @@
   padding: 0.35rem 0;
   min-height: 24px;
 }
+
+/* Why a move stopped, by kind (task 1004450). WAITING is the accent, like a move in
+   flight — something is still being done, on its own clock. A DECISION is the warn mark:
+   nothing is broken, and the next step is the owner's. */
+.dp-settled--waiting {
+  border-left: 3px solid var(--accent);
+  padding-left: 0.7rem;
+}
+.dp-settled--decision {
+  border-left: 3px solid var(--warn);
+  padding-left: 0.7rem;
+}
+.dp-settled .ps-controls { margin: 0.4rem 0 0.2rem; }
+
+/* The project's update rule (task 1004445) — a quiet setting under the move, set apart by
+   a hairline so it does not read as part of whichever state sits above it. */
+.dp-rule {
+  margin: 0.9rem 0 0;
+  padding-top: 0.7rem;
+  border-top: 1px solid var(--rule-soft);
+}
+.dp-rule .ps-controls { align-items: center; gap: 0.5rem; }
+.dp-rule__label { font-size: 0.86rem; color: var(--ink-soft); }
+.dp-rule__select { min-height: 32px; }
+/* A link inside a stopped move's sentence ("the owner's blockers") is a control and owes
+   the 24px floor: the prose-link recipe buys the height with padding and hands it back
+   with an equal negative margin, so the line does not re-space. */
+.dp-settled .ov-row__sub a { display: inline-block; min-height: 24px; padding: 3px 0; margin: -3px 0; }

package/modules/provisioning/core-upgrade.js

@@ -348,7 +348,10 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     preflight_at: pf && recommended && pf.target === recommended ? (snap.preflight_at || null) : null,
     // not_before: a failed move waiting out its retry backoff (task 1004447) — the page can
     // say "trying again at …" instead of an unexplained "pending" for up to six hours.
-    open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null, not_before: openIntent.not_before || null, last_error: openIntent.not_before && openIntent.last_error ? String(openIntent.last_error).slice(0, 600) : null } : null,
+    open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null, not_before: openIntent.not_before || null, last_error: openIntent.not_before && openIntent.last_error ? String(openIntent.last_error).slice(0, 600) : null,
+      // WHY it is waiting (task 1004450): a transient retry and a known snag the runner just
+      // fixed wait the same way, and the page words them differently. Only on a waiting row.
+      failure: openIntent.not_before && openIntent.failure_class ? { class: openIntent.failure_class, reason: openIntent.failure_reason || null } : null } : null,
     // THE LAST MOVE, WHATEVER BECAME OF IT (task 1004145).
     //
     // `open_intent` is `state IN ('pending','running')` — by the index's own definition.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.35",
+  "version": "1.20.36",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.35",
+      "version": "1.20.36",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.35",
+  "version": "1.20.36",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8297,5 +8297,11 @@
       "id": "1004457",
       "text": "The project setup wizard now offers Render's Free plan for your app, with a plain note that a free app sleeps when idle and takes about a minute to wake. Starter stays the default. The build and start command boxes no longer l"
     }
+  ],
+  "1.20.36": [
+    {
+      "id": "1004450",
+      "text": "The deploy page now explains why an update stopped in plain words, says when it will try again, and offers a one-click fix when the only thing in the way is your own update setting. You can also see and change how far a projec"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.35'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.36'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -431,7 +431,7 @@ await t('schema_pending passes through as a count, and UNKNOWN stays null rather
 await t('an open intent is surfaced with its target, so the page can say what is already running', () => {
   const p = CU.previewFromSnapshot(previewInst, { served_version: '1.19.758', available: [], recommended: null },
     { action: 'core-upgrade', state: 'running', target_version: '1.19.762' });
-  assert.deepEqual(p.open_intent, { action: 'core-upgrade', state: 'running', target_version: '1.19.762', not_before: null, last_error: null });
+  assert.deepEqual(p.open_intent, { action: 'core-upgrade', state: 'running', target_version: '1.19.762', not_before: null, last_error: null, failure: null });
 });
 
 console.log('\nthe deploy page is gated on the same atom as its routes:');
@@ -1007,5 +1007,12 @@ await t('the preview says when a waiting move will try again, and why it is wait
     'an ordinary pending intent shows no error');
 });
 
+await t('a waiting move says what KIND of failure it is waiting out; a plain pending one says none (task 1004450)', () => {
+  const p = CU.previewFromSnapshot(ACTIVE, null, waiting({ failure_class: 'known_wedge', failure_reason: 'dirty_tree' }), null);
+  assert.deepEqual(p.open_intent.failure, { class: 'known_wedge', reason: 'dirty_tree' });
+  assert.equal(CU.previewFromSnapshot(ACTIVE, null, waiting({ not_before: null, failure_class: 'transient' }), null).open_intent.failure, null);
+  assert.equal(CU.previewFromSnapshot(ACTIVE, null, waiting(), null).open_intent.failure, null, 'a row from before the columns');
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/deploy_page_projects.mjs

@@ -517,7 +517,7 @@ test('the runner’s shell output is folded behind a disclosure, never the headl
   }) });
   await b.settle();
   const html = b.panel();
-  assert.match(html, /<details class="dp-settled__detail"><summary>What the upgrade said<\/summary>/, 'folded');
+  assert.match(html, /<details class="dp-settled__detail"><summary>Technical detail — what the upgrade said<\/summary>/, 'folded');
   assert.match(html, /working tree not clean/, 'and the words are still all there');
   assert.ok(html.indexOf('did not land') < html.indexOf('<details'), 'the plain sentence comes first');
 });
@@ -645,3 +645,167 @@ test('the reconnect link returns to the page\u2019s full https address when ther
   await b.settle();
   assert.ok(b.panel().includes(`return=${encodeURIComponent(here)}`), b.panel());
 });
+
+// ── why a move stopped, by kind; the update rule; waiting is not moving (task 1004450) ──
+
+// A body built inside the vm is another realm's object; compare its data, not its prototype.
+const plain = (o) => JSON.parse(JSON.stringify(o));
+const soon = (mins) => new Date(Date.now() + mins * 60000).toISOString();
+const failedAs = (cls, reason, over = {}) => ({
+  target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'raw runner words', superseded: false,
+  failure: { class: cls, reason }, ...over,
+});
+const waitingIntent = (cls, reason, mins = 60) => ({
+  action: 'core-upgrade', state: 'pending', target_version: '1.19.871', not_before: soon(mins),
+  last_error: 'x', failure: cls ? { class: cls, reason } : null,
+});
+
+test('a move waiting out a temporary failure says WHEN it tries again, and offers to try now', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { open_intent: waitingIntent('transient', 'not_published') }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /dp-settled--waiting/);
+  assert.match(html, /Waiting to try core 1\.19\.871 again at .*in about 60 min/);
+  assert.match(html, /not published yet/, 'the reason, in plain words');
+  assert.match(html, /usually temporary/);
+  assert.doesNotMatch(html, /is pending for this box/, 'not the generic busy line');
+  b.els.get('dp-retry-1')._on.click();
+  await b.settle();
+  const post = b.posts.find((p) => /core-upgrade$/.test(p.path));
+  assert.deepEqual(post && plain(post.body), { to: '1.19.871' }, 'Try now asks for the SAME move');
+});
+
+test('a known snag the runner just fixed says what it did, and that it tries once more', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { open_intent: waitingIntent('known_wedge', 'dirty_tree', 2) }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /A known snag stopped the move/);
+  assert.match(html, /unsaved file changes/);
+  assert.match(html, /saved those changes on its own/);
+  assert.match(html, /tries the move once more/);
+});
+
+test('a pending move with a PAST not_before is still a move under way, not a wait', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { open_intent: waitingIntent('transient', 'not_published', -5) }) });
+  await b.settle();
+  assert.doesNotMatch(b.panel(), /dp-settled--waiting/);
+  assert.match(b.panel(), /is pending for this box/);
+});
+
+test('a move that falls into a WAIT stops the poll at once, with no "still working" toast', async () => {
+  const b = boot({
+    scope: 'hoodify-finance', moveTries: 50,
+    instanceOver: (inst, n) => (n >= 2 ? { open_intent: waitingIntent('transient', 'registry_unreadable') } : {}),
+  });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  for (let i = 0; i < 4; i++) await b.settle();
+  assert.match(b.panel(), /dp-settled--waiting/, 'the row shows the wait');
+  assert.doesNotMatch(b.panel(), /dp-moving/, 'and is no longer painted as moving');
+  assert.ok(!b.toasts.some((t) => /Still working/.test(t)), `no false "still working": ${b.toasts}`);
+  assert.ok(b.reads.get('32') < 10, `the poll stopped early (read ${b.reads.get('32')} times, bound 50)`);
+});
+
+test('a refusal by the update rule offers ONE click: allow new releases, then move', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { update_channel: 'patch', last_move: failedAs('needs_decision', 'outside_channel', { target_version: '1.20.1' }) }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /dp-settled--decision/);
+  assert.match(html, /Your call/);
+  assert.match(html, /outside this project’s update rule/);
+  assert.match(html, /Allow new releases and move to 1\.20\.1/);
+  b.els.get('dp-allow-1')._on.click();
+  await b.settle();
+  const paths = b.posts.map((p) => p.path);
+  const rule = paths.indexOf('/provisioning/instances/1/update-channel');
+  const mv = paths.indexOf('/provisioning/instances/1/core-upgrade');
+  assert.ok(rule >= 0 && mv > rule, `the rule changes FIRST, then the move is queued: ${paths}`);
+  assert.deepEqual(plain(b.posts[rule].body), { channel: 'minor' });
+  assert.deepEqual(plain(b.posts[mv].body), { to: '1.20.1' });
+});
+
+test('under the widest rule already, the refusal offers no allow button', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { update_channel: 'minor', last_move: failedAs('needs_decision', 'outside_channel') }) });
+  await b.settle();
+  assert.doesNotMatch(b.panel(), /dp-allow-1/);
+});
+
+test('the other decisions say what the owner can do, with no button that cannot help', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('needs_decision', 'artist_gate') }) });
+  await b.settle();
+  assert.match(b.panel(), /Approve the artist review/);
+  assert.doesNotMatch(b.panel(), /dp-allow-1/);
+});
+
+test('a failure nothing automatic can fix points at the blocker filed for it', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('unknown', 'health') }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /nothing automatic can fix it/);
+  assert.match(html, /did not answer after restarting/);
+  assert.match(html, /href="\/blockers"/);
+  assert.match(html, /<details class="dp-settled__detail">/, 'the runner’s words are still one click away');
+});
+
+test('a failed ROLLBACK says the project may be down', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('unknown', 'rollback_failed') }) });
+  await b.settle();
+  assert.match(b.panel(), /may be down/);
+  assert.match(b.panel(), /href="\/blockers"/);
+});
+
+test('a temporary failure that ran out of retries offers to try again — only for the move on offer', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('transient', 'npm_install') }) });
+  await b.settle();
+  assert.match(b.panel(), /kept stopping/);
+  assert.match(b.panel(), /dp-again-1/);
+  const other = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('transient', 'npm_install', { target_version: '1.19.850' }) }) });
+  await other.settle();
+  assert.doesNotMatch(other.panel(), /dp-again-1/, 'a try-again for a version no longer on offer would be a different move');
+});
+
+test('the update rule is shown in words and can be changed from the page', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { update_channel: 'patch' }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /Update rule: Fixes only/);
+  assert.match(html, /<option value="patch" selected>/);
+  b.els.set('dp-rule-sel-1', { value: 'minor' });
+  b.els.get('dp-rule-save-1')._on.click();
+  await b.settle();
+  const post = b.posts.find((p) => /update-channel$/.test(p.path));
+  assert.deepEqual(post && plain(post.body), { channel: 'minor' });
+  assert.ok(b.toasts.length, 'the server’s sentence is shown');
+});
+
+test('a preview with no rule reading shows no rule control, rather than a guessed one', async () => {
+  const b = boot();
+  await b.settle();
+  assert.doesNotMatch(b.panel(), /Update rule/);
+});
+
+test('every reason the runner can give has owner words on this page — none falls to the fallback', async () => {
+  // upgrade-outcome.js's REASON_CLASS is the vocabulary; a reason added there with no
+  // sentence here would reach the owner as "no words for this yet".
+  const { createRequire } = await import('node:module');
+  const req = createRequire(import.meta.url);
+  const vocab = Object.keys(req(path.join(ROOT, 'scripts/gds/upgrade-outcome.js')).REASON_CLASS || {});
+  assert.ok(vocab.length > 20, 'the vocabulary was read');
+  const block = SRC.slice(SRC.indexOf('const REASON_WORDS = {'), SRC.indexOf('const reasonWords'));
+  const missing = vocab.filter((k) => !new RegExp(`\\b${k}:`).test(block));
+  assert.deepEqual(missing, [], `reasons with no owner words: ${missing}`);
+});
+
+test('a module that is not ready says what the owner can do about it', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('needs_decision', 'module_incompatible') }) });
+  await b.settle();
+  assert.match(b.panel(), /Turn that module off/);
+});
+
+test('a known snag it could not fix names the next step, and does NOT point at a blocker that was never filed', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('known_wedge', 'disk_full') }) });
+  await b.settle();
+  assert.match(b.panel(), /whoever runs that machine clears the snag/);
+  assert.doesNotMatch(b.panel(), /href="\/blockers"/, 'move-escalation files no blocker for this class');
+});