@bongos/core 1.20.37 → 1.20.39

package/docs/recipes/upgrading-the-core.md

@@ -90,6 +90,8 @@ The sections above are the *manual* `bongos upgrade`. The **subscription** runs
 
 A **major** is never automatic; prereleases are never auto-targeted.
 
+**Where the channel comes from** ([ADR 0357](../adr/0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md), task [1004468](https://cloudbongos.com/builders#/task/1004468)): the rule set on **/deploy** (`provisioning_instances.update_channel`) wins for any roster entry whose `slug` matches a project row. The roster's `channel` below is only the fallback, used when no row matches or the sweep can't read the database. The sweep reads the control plane's DB from its own `DATABASE_URL` / `PGDATABASE`, so the unit needs one of them set. Every run prints each entry's channel and its source.
+
 **Enrolling an instance** — add it to `config/update-subscriptions.json` (instance-side) (ships empty). `env` carries per-instance vars merged into the upgrade child — set `PGDATABASE` so `migrate` hits the right DB (see the Gotchas):
 
 ```json

package/modules/autonomy/db.js

@@ -76,7 +76,7 @@ async function readAutonomyRuns({ routine = null, limit = 20 } = {}) {
 // it unreadable to the caller, which refuses — never a permissive default.
 async function readFence() {
   const [fence, goals] = await Promise.all([
-    pool.query('SELECT enabled, paused_reason, updated_at, updated_by FROM autonomy_fence WHERE id = 1'),
+    pool.query('SELECT enabled, paused_reason, priority_goal_id, updated_at, updated_by FROM autonomy_fence WHERE id = 1'),
     pool.query('SELECT goal_id, note, added_at, added_by FROM autonomy_allowed_goals ORDER BY added_at DESC'),
   ]);
   const row = fence.rows[0];
@@ -84,6 +84,9 @@ async function readFence() {
   return {
     enabled: row.enabled === true,
     paused_reason: row.paused_reason,
+    // A bigint, so a string from node-postgres; normalised for the same reason as
+    // the goal ids below. null = no priority (task 1004453).
+    priority_goal_id: row.priority_goal_id == null ? null : Number(row.priority_goal_id),
     updated_at: row.updated_at,
     updated_by: row.updated_by ? String(row.updated_by) : null,
     // goal_id is a bigint, which node-postgres hands back as a STRING. The runner
@@ -124,6 +127,28 @@ async function allowGoal({ goalId, note = null, builderId = null }) {
   return r ? { ...r, goal_id: Number(r.goal_id) } : null;
 }
 
+// setPriorityGoal — name the goal the runner works first, or clear it with null
+// (task 1004453). The WHERE refuses a goal that is not allowlisted, so the write
+// either lands or returns nothing and the route can say why; the foreign key from
+// autonomy_003 backs the same rule in the schema. Returns:
+//   { row }           — written
+//   { notAllowed }    — that goal is not on the allowlist
+//   { missing }       — the singleton row is gone (migrations not run)
+async function setPriorityGoal({ goalId, builderId = null }) {
+  const { rows } = await pool.query(
+    `UPDATE autonomy_fence
+        SET priority_goal_id = $1, updated_at = now(), updated_by = $2
+      WHERE id = 1
+        AND ($1::bigint IS NULL OR EXISTS (SELECT 1 FROM autonomy_allowed_goals WHERE goal_id = $1::bigint))
+      RETURNING priority_goal_id, updated_at`,
+    [goalId, builderId]
+  );
+  const r = rows[0];
+  if (r) return { row: { priority_goal_id: r.priority_goal_id == null ? null : Number(r.priority_goal_id), updated_at: r.updated_at } };
+  const { rows: fenceRows } = await pool.query('SELECT 1 FROM autonomy_fence WHERE id = 1');
+  return fenceRows.length ? { notAllowed: true } : { missing: true };
+}
+
 // disallowGoal — take a goal off the allowlist. `removed` says whether a row
 // actually went, because "already gone" and "just revoked" are different answers
 // to an owner clicking Remove.
@@ -137,11 +162,11 @@ async function disallowGoal(goalId) {
 // recordRunnerHeartbeat — upsert one host's check-in. ON CONFLICT so the normal
 // case is one write, and `host` is the key so a second runner appears as a second
 // row rather than silently overwriting the first.
-async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null }) {
+async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null, workingGoalId = null }) {
   const { rows } = await pool.query(
     `INSERT INTO autonomy_runner_heartbeat
-       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, last_seen_at, updated_at)
-     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, now(), now())
+       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at, updated_at)
+     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, $9, now(), now())
      ON CONFLICT (builder_id, host) DO UPDATE SET
        pid = EXCLUDED.pid,
        started_at = COALESCE(EXCLUDED.started_at, autonomy_runner_heartbeat.started_at),
@@ -149,10 +174,11 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
        consecutive_failures = EXCLUDED.consecutive_failures,
        last_event = EXCLUDED.last_event,
        working_task_id = EXCLUDED.working_task_id,
+       working_goal_id = EXCLUDED.working_goal_id,
        last_seen_at = now(),
        updated_at = now()
-     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, last_seen_at`,
-    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId]
+     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at`,
+    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId, workingGoalId]
   );
   return rows[0] || null;
 }
@@ -167,14 +193,18 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
 // liveness view entirely (grader finding, task 1003905).
 async function readRunnerHeartbeats(builderId) {
   const { rows } = await pool.query(
-    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, last_seen_at
+    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at
        FROM autonomy_runner_heartbeat
       WHERE builder_id = $1
       ORDER BY last_seen_at DESC
       LIMIT 20`,
     [builderId]
   );
-  return rows.map((r) => ({ ...r, working_task_id: r.working_task_id ? String(r.working_task_id) : null }));
+  return rows.map((r) => ({
+    ...r,
+    working_task_id: r.working_task_id ? String(r.working_task_id) : null,
+    working_goal_id: r.working_goal_id ? String(r.working_goal_id) : null,
+  }));
 }
 
 module.exports = {
@@ -187,4 +217,5 @@ module.exports = {
   setFenceEnabled,
   allowGoal,
   disallowGoal,
+  setPriorityGoal,
 };

package/modules/autonomy/fence.js

@@ -74,25 +74,44 @@ function normaliseFence(raw) {
     const n = Number(typeof g === 'object' && g !== null ? g.goal_id : g);
     if (Number.isSafeInteger(n) && n > 0) ids.push(n);
   }
+  // The priority goal (task 1004453). Honoured only when it is ON the allowlist:
+  // the database already enforces that with a foreign key, and this re-checks it
+  // so a priority can only ever ORDER the allowlist, never add to it. Anything
+  // else (missing, malformed, not allowlisted) reads as "no priority", which is
+  // the old behaviour, not a refusal: the allowlist alone is still a safe answer.
+  const p = Number(raw.priority_goal_id);
+  const priorityGoal = raw.priority_goal_id != null && Number.isSafeInteger(p) && p > 0 && ids.includes(p) ? p : null;
   return {
     enabled: raw.enabled === true,
     pausedReason: typeof raw.paused_reason === 'string' ? raw.paused_reason : null,
     goals: ids,
+    priorityGoal,
   };
 }
 
+// prioritise — the same goals with the priority goal moved to the front. A goal
+// that is not in the list is ignored, so this can reorder and never add.
+function prioritise(goals, priorityGoal) {
+  if (priorityGoal == null || !goals.includes(priorityGoal)) return goals.slice();
+  return [priorityGoal, ...goals.filter((g) => g !== priorityGoal)];
+}
+
 // allowedGoals — the goals this run may work, given the fence and whatever the
 // operator asked for on the command line.
 //
 // The INTERSECTION is the point. `requested` can only narrow: a goal the operator
 // named that the database does not allow is dropped, and reported, rather than
 // honoured. The runner host is not a place authority can come from.
+//
+// The priority goal goes FIRST, after the intersection, so an operator narrowing
+// to goals that leave it out simply gets no priority rather than having it
+// re-added.
 function allowedGoals(fence, requested = []) {
   const allowed = new Set(fence.goals);
   const asked = (requested || []).map((g) => Number(g)).filter((n) => Number.isSafeInteger(n) && n > 0);
-  if (!asked.length) return { goals: fence.goals.slice(), refused: [] };
+  if (!asked.length) return { goals: prioritise(fence.goals, fence.priorityGoal), refused: [] };
   return {
-    goals: asked.filter((g) => allowed.has(g)),
+    goals: prioritise(asked.filter((g) => allowed.has(g)), fence.priorityGoal),
     refused: asked.filter((g) => !allowed.has(g)),
   };
 }
@@ -137,7 +156,10 @@ function decideRun({ fence: rawFence, requestedGoals = [], graderBypassed = null
         : REFUSALS.no_allowlist,
     };
   }
-  return { go: true, goals, refusedGoals: refused, code: null, reason: null };
+  // priorityGoal is reported only when it survived the intersection, so a row can
+  // say "this pick came from the priority goal" without re-deriving the rule.
+  const priorityGoal = fence.priorityGoal != null && goals[0] === fence.priorityGoal ? fence.priorityGoal : null;
+  return { go: true, goals, priorityGoal, refusedGoals: refused, code: null, reason: null };
 }
 
 // decideTask — may THIS task be handed to an unattended worker?
@@ -169,4 +191,4 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
   return { go: true, code: null, reason: null };
 }
 
-module.exports = { REFUSALS, normaliseFence, allowedGoals, decideRun, decideTask };
+module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, decideRun, decideTask };

package/modules/autonomy/migrations/autonomy_003_priority_goal.sql

@@ -0,0 +1,32 @@
+-- autonomy_003_priority_goal.sql — the fence's priority goal (task 1004453).
+--
+-- Owner ruling, 2026-09-30: whoever starts the runner says which goal comes FIRST
+-- as well as which goals it may touch at all. The priority sits on the fence row,
+-- next to the kill switch, for the same reason the allowlist does: the runner
+-- host can read it and cannot write it (see autonomy_001's header).
+--
+-- A FOREIGN KEY TO THE ALLOWLIST, deliberately. The priority goal must be an
+-- allowlisted goal; the route checks that, and this makes it a fact the database
+-- holds rather than a rule one route remembers. ON DELETE SET NULL is the safe
+-- direction: revoking the priority goal from the allowlist clears the priority,
+-- so a revoked goal can never be worked because it was once "first".
+--
+-- The priority ORDERS the allowlist; it never widens it. NULL (the default) means
+-- no priority, which is today's behaviour.
+--
+-- working_goal_id on the heartbeat is the other half of the done-when: the hall
+-- can say which goal the runner's current task came from. Nullable, no FK — a
+-- heartbeat is a report, and a report about a goal deleted since is still true.
+--
+-- Additive and idempotent (ADR 0083 §Decision #5): safe to re-run.
+
+BEGIN;
+
+ALTER TABLE autonomy_fence
+  ADD COLUMN IF NOT EXISTS priority_goal_id bigint
+    REFERENCES autonomy_allowed_goals (goal_id) ON DELETE SET NULL;
+
+ALTER TABLE autonomy_runner_heartbeat
+  ADD COLUMN IF NOT EXISTS working_goal_id bigint;
+
+COMMIT;

package/modules/autonomy/routes/autonomy.js

@@ -88,7 +88,7 @@ module.exports = function buildAutonomyRouter() {
 
   // ── the Autobongos fence (task 1003908, ADR 0307 §6) ───────────────────────
   //
-  // These four routes ARE the fence. Everything the unattended runner is allowed
+  // These five routes ARE the fence. Everything the unattended runner is allowed
   // to do is decided by rows only these can write, on a server the runner host
   // cannot reach — that separation is the entire safety argument, so read the
   // rank gates below as load-bearing rather than boilerplate.
@@ -172,6 +172,31 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // The priority goal (task 1004453): which allowlisted goal the runner works
+  // first. Same gate as the allowlist — choosing what an unattended machine does
+  // first is part of choosing what it may do. The goal must already be on the
+  // allowlist (409 otherwise), so a priority can order the list and never widen
+  // it. `goal_id: null` clears it.
+  router.post('/autonomy/fence/priority', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    // Declared with an open rule: the value is a number OR null, which the
+    // validator has no type for, so the shape is checked just below.
+    if (validateOrRespond(req, res, { goal_id: {} })) return;
+    const raw = req.body ? req.body.goal_id : undefined;
+    if (raw === undefined) return res.fail('goal_id_required', { status: 400, message: 'pass { "goal_id": <number> } or { "goal_id": null } to clear' });
+    const goalId = raw === null ? null : Number(raw);
+    if (goalId !== null && (!Number.isSafeInteger(goalId) || goalId <= 0)) return res.fail('goal_id_required', { status: 400, message: 'pass { "goal_id": <number> } or { "goal_id": null } to clear' });
+    try {
+      const out = await db.setPriorityGoal({ goalId, builderId: req.builder.id });
+      if (out.missing) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
+      if (out.notAllowed) return res.fail('goal_not_allowlisted', { status: 409, message: `goal ${goalId} is not on the allowlist — add it first` });
+      log.info(`[gds] autonomy fence: priority goal ${goalId === null ? 'CLEARED' : `set to ${goalId}`} by builder ${req.builder.id} (${req.builder.rank})`);
+      res.json(out.row);
+    } catch (err) {
+      log.error('[gds] POST /autonomy/fence/priority', err);
+      res.fail('priority_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // ── the runner heartbeat (task 1003905) ────────────────────────────────────
   //
   // A dead runner must be VISIBLE, not silent. The runner also writes a heartbeat
@@ -193,6 +218,7 @@ module.exports = function buildAutonomyRouter() {
       consecutive_failures: { type: 'number' },
       last_event: { type: 'string', maxLength: 64 },
       working_task_id: { type: 'number' },
+      working_goal_id: { type: 'number' },
     })) return;
     const b = req.body || {};
     try {
@@ -207,6 +233,7 @@ module.exports = function buildAutonomyRouter() {
         consecutiveFailures: Number.isInteger(b.consecutive_failures) ? b.consecutive_failures : null,
         lastEvent: b.last_event || null,
         workingTaskId: Number.isInteger(b.working_task_id) ? b.working_task_id : null,
+        workingGoalId: Number.isInteger(b.working_goal_id) ? b.working_goal_id : null,
       });
       res.json({ ok: true, heartbeat: row });
     } catch (err) {

package/modules/hall-ui/public/gate.js

@@ -275,16 +275,31 @@
     });
   }
 
-  function renderFenceGoals(goals) {
+  // The priority goal (task 1004453) is one of the allowlisted rows, marked and
+  // listed first, because that is the order the runner works them in. Its button
+  // clears it; every other row's button makes that goal the priority.
+  function renderFenceGoals(goals, priorityGoalId) {
     const el = document.getElementById('fence-goals');
-    const rows = (goals || []).map((g) => `
+    const pri = priorityGoalId == null ? null : Number(priorityGoalId);
+    // true - false = 1, so the priority row sorts ahead of every other; the rest keep their order.
+    const ordered = (goals || []).slice().sort((a, b) => (Number(b.goal_id) === pri) - (Number(a.goal_id) === pri));
+    const rows = ordered.map((g) => {
+      const isPri = Number(g.goal_id) === pri;
+      return `
       <li class="ov-row" style="display:flex;align-items:center;gap:12px;">
         <a href="/builders#/goal/${encodeURIComponent(g.goal_id)}">Goal ${escapeHtml(String(g.goal_id))}</a>
+        ${isPri ? '<span class="fact-pill fact-pill--ok">Priority</span>' : ''}
         <span style="flex:1;">${escapeHtml(g.note || '')}</span>
+        <button type="button" class="btn" data-priority="${isPri ? '' : escapeHtml(String(g.goal_id))}">${isPri ? 'Clear priority' : 'Make priority'}</button>
         <button type="button" class="btn" data-revoke="${escapeHtml(String(g.goal_id))}">Remove</button>
-      </li>`).join('');
+      </li>`;
+    }).join('');
+    const priLine = pri === null
+      ? 'No priority goal: the runner works these in any order.'
+      : `The runner works goal ${escapeHtml(String(pri))} first, then the others once it has nothing left to claim there.`;
     el.innerHTML = `
       <h3 class="scroll__h" style="font-size:1rem;">Allowlisted goals</h3>
+      ${goals && goals.length ? `<p class="ov-foot">${priLine}</p>` : ''}
       ${goals && goals.length ? `<ul class="ov-rows">${rows}</ul>`
         : emptyStateHtml('No goal is allowlisted, so the runner has nothing it may work on.')}
       <form id="fence-add" class="ov-foot" style="display:flex;gap:8px;align-items:center;margin-top:12px;">
@@ -305,6 +320,19 @@
       } catch (err) { toast(err.message || 'Could not add that goal.'); }
     });
 
+    for (const btn of el.querySelectorAll('[data-priority]')) {
+      btn.addEventListener('click', async () => {
+        // An empty attribute is the Clear button on the current priority row.
+        const v = btn.getAttribute('data-priority');
+        const goalId = v ? Number(v) : null;
+        try {
+          await sendJson('POST', '/autonomy/fence/priority', { goal_id: goalId });
+          toast(goalId === null ? 'Priority cleared.' : `Goal ${goalId} is now the priority.`);
+          await loadFence();
+        } catch (err) { toast(err.message || 'Could not change the priority.'); }
+      });
+    }
+
     for (const btn of el.querySelectorAll('[data-revoke]')) {
       btn.addEventListener('click', async () => {
         const goalId = btn.getAttribute('data-revoke');
@@ -360,6 +388,7 @@
       return `<p class="ov-foot" style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;">
         <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
         <span>${escapeHtml(h.detail || '')}</span>
+        ${r.working_goal_id ? `<span class="ov-fact">from goal ${escapeHtml(String(r.working_goal_id))}</span>` : ''}
         <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
       </p>`;
     }).join('');
@@ -379,7 +408,7 @@
       return;
     }
     renderFenceState(fence);
-    renderFenceGoals(fence.goals);
+    renderFenceGoals(fence.goals, fence.priority_goal_id);
   }
 
   async function init() {

package/modules/ideas/routing.js

@@ -95,9 +95,16 @@ const NEVER_ROUTE_GRADE = 'full';
 //   'discord-bugs'  — the #bugs channel, where the CHANNEL is the classification
 //                     (modules/discord/discord-bugs.js forces kind='bug'), and
 //                     which already carries a rate cap + an unlinked-author guard.
+//   'instance-feedback' — POST /sso/feedback on the hub (task 1004462): a
+//                     federated project relaying `bongos feedback` about Bongos
+//                     itself. It earns the vector the way #bugs does — the
+//                     sender must be a hub-witnessed member of the calling
+//                     project, and the route caps filings per sender and per
+//                     project — and it always files with NO rank, so every
+//                     report lands at 'backlog' awaiting a nod.
 // 'discord-ideas' is deliberately ABSENT: it is an ideation channel, and the bug
 // reports that belong to Discord already have #bugs.
-const HOMELESS_ROUTING_VECTORS = new Set(['api', 'discord-bugs']);
+const HOMELESS_ROUTING_VECTORS = new Set(['api', 'discord-bugs', 'instance-feedback']);
 
 // decideLanding — the matrix, as one pure function.
 //

package/modules/npm-release/preview/childlog.js

@@ -0,0 +1,95 @@
+'use strict';
+
+// modules/npm-release/preview/childlog.js — what the preview child printed, kept small and
+// with secrets taken out (task 1004465).
+//
+// WHY. The child used to be spawned with stdio 'ignore', so when a preview started but could
+// not serve a single page, its own error went nowhere and the only way to find out was ssh.
+// This keeps the last CAP bytes of its stdout and stderr, writes them to a file in the
+// preview's scratch directory, and hands the deploy page a short redacted tail.
+//
+// REDACTION IS BY VALUE AND BY SHAPE. Every value in the environment the child was given
+// (and the live one) whose name looks secret is replaced wherever it appears; then the common
+// shapes (a password in a connection URL, `token=...`, a bearer header, a GitHub or API key)
+// are replaced even if nobody listed them. The tail never reaches a caller unredacted: it is
+// redacted at read time as well as at write time, so a secret that arrives split across two
+// chunks is still caught.
+
+const CAP = 64 * 1024;
+// The file is rewritten at most this often, asynchronously: the child's output is handled
+// inside the LIVE hall's process, and a chatty or crash-looping child must never turn into a
+// run of blocking disk writes on its event loop.
+const FLUSH_MS = 500;
+const TAIL_LINES = 20;
+const MAX_LINE = 300;
+const SECRET_NAME = /(SECRET|TOKEN|PASSWORD|PASSWD|PASS|KEY|CREDENTIAL|COOKIE|AUTH)/i;
+
+const SHAPES = [
+  [/([a-z][a-z0-9+.-]*:\/\/[^\s:/@]*:)[^\s@/]+@/gi, '$1[redacted]@'],
+  [/\b((?:api[_-]?key|token|secret|password|passwd|authorization|cookie|signing[_-]?key)\w*\s*[=:]\s*)("[^"]*"|'[^']*'|\S+)/gi, '$1[redacted]'],
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]+/g, 'Bearer [redacted]'],
+  [/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{10,})/g, '[redacted]'],
+];
+
+/** The values in these environments that look like secrets and are long enough to matter. */
+function secretValues(...envs) {
+  const out = new Set();
+  for (const env of envs) {
+    for (const [k, v] of Object.entries(env || {})) {
+      if (SECRET_NAME.test(k) && typeof v === 'string' && v.length >= 6) out.add(v);
+    }
+  }
+  // Longest first, so a value that contains another is replaced whole.
+  return [...out].sort((a, b) => b.length - a.length);
+}
+
+/** Take the secrets out of one piece of text. Pure. */
+function redact(text, secrets = []) {
+  let s = String(text);
+  for (const v of secrets) s = s.split(v).join('[redacted]');
+  for (const [re, to] of SHAPES) s = s.replace(re, to);
+  return s;
+}
+
+/**
+ * @param {object} [o]
+ * @param {string[]} [o.secrets]  exact values to take out (from secretValues)
+ * @param {object} [o.fsImpl]     fs (writeFile, the callback form) — optional, with `file`
+ * @param {string} [o.file]       where to keep the capped raw-but-redacted log
+ * @param {number} [o.cap]
+ */
+function createChildLog({ secrets = [], fsImpl = null, file = null, cap = CAP, flushMs = FLUSH_MS } = {}) {
+  let buf = '';
+  let timer = null;
+  let closed = false;
+  const canWrite = () => !!(fsImpl && file && typeof fsImpl.writeFile === 'function');
+  function flush() {
+    timer = null;
+    if (closed || !canWrite()) return;
+    try { fsImpl.writeFile(file, buf, () => { /* best effort */ }); } catch { /* best effort */ }
+  }
+  return {
+    /** Add output. Never throws: a log that cannot be kept must not fail a start. */
+    append(chunk) {
+      try {
+        buf = (buf + redact(chunk, secrets)).slice(-cap);
+        if (canWrite() && !timer && !closed) {
+          timer = setTimeout(flush, flushMs);
+          if (timer && typeof timer.unref === 'function') timer.unref();
+        }
+      } catch { /* best effort */ }
+    },
+    /** Write the file now (tests; the timer does this in production). */
+    flush,
+    /** Stop writing: the scratch directory is about to be removed. */
+    close() { closed = true; if (timer) { clearTimeout(timer); timer = null; } },
+    /** The last `n` non-empty lines, each shortened. */
+    tail(n = TAIL_LINES) {
+      return redact(buf, secrets).split(/\r?\n/).filter((l) => l.trim())
+        .slice(-n).map((l) => (l.length > MAX_LINE ? `${l.slice(0, MAX_LINE)}…` : l));
+    },
+    size: () => buf.length,
+  };
+}
+
+module.exports = { createChildLog, redact, secretValues };

package/modules/npm-release/preview/commands.js

@@ -36,11 +36,49 @@ function installCommand({ cacheRoot, version }) {
   return { cmd: 'npm', args: ['install', '--prefix', versionDir(cacheRoot, version), `${PACKAGE}@${version}`, '--omit=dev'] };
 }
 
-/** Drop the copy if one is left over — used before a start and on every stop. */
+/**
+ * Drop the copy if one is left over — used before a start and on every stop. --force ends any
+ * connection still open on the copy (Postgres 13+), which is exactly the case that used to
+ * leave it behind: a child that had not finished exiting. The name is the fixed PREVIEW_DB
+ * and nothing is interpolated, so this can never name the live database.
+ */
 function dropDbCommand() {
+  return { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] };
+}
+
+/** Plain drop, for a server whose dropdb has no --force (Postgres 12 and older). */
+function dropDbPlainCommand() {
   return { cmd: 'dropdb', args: ['--if-exists', PREVIEW_DB] };
 }
 
+/**
+ * End every connection to the copy and ONLY the copy: the database name is the literal
+ * PREVIEW_DB, never a parameter. Run on the maintenance database, since the copy cannot be
+ * connected to while it is being emptied.
+ */
+function terminateBackendsCommand() {
+  return {
+    cmd: 'psql',
+    args: ['-X', '-d', 'postgres', '-tAc',
+      `SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '${PREVIEW_DB}' AND pid <> pg_backend_pid()`],
+  };
+}
+
+/**
+ * Can this command only ever touch the copy? True for the drop commands above and nothing
+ * else. The supervisor checks it before running any drop, so a future edit that pointed one
+ * at another database is refused at run time, not discovered on the droplet.
+ */
+function targetsOnlyPreviewDb(command) {
+  if (!command || !Array.isArray(command.args)) return false;
+  if (command.cmd === 'dropdb') {
+    const last = command.args[command.args.length - 1];
+    return last === PREVIEW_DB && command.args.slice(0, -1).every((a) => a.startsWith('--'));
+  }
+  if (command.cmd === 'psql') return JSON.stringify(command.args) === JSON.stringify(terminateBackendsCommand().args);
+  return false;
+}
+
 /** An empty database for the copy. Deliberately no template (see the header). */
 function createDbCommand() {
   return { cmd: 'createdb', args: [PREVIEW_DB] };
@@ -65,17 +103,20 @@ function restoreCommand({ dumpFile }) {
  * DATABASE_URL is blanked because the pool prefers it to PGDATABASE, and PGDATABASE is
  * pinned to the copy so nothing can be applied to the live database by mistake.
  */
-function migrateCommand({ cacheRoot, version, env }) {
+function migrateCommand({ cacheRoot, version, env, instanceDir }) {
   const dir = versionDir(cacheRoot, version);
+  // With a scratch instance directory, THAT is the instance root (its config/ and
+  // migrations/instance/ are copies of the live instance's); without one, the install directory.
+  const root = instanceDir || dir;
   return {
     cmd: 'bash',
     args: [path.join(dir, 'node_modules', '@bongos', 'core', 'scripts', 'migrate.sh')],
-    cwd: dir,
-    env: { ...env, INIT_CWD: dir, PGDATABASE: PREVIEW_DB, DATABASE_URL: '' },
+    cwd: root,
+    env: { ...env, INIT_CWD: root, PGDATABASE: PREVIEW_DB, DATABASE_URL: '' },
   };
 }
 
 module.exports = {
   VERSION_RE, PACKAGE, versionDir, entryPath,
-  installCommand, dropDbCommand, createDbCommand, dumpCommand, restoreCommand, migrateCommand,
+  installCommand, dropDbCommand, dropDbPlainCommand, terminateBackendsCommand, targetsOnlyPreviewDb, createDbCommand, dumpCommand, restoreCommand, migrateCommand,
 };

package/modules/npm-release/preview/env.js

@@ -41,12 +41,15 @@ const POLLERS_OFF = Object.freeze([
 
 // Modules that talk to the outside world, off. npm-release is off too: a preview must not
 // offer previews of its own.
-const MODULES_OFF = Object.freeze([
-  'BONGOS_MODULE_DISCORD',
-  'BONGOS_MODULE_AGENTS',
-  'BONGOS_MODULE_PROVISIONING',
-  'BONGOS_MODULE_NPM_RELEASE',
-]);
+//
+// EVERY SPELLING OF THE PREFIX. The core reads <PREFIX>_MODULE_<KEY> with the PREFIX the
+// instance's branding pack names, then the legacy ones. The child now runs with a copy of the
+// live instance's config/ (task 1004465), so its prefix may be the live instance's own, and a
+// switch spelled only BONGOS_ would then be ignored — Discord and the agents would come back
+// on in the copy. So each switch is set under every prefix the core can resolve.
+const MODULE_KEYS = Object.freeze(['DISCORD', 'AGENTS', 'PROVISIONING', 'NPM_RELEASE']);
+const PREFIXES = Object.freeze(['BONGOS', 'CLOUDBONGOS', 'OTB', 'GDS', 'PMS']);
+const MODULES_OFF = Object.freeze(PREFIXES.flatMap((pfx) => MODULE_KEYS.map((k) => `${pfx}_MODULE_${k}`)));
 
 /**
  * Build the child's environment.
@@ -55,9 +58,12 @@ const MODULES_OFF = Object.freeze([
  * @param {object} [o.env]   the live process's environment (only CARRIED names are read)
  * @param {number|string} o.port   the loopback port the preview listens on
  * @param {string} o.scratchHome   an empty directory to serve as HOME
+ * @param {string} [o.envPrefix]   the env prefix of the copied instance's branding pack, if any
+ * @param {string} [o.instanceRoot]  the scratch directory shaped like an instance root (config/,
+ *                                   migrations/instance/); the child reads its host content from it
  * @returns {Record<string,string>} a fresh object, never `env` itself
  */
-function buildPreviewEnv({ env = process.env, port, scratchHome } = {}) {
+function buildPreviewEnv({ env = process.env, port, scratchHome, instanceRoot, envPrefix } = {}) {
   if (!port) throw new TypeError('buildPreviewEnv: port is required');
   if (!scratchHome) throw new TypeError('buildPreviewEnv: scratchHome is required');
   const out = {};
@@ -68,10 +74,15 @@ function buildPreviewEnv({ env = process.env, port, scratchHome } = {}) {
   out.PORT = String(port);
   out.HOST = '127.0.0.1';
   out.HOME = scratchHome;
+  // Named explicitly: without it the core takes the process's working directory as the instance
+  // root, and the install directory is not one (no config/, so no branding, no module switches).
+  if (instanceRoot) out.BONGOS_INSTANCE_ROOT = instanceRoot;
   out.PGDATABASE = PREVIEW_DB;
   out.CHAT_DRY_RUN = '1';
   for (const name of POLLERS_OFF) out[name] = '1';
   for (const name of MODULES_OFF) out[name] = '0';
+  // The copied instance's own prefix, when it is none of the above.
+  if (/^[A-Z][A-Z0-9_]*$/.test(String(envPrefix || ''))) for (const k of MODULE_KEYS) out[`${envPrefix}_MODULE_${k}`] = '0';
   return out;
 }