@bongos/core 1.20.77 → 1.20.78

package/scripts/gds/update-sweep.js

@@ -51,6 +51,13 @@
 // instance's OWN core says this upgrade rewrites (laneGeneratedPaths). Anything outside that set is
 // still a human's, and still stops us.
 //
+// ── WHICH VERSIONS AN INSTANCE TAKES AT ALL (task 1004297, ADR 0360) ───────────────────────────────
+// Each roster entry has a FOLLOW beside its channel. `released` (the default) takes only versions at
+// or below the registry's `latest` label — what the owner has released to other projects; the
+// platform's own hall is set to `candidates` and takes every version as soon as it is published, so
+// Bongos runs each one before anyone else is offered it. An instance that follows releases and whose
+// released label cannot be read is SKIPPED, never upgraded on a guess.
+//
 // Usage:
 //   node scripts/gds/update-sweep.js            # dry-run (plan only)
 //   node scripts/gds/update-sweep.js --apply    # actually upgrade
@@ -472,6 +479,83 @@ function preflightFlagsFor(pinMode) {
 
 // ── the sweep ────────────────────────────────────────────────────────────────────────────────────
 
+// ── A VERSION THAT FAILED HERE IS NOT RETRIED EVERY SWEEP (task 1004297, ADR 0360 D4) ─────────────
+// At a daily cadence a version that failed its health check was retried once a day. At the 15-minute
+// cadence the platform now runs, the same version would be installed, fail, restart the service and
+// roll back every quarter of an hour until something newer was published — an outage generator. So a
+// version whose upgrade failed here is HELD for a day for that instance: the sweep skips it and says
+// so, and any NEWER version is taken at once (it is the fix). The hold expires so a transient failure
+// (a registry blip, a full disk since cleared) is retried rather than refused forever.
+//
+// The record lives in the sweep's own config home, never in an instance's tree: a file written there
+// would be "a human's work" to pinState and wedge the lane it exists to protect.
+const REFUSAL_HOLD_MS = 24 * 60 * 60 * 1000;
+const REFUSALS_FILE = 'core-update-refused.json';
+
+function refusalsPath() {
+  try { return path.join(require('../../src/instance-config.js').configHome(), REFUSALS_FILE); } catch { return null; }
+}
+
+function readRefusals(file, readFile = fs.readFileSync) {
+  if (!file) return {};
+  try {
+    const j = JSON.parse(readFile(file, 'utf8'));
+    return j && typeof j === 'object' && !Array.isArray(j) ? j : {};
+  } catch { return {}; }
+}
+
+// The versions held for `slug` at `now`: a Map version → { at, reason }, only those still inside
+// the hold. PURE.
+function heldVersions(refusals, slug, now) {
+  const out = new Map();
+  const rows = refusals && Array.isArray(refusals[slug]) ? refusals[slug] : [];
+  for (const r of rows) {
+    const at = r && Date.parse(r.at);
+    if (r && typeof r.version === 'string' && Number.isFinite(at) && now - at < REFUSAL_HOLD_MS) out.set(r.version, { at: r.at, reason: r.reason || null });
+  }
+  return out;
+}
+
+// Record that `version` failed on `slug`. Keeps only rows still inside the hold, so the file cannot
+// grow without bound. Best-effort: a record that cannot be written costs one retry, never the sweep.
+function recordRefusal({ file, slug, version, reason, now = Date.now(), readFile = fs.readFileSync, writeFile = fs.writeFileSync, mkdir = fs.mkdirSync } = {}) {
+  if (!file || !slug || !version) return false;
+  try {
+    const all = readRefusals(file, readFile);
+    const keep = [...heldVersions(all, slug, now)].filter(([v]) => v !== version).map(([v, x]) => ({ version: v, at: x.at, reason: x.reason }));
+    all[slug] = [...keep, { version, at: new Date(now).toISOString(), reason: reason || null }];
+    mkdir(path.dirname(file), { recursive: true });
+    writeFile(file, JSON.stringify(all, null, 2) + '\n');
+    return true;
+  } catch { return false; }
+}
+
+// What this instance should move to, and under which follow (task 1004297, ADR 0360). The channel
+// bounds how far a jump may go; the follow bounds which published versions exist to jump to at all.
+//
+// `inst.follow` is absent only when the core this sweep resolved predates the axis. That core also
+// predates any split between candidates and releases, so every published version IS a release and
+// the old reading — all of them — is the right one. With the axis present, `released` asks the
+// registry which version carries the `latest` label and SKIPS the instance when it cannot say: an
+// instance that follows releases is never upgraded on a guess.
+//
+// Returns { follow, target } (target null = up to date) or { follow, skip: '<why>' }.
+function followTarget({ inst, installed, channel, versions, env, held = new Map() }) {
+  const follow = inst.follow || 'candidates';
+  let admitted = versions;
+  if (follow === 'released' && typeof channel.readReleaseTags === 'function') {
+    const tags = channel.readReleaseTags({ cwd: inst.dir, env });
+    if (!tags.ok) return { follow, skip: `could not read which version is released (${tags.error})` };
+    admitted = channel.versionsForFollow({ follow, available: admitted, released: tags.released });
+  }
+  const pick = (list) => channel.resolveChannelTarget({ installed, channel: inst.channel, available: list }) || null;
+  const target = pick(admitted.filter((v) => !held.has(v)));
+  // A hold is named only when it is what changed the answer: the version this instance would have
+  // taken without it.
+  const unheld = pick(admitted);
+  return { follow, target, held: unheld && unheld !== target && held.has(unheld) ? { version: unheld, ...held.get(unheld) } : null };
+}
+
 // `instanceRoot` is the default roster root when no --instance is given: the subscribe.js shim passes
 // its own instance root; run directly, it is the working directory.
 function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
@@ -503,6 +587,8 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
   if (only && roster.length === 0) console.error(`  ! --only ${only} matched no subscribed instance`);
 
   let upgraded = 0, skipped = 0, failed = 0, upToDate = 0, healed = 0;
+  const refusalsFile = refusalsPath();
+  const refusals = readRefusals(refusalsFile);
 
   for (const inst of roster) {
     const label = inst.slug;
@@ -574,8 +660,12 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
     const listed = channel.listAvailableVersions({ cwd: inst.dir, env: { ...process.env, ...inst.env } });
     if (!listed.ok) { console.error(`  ! ${label}: could not list registry versions (${listed.error}) — skipped`); skipped++; continue; }
 
-    const target = channel.resolveChannelTarget({ installed, channel: inst.channel, available: listed.versions });
-    if (!target) { console.log(`  ✓ ${label}: up to date on ${installed} (channel: ${inst.channel})`); upToDate++; continue; }
+    const aim = followTarget({ inst, installed, channel, versions: listed.versions, env: { ...process.env, ...inst.env }, held: heldVersions(refusals, label, Date.now()) });
+    if (aim.skip) { console.error(`  ! ${label}: ${aim.skip} — skipped`); skipped++; continue; }
+    if (aim.held) console.log(`  • ${label}: ${aim.held.version} failed here at ${aim.held.at} — held for a day, or until a newer version is published`);
+    const target = aim.target;
+    const pace = `channel: ${inst.channel}, follows: ${aim.follow}`;
+    if (!target) { console.log(`  ✓ ${label}: up to date on ${installed} (${pace})`); upToDate++; continue; }
 
     const { script: upgradeScript, source: scriptSource } = resolveUpgradeScript(inst.dir, { fallback: sweepingCoreUpgradeScript });
     if (!upgradeScript) { console.error(`  ! ${label}: no upgrade.js resolvable for this instance — skipped`); skipped++; continue; }
@@ -590,7 +680,7 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
       // promise a policy the real sweep will not use (task 1004122). It read `canCommitPin` alone
       // before, and so said "--commit-pin" for a co-tenant that was never going to get it.
       const dryPinFlags = [...pinFlagsFor({ pinMode, canCommitPin, canPinNoPush }), ...preflightFlagsFor(pinMode)];
-      console.log(`  → ${label}: would upgrade ${installed} → ${target} (channel: ${inst.channel}, registry, via the ${scriptSource} core${dryPinFlags.length ? `, ${dryPinFlags.join(' ')}` : ''})`);
+      console.log(`  → ${label}: would upgrade ${installed} → ${target} (${pace}, registry, via the ${scriptSource} core${dryPinFlags.length ? `, ${dryPinFlags.join(' ')}` : ''})`);
       console.log(`      engine: ${dryEngine}`);
       continue;
     }
@@ -656,6 +746,12 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
 
     if (res.status !== 0) {
       console.error(`  ✖ ${label}: upgrade to ${target} exited ${res.status == null ? '(signal)' : res.status} — see output above (auto-rollback runs on install/migrate/health failure)`);
+      // Hold the version unless it actually went in (a failure AFTER a good install, such as an
+      // unpushed pin, is not the version's fault and must not stop it being retried).
+      if (readInstalledCoreVersion(inst.dir) !== target) {
+        const held = recordRefusal({ file: refusalsFile, slug: label, version: target, reason: `exit ${res.status == null ? 'signal' : res.status}` });
+        console.error(`      ${held ? `${target} is held for this instance for a day; a newer version is still taken at once.` : 'could not record the hold — the next sweep will try this version again.'}`);
+      }
       // A rollback restores the OLD pin, which can itself leave the tree dirty. Tidy it so one bad
       // patch does not wedge every future sweep.
       const after = pinState(inst.dir, spawnSync, generatedAfter);
@@ -714,4 +810,4 @@ if (require.main === module) {
   catch (e) { console.error(`core-update-subscription: fatal — ${e && e.message ? e.message : e}`); process.exit(1); }
 }
 
-module.exports = { main, coreModulePathFrom, CORE_PKG_NAMES, pinState, laneGeneratedPaths, commitPin, preflightFlagsFor, resolveUpgradeScript, supportsCommitPin, supportsPinNoPush, pinFlagsFor, goLiveTargetFor, resolveGoLive, goLiveEngineFor, needsCoTenantMode, pinModeOf, healDecision, rawTopologyFor, PIN_FILES, PIN_MODES, GO_LIVE_REQUIRED };
+module.exports = { main, followTarget, heldVersions, recordRefusal, readRefusals, REFUSAL_HOLD_MS, coreModulePathFrom, CORE_PKG_NAMES, pinState, laneGeneratedPaths, commitPin, preflightFlagsFor, resolveUpgradeScript, supportsCommitPin, supportsPinNoPush, pinFlagsFor, goLiveTargetFor, resolveGoLive, goLiveEngineFor, needsCoTenantMode, pinModeOf, healDecision, rawTopologyFor, PIN_FILES, PIN_MODES, GO_LIVE_REQUIRED };

package/scripts/migrate.sh

@@ -218,7 +218,11 @@ apply_migration() {
     MIGRATIONS_APPLIED=$((MIGRATIONS_APPLIED + 1))
     return
   fi
-  if echo "$APPLIED" | grep -q "^${version}$"; then
+  # NO PIPE (task 1004488). Under pipefail, `echo "$APPLIED" | grep -q` fails whenever grep -q
+  # matches and exits before echo has written the whole list (echo dies of SIGPIPE), so an applied
+  # migration read as NOT applied and was re-run: a random handful per deploy on the droplet.
+  # A here-string has no writer to kill. -x whole line, -F literal: a stem is not a pattern.
+  if grep -qxF -- "$version" <<< "$APPLIED"; then
     echo "skip   $version (already applied)"
     MIGRATIONS_ALREADY=$((MIGRATIONS_ALREADY + 1))
     return
@@ -343,7 +347,7 @@ for root in "$CORE_ROOT" "$INSTANCE_ROOT"; do
     mig_dir="${mod_dir}migrations"
     [ -d "$mig_dir" ] || continue
     # Check if this module is enabled
-    if ! echo " $NODE_ENABLED_MODULES " | grep -q " $mod_key "; then
+    if ! grep -qF -- " $mod_key " <<< " $NODE_ENABLED_MODULES "; then
       echo "module $mod_key disabled — skipping ${mig_dir}/*.sql"
       continue
     fi

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.77'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.78'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_sky.mjs

@@ -513,4 +513,81 @@ await test('a ring carries its UAT state in the goal page words, and says it on
   assert.equal((src.match(/esc\(c\.uatLabel\)/g) || []).length, 2, 'the hover card and the panel both print the label, escaped');
 });
 
+// ═══ light mode (task 1004500) ════════════════════════════════════════════════
+
+// The sky follows the hall's theme. Dark is the template's set on the stage;
+// light overrides it, written twice (html[data-theme] once shell.js runs, the
+// media query for first paint) — the pair style.css keeps for its dark tier,
+// and the same drift risk, so the same lockstep.
+const SKY_CSS = FS.readFileSync('modules/hall-ui/public/thinking.css', 'utf8').replace(/\r\n/g, '\n');
+const declLines = (body) => body.split('\n').map((l) => l.trim()).filter(Boolean);
+const declNames = (body) => new Set([...body.matchAll(/(--[\w-]+|color-scheme)\s*:/g)].map((m) => m[1]));
+const skyBlocks = () => {
+  const dark = /^body\[data-page\] \.sky-stage \{\n([\s\S]*?)\n\}/m.exec(SKY_CSS);
+  const light = /^html\[data-theme="light"\] body\[data-page\] \.sky-stage \{\n([\s\S]*?)\n\}/m.exec(SKY_CSS);
+  const twin = /@media \(prefers-color-scheme: light\) \{\n\s*html:not\(\[data-theme\]\) body\[data-page\] \.sky-stage \{\n([\s\S]*?)\n\s*\}\n\}/.exec(SKY_CSS);
+  return { dark: dark && dark[1], light: light && light[1], twin: twin && twin[1] };
+};
+
+await test('LIGHT IS WRITTEN TWICE AND THE TWO ARE ONE — the data-theme block and its first-paint twin declare the same lines', () => {
+  const { dark, light, twin } = skyBlocks();
+  assert.ok(dark, 'the dark (template) token block is found');
+  assert.ok(light, 'the html[data-theme="light"] block is found');
+  assert.ok(twin, 'the prefers-color-scheme: light twin is found');
+  same(declLines(twin), declLines(light), 'the twin is the data-theme block, line for line');
+  assert.ok(declLines(light).length >= 6, 'and the block is not vacuously empty');
+});
+
+await test('light re-declares every colour the dark set declares, and every channel is three bytes', () => {
+  const { dark, light } = skyBlocks();
+  const type = new Set(['--label', '--mono', '--face']); // the faces are not a theme
+  const want = [...declNames(dark)].filter((n) => !type.has(n));
+  assert.ok(want.length >= 15, `the dark set names its colours (${want.length})`);
+  const have = declNames(light);
+  same(want.filter((n) => !have.has(n)), [], 'no dark colour is left for light to inherit');
+  for (const [name, body] of [['dark', dark], ['light', light]]) {
+    const chans = [...body.matchAll(/(--sky-[\w-]+-rgb)\s*:\s*([^;]+);/g)];
+    assert.ok(chans.length >= 5, `${name} declares the canvas's channels`);
+    for (const [, n, v] of chans) {
+      const parts = v.split(',').map((x) => Number(x.trim()));
+      assert.ok(parts.length === 3 && parts.every((x) => Number.isInteger(x) && x >= 0 && x <= 255), `${name} ${n} is r,g,b (got "${v}")`);
+    }
+  }
+});
+
+// What the stage's computed style answers in each theme: the two blocks above,
+// read the way the browser would.
+const stageStyles = (body) => Object.fromEntries([...body.matchAll(/(--[\w-]+)\s*:\s*([^;]+);/g)].map((m) => [m[1], m[2].trim()]));
+
+await test('THE CANVAS FOLLOWS THE TOGGLE — a theme flip re-reads the stage and repaints, with no reload', async () => {
+  const { dark, light } = skyBlocks();
+  const styles = stageStyles(dark);
+  const p = await boot({ mine: mine(FIVE()), sky: sky([well()]), versions: versions(), styles });
+  const SKY = p.SKY(); const acc = SKY.ACC;
+  assert.ok(p.themeObservers() >= 1, 'the page watches html[data-theme]');
+  p.frame();
+  same(SKY.INK, [255, 255, 255], 'dark: the ink is the template white');
+  same(SKY.VOID, [0, 0, 0], 'dark: the void is black');
+  same(SKY.tone([255, 238, 222]), [255, 238, 222], 'dark: a thought keeps its temperature');
+
+  Object.assign(styles, stageStyles(light));
+  p.S().dirty = false;
+  p.setTheme('light');
+  assert.equal(!!p.S().dirty, true, 'the flip marks the sky for a redraw');
+  p.frame();
+  same(SKY.INK, stageStyles(light)['--sky-ink-rgb'].split(',').map(Number), 'light: the ink is the stage\'s');
+  same(SKY.VOID, stageStyles(light)['--sky-void-rgb'].split(',').map(Number), 'light: the void is paper');
+  same(SKY.ACC, stageStyles(light)['--sky-accent-rgb'].split(',').map(Number), 'light: the accent darkens');
+  assert.equal(SKY.ACC === acc, true, 'refilled in place, so SKY.ACC is still the object every file holds');
+  const k = Number(stageStyles(light)['--sky-temp']);
+  same(SKY.tone([255, 238, 222]), [255, 238, 222].map((v) => Math.round(v * k)), 'light: a near-white thought darkens to read on paper');
+  assert.equal(SKY.ink(0.5), `rgba(${SKY.INK.join(',')},0.5)`, 'ink() paints in the new ink');
+
+  Object.assign(styles, stageStyles(dark));
+  p.setTheme('dark');
+  p.frame();
+  same(SKY.INK, [255, 255, 255], 'and back: the white returns');
+  assert.equal(SKY.ink(0.5), 'rgba(255,255,255,0.5)', 'ink() forgot the light strings');
+});
+
 summary();

package/tests/helpers.mjs

@@ -518,9 +518,17 @@ export function shallowCloneReason(root = ROOT) {
 // each caller —  is the /inbox/by-builder/ payload to answer with.
 const PROFILE_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.js'), 'utf8');
 const PROFILE_ROLES_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile-roles.js'), 'utf8');
+// The Activity tabs draw from these two (task 1004435), loaded first as the page does.
+const IDEA_OBJECTS_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/idea-objects.js'), 'utf8');
+const PROFILE_CRAFTS_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile-crafts.js'), 'utf8');
 // Boot the REAL profile.js against a stub DOM + a stub OTBKit that captures each
 // ledger's rowHtml, and return what it rendered plus every request it made.
-export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
+//
+// `roles` is the profile's roles.shown, main first (task 1004435): one Activity
+// tab each. The default leads with the ideator, so the trail is the first tab
+// and a suite that reads it needs no switch; switchCraft('engineer') opens the
+// works and goals, switchCraft('artist') the approved pages.
+export function bootProfilePage({ signedIn = true, trail = [], roles = ['ideator', 'engineer'], artistPages = [] } = {}) {
   const els = new Map();
   const makeEl = () => ({
     dataset: {}, style: {}, textContent: '', hidden: false, _html: '',
@@ -551,12 +559,15 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
           : { status: 401, ok: false, data: null };
       }
       if (/\/builders\/\d+\/profile$/.test(url)) {
-        return { status: 200, ok: true, data: { builder: { id: 95, github_login: 'jaxri', rank: 'metic' }, shipped_count: 4, achievements: [], recent_ships: [] } };
+        return { status: 200, ok: true, data: { builder: { id: 95, github_login: 'jaxri', rank: 'metic' }, shipped_count: 4, achievements: [], recent_ships: [], roles: { main: roles[0], shown: roles } } };
       }
       if (url.includes('/activity?')) {
         const isGoals = url.includes('section=goals');
         return { status: 200, ok: true, data: { rows: isGoals ? [{ id: 7, title: 'A goal', disciplines: ['artist'], task_shipped: 1, task_total: 2 }] : [{ id: 42, title: 'A work', discipline: 'engineer', shipped_at: '2026-08-01T00:00:00Z' }], total: 1 } };
       }
+      if (url.includes('/copy-desk/artists/')) {
+        return { status: 200, ok: true, data: { rows: artistPages, total: artistPages.length } };
+      }
       if (url.includes('/inbox/by-builder/')) {
         return { status: 200, ok: true, data: { ideas: trail, total: trail.length } };
       }
@@ -589,7 +600,7 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
       let current = tabs[0].id;
       tabsOnChange = onChange;
       onChange(current);
-      return { active: () => current, activate(id) { current = id; onChange(id); } };
+      return { active: () => current, activate(id) { current = id; onChange(id); }, setCount() {} };
     },
     shipVisualThumbHtml: () => '',
   };
@@ -616,17 +627,20 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
     location: { hostname: 'builders.cloudbongos.com', search: '', pathname: '/profile' },
     localStorage: { getItem: () => null, setItem() {} },
     addEventListener() {},
+    matchMedia: () => ({ matches: false }),
   };
 
   const sandbox = {
     window: windowObj, document: documentObj, location: windowObj.location,
-    console, setTimeout, clearTimeout, URLSearchParams,
+    console, setTimeout, clearTimeout, URLSearchParams, matchMedia: windowObj.matchMedia,
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
-  // profile.js draws the header from profile-roles.js (task 1004434), which the
-  // page loads first.
+  // profile.js draws the header from profile-roles.js (task 1004434) and the
+  // Activity tabs from profile-crafts.js (task 1004435), which the page loads first.
   vm.runInContext(PROFILE_ROLES_JS, sandbox, { filename: 'profile-roles.js' });
+  vm.runInContext(IDEA_OBJECTS_JS, sandbox, { filename: 'idea-objects.js' });
+  vm.runInContext(PROFILE_CRAFTS_JS, sandbox, { filename: 'profile-crafts.js' });
   vm.runInContext(PROFILE_JS, sandbox, { filename: 'profile.js' });
 
   const htmlFor = (mountId) => {
@@ -789,6 +803,7 @@ export function bootSkyPage({
   mine = null, sky = null, versions = null, me = null, template = undefined,
   viewer = { id: 95, permissions: {} }, status = {}, tourSeen = true, storage = {},
   innerWidth = 1280, innerHeight = 800, reduce = true, page = 'thinking',
+  styles = null,
 } = {}) {
   // ── the DOM ──────────────────────────────────────────────────────────────
   const windowListeners = new Map();
@@ -927,14 +942,22 @@ export function bootSkyPage({
     clearTimeout: (id) => { const i = timers.findIndex((t) => t.id === id); if (i >= 0) timers.splice(i, 1); },
   };
   class Event { constructor(type) { this.type = type; } preventDefault() {} }
+  // The theme seam (task 1004500): `styles` is the stage's computed custom
+  // properties (mutable, so a test can change them before a flip), and every
+  // MutationObserver the page makes is kept so `setTheme` can fire it the way
+  // shell.js writing html[data-theme] would. No `styles` means no
+  // getComputedStyle at all, the sandbox every other case has always run in.
+  const themeObservers = [];
+  class MutationObserver { constructor(fn) { this.fn = fn; } observe(target, opts) { themeObservers.push({ fn: this.fn, target, opts }); } disconnect() {} }
 
   const sandbox = {
     window: windowObj, document: documentObj, location: windowObj.location, localStorage: windowObj.localStorage,
     innerWidth, innerHeight, devicePixelRatio: 1, matchMedia: windowObj.matchMedia, performance: windowObj.performance,
     requestAnimationFrame: windowObj.requestAnimationFrame, addEventListener: windowObj.addEventListener,
     setTimeout: windowObj.setTimeout, clearTimeout: windowObj.clearTimeout,
-    console, Event, URLSearchParams, Math, Number, Date, JSON, Map, Set, Promise, Object, Array, String, Infinity, NaN,
+    MutationObserver, console, Event, URLSearchParams, Math, Number, Date, JSON, Map, Set, Promise, Object, Array, String, Infinity, NaN,
   };
+  if (styles) sandbox.getComputedStyle = (el) => ({ getPropertyValue: (name) => (el && String(el.className || '').split(/\s+/).includes('sky-stage') && name in styles ? styles[name] : '') });
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   for (const [name, src] of SKY_SRC) vm.runInContext(src, sandbox, { filename: name });
@@ -970,6 +993,8 @@ export function bootSkyPage({
     submit: () => { byId('file').fire('submit', new Event('submit')); },
     click: (id) => { const el = byId(id); if (!el) throw new Error(`no element #${id}`); el.fire('click', new Event('click')); },
     frame: () => { if (raf) raf(Date.now()); },
+    setTheme: (t) => { documentObj.documentElement.dataset.theme = t; for (const o of themeObservers) if (o.target === documentObj.documentElement && (!o.opts.attributeFilter || o.opts.attributeFilter.includes('data-theme'))) o.fn([{ type: 'attributes', attributeName: 'data-theme' }]); },
+    themeObservers: () => themeObservers.length,
     ready: () => root.dataset.skyReady === '1',
   };
   return out;

package/tests/migrate_applied_check.mjs

@@ -0,0 +1,94 @@
+// tests/migrate_applied_check.mjs — migrate.sh never re-runs a migration that is already applied
+// (task 1004488).
+//
+// WHAT IS AT RISK. migrate.sh runs under `set -euo pipefail`, and it used to ask "is this stem
+// applied?" with `echo "$APPLIED" | grep -q "^stem$"`. grep -q exits on its first match; if echo
+// has not finished writing the list, echo dies of SIGPIPE, pipefail fails the pipeline, and an
+// applied migration reads as NOT applied. On the droplet that happened to a random handful of the
+// ~300 checks in a run (task 1004388: 091, then 145 + 177, then 037 + 059 — all recorded as
+// applied), so a deploy could silently re-run a data migration against the live database.
+//
+// HOW THIS MAKES A RACE DETERMINISTIC. A stand-in psql answers the "SELECT version FROM
+// schema_migrations" query with every real core stem FIRST, then enough padding to overflow any
+// pipe buffer. echo then blocks on a full pipe while grep -q has already matched and exited, so
+// the old check fails for every stem, every run. The stub records each `-f <file>` it is asked to
+// apply; with every stem recorded as applied, there must be none.
+//
+// Run:  node --test tests/migrate_applied_check.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, readdirSync, existsSync, chmodSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATE = path.join(REPO_ROOT, 'scripts', 'migrate.sh');
+
+// migrate.sh is POSIX bash; the stub psql below is a shell script. Windows CI runs the suite too.
+const skip = process.platform === 'win32' ? 'POSIX shell stub' : false;
+
+const sqlStems = (dir) => (existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith('.sql')).map((f) => f.slice(0, -4)) : []);
+
+// The core stems: the ones the core loop must skip.
+function stems() {
+  return sqlStems(path.join(REPO_ROOT, 'migrations')).sort();
+}
+
+// Every module's stems too, so the module loop that follows finds them applied as well.
+function moduleStems() {
+  const root = path.join(REPO_ROOT, 'modules');
+  return readdirSync(root).flatMap((m) => sqlStems(path.join(root, m, 'migrations'))).sort();
+}
+
+function rig() {
+  const dir = mkdtempSync(path.join(tmpdir(), 'migrate-applied-'));
+  const list = path.join(dir, 'applied.txt');
+  const log = path.join(dir, 'applied-files.log');
+  // Real stems first (so grep -q matches early), then ~400 KB of padding (so echo is still writing).
+  const padding = Array.from({ length: 8000 }, (_, i) => `zz_padding_${String(i).padStart(6, '0')}_not_a_real_migration_stem`);
+  writeFileSync(list, [...stems(), ...moduleStems(), ...padding].join('\n') + '\n');
+  const psql = path.join(dir, 'psql');
+  writeFileSync(psql, [
+    '#!/usr/bin/env bash',
+    '# Stand-in psql: the applied list for the schema_migrations read, a log line for every -f.',
+    'prev=""',
+    'for a in "$@"; do',
+    `  if [ "$prev" = "-f" ]; then echo "$a" >> ${JSON.stringify(log)}; fi`,
+    '  case "$a" in *"SELECT version FROM schema_migrations"*)' + ` cat ${JSON.stringify(list)};; esac`,
+    '  prev="$a"',
+    'done',
+    'exit 0',
+    '',
+  ].join('\n'));
+  chmodSync(psql, 0o755);
+  return { dir, log };
+}
+
+test('a migration recorded as applied is skipped, even when the applied list overflows a pipe buffer', { skip }, () => {
+  const { dir, log } = rig();
+  try {
+    const env = { ...process.env, PATH: `${dir}${path.delimiter}${process.env.PATH}`, PGDATABASE: 'stub_db', DATABASE_URL: '',
+      PGHOST: path.join(dir, 'no-such-socket-dir'), INIT_CWD: REPO_ROOT };
+    // The run goes on past the core loop (modules, gates) and may stop there against a stub; the core
+    // loop's own output is what this test reads, so the exit code is not asserted.
+    const r = spawnSync('bash', [MIGRATE], { cwd: REPO_ROOT, env, encoding: 'utf8', timeout: 120000 });
+    const out = String(r.stdout || '');
+    const skipped = (out.match(/^skip {3}/gm) || []).length;
+    assert.ok(skipped >= stems().length, `expected every core stem skipped, saw ${skipped} of ${stems().length}\n${out.slice(0, 2000)}\n${String(r.stderr || '').slice(-2000)}`);
+    const reapplied = (out.match(/^apply {2}(\S+)/gm) || []).map((l) => l.slice(7));
+    assert.deepEqual(reapplied, [], 'already-applied migrations were re-run: ' + reapplied.join(', '));
+    const files = existsSync(log) ? readFileSync(log, 'utf8').split('\n').filter(Boolean).filter((f) => f.endsWith('.sql')) : [];
+    assert.deepEqual(files, [], 'psql -f was called for an applied migration');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('migrate.sh asks "is it applied?" without a pipe', () => {
+  // The behavioural test above is the proof; this names the shape so a future edit that brings
+  // `echo ... | grep -q` back is refused at the line, not rediscovered on the droplet.
+  const src = readFileSync(MIGRATE, 'utf8').split('\n').filter((l) => !/^\s*#/.test(l)).join('\n');
+  assert.doesNotMatch(src, /echo [^\n|]*\|\s*grep -q/, 'an `echo … | grep -q` pipeline under pipefail can read a match as a miss');
+});

package/tests/npm_release_page.mjs

@@ -181,3 +181,70 @@ test('a task title and a note line are quoted ledger data: their dashes render a
   assert.ok(b.work().innerHTML.includes('>Deploy page, where the work is, phase 1</a>'));
   assert.doesNotMatch(b.work().innerHTML, /Deploy page [—–]/);
 });
+
+// ---- this hall's own upgrades (task 1004297) ----------------------------------------
+
+const withUpgrades = (over) => ({ ...FIXTURE, upgrades: { ok: true, rows: [] }, waiting: null, ...over });
+const upgrade = (o) => ({ from: '1.19.1032', to: '1.19.1033', at: '2026-09-26T00:22:18.000Z', how: 'server', rolled_back: false, reason: null, ...o });
+
+test('the upgrades group lists each move with who made it', async () => {
+  const b = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [
+    upgrade({}), upgrade({ from: '1.19.1030', to: '1.19.1032', how: 'door' }), upgrade({ from: '1.19.1029', to: '1.19.1030', how: 'sweep' }),
+  ] } })));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.match(html, /Upgrades on this hall/);
+  assert.match(html, />1\.19\.1032 → 1\.19\.1033</);
+  assert.match(html, /on the server/);
+  assert.match(html, /Upgrade pressed on \/deploy/);
+  assert.match(html, /the automatic update/);
+  assert.doesNotMatch(html, /was rolled back/, 'no warning when nothing rolled back');
+});
+
+test('a rolled-back upgrade is said plainly, and a rollback as the LAST move is a warning', async () => {
+  const back = upgrade({ from: '1.19.1033', to: '1.19.1034', rolled_back: true, reason: 'health check failed — after restart' });
+  const b = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [back, upgrade({})] } })));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.match(html, />Tried 1\.19\.1033 → 1\.19\.1034</);
+  assert.match(html, /It did not come back healthy \(health check failed, after restart\), so the hall went back to 1\.19\.1033\./, 'the reason is ledger text: its dash renders as a comma');
+  assert.match(html, /<strong>The last upgrade here was rolled back\.<\/strong> 1\.19\.1034 was installed, did not come back healthy, and was undone\./);
+
+  assert.match(html, /This hall will not try it again for a day; the next newer version is installed as soon as it is published\./);
+
+  // The version still waits in the reading, but it is HELD by the sweep: "takes it on its next
+  // update" would be a promise the lane will not keep, so the rollback note speaks alone.
+  const heldBack = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [back] },
+    waiting: { versions: 1, first: '1.19.1034', since: new Date().toISOString(), minutes: 3, stalled: false } })));
+  await heldBack.settle();
+  assert.doesNotMatch(heldBack.work().innerHTML, /takes it on its next automatic update/);
+
+  const older = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [upgrade({ to: '1.19.1035' }), back] } })));
+  await older.settle();
+  assert.doesNotMatch(older.work().innerHTML, /The last upgrade here was rolled back/, 'an old rollback is history, not a warning');
+});
+
+test('a stalled wait warns that the automation may have stopped; a fresh one is one quiet line', async () => {
+  const stalled = bootWork(() => ok(withUpgrades({ waiting: { versions: 3, first: '1.19.1041', since: '2026-09-26T08:00:00.000Z', minutes: 300, stalled: true } })));
+  await stalled.settle();
+  assert.match(stalled.work().innerHTML, /ov-note--warn"><p><strong>The automatic update may have stopped\.<\/strong> 1\.19\.1041 \(and 2 newer\) was published/);
+
+  const fresh = bootWork(() => ok(withUpgrades({ waiting: { versions: 1, first: '1.19.1042', since: new Date(Date.now() - 4 * 60000).toISOString(), minutes: 4, stalled: false } })));
+  await fresh.settle();
+  assert.doesNotMatch(fresh.work().innerHTML, /may have stopped/);
+  assert.match(fresh.work().innerHTML, /1\.19\.1042 was published 4 minutes ago; this hall takes it on its next automatic update\./);
+});
+
+test('an unreadable ledger says so; a page with no ledger reading shows no group at all', async () => {
+  const bad = bootWork(() => ok(withUpgrades({ upgrades: { ok: false, error: 'this hall\'s upgrade ledger could not be read (<b>boom</b>)' } })));
+  await bad.settle();
+  assert.match(bad.work().innerHTML, /this hall&#39;s upgrade ledger could not be read \(&lt;b&gt;boom&lt;\/b&gt;\)\./);
+
+  const none = bootWork(() => ok({ ...FIXTURE, upgrades: null }));
+  await none.settle();
+  assert.doesNotMatch(none.work().innerHTML, /Upgrades on this hall/);
+
+  const empty = bootWork(() => ok(withUpgrades({})));
+  await empty.settle();
+  assert.match(empty.work().innerHTML, /No upgrade is recorded on this hall yet\./);
+});

package/tests/npm_release_work.mjs

@@ -263,3 +263,85 @@ test('the handler passes the query through and answers 500 plainly when the read
   assert.equal(status, 500);
   assert.equal(err.error.code, 'work_read_failed');
 });
+
+// ---- this hall's own upgrades (task 1004297) --------------------------------------------
+
+// The fixture pool refuses any query it was not written for; these cases answer the ledger
+// read on top of it, so every earlier query is still held to the same strictness.
+function withLedger(pool, answer) {
+  const inner = pool.query.bind(pool);
+  pool.query = async (sql, params) => {
+    if (/FROM core_upgrades/.test(sql)) {
+      pool.queries.push({ sql, params });
+      if (answer instanceof Error) throw answer;
+      return { rows: answer };
+    }
+    return inner(sql, params);
+  };
+  return pool;
+}
+
+test('the upgrade ledger is read newest first, bounded, and each move says who made it', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, [
+    { from_version: '1.0.2', to_version: '1.0.3', applied_at: '2026-09-26T12:00:00Z', source: 'shell', note: null },
+    { from_version: '1.0.1', to_version: '1.0.2', applied_at: '2026-09-25T12:00:00Z', source: 'owner-control', note: null },
+    { from_version: '1.0.1', to_version: '1.0.2', applied_at: '2026-09-25T11:00:00Z', source: null, note: 'auto-subscription (patch)' },
+  ]);
+  const d = await read();
+  assert.equal(d.upgrades.ok, true);
+  assert.deepEqual(d.upgrades.rows.map((r) => [r.from, r.to, r.how, r.rolled_back]), [
+    ['1.0.2', '1.0.3', 'server', false],
+    ['1.0.1', '1.0.2', 'door', false],
+    ['1.0.1', '1.0.2', 'sweep', false],
+  ]);
+  assert.equal(d.upgrades.rows[0].at, '2026-09-26T12:00:00.000Z');
+  const q = pool.queries.find((x) => /FROM core_upgrades/.test(x.sql));
+  assert.match(q.sql, /ORDER BY applied_at DESC, id DESC/);
+  assert.match(q.sql, /LIMIT \$1/);
+  assert.equal(q.params[0], 8);
+});
+
+test('a rolled-back upgrade is flagged, with its reason and without the bookkeeping', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, [{ from_version: '1.0.3', to_version: '1.0.4', applied_at: '2026-09-26T12:30:00Z', source: 'shell',
+    note: 'rolled_back: health check failed after restart (attempted 1.0.3 → 1.0.4, restored 1.0.3)' }]);
+  const r = (await read()).upgrades.rows[0];
+  assert.equal(r.rolled_back, true);
+  assert.equal(r.reason, 'health check failed after restart');
+  assert.equal(r.to, '1.0.4');
+});
+
+test('a ledger that cannot be read is reported as unreadable, never as "no upgrades"', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, new Error('relation "core_upgrades" does not exist'));
+  const d = await read();
+  assert.equal(d.upgrades.ok, false);
+  assert.match(d.upgrades.error, /upgrade ledger could not be read \(relation "core_upgrades" does not exist\)/);
+  assert.ok(d.stages, 'and the rest of the page still reads');
+});
+
+test('a published version waiting past the alarm says the automation may have stopped', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, []);
+  const d = await read();   // runs 1.0.3; 1.0.4 was published 2026-09-25T10:00Z, 27 hours before `now`
+  assert.deepEqual(d.waiting, { versions: 2, first: '1.0.4', since: TIMES['1.0.4'], minutes: 27 * 60, stalled: true });
+
+  const fresh = await read({ now: () => Date.parse(TIMES['1.0.4']) + 10 * 60000 });
+  assert.equal(fresh.waiting.stalled, false, 'ten minutes is the system working, not stopped');
+  assert.equal(fresh.waiting.minutes, 10);
+
+  const current = await read({ live: '1.0.5' });
+  assert.equal(current.waiting, null, 'nothing newer: nothing waiting');
+});
+
+test('another package has no "this hall" upgrades to show', async () => {
+  const { pool } = setup();
+  withLedger(pool, []);
+  const fg = fakeHttpsGet({ [`${ORIGIN}/other-pkg`]: { body: npmPackument({ versions: ['1.0.0'], latest: '1.0.0', times: {}, pkg: 'other-pkg' }) },
+    [`${ORIGIN}/other-pkg/-/other-pkg-1.0.0.tgz`]: { body: npmTarball({ notes: { '1.0.0': [] }, pkg: 'other-pkg' }) } });
+  const d = await readWork({ pool, pkg: 'other-pkg', get: fg.get, store: freshStore(), now: () => Date.parse('2026-09-26T13:00:00Z') });
+  assert.equal(d.upgrades, null);
+  assert.equal(d.waiting, null);
+  assert.ok(!pool.queries.some((x) => /FROM core_upgrades/.test(x.sql)), 'and the ledger is not read at all');
+});