@bongos/core 1.20.77 → 1.20.79

package/scripts/gds/update-channel.js

@@ -17,6 +17,16 @@
 // A MAJOR bump is NEVER automatic under any channel — a major is a breaking change that wants a human.
 // Prereleases (1.17.2-rc.1) are never auto-target either — only stable releases.
 //
+// A second, independent axis says WHICH published versions an instance may take at all (task 1004297,
+// ADR 0360) — its FOLLOW:
+//   released   — only versions at or below the one the registry labels `latest`, i.e. what the owner
+//                has released to other projects. DEFAULT, for every project.
+//   candidates — every published version, the moment it is published. The platform's own hall, and
+//                only it: Bongos runs each version before anyone else is offered it.
+// The channel bounds how FAR a jump may go; the follow bounds which versions exist to jump to. Until
+// candidates publish under their own label (task 1004298), `latest` is the newest version and the two
+// follows pick the same target — the axis exists first so that the split changes nothing for Bongos.
+//
 // WHY the registry as the source (not vendored tarballs): a subscription needs a LIVE source of
 // truth for "what's the newest published core?" — that's `npm view @bongos/core versions` against the
 // private registry (ADR 0134, task 2090). The vendored path is for a one-off manual bump.
@@ -28,6 +38,10 @@ const { spawnSync } = require('node:child_process');
 const CORE_PKG = '@bongos/core';
 const VALID_CHANNELS = ['pinned', 'patch', 'minor'];
 const DEFAULT_CHANNEL = 'patch';
+const VALID_FOLLOWS = ['released', 'candidates'];
+// Unknown or absent reads as `released`: the follow that takes FEWER versions is the safe default,
+// the way an unknown channel reads as `patch` rather than `minor`.
+const DEFAULT_FOLLOW = 'released';
 const NPM_VIEW_TIMEOUT_MS = 30000;
 // The subscription manifest an operator edits to opt instances in. Ships EMPTY (instances: []) in the
 // core template — a fresh instance subscribes nothing until the operator lists a target here.
@@ -109,6 +123,22 @@ function normalizeChannel(channel) {
   return VALID_CHANNELS.includes(c) ? c : DEFAULT_CHANNEL;
 }
 
+function normalizeFollow(follow) {
+  const f = String(follow == null ? '' : follow).trim().toLowerCase();
+  return VALID_FOLLOWS.includes(f) ? f : DEFAULT_FOLLOW;
+}
+
+// The published versions an instance's FOLLOW admits (task 1004297). PURE. `candidates` admits every
+// one; `released` admits those at or below `released` — the version the registry labels `latest` —
+// and NOTHING when that label is unknown: an instance that follows releases must never take a version
+// because nobody could say whether it was released. Feed the result to resolveChannelTarget.
+function versionsForFollow({ follow, available, released } = {}) {
+  const list = Array.isArray(available) ? available.filter((v) => typeof v === 'string') : [];
+  if (normalizeFollow(follow) === 'candidates') return list;
+  if (!parseSemver(released)) return [];
+  return list.filter((v) => compareSemver(v, released) <= 0);
+}
+
 // Would `channel` permit an unattended jump from `installed` to `candidate`? True only when candidate
 // is a STABLE release strictly newer than installed AND within the channel's blast radius. Any invalid
 // input, an unknown installed version, a prerelease candidate, or a major bump ⇒ false (fail-closed).
@@ -174,6 +204,34 @@ function parseNpmViewVersions(stdout) {
   return { ok: false, error: 'unexpected npm view shape', versions: [] };
 }
 
+// Which version is RELEASED — the one the registry labels `latest` (task 1004297) — via
+// `npm view … dist-tags --json`. A separate read from listAvailableVersions on purpose: that one's
+// output shape is relied on by the deploy door and `bongos upgrade`, and it stays exactly as it is.
+// Fail-SOFT like its sibling: { ok:false, error } on any failure, never a throw. `released` is null
+// unless the label names a stable version.
+function readReleaseTags({ cwd = process.cwd(), pkg = CORE_PKG, run = spawnSync, env = process.env, timeoutMs = NPM_VIEW_TIMEOUT_MS } = {}) {
+  let res;
+  try {
+    res = run('npm', ['view', pkg, 'dist-tags', '--json'], { cwd, env, encoding: 'utf8', timeout: timeoutMs });
+  } catch (e) {
+    return { ok: false, error: e && e.message ? e.message : String(e), released: null, tags: {} };
+  }
+  if (!res || res.status !== 0) {
+    const reason = (res && (res.stderr || res.error && res.error.message)) || `exit ${res && res.status}`;
+    return { ok: false, error: String(reason).trim().split('\n')[0] || 'npm view failed', released: null, tags: {} };
+  }
+  let tags;
+  try { tags = JSON.parse(String(res.stdout || '').trim() || '{}'); } catch (e) {
+    return { ok: false, error: `unparseable npm output: ${e.message}`, released: null, tags: {} };
+  }
+  if (!tags || typeof tags !== 'object' || Array.isArray(tags)) return { ok: false, error: 'unexpected npm view shape', released: null, tags: {} };
+  const latest = typeof tags.latest === 'string' ? tags.latest : null;
+  const released = latest && isStable(latest) ? latest : null;
+  return released
+    ? { ok: true, released, tags }
+    : { ok: false, error: 'the registry names no released (latest) version', released: null, tags };
+}
+
 // ---- subscription manifest --------------------------------------------------
 
 // Read + normalize config/update-subscriptions.json — the operator-edited opt-in list of instances
@@ -191,6 +249,7 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
   let json;
   try { json = JSON.parse(raw); } catch (e) { return { defaultChannel: DEFAULT_CHANNEL, instances: [], source: abs, present: true, dropped: 0, error: `malformed JSON: ${e.message}`, reason: ROSTER_MALFORMED }; }
   const defaultChannel = normalizeChannel(json.defaultChannel);
+  const defaultFollow = normalizeFollow(json.defaultFollow);
   const rows = Array.isArray(json.instances) ? json.instances : [];
   // An entry without a dir can't be upgraded — drop it, but COUNT the drops. Silently discarding an
   // operator's malformed row is how an instance believes it is enrolled while nothing ever touches it.
@@ -203,6 +262,9 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
       service: r.service ? String(r.service) : null,
       healthUrl: r.healthUrl ? String(r.healthUrl) : null,
       channel: normalizeChannel(r.channel == null ? defaultChannel : r.channel),
+      // Which versions this instance takes at all (task 1004297): `released` unless the operator
+      // says `candidates` — which only the platform's own hall should.
+      follow: normalizeFollow(r.follow == null ? defaultFollow : r.follow),
       // Deploy topology (task 1003219). Optional, and only meaningful together: with
       // versionUrl + deployTimer present the sweep can hand the bump to go-live.js and
       // inherit its backup, pull-deploy-timer guard and INDEPENDENT box-side version
@@ -223,7 +285,7 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
         : {},
     }));
   return {
-    defaultChannel, instances, source: abs, present: true, dropped,
+    defaultChannel, defaultFollow, instances, source: abs, present: true, dropped,
     reason: instances.length ? ROSTER_OK : ROSTER_EMPTY,
   };
 }
@@ -396,6 +458,11 @@ module.exports = {
   CORE_PKG,
   VALID_CHANNELS,
   DEFAULT_CHANNEL,
+  VALID_FOLLOWS,
+  DEFAULT_FOLLOW,
+  normalizeFollow,
+  versionsForFollow,
+  readReleaseTags,
   SUBSCRIPTIONS_REL,
   parseSemver,
   isStable,

package/scripts/gds/update-sweep.js

@@ -51,6 +51,13 @@
 // instance's OWN core says this upgrade rewrites (laneGeneratedPaths). Anything outside that set is
 // still a human's, and still stops us.
 //
+// ── WHICH VERSIONS AN INSTANCE TAKES AT ALL (task 1004297, ADR 0360) ───────────────────────────────
+// Each roster entry has a FOLLOW beside its channel. `released` (the default) takes only versions at
+// or below the registry's `latest` label — what the owner has released to other projects; the
+// platform's own hall is set to `candidates` and takes every version as soon as it is published, so
+// Bongos runs each one before anyone else is offered it. An instance that follows releases and whose
+// released label cannot be read is SKIPPED, never upgraded on a guess.
+//
 // Usage:
 //   node scripts/gds/update-sweep.js            # dry-run (plan only)
 //   node scripts/gds/update-sweep.js --apply    # actually upgrade
@@ -472,6 +479,83 @@ function preflightFlagsFor(pinMode) {
 
 // ── the sweep ────────────────────────────────────────────────────────────────────────────────────
 
+// ── A VERSION THAT FAILED HERE IS NOT RETRIED EVERY SWEEP (task 1004297, ADR 0360 D4) ─────────────
+// At a daily cadence a version that failed its health check was retried once a day. At the 15-minute
+// cadence the platform now runs, the same version would be installed, fail, restart the service and
+// roll back every quarter of an hour until something newer was published — an outage generator. So a
+// version whose upgrade failed here is HELD for a day for that instance: the sweep skips it and says
+// so, and any NEWER version is taken at once (it is the fix). The hold expires so a transient failure
+// (a registry blip, a full disk since cleared) is retried rather than refused forever.
+//
+// The record lives in the sweep's own config home, never in an instance's tree: a file written there
+// would be "a human's work" to pinState and wedge the lane it exists to protect.
+const REFUSAL_HOLD_MS = 24 * 60 * 60 * 1000;
+const REFUSALS_FILE = 'core-update-refused.json';
+
+function refusalsPath() {
+  try { return path.join(require('../../src/instance-config.js').configHome(), REFUSALS_FILE); } catch { return null; }
+}
+
+function readRefusals(file, readFile = fs.readFileSync) {
+  if (!file) return {};
+  try {
+    const j = JSON.parse(readFile(file, 'utf8'));
+    return j && typeof j === 'object' && !Array.isArray(j) ? j : {};
+  } catch { return {}; }
+}
+
+// The versions held for `slug` at `now`: a Map version → { at, reason }, only those still inside
+// the hold. PURE.
+function heldVersions(refusals, slug, now) {
+  const out = new Map();
+  const rows = refusals && Array.isArray(refusals[slug]) ? refusals[slug] : [];
+  for (const r of rows) {
+    const at = r && Date.parse(r.at);
+    if (r && typeof r.version === 'string' && Number.isFinite(at) && now - at < REFUSAL_HOLD_MS) out.set(r.version, { at: r.at, reason: r.reason || null });
+  }
+  return out;
+}
+
+// Record that `version` failed on `slug`. Keeps only rows still inside the hold, so the file cannot
+// grow without bound. Best-effort: a record that cannot be written costs one retry, never the sweep.
+function recordRefusal({ file, slug, version, reason, now = Date.now(), readFile = fs.readFileSync, writeFile = fs.writeFileSync, mkdir = fs.mkdirSync } = {}) {
+  if (!file || !slug || !version) return false;
+  try {
+    const all = readRefusals(file, readFile);
+    const keep = [...heldVersions(all, slug, now)].filter(([v]) => v !== version).map(([v, x]) => ({ version: v, at: x.at, reason: x.reason }));
+    all[slug] = [...keep, { version, at: new Date(now).toISOString(), reason: reason || null }];
+    mkdir(path.dirname(file), { recursive: true });
+    writeFile(file, JSON.stringify(all, null, 2) + '\n');
+    return true;
+  } catch { return false; }
+}
+
+// What this instance should move to, and under which follow (task 1004297, ADR 0360). The channel
+// bounds how far a jump may go; the follow bounds which published versions exist to jump to at all.
+//
+// `inst.follow` is absent only when the core this sweep resolved predates the axis. That core also
+// predates any split between candidates and releases, so every published version IS a release and
+// the old reading — all of them — is the right one. With the axis present, `released` asks the
+// registry which version carries the `latest` label and SKIPS the instance when it cannot say: an
+// instance that follows releases is never upgraded on a guess.
+//
+// Returns { follow, target } (target null = up to date) or { follow, skip: '<why>' }.
+function followTarget({ inst, installed, channel, versions, env, held = new Map() }) {
+  const follow = inst.follow || 'candidates';
+  let admitted = versions;
+  if (follow === 'released' && typeof channel.readReleaseTags === 'function') {
+    const tags = channel.readReleaseTags({ cwd: inst.dir, env });
+    if (!tags.ok) return { follow, skip: `could not read which version is released (${tags.error})` };
+    admitted = channel.versionsForFollow({ follow, available: admitted, released: tags.released });
+  }
+  const pick = (list) => channel.resolveChannelTarget({ installed, channel: inst.channel, available: list }) || null;
+  const target = pick(admitted.filter((v) => !held.has(v)));
+  // A hold is named only when it is what changed the answer: the version this instance would have
+  // taken without it.
+  const unheld = pick(admitted);
+  return { follow, target, held: unheld && unheld !== target && held.has(unheld) ? { version: unheld, ...held.get(unheld) } : null };
+}
+
 // `instanceRoot` is the default roster root when no --instance is given: the subscribe.js shim passes
 // its own instance root; run directly, it is the working directory.
 function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
@@ -503,6 +587,8 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
   if (only && roster.length === 0) console.error(`  ! --only ${only} matched no subscribed instance`);
 
   let upgraded = 0, skipped = 0, failed = 0, upToDate = 0, healed = 0;
+  const refusalsFile = refusalsPath();
+  const refusals = readRefusals(refusalsFile);
 
   for (const inst of roster) {
     const label = inst.slug;
@@ -574,8 +660,12 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
     const listed = channel.listAvailableVersions({ cwd: inst.dir, env: { ...process.env, ...inst.env } });
     if (!listed.ok) { console.error(`  ! ${label}: could not list registry versions (${listed.error}) — skipped`); skipped++; continue; }
 
-    const target = channel.resolveChannelTarget({ installed, channel: inst.channel, available: listed.versions });
-    if (!target) { console.log(`  ✓ ${label}: up to date on ${installed} (channel: ${inst.channel})`); upToDate++; continue; }
+    const aim = followTarget({ inst, installed, channel, versions: listed.versions, env: { ...process.env, ...inst.env }, held: heldVersions(refusals, label, Date.now()) });
+    if (aim.skip) { console.error(`  ! ${label}: ${aim.skip} — skipped`); skipped++; continue; }
+    if (aim.held) console.log(`  • ${label}: ${aim.held.version} failed here at ${aim.held.at} — held for a day, or until a newer version is published`);
+    const target = aim.target;
+    const pace = `channel: ${inst.channel}, follows: ${aim.follow}`;
+    if (!target) { console.log(`  ✓ ${label}: up to date on ${installed} (${pace})`); upToDate++; continue; }
 
     const { script: upgradeScript, source: scriptSource } = resolveUpgradeScript(inst.dir, { fallback: sweepingCoreUpgradeScript });
     if (!upgradeScript) { console.error(`  ! ${label}: no upgrade.js resolvable for this instance — skipped`); skipped++; continue; }
@@ -590,7 +680,7 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
       // promise a policy the real sweep will not use (task 1004122). It read `canCommitPin` alone
       // before, and so said "--commit-pin" for a co-tenant that was never going to get it.
       const dryPinFlags = [...pinFlagsFor({ pinMode, canCommitPin, canPinNoPush }), ...preflightFlagsFor(pinMode)];
-      console.log(`  → ${label}: would upgrade ${installed} → ${target} (channel: ${inst.channel}, registry, via the ${scriptSource} core${dryPinFlags.length ? `, ${dryPinFlags.join(' ')}` : ''})`);
+      console.log(`  → ${label}: would upgrade ${installed} → ${target} (${pace}, registry, via the ${scriptSource} core${dryPinFlags.length ? `, ${dryPinFlags.join(' ')}` : ''})`);
       console.log(`      engine: ${dryEngine}`);
       continue;
     }
@@ -656,6 +746,12 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
 
     if (res.status !== 0) {
       console.error(`  ✖ ${label}: upgrade to ${target} exited ${res.status == null ? '(signal)' : res.status} — see output above (auto-rollback runs on install/migrate/health failure)`);
+      // Hold the version unless it actually went in (a failure AFTER a good install, such as an
+      // unpushed pin, is not the version's fault and must not stop it being retried).
+      if (readInstalledCoreVersion(inst.dir) !== target) {
+        const held = recordRefusal({ file: refusalsFile, slug: label, version: target, reason: `exit ${res.status == null ? 'signal' : res.status}` });
+        console.error(`      ${held ? `${target} is held for this instance for a day; a newer version is still taken at once.` : 'could not record the hold — the next sweep will try this version again.'}`);
+      }
       // A rollback restores the OLD pin, which can itself leave the tree dirty. Tidy it so one bad
       // patch does not wedge every future sweep.
       const after = pinState(inst.dir, spawnSync, generatedAfter);
@@ -714,4 +810,4 @@ if (require.main === module) {
   catch (e) { console.error(`core-update-subscription: fatal — ${e && e.message ? e.message : e}`); process.exit(1); }
 }
 
-module.exports = { main, coreModulePathFrom, CORE_PKG_NAMES, pinState, laneGeneratedPaths, commitPin, preflightFlagsFor, resolveUpgradeScript, supportsCommitPin, supportsPinNoPush, pinFlagsFor, goLiveTargetFor, resolveGoLive, goLiveEngineFor, needsCoTenantMode, pinModeOf, healDecision, rawTopologyFor, PIN_FILES, PIN_MODES, GO_LIVE_REQUIRED };
+module.exports = { main, followTarget, heldVersions, recordRefusal, readRefusals, REFUSAL_HOLD_MS, coreModulePathFrom, CORE_PKG_NAMES, pinState, laneGeneratedPaths, commitPin, preflightFlagsFor, resolveUpgradeScript, supportsCommitPin, supportsPinNoPush, pinFlagsFor, goLiveTargetFor, resolveGoLive, goLiveEngineFor, needsCoTenantMode, pinModeOf, healDecision, rawTopologyFor, PIN_FILES, PIN_MODES, GO_LIVE_REQUIRED };

package/scripts/migrate.sh

@@ -218,7 +218,11 @@ apply_migration() {
     MIGRATIONS_APPLIED=$((MIGRATIONS_APPLIED + 1))
     return
   fi
-  if echo "$APPLIED" | grep -q "^${version}$"; then
+  # NO PIPE (task 1004488). Under pipefail, `echo "$APPLIED" | grep -q` fails whenever grep -q
+  # matches and exits before echo has written the whole list (echo dies of SIGPIPE), so an applied
+  # migration read as NOT applied and was re-run: a random handful per deploy on the droplet.
+  # A here-string has no writer to kill. -x whole line, -F literal: a stem is not a pattern.
+  if grep -qxF -- "$version" <<< "$APPLIED"; then
     echo "skip   $version (already applied)"
     MIGRATIONS_ALREADY=$((MIGRATIONS_ALREADY + 1))
     return
@@ -343,7 +347,7 @@ for root in "$CORE_ROOT" "$INSTANCE_ROOT"; do
     mig_dir="${mod_dir}migrations"
     [ -d "$mig_dir" ] || continue
     # Check if this module is enabled
-    if ! echo " $NODE_ENABLED_MODULES " | grep -q " $mod_key "; then
+    if ! grep -qF -- " $mod_key " <<< " $NODE_ENABLED_MODULES "; then
       echo "module $mod_key disabled — skipping ${mig_dir}/*.sql"
       continue
     fi

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.77'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.79'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_sky.mjs

@@ -513,4 +513,81 @@ await test('a ring carries its UAT state in the goal page words, and says it on
   assert.equal((src.match(/esc\(c\.uatLabel\)/g) || []).length, 2, 'the hover card and the panel both print the label, escaped');
 });
 
+// ═══ light mode (task 1004500) ════════════════════════════════════════════════
+
+// The sky follows the hall's theme. Dark is the template's set on the stage;
+// light overrides it, written twice (html[data-theme] once shell.js runs, the
+// media query for first paint) — the pair style.css keeps for its dark tier,
+// and the same drift risk, so the same lockstep.
+const SKY_CSS = FS.readFileSync('modules/hall-ui/public/thinking.css', 'utf8').replace(/\r\n/g, '\n');
+const declLines = (body) => body.split('\n').map((l) => l.trim()).filter(Boolean);
+const declNames = (body) => new Set([...body.matchAll(/(--[\w-]+|color-scheme)\s*:/g)].map((m) => m[1]));
+const skyBlocks = () => {
+  const dark = /^body\[data-page\] \.sky-stage \{\n([\s\S]*?)\n\}/m.exec(SKY_CSS);
+  const light = /^html\[data-theme="light"\] body\[data-page\] \.sky-stage \{\n([\s\S]*?)\n\}/m.exec(SKY_CSS);
+  const twin = /@media \(prefers-color-scheme: light\) \{\n\s*html:not\(\[data-theme\]\) body\[data-page\] \.sky-stage \{\n([\s\S]*?)\n\s*\}\n\}/.exec(SKY_CSS);
+  return { dark: dark && dark[1], light: light && light[1], twin: twin && twin[1] };
+};
+
+await test('LIGHT IS WRITTEN TWICE AND THE TWO ARE ONE — the data-theme block and its first-paint twin declare the same lines', () => {
+  const { dark, light, twin } = skyBlocks();
+  assert.ok(dark, 'the dark (template) token block is found');
+  assert.ok(light, 'the html[data-theme="light"] block is found');
+  assert.ok(twin, 'the prefers-color-scheme: light twin is found');
+  same(declLines(twin), declLines(light), 'the twin is the data-theme block, line for line');
+  assert.ok(declLines(light).length >= 6, 'and the block is not vacuously empty');
+});
+
+await test('light re-declares every colour the dark set declares, and every channel is three bytes', () => {
+  const { dark, light } = skyBlocks();
+  const type = new Set(['--label', '--mono', '--face']); // the faces are not a theme
+  const want = [...declNames(dark)].filter((n) => !type.has(n));
+  assert.ok(want.length >= 15, `the dark set names its colours (${want.length})`);
+  const have = declNames(light);
+  same(want.filter((n) => !have.has(n)), [], 'no dark colour is left for light to inherit');
+  for (const [name, body] of [['dark', dark], ['light', light]]) {
+    const chans = [...body.matchAll(/(--sky-[\w-]+-rgb)\s*:\s*([^;]+);/g)];
+    assert.ok(chans.length >= 5, `${name} declares the canvas's channels`);
+    for (const [, n, v] of chans) {
+      const parts = v.split(',').map((x) => Number(x.trim()));
+      assert.ok(parts.length === 3 && parts.every((x) => Number.isInteger(x) && x >= 0 && x <= 255), `${name} ${n} is r,g,b (got "${v}")`);
+    }
+  }
+});
+
+// What the stage's computed style answers in each theme: the two blocks above,
+// read the way the browser would.
+const stageStyles = (body) => Object.fromEntries([...body.matchAll(/(--[\w-]+)\s*:\s*([^;]+);/g)].map((m) => [m[1], m[2].trim()]));
+
+await test('THE CANVAS FOLLOWS THE TOGGLE — a theme flip re-reads the stage and repaints, with no reload', async () => {
+  const { dark, light } = skyBlocks();
+  const styles = stageStyles(dark);
+  const p = await boot({ mine: mine(FIVE()), sky: sky([well()]), versions: versions(), styles });
+  const SKY = p.SKY(); const acc = SKY.ACC;
+  assert.ok(p.themeObservers() >= 1, 'the page watches html[data-theme]');
+  p.frame();
+  same(SKY.INK, [255, 255, 255], 'dark: the ink is the template white');
+  same(SKY.VOID, [0, 0, 0], 'dark: the void is black');
+  same(SKY.tone([255, 238, 222]), [255, 238, 222], 'dark: a thought keeps its temperature');
+
+  Object.assign(styles, stageStyles(light));
+  p.S().dirty = false;
+  p.setTheme('light');
+  assert.equal(!!p.S().dirty, true, 'the flip marks the sky for a redraw');
+  p.frame();
+  same(SKY.INK, stageStyles(light)['--sky-ink-rgb'].split(',').map(Number), 'light: the ink is the stage\'s');
+  same(SKY.VOID, stageStyles(light)['--sky-void-rgb'].split(',').map(Number), 'light: the void is paper');
+  same(SKY.ACC, stageStyles(light)['--sky-accent-rgb'].split(',').map(Number), 'light: the accent darkens');
+  assert.equal(SKY.ACC === acc, true, 'refilled in place, so SKY.ACC is still the object every file holds');
+  const k = Number(stageStyles(light)['--sky-temp']);
+  same(SKY.tone([255, 238, 222]), [255, 238, 222].map((v) => Math.round(v * k)), 'light: a near-white thought darkens to read on paper');
+  assert.equal(SKY.ink(0.5), `rgba(${SKY.INK.join(',')},0.5)`, 'ink() paints in the new ink');
+
+  Object.assign(styles, stageStyles(dark));
+  p.setTheme('dark');
+  p.frame();
+  same(SKY.INK, [255, 255, 255], 'and back: the white returns');
+  assert.equal(SKY.ink(0.5), 'rgba(255,255,255,0.5)', 'ink() forgot the light strings');
+});
+
 summary();

package/tests/helpers.mjs

@@ -518,9 +518,17 @@ export function shallowCloneReason(root = ROOT) {
 // each caller —  is the /inbox/by-builder/ payload to answer with.
 const PROFILE_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile.js'), 'utf8');
 const PROFILE_ROLES_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile-roles.js'), 'utf8');
+// The Activity tabs draw from these two (task 1004435), loaded first as the page does.
+const IDEA_OBJECTS_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/idea-objects.js'), 'utf8');
+const PROFILE_CRAFTS_JS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile-crafts.js'), 'utf8');
 // Boot the REAL profile.js against a stub DOM + a stub OTBKit that captures each
 // ledger's rowHtml, and return what it rendered plus every request it made.
-export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
+//
+// `roles` is the profile's roles.shown, main first (task 1004435): one Activity
+// tab each. The default leads with the ideator, so the trail is the first tab
+// and a suite that reads it needs no switch; switchCraft('engineer') opens the
+// works and goals, switchCraft('artist') the approved pages.
+export function bootProfilePage({ signedIn = true, trail = [], roles = ['ideator', 'engineer'], artistPages = [] } = {}) {
   const els = new Map();
   const makeEl = () => ({
     dataset: {}, style: {}, textContent: '', hidden: false, _html: '',
@@ -551,12 +559,15 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
           : { status: 401, ok: false, data: null };
       }
       if (/\/builders\/\d+\/profile$/.test(url)) {
-        return { status: 200, ok: true, data: { builder: { id: 95, github_login: 'jaxri', rank: 'metic' }, shipped_count: 4, achievements: [], recent_ships: [] } };
+        return { status: 200, ok: true, data: { builder: { id: 95, github_login: 'jaxri', rank: 'metic' }, shipped_count: 4, achievements: [], recent_ships: [], roles: { main: roles[0], shown: roles } } };
       }
       if (url.includes('/activity?')) {
         const isGoals = url.includes('section=goals');
         return { status: 200, ok: true, data: { rows: isGoals ? [{ id: 7, title: 'A goal', disciplines: ['artist'], task_shipped: 1, task_total: 2 }] : [{ id: 42, title: 'A work', discipline: 'engineer', shipped_at: '2026-08-01T00:00:00Z' }], total: 1 } };
       }
+      if (url.includes('/copy-desk/artists/')) {
+        return { status: 200, ok: true, data: { rows: artistPages, total: artistPages.length } };
+      }
       if (url.includes('/inbox/by-builder/')) {
         return { status: 200, ok: true, data: { ideas: trail, total: trail.length } };
       }
@@ -589,7 +600,7 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
       let current = tabs[0].id;
       tabsOnChange = onChange;
       onChange(current);
-      return { active: () => current, activate(id) { current = id; onChange(id); } };
+      return { active: () => current, activate(id) { current = id; onChange(id); }, setCount() {} };
     },
     shipVisualThumbHtml: () => '',
   };
@@ -616,17 +627,20 @@ export function bootProfilePage({ signedIn = true, trail = [] } = {}) {
     location: { hostname: 'builders.cloudbongos.com', search: '', pathname: '/profile' },
     localStorage: { getItem: () => null, setItem() {} },
     addEventListener() {},
+    matchMedia: () => ({ matches: false }),
   };
 
   const sandbox = {
     window: windowObj, document: documentObj, location: windowObj.location,
-    console, setTimeout, clearTimeout, URLSearchParams,
+    console, setTimeout, clearTimeout, URLSearchParams, matchMedia: windowObj.matchMedia,
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
-  // profile.js draws the header from profile-roles.js (task 1004434), which the
-  // page loads first.
+  // profile.js draws the header from profile-roles.js (task 1004434) and the
+  // Activity tabs from profile-crafts.js (task 1004435), which the page loads first.
   vm.runInContext(PROFILE_ROLES_JS, sandbox, { filename: 'profile-roles.js' });
+  vm.runInContext(IDEA_OBJECTS_JS, sandbox, { filename: 'idea-objects.js' });
+  vm.runInContext(PROFILE_CRAFTS_JS, sandbox, { filename: 'profile-crafts.js' });
   vm.runInContext(PROFILE_JS, sandbox, { filename: 'profile.js' });
 
   const htmlFor = (mountId) => {
@@ -789,6 +803,7 @@ export function bootSkyPage({
   mine = null, sky = null, versions = null, me = null, template = undefined,
   viewer = { id: 95, permissions: {} }, status = {}, tourSeen = true, storage = {},
   innerWidth = 1280, innerHeight = 800, reduce = true, page = 'thinking',
+  styles = null,
 } = {}) {
   // ── the DOM ──────────────────────────────────────────────────────────────
   const windowListeners = new Map();
@@ -927,14 +942,22 @@ export function bootSkyPage({
     clearTimeout: (id) => { const i = timers.findIndex((t) => t.id === id); if (i >= 0) timers.splice(i, 1); },
   };
   class Event { constructor(type) { this.type = type; } preventDefault() {} }
+  // The theme seam (task 1004500): `styles` is the stage's computed custom
+  // properties (mutable, so a test can change them before a flip), and every
+  // MutationObserver the page makes is kept so `setTheme` can fire it the way
+  // shell.js writing html[data-theme] would. No `styles` means no
+  // getComputedStyle at all, the sandbox every other case has always run in.
+  const themeObservers = [];
+  class MutationObserver { constructor(fn) { this.fn = fn; } observe(target, opts) { themeObservers.push({ fn: this.fn, target, opts }); } disconnect() {} }
 
   const sandbox = {
     window: windowObj, document: documentObj, location: windowObj.location, localStorage: windowObj.localStorage,
     innerWidth, innerHeight, devicePixelRatio: 1, matchMedia: windowObj.matchMedia, performance: windowObj.performance,
     requestAnimationFrame: windowObj.requestAnimationFrame, addEventListener: windowObj.addEventListener,
     setTimeout: windowObj.setTimeout, clearTimeout: windowObj.clearTimeout,
-    console, Event, URLSearchParams, Math, Number, Date, JSON, Map, Set, Promise, Object, Array, String, Infinity, NaN,
+    MutationObserver, console, Event, URLSearchParams, Math, Number, Date, JSON, Map, Set, Promise, Object, Array, String, Infinity, NaN,
   };
+  if (styles) sandbox.getComputedStyle = (el) => ({ getPropertyValue: (name) => (el && String(el.className || '').split(/\s+/).includes('sky-stage') && name in styles ? styles[name] : '') });
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   for (const [name, src] of SKY_SRC) vm.runInContext(src, sandbox, { filename: name });
@@ -970,6 +993,8 @@ export function bootSkyPage({
     submit: () => { byId('file').fire('submit', new Event('submit')); },
     click: (id) => { const el = byId(id); if (!el) throw new Error(`no element #${id}`); el.fire('click', new Event('click')); },
     frame: () => { if (raf) raf(Date.now()); },
+    setTheme: (t) => { documentObj.documentElement.dataset.theme = t; for (const o of themeObservers) if (o.target === documentObj.documentElement && (!o.opts.attributeFilter || o.opts.attributeFilter.includes('data-theme'))) o.fn([{ type: 'attributes', attributeName: 'data-theme' }]); },
+    themeObservers: () => themeObservers.length,
     ready: () => root.dataset.skyReady === '1',
   };
   return out;

package/tests/init.mjs

@@ -389,15 +389,18 @@ test('layerPackageJson: no package.json → creates one; second run → present,
 // ---- greenfield installability: package.json minting + writeConfigs (ADR 0108 gap 1/4, task 2053) ----
 // PURE — no fs, no npm. The imperative vendor + `npm install` lockfile step lives in main()
 // and is deliberately NOT unit-tested (keeps real npm out of the suite, per the task).
-test('buildInstancePackageJson: no package.json → mints a private one with the caret core dep + start/migrate scripts', () => {
+test('buildInstancePackageJson: no package.json → mints a private one with the caret core dep + hall/migrate scripts', () => {
   const pkg = init.buildInstancePackageJson(null, { name: 'demo' });
   assert.equal(pkg.name, 'demo');
   assert.equal(pkg.private, true);
   assert.equal(pkg.dependencies[init.CORE_PKG], init.coreDepRange());   // caret when no tarball vendored
-  assert.equal(pkg.scripts.start, init.INSTANCE_START_SCRIPT);
+  assert.equal(pkg.scripts.hall, init.INSTANCE_HALL_SCRIPT);
   assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT);
-  // the start/migrate scripts must target the installed core package so `npm ci` output is runnable
-  assert.match(pkg.scripts.start, /node_modules\/@bongos\/core\/src\/platform-server\.js$/);
+  // `npm start` is left for the project's OWN app (task 1004484): a host like Render reads it
+  // as "how this app starts", and the hall there has no database and times out.
+  assert.equal(pkg.scripts.start, undefined);
+  // the hall/migrate scripts must target the installed core package so `npm ci` output is runnable
+  assert.match(pkg.scripts.hall, /node_modules\/@bongos\/core\/src\/platform-server\.js$/);
   assert.match(pkg.scripts.migrate, /node_modules\/@bongos\/core\/scripts\/migrate\.sh$/);
 });
 
@@ -419,6 +422,18 @@ test('buildInstancePackageJson: preserves existing fields + never clobbers a cus
   assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/bongos-core-1.17.0.tgz'); // dep (re)pinned
 });
 
+test('buildInstancePackageJson: a start that is exactly the old scaffolded hall command moves to "hall" (task 1004484)', () => {
+  const old = 'node node_modules/@bongos/core/src/platform-server.js';
+  const pkg = init.buildInstancePackageJson({ scripts: { start: old, test: 'node --test' } }, { name: 'demo' });
+  assert.equal(pkg.scripts.start, undefined, 'npm start no longer runs the hall');
+  assert.equal(pkg.scripts.hall, old);
+  assert.equal(pkg.scripts.test, 'node --test');
+  // an owner's own "hall" script is never overwritten by the move
+  const kept = init.buildInstancePackageJson({ scripts: { start: old, hall: 'node my-hall.js' } }, { name: 'demo' });
+  assert.equal(kept.scripts.hall, 'node my-hall.js');
+  assert.equal(kept.scripts.start, old, 'with "hall" taken, start is left as the owner has it');
+});
+
 // --- enabled-module dep composition (ADR 0138 / task 2160) --------------------
 
 test('enabledModuleDeps: merges only the ENABLED modules’ declared deps', () => {
@@ -475,7 +490,8 @@ test('writeConfigs (greenfield): mints package.json with the caret core dep + st
     assert.equal(pkg.name, 'cloud-bongos');                  // slugified productName
     assert.equal(pkg.private, true);
     assert.equal(pkg.dependencies[init.CORE_PKG], init.coreDepRange());
-    assert.equal(pkg.scripts.start, init.INSTANCE_START_SCRIPT);
+    assert.equal(pkg.scripts.hall, init.INSTANCE_HALL_SCRIPT);
+    assert.equal(pkg.scripts.start, undefined);
     assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT);
   } finally {
     rmSync(dir, { recursive: true, force: true });