@bongos/core 1.20.77 → 1.20.79

package/tests/migrate_applied_check.mjs

@@ -0,0 +1,94 @@
+// tests/migrate_applied_check.mjs — migrate.sh never re-runs a migration that is already applied
+// (task 1004488).
+//
+// WHAT IS AT RISK. migrate.sh runs under `set -euo pipefail`, and it used to ask "is this stem
+// applied?" with `echo "$APPLIED" | grep -q "^stem$"`. grep -q exits on its first match; if echo
+// has not finished writing the list, echo dies of SIGPIPE, pipefail fails the pipeline, and an
+// applied migration reads as NOT applied. On the droplet that happened to a random handful of the
+// ~300 checks in a run (task 1004388: 091, then 145 + 177, then 037 + 059 — all recorded as
+// applied), so a deploy could silently re-run a data migration against the live database.
+//
+// HOW THIS MAKES A RACE DETERMINISTIC. A stand-in psql answers the "SELECT version FROM
+// schema_migrations" query with every real core stem FIRST, then enough padding to overflow any
+// pipe buffer. echo then blocks on a full pipe while grep -q has already matched and exited, so
+// the old check fails for every stem, every run. The stub records each `-f <file>` it is asked to
+// apply; with every stem recorded as applied, there must be none.
+//
+// Run:  node --test tests/migrate_applied_check.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, readdirSync, existsSync, chmodSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATE = path.join(REPO_ROOT, 'scripts', 'migrate.sh');
+
+// migrate.sh is POSIX bash; the stub psql below is a shell script. Windows CI runs the suite too.
+const skip = process.platform === 'win32' ? 'POSIX shell stub' : false;
+
+const sqlStems = (dir) => (existsSync(dir) ? readdirSync(dir).filter((f) => f.endsWith('.sql')).map((f) => f.slice(0, -4)) : []);
+
+// The core stems: the ones the core loop must skip.
+function stems() {
+  return sqlStems(path.join(REPO_ROOT, 'migrations')).sort();
+}
+
+// Every module's stems too, so the module loop that follows finds them applied as well.
+function moduleStems() {
+  const root = path.join(REPO_ROOT, 'modules');
+  return readdirSync(root).flatMap((m) => sqlStems(path.join(root, m, 'migrations'))).sort();
+}
+
+function rig() {
+  const dir = mkdtempSync(path.join(tmpdir(), 'migrate-applied-'));
+  const list = path.join(dir, 'applied.txt');
+  const log = path.join(dir, 'applied-files.log');
+  // Real stems first (so grep -q matches early), then ~400 KB of padding (so echo is still writing).
+  const padding = Array.from({ length: 8000 }, (_, i) => `zz_padding_${String(i).padStart(6, '0')}_not_a_real_migration_stem`);
+  writeFileSync(list, [...stems(), ...moduleStems(), ...padding].join('\n') + '\n');
+  const psql = path.join(dir, 'psql');
+  writeFileSync(psql, [
+    '#!/usr/bin/env bash',
+    '# Stand-in psql: the applied list for the schema_migrations read, a log line for every -f.',
+    'prev=""',
+    'for a in "$@"; do',
+    `  if [ "$prev" = "-f" ]; then echo "$a" >> ${JSON.stringify(log)}; fi`,
+    '  case "$a" in *"SELECT version FROM schema_migrations"*)' + ` cat ${JSON.stringify(list)};; esac`,
+    '  prev="$a"',
+    'done',
+    'exit 0',
+    '',
+  ].join('\n'));
+  chmodSync(psql, 0o755);
+  return { dir, log };
+}
+
+test('a migration recorded as applied is skipped, even when the applied list overflows a pipe buffer', { skip }, () => {
+  const { dir, log } = rig();
+  try {
+    const env = { ...process.env, PATH: `${dir}${path.delimiter}${process.env.PATH}`, PGDATABASE: 'stub_db', DATABASE_URL: '',
+      PGHOST: path.join(dir, 'no-such-socket-dir'), INIT_CWD: REPO_ROOT };
+    // The run goes on past the core loop (modules, gates) and may stop there against a stub; the core
+    // loop's own output is what this test reads, so the exit code is not asserted.
+    const r = spawnSync('bash', [MIGRATE], { cwd: REPO_ROOT, env, encoding: 'utf8', timeout: 120000 });
+    const out = String(r.stdout || '');
+    const skipped = (out.match(/^skip {3}/gm) || []).length;
+    assert.ok(skipped >= stems().length, `expected every core stem skipped, saw ${skipped} of ${stems().length}\n${out.slice(0, 2000)}\n${String(r.stderr || '').slice(-2000)}`);
+    const reapplied = (out.match(/^apply {2}(\S+)/gm) || []).map((l) => l.slice(7));
+    assert.deepEqual(reapplied, [], 'already-applied migrations were re-run: ' + reapplied.join(', '));
+    const files = existsSync(log) ? readFileSync(log, 'utf8').split('\n').filter(Boolean).filter((f) => f.endsWith('.sql')) : [];
+    assert.deepEqual(files, [], 'psql -f was called for an applied migration');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('migrate.sh asks "is it applied?" without a pipe', () => {
+  // The behavioural test above is the proof; this names the shape so a future edit that brings
+  // `echo ... | grep -q` back is refused at the line, not rediscovered on the droplet.
+  const src = readFileSync(MIGRATE, 'utf8').split('\n').filter((l) => !/^\s*#/.test(l)).join('\n');
+  assert.doesNotMatch(src, /echo [^\n|]*\|\s*grep -q/, 'an `echo … | grep -q` pipeline under pipefail can read a match as a miss');
+});

package/tests/npm_release_page.mjs

@@ -181,3 +181,70 @@ test('a task title and a note line are quoted ledger data: their dashes render a
   assert.ok(b.work().innerHTML.includes('>Deploy page, where the work is, phase 1</a>'));
   assert.doesNotMatch(b.work().innerHTML, /Deploy page [—–]/);
 });
+
+// ---- this hall's own upgrades (task 1004297) ----------------------------------------
+
+const withUpgrades = (over) => ({ ...FIXTURE, upgrades: { ok: true, rows: [] }, waiting: null, ...over });
+const upgrade = (o) => ({ from: '1.19.1032', to: '1.19.1033', at: '2026-09-26T00:22:18.000Z', how: 'server', rolled_back: false, reason: null, ...o });
+
+test('the upgrades group lists each move with who made it', async () => {
+  const b = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [
+    upgrade({}), upgrade({ from: '1.19.1030', to: '1.19.1032', how: 'door' }), upgrade({ from: '1.19.1029', to: '1.19.1030', how: 'sweep' }),
+  ] } })));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.match(html, /Upgrades on this hall/);
+  assert.match(html, />1\.19\.1032 → 1\.19\.1033</);
+  assert.match(html, /on the server/);
+  assert.match(html, /Upgrade pressed on \/deploy/);
+  assert.match(html, /the automatic update/);
+  assert.doesNotMatch(html, /was rolled back/, 'no warning when nothing rolled back');
+});
+
+test('a rolled-back upgrade is said plainly, and a rollback as the LAST move is a warning', async () => {
+  const back = upgrade({ from: '1.19.1033', to: '1.19.1034', rolled_back: true, reason: 'health check failed — after restart' });
+  const b = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [back, upgrade({})] } })));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.match(html, />Tried 1\.19\.1033 → 1\.19\.1034</);
+  assert.match(html, /It did not come back healthy \(health check failed, after restart\), so the hall went back to 1\.19\.1033\./, 'the reason is ledger text: its dash renders as a comma');
+  assert.match(html, /<strong>The last upgrade here was rolled back\.<\/strong> 1\.19\.1034 was installed, did not come back healthy, and was undone\./);
+
+  assert.match(html, /This hall will not try it again for a day; the next newer version is installed as soon as it is published\./);
+
+  // The version still waits in the reading, but it is HELD by the sweep: "takes it on its next
+  // update" would be a promise the lane will not keep, so the rollback note speaks alone.
+  const heldBack = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [back] },
+    waiting: { versions: 1, first: '1.19.1034', since: new Date().toISOString(), minutes: 3, stalled: false } })));
+  await heldBack.settle();
+  assert.doesNotMatch(heldBack.work().innerHTML, /takes it on its next automatic update/);
+
+  const older = bootWork(() => ok(withUpgrades({ upgrades: { ok: true, rows: [upgrade({ to: '1.19.1035' }), back] } })));
+  await older.settle();
+  assert.doesNotMatch(older.work().innerHTML, /The last upgrade here was rolled back/, 'an old rollback is history, not a warning');
+});
+
+test('a stalled wait warns that the automation may have stopped; a fresh one is one quiet line', async () => {
+  const stalled = bootWork(() => ok(withUpgrades({ waiting: { versions: 3, first: '1.19.1041', since: '2026-09-26T08:00:00.000Z', minutes: 300, stalled: true } })));
+  await stalled.settle();
+  assert.match(stalled.work().innerHTML, /ov-note--warn"><p><strong>The automatic update may have stopped\.<\/strong> 1\.19\.1041 \(and 2 newer\) was published/);
+
+  const fresh = bootWork(() => ok(withUpgrades({ waiting: { versions: 1, first: '1.19.1042', since: new Date(Date.now() - 4 * 60000).toISOString(), minutes: 4, stalled: false } })));
+  await fresh.settle();
+  assert.doesNotMatch(fresh.work().innerHTML, /may have stopped/);
+  assert.match(fresh.work().innerHTML, /1\.19\.1042 was published 4 minutes ago; this hall takes it on its next automatic update\./);
+});
+
+test('an unreadable ledger says so; a page with no ledger reading shows no group at all', async () => {
+  const bad = bootWork(() => ok(withUpgrades({ upgrades: { ok: false, error: 'this hall\'s upgrade ledger could not be read (<b>boom</b>)' } })));
+  await bad.settle();
+  assert.match(bad.work().innerHTML, /this hall&#39;s upgrade ledger could not be read \(&lt;b&gt;boom&lt;\/b&gt;\)\./);
+
+  const none = bootWork(() => ok({ ...FIXTURE, upgrades: null }));
+  await none.settle();
+  assert.doesNotMatch(none.work().innerHTML, /Upgrades on this hall/);
+
+  const empty = bootWork(() => ok(withUpgrades({})));
+  await empty.settle();
+  assert.match(empty.work().innerHTML, /No upgrade is recorded on this hall yet\./);
+});

package/tests/npm_release_work.mjs

@@ -263,3 +263,85 @@ test('the handler passes the query through and answers 500 plainly when the read
   assert.equal(status, 500);
   assert.equal(err.error.code, 'work_read_failed');
 });
+
+// ---- this hall's own upgrades (task 1004297) --------------------------------------------
+
+// The fixture pool refuses any query it was not written for; these cases answer the ledger
+// read on top of it, so every earlier query is still held to the same strictness.
+function withLedger(pool, answer) {
+  const inner = pool.query.bind(pool);
+  pool.query = async (sql, params) => {
+    if (/FROM core_upgrades/.test(sql)) {
+      pool.queries.push({ sql, params });
+      if (answer instanceof Error) throw answer;
+      return { rows: answer };
+    }
+    return inner(sql, params);
+  };
+  return pool;
+}
+
+test('the upgrade ledger is read newest first, bounded, and each move says who made it', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, [
+    { from_version: '1.0.2', to_version: '1.0.3', applied_at: '2026-09-26T12:00:00Z', source: 'shell', note: null },
+    { from_version: '1.0.1', to_version: '1.0.2', applied_at: '2026-09-25T12:00:00Z', source: 'owner-control', note: null },
+    { from_version: '1.0.1', to_version: '1.0.2', applied_at: '2026-09-25T11:00:00Z', source: null, note: 'auto-subscription (patch)' },
+  ]);
+  const d = await read();
+  assert.equal(d.upgrades.ok, true);
+  assert.deepEqual(d.upgrades.rows.map((r) => [r.from, r.to, r.how, r.rolled_back]), [
+    ['1.0.2', '1.0.3', 'server', false],
+    ['1.0.1', '1.0.2', 'door', false],
+    ['1.0.1', '1.0.2', 'sweep', false],
+  ]);
+  assert.equal(d.upgrades.rows[0].at, '2026-09-26T12:00:00.000Z');
+  const q = pool.queries.find((x) => /FROM core_upgrades/.test(x.sql));
+  assert.match(q.sql, /ORDER BY applied_at DESC, id DESC/);
+  assert.match(q.sql, /LIMIT \$1/);
+  assert.equal(q.params[0], 8);
+});
+
+test('a rolled-back upgrade is flagged, with its reason and without the bookkeeping', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, [{ from_version: '1.0.3', to_version: '1.0.4', applied_at: '2026-09-26T12:30:00Z', source: 'shell',
+    note: 'rolled_back: health check failed after restart (attempted 1.0.3 → 1.0.4, restored 1.0.3)' }]);
+  const r = (await read()).upgrades.rows[0];
+  assert.equal(r.rolled_back, true);
+  assert.equal(r.reason, 'health check failed after restart');
+  assert.equal(r.to, '1.0.4');
+});
+
+test('a ledger that cannot be read is reported as unreadable, never as "no upgrades"', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, new Error('relation "core_upgrades" does not exist'));
+  const d = await read();
+  assert.equal(d.upgrades.ok, false);
+  assert.match(d.upgrades.error, /upgrade ledger could not be read \(relation "core_upgrades" does not exist\)/);
+  assert.ok(d.stages, 'and the rest of the page still reads');
+});
+
+test('a published version waiting past the alarm says the automation may have stopped', async () => {
+  const { read, pool } = setup();
+  withLedger(pool, []);
+  const d = await read();   // runs 1.0.3; 1.0.4 was published 2026-09-25T10:00Z, 27 hours before `now`
+  assert.deepEqual(d.waiting, { versions: 2, first: '1.0.4', since: TIMES['1.0.4'], minutes: 27 * 60, stalled: true });
+
+  const fresh = await read({ now: () => Date.parse(TIMES['1.0.4']) + 10 * 60000 });
+  assert.equal(fresh.waiting.stalled, false, 'ten minutes is the system working, not stopped');
+  assert.equal(fresh.waiting.minutes, 10);
+
+  const current = await read({ live: '1.0.5' });
+  assert.equal(current.waiting, null, 'nothing newer: nothing waiting');
+});
+
+test('another package has no "this hall" upgrades to show', async () => {
+  const { pool } = setup();
+  withLedger(pool, []);
+  const fg = fakeHttpsGet({ [`${ORIGIN}/other-pkg`]: { body: npmPackument({ versions: ['1.0.0'], latest: '1.0.0', times: {}, pkg: 'other-pkg' }) },
+    [`${ORIGIN}/other-pkg/-/other-pkg-1.0.0.tgz`]: { body: npmTarball({ notes: { '1.0.0': [] }, pkg: 'other-pkg' }) } });
+  const d = await readWork({ pool, pkg: 'other-pkg', get: fg.get, store: freshStore(), now: () => Date.parse('2026-09-26T13:00:00Z') });
+  assert.equal(d.upgrades, null);
+  assert.equal(d.waiting, null);
+  assert.ok(!pool.queries.some((x) => /FROM core_upgrades/.test(x.sql)), 'and the ledger is not read at all');
+});

package/tests/profile_activity.mjs

@@ -468,27 +468,35 @@ await test('the other three outcomes each say what happened', async () => {
   assert.ok(/Still open/.test(html), 'AN OPEN IDEA READS AS OPEN — not as nothing');
 });
 
-await test('switching craft re-asks the SERVER — it does not filter a page in the browser', async () => {
-  const p = bootProfile();
+// Task 1004435 (WA6.RP05): one tab per role the person has, each its craft's
+// own record. The engineer tab is the works and goals, WHOLE (no craft filter:
+// most of the corpus is unclassified); the ideator tab is the trail; the artist
+// tab is the approved pages. No tab is "tasks carrying that label" any more.
+await test('each role tab asks the server for that craft\'s OWN record', async () => {
+  const p = bootProfile({ roles: ['ideator', 'engineer', 'artist'] });
   await settle(); await settle(); await settle();
-  const before = p.requests.length;
+  assert.ok(p.requests.some((u) => u.includes('/inbox/by-builder/')), 'the first tab (the ideator) reads the trail');
+  assert.ok(!p.requests.some((u) => u.includes('section=goals')), 'and no goals ledger until the engineer tab opens');
+  let before = p.requests.length;
+  p.switchCraft('engineer');
+  await settle(); await settle();
+  let after = p.requests.slice(before);
+  assert.ok(after.some((u) => u.includes('section=tasks') && !u.includes('role=')), 'the engineer tab reads the whole works ledger');
+  assert.ok(after.some((u) => u.includes('section=goals') && !u.includes('role=')), 'and the whole goals ledger');
+  before = p.requests.length;
   p.switchCraft('artist');
   await settle(); await settle();
-  const after = p.requests.slice(before);
-  assert.ok(after.some((u) => u.includes('section=tasks') && u.includes('role=artist')), 'tasks are re-fetched for the craft');
-  assert.ok(after.some((u) => u.includes('section=goals') && u.includes('role=artist')), 'goals are re-fetched for the craft');
+  after = p.requests.slice(before);
+  assert.ok(after.some((u) => /\/copy-desk\/artists\/95\/pages\?limit=\d+&offset=0/.test(u)), 'the artist tab reads their approved pages, a few at a time');
+  assert.ok(!after.some((u) => u.includes('role=artist')), 'never "tasks labelled artist"');
 });
 
-await test('the idea trail belongs to the ideator view, not to every craft', async () => {
-  const p = bootProfile();
+await test('a role the person does not have gets no tab and no read', async () => {
+  const p = bootProfile({ roles: ['engineer'] });
   await settle(); await settle(); await settle();
-  assert.equal(p.el('activity-ideas-panel').hidden, false, 'the default "all" view is the whole record, trail included');
-  p.switchCraft('engineer');
-  await settle();
-  assert.equal(p.el('activity-ideas-panel').hidden, true, 'an engineer view is engineer work');
-  p.switchCraft('ideator');
-  await settle();
-  assert.equal(p.el('activity-ideas-panel').hidden, false, 'filing an idea IS ideator work');
+  assert.ok(p.requests.some((u) => u.includes('section=tasks')), 'the only tab is the engineer\'s');
+  assert.ok(!p.requests.some((u) => u.includes('/inbox/by-builder/')), 'no trail read for a person with no ideator role');
+  assert.ok(!p.requests.some((u) => u.includes('/copy-desk/artists/')), 'no pages read for a person with no artist role');
 });
 
 await test('the ledgers page server-side — the request carries a window, not the whole record', async () => {

package/tests/profile_role_headline.mjs

@@ -64,11 +64,11 @@ await test('an artist who never shipped a task leads with pages approved and the
 
 await test('an ideator leads with thoughts, size and what is still alive', () => {
   const v = headline(IDEATOR, OPTS);
-  assert.deepEqual(words(v.tally), ['186 credits', '31 thoughts filed', '7 ignited']);
-  assert.deepEqual(words(v.tiles), ['31 thoughts filed', '7 ignited', '3 Full Ideas', '186~ total size', '72% still alive', '3 karma']);
+  assert.deepEqual(words(v.tally), ['186 credits', '14 thoughts filed', '7 ignited']);
+  assert.deepEqual(words(v.tiles), ['14 thoughts filed', '7 ignited', '3 Full Ideas', '186~ total size', '72% still alive', '3 karma']);
   assert.equal(v.tiles[2].f, '1 ratified by the board');
   assert.match(v.tiles[3].title, /Includes 24 credits of historical estimate/, 'the ~ says what it means');
-  assert.equal(v.sub, 'Builder 9 — Contributor · 31 thoughts filed');
+  assert.equal(v.sub, 'Builder 9 — Contributor · 14 thoughts filed');
 });
 
 await test('several crafts each show, main first, in the server\'s order', () => {
@@ -164,7 +164,7 @@ await test('the real page draws the artist\'s tally, chips, tiles and surface ro
 
 await test('the real page draws the ideator\'s and the engineer\'s own headlines', async () => {
   const i = await boot(IDEATOR);
-  assert.match(text(i.head), /186 credits 31 thoughts filed 7 ignited/);
+  assert.match(text(i.head), /186 credits 14 thoughts filed 7 ignited/);
   assert.match(text(i.nums), /186~ total size/);
   assert.match(text(i.nums), /72% still alive/);
   assert.ok(!i.nums.includes('kit-bars'), 'no surface rows for an ideator');

package/tests/profile_role_tabs.mjs

@@ -0,0 +1,163 @@
+// tests/profile_role_tabs.mjs — the profile's Ideator and Artist tabs show the
+// role's own record (task 1004435 / WA6.RP05, goal 1000095, criterion
+// wa6-roles-read-true-in-public).
+//
+// The done-when: "both tabs match the mock for fixtures, and the old
+// task-labelled lists are gone from those tabs". Run for real, end to end:
+//
+//   1. THE ARTIST'S READ. composeArtistPages over the copy desk's own round
+//      fixture, then the new signed-in route over a stubbed lifecycle port:
+//      only that artist's SHIPPED rounds, newest first, each with its first
+//      changed line; a stranger gets a 401, a bad id a 400.
+//   2. THE IDEATOR'S TRAIL. profile-crafts.js over the harness's ideator fixture
+//      (the mock's fourteen thoughts): one mark per thought, each tied to its
+//      row, the sky's five words, size and brightness as separate channels.
+//   3. THE PAGE. The REAL profile.js in a vm with the artist tab open, fed the
+//      route's own output, so a field the route renames cannot leave this green.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner, bootProfilePage, settle } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+
+const F = require('../modules/copy-desk/tests/fixtures/page-tweak.cjs');
+const pageStatus = require('../modules/copy-desk/page-status.js');
+const { test, summary } = makeRunner();
+
+// ---- 1. the artist's read ---------------------------------------------------
+
+await test('an artist\'s approved pages: only theirs, only shipped, newest first, with the first changed line', () => {
+  const alice = pageStatus.composeArtistPages({ builderId: F.ALICE.id, inventory: F.INVENTORY, tasks: F.TASKS });
+  assert.deepEqual(alice.map((p) => p.task_id), ['201', '101'], 'Sep 20 before Sep 1; Bob\'s round and the abandoned one are not hers');
+  assert.equal(alice[0].page_id, 'builders:studio');
+  assert.equal(alice[0].surface_label, 'Builders hall');
+  assert.equal(alice[0].line_count, 1);
+  assert.deepEqual(alice[0].first, { before: 'Welcome', after: 'Welcome home' });
+  assert.equal(alice[0].approved_at, '2026-09-20T10:00:00.000Z');
+  const bob = pageStatus.composeArtistPages({ builderId: F.BOB.id, inventory: F.INVENTORY, tasks: F.TASKS });
+  assert.deepEqual(bob.map((p) => p.task_id), ['102'], 'his active round is not an approved page');
+  assert.equal(bob[0].line_count, 2);
+  assert.deepEqual(bob[0].first, { before: 'Every projekt', after: 'Every project' }, 'the FIRST changed line');
+});
+
+await test('the route: signed in only, a bad id refused, paged, and it asks for THIS artist\'s rounds', async () => {
+  const api = require('../src/module-api.js');
+  const seams = require('../src/module-seams.js');
+  const pageData = require('../modules/copy-desk/page-data.js');
+  const asked = [];
+  seams._reset();
+  seams.registerProvider('lifecycle', { async listPageTweakTasks(opts) { asked.push(opts); return F.TASKS; } });
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'artist-pages-'));
+  fs.mkdirSync(path.join(tmp, 'docs'), { recursive: true });
+  fs.writeFileSync(path.join(tmp, 'docs', 'page-inventory.json'), JSON.stringify(F.INVENTORY));
+  pageData._setRoot(tmp);
+  let signedIn = true;
+  const realRequire = api.requireBuilder;
+  api.requireBuilder = (req, res, next) => (signedIn ? next() : res.status(401).json({ error: 'unauthorized' }));
+  const express = require('express');
+  const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+  const app = express();
+  app.use(attachFail);
+  app.use(require('../modules/copy-desk/routes/copy-desk-artist.js')());
+  const server = await new Promise((r) => { const s = app.listen(0, '127.0.0.1', () => r(s)); });
+  const get = async (p) => { const r = await fetch(`http://127.0.0.1:${server.address().port}${p}`); return { status: r.status, body: await r.json() }; };
+  try {
+    const all = await get(`/copy-desk/artists/${F.ALICE.id}/pages`);
+    assert.equal(all.status, 200);
+    assert.deepEqual(all.body.rows.map((r) => r.task_id), ['201', '101']);
+    assert.equal(all.body.total, 2);
+    assert.deepEqual(asked.at(-1), { artistId: F.ALICE.id }, 'the read is scoped to the artist, never every round');
+    const page2 = await get(`/copy-desk/artists/${F.ALICE.id}/pages?limit=1&offset=1`);
+    assert.deepEqual(page2.body.rows.map((r) => r.task_id), ['101']);
+    assert.equal(page2.body.total, 2, 'the total is the whole set, not the page');
+    assert.equal((await get('/copy-desk/artists/abc/pages')).status, 400);
+    assert.equal((await get('/copy-desk/artists/0/pages')).status, 400);
+    signedIn = false;
+    assert.equal((await get(`/copy-desk/artists/${F.ALICE.id}/pages`)).status, 401, 'owner decision (a): the pages and their words need a sign-in');
+  } finally {
+    api.requireBuilder = realRequire;
+    pageData._setRoot(null);
+    seams._reset();
+    server.closeAllConnections();
+    await new Promise((r) => server.close(r));
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+// ---- 2. the ideator's trail -------------------------------------------------
+
+function loadCrafts() {
+  const sandbox = { window: {}, console };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  for (const f of ['idea-objects.js', 'profile-crafts.js']) {
+    vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public', f), 'utf8'), sandbox, { filename: f });
+  }
+  return sandbox.window.OTBProfileCrafts;
+}
+const crafts = loadCrafts();
+const TRAIL = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/hall-preview/fixtures/inbox__by-builder__2002.json'), 'utf8')).ideas;
+
+await test('the trail draws every thought once, each mark tied to its ledger row', () => {
+  const svg = crafts.trailSvgHtml(TRAIL, { width: 900 });
+  const ids = [...svg.matchAll(/data-i="(\d+)"/g)].map((m) => Number(m[1]));
+  assert.deepEqual(ids.sort((a, b) => a - b), TRAIL.map((_, i) => i), 'one mark per thought, none missing, none doubled');
+  assert.match(svg, /role="img"/);
+  assert.match(svg, /aria-label="14 thoughts filed, by the day each was filed\. Each is also a row in the table below\."/);
+  assert.ok(!/<(?:path|polyline|rect)\b/.test(svg), 'circles and lines only: series geometry is the kit\'s (hall_audit §6b)');
+  assert.equal((svg.match(/class="pt-tether"/g) || []).length, 2, 'each folded-in thought is tethered to the one it joined');
+  for (const cls of ['pt-star', 'pt-remnant', 'pt-cold', 'pt-ring']) assert.ok(svg.includes(cls), `the ${cls} mark is drawn`);
+});
+
+await test('size and brightness are separate channels', () => {
+  const big = crafts.trailSvgHtml([TRAIL[0]], { width: 600 });   // 64 cr, all alive
+  const half = crafts.trailSvgHtml([TRAIL[1]], { width: 600 });  // 42 cr, 60% alive
+  const r = (s) => Number(/class="pt-m pt-star"[^>]*r="([\d.]+)"/.exec(s)[1]);
+  const op = (s) => Number(/fill-opacity="([\d.]+)"/.exec(s)[1]);
+  assert.ok(r(big) > r(half), 'more credits, a wider mark');
+  assert.equal(op(big), 1);
+  assert.equal(op(half), 0.72, 'less of its work alive, a dimmer mark (0.3 + 0.7 x 0.6)');
+  const remnant = crafts.trailSvgHtml([TRAIL[4]], { width: 600 });
+  assert.match(remnant, /pt-remnant[^>]*r="(?!3\.2")/, 'a burned-out thought keeps its size');
+});
+
+await test('every row says its state in the sky\'s words, its size and what is still alive', () => {
+  const href = (id) => `/idea/${id}`;
+  const outcome = () => 'OUTCOME';
+  const row = (i) => crafts.thoughtRowHtml(TRAIL[i], i, { outcomeHtml: outcome, ideaHref: href });
+  assert.match(row(0), /burning<\/span>/);
+  assert.match(row(0), />64 cr</);
+  assert.match(row(1), />60%</);
+  assert.match(row(2), /waiting<\/span>[\s\S]*no size/);
+  assert.match(row(4), /burned out[\s\S]*22 cr<span class="pt-est" title="12 of it estimated[^"]*"> ~<\/span>[\s\S]*>0%</, 'the ~ marks the historical estimate');
+  assert.match(row(5), /folded in/);
+  assert.match(row(6), /declined/);
+  assert.match(row(0), /<tr id="pt-row-0" data-i="0" tabindex="0">/, 'a row is focusable, so a mark\'s click can land on it');
+  assert.match(row(0), /OUTCOME/, 'the old trail\'s "what became of it" is folded in, not dropped');
+  const legend = crafts.legendHtml();
+  for (const w of ['burning', 'waiting', 'folded in', 'burned out', 'declined']) assert.ok(legend.includes(w), `the legend names "${w}"`);
+});
+
+// ---- 3. the page --------------------------------------------------------------
+
+await test('the real page\'s artist tab draws the route\'s own rows, before and after', async () => {
+  const rows = pageStatus.composeArtistPages({ builderId: F.ALICE.id, inventory: F.INVENTORY, tasks: F.TASKS });
+  const wire = JSON.parse(JSON.stringify(rows));
+  const p = bootProfilePage({ roles: ['artist'], artistPages: wire });
+  await settle(); await settle(); await settle(); await settle();
+  const html = p.el('activity-pages').innerHTML;
+  assert.match(html, /Studio[\s\S]*Builders hall · approved Sep 20[\s\S]*1 line changed/);
+  assert.match(html, /pg-ba__was">Welcome<[\s\S]*pg-ba__now">Welcome home</);
+  assert.match(html, /Projects[\s\S]*Landing · approved Sep 1/);
+  assert.ok(!p.requests.some((u) => u.includes('role=artist')), 'the old "tasks labelled artist" list is gone');
+});
+
+summary();

package/tests/update_channel.mjs

@@ -15,7 +15,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { mkdtempSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -338,6 +338,85 @@ t('describeStaleness: silent when healthy, explicit about "the upgrader stopped"
   assert.match(msg, /upgrader has most likely stopped/);
 });
 
+// ---- the follow: every candidate, or released only (task 1004297, ADR 0360) -
+
+t('normalizeFollow: released and candidates are the words; anything else reads as the safer released', () => {
+  assert.equal(uc.DEFAULT_FOLLOW, 'released');
+  assert.deepEqual(uc.VALID_FOLLOWS, ['released', 'candidates']);
+  assert.equal(uc.normalizeFollow('candidates'), 'candidates');
+  assert.equal(uc.normalizeFollow(' Candidates '), 'candidates');
+  for (const v of [undefined, null, '', 'every', 'latest', 'next', 42]) assert.equal(uc.normalizeFollow(v), 'released', String(v));
+});
+
+t('versionsForFollow: candidates takes every version; released stops at the released label', () => {
+  const available = ['1.19.1038', '1.19.1039', '1.19.1040', '1.19.1041'];
+  assert.deepEqual(uc.versionsForFollow({ follow: 'candidates', available, released: '1.19.1039' }), available);
+  assert.deepEqual(uc.versionsForFollow({ follow: 'released', available, released: '1.19.1039' }), ['1.19.1038', '1.19.1039']);
+  assert.deepEqual(uc.versionsForFollow({ available, released: '1.19.1039' }), ['1.19.1038', '1.19.1039'], 'no follow given reads as released');
+});
+
+t('versionsForFollow: a follower of releases takes NOTHING when nobody can say what is released', () => {
+  const available = ['1.19.1040', '1.19.1041'];
+  for (const released of [null, undefined, '', 'not-a-version']) {
+    assert.deepEqual(uc.versionsForFollow({ follow: 'released', available, released }), [], String(released));
+  }
+  assert.deepEqual(uc.versionsForFollow({ follow: 'candidates', available, released: null }), available, 'candidates never needs the label');
+});
+
+t('the follow composes with the channel: released caps which versions exist, the channel caps the jump', () => {
+  const available = ['1.19.1040', '1.19.1041', '1.20.0'];
+  const pick = (follow, released) => uc.resolveChannelTarget({
+    installed: '1.19.1039', channel: 'patch', available: uc.versionsForFollow({ follow, available, released }),
+  });
+  assert.equal(pick('candidates', '1.19.1040'), '1.19.1041', 'Bongos takes the newest candidate its channel allows');
+  assert.equal(pick('released', '1.19.1040'), '1.19.1040', 'every other project stops at the release');
+  assert.equal(pick('released', '1.20.0'), '1.19.1041', 'and the patch channel still refuses the new line');
+  assert.equal(pick('released', null), null, 'an unreadable label moves nobody');
+});
+
+t('readReleaseTags: the released version is the latest label, read fail-soft', () => {
+  const seen = [];
+  const run = (cmd, args, o) => { seen.push([cmd, args, o.timeout]); return { status: 0, stdout: '{"latest":"1.19.1040","next":"1.19.1042"}' }; };
+  assert.deepEqual(uc.readReleaseTags({ run }), { ok: true, released: '1.19.1040', tags: { latest: '1.19.1040', next: '1.19.1042' } });
+  assert.deepEqual(seen[0].slice(0, 2), ['npm', ['view', '@bongos/core', 'dist-tags', '--json']]);
+  assert.ok(seen[0][2] > 0, 'the read carries a timeout');
+
+  const noLatest = uc.readReleaseTags({ run: () => ({ status: 0, stdout: '{"next":"1.19.1042"}' }) });
+  assert.equal(noLatest.ok, false);
+  assert.equal(noLatest.released, null);
+  const pre = uc.readReleaseTags({ run: () => ({ status: 0, stdout: '{"latest":"2.0.0-rc.1"}' }) });
+  assert.equal(pre.ok, false, 'a prerelease is never the release');
+  assert.equal(uc.readReleaseTags({ run: () => ({ status: 1, stderr: 'E404 Not Found' }) }).ok, false);
+  assert.match(uc.readReleaseTags({ run: () => ({ status: 1, stderr: 'E404 Not Found' }) }).error, /E404/);
+  assert.equal(uc.readReleaseTags({ run: () => ({ status: 0, stdout: 'not json' }) }).ok, false);
+  assert.equal(uc.readReleaseTags({ run: () => ({ status: 0, stdout: '["1.0.0"]' }) }).ok, false);
+  assert.equal(uc.readReleaseTags({ run: () => { throw new Error('spawn ENOENT'); } }).ok, false);
+});
+
+t('listAvailableVersions is untouched by the follow: same command, same shape', () => {
+  const seen = [];
+  const r = uc.listAvailableVersions({ run: (c, a) => { seen.push(a); return { status: 0, stdout: '["1.0.0"]' }; } });
+  assert.deepEqual(seen[0], ['view', '@bongos/core', 'versions', '--json']);
+  assert.deepEqual(r, { ok: true, versions: ['1.0.0'] });
+});
+
+t('loadSubscriptions: each entry carries a follow, released unless it says candidates', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'uc-follow-'));
+  mkdirSync(join(dir, 'config'), { recursive: true });
+  writeFileSync(join(dir, 'config', 'update-subscriptions.json'), JSON.stringify({ instances: [
+    { slug: 'cloudbongos', dir: '/srv/cb', follow: 'candidates' },
+    { slug: 'tenant', dir: '/srv/t' },
+    { slug: 'typo', dir: '/srv/x', follow: 'everything' },
+  ] }));
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.equal(r.defaultFollow, 'released');
+  assert.deepEqual(r.instances.map((i) => [i.slug, i.follow]), [['cloudbongos', 'candidates'], ['tenant', 'released'], ['typo', 'released']]);
+
+  writeFileSync(join(dir, 'config', 'update-subscriptions.json'), JSON.stringify({ defaultFollow: 'candidates', instances: [{ slug: 'a', dir: '/a' }, { slug: 'b', dir: '/b', follow: 'released' }] }));
+  const d = uc.loadSubscriptions({ instanceDir: dir });
+  assert.deepEqual(d.instances.map((i) => i.follow), ['candidates', 'released'], 'a roster-wide default, overridable per entry');
+});
+
 console.log(`\nupdate_channel: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);