@bongos/core 1.21.119 → 1.21.121

package/modules/hall-ui/public/modules.js

@@ -113,6 +113,32 @@
     return '<span class="fact-pill fact-pill--warn" title="Taken out of the store. Your copy keeps working, but it will get no more updates.">delisted · no more updates</span>';
   }
 
+  // A toggle this server has not acted on yet (task 1004463): routes mount and pollers
+  // start once, at boot, so the change lands at the next restart.
+  // The words are the server's (restartNote in src/bongos/routes/modules.js): 'routes' are
+  // its pages, 'pollers' its background jobs, and only what actually waits is named.
+  function restartFact(m) {
+    const waits = Array.isArray(m.restart_pending) ? m.restart_pending : [];
+    if (!waits.length) return '';
+    const parts = m.enabled
+      ? [waits.includes('routes') && 'its pages do not open', waits.includes('pollers') && 'its background jobs do not run']
+      : [waits.includes('routes') && 'its pages still open', waits.includes('pollers') && 'its background jobs still run'];
+    const title = `It turns ${m.enabled ? 'on' : 'off'} at the next restart of this server. Until then ${parts.filter(Boolean).join(' and ')}.`;
+    const pill = `<span class="fact-pill fact-pill--warn" title="${escapeHtml(title)}">waits for a restart</span>`;
+    const door = restartDoor();
+    return door ? pill + `<a class="fact-pill" href="${escapeHtml(door)}">restart it</a>` : pill;
+  }
+  // Where this server's Restart button is: only the platform's own hall has one, on its
+  // project page on the hub (task 1004463). Elsewhere whoever runs the server restarts it.
+  function restartDoor() {
+    const hub = window.OTB && typeof window.OTB.hubOrigin === 'function' ? window.OTB.hubOrigin() : null;
+    if (!hub) return null;
+    let hubHost = '';
+    try { hubHost = new URL(hub).hostname; } catch (err) { return null; }
+    const here = String(window.location.hostname || '').replace(/^builders\./, '');
+    return here === hubHost ? `${hub}/projects?view=mine` : null;
+  }
+
   // The lines the row's details disclosure opens onto: the facts the payload
   // carries that the card never rendered — what the module contributes, the
   // core it needs, who maintains it and what it hands off to.
@@ -159,7 +185,7 @@
         <div class="ov-row__main">
           <span class="ov-row__title">${escapeHtml(m.title || m.key)}<span class="ov-mono">${escapeHtml(m.key)}</span></span>
           ${desc ? `<p class="ov-row__sub mod-row__desc">${escapeHtml(desc)}</p>` : ''}
-          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}</div>
+          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}${restartFact(m)}</div>
           ${lines ? `<details class="mod-more"${openKeys.has(m.key) ? ' open' : ''}><summary aria-label="Details for ${escapeHtml(m.title || m.key)}"></summary>${lines}</details>` : ''}
         </div>
         <div class="ov-row__right mod-row__right">${rightHtml(m)}</div>
@@ -289,13 +315,13 @@
       const body = res.data || {};
       if (!res.ok) throw new Error(body.message || `enable → ${res.status}`);
       const m = allModules.find((x) => x.key === key);
-      if (m) m.enabled = next;
+      if (m) { m.enabled = next; if (Array.isArray(body.restart_pending)) m.restart_pending = body.restart_pending; }
       btn.setAttribute('aria-pressed', next ? 'true' : 'false');
       btn.textContent = next ? 'enabled' : 'disabled';
       const figs = $('#mod-figs');
       if (figs) figs.innerHTML = figsHTML();
       renderRows();
-      toast(body.note || (next ? `${key} enabled.` : `${key} disabled.`), { duration: 3200 });
+      toast(body.note || (next ? `${key} enabled.` : `${key} disabled.`), { duration: body.restart_pending && body.restart_pending.length ? 7000 : 3200 });
     } catch (err) {
       console.error('[modules] toggle failed', err);
       toast(err.message || 'Could not change that module.', { duration: 3200 });

package/modules/provisioning/github-setup.js

@@ -19,7 +19,11 @@
 //              docs warn it can be spoofed, so that redirect only records that the founder
 //              SAYS they installed it ('github-app-install-reported'), which makes the
 //              runner look again.
-//   sign_in  — the runner saw the project report auth_configured (the manifest row 'done').
+//   sign_in  — the runner saw the project report auth_configured (the manifest row 'done'),
+//              OR the liveness sweep did ('github-sign-in-seen', task 1004410). The second
+//              is what keeps the step honest when sign-in was wired some other way (a manual
+//              OAuth app, or a GitHub tab that never came back): the project's own answer
+//              is the fact the step names, so it ticks whatever the attempt row says.
 //   device   — the runner started a device-flow sign-in with the app's client id and GitHub
 //              did not refuse it with device_flow_disabled ('github-app-device-flow').
 //              GitHub offers no manifest field and no API to switch device flow on (the
@@ -43,6 +47,9 @@ const SETUP_EVENTS = Object.freeze({
   // the founder pressed "Pick up where it stopped" or "Check again" (task 1004652). Like an
   // install report it re-opens the runner's checking window; it claims nothing itself.
   checkRequested: 'github-app-check-requested',
+  // the liveness sweep saw the project's own /healthz answer auth_configured: true (task
+  // 1004410). Recorded once per attempt (recordSignInSeen); no detail.
+  signInSeen: 'github-sign-in-seen',
 });
 
 const { effectiveManifestStatus } = require('./manifest-truth');
@@ -99,7 +106,7 @@ async function githubSetupFacts(db, instanceId, since) {
   const org = find(SETUP_EVENTS.appOrg);
   return {
     installReportedAt: at(SETUP_EVENTS.installReported), installedAt: at(SETUP_EVENTS.installed), deviceFlowAt: at(SETUP_EVENTS.deviceFlow),
-    checkRequestedAt: at(SETUP_EVENTS.checkRequested),
+    checkRequestedAt: at(SETUP_EVENTS.checkRequested), signInSeenAt: at(SETUP_EVENTS.signInSeen),
     appOrg: org && validGithubLogin(org.detail) ? org.detail : null,
   };
 }
@@ -108,22 +115,42 @@ async function githubSetupFacts(db, instanceId, since) {
 // vocabulary) + the facts above. A closed vocabulary the page turns into words:
 //   'done' · 'now' (waiting on GitHub, the founder or the platform) · 'todo' (not reached)
 //   · 'stopped' (this attempt failed at this step) · 'later' (device flow only: optional, off).
+// A project that answers sign-in works with no app of ours recorded was wired some other
+// way: approve and install name steps it never needed, so they read done and
+// `wired_elsewhere` says why (task 1004410). With an app recorded, they keep their own facts.
 // PURE.
 function githubChecklist(status, appSlug, facts = {}) {
   const s = String(status || '');
   const inFlight = s === 'pending' || s === 'code_received' || s === 'converting';
   const failed = s === 'error' || s === 'expired';
-  const approve = appSlug ? 'done' : inFlight ? 'now' : failed ? 'stopped' : 'todo';
-  const install = facts.installedAt ? 'done' : appSlug ? 'now' : 'todo';
-  const signIn = s === 'done' ? 'done' : appSlug && failed ? 'stopped' : appSlug ? 'now' : 'todo';
+  const seen = !!facts.signInSeenAt;
+  const elsewhere = seen && !appSlug;
+  const approve = appSlug || elsewhere ? 'done' : inFlight ? 'now' : failed ? 'stopped' : 'todo';
+  const install = facts.installedAt || elsewhere ? 'done' : appSlug ? 'now' : 'todo';
+  const signIn = s === 'done' || seen ? 'done' : appSlug && failed ? 'stopped' : appSlug ? 'now' : 'todo';
   const device = facts.deviceFlowAt ? 'done' : s === 'done' ? 'later' : 'todo';
   return {
     approve, install, sign_in: signIn, device_flow: device,
     // what "is alive" waits for — device flow is optional by design
     connected: approve === 'done' && install === 'done' && signIn === 'done',
+    wired_elsewhere: elsewhere,
   };
 }
 
+// The liveness sweep saw this project answer auth_configured: true (task 1004410). One row
+// per attempt: nothing is written when one already stands since the latest attempt began
+// (or ever, for a project with no attempt), so a five-minute sweep never grows the ledger.
+async function recordSignInSeen(db, instanceId) {
+  await db.query(
+    `INSERT INTO provisioning_events (instance_id, event, actor)
+     SELECT $1, $2, 'liveness'
+      WHERE NOT EXISTS (
+        SELECT 1 FROM provisioning_events e
+         WHERE e.instance_id = $1 AND e.event = $2
+           AND e.created_at >= COALESCE((SELECT max(m.created_at) FROM provisioning_oauth_manifests m WHERE m.instance_id = $1), 'epoch'::timestamptz))`,
+    [instanceId, SETUP_EVENTS.signInSeen]);
+}
+
 // Is the runner still checking this attempt? While it is, an install or a 'later'
 // device-flow step can still tick itself, so the page keeps polling. PURE.
 function stillVerifying(row, facts = {}, now = Date.now()) {
@@ -147,6 +174,8 @@ function stillVerifying(row, facts = {}, now = Date.now()) {
 // PURE.
 function pickUpFor(row, status, checklist, verifying, now = Date.now()) {
   if (!row) return null;
+  // sign-in works without our app (task 1004410): there is nothing left to pick up
+  if (checklist && checklist.wired_elsewhere) return null;
   if (status === 'pending') return 'reopen';
   if (status === 'expired') return 'fresh';
   if (row.app_slug || row.app_id) {
@@ -195,8 +224,12 @@ async function requeueConversion(db, id) {
 // lands on the setup page, which sends the founder back to their projects.
 // A failed facts read is "nothing verified yet" — the honest 'now' states, never a 500.
 async function githubSetupRead(db, inst, row, status, { now = Date.now(), withState = true } = {}) {
-  if (!row) return { checklist: githubChecklist(null, null), install_url: null, repo: targetRepo(inst), verifying: false, app_org: null, pick_up: null };
   let facts = {};
+  if (!row) {
+    // no attempt: only the project's own answer can tick anything (task 1004410)
+    try { facts = (inst && inst.id != null) ? await module.exports.githubSetupFacts(db, inst.id, null) : {}; } catch (_) { facts = {}; }
+    return { checklist: githubChecklist(null, null, facts), install_url: null, repo: targetRepo(inst), verifying: false, app_org: null, pick_up: null };
+  }
   // through module.exports so a route test can stub the one DB read on the cached module
   try { facts = await module.exports.githubSetupFacts(db, row.instance_id, row.created_at); } catch (_) { facts = {}; }
   const checklist = githubChecklist(status, row.app_slug, facts);
@@ -216,5 +249,5 @@ async function githubSetupRead(db, inst, row, status, { now = Date.now(), withSt
 
 module.exports = {
   SETUP_EVENTS, VERIFY_WINDOW_MS, installUrlFor, targetRepo, githubSetupFacts, githubChecklist, stillVerifying, githubSetupRead,
-  validGithubLogin, pickUpFor, mintGuard, requeueConversion,
+  validGithubLogin, pickUpFor, mintGuard, requeueConversion, recordSignInSeen,
 };

package/modules/provisioning/pollers/liveness-sweep.js

@@ -27,6 +27,7 @@ const dns = require('node:dns').promises;
 const { Agent: UndiciAgent } = require('undici');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
+const githubSetup = require('../github-setup');
 const { planNotices, postNotice } = require('./liveness-notify');
 // task 1004000: the runner-drift check rides this tick rather than installing a timer of
 // its own — the sweep already runs every ~5 min on the one host that can see the systemd
@@ -163,8 +164,35 @@ function probeReason(err) {
   return err.message ? String(err.message).slice(0, 40) : 'error';
 }
 
+// The /healthz answer is tiny; read no more than this of a body a builder's host chose.
+const BODY_CAP_BYTES = 4096;
+
+// Did the answer say auth_configured: true (task 1004410)? Reads at most BODY_CAP_BYTES
+// and answers false for anything else — a big, slow or non-JSON body is never "configured".
+async function readAuthConfigured(res) {
+  try {
+    if (!res.body || typeof res.body.getReader !== 'function') {
+      return typeof res.json === 'function' ? (await res.json()).auth_configured === true : false;
+    }
+    const reader = res.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.length;
+      if (size > BODY_CAP_BYTES) { reader.cancel().catch(() => {}); return false; }
+      chunks.push(Buffer.from(value));
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf8')).auth_configured === true;
+  } catch (_) {
+    return false;
+  }
+}
+
 // Knock once. Any 2xx = up; everything else (non-2xx, refused, DNS, TLS, timeout)
-// = down with a reason. Never throws — a probe result is the whole point.
+// = down with a reason. Never throws — a probe result is the whole point. An up answer
+// also carries whether the project says its sign-in is configured (task 1004410).
 async function probeHealthz(url, { timeoutMs = PROBE_TIMEOUT_MS, fetchImpl, pin } = {}) {
   const doFetch = fetchImpl || globalThis.fetch;
   const dispatcher = pin && !fetchImpl ? pinnedDispatcher(pin, timeoutMs) : null;
@@ -178,7 +206,7 @@ async function probeHealthz(url, { timeoutMs = PROBE_TIMEOUT_MS, fetchImpl, pin
       headers: { accept: 'application/json, text/plain;q=0.9, */*;q=0.8' },
       ...(dispatcher ? { dispatcher } : {}),
     });
-    if (res.status >= 200 && res.status < 300) return { up: true };
+    if (res.status >= 200 && res.status < 300) return { up: true, authConfigured: await readAuthConfigured(res) };
     return { up: false, reason: `http ${res.status}` };
   } catch (e) {
     return { up: false, reason: probeReason(e) };
@@ -229,6 +257,10 @@ async function sweepOnce(deps = {}) {
     if (row.domain && !row.dns_resolved_at && (pin || probe.up)) {
       await provisioning.recordDnsResolved(db, row.id).catch((e) => log(`[liveness] dns record failed (non-blocking): ${e && e.message ? e.message : e}`));
     }
+    // The project's own word that sign-in works ticks its setup checklist (task 1004410).
+    if (probe.up && probe.authConfigured) {
+      await githubSetup.recordSignInSeen(db, row.id).catch((e) => log(`[liveness] sign-in record failed (non-blocking): ${e && e.message ? e.message : e}`));
+    }
     return { row, probed: true, prevUp: rec ? rec.prev_up : null, ...probe };
   }));
 

package/modules/provisioning/provisioning.js

@@ -123,9 +123,11 @@ const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host', 'control-plane
 // SETTINGS_APPLY_FROM: each action declaring its own gate is this module's
 // convention, and the two answer different questions.
 const RESTART_FROM = new Set(['active']);
-// Same reachability rule as the settings push (the runner can only restart what it runs),
-// minus 'control-plane': task 1004334 gave the self row a settings push, not a restart door.
-const RESTART_SHAPES = new Set(['co-tenant', 'cloud-host']);
+// Same reachability rule as the settings push (the runner can only restart what it runs).
+// 'control-plane' joined in task 1004463: a module toggled in its hall takes effect only at
+// the next restart, the guard already allows 'restart' on the self row, and the owner's only
+// other way was a shell on the box.
+const RESTART_SHAPES = new Set(['co-tenant', 'cloud-host', 'control-plane']);
 
 // Per-project settings (task 1003040, goal 1000058): the known keys + their
 // vocabularies, enforced at the API layer — the jsonb `settings` column

package/modules/provisioning/tests/liveness.mjs

@@ -330,7 +330,7 @@ await ta('the pin is load-bearing on the REAL client: same URL, the pinned addre
   try {
     // 'pinned.invalid' resolves nowhere; only the pin can make this connect.
     const hit = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.1', family: 4 } });
-    assert.deepEqual(hit, { up: true }, 'the pinned address is what gets connected');
+    assert.deepEqual(hit, { up: true, authConfigured: false }, 'the pinned address is what gets connected');
     const miss = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.2', family: 4 } });
     assert.equal(miss.up, false, 'a different pin cannot reach the same server — the pin, not DNS, decides');
   } finally {

package/modules/public-landing/public/projects.html

@@ -6987,7 +6987,11 @@ summary{min-height:24px;padding:3px 0;}
          including when a LATER step stopped (sign-in unconfirmed) */
       var appMade = (ghStep('approve') === 'done' || live.appSlug) && live.manifest !== 'expired' &&
         (live.manifest !== 'error' || live.manifestFailure === 'sign_in_unconfirmed');
-      if (appMade) { approve.state = 'done'; approve.sub = name + ' app on ' + (appOrgLogin() || 'your account'); }
+      /* sign-in works with no app of ours: it was wired another way, and the project's own
+         answer is the fact (task 1004410) — never "waiting on GitHub" for a step it skipped */
+      var elsewhere = !!ghStep('wired_elsewhere');
+      if (elsewhere) { approve.state = 'done'; approve.sub = 'Not needed. Sign-in was set up another way.'; }
+      else if (appMade) { approve.state = 'done'; approve.sub = name + ' app on ' + (appOrgLogin() || 'your account'); }
       else if (!dom) { approve.state = 'todo'; approve.sub = 'Opens once it has an address.'; }
       /* GitHub refuses app manifests whose hook URL it cannot reach (owner walk, 2026-08-12) */
       else if (!apexBase()) { approve.state = 'todo'; approve.sub = 'GitHub can’t reach a platform on a local address, so this works only on a public one.'; }
@@ -7010,7 +7014,8 @@ summary{min-height:24px;padding:3px 0;}
 
       var install = { key: 'install', title: 'Install it on your repo', sub: repo || '' };
       var installUrl = live.installUrl || (live.appSlug ? 'https://github.com/apps/' + encodeURIComponent(live.appSlug) + '/installations/new' : null);
-      if (ghStep('install') === 'done') install.state = 'done';
+      if (elsewhere) { install.state = 'done'; install.sub = 'Not needed. Sign-in was set up another way.'; }
+      else if (ghStep('install') === 'done') install.state = 'done';
       else if (!live.appSlug) install.state = 'todo';
       /* the runner stopped checking and GitHub never confirmed the install: the link opens the
          SAME app's install page, and the click asks the runner to look again */
@@ -8536,9 +8541,11 @@ summary{min-height:24px;padding:3px 0;}
      last_verified_up === false is the verdict; null means never probed and is
      deliberately NOT the same claim (publicInstance keeps the two apart), so a
      brand-new project never grows a Restart button it has no use for. A door on
-     every healthy card would only invite needless downtime. */
+     every healthy card would only invite needless downtime. The ONE exception is the
+     platform's own row (task 1004463): a module switched on or off in its hall waits for
+     a restart, so its owner always has the door. */
   function canRestart(inst) {
-    return inst.status === 'active' && inst.last_verified_up === false && !inst.open_intent;
+    return inst.status === 'active' && !inst.open_intent && (inst.last_verified_up === false || inst.hosting_shape === 'control-plane');
   }
   /* keep watching while the platform is doing something to this instance */
   function shouldWatch(inst) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.119",
+  "version": "1.21.121",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.119",
+      "version": "1.21.121",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.119",
+  "version": "1.21.121",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9696,5 +9696,17 @@
       "id": "1004664",
       "text": "A profile privacy test that had been switched off because it failed on a fresh database is fixed and switched back on, so it guards the public profile page again."
     }
+  ],
+  "1.21.120": [
+    {
+      "id": "1004410",
+      "text": "The new-project page no longer says GitHub sign-in is unfinished when it already works: the platform now checks the project itself and ticks the step."
+    }
+  ],
+  "1.21.121": [
+    {
+      "id": "1004463",
+      "text": "Turning a module on or off now says honestly when it takes effect at the next restart, and the platform's own server can be restarted from its project page instead of needing a login to the machine."
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -91,7 +91,7 @@ const EXEMPTIONS = [
        + 're-opens for review.',
   },
   {
-    at: 'src/module-loader/loader.js:196',
+    at: 'src/module-loader/loader.js:198',
     why: 'The plugin loader, and the second site the audit named (B50 "motivating sites"). It '
        + 'require()s a discovered module\'s route file, so the specifier is a runtime path BY '
        + 'DESIGN — a plugin system whose module paths are compile-time constants is not a plugin '
@@ -103,7 +103,7 @@ const EXEMPTIONS = [
        + 'absorbed into this check.',
   },
   {
-    at: 'src/module-loader/loader.js:309',
+    at: 'src/module-loader/loader.js:347',
     why: 'The poller twin of the route require at :196 — same DEFAULT_ROOTS bound, same plugin-by-'
        + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
        + 'change to either call re-opens only that one.',

package/scripts/gds/provision.js

@@ -927,8 +927,10 @@ async function settingsApplyInstance(inst, deps) {
 // ---------------------------------------------------------------------------
 async function restartInstance(inst, deps) {
   const { db, provisioning, exec, log, apply, privileged } = deps;
-  // Same box routing as settingsApplyInstance: a standalone runs control-plane-local.
-  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
+  // Same box routing as settingsApplyInstance: a standalone runs control-plane-local, and the
+  // control plane's own row IS this box (task 1004463).
+  const onControlBox = inst.hosting_shape === 'cloud-host' || inst.hosting_shape === 'control-plane';
+  const boxExec = onControlBox ? (deps.controlExec || exec) : exec;
   const sudoP = privileged ? 'sudo ' : '';
   log(`restart ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
 

package/src/bongos/routes/modules.js

@@ -77,6 +77,8 @@ const express = require('express');
 const auth = require('../auth');
 const { asyncHandler, validateOrRespond, LIMITS } = require('./_helpers');
 const loader = require('../../module-loader/loader');
+// named, not loader.restartPendingFor: knip sees a named require, never a member read
+const { restartPendingFor } = require('../../module-loader/loader');
 const catalog = require('../../module-loader/catalog');
 const modulesLib = require('../../modules');
 // scripts/gds/ is a sibling CORE-package dir (both resolve under
@@ -110,6 +112,15 @@ const log = require('../logger').logger.child({ src: 'modules' });
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog } = require('../module-listing');
 
+// The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
+// module's pages, 'pollers' its background jobs. PURE.
+function restartNote(waits, enabled) {
+  const parts = enabled
+    ? [waits.includes('routes') && 'its pages do not open', waits.includes('pollers') && 'its background jobs do not run']
+    : [waits.includes('routes') && 'its pages still open', waits.includes('pollers') && 'its background jobs still run'];
+  return `It turns ${enabled ? 'on' : 'off'} at the next restart of this server. Until then ${parts.filter(Boolean).join(' and ')}.`;
+}
+
 // A packaged submission embeds every file's content (base64) — cap the total
 // so a runaway/misbuilt module can't bloat the review-queue table. Generous
 // headroom over what a real feature module carries (routes + migrations + UI
@@ -258,6 +269,8 @@ module.exports = function buildModulesRouter() {
         ? `/builders/modules?howto=${encodeURIComponent(m.key)}&version=${encodeURIComponent(String(m.version))}`
         : null;
       m.store_delisted = m.source === 'instance' && delistedKeys.has(m.key);
+      // what of this module still waits for a restart to match its toggle (task 1004463)
+      m.restart_pending = restartPendingFor(m.key, m.enabled === true);
     }
     res.json({
       modules: all,
@@ -297,6 +310,9 @@ module.exports = function buildModulesRouter() {
       // the write path deliberately is not.
       const resolvedSet = await setOverride(key, enabled, { builderId: req.builder && req.builder.id });
       const effective = resolvedSet ? resolvedSet[key] === true : enabled;
+      // Routes mount and pollers start once, at boot (task 1004463): say so rather than
+      // "live now" when this change waits for the next restart of this server.
+      const waits = restartPendingFor(key, effective);
 
       console.log(`[gds] module "${key}" ${enabled ? 'enabled' : 'disabled'} by builder ${req.builder && req.builder.id}`);
       res.json({
@@ -308,9 +324,12 @@ module.exports = function buildModulesRouter() {
         // who is not told so will re-click the toggle and blame the feature.
         effective,
         source: (resolvedSet && resolvedSet.sources && resolvedSet.sources[key]) || 'override',
-        note: effective === enabled
-          ? 'Live on this box now, and durable — it survives the next deploy.'
-          : `Recorded, but "${key}" still resolves to ${effective}: a higher-precedence layer (env, or the spend guard) is winning.`,
+        restart_pending: waits,
+        note: effective !== enabled
+          ? `Recorded, but "${key}" still resolves to ${effective}: a higher-precedence layer (env, or the spend guard) is winning.`
+          : waits.length
+            ? `Saved, and it survives the next deploy. ${restartNote(waits, enabled)}`
+            : 'Live on this box now, and durable — it survives the next deploy.',
       });
     }));
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.119'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.121'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/module-loader/loader.js

@@ -112,7 +112,7 @@ function discoverModules({ roots = DEFAULT_ROOTS, core = coreVersion() } = {}) {
 // Cached singleton for app code (lazy, like src/modules.js's modules()).
 let _cache = null;
 function discovered(opts) { return (_cache ||= discoverModules(opts)); }
-function _reset() { _cache = null; _startedPollers = []; }
+function _reset() { _cache = null; _startedPollers = []; _boot = { routes: null, pollers: null }; _bootShape = null; }
 
 // The discovered manifests as MODULE_REGISTRY-shaped entries, so src/modules.js
 // can merge them with its built-in registry. Empty until a module exists.
@@ -190,8 +190,10 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
   const enabled = enabledModules({ isEnabled }, opts);
   verifyEnabledPorts(enabled);
   let mounted = 0;
-  for (const { dir, manifest } of enabled) {
+  _boot.routes = new Set();
+  for (const { key, dir, manifest } of enabled) {
     const routeKeys = (manifest.contributes && manifest.contributes.routes) || [];
+    if (routeKeys.length) _boot.routes.add(key);
     for (const rk of routeKeys) {
       const factory = require(path.join(dir, 'routes', `${rk}.js`));
       const sub = typeof factory === 'function' ? factory() : factory;
@@ -284,6 +286,41 @@ function moduleWebSurfaces({ isEnabled } = {}, opts) {
   return out;
 }
 
+// What this process mounted at boot (task 1004463): the keys whose routes were mounted
+// and whose pollers started. null until that boot step has run in this process — so a
+// script or test that never booted is never told a restart is pending.
+let _boot = { routes: null, pollers: null };
+// key → { routes, pollers }: whether each discovered module mounts routes / runs a poller in
+// this process. Module files do not change under a running process, so it is worked out
+// once, on first ask, rather than stat'ing disk on every GET /modules.
+let _bootShape = null;
+function bootShape(opts) {
+  if (_bootShape) return _bootShape;
+  _bootShape = new Map();
+  for (const { key, dir, manifest } of discovered(opts).loaded) {
+    const c = manifest.contributes || {};
+    _bootShape.set(key, {
+      routes: (c.routes || []).length > 0,
+      // the same rule startModulePollers applies: a poller with no file here runs elsewhere
+      pollers: (c.pollers || []).some((pk) => fs.existsSync(path.join(dir, 'pollers', `${pk}.js`))),
+    });
+  }
+  return _bootShape;
+}
+
+// Does turning module `key` to `enabled` wait for a restart in THIS process (task
+// 1004463)? Routes mount and pollers start once, at boot, so a module switched on after
+// boot has no pages yet, and one switched off keeps answering until the restart. Returns
+// what waits — [] when the change is live now. PURE over the boot record and the manifest.
+function restartPendingFor(key, enabled, opts) {
+  const shape = bootShape(opts).get(key);
+  if (!shape) return [];
+  const waits = [];
+  if (_boot.routes && shape.routes && _boot.routes.has(key) !== !!enabled) waits.push('routes');
+  if (_boot.pollers && shape.pollers && _boot.pollers.has(key) !== !!enabled) waits.push('pollers');
+  return waits;
+}
+
 // Started poller handles (key, name, module), so stopModulePollers stops exactly
 // what startModulePollers started — and a test can introspect them.
 let _startedPollers = [];
@@ -299,6 +336,7 @@ let _startedPollers = [];
 // No-op when nothing is discovered/enabled. Returns the started-handle list.
 function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
   const started = [];
+  _boot.pollers = new Set();
   for (const { key, dir, manifest } of discovered(opts).loaded) {
     if (typeof isEnabled === 'function' && !isEnabled(key)) continue;
     const pollerKeys = (manifest.contributes && manifest.contributes.pollers) || [];
@@ -323,6 +361,7 @@ function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
             r.catch((e) => console.error(`[module-loader] poller ${key}/${pk} start error: ${e && e.message ? e.message : e}`));
           }
           started.push({ key, poller: pk, handle: poller });
+          _boot.pollers.add(key);
         }
       } catch (e) {
         console.error(`[module-loader] poller ${key}/${pk} start threw: ${e && e.message ? e.message : e}`);
@@ -370,6 +409,7 @@ module.exports = {
   moduleWebSurfaces,
   startModulePollers,
   stopModulePollers,
+  restartPendingFor,
   loaderSnapshot,
   coreVersion,
   dedupeRoots,

package/tests/github_one_trip.mjs

@@ -35,7 +35,7 @@ const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>
 
 test('each step reads only what the server has seen — the honest "not yet" states included', () => {
   const none = GS.githubChecklist(null, null);
-  assert.deepEqual(none, { approve: 'todo', install: 'todo', sign_in: 'todo', device_flow: 'todo', connected: false }, 'never started');
+  assert.deepEqual(none, { approve: 'todo', install: 'todo', sign_in: 'todo', device_flow: 'todo', connected: false, wired_elsewhere: false }, 'never started');
   assert.equal(GS.githubChecklist('pending', null).approve, 'now', 'waiting for the approval on GitHub');
   for (const s of ['code_received', 'converting']) {
     const c = GS.githubChecklist(s, null);