@bongos/core 1.21.120 → 1.21.121

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.120",
-  "core_contract": "1.21.120",
-  "source_commit": "a0abf3fc6c913d358ffd525f1592603c5ba771b0",
+  "core_version": "1.21.121",
+  "core_contract": "1.21.121",
+  "source_commit": "514ed742253be1dacb6b1d18d49f2f6fa3f6b427",
   "source_ref": "HEAD",
-  "built_at": "2026-10-14T16:25:27.328Z",
+  "built_at": "2026-10-14T17:15:08.661Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 605,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3117,
+    "functional_verbatim": 3118,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3751,
-  "tree_sha256": "9223a47c6d78a1edb87bbb0565101cac2b5d3c655b3cc9a703bee7c6116db5be",
+  "file_count": 3752,
+  "tree_sha256": "49b303e76f9a422c8c0b909fe0ee46687b713859b18104045df85b7ef48fa505",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -337,7 +337,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "180a7c8a717b39b948341c1f0e5fb9bf69aec98f5d1f8cf1c37607972a05ed6b"
+      "sha256": "493cebcc4535646738cfda7d3df73ba9895e7e88c3c268d62cca55420aebab29"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1462,7 +1462,7 @@
     {
       "path": "docs/adr/0199-restart-an-unreachable-active-project.md",
       "mode": "0000644",
-      "sha256": "999c2eb382b51317a4f1fbf7a615855be7baeded04cf03c4e1a411b2f98386cd"
+      "sha256": "a1dae8f4126ab9cfff7390bbde17a501ec0fe0b17f5c49ce2d0b4bd4e7735d9b"
     },
     {
       "path": "docs/adr/0200-re-point-a-bring-your-own-domain.md",
@@ -2382,7 +2382,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "6ecf7c560ed5131cbc24a55498493a1fcf200516118c4c84e4ef0484f1d780e7"
+      "sha256": "1504a1bc002e033dd4c69c55a074014b35f88fe0015746911ac69e02cff4a430"
     },
     {
       "path": "docs/architecture.md",
@@ -2407,12 +2407,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "32112bc332f327d446a1a066fc4036a916ca7e1a021202d4c07f468973910697"
+      "sha256": "2f6c0fff979e7a52a1dff20184291da110751084197f9619497bc5a8668c2c0f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "50acc9b093e07c52ee9fc4b31a3e69c5ae6bc73c00530c71fc4a81c6f6aca727"
+      "sha256": "2fa52a4d4411a29e5aadeb0a03898a32144834527c7e84804f4c9df5f584cab6"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "72ce941af880f14ccd6a7b1df337934e527a8553d85cbe8b986076bbcf1358cc"
+      "sha256": "24cea3fdb2f8e21b6358090612695e37c03e734fcd305e87d35456fa8a515adf"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3012,7 +3012,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "cda2d7936c5a440c9bf7a535d553c316ee41271a7081b283d52d1599f605d052"
+      "sha256": "d59a98a2c166e276275156dfb13887c9147f1596ca65fb777c97e988dd23bf25"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6132,7 +6132,7 @@
     {
       "path": "modules/hall-ui/public/modules.js",
       "mode": "0000644",
-      "sha256": "6f960241607ea3921cce5d40bf5fbb6d17595d26213601cbc6a7195448624b11"
+      "sha256": "a42b39265d8cfc1a191fe203c6d48c7da111e231ae33da731ebe5a9aa7cd656c"
     },
     {
       "path": "modules/hall-ui/public/modules.states.json",
@@ -8782,7 +8782,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "b45bcb38497d8999ea0e5e3d0844785a7514a829cfd6cbb58c9b3167ccce37f9"
+      "sha256": "c99cfa7d071ece3f6d821709a8610baa25bb0323f7219016ac53d7e8ebb5e197"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -9667,7 +9667,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "060c9904c6fefb2848819609a61bbb76822c273c601d670500a9e031380120e1"
+      "sha256": "ead1660e07f5bd8cf34008318e1c729ce39f5f4717e104be4cd2e64942a6b264"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -10467,12 +10467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "acf5cb64360f149851f33d37eb868b75ea6a476b6a26fe8c7fba494d0a530202"
+      "sha256": "4fbad4e149e09def5dfaf46fb9069c0298871200c54d8836c61efdf527e14038"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0e819e620052f3e27e6088f87839bfa0ac850b3b1992024fd13c5540930cafce"
+      "sha256": "7107e720fbe7a367451fb610dcccac24f7563e1a50b898bf1899b76afc53fd6f"
     },
     {
       "path": "public-docs/index.html",
@@ -10492,7 +10492,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "6969dc70a1c0541fcd0a79f7b801d7de58b8a84b96c22e8e36b5524432878219"
+      "sha256": "7818da891dbc2d601d13dc938d43d83f49061084ed93fef83fe6d4479c98f828"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11002,7 +11002,7 @@
     {
       "path": "scripts/gds/exec-path-guard.js",
       "mode": "0000644",
-      "sha256": "8ed7c35c0d6be3c8a11ee990b487114d7e422caeb70c67240b5060a0087cfdc4"
+      "sha256": "cda9e125cfb2cb354c7d4e20065c36712a75955d3981203012c2334d0ce637ae"
     },
     {
       "path": "scripts/gds/feedback-send.js",
@@ -11587,7 +11587,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "ff2d4e3576942d20056d11236dc13481a8ef560fa9828b691b30ba3758203048"
+      "sha256": "ea11cc49dbc298c8b3ed4ad88e25a3acfbba65fcd65727c9b47c43ee41e24437"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -12722,7 +12722,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "aea0a0f28621500bee51e4fec8e794139cf90c3360fdc55caecbbd5a5fc82b69"
+      "sha256": "e6b1b25371695b4aa959f5fdcece31869e827221f0205d1797c8332628d7b6a2"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -12802,7 +12802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ea34607161a0fbc072ecd805d5e150692df9557f574b6c74ebd53f96ea8ba341"
+      "sha256": "0ebfd076b4e28ae56b54b3bdc1f43d1f4ee3e74391b4b28600de50f653ee097c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12812,7 +12812,7 @@
     {
       "path": "src/module-loader/loader.js",
       "mode": "0000644",
-      "sha256": "f3ec8f005fb9bb366a489b82a5836195b78982b0f605a8e03b588f53f7f9392f"
+      "sha256": "04458c645d876011324e5ae11011774699c06e39ff2fa1ba1cf58a2d2775f887"
     },
     {
       "path": "src/module-loader/manifest-schema.js",
@@ -15267,7 +15267,7 @@
     {
       "path": "tests/hall_catalog_world.mjs",
       "mode": "0000644",
-      "sha256": "11f0ac50c5424a76371591b31275c796ded853db0cd35798b9adc878cdd88c88"
+      "sha256": "8aad2dd0521d212dfdb21a4fe4d2c341ddc94796bd4bc9b871ac1b5b25cc596d"
     },
     {
       "path": "tests/hall_city.mjs",
@@ -16362,7 +16362,7 @@
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",
-      "sha256": "88100737a4b7a67899c3eba3dc01bcf3079d4171ad1dad62b79ffdb49ec3bee3"
+      "sha256": "a2a029afd86336a83deeb79f0856473470024fa94da01e1c556094b8e6d042d5"
     },
     {
       "path": "tests/module_manifest.mjs",
@@ -16434,6 +16434,11 @@
       "mode": "0000644",
       "sha256": "0db12d802203780f489e9a6d7abf970dfcde9099ac7011fcaaa6c575336804cd"
     },
+    {
+      "path": "tests/module_toggle_restart.mjs",
+      "mode": "0000644",
+      "sha256": "31b96e448b751a6f81891286e0dee96eb13e543d029787c5520f785fe2f45291"
+    },
     {
       "path": "tests/module_update.mjs",
       "mode": "0000644",
@@ -17017,7 +17022,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "e1595e83c5ee16acf89d4dcbe2771e09f2e35a09c8e099d048857932388ba571"
+      "sha256": "d18b4f99bb89f935d594020df107c7e7a4db3ea1075a4b48dce33b7312412bb8"
     },
     {
       "path": "tests/projects_hub_render_connect.mjs",
@@ -17102,7 +17107,7 @@
     {
       "path": "tests/provision_restart.mjs",
       "mode": "0000644",
-      "sha256": "caa345e6708d896b42c597a9f83919b4795222e61955c728975d56a873a04fb8"
+      "sha256": "deb9ee70fd9fdc70b25a5dd97ed76200ab10daa7eef3f6ea61bb6d5b7bb50494"
     },
     {
       "path": "tests/provision_settings_apply.mjs",
@@ -17232,7 +17237,7 @@
     {
       "path": "tests/provisioning_restart.mjs",
       "mode": "0000644",
-      "sha256": "c591f3fcf47551575ff99a7da62dc9c68763698bed7144d463a9b11a37d34ee0"
+      "sha256": "5cd2eda5b5e7dd09e96694f7973672c557daa8c8c5197e4dc2ee90eaa30dff21"
     },
     {
       "path": "tests/provisioning_runner_drift_notice.mjs",
@@ -17247,7 +17252,7 @@
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "432e7122f9ab59de28f46d9bdc342c1387a799b2b567c26c1d019b57ae40ac92"
+      "sha256": "2a5645624375b0d4386e12af1e437bdefc41b60d0d3f0b7b2c1a6c53f6a2e06f"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",

package/clients/bongos-client/index.d.ts

@@ -440,7 +440,7 @@ export interface PostMinglePairsIdDecideResponse { pair: unknown }
 export interface PostMingleRoundRequest { limit?: number }
 export interface PostMingleRoundResponse { paired: unknown; count: unknown; skipped: unknown }
 export interface PostModulesKeyEnableRequest { enabled?: unknown }
-export interface PostModulesKeyEnableResponse { ok: boolean; key: unknown; enabled: unknown; effective: unknown; source: unknown; note: unknown }
+export interface PostModulesKeyEnableResponse { ok: boolean; key: unknown; enabled: unknown; effective: unknown; source: unknown; restart_pending: unknown; note: unknown }
 export interface PostModulesKeySubmitRequest { signed_by?: string }
 export interface PostModulesKeySubmitResponse { ok: boolean; submission: unknown }
 export interface PostMyProjectsClientIdLeaveResponse { ok: boolean; left: unknown }

package/docs/adr/0199-restart-an-unreachable-active-project.md

@@ -47,3 +47,7 @@ None of them came with an action. The pre-UAT hub review (2026-08-24) recorded w
 - **Reporting `healthy:true` as "answering again" on a domained instance** — the loopback probe cannot see what the sweep sees; the card would still say unreachable and the event would read as a lie.
 - **Retrying a restart that left the project down** — restarting a broken instance four more times fixes nothing and ends by overwriting the owner's action with an `error_note`.
 - **Showing the door on every active card** — an always-available Restart invites downtime on projects that are fine, and there is no reading behind it to act on.
+
+## Amendment (task 1004463, 2026-10-14)
+
+The platform's own row (`control-plane`) joins `RESTART_SHAPES`, and decision 7's door shows on it whenever it is `active` with nothing in flight, healthy or not. It is the one exception to "no Restart door on every active card": a module switched on or off in that hall mounts its routes and starts its pollers only at the next restart (the Modules toggle now says so, `restartPendingFor` in `src/module-loader/loader.js`), and the owner's only other way to restart the control plane was a shell on the box. `control-plane-guard.js` already allowed `restart` on that row; the runner routes it to the control-plane executor as it does `settings-apply`.

package/docs/api/openapi.json

@@ -32561,6 +32561,7 @@
           "enabled": {},
           "effective": {},
           "source": {},
+          "restart_pending": {},
           "note": {}
         },
         "required": [
@@ -32569,6 +32570,7 @@
           "enabled",
           "effective",
           "source",
+          "restart_pending",
           "note"
         ]
       },

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2720 strings** across 3 surfaces · 2300 distinct pieces of copy · 2720 certain, 0 heuristic · 240 shown in more than one place.
+**2722 strings** across 3 surfaces · 2302 distinct pieces of copy · 2722 certain, 0 heuristic · 240 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 143 | 1912 |
+| `builders-hall` | `modules/hall-ui/public` | 143 | 1914 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 9 | 708 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8226c979db4d` | 3x | Not now | modules/hall-ui/public/collab.js:668, modules/hall-ui/public/paintbrush.js:119, modules/hall-ui/public/paintbrush.js:183 |
 | … | | _200 more in the JSON registry_ | |
 
-## `builders-hall` — 1912 strings
+## `builders-hall` — 1914 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -356,7 +356,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/project-settings.js:284` |
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/task.js:1022` |
 | `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:1018` |
-| `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:335` |
+| `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:361` |
 | `9912c3835136` | certain | Could not load requests — reload to try again. | `modules/hall-ui/public/collab.js:845` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:504` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:542` |
@@ -376,7 +376,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `64f9d51f0fa2` | certain | Could not load your settings. | `modules/hall-ui/public/settings.js:1199` |
 | `de244c45d916` | certain | Could not load {…} | `modules/hall-ui/public/task.js:1015` |
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
-| `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:314` |
+| `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:340` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:768` |
 | `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:624` |
 | `21a782f1af26` | certain | Could not read what this would bring in: {…}. The check below still applies. | `modules/hall-ui/public/deploy.js:542` |
@@ -877,7 +877,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `43626cff7071` | certain | Nothing of that kind in your sky. | `modules/hall-ui/public/sky-panel.js:123` |
 | `b05a5f8cb074` | certain | Nothing personal is sent. | `modules/hall-ui/public/my-agents.js:429` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:297` |
-| `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:275` |
+| `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:301` |
 | `27c0d872db2d` | certain | Nothing you have typed above is lost by opening this. | `modules/hall-ui/public/ideas.html:155` |
 | `26a07b64f49d` | certain | Now running core {…} | `modules/hall-ui/public/deploy.js:400` |
 | `21cb60a8a96a` | certain | Now running core {…} — but GitHub was not updated. | `modules/hall-ui/public/deploy.js:390` |
@@ -1761,6 +1761,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9eca058c6ad2` | certain | release a thought — one line | `modules/hall-ui/public/goal-map.html:90` |
 | `9eca058c6ad2` | certain | release a thought — one line | `modules/hall-ui/public/thinking.html:98` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:80` |
+| `299dd9d33f53` | certain | restart it | `modules/hall-ui/public/modules.js:129` |
 | `58b4e7a48d86` | certain | reviews from before Tweak Mode | `modules/hall-ui/public/studio.html:143` |
 | `0d677ab4868a` | certain | reviews written on the live site | `modules/hall-ui/public/studio.html:138` |
 | `f37f5043f81b` | certain | ring {…} of {…} · {…} | `modules/hall-ui/public/sky-interaction.js:34` |
@@ -1784,7 +1785,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c8c2551006dc` | certain | skip the tour | `modules/hall-ui/public/goal-map.html:121` |
 | `c8c2551006dc` | certain | skip the tour | `modules/hall-ui/public/thinking.html:122` |
 | `1e737a57eb20` | certain | start governing | `modules/hall-ui/public/city.html:99` |
-| `0215b2cdca8c` | certain | submit for review | `modules/hall-ui/public/modules.js:149` |
+| `0215b2cdca8c` | certain | submit for review | `modules/hall-ui/public/modules.js:175` |
 | `43e6f1592ae3` | certain | submit it in the editor | `modules/hall-ui/public/studio.js:829` |
 | `9ec19e32f86f` | certain | submit page | `modules/hall-ui/public/tweak-editor.html:68` |
 | `da30b952a60b` | certain | system / unattributed | `modules/hall-ui/public/goals-page.js:284` |
@@ -1852,6 +1853,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8cd3cc4005fc` | certain | via goal | `modules/hall-ui/public/dom-utils.js:441` |
 | `007b28a56031` | certain | view diff | `modules/hall-ui/public/gate.js:160` |
 | `18cf722bdd7e` | certain | waiting · | `modules/hall-ui/public/sky-interaction.js:128` |
+| `354861d3c2ce` | certain | waits for a restart | `modules/hall-ui/public/modules.js:127` |
 | `35be9e0923da` | certain | walks the whole path in plain language. | `modules/hall-ui/public/hall-render.js:837` |
 | `db42054582ed` | certain | wells · | `modules/hall-ui/public/sky-interaction.js:129` |
 | `17705daf7b85` | certain | what counts as passing | `modules/hall-ui/public/government.html:55` |
@@ -1886,7 +1888,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6c08bfe92e2b` | certain | {…} This project is invite-only: the {…} invites each builder, and there is nothing to apply for here. | `modules/hall-ui/public/hall-render.js:292` |
 | `c5623d60015d` | certain | {…} Your standing is {…}. | `modules/hall-ui/public/hall-render.js:850` |
 | `a91e1e702d4d` | certain | {…} achieved, {…} in progress, {…} not started of {…} goals | `modules/hall-ui/public/roadmap.js:73` |
-| `a65d371b5cb3` | certain | {…} and above can enable or disable a module | `modules/hall-ui/public/modules.js:147` |
+| `a65d371b5cb3` | certain | {…} and above can enable or disable a module | `modules/hall-ui/public/modules.js:173` |
 | `98b1c674fc37` | certain | {…} and up | `modules/hall-ui/public/sessions.js:289` |
 | `111b71a9acaf` | certain | {…} and up. | `modules/hall-ui/public/sessions.js:287` |
 | `56b00d773232` | certain | {…} and {…} | `modules/hall-ui/public/profile-nudge.js:77` |
@@ -1924,7 +1926,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1a8a6267e490` | certain | {…} unfinished task{…} — say what happens to each | `modules/hall-ui/public/goals-render.js:1042` |
 | `2f75f69cdb2f` | certain | {…} {…} changed | `modules/hall-ui/public/profile-crafts.js:218` |
 | `8186b562553a` | certain | {…} {…} waiting | `modules/hall-ui/public/work.js:420` |
-| `a9216af9b05e` | certain | {…} {…} — how-to | `modules/hall-ui/public/modules.js:390` |
+| `a9216af9b05e` | certain | {…} {…} — how-to | `modules/hall-ui/public/modules.js:416` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/watch.js:514` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/work.js:265` |
 | `b3757ba3bb46` | certain | {…} · Stored encrypted; never shown again after saving. | `modules/hall-ui/public/settings.js:873` |
@@ -1932,7 +1934,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d73256fbc395` | certain | {…} · who votes, and how it {…} | `modules/hall-ui/public/board-room.js:460` |
 | `cab2a4296aec` | certain | {…} · {…} · {…}{…} | `modules/hall-ui/public/goal-inbox.js:458` |
 | `1ac723849449` | certain | {…} · {…}{…} | `modules/hall-ui/public/sky-interaction.js:33` |
-| `ddd2bfc1fb60` | certain | {…} — how to use it | `modules/hall-ui/public/modules.js:392` |
+| `ddd2bfc1fb60` | certain | {…} — how to use it | `modules/hall-ui/public/modules.js:418` |
 | `085f93f3f775` | certain | {…} — see all standings | `modules/hall-ui/public/hall-render.js:80` |
 | `2a2728a4ec4f` | certain | {…}% of tasks complete | `modules/hall-ui/public/roadmap.js:63` |
 | `15e545eb3ce2` | certain | {…}, no such task | `modules/hall-ui/public/task.js:1002` |
@@ -1947,7 +1949,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `97e27ab169ae` | certain | {…}{…} session{…} across {…} builder{…}. | `modules/hall-ui/public/sessions.js:443` |
 | `3d74668f69e5` | certain | {…}{…} · {…} | `modules/hall-ui/public/task.js:639` |
 | `7f79bedecf60` | certain | {…}{…} — open it to see what went | `modules/hall-ui/public/goal-inbox.js:374` |
-| `1026fd5f68b7` | certain | · version | `modules/hall-ui/public/modules.js:395` |
+| `1026fd5f68b7` | certain | · version | `modules/hall-ui/public/modules.js:421` |
 | `4a5ff4f662df` | certain | — ${…} of ${…} this month ({…}%). {…} | `modules/hall-ui/public/hall-render.js:523` |
 | `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:711` |
 | `729d4ce22b99` | certain | — any — | `modules/hall-ui/public/hall-widgets.js:163` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2720,
-    "unique_ids": 2300,
-    "certain": 2720,
+    "strings": 2722,
+    "unique_ids": 2302,
+    "certain": 2722,
     "heuristic": 0,
     "duplicate_ids": 240
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 143,
-      "strings": 1912
+      "strings": 1914
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -5091,7 +5091,7 @@
       "surface": "builders-hall",
       "text": "Could not load modules.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 335,
+      "line": 361,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5271,7 +5271,7 @@
       "surface": "builders-hall",
       "text": "Could not reach the submit endpoint.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 314,
+      "line": 340,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9780,7 +9780,7 @@
       "surface": "builders-hall",
       "text": "Nothing to submit — every module here ships with the core.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 275,
+      "line": 301,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -17731,6 +17731,15 @@
       "origin": "html-attr:placeholder",
       "confidence": "certain"
     },
+    {
+      "id": "299dd9d33f53",
+      "surface": "builders-hall",
+      "text": "restart it",
+      "file": "modules/hall-ui/public/modules.js",
+      "line": 129,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "58b4e7a48d86",
       "surface": "builders-hall",
@@ -17943,7 +17952,7 @@
       "surface": "builders-hall",
       "text": "submit for review",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 149,
+      "line": 175,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18550,6 +18559,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "354861d3c2ce",
+      "surface": "builders-hall",
+      "text": "waits for a restart",
+      "file": "modules/hall-ui/public/modules.js",
+      "line": 127,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "35be9e0923da",
       "surface": "builders-hall",
@@ -18861,7 +18879,7 @@
       "surface": "builders-hall",
       "text": "{…} and above can enable or disable a module",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 147,
+      "line": 173,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19203,7 +19221,7 @@
       "surface": "builders-hall",
       "text": "{…} {…} — how-to",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 390,
+      "line": 416,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -19275,7 +19293,7 @@
       "surface": "builders-hall",
       "text": "{…} — how to use it",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 392,
+      "line": 418,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -19410,7 +19428,7 @@
       "surface": "builders-hall",
       "text": "· version",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 395,
+      "line": 421,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3077,5 +3077,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.118 with no explicit bump. run 38574092141. (task 1002620)
   1.21.120 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.119 with no explicit bump. run 38597828843. (task 1002620)
+  1.21.121 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.120 with no explicit bump. run 38604777189. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -1875,7 +1875,7 @@
       "surface": "builders",
       "title": "Modules",
       "states_read": ["browse","search-empty","lens","details","out"],
-      "files_hash": "22c9622ad3cbe0da",
+      "files_hash": "c1d5725a6bf0afe2",
       "reading_hash": "e37d27e205c7ba63",
       "counts": {"lines":48,"placed":19,"shared":8,"unplaced":21},
       "omitted": {"data":76},
@@ -1917,7 +1917,7 @@
         {"key":"L0034","section":"Module catalog","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07"},
         {"key":"L0035","section":"Module catalog","text":"sessions","placement":"placed","file":"modules/hall-ui/public/task.js","line":467,"string_id":"732b4c935e36"},
         {"key":"L0036","section":"Module catalog","text":"Built by this project","placement":"placed","file":"modules/hall-ui/public/modules.html","line":70,"string_id":"b51edc826cbe"},
-        {"key":"L0037","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":149,"string_id":"0215b2cdca8c"},
+        {"key":"L0037","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":175,"string_id":"0215b2cdca8c"},
         {"key":"L0038","section":"Module catalog","text":"A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":74,"string_id":"2e17d7e236d9"},
         {"key":"L0039","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":520,"string_id":"1883ad7f07fc"},
         {"key":"L0040","section":"Module catalog","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":810,"string_id":"fd1903586e8e"},
@@ -5129,7 +5129,7 @@
       "surface": "landing",
       "title": "{{productName}} — projects",
       "states_read": ["out-map","in-map","in-map-projects","in-map-profile","in-map-kbd","in-map-search","in-map-mine-on","in-table","in-table-by-builders","in-mine","in-manage","in-manage-address","in-manage-planet","in-manage-card","in-manage-look","in-manage-kind","in-manage-invite","in-manage-invite-handoff","in-manage-invite-guild","in-manage-app-live","in-manage-app-building","in-manage-app-failed","in-manage-app-retry","in-manage-app-offer","in-manage-app-connect","in-manage-snag","in-manage-gone","in-manage-missing","out-manage","in-new","in-new-named","in-new-ready","in-new-name-prefilled","in-new-demo","in-new-demo-used","in-new-checks-filled","in-new-checks-entity","in-new-row-code","in-new-row-address","in-new-row-team","in-new-row-extras","in-new-row-rewards","in-new-row-app","in-new-row-run","in-new-row-ship","in-new-look","in-new-look-custom","in-new-create-blocked","in-new-done","in-new-resume-offer","out-new","out-map-projects","card","card-noart","card-self","in-manage-demo","in-mine-dns-pending","in-manage-dns-pending","in-mine-empty","card-floor","card-backdrop","in-new-done-live","setup-just-created","setup-waiting-on-github","setup-installing","setup-stopped","setup-all-done","setup-cloud-hop-open"],
-      "files_hash": "82d94c8932993dbd",
+      "files_hash": "6c567b2c13fd0fc6",
       "reading_hash": "302909900601b80c",
       "counts": {"lines":825,"placed":246,"shared":21,"unplaced":558},
       "omitted": {"data":150},

package/modules/hall-ui/public/modules.js

@@ -113,6 +113,32 @@
     return '<span class="fact-pill fact-pill--warn" title="Taken out of the store. Your copy keeps working, but it will get no more updates.">delisted · no more updates</span>';
   }
 
+  // A toggle this server has not acted on yet (task 1004463): routes mount and pollers
+  // start once, at boot, so the change lands at the next restart.
+  // The words are the server's (restartNote in src/bongos/routes/modules.js): 'routes' are
+  // its pages, 'pollers' its background jobs, and only what actually waits is named.
+  function restartFact(m) {
+    const waits = Array.isArray(m.restart_pending) ? m.restart_pending : [];
+    if (!waits.length) return '';
+    const parts = m.enabled
+      ? [waits.includes('routes') && 'its pages do not open', waits.includes('pollers') && 'its background jobs do not run']
+      : [waits.includes('routes') && 'its pages still open', waits.includes('pollers') && 'its background jobs still run'];
+    const title = `It turns ${m.enabled ? 'on' : 'off'} at the next restart of this server. Until then ${parts.filter(Boolean).join(' and ')}.`;
+    const pill = `<span class="fact-pill fact-pill--warn" title="${escapeHtml(title)}">waits for a restart</span>`;
+    const door = restartDoor();
+    return door ? pill + `<a class="fact-pill" href="${escapeHtml(door)}">restart it</a>` : pill;
+  }
+  // Where this server's Restart button is: only the platform's own hall has one, on its
+  // project page on the hub (task 1004463). Elsewhere whoever runs the server restarts it.
+  function restartDoor() {
+    const hub = window.OTB && typeof window.OTB.hubOrigin === 'function' ? window.OTB.hubOrigin() : null;
+    if (!hub) return null;
+    let hubHost = '';
+    try { hubHost = new URL(hub).hostname; } catch (err) { return null; }
+    const here = String(window.location.hostname || '').replace(/^builders\./, '');
+    return here === hubHost ? `${hub}/projects?view=mine` : null;
+  }
+
   // The lines the row's details disclosure opens onto: the facts the payload
   // carries that the card never rendered — what the module contributes, the
   // core it needs, who maintains it and what it hands off to.
@@ -159,7 +185,7 @@
         <div class="ov-row__main">
           <span class="ov-row__title">${escapeHtml(m.title || m.key)}<span class="ov-mono">${escapeHtml(m.key)}</span></span>
           ${desc ? `<p class="ov-row__sub mod-row__desc">${escapeHtml(desc)}</p>` : ''}
-          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}</div>
+          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}${restartFact(m)}</div>
           ${lines ? `<details class="mod-more"${openKeys.has(m.key) ? ' open' : ''}><summary aria-label="Details for ${escapeHtml(m.title || m.key)}"></summary>${lines}</details>` : ''}
         </div>
         <div class="ov-row__right mod-row__right">${rightHtml(m)}</div>
@@ -289,13 +315,13 @@
       const body = res.data || {};
       if (!res.ok) throw new Error(body.message || `enable → ${res.status}`);
       const m = allModules.find((x) => x.key === key);
-      if (m) m.enabled = next;
+      if (m) { m.enabled = next; if (Array.isArray(body.restart_pending)) m.restart_pending = body.restart_pending; }
       btn.setAttribute('aria-pressed', next ? 'true' : 'false');
       btn.textContent = next ? 'enabled' : 'disabled';
       const figs = $('#mod-figs');
       if (figs) figs.innerHTML = figsHTML();
       renderRows();
-      toast(body.note || (next ? `${key} enabled.` : `${key} disabled.`), { duration: 3200 });
+      toast(body.note || (next ? `${key} enabled.` : `${key} disabled.`), { duration: body.restart_pending && body.restart_pending.length ? 7000 : 3200 });
     } catch (err) {
       console.error('[modules] toggle failed', err);
       toast(err.message || 'Could not change that module.', { duration: 3200 });

package/modules/provisioning/provisioning.js

@@ -123,9 +123,11 @@ const SETTINGS_APPLY_SHAPES = new Set(['co-tenant', 'cloud-host', 'control-plane
 // SETTINGS_APPLY_FROM: each action declaring its own gate is this module's
 // convention, and the two answer different questions.
 const RESTART_FROM = new Set(['active']);
-// Same reachability rule as the settings push (the runner can only restart what it runs),
-// minus 'control-plane': task 1004334 gave the self row a settings push, not a restart door.
-const RESTART_SHAPES = new Set(['co-tenant', 'cloud-host']);
+// Same reachability rule as the settings push (the runner can only restart what it runs).
+// 'control-plane' joined in task 1004463: a module toggled in its hall takes effect only at
+// the next restart, the guard already allows 'restart' on the self row, and the owner's only
+// other way was a shell on the box.
+const RESTART_SHAPES = new Set(['co-tenant', 'cloud-host', 'control-plane']);
 
 // Per-project settings (task 1003040, goal 1000058): the known keys + their
 // vocabularies, enforced at the API layer — the jsonb `settings` column

package/modules/public-landing/public/projects.html

@@ -8541,9 +8541,11 @@ summary{min-height:24px;padding:3px 0;}
      last_verified_up === false is the verdict; null means never probed and is
      deliberately NOT the same claim (publicInstance keeps the two apart), so a
      brand-new project never grows a Restart button it has no use for. A door on
-     every healthy card would only invite needless downtime. */
+     every healthy card would only invite needless downtime. The ONE exception is the
+     platform's own row (task 1004463): a module switched on or off in its hall waits for
+     a restart, so its owner always has the door. */
   function canRestart(inst) {
-    return inst.status === 'active' && inst.last_verified_up === false && !inst.open_intent;
+    return inst.status === 'active' && !inst.open_intent && (inst.last_verified_up === false || inst.hosting_shape === 'control-plane');
   }
   /* keep watching while the platform is doing something to this instance */
   function shouldWatch(inst) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.120",
+  "version": "1.21.121",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.120",
+      "version": "1.21.121",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.120",
+  "version": "1.21.121",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9702,5 +9702,11 @@
       "id": "1004410",
       "text": "The new-project page no longer says GitHub sign-in is unfinished when it already works: the platform now checks the project itself and ticks the step."
     }
+  ],
+  "1.21.121": [
+    {
+      "id": "1004463",
+      "text": "Turning a module on or off now says honestly when it takes effect at the next restart, and the platform's own server can be restarted from its project page instead of needing a login to the machine."
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -91,7 +91,7 @@ const EXEMPTIONS = [
        + 're-opens for review.',
   },
   {
-    at: 'src/module-loader/loader.js:196',
+    at: 'src/module-loader/loader.js:198',
     why: 'The plugin loader, and the second site the audit named (B50 "motivating sites"). It '
        + 'require()s a discovered module\'s route file, so the specifier is a runtime path BY '
        + 'DESIGN — a plugin system whose module paths are compile-time constants is not a plugin '
@@ -103,7 +103,7 @@ const EXEMPTIONS = [
        + 'absorbed into this check.',
   },
   {
-    at: 'src/module-loader/loader.js:309',
+    at: 'src/module-loader/loader.js:347',
     why: 'The poller twin of the route require at :196 — same DEFAULT_ROOTS bound, same plugin-by-'
        + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
        + 'change to either call re-opens only that one.',

package/scripts/gds/provision.js

@@ -927,8 +927,10 @@ async function settingsApplyInstance(inst, deps) {
 // ---------------------------------------------------------------------------
 async function restartInstance(inst, deps) {
   const { db, provisioning, exec, log, apply, privileged } = deps;
-  // Same box routing as settingsApplyInstance: a standalone runs control-plane-local.
-  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
+  // Same box routing as settingsApplyInstance: a standalone runs control-plane-local, and the
+  // control plane's own row IS this box (task 1004463).
+  const onControlBox = inst.hosting_shape === 'cloud-host' || inst.hosting_shape === 'control-plane';
+  const boxExec = onControlBox ? (deps.controlExec || exec) : exec;
   const sudoP = privileged ? 'sudo ' : '';
   log(`restart ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
 

package/src/bongos/routes/modules.js

@@ -77,6 +77,8 @@ const express = require('express');
 const auth = require('../auth');
 const { asyncHandler, validateOrRespond, LIMITS } = require('./_helpers');
 const loader = require('../../module-loader/loader');
+// named, not loader.restartPendingFor: knip sees a named require, never a member read
+const { restartPendingFor } = require('../../module-loader/loader');
 const catalog = require('../../module-loader/catalog');
 const modulesLib = require('../../modules');
 // scripts/gds/ is a sibling CORE-package dir (both resolve under
@@ -110,6 +112,15 @@ const log = require('../logger').logger.child({ src: 'modules' });
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog } = require('../module-listing');
 
+// The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
+// module's pages, 'pollers' its background jobs. PURE.
+function restartNote(waits, enabled) {
+  const parts = enabled
+    ? [waits.includes('routes') && 'its pages do not open', waits.includes('pollers') && 'its background jobs do not run']
+    : [waits.includes('routes') && 'its pages still open', waits.includes('pollers') && 'its background jobs still run'];
+  return `It turns ${enabled ? 'on' : 'off'} at the next restart of this server. Until then ${parts.filter(Boolean).join(' and ')}.`;
+}
+
 // A packaged submission embeds every file's content (base64) — cap the total
 // so a runaway/misbuilt module can't bloat the review-queue table. Generous
 // headroom over what a real feature module carries (routes + migrations + UI
@@ -258,6 +269,8 @@ module.exports = function buildModulesRouter() {
         ? `/builders/modules?howto=${encodeURIComponent(m.key)}&version=${encodeURIComponent(String(m.version))}`
         : null;
       m.store_delisted = m.source === 'instance' && delistedKeys.has(m.key);
+      // what of this module still waits for a restart to match its toggle (task 1004463)
+      m.restart_pending = restartPendingFor(m.key, m.enabled === true);
     }
     res.json({
       modules: all,
@@ -297,6 +310,9 @@ module.exports = function buildModulesRouter() {
       // the write path deliberately is not.
       const resolvedSet = await setOverride(key, enabled, { builderId: req.builder && req.builder.id });
       const effective = resolvedSet ? resolvedSet[key] === true : enabled;
+      // Routes mount and pollers start once, at boot (task 1004463): say so rather than
+      // "live now" when this change waits for the next restart of this server.
+      const waits = restartPendingFor(key, effective);
 
       console.log(`[gds] module "${key}" ${enabled ? 'enabled' : 'disabled'} by builder ${req.builder && req.builder.id}`);
       res.json({
@@ -308,9 +324,12 @@ module.exports = function buildModulesRouter() {
         // who is not told so will re-click the toggle and blame the feature.
         effective,
         source: (resolvedSet && resolvedSet.sources && resolvedSet.sources[key]) || 'override',
-        note: effective === enabled
-          ? 'Live on this box now, and durable — it survives the next deploy.'
-          : `Recorded, but "${key}" still resolves to ${effective}: a higher-precedence layer (env, or the spend guard) is winning.`,
+        restart_pending: waits,
+        note: effective !== enabled
+          ? `Recorded, but "${key}" still resolves to ${effective}: a higher-precedence layer (env, or the spend guard) is winning.`
+          : waits.length
+            ? `Saved, and it survives the next deploy. ${restartNote(waits, enabled)}`
+            : 'Live on this box now, and durable — it survives the next deploy.',
       });
     }));
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.120'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.121'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/module-loader/loader.js

@@ -112,7 +112,7 @@ function discoverModules({ roots = DEFAULT_ROOTS, core = coreVersion() } = {}) {
 // Cached singleton for app code (lazy, like src/modules.js's modules()).
 let _cache = null;
 function discovered(opts) { return (_cache ||= discoverModules(opts)); }
-function _reset() { _cache = null; _startedPollers = []; }
+function _reset() { _cache = null; _startedPollers = []; _boot = { routes: null, pollers: null }; _bootShape = null; }
 
 // The discovered manifests as MODULE_REGISTRY-shaped entries, so src/modules.js
 // can merge them with its built-in registry. Empty until a module exists.
@@ -190,8 +190,10 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
   const enabled = enabledModules({ isEnabled }, opts);
   verifyEnabledPorts(enabled);
   let mounted = 0;
-  for (const { dir, manifest } of enabled) {
+  _boot.routes = new Set();
+  for (const { key, dir, manifest } of enabled) {
     const routeKeys = (manifest.contributes && manifest.contributes.routes) || [];
+    if (routeKeys.length) _boot.routes.add(key);
     for (const rk of routeKeys) {
       const factory = require(path.join(dir, 'routes', `${rk}.js`));
       const sub = typeof factory === 'function' ? factory() : factory;
@@ -284,6 +286,41 @@ function moduleWebSurfaces({ isEnabled } = {}, opts) {
   return out;
 }
 
+// What this process mounted at boot (task 1004463): the keys whose routes were mounted
+// and whose pollers started. null until that boot step has run in this process — so a
+// script or test that never booted is never told a restart is pending.
+let _boot = { routes: null, pollers: null };
+// key → { routes, pollers }: whether each discovered module mounts routes / runs a poller in
+// this process. Module files do not change under a running process, so it is worked out
+// once, on first ask, rather than stat'ing disk on every GET /modules.
+let _bootShape = null;
+function bootShape(opts) {
+  if (_bootShape) return _bootShape;
+  _bootShape = new Map();
+  for (const { key, dir, manifest } of discovered(opts).loaded) {
+    const c = manifest.contributes || {};
+    _bootShape.set(key, {
+      routes: (c.routes || []).length > 0,
+      // the same rule startModulePollers applies: a poller with no file here runs elsewhere
+      pollers: (c.pollers || []).some((pk) => fs.existsSync(path.join(dir, 'pollers', `${pk}.js`))),
+    });
+  }
+  return _bootShape;
+}
+
+// Does turning module `key` to `enabled` wait for a restart in THIS process (task
+// 1004463)? Routes mount and pollers start once, at boot, so a module switched on after
+// boot has no pages yet, and one switched off keeps answering until the restart. Returns
+// what waits — [] when the change is live now. PURE over the boot record and the manifest.
+function restartPendingFor(key, enabled, opts) {
+  const shape = bootShape(opts).get(key);
+  if (!shape) return [];
+  const waits = [];
+  if (_boot.routes && shape.routes && _boot.routes.has(key) !== !!enabled) waits.push('routes');
+  if (_boot.pollers && shape.pollers && _boot.pollers.has(key) !== !!enabled) waits.push('pollers');
+  return waits;
+}
+
 // Started poller handles (key, name, module), so stopModulePollers stops exactly
 // what startModulePollers started — and a test can introspect them.
 let _startedPollers = [];
@@ -299,6 +336,7 @@ let _startedPollers = [];
 // No-op when nothing is discovered/enabled. Returns the started-handle list.
 function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
   const started = [];
+  _boot.pollers = new Set();
   for (const { key, dir, manifest } of discovered(opts).loaded) {
     if (typeof isEnabled === 'function' && !isEnabled(key)) continue;
     const pollerKeys = (manifest.contributes && manifest.contributes.pollers) || [];
@@ -323,6 +361,7 @@ function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
             r.catch((e) => console.error(`[module-loader] poller ${key}/${pk} start error: ${e && e.message ? e.message : e}`));
           }
           started.push({ key, poller: pk, handle: poller });
+          _boot.pollers.add(key);
         }
       } catch (e) {
         console.error(`[module-loader] poller ${key}/${pk} start threw: ${e && e.message ? e.message : e}`);
@@ -370,6 +409,7 @@ module.exports = {
   moduleWebSurfaces,
   startModulePollers,
   stopModulePollers,
+  restartPendingFor,
   loaderSnapshot,
   coreVersion,
   dedupeRoots,

package/tests/hall_catalog_world.mjs

@@ -58,7 +58,7 @@ test('modules: the row is the oversight row — title with the mono key, clamped
   assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
   assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
   assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
-  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}<\/div>/, 'provenance, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill are the facts line');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}\$\{restartFact\(m\)\}<\/div>/, 'provenance, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill and (task 1004463) the waits-for-a-restart pill are the facts line');
   assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
   const css = read('modules.css');
   assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');

package/tests/module_loader.mjs

@@ -462,3 +462,34 @@ test('the demo proof module mounts + serves through the loader (BV1.R52 / task 1
   assert.deepEqual(routes.sort(), ['GET /demo/health', 'POST /demo/ping']);
   loader._reset();
 });
+
+// ---------------------------------------------------------------------------
+// task 1004463 — a toggle says whether it waits for a restart. Routes mount and pollers
+// start once, at boot, so restartPendingFor compares the toggle with what THIS process
+// mounted; the Modules toggle used to claim "Live on this box now" regardless.
+// ---------------------------------------------------------------------------
+
+test('task 1004463: restartPendingFor names what waits for a restart, and nothing before boot', () => {
+  loader._reset();
+  const factory = "module.exports = () => function moduleRoute(req, res, next) { next(); };";
+  const poller = 'module.exports = { start() {}, stop() {} };';
+  const root = fixtureRoot({
+    pages: { manifest: validManifest('pages', { contributes: { routes: ['main'] } }), files: { 'routes/main.js': factory } },
+    jobs: { manifest: validManifest('jobs', { contributes: { routes: ['main'], pollers: ['tick'] } }), files: { 'routes/main.js': factory, 'pollers/tick.js': poller } },
+    remote: { manifest: validManifest('remote', { contributes: { pollers: ['elsewhere'] } }) },
+    quiet: { manifest: validManifest('quiet') },
+  });
+  const opts = { roots: [root], core: '1.0.0' };
+  assert.deepEqual(loader.restartPendingFor('pages', true, opts), [], 'a process that never booted is never told a restart is pending');
+  const bootOn = (k) => k === 'jobs';
+  loader.mountModuleRoutes({ use: () => {} }, { isEnabled: bootOn }, opts);
+  loader.startModulePollers({}, { isEnabled: bootOn }, opts);
+  assert.deepEqual(loader.restartPendingFor('pages', true, opts), ['routes'], 'switched on after boot: its pages wait');
+  assert.deepEqual(loader.restartPendingFor('pages', false, opts), [], 'back off: matches what is mounted');
+  assert.deepEqual(loader.restartPendingFor('jobs', false, opts), ['routes', 'pollers'], 'switched off after boot: pages and jobs keep running');
+  assert.deepEqual(loader.restartPendingFor('jobs', true, opts), []);
+  assert.deepEqual(loader.restartPendingFor('remote', true, opts), [], 'a poller with no file here never runs in this process');
+  assert.deepEqual(loader.restartPendingFor('quiet', true, opts), [], 'nothing mounted at boot, nothing to wait for');
+  assert.deepEqual(loader.restartPendingFor('nope', true, opts), []);
+  loader._reset();
+});

package/tests/module_toggle_restart.mjs

@@ -0,0 +1,73 @@
+// tests/module_toggle_restart.mjs — task 1004463.
+//
+// Measured on cloudbongos.com: switching a module on stored the override and the toggle
+// said "Live on this box now", but the module's pages stayed 404 until the next restart,
+// because routes mount (and pollers start) once, at boot. The toggle now asks the loader
+// what still waits (restartPendingFor) and says so; GET /modules carries the same field
+// so the hall can show "waits for a restart" on the row.
+//
+// Hermetic: setOverride is stubbed BEFORE the route file binds it, and the loader's
+// answer is stubbed on the loader object the route calls through. The loader's own rule
+// is tests/module_loader.mjs (task 1004463 case).
+//
+// Run:  node --test tests/module_toggle_restart.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const overrides = require('../src/bongos/module-overrides.js');
+overrides.setOverride = async (key, enabled) => ({ [key]: enabled, sources: { [key]: 'override' } });
+const loader = require('../src/module-loader/loader.js');
+// the route binds restartPendingFor at require time, so stub it BEFORE the route loads and
+// let each case choose the answer through `pending`
+let pending = () => [];
+loader.restartPendingFor = (...a) => pending(...a);
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+
+function handlerFor(router, method, path) {
+  const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${path} on the router`);
+  return layer.route.stack[layer.route.stack.length - 1].handle;
+}
+async function invoke(handler, req) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    fail(code, opts) { this.body = { error: code, ...opts }; return this; },
+  };
+  let err = null;
+  await handler(req, res, (e) => { err = e; });
+  if (err) throw err;
+  return res;
+}
+const router = buildModulesRouter();
+const key = buildModulesRouter.listModules()[0].key;
+const toggle = (enabled) => invoke(handlerFor(router, 'post', '/modules/:key/enable'), { params: { key }, query: {}, body: { enabled }, builder: { id: 1 } });
+
+test('a toggle that waits for a restart says so, instead of "live now"', async () => {
+  pending = () => ['routes', 'pollers'];
+  const on = await toggle(true);
+  assert.deepEqual(on.body.restart_pending, ['routes', 'pollers']);
+  assert.doesNotMatch(on.body.note, /Live on this box now/);
+  assert.equal(on.body.note, 'Saved, and it survives the next deploy. It turns on at the next restart of this server. Until then its pages do not open and its background jobs do not run.');
+  pending = () => ['routes'];
+  const off = await toggle(false);
+  assert.equal(off.body.note, 'Saved, and it survives the next deploy. It turns off at the next restart of this server. Until then its pages still open.');
+});
+
+test('a toggle with nothing waiting is still live now', async () => {
+  pending = () => [];
+  const r = await toggle(true);
+  assert.deepEqual(r.body.restart_pending, []);
+  assert.equal(r.body.note, 'Live on this box now, and durable — it survives the next deploy.');
+});
+
+test('GET /modules carries restart_pending on every row', async () => {
+  pending = (k) => (k === key ? ['routes'] : []);
+  const r = await invoke(handlerFor(router, 'get', '/modules'), { params: {}, query: {}, body: {} });
+  for (const m of r.body.modules) assert.ok(Array.isArray(m.restart_pending), `${m.key} carries restart_pending`);
+  assert.deepEqual(r.body.modules.find((m) => m.key === key).restart_pending, ['routes']);
+});

package/tests/projects_hub_pre_uat.mjs

@@ -86,7 +86,10 @@ test('the restart door appears ONLY where it has a reason to exist, and mirrors
   // task 1004182 folded into 'cloud-host'. A `!== 'dedicated'` test against a value no row
   // can hold is always true, so keeping it would have been a condition that reads like a
   // guard and guards nothing.
-  assert.doesNotMatch(body, /hosting_shape/, 'no shape term survives — the one it excluded no longer exists');
+  // task 1004463: the ONE shape term is an inclusion — the platform's own row always has the
+  // door, because a module toggled in its hall waits for a restart
+  assert.match(body, /inst.last_verified_up === false || inst.hosting_shape === 'control-plane'/, 'the self row is the one healthy card with a door');
+  assert.doesNotMatch(body, /dedicated/, 'the shape it once excluded no longer exists');
   assert.match(body, /!inst\.open_intent/, 'the strip tells the story while work is in flight');
 });
 

package/tests/provision_restart.mjs

@@ -167,9 +167,9 @@ await ta('dry-run runs no real work and observes nothing', async () => {
   assert.equal(writes.length, 0);
 });
 
-await ta('a co-tenant restarts on the co-hosting box; a cloud-host on the control plane', async () => {
+await ta("a co-tenant restarts on the co-hosting box; a cloud-host and the platform's own row on the control plane", async () => {
   const seen = {};
-  for (const shape of ['co-tenant', 'cloud-host']) {
+  for (const shape of ['co-tenant', 'cloud-host', 'control-plane']) {
     const box = [], control = [];
     const { deps } = recorder();
     deps.exec = (cmd) => { box.push(cmd); return /healthz/.test(cmd) ? { ok: true, stdout: '{}' } : { ok: true, stdout: '' }; };
@@ -179,6 +179,7 @@ await ta('a co-tenant restarts on the co-hosting box; a cloud-host on the contro
   }
   assert.ok(seen['co-tenant'].box > 0 && seen['co-tenant'].control === 0, 'a co-tenant runs on the box');
   assert.ok(seen['cloud-host'].control > 0 && seen['cloud-host'].box === 0, 'a cloud-host runs control-plane-local (task 2074) — restart it THERE');
+  assert.ok(seen['control-plane'].control > 0 && seen['control-plane'].box === 0, 'the self row IS this box (task 1004463)');
 });
 
 await ta('privileged mode escalates the restart', async () => {

package/tests/provisioning_restart.mjs

@@ -89,14 +89,17 @@ t('RESTART_FROM is exactly {active} — every other state is already served by t
   }
 });
 
-t('RESTART_SHAPES is the runner-reachable pair, and the set is a subset of HOSTING_SHAPES', () => {
-  assert.deepEqual([...provisioning.RESTART_SHAPES].sort(), ['cloud-host', 'co-tenant']);
+t('RESTART_SHAPES is what the runner can reach, and the set is a subset of HOSTING_SHAPES', () => {
+  // task 1004463 added the control plane's own row: its hall's module toggles wait for a restart
+  assert.deepEqual([...provisioning.RESTART_SHAPES].sort(), ['cloud-host', 'co-tenant', 'control-plane']);
+  const G = require('../modules/provisioning/control-plane-guard.js');
+  assert.equal(G.intentAllowedForShape('restart', 'control-plane'), true, 'the self-row guard lets the restart through, so the route never promises one it refuses');
   for (const s of provisioning.RESTART_SHAPES) assert.ok(provisioning.HOSTING_SHAPES.includes(s), `${s} is a real shape`);
   // Was `!has('dedicated')`. Task 1004182 removed that value from HOSTING_SHAPES, which made
   // the assertion vacuously true — it would now pass against any set at all. Name the shapes
   // that still EXIST and are still unreachable, and assert they are real first, so this
   // cannot rot the same way twice.
-  for (const unreachable of ['byo-host', 'control-plane']) {
+  for (const unreachable of ['byo-host']) {
     assert.ok(provisioning.HOSTING_SHAPES.includes(unreachable), `${unreachable} must be a real shape or this assertion is vacuous`);
     assert.ok(!provisioning.RESTART_SHAPES.has(unreachable), unreachable);
   }

package/tests/provisioning_settings_apply.mjs

@@ -92,8 +92,8 @@ t('the two gates agree: every settings-apply shape is one the self-row guard let
   // "a restart is coming" and then answer the owner with control_plane_protected.
   const G = require('../modules/provisioning/control-plane-guard.js');
   for (const s of provisioning.SETTINGS_APPLY_SHAPES) assert.equal(G.intentAllowedForShape('settings-apply', s), true, s);
-  // and the restart door was NOT opened on the self row as a side effect
-  assert.ok(!provisioning.RESTART_SHAPES.has('control-plane'), 'task 1004334 widened the settings push only');
+  // the restart door on the self row came later, deliberately (task 1004463)
+  assert.ok(provisioning.RESTART_SHAPES.has('control-plane'), 'task 1004463 opened the restart door on the self row');
 });
 
 await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carries the settings-apply action', async () => {