@bongos/core 1.21.125 → 1.21.127

package/scripts/gds/provision-caps.js

@@ -0,0 +1,63 @@
+// scripts/gds/provision-caps.js — the resource caps every hosted project's service carries
+// (task 1004414). A cloud-host project runs its owner's code on the box that also serves the
+// hub, and ADR 0354 lets any signed-in builder host one, so a runaway project must not be
+// able to starve the others or the hub.
+//
+// The numbers are the owner's (2026-10-15), sized from ADR 0285's measurement: a project
+// idles at ~45-70 MB and peaks at 118-134 MB at boot (page cache included), and uses a
+// fraction of a percent of one core. MemoryHigh throttles and reclaims before MemoryMax
+// kills; a killed project comes back through the unit's Restart=always. Too tight a cap
+// takes a healthy project down, so change these only as a decision.
+//
+// A NEW unit renders them (serviceUnit). An EXISTING unit takes them with `systemctl
+// set-property`, which applies live and persists a drop-in under /etc/systemd/system.control/,
+// so nothing restarts and no unit file is rewritten — rewriting would move a project made
+// before the per-instance accounts (task 1003369) onto an account that does not exist.
+// systemd only: the supervisord image has no cgroups to cap.
+
+'use strict';
+
+const RESOURCE_CAPS = Object.freeze({
+  MemoryHigh: '160M',
+  MemoryMax: '256M',
+  CPUQuota: '50%',
+  TasksMax: '256',
+});
+
+function capDirectives() {
+  return Object.entries(RESOURCE_CAPS).map(([key, value]) => `${key}=${value}`);
+}
+
+// The slug is interpolated into a root shell command, so it is held to the create route's
+// charset here too rather than trusted from the row.
+const SAFE_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+
+function setCapsCmd(inst, { sudoP = '' } = {}) {
+  if (!SAFE_SLUG.test(String(inst.slug))) throw new Error(`refusing to cap an unsafe slug: ${JSON.stringify(inst.slug)}`);
+  return `${sudoP}systemctl set-property ${inst.slug}.service ${capDirectives().join(' ')}`;
+}
+
+// `provision.js apply-caps [--apply]` — cap every running hosted project now. A cloud-host
+// always runs on the control plane (capacity.placementBox), so this uses controlExec. One
+// project that refuses never stops the rest; the result names it.
+async function cmdApplyCaps(deps) {
+  const { db, log, privileged } = deps;
+  const exec = deps.controlExec || deps.exec;
+  const sudoP = privileged ? 'sudo ' : '';
+  const { rows } = await db.query(
+    `SELECT slug FROM provisioning_instances
+      WHERE hosting_shape = 'cloud-host' AND status = 'active'
+      ORDER BY slug`);
+  const capped = [], failed = [];
+  for (const { slug } of rows) {
+    // makeExec answers an allowFail'd failure ok:true + softFailed:true (softFailResult)
+    let r;
+    try { r = exec(setCapsCmd({ slug }, { sudoP }), { allowFail: true }); } catch { r = null; }
+    (!r || r.ok === false || r.softFailed ? failed : capped).push(slug);
+  }
+  log(`${deps.apply ? 'capped' : 'would cap (dry-run — add --apply)'} ${capped.length} of ${rows.length} active hosted project(s) at ${capDirectives().join(' ')}`);
+  if (failed.length) log(`  ✖ could not cap: ${failed.join(', ')} — re-run once each unit is loaded`);
+  return { ok: failed.length === 0, capped, failed };
+}
+
+module.exports = { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps };

package/scripts/gds/provision-process.js

@@ -59,6 +59,9 @@ const systemd = {
     exec(`${sudoP}rm -f ${serviceUnitPath(inst)}`, { allowFail: true });
     exec(`${sudoP}systemctl disable --now ${backupUnitName(inst)}.timer`, { allowFail: true });
     exec(`${sudoP}rm -f ${backupServicePath(inst)} ${backupTimerPath(inst)}`, { allowFail: true });
+    // the caps drop-in `provision.js apply-caps` wrote (task 1004414, provision-caps.js)
+    exec(`${sudoP}rm -f /etc/systemd/system.control/${inst.slug}.service.d/50-*.conf`, { allowFail: true });
+    exec(`${sudoP}rmdir /etc/systemd/system.control/${inst.slug}.service.d`, { allowFail: true });
     exec(`${sudoP}systemctl daemon-reload`, { allowFail: true });
     exec(`${sudoP}systemctl reset-failed ${inst.slug}.service ${backupUnitName(inst)}.service`, { allowFail: true });
   },

package/scripts/gds/provision-units.js

@@ -12,6 +12,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
 const { CORE_PKG_DIR, appUser, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
+const { capDirectives } = require('./provision-caps.js');
 
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
@@ -61,6 +62,8 @@ ProtectSystem=strict
 ProtectHome=read-only
 PrivateTmp=true
 ReadWritePaths=${stateDir} -${workDir}/config
+# Resource caps (task 1004414; the numbers and their reasons are in provision-caps.js).
+${capDirectives().join('\n')}
 
 [Install]
 WantedBy=multi-user.target

package/scripts/gds/provision.js

@@ -1348,6 +1348,7 @@ Commands:
   teardown <slug>        tear down one instance by slug
   reconcile              re-enqueue instances stuck mid-flight with no open intent
   status                 list provisioned instances + estimated run-rate
+  apply-caps             cap every active hosted project's memory/CPU/tasks live (task 1004414)
   dns-check <domain>     PREFLIGHT: verify the control-plane Cloudflare token can reach
                          the domain's zone BEFORE the address step (network-only, no DB)
 
@@ -1397,7 +1398,7 @@ async function main() {
     process.exit(1);
   }
 
-  const known = ['run-intents', 'provision', 'teardown', 'reconcile', 'status'];
+  const known = ['run-intents', 'provision', 'teardown', 'reconcile', 'status', 'apply-caps'];
   if (!known.includes(cmd)) { console.error(`unknown command: ${cmd}\n`); usage(); process.exit(2); }
   const slug = args[1] && !args[1].startsWith('--') ? args[1] : null;
   if ((cmd === 'provision' || cmd === 'teardown') && !slug) { console.error(`${cmd} needs a <slug>`); process.exit(2); }
@@ -1432,6 +1433,7 @@ async function main() {
     else if (cmd === 'teardown') { const inst = await provisioning.getInstanceBySlug(pool, slug); if (!inst) { console.error(`no instance with slug '${slug}'`); await pool.end().catch(() => {}); process.exit(1); } result = await teardownInstance(inst, deps); }
     else if (cmd === 'reconcile') result = await cmdReconcile(deps);
     else if (cmd === 'status') result = await cmdStatus(deps);
+    else if (cmd === 'apply-caps') result = await require('./provision-caps.js').cmdApplyCaps(deps);
   } catch (e) {
     console.error('fatal:', e && e.message ? e.message : e);
     await pool.end().catch(() => {});

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.125'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.127'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/module-loader/error-tally.js

@@ -0,0 +1,188 @@
+// src/module-loader/error-tally.js — count each mounted module's runtime errors
+// per day, so a store module's Reliability score has real installs behind it
+// (task 1004637, follow-up to task 1003793; ADR 0343 D1).
+//
+// WHY. The store scores Reliability from a daily runtime-error count per module
+// version, but nothing on an instance counted one: the loader console.errored a
+// poller that failed to load and attributed nothing else to a module at all. This
+// file is the instance-side tally the loader feeds; scripts/gds/module-error-report.js
+// is the sender that turns it into reports.
+//
+// WHAT COUNTS. A request a module's router took and answered 500 (a thrown error or
+// an unhandled failure — not a 4xx, which is the caller's mistake, and not a 503,
+// which modules use to say "not set up here"); a poller that failed to load, threw
+// or rejected on start; and anything a poller hands to the `reportError` the loader
+// gives it. Only a module whose manifest carries an exact X.Y.Z version is counted,
+// because the store files counts against an exact version.
+//
+// COUNTS ONLY (owner's privacy posture, 2026-10-01). The tally holds module key,
+// version, day and a whole number — never an error's text, a path or a request.
+//
+// WHO SENDS (owner, 2026-10-15). A builder's sign-in on the box: the store's report
+// routes take a builder, and no project-to-store credential exists (parked as
+// task 1004740). So this file never talks to the network. It writes the tally to the
+// instance config dir, and startDailySend() runs the sender as a CHILD process —
+// cli-lib's session plumbing must never load in the server process.
+//
+// Counting is always in memory; nothing touches disk until start() is called, and
+// only the server entrypoint calls it — so a test or tool that mounts modules never
+// writes a file.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const FILE_NAME = 'module-error-counts.json';
+// Days kept on disk. One more than the store accepts (ERROR_DAY_WINDOW = 30), so a
+// day the sender has not reached yet is never pruned before it can go.
+const KEEP_DAYS = 31;
+const FLUSH_DELAY_MS = 5_000;
+const ROLL_CHECK_MS = 60 * 60 * 1000;
+const SEND_EVERY_MS = 6 * 60 * 60 * 1000;
+const FIRST_SEND_DELAY_MS = 10 * 60 * 1000;
+const EXACT_VERSION = /^\d+\.\d+\.\d+$/;
+// The sender, rooted at this file so what the server runs is answerable by reading
+// this line (exec-path-guard, task 1003371).
+const SENDER = path.join(__dirname, '..', '..', 'scripts', 'gds', 'module-error-report.js');
+
+function utcDay(ms = Date.now()) { return new Date(ms).toISOString().slice(0, 10); }
+
+let _now = Date.now;
+let _days = {};          // day → { "key@version": count }
+let _mounted = new Map(); // key → version, for every module seeded today and each new day
+let _file = null;         // set by start(); null = nothing written to disk
+let _flushTimer = null;
+let _timers = [];
+
+function entryOf(key, version) { return `${key}@${version}`; }
+
+// Make sure today has a 0 for every mounted module — a clean day is exactly what
+// Reliability measures, so a module that ran and threw nothing must still appear.
+function seedToday() {
+  const today = utcDay(_now());
+  const row = (_days[today] ||= {});
+  for (const [key, version] of _mounted) {
+    const e = entryOf(key, version);
+    if (!(e in row)) row[e] = 0;
+  }
+  return row;
+}
+
+// Register the modules this process runs. Call once the enabled set is known; a
+// module without an exact version is ignored. Returns how many were registered.
+function seed(modules) {
+  let n = 0;
+  for (const { key, manifest } of modules) {
+    const v = manifest && manifest.version;
+    if (typeof v !== 'string' || !EXACT_VERSION.test(v)) continue;
+    _mounted.set(key, v);
+    n += 1;
+  }
+  seedToday();
+  scheduleFlush();
+  return n;
+}
+
+// Count one runtime error against a mounted module. Unknown or unversioned keys
+// are ignored, so a stray call can never invent a module.
+function record(key) {
+  const version = _mounted.get(key);
+  if (!version) return false;
+  const row = seedToday();
+  row[entryOf(key, version)] += 1;
+  scheduleFlush();
+  return true;
+}
+
+function prune() {
+  const cutoff = utcDay(_now() - KEEP_DAYS * 86_400_000);
+  for (const d of Object.keys(_days)) if (d < cutoff) delete _days[d];
+}
+
+function scheduleFlush() {
+  if (!_file || _flushTimer) return;
+  _flushTimer = setTimeout(() => { _flushTimer = null; flush(); }, FLUSH_DELAY_MS);
+  if (_flushTimer.unref) _flushTimer.unref();
+}
+
+// Write the tally atomically (temp file, then rename), so the sender never reads
+// half a file. Best-effort: a failed write costs a count, never the server.
+function flush() {
+  if (!_file) return false;
+  prune();
+  try {
+    fs.mkdirSync(path.dirname(_file), { recursive: true });
+    const tmp = `${_file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ days: _days }, null, 2));
+    fs.renameSync(tmp, _file);
+    return true;
+  } catch (e) {
+    process.emitWarning(`module error tally: could not write ${_file}: ${e && e.message ? e.message : e}`);
+    return false;
+  }
+}
+
+// Read a tally file. Never throws: a missing or unreadable file is an empty tally.
+function readTally(file) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return parsed && typeof parsed.days === 'object' && parsed.days ? parsed.days : {};
+  } catch { return {}; }
+}
+
+function defaultFile() {
+  return require('../instance-config').configPath(FILE_NAME);
+}
+
+// Persist from now on. Merges what is already on disk (a restart mid-day keeps the
+// morning's count: the higher of the two wins per entry), seeds today, and checks
+// hourly for a new day so a server that runs for a week still files a 0 each day.
+function start({ file = defaultFile(), now } = {}) {
+  if (now) _now = now;
+  _file = file;
+  const onDisk = readTally(file);
+  for (const [day, row] of Object.entries(onDisk)) {
+    const mine = (_days[day] ||= {});
+    for (const [e, n] of Object.entries(row || {})) {
+      if (Number.isInteger(n) && n >= 0) mine[e] = Math.max(mine[e] || 0, n);
+    }
+  }
+  seedToday();
+  flush();
+  const roll = setInterval(() => { seedToday(); flush(); }, ROLL_CHECK_MS);
+  if (roll.unref) roll.unref();
+  _timers.push(roll);
+  return file;
+}
+
+// Run the sender now and then (scripts/gds/module-error-report.js) as a child
+// process. It sends nothing without a builder sign-in on this box, and only days
+// before today, so running it often is cheap and safe. Returns the timers.
+function startDailySend({ spawnImpl } = {}) {
+  const { spawn } = require('node:child_process');
+  const run = spawnImpl || (() => {
+    const child = spawn(process.execPath, [SENDER, '--quiet'], { stdio: 'ignore', detached: false });
+    child.on('error', () => {});
+    if (child.unref) child.unref();
+  });
+  if (!fs.existsSync(SENDER)) return [];
+  const go = () => { try { run(SENDER); } catch { /* best-effort */ } };
+  const first = setTimeout(go, FIRST_SEND_DELAY_MS);
+  const every = setInterval(go, SEND_EVERY_MS);
+  for (const t of [first, every]) if (t.unref) t.unref();
+  _timers.push(first, every);
+  return [first, every];
+}
+
+// The in-memory tally, for tests and a /watch tile.
+function snapshot() { return JSON.parse(JSON.stringify(_days)); }
+
+function _reset() {
+  for (const t of _timers) { clearTimeout(t); clearInterval(t); }
+  if (_flushTimer) clearTimeout(_flushTimer);
+  _timers = []; _flushTimer = null; _days = {}; _mounted = new Map(); _file = null; _now = Date.now;
+}
+
+module.exports = {
+  FILE_NAME,
+  utcDay, seed, record, readTally, start, startDailySend, snapshot, _reset,
+};

package/src/module-loader/loader.js

@@ -112,7 +112,7 @@ function discoverModules({ roots = DEFAULT_ROOTS, core = coreVersion() } = {}) {
 // Cached singleton for app code (lazy, like src/modules.js's modules()).
 let _cache = null;
 function discovered(opts) { return (_cache ||= discoverModules(opts)); }
-function _reset() { _cache = null; _startedPollers = []; _boot = { routes: null, pollers: null }; _bootShape = null; }
+function _reset() { resetErrorTally(); _cache = null; _startedPollers = []; _boot = { routes: null, pollers: null }; _bootShape = null; }
 
 // The discovered manifests as MODULE_REGISTRY-shaped entries, so src/modules.js
 // can merge them with its built-in registry. Empty until a module exists.
@@ -197,10 +197,13 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
     for (const rk of routeKeys) {
       const factory = require(path.join(dir, 'routes', `${rk}.js`));
       const sub = typeof factory === 'function' ? factory() : factory;
-      router.use(sub);
+      router.use(attributeErrors(key, sub));
       mounted += 1;
     }
   }
+  // Every enabled module gets a 0 for today, routes or not: a clean day is what the
+  // store's Reliability score measures (task 1004637).
+  seedErrorTally(enabled);
   return mounted;
 }
 
@@ -352,19 +355,26 @@ function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
         // here. A file that EXISTS but throws is a real error (the catch below).
         if (e && e.code === 'MODULE_NOT_FOUND' && String(e.message).includes(pollerPath)) continue;
         console.error(`[module-loader] poller ${key}/${pk} failed to load: ${e && e.message ? e.message : e}`);
+        recordModuleError(key);
         continue;
       }
       try {
         if (poller && typeof poller.start === 'function') {
-          const r = poller.start(deps);
+          // reportError: how a poller counts a failure in its own runs against its
+          // module (task 1004637) — counts only, it takes no message.
+          const r = poller.start({ ...deps, reportError: () => recordModuleError(key) });
           if (r && typeof r.then === 'function') {
-            r.catch((e) => console.error(`[module-loader] poller ${key}/${pk} start error: ${e && e.message ? e.message : e}`));
+            r.catch((e) => {
+              console.error(`[module-loader] poller ${key}/${pk} start error: ${e && e.message ? e.message : e}`);
+              recordModuleError(key);
+            });
           }
           started.push({ key, poller: pk, handle: poller });
           _boot.pollers.add(key);
         }
       } catch (e) {
         console.error(`[module-loader] poller ${key}/${pk} start threw: ${e && e.message ? e.message : e}`);
+        recordModuleError(key);
       }
     }
   }
@@ -397,9 +407,47 @@ function loaderSnapshot(opts) {
     loaded: d.loaded.map((m) => m.key),
     skipped: d.skipped,
     errors: d.errors,
+    // per-day runtime-error counts per module@version, kept for the store (task 1004637)
+    errorCounts: snapshotErrorTally(),
   };
 }
 
+// Which module took this request, and whether its 500 has been hooked yet.
+const OWNER = Symbol('moduleOwner');
+const HOOKED = Symbol('moduleErrorHooked');
+
+// Wrap a module's router so a request it answers with a 500 counts against that
+// module (task 1004637). The module is the owner from the moment the request enters
+// its router until it falls through (the router calls next() with no error): a request
+// the module never matched is not its fault, and the next module or the kernel takes
+// it from there. An error the module passes on (next(err)) keeps it the owner, so the
+// kernel's error handler answering 500 for it still counts here. Only a 500 counts:
+// a 4xx is the caller's mistake and a 503 is a module saying it is not set up.
+//
+// A plain function rather than a nested express Router, so nothing about mounting
+// changes for the kernel; `stack` is passed through so tooling that reads a mounted
+// router's routes still sees the module's own.
+function attributeErrors(key, sub) {
+  const scoped = function moduleScoped(req, res, next) {
+    const prev = req[OWNER];
+    req[OWNER] = key;
+    if (!req[HOOKED] && res && typeof res.on === 'function') {
+      req[HOOKED] = true;
+      res.on('finish', () => { if (res.statusCode === 500 && req[OWNER]) recordModuleError(req[OWNER]); });
+    }
+    sub(req, res, (err) => {
+      if (!err || typeof err === 'string') req[OWNER] = prev; // fell through ('route'/'router' too)
+      next(err);
+    });
+  };
+  if (sub && sub.stack) scoped.stack = sub.stack;
+  return scoped;
+}
+
+// Per-module runtime-error counts (task 1004637). Pure fs + timers, no network and no
+// core requires at load, so it is cycle-safe here.
+const { seed: seedErrorTally, record: recordModuleError, _reset: resetErrorTally, snapshot: snapshotErrorTally } = require('./error-tally');
+
 module.exports = {
   discoverModules,
   discovered,

package/src/platform-server.js

@@ -47,6 +47,7 @@ const express = require('express');
 const { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal } = require('./bongos/serve-internal');
 const { isApiShapedPath, apiNotFoundBody } = require('./bongos/api-path-404');
 const moduleLoader = require('./module-loader/loader');
+const { start: startErrorTally, startDailySend: startErrorReports } = require('./module-loader/error-tally');
 const { isModuleEnabled } = require('./modules');
 // Hoisted out of an inline require inside the boot IIFE below (task 1004052 strand walk).
 // knip does not follow an inline require(), so every export of module-overrides.js read as
@@ -413,6 +414,12 @@ if (require.main === module) {
       // process starts, and /version carries the count within one query of a restart.
       schemaPending();
       startBackgroundServices();
+      // Store modules' daily runtime-error counts (task 1004637): keep the tally on
+      // disk, and now and then run the sender, which goes out only with a builder
+      // sign-in on this box. Here, not in startBackgroundServices(), so a test that
+      // starts the pollers never writes the tally or spawns the sender.
+      try { startErrorTally(); startErrorReports(); }
+      catch (e) { logger.warn({ err: e.message }, 'module error tally did not start; module error counts are not kept'); }
     });
   })().catch((err) => {
     // THE AWAIT ABOVE MUST NOT SOFTEN A FATAL BOOT (task 1002857, caught by

package/tests/goal_forest_lib.mjs

@@ -141,6 +141,34 @@ await test('describe states the numbers plainly, and an empty forest says so', (
   assert.equal(L.describe(L.analyse({})), 'No task in this goal depends on another task in this goal.');
 });
 
+// ---- the band card's summary (task 1004738) ---------------------------------------
+
+await test('brief is the short form of describe, and falls back to it for an empty forest', () => {
+  const a = L.analyse({ nodes: [1, 2, 3, 4, 5].map((i) => node(i)), edges: [edge(2, 1), edge(3, 2), edge(5, 4)] });
+  assert.equal(L.brief(a), '5 tasks linked by dependencies, in 2 chains.');
+  assert.equal(L.brief(L.analyse({})), L.describe(L.analyse({})));
+});
+
+await test('shipFirst ranks the open tasks nothing open blocks by how many open tasks wait on them, down the chain', () => {
+  // 1 ← 2 ← 3 and 1 ← 4: task 1 unblocks three. 5 ← 6: task 5 unblocks one.
+  const a = L.analyse({ nodes: [1, 2, 3, 4, 5, 6].map((i) => node(i)), edges: [edge(2, 1), edge(3, 2), edge(4, 1), edge(6, 5)] });
+  assert.deepEqual(L.shipFirst(a, 3).map((r) => [r.id, r.unblocks]), [['1', 3], ['5', 1]],
+    'a task still waiting on an open one is never "first"; one that unblocks nothing is left off');
+});
+
+await test('shipFirst: a shipped dependency frees what waits on it, and closed work is never listed or counted', () => {
+  const a = L.analyse({
+    nodes: [node(1, { status: 'shipped' }), node(2), node(3), node(4, { status: 'abandoned' })],
+    edges: [edge(2, 1), edge(3, 2), edge(4, 2)],
+  });
+  assert.deepEqual(L.shipFirst(a, 3).map((r) => [r.id, r.unblocks]), [['2', 1]], 'task 2 is up next and unblocks only the open task 3');
+});
+
+await test('shipFirst stops at the limit and breaks ties by task id', () => {
+  const a = L.analyse({ nodes: [1, 2, 3, 4, 5, 6, 7, 8].map((i) => node(i)), edges: [edge(5, 4), edge(6, 3), edge(7, 2), edge(8, 1)] });
+  assert.deepEqual(L.shipFirst(a, 3).map((r) => r.id), ['1', '2', '3']);
+});
+
 // ---- purity -----------------------------------------------------------------------
 
 await test('the lib is pure: no DOM, no fetch, no cross-goal input', () => {

package/tests/goal_forest_page.mjs

@@ -36,10 +36,11 @@ const settle = async () => { for (let i = 0; i < 20; i++) await tick(); };
 const t = (id, extra = {}) => ({ task_id: String(id), title: `Task ${id}`, status: 'ready', priority: 3, ...extra });
 const e = (from, to) => ({ from: String(from), to: String(to) });
 
-async function boot({ status = 200, fail = false, payload = { nodes: [], edges: [] } } = {}) {
+async function boot({ status = 200, fail = false, payload = { nodes: [], edges: [] }, conflictPairs = null, view = 'dependencies' } = {}) {
   const root = makeEl('div');
   const reg = (id) => { const el = makeEl('div', { id }); root.appendChild(el); return el; };
-  ['goal-deps-h', 'goal-deps-count', 'goal-deps-lede', 'goal-deps-body'].forEach(reg);
+  ['goal-deps-h', 'goal-deps-count', 'goal-deps-lede', 'goal-deps-body', 'goal-deps-back',
+    'goal-deps-card-count', 'goal-deps-card-lede', 'goal-deps-card-body', 'goal-deps-card-foot'].forEach(reg);
 
   const documentObj = {
     getElementById: (id) => walk(root, (el) => (el.id === id ? el : null)),
@@ -83,7 +84,7 @@ async function boot({ status = 200, fail = false, payload = { nodes: [], edges:
   vm.runInContext(read('bulk-toolbar.js'), sandbox, { filename: 'bulk-toolbar.js' }); // task 1003141
   vm.runInContext(RENDER_JS, sandbox, { filename: 'goals-render.js' });
 
-  const state = { current: 7, forest: null, forestError: false };
+  const state = { current: 7, view, forest: null, forestError: false, conflictPairs };
   const ctx = {
     API: '/api/bongos',
     state,
@@ -96,7 +97,10 @@ async function boot({ status = 200, fail = false, payload = { nodes: [], edges:
     },
   };
   const renderers = windowObj.OTBGoalsRender(ctx);
-  return { $: documentObj.getElementById, requests, state, renderers };
+  // The band card's renderer is the forest module's own export — goals-render.js
+  // reaches it through its private `forestRender`, so the test makes its own.
+  const card = windowObj.OTBGoalForestRender(ctx);
+  return { $: documentObj.getElementById, requests, state, renderers, card };
 }
 
 // ---- the honest states (ADR 0227) ---------------------------------------------
@@ -217,14 +221,105 @@ await test('renderDetail calls loadDependencyForest, beside loadGoalTasks, for t
   assert.match(RENDER_JS, /loadGoalTasks\(g\.id\);\s*\n\s*loadDependencyForest\(g\.id\);/);
 });
 
-await test('the section is its OWN full-width block, not squeezed into the three-column band', () => {
+// ---- the band card + the full view (task 1004738) ----------------------------
+
+const sectionOf = (html, id) => {
+  const start = html.indexOf(`<section id="${id}"`);
+  return start < 0 ? '' : html.slice(start, html.indexOf('</section>', start));
+};
+
+await test('the band\'s third column is the compact Dependencies card, where Conflicts was — no long block before Tasks', () => {
   const html = fs.readFileSync(path.join(HALL, 'goals.html'), 'utf8');
-  const bandAt = html.indexOf('class="scroll goal-band"');
-  const depsAt = html.indexOf('id="goal-deps-scroll"');
-  const tasksAt = html.indexOf('<h2 class="scroll__h">Tasks</h2>');
-  assert.ok(bandAt > -1 && depsAt > -1 && tasksAt > -1);
-  assert.ok(bandAt < depsAt && depsAt < tasksAt, 'band, then dependencies, then tasks');
-  assert.equal(/id="goal-deps-scroll"[\s\S]{0,400}goal-band__col/.test(html), false, 'not inside a band column');
+  const detail = sectionOf(html, 'goal-detail-view');
+  const cols = detail.split('class="goal-band__col"').slice(1);
+  assert.equal(cols.length, 3, 'still three columns');
+  assert.match(cols[2], /^\s*id="goal-deps-card"/, 'Dependencies takes the third slot');
+  assert.equal(/>Conflicts</.test(cols.join('')), false, 'no Conflicts column left in the band');
+  assert.equal(detail.includes('id="goal-deps-scroll"'), false, 'the forest is off the goal page');
+});
+
+await test('the full picture is #/goal/N/dependencies: the forest, then the whole conflict set; the old /conflicts lands there', () => {
+  const html = fs.readFileSync(path.join(HALL, 'goals.html'), 'utf8');
+  const view = sectionOf(html, 'goal-dependencies-view');
+  const depsAt = view.indexOf('id="goal-deps-scroll"');
+  const conflictsAt = view.indexOf('id="goal-conflicts-full"');
+  assert.ok(view.includes('id="goal-deps-back"') && depsAt > -1 && depsAt < conflictsAt, 'back link, forest, then conflicts');
+  assert.equal(sectionOf(html, 'goal-conflicts-view'), '', 'no separate conflicts view any more');
+  const page = read('goals-page.js');
+  assert.match(page, /dependencies: '#goal-dependencies-view'/);
+  assert.match(page, /\(dependencies\|conflicts\|members\|completion\)/);
+  assert.match(page, /mSub\[2\] === 'conflicts' \? 'dependencies'/, 'the inbox\'s /conflicts links keep working');
+  assert.match(RENDER_JS, /function renderConflicts\(\) \{[\s\S]*?forestRender\.renderDependencyCard\(\);/, 'the card re-renders when the conflicts land');
+});
+
+await test('the card states the shape, lists what to ship first, counts conflicts, and links to the full view', async () => {
+  const h = await boot({
+    payload: { nodes: [t(1, { title: 'Base' }), t(2), t(3), t(4, { title: 'Other root' }), t(5)], edges: [e(2, 1), e(3, 2), e(5, 4)] },
+    conflictPairs: [{ a: 2, b: 5 }, { a: 3, b: 5 }],
+  });
+  await h.renderers.loadDependencyForest(7);
+  assert.equal(h.$('goal-deps-card-count').hidden, false);
+  assert.equal(h.$('goal-deps-card-count').textContent, '5');
+  assert.equal(h.$('goal-deps-card-lede').textContent, '5 tasks linked by dependencies, in 2 chains.');
+  const body = h.$('goal-deps-card-body');
+  const rows = body.querySelectorAll('.gf-brief__row');
+  assert.deepEqual(rows.map((r) => r.querySelector('a').getAttribute('href')), ['#/task/1', '#/task/4']);
+  assert.deepEqual(rows.map((r) => r.querySelector('.gf-brief__n').textContent), ['unblocks 2', 'unblocks 1']);
+  const line = body.querySelector('.gf-brief__conflicts');
+  assert.equal(line.textContent, '2 file conflicts between open tasks.');
+  assert.match(line.className, /gf-brief__conflicts--live/);
+  const foot = h.$('goal-deps-card-foot');
+  assert.equal(foot.hidden, false);
+  assert.equal(foot.querySelector('a').getAttribute('href'), '#/goal/7/dependencies');
+  assert.equal(h.$('goal-deps-back').getAttribute('href'), '#/goal/7');
+});
+
+await test('on the goal page only the card is drawn — the forest waits for its own view, where its titles can be measured', async () => {
+  const h = await boot({ view: 'detail', payload: { nodes: [t(1), t(2)], edges: [e(2, 1)] } });
+  await h.renderers.loadDependencyForest(7);
+  assert.equal(h.$('goal-deps-body').querySelector('svg'), null, 'no forest drawn into the hidden view');
+  assert.equal(h.$('goal-deps-body').innerHTML, '');
+  assert.equal(h.$('goal-deps-card-lede').textContent, '2 tasks linked by dependencies, in 1 chain.');
+  h.state.view = 'dependencies';
+  h.renderers.renderDependencyForest();
+  assert.ok(h.$('goal-deps-body').querySelector('svg'), 'opening the view draws it');
+});
+
+await test('the card: no conflicts says so, unknown conflicts says nothing, and an empty goal has no door to an empty page', async () => {
+  const none = await boot({ payload: { nodes: [], edges: [] }, conflictPairs: [] });
+  await none.renderers.loadDependencyForest(7);
+  assert.match(none.$('goal-deps-card-lede').textContent, /No task in this goal depends on another/);
+  assert.equal(none.$('goal-deps-card-count').hidden, true);
+  assert.equal(none.$('goal-deps-card-body').querySelector('.gf-brief__conflicts').textContent, 'No file conflicts between open tasks.');
+  assert.equal(none.$('goal-deps-card-foot').hidden, true);
+
+  const unknown = await boot({ payload: { nodes: [], edges: [] }, conflictPairs: null });
+  await unknown.renderers.loadDependencyForest(7);
+  assert.equal(unknown.$('goal-deps-card-body').querySelector('.gf-brief__conflicts'), null, 'a failed or pending conflicts read draws no line, not a zero');
+
+  const onlyConflicts = await boot({ payload: { nodes: [], edges: [] }, conflictPairs: [{ a: 1, b: 2 }] });
+  await onlyConflicts.renderers.loadDependencyForest(7);
+  assert.equal(onlyConflicts.$('goal-deps-card-foot').hidden, false, 'conflicts alone still earn the full view');
+});
+
+await test('the card: while reading, and after a failed read, it says so — and a late conflicts list re-renders it', async () => {
+  const h = await boot({ fail: true });
+  const p = h.renderers.loadDependencyForest(7);
+  assert.equal(h.$('goal-deps-card-lede').textContent, 'Reading…');
+  await p;
+  assert.match(h.$('goal-deps-card-lede').textContent, /Couldn.t load this goal.s task dependencies/);
+  h.state.conflictPairs = [{ a: 1, b: 2 }];
+  h.card.renderDependencyCard();
+  assert.equal(h.$('goal-deps-card-body').querySelector('.gf-brief__conflicts').textContent, '1 file conflict between open tasks.');
+});
+
+await test('a "ship first" title is builder-authored text and never becomes markup in the card either', async () => {
+  const evil = '<img src=x onerror=alert(1)>';
+  const h = await boot({ payload: { nodes: [t(1, { title: evil }), t(2)], edges: [e(2, 1)] } });
+  await h.renderers.loadDependencyForest(7);
+  const body = h.$('goal-deps-card-body');
+  assert.equal(body.querySelector('img'), null);
+  assert.ok(body.textContent.includes(evil));
 });
 
 summary();

package/tests/module_assess_price_parity.mjs

@@ -87,7 +87,7 @@ function fakeDb() {
     async query(sql, params = []) {
       sqlSeen.push(sql);
       if (PRICE_WORD.test(sql)) throw new Error(`the assessment read price: ${sql.slice(0, 120)}`);
-      if (/^SELECT id, module_key, version FROM store_module_versions WHERE id/.test(sql)) {
+      if (/^SELECT id, module_key, version(, artifact_path)? FROM store_module_versions WHERE id/.test(sql)) {
         const v = CASES.find((c) => String(c.id) === String(params[0]));
         return { rows: v ? [{ id: v.id, module_key: v.module_key, version: v.version }] : [] };
       }
@@ -162,7 +162,7 @@ test('assessVersion on publish runs the same steps for every case, and never rea
   const recordDocs = async (id, { db: d }) => { steps.push(['docs', id]); return { ok: true, signal: d.add(id, 'docs', 'scored', 50) }; };
   const out = [];
   for (const c of CASES) {
-    const res = await assessVersion(c.id, { db, recordSecurity, recordDocs });
+    const res = await assessVersion(c.id, { db, dispatchTests: async () => null, recordSecurity, recordDocs });
     assert.equal(res.ok, true, c.module_key);
     out.push(shape(res.score));
   }