@bongos/core 1.21.144 → 1.21.146

package/scripts/gds/provision-auto-upgrade.js

@@ -23,8 +23,16 @@
 // re-queue a target that already failed, every tick, forever. A target is held for an
 // instance when it already has, FOR THAT TARGET: a core-upgrade that ended (error, or
 // done but the box is still behind), a preflight intent that errored, or a stored
-// preflight verdict that refused. A newer release is a new target and is not held. The
-// richer hold — telling the project owner, releasing it — is task 1004730.
+// preflight verdict that refused. A newer release is a new target and is not held.
+//
+// BY FAILURE CLASS (task 1004730). A failed intent records WHAT KIND of failure it was
+// (upgrade-outcome.js classifyFailure, stored by the drain loop). A `transient` one (a
+// registry blip, an install that could not download) already waited out its own
+// 15m/1h/6h backoff inside the intent (intent-retry.js) before it was retired, so this
+// path may try that same target once more after TRANSIENT_HOLD_MS. Every other class (a
+// known wedge whose one fix did not hold, a rule refusing it, an unknown, a failed
+// rollback, which move-escalation.js already took to a person) stays held until a newer
+// release. The project's own hall tells its owner: src/bongos/upgrade-hold.js.
 //
 // Carved into its own file because provision.js and provision-core-upgrade.js sit at
 // the size ratchet. Best-effort: nothing here may fail the tick.
@@ -35,6 +43,11 @@ const { resolveEnv } = require('../../src/instance-config');
 // restarts every hosted project at once. The tick runs every few minutes; one is plenty.
 const AUTO_MOVES_PER_TICK = 1;
 
+// How long a target whose failure was classed transient waits before this path tries it
+// again (task 1004730): a day, the hold the self-host sweep gives a failed version
+// (update-sweep.js REFUSAL_HOLD_MS).
+const TRANSIENT_HOLD_MS = 24 * 60 * 60 * 1000;
+
 const REQUESTED_BY = 'runner:auto-upgrade';
 const OPEN_STATES = new Set(['pending', 'running']);
 const OFF_VALUES = new Set(['off', '0', 'false', 'no', 'disabled']);
@@ -57,6 +70,15 @@ function parseVerdict(p) {
   return p;
 }
 
+// Does this failed intent still hold its target at `now`? A transient error holds for
+// TRANSIENT_HOLD_MS from when it was retired; anything else holds until a newer release
+// (task 1004730). An unreadable time reads as "just now", the safe direction. PURE.
+function stillHolds(i, now) {
+  if (i.failure_class !== 'transient' || i.state !== 'error') return true;
+  const at = Date.parse(i.updated_at);
+  return !Number.isFinite(at) || now - at < TRANSIENT_HOLD_MS;
+}
+
 /**
  * What, if anything, to queue for one project. PURE.
  * @param {object} inst     provisioning_instances row joined with its core-version snapshot
@@ -64,7 +86,7 @@ function parseVerdict(p) {
  * @param {object} channelMod update-channel.js
  * @returns {{ action: string, to: string } | { skip: string }}
  */
-function decideAutoMove(inst, intents, channelMod) {
+function decideAutoMove(inst, intents, channelMod, now = Date.now()) {
   if (inst.hosting_shape !== 'cloud-host') return { skip: 'not a hosted project' }; // never the control-plane row
   if (inst.status !== 'active') return { skip: 'not active' };
   if (channelMod.normalizeChannel(inst.update_channel) === 'pinned') return { skip: 'pinned' };
@@ -75,7 +97,7 @@ function decideAutoMove(inst, intents, channelMod) {
   const same = (i) => String(i.target_version || '') === String(to);
   const held = intents.some((i) => same(i) && (
     (i.action === 'core-upgrade' && (i.state === 'error' || i.state === 'done'))
-    || (i.action === 'core-upgrade-preflight' && i.state === 'error')));
+    || (i.action === 'core-upgrade-preflight' && i.state === 'error')) && stillHolds(i, now));
   const verdict = parseVerdict(inst.preflight);
   const verdictForTarget = verdict && String(verdict.target || '') === String(to) ? verdict : null;
   if (held || (verdictForTarget && verdictForTarget.ok !== true)) return { skip: `held: ${to} already failed here` };
@@ -95,6 +117,7 @@ async function autoUpgradeTick(deps) {
   }
   const channelMod = deps.updateChannel || require('./update-channel.js');
   let queued = 0;
+  const now = (deps.now || Date.now)();
   try {
     const { rows } = await db.query(
       `SELECT i.id, i.slug, i.owner_builder_id, i.hosting_shape, i.status, i.update_channel,
@@ -105,7 +128,7 @@ async function autoUpgradeTick(deps) {
         ORDER BY i.id`);
     if (!rows.length) return { queued };
     const { rows: intents } = await db.query(
-      `SELECT instance_id, action, state, target_version FROM provisioning_intents
+      `SELECT instance_id, action, state, target_version, failure_class, updated_at FROM provisioning_intents
         WHERE instance_id = ANY($1)
           AND (state IN ('pending', 'running')
                OR (action IN ('core-upgrade', 'core-upgrade-preflight') AND target_version IS NOT NULL))`,
@@ -113,7 +136,7 @@ async function autoUpgradeTick(deps) {
     for (const inst of rows) {
       if (queued >= AUTO_MOVES_PER_TICK) break;
       const mine = intents.filter((i) => String(i.instance_id) === String(inst.id));
-      const d = decideAutoMove(inst, mine, channelMod);
+      const d = decideAutoMove(inst, mine, channelMod, now);
       if (d.skip) { if (d.skip.startsWith('held')) log(`  auto core-upgrade: ${inst.slug} ${d.skip}`); continue; }
       try {
         const r = await provisioning.enqueueIntent(db, inst.id, d.action, REQUESTED_BY, d.to);
@@ -136,4 +159,4 @@ async function autoUpgradeTick(deps) {
   return { queued };
 }
 
-module.exports = { AUTO_MOVES_PER_TICK, autoUpgradeEnabled, autoUpgradeTick };
+module.exports = { AUTO_MOVES_PER_TICK, TRANSIENT_HOLD_MS, autoUpgradeEnabled, autoUpgradeTick };

package/src/bongos/routes/core-update.js

@@ -34,6 +34,7 @@ const { readSoftwareUpdate } = require('../software-update');
 const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
 const upgradeRequest = require('../upgrade-request');
+const { readUpgradeHold } = require('../upgrade-hold');
 
 // WHERE A HOSTED PROJECT'S OWNER TAKES THE UPGRADE (task 1004174, ADR 0339): the hub's
 // own deploy door, scoped to this project — `<hub>/deploy?project=<slug>`. The act stays
@@ -213,6 +214,14 @@ async function readAsk({ update, door, deps }) {
   return upgradeRequest.askState({ ...base, stored });
 }
 
+// A core move this project's own ledger says was rolled back (task 1004730,
+// src/bongos/upgrade-hold.js): which version was tried, why in plain words, and that this
+// project is still on its old version and working. Both reads carry it, the Software update
+// panel and the banner. Fail-soft: a hold that cannot be read is no hold, never a 500.
+async function safeHold(read, args) {
+  try { return (await read(args)) || null; } catch { return null; }
+}
+
 function buildCoreUpdateRouter({
   coreUpdate = readCoreUpdate,
   selfChannel = storedSelfChannel,
@@ -221,6 +230,7 @@ function buildCoreUpdateRouter({
   canUpdate = holdsCorePin,
   doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl() }),
   askDeps = defaultAskDeps,
+  upgradeHold = readUpgradeHold,
 } = {}) {
   contributeCoreUpdateToDocket();
   const router = express.Router();
@@ -245,7 +255,8 @@ function buildCoreUpdateRouter({
       // No `deploy_url` any more (task 1004296): the banner on a hall without a door of its
       // own links to Settings → Software update, and the hand-off lives on GET /software-update.
       const { channel, source } = await resolveChannel(selfChannel);
-      res.json({ ok: true, update: { ...(await coreUpdate({ running, channel })), channel_source: source } });
+      const update = await coreUpdate({ running, channel });
+      res.json({ ok: true, update: { ...update, channel_source: source }, held: await safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.latest : null }) });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -283,7 +294,8 @@ function buildCoreUpdateRouter({
       ]);
       const door = updateDoor(doorInputs());
       const ask = await readAsk({ update, door, deps: askDeps() });
-      res.json({ ok: true, update, door, can_update: can === true, ask });
+      const held = await safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.offered : null });
+      res.json({ ok: true, update, door, can_update: can === true, ask, held });
     }, { errorCode: 'software_update_failed', message: false }),
   );
 

package/src/bongos/upgrade-hold.js

@@ -0,0 +1,96 @@
+'use strict';
+
+// src/bongos/upgrade-hold.js — "we tried that version, it was rolled back, you are fine":
+// what THIS project's own hall says about a core move that failed (task 1004730).
+//
+// WHY. Since task 1004729 the hub moves a hosted project's core on its own, by its update
+// rule, and holds a target that failed so it is not retried every tick. The hub's /deploy
+// page and its blockers said so; the project's OWNER, in their own hall, saw only "Update
+// ready" for a version that had already been tried and undone on their project.
+//
+// NO NEW CHANNEL. The move itself is `bongos upgrade` (scripts/gds/upgrade.js), run with
+// PGDATABASE set to THIS project's database, and its auto-rollback writes one row to this
+// project's own `core_upgrades` ledger: `rolled_back: <why> (attempted A → B, restored A)`.
+// So the fact is already here, in this hall's own database, written by the run that failed.
+// This file reads it back; the hub is never asked and nothing crosses an instance.
+//
+// WHAT IT DOES NOT SEE. A pre-flight that refused, or a move refused before anything
+// changed, wrote nothing here (nothing changed on this project). Those stay on the hub.
+//
+// A HOLD IS SHOWN ONLY WHILE IT IS TRUE:
+//   • the newest ledger row is that rollback (a later move that landed ends it);
+//   • this server runs the version the rollback restored (so "still on it, and working"
+//     is a fact: this answer is being served by it);
+//   • nothing newer than the tried version is offered (a newer release clears the hold —
+//     it may carry the fix, and the hub queues it).
+
+const { compareSemver } = require('../../scripts/gds/update-channel.js');
+const { upgradeReason, classifyFailure } = require('../../scripts/gds/upgrade-outcome.js');
+
+const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
+// upgrade.js rollback()'s note, exactly: `rolled_back: ${reason} (attempted F → T, restored P)`.
+const ROLLBACK_NOTE_RE = /^rolled_back: (.+) \(attempted \S+ → \S+, restored \S+\)$/;
+
+// What each step that can fail after the pin moved means, for someone who does not run
+// servers. Keyed by upgrade-outcome.js's reason codes; anything else is the general line.
+const REASON_WORDS = Object.freeze({
+  npm_install: 'its files could not be downloaded and installed',
+  integrity_pin: 'its files did not match the ones that were published',
+  migrate: 'the database changes it brings could not be applied to this project',
+  migrate_check_violation: 'the database changes it brings do not fit data this project already has',
+  restart: 'the project did not start on it',
+  health: 'the project did not answer properly after starting on it',
+  disk_full: 'the server ran out of disk space while installing it',
+});
+const GENERAL_WORDS = 'it did not pass its checks';
+
+/**
+ * The hold this project is under, or null. PURE.
+ * @param {object[]} rows      core_upgrades rows, newest first
+ * @param {string}   running   the core this server runs
+ * @param {string?}  offered   the newest release this project's rule offers (null if none/unread)
+ */
+function upgradeHold({ rows, running, offered }) {
+  const last = Array.isArray(rows) ? rows[0] : null;
+  if (!last || typeof last.note !== 'string') return null;
+  const m = ROLLBACK_NOTE_RE.exec(last.note);
+  const tried = String(last.to_version || '');
+  const was = String(last.from_version || '');
+  if (!m || !VERSION_RE.test(tried) || !VERSION_RE.test(was)) return null;
+  if (String(running || '') !== was) return null;
+  if (offered && VERSION_RE.test(String(offered)) && compareSemver(offered, tried) > 0) return null;
+  const reason = upgradeReason({ error: m[1], rolledBack: true });
+  const transient = classifyFailure(reason).class === 'transient';
+  const why = REASON_WORDS[reason] || GENERAL_WORDS;
+  const at = last.applied_at ? new Date(last.applied_at) : null;
+  return {
+    version: tried,
+    still_on: was,
+    reason,
+    retry: transient ? 'later' : 'next_release',
+    at: at && Number.isFinite(at.getTime()) ? at.toISOString() : null,
+    message: `Version ${tried} was tried on this project and did not work: ${why}. `
+      + `It was rolled back automatically, so this project is still on ${was} and working normally. `
+      + (transient
+        ? 'It may be tried again later.'
+        : `${tried} is on hold here, and the next release will be tried when it is out.`),
+  };
+}
+
+/**
+ * Read this project's own ledger and answer upgradeHold. Never throws: a ledger that
+ * cannot be read is "no hold", never a failed Software update panel.
+ */
+async function readUpgradeHold({ running, offered, pool = null } = {}) {
+  try {
+    const db = pool || require('./pool').pool;
+    const { rows } = await db.query(
+      `SELECT from_version, to_version, note, applied_at FROM core_upgrades
+        ORDER BY applied_at DESC, id DESC LIMIT 1`);
+    return upgradeHold({ rows, running, offered });
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { upgradeHold, readUpgradeHold };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.144'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.146'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/blockers_page_ui.mjs

@@ -325,8 +325,9 @@ await test('resolving through the shared #/blocker/N overlay (otb:blocker-resolv
 
 await test('the sub-line reason prose has ONE source (blockers.html); JS never carries a copy (task 1003985)', () => {
   const html = fs.readFileSync(path.join(HALL, 'blockers.html'), 'utf8');
-  assert.match(html, /Resolving one un-sticks every task waiting on it/, 'the static sub-line keeps the prose');
-  assert.doesNotMatch(BLOCKERS_JS_SRC, /un-sticks|only they can make/, 'blockers.js must not duplicate the prose');
+  // Wording is the artist's (page tweak, task 1004348); the invariant is the single source.
+  assert.match(html, /Any tasks awaiting the same block will unblock automatically on resolution/, 'the static sub-line keeps the prose');
+  assert.doesNotMatch(BLOCKERS_JS_SRC, /unblock automatically on resolution|gated at the owner level/, 'blockers.js must not duplicate the prose');
 });
 
 summary();

package/tests/core_auto_upgrade.mjs

@@ -13,7 +13,7 @@
 // Run:  node tests/core_auto_upgrade.mjs
 
 import { strict as assert } from 'node:assert';
-import { autoUpgradeTick, AUTO_MOVES_PER_TICK, autoUpgradeEnabled } from '../scripts/gds/provision-auto-upgrade.js';
+import { autoUpgradeTick, AUTO_MOVES_PER_TICK, autoUpgradeEnabled, TRANSIENT_HOLD_MS } from '../scripts/gds/provision-auto-upgrade.js';
 
 let passed = 0;
 let failed = 0;
@@ -32,7 +32,7 @@ function row(over = {}) {
 }
 
 // A fake world: `rows` are candidates, `intents` the provisioning_intents history.
-function makeDeps({ rows = [row()], intents = [], env = {} } = {}) {
+function makeDeps({ rows = [row()], intents = [], env = {}, now } = {}) {
   const queued = [];
   const events = [];
   const db = {
@@ -53,7 +53,7 @@ function makeDeps({ rows = [row()], intents = [], env = {} } = {}) {
     },
     async recordEvent(_db, e) { events.push(e); },
   };
-  return { db, provisioning, env, log: () => {}, queued, events };
+  return { db, provisioning, env, now, log: () => {}, queued, events };
 }
 
 console.log('core auto-upgrade tick (task 1004729)');
@@ -185,5 +185,66 @@ await t('a refusal from enqueueIntent (e.g. the control-plane guard) never fails
   assert.equal(r.queued, 0);
 });
 
+// ---- the hold, by failure class (task 1004730) ------------------------------------------
+// A failure classed `transient` (upgrade-outcome.js: a registry blip, a release still
+// publishing, an install that could not download) already waited out its own 15m/1h/6h
+// backoff inside the intent (intent-retry.js) before it was retired. The automatic path
+// may try that same target once more after TRANSIENT_HOLD_MS; every other class (a known
+// wedge whose fix did not hold, a rule refusing it, an unknown, a failed rollback) stays
+// held until a newer release.
+const T0 = Date.parse('2026-10-14T12:00:00Z');
+const hoursAgo = (h) => new Date(T0 - h * 3600 * 1000).toISOString();
+
+await t('a target retired as TRANSIENT is held for a day, then tried again', async () => {
+  assert.equal(TRANSIENT_HOLD_MS, 24 * 3600 * 1000);
+  const failedAt = (h) => [{ instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: 'transient', failure_reason: 'npm_install', updated_at: hoursAgo(h) }];
+  const fresh = makeDeps({ intents: failedAt(2), now: () => T0 });
+  await autoUpgradeTick(fresh);
+  assert.equal(fresh.queued.length, 0, 'held inside the day');
+  const later = makeDeps({ intents: failedAt(25), now: () => T0 });
+  await autoUpgradeTick(later);
+  assert.equal(later.queued.length, 1, 'tried again after the day');
+  assert.equal(later.queued[0].target_version, '1.21.69');
+});
+
+await t('a transient PREFLIGHT error is also released after a day', async () => {
+  const d = makeDeps({ now: () => T0, intents: [{ instance_id: 52, action: 'core-upgrade-preflight', state: 'error', target_version: '1.21.69', failure_class: 'transient', updated_at: hoursAgo(30) }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 1);
+});
+
+await t('every other class stays held however long ago it failed', async () => {
+  for (const cls of ['unknown', 'known_wedge', 'needs_decision', null]) {
+    const d = makeDeps({ now: () => T0, intents: [{ instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: cls, updated_at: hoursAgo(24 * 30) }] });
+    await autoUpgradeTick(d);
+    assert.equal(d.queued.length, 0, String(cls));
+  }
+});
+
+await t('a move that finished but left the box behind stays held, whatever its age', async () => {
+  const d = makeDeps({ now: () => T0, rows: [row({ preflight: { target: '1.21.69', ok: true } })],
+    intents: [{ instance_id: 52, action: 'core-upgrade', state: 'done', target_version: '1.21.69', failure_class: null, updated_at: hoursAgo(24 * 30) }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('one held failure of the target wins over an older transient one', async () => {
+  const d = makeDeps({ now: () => T0, intents: [
+    { instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: 'transient', updated_at: hoursAgo(72) },
+    { instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: 'unknown', updated_at: hoursAgo(48) }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('the intents read carries the failure class and when it failed', async () => {
+  const d = makeDeps();
+  let sql = '';
+  const q = d.db.query;
+  d.db.query = async (s, p) => { if (/FROM provisioning_intents/.test(s)) sql = s; return q(s, p); };
+  await autoUpgradeTick(d);
+  assert.match(sql, /failure_class/);
+  assert.match(sql, /updated_at/);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/core_upgrade_owner_door.mjs

@@ -344,7 +344,7 @@ const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js')
 // The real shell.js in a DOM stub (the tests/core_update_banner.mjs harness), with the
 // /core-update answer optionally carrying a deploy_url — an older server still sends one —
 // and elements that remember their attributes.
-function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
+function boot({ provisioning, deployUrl, pathname = '/settings', hash = '', held }) {
   const els = new Map();
   const inserted = [];
   const makeEl = () => ({
@@ -380,7 +380,7 @@ function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
     BongosClient: {
       createClient: () => ({
         request: (_method, p) => (p === '/api/bongos/core-update'
-          ? Promise.resolve({ status: 200, data: { ok: true, update, deploy_url: deployUrl } })
+          ? Promise.resolve({ status: 200, data: { ok: true, update, deploy_url: deployUrl, held } })
           : new Promise(() => {})),
       }),
     },
@@ -396,6 +396,7 @@ function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
   windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions: { 'core.pin.move': true } });
   return {
     banner: () => inserted.find((e) => String(e._html).includes('is available')),
+    notice: () => inserted.find((e) => e.id === 'core-update-notice'),
     deployItem: () => els.get('nav-deploy'),
   };
 }
@@ -449,5 +450,27 @@ await t('on the platform, the local door wins: the banner links /deploy and the
   assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');
 });
 
+// Task 1004730: a version this project already tried and rolled back is not announced as
+// "available" with an Upgrade button. The banner says what happened instead, in the owner's
+// words, and points at Software update for the rest.
+await t('a held version: the banner says it was tried and rolled back, and the project is still fine', async () => {
+  const held = { version: '1.19.1033', still_on: '1.19.871', message: 'long form' };
+  const b = boot({ provisioning: false, held });
+  await settle();
+  const n = b.notice();
+  assert.ok(n, 'the banner renders');
+  assert.doesNotMatch(n.innerHTML, /is available/);
+  assert.match(n.innerHTML, /1\.19\.1033<\/strong> was tried on this project and rolled back/);
+  assert.match(n.innerHTML, /still on 1\.19\.871 and working/);
+  assert.match(n.innerHTML, /href="\/settings#software-update">Details</);
+  assert.doesNotMatch(n.innerHTML, />Upgrade</, 'no button to take the version that just failed');
+});
+
+await t('a hold on an OLDER version than the one now out leaves the ordinary banner', async () => {
+  const b = boot({ provisioning: false, held: { version: '1.19.900', still_on: '1.19.871', message: 'x' } });
+  await settle();
+  assert.ok(b.banner(), 'the newer release is announced as usual');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/hall_profile_world.mjs

@@ -338,12 +338,30 @@ test('render draws three public figures with a table twin per time chart, and no
   assert.ok(out.includes('<td>2026-08-20</td><td class="ledger__num">50 drachmae</td>'), 'the drachmae twin reads the ledger, not the 30 of per-task awards');
   assert.ok(!out.includes('id="chart-rate"'), 'no pace chart on someone else\'s profile');
   assert.ok(!b.requests.some((u) => u.includes('/analytics/')), 'and /analytics was never asked for');
-  assert.equal((out.match(/<details class="pchart__twin">/g) || []).length, 2, 'a table twin under each time chart');
+  assert.equal((out.match(/<details class="pchart__twin">/g) || []).length, 3, 'a table twin under each time chart and the weekly columns');
   assert.ok(out.includes('<td>2026-08-01</td><td class="ledger__num">2 works</td>'), 'the twin holds the plotted day and its value');
   assert.ok(out.includes('>3 works</text>'), 'only the endpoint is direct-labelled');
   assert.ok(out.includes('Drachmae earned'), 'the currency label comes from branding at render');
 });
 
+test('task 1004756: any profile draws works shipped PER WEEK from the record, each week present', async () => {
+  const b = bootRender({
+    rows: [ship('2026-08-01'), ship('2026-08-01'), ship('2026-08-20', { discipline: 'ui' })],
+    earnings: [pay('2026-08-01', 20)],
+  });
+  await b.C.render({ api: b.api, API: '/api/bongos', builderId: 95, selfId: 7, signedIn: true, now: NOW });
+  const out = b.mount.innerHTML;
+  assert.ok(out.includes('id="chart-weekly"'), 'the weekly figure draws for another builder');
+  assert.ok(out.includes('Works shipped, by week'));
+  assert.ok(!b.requests.some((u) => u.includes('/analytics/')), 'from the record already read, no extra request');
+  const w = b.C.weeklyShipped([ship('2026-08-01'), ship('2026-08-01'), ship('2026-08-20')], null, NOW);
+  assert.equal(w.buckets.reduce((s, x) => s + x.n, 0), 3, 'every ship counted once');
+  assert.ok(w.buckets.some((x) => x.n === 2), 'two ships in one week are one column of 2');
+  assert.ok(w.buckets.some((x) => x.n === 0), 'quiet weeks stay on the axis as zero');
+  assert.ok(w.days <= 365, 'all time is capped');
+  assert.equal(b.C.weeklyShipped([], 30, NOW).buckets.length, 5, '30 days is five week columns');
+});
+
 test('render asks for the pace chart on the viewer\'s own profile only', async () => {
   const analytics = { window_days: 28, ship_rate: [{ day: '2026-09-01', n: 2 }] };
   const own = bootRender({ rows: [ship('2026-08-01')], analytics });

package/tests/nav_permission_atoms.mjs

@@ -89,8 +89,9 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 
 // task 1004685 (the living-city prototype): the held-seat nav and the My agents tab,
 // then the reads it shares with the governor pages (window.__hallReads); task 1004713:
-// the seats read from /me's server-resolved positions block.
-const SHELL_SHA = 'd50a4cc5e6c954b5';
+// the seats read from /me's server-resolved positions block; task 1004730: the banner
+// says a held core version was tried and rolled back.
+const SHELL_SHA = 'b4e4b7ae4fea6bc1';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);