@bongos/core 1.21.145 → 1.21.147

package/modules/hall-ui/public/studio.html

@@ -190,7 +190,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-10-hall-keys1"></script>
+<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/style.css

@@ -1068,6 +1068,17 @@ html[data-theme="dark"] .gplate__light { display: none; }
 /* With no action link the close button still sits hard right. */
 .core-update-notice__action + .core-update-notice__close { margin-left: 0; }
 .core-update-notice > span + .core-update-notice__close { margin-left: auto; }
+/* "Upgraded to core X on <date>" and what changed (task 1004731): the same strip, with the
+   release-note lines under the sentence in the body ink; it wraps on a phone. */
+.core-move-notice { flex-wrap: wrap; }
+.core-move-notice__body { flex: 1 1 20rem; min-width: 0; }
+.core-move-notice__list {
+  margin: 4px 0 0;
+  padding-left: 1.15rem;
+  max-width: var(--measure, 68ch);
+  color: var(--ink-soft);
+}
+.core-move-notice__list li + li { margin-top: 2px; }
 .topbar-menu {
   display: none;
   align-items: center;

package/modules/hall-ui/public/task.html

@@ -56,7 +56,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-10-hall-keys1"></script>
+<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -140,7 +140,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-10-hall-keys1"></script>
+<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -144,7 +144,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-10-hall-keys1"></script>
+<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -167,7 +167,7 @@
      chrome exists before the page script runs. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-10-hall-keys1"></script>
+<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -173,7 +173,7 @@
      time so the chrome exists before the deferred page scripts execute. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-10-hall-keys1"></script>
+<script src="/builders/shell.js?v=2026-10-18-core-move1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.145",
+  "version": "1.21.147",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.145",
+      "version": "1.21.147",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.145",
+  "version": "1.21.147",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9884,5 +9884,17 @@
       "id": "1004348",
       "text": "The Blockers page now uses the owner's own words, written on a Chromebook and brought back from Google Docs. The line under the page title is shorter and plainer, and the button reads \"+ File blocker\". Both rewritten lines wen"
     }
+  ],
+  "1.21.146": [
+    {
+      "id": "1004730",
+      "text": "When an automatic core update fails on a hosted project and is rolled back, that version is not retried over and over, and the project's owner now sees in their own Settings and update banner which version was tried, that it w"
+    }
+  ],
+  "1.21.147": [
+    {
+      "id": "1004731",
+      "text": "After a project's software is updated, its owner now sees a one-time note saying which version it moved to, when, and what changed, and the Software update page lists the recent updates, including any that failed and were undo"
+    }
   ]
 }

package/scripts/gds/provision-auto-upgrade.js

@@ -23,8 +23,16 @@
 // re-queue a target that already failed, every tick, forever. A target is held for an
 // instance when it already has, FOR THAT TARGET: a core-upgrade that ended (error, or
 // done but the box is still behind), a preflight intent that errored, or a stored
-// preflight verdict that refused. A newer release is a new target and is not held. The
-// richer hold — telling the project owner, releasing it — is task 1004730.
+// preflight verdict that refused. A newer release is a new target and is not held.
+//
+// BY FAILURE CLASS (task 1004730). A failed intent records WHAT KIND of failure it was
+// (upgrade-outcome.js classifyFailure, stored by the drain loop). A `transient` one (a
+// registry blip, an install that could not download) already waited out its own
+// 15m/1h/6h backoff inside the intent (intent-retry.js) before it was retired, so this
+// path may try that same target once more after TRANSIENT_HOLD_MS. Every other class (a
+// known wedge whose one fix did not hold, a rule refusing it, an unknown, a failed
+// rollback, which move-escalation.js already took to a person) stays held until a newer
+// release. The project's own hall tells its owner: src/bongos/upgrade-hold.js.
 //
 // Carved into its own file because provision.js and provision-core-upgrade.js sit at
 // the size ratchet. Best-effort: nothing here may fail the tick.
@@ -35,6 +43,11 @@ const { resolveEnv } = require('../../src/instance-config');
 // restarts every hosted project at once. The tick runs every few minutes; one is plenty.
 const AUTO_MOVES_PER_TICK = 1;
 
+// How long a target whose failure was classed transient waits before this path tries it
+// again (task 1004730): a day, the hold the self-host sweep gives a failed version
+// (update-sweep.js REFUSAL_HOLD_MS).
+const TRANSIENT_HOLD_MS = 24 * 60 * 60 * 1000;
+
 const REQUESTED_BY = 'runner:auto-upgrade';
 const OPEN_STATES = new Set(['pending', 'running']);
 const OFF_VALUES = new Set(['off', '0', 'false', 'no', 'disabled']);
@@ -57,6 +70,15 @@ function parseVerdict(p) {
   return p;
 }
 
+// Does this failed intent still hold its target at `now`? A transient error holds for
+// TRANSIENT_HOLD_MS from when it was retired; anything else holds until a newer release
+// (task 1004730). An unreadable time reads as "just now", the safe direction. PURE.
+function stillHolds(i, now) {
+  if (i.failure_class !== 'transient' || i.state !== 'error') return true;
+  const at = Date.parse(i.updated_at);
+  return !Number.isFinite(at) || now - at < TRANSIENT_HOLD_MS;
+}
+
 /**
  * What, if anything, to queue for one project. PURE.
  * @param {object} inst     provisioning_instances row joined with its core-version snapshot
@@ -64,7 +86,7 @@ function parseVerdict(p) {
  * @param {object} channelMod update-channel.js
  * @returns {{ action: string, to: string } | { skip: string }}
  */
-function decideAutoMove(inst, intents, channelMod) {
+function decideAutoMove(inst, intents, channelMod, now = Date.now()) {
   if (inst.hosting_shape !== 'cloud-host') return { skip: 'not a hosted project' }; // never the control-plane row
   if (inst.status !== 'active') return { skip: 'not active' };
   if (channelMod.normalizeChannel(inst.update_channel) === 'pinned') return { skip: 'pinned' };
@@ -75,7 +97,7 @@ function decideAutoMove(inst, intents, channelMod) {
   const same = (i) => String(i.target_version || '') === String(to);
   const held = intents.some((i) => same(i) && (
     (i.action === 'core-upgrade' && (i.state === 'error' || i.state === 'done'))
-    || (i.action === 'core-upgrade-preflight' && i.state === 'error')));
+    || (i.action === 'core-upgrade-preflight' && i.state === 'error')) && stillHolds(i, now));
   const verdict = parseVerdict(inst.preflight);
   const verdictForTarget = verdict && String(verdict.target || '') === String(to) ? verdict : null;
   if (held || (verdictForTarget && verdictForTarget.ok !== true)) return { skip: `held: ${to} already failed here` };
@@ -95,6 +117,7 @@ async function autoUpgradeTick(deps) {
   }
   const channelMod = deps.updateChannel || require('./update-channel.js');
   let queued = 0;
+  const now = (deps.now || Date.now)();
   try {
     const { rows } = await db.query(
       `SELECT i.id, i.slug, i.owner_builder_id, i.hosting_shape, i.status, i.update_channel,
@@ -105,7 +128,7 @@ async function autoUpgradeTick(deps) {
         ORDER BY i.id`);
     if (!rows.length) return { queued };
     const { rows: intents } = await db.query(
-      `SELECT instance_id, action, state, target_version FROM provisioning_intents
+      `SELECT instance_id, action, state, target_version, failure_class, updated_at FROM provisioning_intents
         WHERE instance_id = ANY($1)
           AND (state IN ('pending', 'running')
                OR (action IN ('core-upgrade', 'core-upgrade-preflight') AND target_version IS NOT NULL))`,
@@ -113,7 +136,7 @@ async function autoUpgradeTick(deps) {
     for (const inst of rows) {
       if (queued >= AUTO_MOVES_PER_TICK) break;
       const mine = intents.filter((i) => String(i.instance_id) === String(inst.id));
-      const d = decideAutoMove(inst, mine, channelMod);
+      const d = decideAutoMove(inst, mine, channelMod, now);
       if (d.skip) { if (d.skip.startsWith('held')) log(`  auto core-upgrade: ${inst.slug} ${d.skip}`); continue; }
       try {
         const r = await provisioning.enqueueIntent(db, inst.id, d.action, REQUESTED_BY, d.to);
@@ -136,4 +159,4 @@ async function autoUpgradeTick(deps) {
   return { queued };
 }
 
-module.exports = { AUTO_MOVES_PER_TICK, autoUpgradeEnabled, autoUpgradeTick };
+module.exports = { AUTO_MOVES_PER_TICK, TRANSIENT_HOLD_MS, autoUpgradeEnabled, autoUpgradeTick };

package/scripts/gds/provision-core-upgrade.js

@@ -321,7 +321,10 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // the one field task 1004121 exists to keep identical. Skipped when !apply, where the
   // command is printed and never run — a plan should not spend a subprocess per tick.
   const { runAs, migrateAs } = resolveRunAs(inst, deps, { probe: apply });
-  const { cmd, runDir } = upgradeInvocation(inst, to, { privileged, requestedBy, selfRoot, runAs, migrateAs });
+  // A move the hub queued by itself (provision-auto-upgrade.js) says so in the project's
+  // own ledger, so its hall can tell its owner "upgraded automatically" (task 1004731).
+  const automatic = !!intent && intent.requested_by === 'runner:auto-upgrade';
+  const { cmd, runDir } = upgradeInvocation(inst, to, { privileged, requestedBy, automatic, selfRoot, runAs, migrateAs });
 
   if (!apply) {
     // A --dry-run runner tick used to only PRINT this command. It now runs the CLI's own
@@ -668,7 +671,7 @@ function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
 // HERE rather than left to instanceUser()'s own throw: that throw is correct today, but
 // a call site whose safety depends on a helper's internals is one refactor away from a
 // shell-injection path (and the apply leg's own guard sits at the route, not here).
-function upgradeInvocation(inst, to, { privileged = false, dryRun = false, requestedBy = '', selfRoot = selfInstanceRoot, runAs = null, migrateAs = null } = {}) {
+function upgradeInvocation(inst, to, { privileged = false, dryRun = false, requestedBy = '', automatic = false, selfRoot = selfInstanceRoot, runAs = null, migrateAs = null } = {}) {
   if (!isValidSlug(inst && inst.slug)) {
     throw new Error(`upgradeInvocation: refusing to build a shell command from an invalid slug ${JSON.stringify(inst && inst.slug)}`);
   }
@@ -729,7 +732,10 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
       // token; the upgrade process cannot (task 1004065, pushUpgradePin).
       hubPushesPin(inst) ? '--pin-no-push' : '',
       requestedBy ? `--requested-by ${requestedBy}` : '',
-      requestedBy ? '--upgrade-source owner-control' : ''];
+      requestedBy ? '--upgrade-source owner-control' : '',
+      // The ledger's existing mark for an unattended move (the self-host sweep writes
+      // `auto-subscription (<rule>)`); one shell-safe word here (task 1004731).
+      automatic && !requestedBy ? '--note auto-subscription' : ''];
   return { cmd: [...shared, ...tail].filter(Boolean).join(' '), runDir: REPO_ROOT, instanceDir, runAs: account, migrateAs: dbAccount };
 }
 

package/src/bongos/core-moves.js

@@ -0,0 +1,155 @@
+'use strict';
+
+// src/bongos/core-moves.js — "you were upgraded, and this is what changed": what THIS
+// project's own hall says after its core moved, and the short list of moves Settings →
+// Software update keeps (task 1004731).
+//
+// WHY. Since task 1004729 the hub moves a hosted project's core on its own, by its update
+// rule. The owner found out only by noticing a different number. The goal state is "a
+// changelog is visible inside the update": the hall says once, after the move, which core
+// it is on now, when it moved, and what the releases in between brought.
+//
+// NO NEW CHANNEL — the same reading task 1004730's hold makes (upgrade-hold.js). Every move,
+// automatic or by hand, is `bongos upgrade` run against THIS project's database, and it
+// writes one row to this project's own `core_upgrades` ledger: a landed move as from → to,
+// a failed one as its `rolled_back:` row. And the release notes for every version up to
+// the one now running ship INSIDE the running core (release-notes.json, task 1004218), so
+// the entries between the old and the new version are read from this project's own disk.
+// The hub is never asked.
+//
+// HOW IT WAS MOVED is only as precise as the ledger: `source = 'owner-control'` is the
+// Update button (a person); a note carrying `auto-subscription` is an automatic move (the
+// self-host sweep has always written it, and since this task the hub's automatic move
+// passes it too, provision-core-upgrade.js); anything else was run on the server, and the
+// ledger cannot say by whom, so it says "on the server" rather than guess. A failed
+// automatic move keeps no note of its own (rollback() writes `rolled_back:` in the one note
+// column), so it reads as "on the server" too.
+
+const fs = require('fs');
+const path = require('path');
+const { notesBetween, RELEASE_NOTES_FILE } = require('../../scripts/gds/release-notes.js');
+
+const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
+const ROLLED_BACK_RE = /^rolled_back:/;
+const DOWNGRADE_RE = /^downgrade\b/;
+const AUTO_RE = /auto-subscription/;
+
+// A notice is about a move that just happened. A project whose last move was months ago
+// (the ledger outlives this feature) is not told about it as news.
+const NOTICE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+// The notice is a banner, not the changelog: a few lines, then "and N more" with the way
+// to the full list.
+const NOTICE_ENTRIES_MAX = 6;
+// "A short history of moves."
+const HISTORY_MAX = 8;
+
+const MONTHS = ['January', 'February', 'March', 'April', 'May', 'June', 'July', 'August',
+  'September', 'October', 'November', 'December'];
+
+function isoOrNull(v) {
+  const d = v ? new Date(v) : null;
+  return d && Number.isFinite(d.getTime()) ? d.toISOString() : null;
+}
+
+// "15 October 2026", in UTC so the same move reads the same date for every reader and test.
+function longDate(iso) {
+  const d = new Date(iso);
+  return `${d.getUTCDate()} ${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;
+}
+
+/** How a ledger row's move was started: 'automatic' | 'by_hand' | 'on_server'. PURE. */
+function moveHow(row) {
+  if (row && row.source === 'owner-control') return 'by_hand';
+  if (row && typeof row.note === 'string' && AUTO_RE.test(row.note)) return 'automatic';
+  return 'on_server';
+}
+
+/** What a ledger row says happened: 'upgraded' | 'moved_back' | 'rolled_back'. PURE. */
+function moveOutcome(row) {
+  const note = row && typeof row.note === 'string' ? row.note : '';
+  if (ROLLED_BACK_RE.test(note)) return 'rolled_back';
+  if (DOWNGRADE_RE.test(note)) return 'moved_back';
+  return 'upgraded';
+}
+
+/**
+ * The short history Settings → Software update shows, newest first, failed moves included.
+ * PURE over core_upgrades rows (newest first). `version` is the core the move went to, or
+ * for a rolled-back row the one it tried.
+ */
+function moveHistory(rows) {
+  if (!Array.isArray(rows)) return [];
+  return rows
+    .filter((r) => r && VERSION_RE.test(String(r.to_version || '')))
+    .slice(0, HISTORY_MAX)
+    .map((r) => ({
+      id: r.id == null ? null : String(r.id),
+      version: String(r.to_version),
+      from: VERSION_RE.test(String(r.from_version || '')) ? String(r.from_version) : null,
+      at: isoOrNull(r.applied_at),
+      how: moveHow(r),
+      outcome: moveOutcome(r),
+    }));
+}
+
+/**
+ * The one-time notice after a move, or null. PURE.
+ *
+ * Shown only while it is true and new: the newest ledger row is a move that went in (not a
+ * rollback), this server runs the version it went to (so "upgraded to X" is a fact: this
+ * answer is served by X), it is recent, and this builder has not seen it (`seenId`, the
+ * ledger row id they last acknowledged).
+ *
+ * @param {object[]} rows     core_upgrades rows, newest first
+ * @param {string}   running  the core this server runs
+ * @param {object?}  notes    the running core's release-notes.json (null if unreadable)
+ * @param {string?}  seenId   the ledger row id this builder has acknowledged
+ * @param {number}   now      ms clock
+ */
+function moveNotice({ rows, running, notes = null, seenId = null, now = Date.now() }) {
+  const last = Array.isArray(rows) ? rows[0] : null;
+  if (!last || last.id == null) return null;
+  const id = String(last.id);
+  const to = String(last.to_version || '');
+  if (!VERSION_RE.test(to) || to !== String(running || '')) return null;
+  const outcome = moveOutcome(last);
+  if (outcome === 'rolled_back') return null;
+  if (seenId != null && String(seenId) === id) return null;
+  const at = isoOrNull(last.applied_at);
+  if (!at || now - Date.parse(at) > NOTICE_MAX_AGE_MS) return null;
+  const from = VERSION_RE.test(String(last.from_version || '')) ? String(last.from_version) : null;
+  const how = moveHow(last);
+
+  // The release-note entries between the old and the new version, from this core's own file.
+  let entries = null;
+  let more = 0;
+  if (outcome === 'upgraded' && from && notes) {
+    const r = notesBetween(notes, from, to);
+    if (r.entries) {
+      entries = r.entries.slice(0, NOTICE_ENTRIES_MAX);
+      more = r.entries.length - entries.length;
+    }
+  }
+  const verb = outcome === 'moved_back' ? 'Moved back' : 'Upgraded';
+  return {
+    id,
+    version: to,
+    from,
+    at,
+    how,
+    outcome,
+    message: `${verb}${how === 'automatic' ? ' automatically' : ''} to core ${to} on ${longDate(at)}.`,
+    entries,
+    more,
+  };
+}
+
+/**
+ * The running core's own release notes, or null. Never throws. The file sits at the package
+ * root beside package.json (release-notes.js); a core checkout run in place has none.
+ */
+function readInstalledReleaseNotes({ fsImpl = fs, root = path.join(__dirname, '..', '..') } = {}) {
+  try { return JSON.parse(fsImpl.readFileSync(path.join(root, RELEASE_NOTES_FILE), 'utf8')); } catch { return null; }
+}
+
+module.exports = { moveHistory, moveNotice, readInstalledReleaseNotes };

package/src/bongos/routes/core-update.js

@@ -34,6 +34,8 @@ const { readSoftwareUpdate } = require('../software-update');
 const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
 const upgradeRequest = require('../upgrade-request');
+const { readUpgradeHold } = require('../upgrade-hold');
+const { moveNotice, moveHistory, readInstalledReleaseNotes } = require('../core-moves');
 
 // WHERE A HOSTED PROJECT'S OWNER TAKES THE UPGRADE (task 1004174, ADR 0339): the hub's
 // own deploy door, scoped to this project — `<hub>/deploy?project=<slug>`. The act stays
@@ -213,6 +215,45 @@ async function readAsk({ update, door, deps }) {
   return upgradeRequest.askState({ ...base, stored });
 }
 
+// A core move this project's own ledger says was rolled back (task 1004730,
+// src/bongos/upgrade-hold.js): which version was tried, why in plain words, and that this
+// project is still on its old version and working. Both reads carry it, the Software update
+// panel and the banner. Fail-soft: a hold that cannot be read is no hold, never a 500.
+async function safeHold(read, args) {
+  try { return (await read(args)) || null; } catch { return null; }
+}
+
+// "Upgraded to core X on <date>, and this is what changed" (task 1004731,
+// src/bongos/core-moves.js): the one-time notice after a move and the short history of
+// moves, both read from this project's own core_upgrades ledger, the notes from the running
+// core's own release-notes.json. Gated like the ledger read (GET /core-upgrades): when and to
+// what this box moved is a vulnerability-window fact (ADR 0043).
+//
+// WHO HAS SEEN IT is per builder and server-side, in the builder-settings module's
+// behavior_prefs (core-move-seen.js), reached through its port: core never requires a module.
+// Without the module the hall remembers it in the browser instead ('browser').
+async function defaultSeenMove(req) {
+  const port = seams.resolveOptional('builder-settings');
+  if (!port || typeof port.coreMoveSeen !== 'function' || typeof port.getBuilderBehaviorPrefs !== 'function') {
+    return { remember: 'browser', seen: null };
+  }
+  return { remember: 'server', seen: port.coreMoveSeen(await port.getBuilderBehaviorPrefs(req.builder && req.builder.id)) };
+}
+
+// The notice for this viewer, or null. Fail-soft: a ledger, notes file or seen state that
+// cannot be read is no notice, never a failed banner read.
+async function safeMoved({ req, running, upgrades, releaseNotes, seenMove }) {
+  try {
+    const [rows, seen] = await Promise.all([upgrades({ limit: 1 }), seenMove(req)]);
+    const notice = moveNotice({ rows, running, notes: releaseNotes(), seenId: seen && seen.seen });
+    return notice ? { ...notice, remember: seen && seen.remember === 'server' ? 'server' : 'browser' } : null;
+  } catch { return null; }
+}
+
+async function safeHistory(upgrades) {
+  try { return moveHistory(await upgrades({ limit: 8 })); } catch { return null; }
+}
+
 function buildCoreUpdateRouter({
   coreUpdate = readCoreUpdate,
   selfChannel = storedSelfChannel,
@@ -221,6 +262,9 @@ function buildCoreUpdateRouter({
   canUpdate = holdsCorePin,
   doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl() }),
   askDeps = defaultAskDeps,
+  upgradeHold = readUpgradeHold,
+  releaseNotes = readInstalledReleaseNotes,
+  seenMove = defaultSeenMove,
 } = {}) {
   contributeCoreUpdateToDocket();
   const router = express.Router();
@@ -237,7 +281,7 @@ function buildCoreUpdateRouter({
     // grader caught here, and it is invisible to any test that does not drive a
     // real request through the assembled router; tests/core_update_banner.mjs now
     // does, and fails if this call is mis-shaped again.
-    asyncHandler('GET /core-update', async (_req, res) => {
+    asyncHandler('GET /core-update', async (req, res) => {
       // Fail-soft on the version read, exactly as GET /version does: an instance
       // that cannot name its own core reports `no_answer` and renders no banner.
       let running = null;
@@ -245,7 +289,12 @@ function buildCoreUpdateRouter({
       // No `deploy_url` any more (task 1004296): the banner on a hall without a door of its
       // own links to Settings → Software update, and the hand-off lives on GET /software-update.
       const { channel, source } = await resolveChannel(selfChannel);
-      res.json({ ok: true, update: { ...(await coreUpdate({ running, channel })), channel_source: source } });
+      const update = await coreUpdate({ running, channel });
+      const [held, moved] = await Promise.all([
+        safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.latest : null }),
+        safeMoved({ req, running, upgrades, releaseNotes, seenMove }),
+      ]);
+      res.json({ ok: true, update: { ...update, channel_source: source }, held, moved });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -283,7 +332,10 @@ function buildCoreUpdateRouter({
       ]);
       const door = updateDoor(doorInputs());
       const ask = await readAsk({ update, door, deps: askDeps() });
-      res.json({ ok: true, update, door, can_update: can === true, ask });
+      const held = await safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.offered : null });
+      // The history only for a viewer who holds core.pin.move (see safeMoved's gate note).
+      const history = can === true ? await safeHistory(upgrades) : null;
+      res.json({ ok: true, update, door, can_update: can === true, ask, held, history });
     }, { errorCode: 'software_update_failed', message: false }),
   );
 

package/src/bongos/upgrade-hold.js

@@ -0,0 +1,96 @@
+'use strict';
+
+// src/bongos/upgrade-hold.js — "we tried that version, it was rolled back, you are fine":
+// what THIS project's own hall says about a core move that failed (task 1004730).
+//
+// WHY. Since task 1004729 the hub moves a hosted project's core on its own, by its update
+// rule, and holds a target that failed so it is not retried every tick. The hub's /deploy
+// page and its blockers said so; the project's OWNER, in their own hall, saw only "Update
+// ready" for a version that had already been tried and undone on their project.
+//
+// NO NEW CHANNEL. The move itself is `bongos upgrade` (scripts/gds/upgrade.js), run with
+// PGDATABASE set to THIS project's database, and its auto-rollback writes one row to this
+// project's own `core_upgrades` ledger: `rolled_back: <why> (attempted A → B, restored A)`.
+// So the fact is already here, in this hall's own database, written by the run that failed.
+// This file reads it back; the hub is never asked and nothing crosses an instance.
+//
+// WHAT IT DOES NOT SEE. A pre-flight that refused, or a move refused before anything
+// changed, wrote nothing here (nothing changed on this project). Those stay on the hub.
+//
+// A HOLD IS SHOWN ONLY WHILE IT IS TRUE:
+//   • the newest ledger row is that rollback (a later move that landed ends it);
+//   • this server runs the version the rollback restored (so "still on it, and working"
+//     is a fact: this answer is being served by it);
+//   • nothing newer than the tried version is offered (a newer release clears the hold —
+//     it may carry the fix, and the hub queues it).
+
+const { compareSemver } = require('../../scripts/gds/update-channel.js');
+const { upgradeReason, classifyFailure } = require('../../scripts/gds/upgrade-outcome.js');
+
+const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
+// upgrade.js rollback()'s note, exactly: `rolled_back: ${reason} (attempted F → T, restored P)`.
+const ROLLBACK_NOTE_RE = /^rolled_back: (.+) \(attempted \S+ → \S+, restored \S+\)$/;
+
+// What each step that can fail after the pin moved means, for someone who does not run
+// servers. Keyed by upgrade-outcome.js's reason codes; anything else is the general line.
+const REASON_WORDS = Object.freeze({
+  npm_install: 'its files could not be downloaded and installed',
+  integrity_pin: 'its files did not match the ones that were published',
+  migrate: 'the database changes it brings could not be applied to this project',
+  migrate_check_violation: 'the database changes it brings do not fit data this project already has',
+  restart: 'the project did not start on it',
+  health: 'the project did not answer properly after starting on it',
+  disk_full: 'the server ran out of disk space while installing it',
+});
+const GENERAL_WORDS = 'it did not pass its checks';
+
+/**
+ * The hold this project is under, or null. PURE.
+ * @param {object[]} rows      core_upgrades rows, newest first
+ * @param {string}   running   the core this server runs
+ * @param {string?}  offered   the newest release this project's rule offers (null if none/unread)
+ */
+function upgradeHold({ rows, running, offered }) {
+  const last = Array.isArray(rows) ? rows[0] : null;
+  if (!last || typeof last.note !== 'string') return null;
+  const m = ROLLBACK_NOTE_RE.exec(last.note);
+  const tried = String(last.to_version || '');
+  const was = String(last.from_version || '');
+  if (!m || !VERSION_RE.test(tried) || !VERSION_RE.test(was)) return null;
+  if (String(running || '') !== was) return null;
+  if (offered && VERSION_RE.test(String(offered)) && compareSemver(offered, tried) > 0) return null;
+  const reason = upgradeReason({ error: m[1], rolledBack: true });
+  const transient = classifyFailure(reason).class === 'transient';
+  const why = REASON_WORDS[reason] || GENERAL_WORDS;
+  const at = last.applied_at ? new Date(last.applied_at) : null;
+  return {
+    version: tried,
+    still_on: was,
+    reason,
+    retry: transient ? 'later' : 'next_release',
+    at: at && Number.isFinite(at.getTime()) ? at.toISOString() : null,
+    message: `Version ${tried} was tried on this project and did not work: ${why}. `
+      + `It was rolled back automatically, so this project is still on ${was} and working normally. `
+      + (transient
+        ? 'It may be tried again later.'
+        : `${tried} is on hold here, and the next release will be tried when it is out.`),
+  };
+}
+
+/**
+ * Read this project's own ledger and answer upgradeHold. Never throws: a ledger that
+ * cannot be read is "no hold", never a failed Software update panel.
+ */
+async function readUpgradeHold({ running, offered, pool = null } = {}) {
+  try {
+    const db = pool || require('./pool').pool;
+    const { rows } = await db.query(
+      `SELECT from_version, to_version, note, applied_at FROM core_upgrades
+        ORDER BY applied_at DESC, id DESC LIMIT 1`);
+    return upgradeHold({ rows, running, offered });
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { upgradeHold, readUpgradeHold };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.145'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.147'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');