@bongos/core 1.21.145 → 1.21.147

package/tests/core_auto_upgrade.mjs

@@ -13,7 +13,7 @@
 // Run:  node tests/core_auto_upgrade.mjs
 
 import { strict as assert } from 'node:assert';
-import { autoUpgradeTick, AUTO_MOVES_PER_TICK, autoUpgradeEnabled } from '../scripts/gds/provision-auto-upgrade.js';
+import { autoUpgradeTick, AUTO_MOVES_PER_TICK, autoUpgradeEnabled, TRANSIENT_HOLD_MS } from '../scripts/gds/provision-auto-upgrade.js';
 
 let passed = 0;
 let failed = 0;
@@ -32,7 +32,7 @@ function row(over = {}) {
 }
 
 // A fake world: `rows` are candidates, `intents` the provisioning_intents history.
-function makeDeps({ rows = [row()], intents = [], env = {} } = {}) {
+function makeDeps({ rows = [row()], intents = [], env = {}, now } = {}) {
   const queued = [];
   const events = [];
   const db = {
@@ -53,7 +53,7 @@ function makeDeps({ rows = [row()], intents = [], env = {} } = {}) {
     },
     async recordEvent(_db, e) { events.push(e); },
   };
-  return { db, provisioning, env, log: () => {}, queued, events };
+  return { db, provisioning, env, now, log: () => {}, queued, events };
 }
 
 console.log('core auto-upgrade tick (task 1004729)');
@@ -185,5 +185,66 @@ await t('a refusal from enqueueIntent (e.g. the control-plane guard) never fails
   assert.equal(r.queued, 0);
 });
 
+// ---- the hold, by failure class (task 1004730) ------------------------------------------
+// A failure classed `transient` (upgrade-outcome.js: a registry blip, a release still
+// publishing, an install that could not download) already waited out its own 15m/1h/6h
+// backoff inside the intent (intent-retry.js) before it was retired. The automatic path
+// may try that same target once more after TRANSIENT_HOLD_MS; every other class (a known
+// wedge whose fix did not hold, a rule refusing it, an unknown, a failed rollback) stays
+// held until a newer release.
+const T0 = Date.parse('2026-10-14T12:00:00Z');
+const hoursAgo = (h) => new Date(T0 - h * 3600 * 1000).toISOString();
+
+await t('a target retired as TRANSIENT is held for a day, then tried again', async () => {
+  assert.equal(TRANSIENT_HOLD_MS, 24 * 3600 * 1000);
+  const failedAt = (h) => [{ instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: 'transient', failure_reason: 'npm_install', updated_at: hoursAgo(h) }];
+  const fresh = makeDeps({ intents: failedAt(2), now: () => T0 });
+  await autoUpgradeTick(fresh);
+  assert.equal(fresh.queued.length, 0, 'held inside the day');
+  const later = makeDeps({ intents: failedAt(25), now: () => T0 });
+  await autoUpgradeTick(later);
+  assert.equal(later.queued.length, 1, 'tried again after the day');
+  assert.equal(later.queued[0].target_version, '1.21.69');
+});
+
+await t('a transient PREFLIGHT error is also released after a day', async () => {
+  const d = makeDeps({ now: () => T0, intents: [{ instance_id: 52, action: 'core-upgrade-preflight', state: 'error', target_version: '1.21.69', failure_class: 'transient', updated_at: hoursAgo(30) }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 1);
+});
+
+await t('every other class stays held however long ago it failed', async () => {
+  for (const cls of ['unknown', 'known_wedge', 'needs_decision', null]) {
+    const d = makeDeps({ now: () => T0, intents: [{ instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: cls, updated_at: hoursAgo(24 * 30) }] });
+    await autoUpgradeTick(d);
+    assert.equal(d.queued.length, 0, String(cls));
+  }
+});
+
+await t('a move that finished but left the box behind stays held, whatever its age', async () => {
+  const d = makeDeps({ now: () => T0, rows: [row({ preflight: { target: '1.21.69', ok: true } })],
+    intents: [{ instance_id: 52, action: 'core-upgrade', state: 'done', target_version: '1.21.69', failure_class: null, updated_at: hoursAgo(24 * 30) }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('one held failure of the target wins over an older transient one', async () => {
+  const d = makeDeps({ now: () => T0, intents: [
+    { instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: 'transient', updated_at: hoursAgo(72) },
+    { instance_id: 52, action: 'core-upgrade', state: 'error', target_version: '1.21.69', failure_class: 'unknown', updated_at: hoursAgo(48) }] });
+  await autoUpgradeTick(d);
+  assert.equal(d.queued.length, 0);
+});
+
+await t('the intents read carries the failure class and when it failed', async () => {
+  const d = makeDeps();
+  let sql = '';
+  const q = d.db.query;
+  d.db.query = async (s, p) => { if (/FROM provisioning_intents/.test(s)) sql = s; return q(s, p); };
+  await autoUpgradeTick(d);
+  assert.match(sql, /failure_class/);
+  assert.match(sql, /updated_at/);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/core_move_notice.mjs

@@ -0,0 +1,356 @@
+// tests/core_move_notice.mjs — after the project's core moves, its own hall says so once,
+// with what changed, and Settings → Software update keeps a short history (task 1004731).
+//
+// The move writes one row to THIS project's own core_upgrades ledger (scripts/gds/upgrade.js);
+// the running core carries the release notes for every version up to itself
+// (release-notes.json). src/bongos/core-moves.js reads both back: GET /core-update carries
+// the one-time notice (`moved`) for the banner, GET /software-update the history. The
+// builder's "seen" is server-side, in the builder-settings module's behavior_prefs.
+//
+// Run:  node tests/core_move_notice.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { moveNotice, moveHistory, readInstalledReleaseNotes } = require('../src/bongos/core-moves.js');
+const seen = require('../modules/builder-settings/core-move-seen.js');
+
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+const NOW = Date.parse('2026-10-16T12:00:00.000Z');
+const NOTES = {
+  '1.21.20': [{ id: '1', text: 'Old work, already on the project.' }],
+  '1.21.21': [{ id: '1004700', text: 'The board shows who is reviewing.' }],
+  '1.21.22': [],
+  '1.21.23': [{ text: 'Settings remembers your filters.' }, { id: '1004702', text: 'Faster task pages.' }],
+  '1.21.24': [{ id: '9', text: 'Beyond this move.' }],
+};
+// The rows upgrade.js writes: a landed move, an automatic one, a door one, a rollback.
+const moved = (over = {}) => ({ id: '41', from_version: '1.21.20', to_version: '1.21.23', note: null, source: null,
+  applied_at: '2026-10-15T09:00:00.000Z', ...over });
+const rollback = { id: '40', from_version: '1.21.20', to_version: '1.21.22', source: null, applied_at: '2026-10-14T09:00:00.000Z',
+  note: 'rolled_back: migrate failed (attempted 1.21.20 → 1.21.22, restored 1.21.20)' };
+
+console.log('the notice after a core move, and the history of moves (task 1004731)');
+
+await t('a recorded move renders as a notice: version, date, and the release-note entries between old and new', () => {
+  const n = moveNotice({ rows: [moved()], running: '1.21.23', notes: NOTES, now: NOW });
+  assert.equal(n.id, '41');
+  assert.equal(n.version, '1.21.23');
+  assert.equal(n.from, '1.21.20');
+  assert.equal(n.message, 'Upgraded to core 1.21.23 on 15 October 2026.');
+  assert.deepEqual(n.entries.map((e) => e.text),
+    ['Settings remembers your filters.', 'Faster task pages.', 'The board shows who is reviewing.'],
+    'newest first, only the versions after the old one and up to the new one');
+  assert.equal(n.more, 0);
+});
+
+await t('an automatic move says so; a move by hand reads the same, without the word', () => {
+  assert.equal(moveNotice({ rows: [moved({ note: 'auto-subscription' })], running: '1.21.23', notes: NOTES, now: NOW }).message,
+    'Upgraded automatically to core 1.21.23 on 15 October 2026.');
+  const door = moveNotice({ rows: [moved({ source: 'owner-control' })], running: '1.21.23', notes: NOTES, now: NOW });
+  assert.equal(door.how, 'by_hand');
+  assert.equal(door.message, 'Upgraded to core 1.21.23 on 15 October 2026.');
+});
+
+await t('the notice clears once this builder has seen that move, and the next move is news again', () => {
+  assert.equal(moveNotice({ rows: [moved()], running: '1.21.23', notes: NOTES, seenId: '41', now: NOW }), null);
+  assert.ok(moveNotice({ rows: [moved({ id: '42' })], running: '1.21.23', notes: NOTES, seenId: '41', now: NOW }));
+});
+
+await t('no notice for a rollback, a version this server does not run, or a move months old', () => {
+  assert.equal(moveNotice({ rows: [rollback, moved()], running: '1.21.20', notes: NOTES, now: NOW }), null);
+  assert.equal(moveNotice({ rows: [moved()], running: '1.21.20', notes: NOTES, now: NOW }), null);
+  assert.equal(moveNotice({ rows: [moved()], running: '1.21.23', notes: NOTES, now: NOW + 40 * 86400000 }), null);
+  assert.equal(moveNotice({ rows: [], running: '1.21.23', notes: NOTES, now: NOW }), null);
+});
+
+await t('notes that cannot be read, or do not cover the move, still give the notice, with no entries', () => {
+  const none = moveNotice({ rows: [moved()], running: '1.21.23', notes: null, now: NOW });
+  assert.equal(none.entries, null);
+  assert.match(none.message, /1\.21\.23/);
+  assert.equal(moveNotice({ rows: [moved()], running: '1.21.23', notes: { '1.21.22': [] }, now: NOW }).entries, null);
+});
+
+await t('a long range shows a few entries and counts the rest', () => {
+  const many = { '1.21.20': [] };
+  for (let i = 21; i <= 30; i++) many[`1.21.${i}`] = [{ text: `Change ${i}.` }];
+  const n = moveNotice({ rows: [moved({ to_version: '1.21.30' })], running: '1.21.30', notes: many, now: NOW });
+  assert.equal(n.entries.length, 6);
+  assert.equal(n.more, 4);
+});
+
+await t('the history lists every move, newest first, failed ones included, with how and outcome', () => {
+  const h = moveHistory([moved({ note: 'auto-subscription' }), rollback,
+    { id: '39', from_version: '1.21.19', to_version: '1.21.20', source: 'owner-control', note: null, applied_at: '2026-10-10T09:00:00.000Z' },
+    { id: '38', from_version: '1.21.20', to_version: '1.21.19', source: null, note: 'downgrade (--allow-downgrade)', applied_at: '2026-10-09T09:00:00.000Z' }]);
+  assert.deepEqual(h.map((m) => [m.version, m.how, m.outcome]), [
+    ['1.21.23', 'automatic', 'upgraded'],
+    ['1.21.22', 'on_server', 'rolled_back'],
+    ['1.21.20', 'by_hand', 'upgraded'],
+    ['1.21.19', 'on_server', 'moved_back'],
+  ]);
+  assert.equal(h[0].at, '2026-10-15T09:00:00.000Z');
+  assert.equal(moveHistory(Array.from({ length: 20 }, (_, i) => moved({ id: String(i) }))).length, 8, 'a short history');
+});
+
+await t('the running core\'s own release notes are read from its package root; none is null, never a throw', () => {
+  const fake = { readFileSync: () => JSON.stringify(NOTES) };
+  assert.deepEqual(readInstalledReleaseNotes({ fsImpl: fake, root: '/x' }), NOTES);
+  assert.equal(readInstalledReleaseNotes({ fsImpl: { readFileSync: () => { throw new Error('ENOENT'); } }, root: '/x' }), null);
+});
+
+// ---- the per-builder seen state (builder-settings module) -------------------------------
+
+await t('seen is one ledger id per builder, kept beside the other prefs', () => {
+  assert.equal(seen.seenId({}), null);
+  assert.equal(seen.seenId(seen.applySeen({ wandering: 'low' }, '41')), '41');
+  assert.equal(seen.applySeen({ wandering: 'low' }, '41').wandering, 'low');
+  assert.equal(seen.validatePatch({ id: '41' }).id, '41');
+  assert.equal(seen.validatePatch({ id: 'x' }).ok, false);
+  assert.equal(seen.validatePatch({ id: '41', other: 1 }).ok, false);
+});
+
+await t('PATCH /me/core-move-seen stores it for the signed-in builder only, and the port reads it back', async () => {
+  const rows = new Map([[1, { wandering: 'low' }]]);
+  const db = require('../modules/builder-settings/db.js');
+  db.getBuilderBehaviorPrefs = async (id) => rows.get(id) || {};
+  db.setBuilderBehaviorPrefs = async (id, prefs) => { rows.set(id, prefs); return prefs; };
+  const router = require('../modules/builder-settings/routes/settings.js')();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/me/core-move-seen' && l.route.methods.patch);
+  assert.ok(layer, 'PATCH /me/core-move-seen is registered');
+  const out = { status: 200, body: null };
+  const res = { status(s) { out.status = s; return this; }, json(b) { out.body = b; return this; },
+    fail(code, a, b) { out.status = typeof a === 'number' ? a : (a && a.status) || 400; out.body = { error: code, ...(b || {}) }; return this; } };
+  await layer.route.stack[layer.route.stack.length - 1].handle({ builder: { id: 1 }, body: { id: '41' } }, res);
+  assert.equal(out.status, 200);
+  assert.deepEqual(out.body, { ok: true, seen: '41' });
+  assert.equal(rows.get(1).wandering, 'low', 'sibling prefs survive');
+  assert.equal(rows.has(2), false);
+  const port = require('../modules/builder-settings/settings.js');
+  assert.equal(port.coreMoveSeen(rows.get(1)), '41');
+});
+
+// ---- the two reads the hall makes ------------------------------------------------------
+
+const { CORE_VERSION } = require('../src/module-api.js');
+const nowMove = (over = {}) => moved({ to_version: CORE_VERSION, from_version: '0.0.1', applied_at: new Date().toISOString(), ...over });
+
+async function drive(p, deps) {
+  const auth = require('../src/bongos/auth.js');
+  const saved = { b: auth.requireBuilder, p: auth.requirePermission };
+  auth.requireBuilder = (req, _res, next) => { req.builder = { id: '7' }; next(); };
+  auth.requirePermission = () => (_req, _res, next) => next();
+  const build = require('../src/bongos/routes/core-update.js');
+  const express = require('express');
+  const app = express();
+  try {
+    app.use(build({ askDeps: () => ({ hub: null, getSetting: async () => null }), canUpdate: async () => true,
+      doorInputs: () => ({ provisioning: false, idp: null, hubUpgradeUrl: null }), upgradeHold: async () => null,
+      releaseNotes: () => ({ '0.0.1': [], [CORE_VERSION]: [{ text: 'Shown after the move.' }] }), ...deps }));
+  } finally { auth.requireBuilder = saved.b; auth.requirePermission = saved.p; }
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  try {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}${p}`);
+    return { status: res.status, body: await res.json() };
+  } finally { server.close(); }
+}
+
+await t('GET /core-update carries the notice for this builder, and none once they have seen it', async () => {
+  const r = await drive('/core-update', {
+    coreUpdate: async () => ({ reading: 'ok', behind: false }), selfChannel: async () => null,
+    upgrades: async () => [nowMove()], seenMove: async () => ({ remember: 'server', seen: null }),
+  });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.moved.version, CORE_VERSION);
+  assert.equal(r.body.moved.remember, 'server');
+  assert.deepEqual(r.body.moved.entries.map((e) => e.text), ['Shown after the move.']);
+  const after = await drive('/core-update', {
+    coreUpdate: async () => ({ reading: 'ok', behind: false }), selfChannel: async () => null,
+    upgrades: async () => [nowMove()], seenMove: async () => ({ remember: 'server', seen: '41' }),
+  });
+  assert.equal(after.body.moved, null);
+});
+
+await t('a ledger that cannot be read is no notice, never a failed banner read', async () => {
+  const r = await drive('/core-update', { coreUpdate: async () => ({ reading: 'ok', behind: false }), selfChannel: async () => null,
+    upgrades: async () => { throw new Error('no table'); }, seenMove: async () => ({ remember: 'server', seen: null }) });
+  assert.equal(r.status, 200);
+  assert.equal(r.body.moved, null);
+});
+
+await t('GET /software-update carries the history for those who may update, and not for anyone else', async () => {
+  const deps = { softwareUpdate: async ({ running }) => ({ reading: 'ok', running, offered: null }),
+    upgrades: async () => [nowMove({ note: 'auto-subscription' }), rollback] };
+  const r = await drive('/software-update', deps);
+  assert.deepEqual(r.body.history.map((m) => [m.how, m.outcome]), [['automatic', 'upgraded'], ['on_server', 'rolled_back']]);
+  const other = await drive('/software-update', { ...deps, canUpdate: async () => false });
+  assert.equal(other.body.history, null, 'when and to what the core moved is a vulnerability-window fact (ADR 0043)');
+});
+
+// ---- the hall draws the notice, and it clears after it is seen --------------------------
+
+const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
+// shell.js loads the notice's own file only when there is a notice; the fake <head> runs it.
+const NOTICE = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/core-move-notice.js'), 'utf8');
+
+function boot({ data, permissions = { 'core.pin.move': true }, stored = {} } = {}) {
+  const inserted = [];
+  const requested = [];
+  const loaded = [];
+  const els = new Map();
+  let sandbox = null;
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '', _on: {},
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
+    addEventListener(ev, fn) { this._on[ev] = fn; },
+    querySelector(sel) { const self = this; return { addEventListener: (e, f) => { (self._q ||= {})[sel] = f; } }; },
+    querySelectorAll() { return []; },
+    appendChild() {}, focus() {}, click() {}, scrollIntoView() {}, remove() { this._removed = true; },
+    insertAdjacentElement(_pos, el) { inserted.push(el); },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const documentObj = {
+    body: { dataset: { page: 'index' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelectorAll() { return []; }, createElement() { return makeEl(); },
+    addEventListener() {}, dispatchEvent() {}, get cookie() { return ''; }, set cookie(_v) {},
+    head: { appendChild(tag) { loaded.push(tag.src); vm.runInContext(NOTICE, sandbox, { filename: 'core-move-notice.js' }); tag.onload(); } },
+  };
+  const location = { hostname: 'h', origin: 'https://h', pathname: '/', hash: '', assign() {}, replace() {} };
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: { provisioning: false } },
+    BongosClient: { createClient: () => ({ request: (method, p, opts) => {
+      requested.push({ method, p, body: opts && opts.body });
+      if (p === '/api/bongos/core-update') return Promise.resolve({ status: 200, data });
+      if (p === '/api/bongos/me/core-move-seen') return Promise.resolve({ status: 200, ok: true, data: { ok: true } });
+      return new Promise(() => {});
+    } }) },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: { getItem: (k) => (k in stored ? stored[k] : null), setItem: (k, v) => { stored[k] = v; } },
+    requestAnimationFrame() {}, scrollTo() {}, location, addEventListener() {},
+  };
+  sandbox = { window: windowObj, document: documentObj, location, console, setTimeout, clearTimeout, queueMicrotask,
+    CustomEvent: class { constructor(tp, i) { this.type = tp; Object.assign(this, i); } } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
+  windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions });
+  return { inserted, requested, stored, loaded, notice: () => inserted.find((e) => String(e._html).includes('core-move-notice__list') || String(e._html).includes('Upgraded')) };
+}
+const settle = async () => { for (let i = 0; i < 5; i++) await new Promise((r) => setTimeout(r, 0)); };
+
+const recorded = moveNotice({ rows: [moved({ note: 'auto-subscription' })], running: '1.21.23', notes: NOTES, now: NOW });
+
+await t('the hall renders the notice from a recorded move, with its release-note entries', async () => {
+  const b = boot({ data: { ok: true, update: { reading: 'ok', behind: false }, held: null, moved: { ...recorded, remember: 'server' } } });
+  await settle();
+  const el = b.notice();
+  assert.ok(el, 'the notice is drawn');
+  assert.match(el.innerHTML, /Upgraded automatically to core 1\.21\.23 on 15 October 2026\./);
+  assert.match(el.innerHTML, /Settings remembers your filters\./);
+  assert.match(el.innerHTML, /Faster task pages\./);
+  assert.match(el.innerHTML, /href="\/settings#software-update"/);
+  assert.equal(b.loaded.length, 1, 'its file is loaded once, only because there is a notice');
+  assert.match(b.loaded[0], /^\/builders\/core-move-notice\.js/);
+});
+
+await t('no notice, no extra file: a page with nothing to say loads nothing', async () => {
+  const b = boot({ data: { ok: true, update: { reading: 'ok', behind: false }, held: null, moved: null } });
+  await settle();
+  assert.equal(b.loaded.length, 0);
+  assert.equal(b.notice(), undefined);
+});
+
+await t('the notice clears once seen: closing it tells the server, for this move, and removes it', async () => {
+  const b = boot({ data: { ok: true, update: { reading: 'ok', behind: false }, held: null, moved: { ...recorded, remember: 'server' } } });
+  await settle();
+  const el = b.notice();
+  el._q['.core-move-notice__close']();
+  await settle();
+  assert.equal(el._removed, true);
+  const patch = b.requested.find((r) => r.method === 'PATCH');
+  assert.equal(patch && patch.p, '/api/bongos/me/core-move-seen');
+  assert.equal(JSON.stringify(patch.body), JSON.stringify({ id: '41' }));
+  // The next page load: the server answers moved:null for this builder.
+  const next = boot({ data: { ok: true, update: { reading: 'ok', behind: false }, held: null, moved: null } });
+  await settle();
+  assert.equal(next.notice(), undefined);
+});
+
+await t('without the server-side store the browser remembers it instead', async () => {
+  const stored = {};
+  const b = boot({ stored, data: { ok: true, update: { reading: 'ok', behind: false }, held: null, moved: { ...recorded, remember: 'browser' } } });
+  await settle();
+  b.notice()._q['.core-move-notice__close']();
+  await settle();
+  assert.equal(stored['bongos.coreMove.seen'], '41');
+  assert.ok(!b.requested.some((r) => r.method === 'PATCH'));
+  const again = boot({ stored, data: { ok: true, update: { reading: 'ok', behind: false }, held: null, moved: { ...recorded, remember: 'browser' } } });
+  await settle();
+  assert.equal(again.notice(), undefined);
+});
+
+// ---- Settings → Software update draws the history ---------------------------------------
+
+const PANEL_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/settings-software-update.js'), 'utf8');
+const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+async function panel(data) {
+  const el = () => ({ hidden: true, textContent: '', _html: '', dataset: {}, set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; }, querySelectorAll: () => [] });
+  const els = new Map([['software-update-scroll', el()], ['su-body', el()], ['su-note', el()], ['settings-groups', el()]]);
+  els.get('settings-groups').dataset.active = 'update';
+  const windowObj = { BongosClient: { createClient: () => ({ request: async () => ({ ok: true, status: 200, data }) }) }, OTB: { escapeHtml }, location: { assign() {} } };
+  const sandbox = { window: windowObj, document: { getElementById: (id) => els.get(id) || null, addEventListener() {} }, console, setTimeout, Date, Math, URL, Promise, String, Number };
+  vm.createContext(sandbox);
+  vm.runInContext(PANEL_SRC, sandbox, { filename: 'settings-software-update.js' });
+  for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
+  return els.get('su-body').innerHTML;
+}
+
+await t('Settings → Software update lists the moves: version, date, automatic or by hand, outcome', async () => {
+  const history = moveHistory([moved({ note: 'auto-subscription' }), rollback,
+    { id: '39', from_version: '1.21.19', to_version: '1.21.20', source: 'owner-control', note: null, applied_at: '2026-10-10T09:00:00.000Z' }]);
+  const html = await panel({ ok: true, update: { reading: 'ok', running: '1.21.23', offered: null }, door: { kind: 'cli' }, can_update: true, ask: {}, held: null, history });
+  assert.match(html, /Recent updates/);
+  assert.match(html, /1\.21\.23/);
+  assert.match(html, /15 October 2026/);
+  assert.match(html, /Automatic/);
+  assert.match(html, /By hand/);
+  assert.match(html, /Rolled back/);
+  assert.match(html, /Installed/);
+  assert.doesNotMatch(html.slice(html.indexOf('Recent updates')), /[—–]/, 'voice rule: no dashes in new copy');
+});
+
+await t('no history, no change: the panel draws exactly what it did before', async () => {
+  const data = { ok: true, update: { reading: 'ok', running: '1.21.20', offered: '1.21.116', whats_new: null }, door: { kind: 'cli', url: null }, can_update: true, ask: {}, held: null };
+  assert.equal(await panel({ ...data, history: null }), await panel(data));
+  assert.equal(await panel({ ...data, history: [] }), await panel(data));
+});
+
+// ---- the hub's automatic move marks itself in the project's ledger -------------------------
+
+await t('the hub\'s automatic move passes the auto-subscription note; a door move and a preview do not', () => {
+  const R = require('../scripts/gds/provision-core-upgrade.js');
+  const box = { slug: 'toast', port: 4100, hosting_shape: 'cloud-host' };
+  const as = { runAs: 'bongos', migrateAs: 'bongos' };
+  assert.match(R.upgradeInvocation(box, '1.21.23', { ...as, automatic: true }).cmd, / --note auto-subscription(\s|$)/);
+  assert.doesNotMatch(R.upgradeInvocation(box, '1.21.23', { ...as, requestedBy: '42' }).cmd, /--note/);
+  assert.doesNotMatch(R.upgradeInvocation(box, '1.21.23', { ...as, automatic: true, dryRun: true }).cmd, /--note/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/core_upgrade_owner_door.mjs

@@ -344,7 +344,7 @@ const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js')
 // The real shell.js in a DOM stub (the tests/core_update_banner.mjs harness), with the
 // /core-update answer optionally carrying a deploy_url — an older server still sends one —
 // and elements that remember their attributes.
-function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
+function boot({ provisioning, deployUrl, pathname = '/settings', hash = '', held }) {
   const els = new Map();
   const inserted = [];
   const makeEl = () => ({
@@ -380,7 +380,7 @@ function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
     BongosClient: {
       createClient: () => ({
         request: (_method, p) => (p === '/api/bongos/core-update'
-          ? Promise.resolve({ status: 200, data: { ok: true, update, deploy_url: deployUrl } })
+          ? Promise.resolve({ status: 200, data: { ok: true, update, deploy_url: deployUrl, held } })
           : new Promise(() => {})),
       }),
     },
@@ -396,6 +396,7 @@ function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
   windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions: { 'core.pin.move': true } });
   return {
     banner: () => inserted.find((e) => String(e._html).includes('is available')),
+    notice: () => inserted.find((e) => e.id === 'core-update-notice'),
     deployItem: () => els.get('nav-deploy'),
   };
 }
@@ -449,5 +450,27 @@ await t('on the platform, the local door wins: the banner links /deploy and the
   assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');
 });
 
+// Task 1004730: a version this project already tried and rolled back is not announced as
+// "available" with an Upgrade button. The banner says what happened instead, in the owner's
+// words, and points at Software update for the rest.
+await t('a held version: the banner says it was tried and rolled back, and the project is still fine', async () => {
+  const held = { version: '1.19.1033', still_on: '1.19.871', message: 'long form' };
+  const b = boot({ provisioning: false, held });
+  await settle();
+  const n = b.notice();
+  assert.ok(n, 'the banner renders');
+  assert.doesNotMatch(n.innerHTML, /is available/);
+  assert.match(n.innerHTML, /1\.19\.1033<\/strong> was tried on this project and rolled back/);
+  assert.match(n.innerHTML, /still on 1\.19\.871 and working/);
+  assert.match(n.innerHTML, /href="\/settings#software-update">Details</);
+  assert.doesNotMatch(n.innerHTML, />Upgrade</, 'no button to take the version that just failed');
+});
+
+await t('a hold on an OLDER version than the one now out leaves the ordinary banner', async () => {
+  const b = boot({ provisioning: false, held: { version: '1.19.900', still_on: '1.19.871', message: 'x' } });
+  await settle();
+  assert.ok(b.banner(), 'the newer release is announced as usual');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/nav_permission_atoms.mjs

@@ -89,8 +89,10 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 
 // task 1004685 (the living-city prototype): the held-seat nav and the My agents tab,
 // then the reads it shares with the governor pages (window.__hallReads); task 1004713:
-// the seats read from /me's server-resolved positions block.
-const SHELL_SHA = 'd50a4cc5e6c954b5';
+// the seats read from /me's server-resolved positions block; task 1004730: the banner
+// says a held core version was tried and rolled back; task 1004731: the one-time
+// "Upgraded to core X" notice after a move.
+const SHELL_SHA = 'eb9e85b9c1784f01';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);