@bongos/core 1.21.33 → 1.21.35

package/modules/lifecycle/governor-docket.js

@@ -58,10 +58,29 @@ function removalMatter(r) {
     tally: null,
     href: `/task/${encodeURIComponent(r.proposal_task_id)}`,
     ref: { type: 'task', id: r.proposal_task_id },
+    // POST /removal-proposals/:id/decide, the docket source's own atom (task 1004559)
+    acts: [{ key: 'remove' }, { key: 'keep' }],
   };
 }
 
-function uatMatter(c) {
+// The one-tap reasons a force sign-off may give (POST /done-when/:id/satisfy
+// requires one); the desk sends the label as the override reason.
+const FORCE_REASONS = Object.freeze([
+  { key: 'tested_by_hand', label: 'tested by hand' },
+  { key: 'checked_review', label: 'seen in review' },
+  { key: 'no_longer', label: 'no longer applies' },
+]);
+// What the viewer may do on a criterion waiting for a tester (task 1004559). A
+// backend-only criterion signs off in one tap (with the live attestation as its
+// chip); a user-facing one needs a recording, so its act goes to the goal's page.
+// Force sign-off only for a holder of criterion.satisfy, that route's own atom.
+function uatActs(c, { force = false } = {}) {
+  const acts = [c.backend_only === true ? { key: 'signoff', options: [{ key: 'live', label: 'tested it live' }] } : { key: 'record' }];
+  if (force) acts.push({ key: 'force', options: FORCE_REASONS });
+  return acts;
+}
+
+function uatMatter(c, opts) {
   return {
     id: c.id,
     rule: 'signoff',
@@ -75,6 +94,7 @@ function uatMatter(c) {
     tally: { for: c.shipped_total, against: 0, open: 0, needs: 'one sign-off by someone who did not build it' },
     href: c.goal_id ? `/goals#/goal/${encodeURIComponent(c.goal_id)}` : '/goals',
     ref: { type: 'criterion', id: c.id },
+    acts: uatActs(c, opts),
   };
 }
 
@@ -326,7 +346,8 @@ function contributeLifecycleToDocket() {
     source: 'criteria_uat',
     building: 'review',
     gate: { permission: 'criterion.review' },
-    read: async () => (await doneWhen.listPendingReviewCriteria({})).filter((c) => c.awaiting_uat === true).map(uatMatter),
+    read: async (ctx) => (await doneWhen.listPendingReviewCriteria({})).filter((c) => c.awaiting_uat === true)
+      .map((c) => uatMatter(c, { force: ctx.has('criterion.satisfy') })),
   });
   // Own-scoped by its read, like GET /goals/inbox: a goal's lead sees the requests
   // to join their goals, and everyone sees their own pending ones. An Archon is
@@ -371,6 +392,7 @@ module.exports = {
   overrideMatter,
   removalMatter,
   uatMatter,
+  uatActs,
   joinRequestMatter,
   flowReading,
   promisesReading,

package/modules/lifecycle/routes/project-settings.js

@@ -134,7 +134,29 @@ function upmarketRow() {
   };
 }
 
+// The Rules desk's settings rows (task 1004559), under this page's own atom: the
+// rot timer as one-tap day counts (PATCH /project-settings/rot-days), and the
+// work categories as a link to this page, since a category is named in words.
+// Pure; exported for tests.
+const ROT_CHOICES = Object.freeze([7, 14, 30, 60, 90]);
+function settingsDeskRows({ days, categories }) {
+  const live = (categories || []).filter((c) => c && c.active !== false).length;
+  return [
+    { id: 'rot', name: 'Rot timer', fact: `stale after ${days} ${days === 1 ? 'day' : 'days'}`, facts: ['raising it only asks a person'], tool: true, ref: { type: 'project_setting', id: 'rot_days' },
+      acts: [{ key: 'rot', options: ROT_CHOICES.filter((d) => d !== Number(days)).slice(0, 4).map((d) => ({ key: String(d), label: `${d} days` })) }] },
+    { id: 'categories', name: 'Work categories', fact: `${live} in use`, tool: true, href: '/project-settings', ref: { type: 'project_setting', id: 'work_categories' }, acts: [{ key: 'open' }] },
+  ];
+}
+function contributeSettingsDesk() {
+  api.contribute('governor.docket', {
+    desk: 'rules.settings',
+    gate: { permission: 'project.settings.manage' },
+    read: async () => settingsDeskRows({ days: (await api.resolveRotDays()).days, categories: await goalCategory.listCategories({ includeInactive: true }) }),
+  });
+}
+
 module.exports = function buildProjectSettingsRouter() {
+  contributeSettingsDesk();
   const router = express.Router();
 
   // GET /project-settings — all five rows in ONE read.
@@ -261,3 +283,5 @@ module.exports = function buildProjectSettingsRouter() {
 
   return router;
 };
+
+module.exports.settingsDeskRows = settingsDeskRows;

package/modules/onboarding/routes/access-requests.js

@@ -242,7 +242,12 @@ function accessRequestDocketMatter(r) {
 // The governor's docket: a pending request to join stands at People, shown only
 // to a viewer holding `access_request.review` (this queue's own atom, because it
 // exposes would-be builders' usernames) and needing that same viewer's act.
+// The People desk's invite row (task 1004559), under the invite route's own atom:
+// one GitHub name typed in place, sent to POST /access-requests/invite.
+const INVITE_DESK_ROW = Object.freeze({ id: 'invite', name: 'Invite someone', fact: 'by their GitHub name', tool: true, ref: { type: 'invite', id: 'new' }, acts: [{ key: 'invite', field: 'github_login' }] });
+
 function contributeAccessRequestsToDocket() {
+  api.contribute('governor.docket', { desk: 'people.invite', gate: { permission: 'access_request.review' }, read: async () => [INVITE_DESK_ROW] });
   api.contribute('governor.docket', {
     source: 'access_requests',
     building: 'people',
@@ -651,3 +656,5 @@ module.exports = function buildAccessRequestsRouter() {
 };
 
 module.exports.accessRequestDocketMatter = accessRequestDocketMatter;
+
+module.exports.INVITE_DESK_ROW = INVITE_DESK_ROW;

package/modules/provisioning/core-upgrade.js

@@ -545,5 +545,5 @@ function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespo
   };
 }
 
-module.exports = { UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/routes/core-upgrade.js

@@ -25,12 +25,45 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
-const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler } = require('../core-upgrade');
+const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler, loadPreview } = require('../core-upgrade');
 const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
 
+// The Release desk's core row (task 1004559): the platform's own move, in two
+// steps on one row. Until a dry run has PASSED for the very version on offer the
+// row offers only 'check' (POST …/core-upgrade with dry_run); 'take' (the real
+// move) is handed only after that pass, so no desk can move the pin without the
+// check. The chip carries the version, which the route requires as its own
+// confirmation. A run in progress offers nothing (the row then steps aside for
+// the plain core-update matter). Pure; exported for tests.
+function coreDeskRows(preview) {
+  const p = preview || {};
+  const to = p.recommended_version;
+  if (!p.behind || !to || p.instance_id == null) return [];
+  if (p.open_intent && (p.open_intent.state === 'pending' || p.open_intent.state === 'running')) return [];
+  const pf = p.preflight && p.preflight.target === to ? p.preflight : null;
+  const version = [{ key: String(to), label: String(to) }];
+  const base = { id: p.instance_id, name: `Core ${to}`, over: 'core_update', opened_at: p.observed_at || null, ref: { type: 'core_pin', id: p.instance_id } };
+  if (pf && pf.ok) return [{ ...base, fact: 'checked · nothing blocks', facts: [`running ${p.served_version || 'unknown'}`], acts: [{ key: 'take', options: version }, { key: 'check', options: version }] }];
+  if (pf) return [{ ...base, fact: 'the check refused it', facts: [String(pf.error || 'no reason given'), `running ${p.served_version || 'unknown'}`], acts: [{ key: 'check', options: version }] }];
+  return [{ ...base, fact: 'not checked yet', facts: [`running ${p.served_version || 'unknown'}`], acts: [{ key: 'check', options: version }] }];
+}
+function contributeCoreDesk() {
+  api.contribute('governor.docket', {
+    desk: 'release.core',
+    // the control-plane read's own atom (GET /provisioning/control-plane)
+    gate: { permission: 'core.pin.move' },
+    read: async () => {
+      const { rows } = await api.pool.query("SELECT * FROM provisioning_instances WHERE hosting_shape = 'control-plane' LIMIT 1");
+      if (!rows.length) return [];
+      return coreDeskRows(await loadPreview(api.pool, provisioning, rows[0]));
+    },
+  });
+}
+
 module.exports = function buildCoreUpgradeRouter() {
+  contributeCoreDesk();
   const router = express.Router();
 
   // POST /provisioning/instances/:id/core-upgrade — move the core pin.
@@ -119,3 +152,5 @@ module.exports = function buildCoreUpgradeRouter() {
 
   return router;
 };
+
+module.exports.coreDeskRows = coreDeskRows;

package/modules/security/routes/reports.js

@@ -56,6 +56,23 @@ function redteamDocketMatter(r) {
     tally: null,
     href: '/watch',
     ref: { type: 'vulnerability_report', id: r.id },
+    // The floor desk's acts (task 1004559): the docket only lists this for a
+    // holder of the adjudicate atom, which both routes check.
+    acts: [{ key: 'confirm' }, { key: 'dispute' }],
+  };
+}
+
+// A confirmed report still waiting for its fix, as a Disputes desk row (task
+// 1004559): one act, POST /security/reports/:id/fix. Pure; exported for tests.
+function confirmedDeskRow(r) {
+  return {
+    id: r.id,
+    name: r.title,
+    fact: r.severity ? `${r.severity} · confirmed` : 'confirmed',
+    facts: ['confirmed, not fixed yet'],
+    opened_at: r.confirmed_at || r.reported_at || null,
+    ref: { type: 'vulnerability_report', id: r.id },
+    acts: [{ key: 'fix' }],
   };
 }
 
@@ -69,6 +86,11 @@ function contributeReportsToDocket() {
       return lists.flat().map(redteamDocketMatter);
     },
   });
+  api.contribute('governor.docket', {
+    desk: 'disputes.confirmed',
+    gate: { permission: 'security.report.adjudicate' },
+    read: async () => (await security.listVulnerabilityReports({ scope: 'all', status: 'confirmed', limit: 40 })).map(confirmedDeskRow),
+  });
   // The Disputes record (task 1004527): every report that was ruled on, dated by
   // its ruling (confirmed or fixed). Same atom as the list route it reads.
   api.contribute('governor.docket', {
@@ -318,3 +340,4 @@ module.exports = function buildSecurityReportsRouter() {
 
 module.exports.redteamDocketMatter = redteamDocketMatter;
 module.exports.rulingHistory = rulingHistory;
+module.exports.confirmedDeskRow = confirmedDeskRow;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.33",
+  "version": "1.21.35",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.33",
+      "version": "1.21.35",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.33",
+  "version": "1.21.35",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8958,5 +8958,17 @@
       "id": "1004494",
       "text": "The look for each craft mode is decided. Artistry, Ideating and Governing each get their own colour (moonlight, star gold, city blue) on the mode switch, the tab you are on and the top bar, the mode's name beside the page titl"
     }
+  ],
+  "1.21.34": [
+    {
+      "id": "1004558",
+      "text": "Inside every building in the governor city, the floor you pick is now a desk you can act from, built from the new floor desks design. It shows the floor's name and how many things wait on you, up to three short numbers, and on"
+    }
+  ],
+  "1.21.35": [
+    {
+      "id": "1004559",
+      "text": "Governing now happens inside the buildings. On a floor's desk you can set a builder's tier, deactivate them, invite someone by GitHub name, give or take back a custom rank; confirm, dispute or mark fixed a security report and"
+    }
   ]
 }

package/src/bongos/routes/backup.js

@@ -24,6 +24,7 @@ const auth = require('../auth');
 const { branding } = require('../../branding');
 const { resolveEnv } = require('../../instance-config');
 const { asyncHandler } = require('./_helpers');
+const seams = require('../../module-seams');
 // task 1003208: structured logging — was console.*. A core file logs through
 // the kernel logger directly; only MODULES go via api.logger (the doorway).
 const log = require('../logger').logger.child({ src: 'backup' });
@@ -76,6 +77,20 @@ function isStaleDump(stamp, nowMs = Date.now(), staleAfterHours = STALE_AFTER_HO
   return age > staleAfterHours;
 }
 
+// The newest dump's age for the Treasury desk (task 1004559), read WITHOUT
+// blocking: the docket is read on every street visit, so this is one async
+// directory listing and the age from the filename (no stat), never latestDump()'s
+// synchronous reads. Same filename rule and staleness rule as latestDump().
+async function newestDumpAge(nowMs = Date.now()) {
+  let files;
+  try { files = await fs.promises.readdir(BACKUP_DIR); } catch { return null; }
+  const dumps = files.filter((f) => f.startsWith(`${DB_NAME}-`) && f.endsWith('.sql.gz')).sort();
+  if (!dumps.length) return null;
+  const ts = dumps[dumps.length - 1].replace(`${DB_NAME}-`, '').replace('.sql.gz', '');
+  const age = dumpAgeHours(ts, nowMs);
+  return { age_hours: age === null ? null : Math.round(age * 10) / 10, stale: isStaleDump(ts, nowMs) };
+}
+
 function latestDump(nowMs = Date.now()) {
   let files;
   try {
@@ -107,7 +122,16 @@ function latestDump(nowMs = Date.now()) {
   };
 }
 
+// The Treasury desk's backup row (task 1004559), under the backup routes' own
+// atom: one tap runs POST /backup/trigger. Pure; exported for tests.
+function backupDeskRows(dump, running) {
+  const age = dump && Number.isFinite(Number(dump.age_hours)) ? Number(dump.age_hours) : null;
+  const fact = running ? 'backing up now' : age == null ? 'no backup yet' : age < 1 ? 'last one under an hour' : age < 48 ? `last ${Math.round(age)} hours ago` : `last ${Math.round(age / 24)} days ago`;
+  return [{ id: 'now', name: 'Back up now', fact, facts: dump && dump.stale ? ['the last one is stale'] : [], tool: true, ref: { type: 'backup', id: 'now' }, acts: running ? [] : [{ key: 'backup' }] }];
+}
+
 module.exports = function buildBackupRouter() {
+  seams.contribute('governor.docket', { desk: 'treasury.backup', gate: { permission: 'backup.manage' }, read: async () => backupDeskRows(await newestDumpAge(), triggerRunning) });
   const router = express.Router();
 
   // rank: metic+archon — any working builder may check or trigger a backup. Gate:
@@ -168,3 +192,5 @@ module.exports.parseDumpTimestamp = parseDumpTimestamp;
 module.exports.dumpAgeHours = dumpAgeHours;
 module.exports.isStaleDump = isStaleDump;
 module.exports.STALE_AFTER_HOURS = STALE_AFTER_HOURS;
+
+module.exports.backupDeskRows = backupDeskRows;

package/src/bongos/routes/builders.js

@@ -168,7 +168,45 @@ function fireDiscordBroadcast(text) {
   }
 }
 
+// The People desk's builder rows (task 1004559): one row per active builder the
+// viewer may act on, with the acts the viewer's own atoms allow: set tier
+// (builder.rank.set, PATCH /builders/:id/rank) and deactivate (builder.status.set,
+// PATCH /builders/:id/status). Never the viewer's own row: both routes refuse it.
+// Pure; exported for tests.
+const STOP_REASONS = Object.freeze([
+  { key: 'left', label: 'left the project' },
+  { key: 'quiet', label: 'gone quiet' },
+  { key: 'asked', label: 'asked to stop' },
+]);
+function builderDeskRows(builders, { viewerId, mayRank, mayStop, ranks }) {
+  if (!mayRank && !mayStop) return [];
+  return (builders || []).filter((b) => b && String(b.id) !== String(viewerId)).map((b) => {
+    const acts = [];
+    // one rung up at most (the route refuses a multi-rung promotion), any rung down
+    const at = (ranks || []).indexOf(b.rank);
+    // a rank off the live ladder offers no tier chip: there is no rung to move by one
+    if (mayRank && at >= 0) acts.push({ key: 'tier', options: (ranks || []).filter((r, i) => r !== b.rank && i <= at + 1).map((r) => ({ key: r, label: r })) });
+    if (mayStop) acts.push({ key: 'deactivate', options: STOP_REASONS });
+    return { id: b.id, name: b.display_name || b.github_login || `builder ${b.id}`, fact: b.rank || 'builder', facts: b.github_login ? [`@${b.github_login}`] : [], ref: { type: 'builder', id: b.id }, acts };
+  });
+}
+// Contributed from the router factory: any builder passes the gate, and the read
+// scopes itself to the viewer's atoms (an empty desk for a viewer holding neither).
+function contributeBuilderDesk() {
+  seams.contribute('governor.docket', {
+    desk: 'people.builders',
+    gate: { anyBuilder: true },
+    read: async (ctx) => {
+      const mayRank = ctx.has('builder.rank.set');
+      const mayStop = ctx.has('builder.status.set');
+      if (!mayRank && !mayStop) return [];
+      return builderDeskRows(await db.listActiveBuilders(), { viewerId: ctx.builderId, mayRank, mayStop, ranks: db.LIVE_RANK_LADDER });
+    },
+  });
+}
+
 module.exports = function buildBuildersRouter() {
+  contributeBuilderDesk();
   const router = express.Router();
 
   // rank: archon — sole chokepoint that mutates builders.rank; ADR 0016 §enforcement.
@@ -707,3 +745,5 @@ module.exports = function buildBuildersRouter() {
 
   return router;
 };
+
+module.exports.builderDeskRows = builderDeskRows;

package/src/bongos/routes/modules.js

@@ -180,8 +180,24 @@ function contributeModuleRechecksToDocket() {
   });
 }
 
+// The Rules desk's module rows (task 1004559), under the toggle's own atom
+// (POST /modules/:key/enable, module.enable): each module on disk, turned on in
+// one tap, or off with a one-tap 'yes' so a stray tap cannot pull one. Pure;
+// exported for tests.
+function moduleDeskRows(mods) {
+  return (mods || []).filter((m) => m && m.key).map((m) => ({
+    id: m.key, name: m.title || m.key, fact: m.enabled ? 'on' : 'off', facts: m.description ? [m.description] : [], tool: true,
+    ref: { type: 'module', id: m.key },
+    acts: [m.enabled ? { key: 'module_off', options: [{ key: 'yes', label: 'yes, turn off' }] } : { key: 'module_on' }],
+  }));
+}
+function contributeModuleDesk() {
+  seams.contribute('governor.docket', { desk: 'rules.modules', gate: { permission: 'module.enable' }, read: async () => moduleDeskRows(listModules()) });
+}
+
 module.exports = function buildModulesRouter() {
   contributeModuleRechecksToDocket();
+  contributeModuleDesk();
   const router = express.Router();
   // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
   // router starts empty.
@@ -702,3 +718,5 @@ module.exports = function buildModulesRouter() {
 // own disk scan, no DB), so it's safe to require directly outside an Express
 // request cycle, the same way tests/atlas.mjs requires gen-atlas.js's builders.
 module.exports.listModules = listModules;
+
+module.exports.moduleDeskRows = moduleDeskRows;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.33'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.35'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/governor_docket.mjs

@@ -285,7 +285,7 @@ test('the response shape: counts, line, street-ordered buildings, sorted matters
   c.readings.set('flow', { reading: 'flow', gate: { anyBuilder: true }, read: async () => ({ value: 3, figure: '3 stuck', line: 'longest wait 4 days, waiting for review', hot: true }) });
   const d = await docket.buildDocket({ viewer: VIEWER, permissions: ['board.vote.cast', 'security.report.adjudicate'], contributions: c, now: NOW });
 
-  assert.deepEqual(Object.keys(d).sort(), ['buildings', 'counts', 'floors', 'generated_at', 'history', 'history_sources', 'line', 'matters', 'readings', 'sources', 'viewer', 'vocabulary'].sort());
+  assert.deepEqual(Object.keys(d).sort(), ['buildings', 'counts', 'desks', 'floors', 'generated_at', 'history', 'history_sources', 'line', 'matters', 'readings', 'sources', 'viewer', 'vocabulary'].sort());
   assert.deepEqual(d.viewer, { id: '7' });
   // board 11 (needs) + board 12 (settled, closed this week) + blocker + report; board 13 is too old
   assert.deepEqual(d.counts, { needs: 2, moving: 1, settled: 1 });
@@ -734,3 +734,30 @@ test('GET /government/docket: 403 without board.vote.cast, the documented shape
   assert.equal(body.sources.find((s) => s.source === 'access_requests').status, 'not_yours');
   assert.ok(!JSON.stringify(body).includes('Admit Kai'), 'a hidden source leaks nothing');
 });
+
+// ── the floor desks' acts and rows (task 1004559) ────────────────────────────
+
+test('acts: a matter carries only well-formed acts, at most two, with at most five one-tap options', () => {
+  const m = docket.normalizeMatter({ id: 1, title: 't', acts: [{ key: 'confirm', options: [1, 2, 3, 4, 5, 6].map((n) => ({ key: n, label: `option ${n}` })) }, { key: 'Bad Key' }, { key: 'fix' }, { key: 'third' }] }, { source: 's', building: 'review' });
+  assert.deepEqual(m.acts.map((a) => a.key), ['confirm', 'fix']);
+  assert.equal(m.acts[0].options.length, 5);
+  assert.equal('acts' in docket.normalizeMatter({ id: 1, title: 't' }, { source: 's', building: 'review' }), false, 'no acts, no field');
+  assert.deepEqual(docket.normalizeActs([{ key: 'allow', pick: 'open_goals', except: [1, 2] }, { key: 'pause', pick: 'everything' }]), [{ key: 'allow', pick: 'open_goals', except: ['1', '2'] }, { key: 'pause' }]);
+  assert.equal(docket.normalizeDeskRow({ id: 1, name: 'n', acts: [] }, { desk: 'people.builders', building: 'people' }), null, 'a desk row with nothing to do is dropped');
+});
+
+test('desks: gated by the atom their write route checks; a gated-out desk is not_yours with no rows; a broken one is unavailable', async () => {
+  const c = none();
+  c.desks = new Map([
+    ['people.builders', { desk: 'people.builders', gate: { permission: 'builder.rank.set' }, read: async () => [{ id: 7, name: 'Ana', fact: 'thetes', acts: [{ key: 'tier', options: [{ key: 'metic', label: 'metic' }] }] }, { id: 8, name: 'no acts', acts: [] }] }],
+    ['automation.goals', { desk: 'automation.goals', gate: { anyBuilder: true }, read: async () => { throw new Error('boom'); } }],
+  ]);
+  const without = await docket.buildDocket({ viewer: VIEWER, permissions: [], contributions: c, now: NOW });
+  const by = (d, k) => d.desks.find((x) => x.key === k);
+  assert.deepEqual(by(without, 'people.builders'), { key: 'people.builders', building: 'people', status: 'not_yours', rows: [] });
+  assert.equal(by(without, 'automation.goals').status, 'unavailable');
+  assert.equal(by(without, 'automation.runners').status, 'off');
+  const withAtom = await docket.buildDocket({ viewer: VIEWER, permissions: ['builder.rank.set'], contributions: c, now: NOW });
+  assert.deepEqual(by(withAtom, 'people.builders').rows.map((r) => [r.id, r.name, r.acts[0].key]), [['people.builders:7', 'Ana', 'tier']]);
+  assert.equal(withAtom.matters.length, 0, 'desk rows never become matters (no pins, no counts)');
+});

package/tests/hall_matter_card.mjs

@@ -177,9 +177,18 @@ test('every act maps to the route that does it, with the body that route accepts
   assert.deepEqual(C.request(gate, 'release'), { method: 'POST', url: '/api/bongos/gate-approvals/812/approve', body: {} });
 });
 
-test('no act on any card reaches the core pin or a provisioning route', () => {
+// Task 1004559 moved the core update onto the Release desk, check first: the ONLY
+// way a card reaches the pin is the core_pin row, whose 'take' the server hands
+// only after a passed dry run (tests/hall_street_desk.mjs pins that), and which
+// needs the version chip as its confirmation. Nothing else may name the route.
+test('only the core_pin row reaches the core pin, and never without its version', () => {
   const src = read('street-card.js').replace(/^\s*\/\/.*$/gm, '');
-  assert.doesNotMatch(src, /core-upgrade|provisioning|\/core-update/);
+  const block = src.split('ACT_ROUTES.core_pin = {')[1].split('};')[0];
+  assert.equal(src.replace(block, '').match(/core-upgrade|provisioning|\/core-update/g), null, 'no other act names a provisioning route');
+  const cv = C.actsCard({ key: 'release.core:41', kind: 'core_pin', id: '41' });
+  assert.equal(C.request(cv, 'take', {}), null);
+  assert.equal(C.request(cv, 'check', {}), null);
+  assert.deepEqual(JSON.parse(JSON.stringify(C.request(cv, 'check', { option: '1.21.20' }))).body, { to: '1.21.20', dry_run: true });
 });
 
 test('an objection names its reason and its part before anything is sent; the parts are the server\'s own keys', () => {
@@ -258,7 +267,7 @@ async function bootPage({ feeds, posts = {} }) {
   };
   const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, Date, console, encodeURIComponent, decodeURIComponent, isNaN, isFinite });
   ctx.globalThis = ctx;
-  for (const f of ['city-draw.js', 'street-draw.js', 'street-card.js', 'street-inside.js', 'street.js']) vm.runInContext(read(f), ctx);
+  for (const f of ['city-draw.js', 'street-draw.js', 'street-card.js', 'street-inside.js', 'street-desk.js', 'street.js']) vm.runInContext(read(f), ctx);
   await window.GovStreetPage.ready;
   return { window, byId, calls, focused };
 }

package/tests/hall_street.mjs

@@ -376,7 +376,7 @@ test('the page holds the prototype\'s header, the street, the readings and the c
   assert.match(html, /<a class="street-mark" id="streetHome" href="\/builders\/city"[^>]*>\{\{productName\}\}</);
   for (const id of ['hudNeeds', 'hudMoving', 'hudShare', 'streetMode', 'streetSigns', 'streetPins', 'streetDoors', 'streetCard']) assert.match(html, new RegExp(`id="${id}"`), id);
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts, ['shell-trail', 'craft-mode', 'shell', 'palette', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-amend', 'street'], 'the hall shell (task 1004544), the shared kit, then the card (task 1004528), the interiors (task 1004526) and the drafted amendment (task 1004530)');
+  assert.deepEqual(scripts, ['shell-trail', 'craft-mode', 'shell', 'palette', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the shared kit, then the card (task 1004528), the interiors (task 1004526), the floor desk (task 1004558) and the drafted amendment (task 1004530)');
   assert.equal(City.STREET_HREF, '/builders/street', 'the city\'s door is this page');
 });
 

package/tests/hall_street_amend.mjs

@@ -253,7 +253,7 @@ async function bootPage({ hash = '#building=review', cons = constitution(), answ
   };
   const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, Date, console, encodeURIComponent, decodeURIComponent, isNaN, isFinite, Map, setTimeout, clearTimeout });
   ctx.globalThis = ctx;
-  for (const f of ['city-draw.js', 'street-draw.js', 'street-card.js', 'street-inside.js', 'street-amend.js', 'street.js']) vm.runInContext(read(f), ctx);
+  for (const f of ['city-draw.js', 'street-draw.js', 'street-card.js', 'street-inside.js', 'street-desk.js', 'street-amend.js', 'street.js']) vm.runInContext(read(f), ctx);
   await window.GovStreetPage.ready;
   await tick();
   return { window, byId, focused, gets, posts, history };