@bongos/core 1.21.34 → 1.21.35

package/modules/onboarding/routes/access-requests.js

@@ -242,7 +242,12 @@ function accessRequestDocketMatter(r) {
 // The governor's docket: a pending request to join stands at People, shown only
 // to a viewer holding `access_request.review` (this queue's own atom, because it
 // exposes would-be builders' usernames) and needing that same viewer's act.
+// The People desk's invite row (task 1004559), under the invite route's own atom:
+// one GitHub name typed in place, sent to POST /access-requests/invite.
+const INVITE_DESK_ROW = Object.freeze({ id: 'invite', name: 'Invite someone', fact: 'by their GitHub name', tool: true, ref: { type: 'invite', id: 'new' }, acts: [{ key: 'invite', field: 'github_login' }] });
+
 function contributeAccessRequestsToDocket() {
+  api.contribute('governor.docket', { desk: 'people.invite', gate: { permission: 'access_request.review' }, read: async () => [INVITE_DESK_ROW] });
   api.contribute('governor.docket', {
     source: 'access_requests',
     building: 'people',
@@ -651,3 +656,5 @@ module.exports = function buildAccessRequestsRouter() {
 };
 
 module.exports.accessRequestDocketMatter = accessRequestDocketMatter;
+
+module.exports.INVITE_DESK_ROW = INVITE_DESK_ROW;

package/modules/provisioning/core-upgrade.js

@@ -545,5 +545,5 @@ function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespo
   };
 }
 
-module.exports = { UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/routes/core-upgrade.js

@@ -25,12 +25,45 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
-const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler } = require('../core-upgrade');
+const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler, loadPreview } = require('../core-upgrade');
 const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
 
+// The Release desk's core row (task 1004559): the platform's own move, in two
+// steps on one row. Until a dry run has PASSED for the very version on offer the
+// row offers only 'check' (POST …/core-upgrade with dry_run); 'take' (the real
+// move) is handed only after that pass, so no desk can move the pin without the
+// check. The chip carries the version, which the route requires as its own
+// confirmation. A run in progress offers nothing (the row then steps aside for
+// the plain core-update matter). Pure; exported for tests.
+function coreDeskRows(preview) {
+  const p = preview || {};
+  const to = p.recommended_version;
+  if (!p.behind || !to || p.instance_id == null) return [];
+  if (p.open_intent && (p.open_intent.state === 'pending' || p.open_intent.state === 'running')) return [];
+  const pf = p.preflight && p.preflight.target === to ? p.preflight : null;
+  const version = [{ key: String(to), label: String(to) }];
+  const base = { id: p.instance_id, name: `Core ${to}`, over: 'core_update', opened_at: p.observed_at || null, ref: { type: 'core_pin', id: p.instance_id } };
+  if (pf && pf.ok) return [{ ...base, fact: 'checked · nothing blocks', facts: [`running ${p.served_version || 'unknown'}`], acts: [{ key: 'take', options: version }, { key: 'check', options: version }] }];
+  if (pf) return [{ ...base, fact: 'the check refused it', facts: [String(pf.error || 'no reason given'), `running ${p.served_version || 'unknown'}`], acts: [{ key: 'check', options: version }] }];
+  return [{ ...base, fact: 'not checked yet', facts: [`running ${p.served_version || 'unknown'}`], acts: [{ key: 'check', options: version }] }];
+}
+function contributeCoreDesk() {
+  api.contribute('governor.docket', {
+    desk: 'release.core',
+    // the control-plane read's own atom (GET /provisioning/control-plane)
+    gate: { permission: 'core.pin.move' },
+    read: async () => {
+      const { rows } = await api.pool.query("SELECT * FROM provisioning_instances WHERE hosting_shape = 'control-plane' LIMIT 1");
+      if (!rows.length) return [];
+      return coreDeskRows(await loadPreview(api.pool, provisioning, rows[0]));
+    },
+  });
+}
+
 module.exports = function buildCoreUpgradeRouter() {
+  contributeCoreDesk();
   const router = express.Router();
 
   // POST /provisioning/instances/:id/core-upgrade — move the core pin.
@@ -119,3 +152,5 @@ module.exports = function buildCoreUpgradeRouter() {
 
   return router;
 };
+
+module.exports.coreDeskRows = coreDeskRows;

package/modules/security/routes/reports.js

@@ -56,6 +56,23 @@ function redteamDocketMatter(r) {
     tally: null,
     href: '/watch',
     ref: { type: 'vulnerability_report', id: r.id },
+    // The floor desk's acts (task 1004559): the docket only lists this for a
+    // holder of the adjudicate atom, which both routes check.
+    acts: [{ key: 'confirm' }, { key: 'dispute' }],
+  };
+}
+
+// A confirmed report still waiting for its fix, as a Disputes desk row (task
+// 1004559): one act, POST /security/reports/:id/fix. Pure; exported for tests.
+function confirmedDeskRow(r) {
+  return {
+    id: r.id,
+    name: r.title,
+    fact: r.severity ? `${r.severity} · confirmed` : 'confirmed',
+    facts: ['confirmed, not fixed yet'],
+    opened_at: r.confirmed_at || r.reported_at || null,
+    ref: { type: 'vulnerability_report', id: r.id },
+    acts: [{ key: 'fix' }],
   };
 }
 
@@ -69,6 +86,11 @@ function contributeReportsToDocket() {
       return lists.flat().map(redteamDocketMatter);
     },
   });
+  api.contribute('governor.docket', {
+    desk: 'disputes.confirmed',
+    gate: { permission: 'security.report.adjudicate' },
+    read: async () => (await security.listVulnerabilityReports({ scope: 'all', status: 'confirmed', limit: 40 })).map(confirmedDeskRow),
+  });
   // The Disputes record (task 1004527): every report that was ruled on, dated by
   // its ruling (confirmed or fixed). Same atom as the list route it reads.
   api.contribute('governor.docket', {
@@ -318,3 +340,4 @@ module.exports = function buildSecurityReportsRouter() {
 
 module.exports.redteamDocketMatter = redteamDocketMatter;
 module.exports.rulingHistory = rulingHistory;
+module.exports.confirmedDeskRow = confirmedDeskRow;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.34",
+  "version": "1.21.35",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.34",
+      "version": "1.21.35",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.34",
+  "version": "1.21.35",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8964,5 +8964,11 @@
       "id": "1004558",
       "text": "Inside every building in the governor city, the floor you pick is now a desk you can act from, built from the new floor desks design. It shows the floor's name and how many things wait on you, up to three short numbers, and on"
     }
+  ],
+  "1.21.35": [
+    {
+      "id": "1004559",
+      "text": "Governing now happens inside the buildings. On a floor's desk you can set a builder's tier, deactivate them, invite someone by GitHub name, give or take back a custom rank; confirm, dispute or mark fixed a security report and"
+    }
   ]
 }

package/src/bongos/routes/backup.js

@@ -24,6 +24,7 @@ const auth = require('../auth');
 const { branding } = require('../../branding');
 const { resolveEnv } = require('../../instance-config');
 const { asyncHandler } = require('./_helpers');
+const seams = require('../../module-seams');
 // task 1003208: structured logging — was console.*. A core file logs through
 // the kernel logger directly; only MODULES go via api.logger (the doorway).
 const log = require('../logger').logger.child({ src: 'backup' });
@@ -76,6 +77,20 @@ function isStaleDump(stamp, nowMs = Date.now(), staleAfterHours = STALE_AFTER_HO
   return age > staleAfterHours;
 }
 
+// The newest dump's age for the Treasury desk (task 1004559), read WITHOUT
+// blocking: the docket is read on every street visit, so this is one async
+// directory listing and the age from the filename (no stat), never latestDump()'s
+// synchronous reads. Same filename rule and staleness rule as latestDump().
+async function newestDumpAge(nowMs = Date.now()) {
+  let files;
+  try { files = await fs.promises.readdir(BACKUP_DIR); } catch { return null; }
+  const dumps = files.filter((f) => f.startsWith(`${DB_NAME}-`) && f.endsWith('.sql.gz')).sort();
+  if (!dumps.length) return null;
+  const ts = dumps[dumps.length - 1].replace(`${DB_NAME}-`, '').replace('.sql.gz', '');
+  const age = dumpAgeHours(ts, nowMs);
+  return { age_hours: age === null ? null : Math.round(age * 10) / 10, stale: isStaleDump(ts, nowMs) };
+}
+
 function latestDump(nowMs = Date.now()) {
   let files;
   try {
@@ -107,7 +122,16 @@ function latestDump(nowMs = Date.now()) {
   };
 }
 
+// The Treasury desk's backup row (task 1004559), under the backup routes' own
+// atom: one tap runs POST /backup/trigger. Pure; exported for tests.
+function backupDeskRows(dump, running) {
+  const age = dump && Number.isFinite(Number(dump.age_hours)) ? Number(dump.age_hours) : null;
+  const fact = running ? 'backing up now' : age == null ? 'no backup yet' : age < 1 ? 'last one under an hour' : age < 48 ? `last ${Math.round(age)} hours ago` : `last ${Math.round(age / 24)} days ago`;
+  return [{ id: 'now', name: 'Back up now', fact, facts: dump && dump.stale ? ['the last one is stale'] : [], tool: true, ref: { type: 'backup', id: 'now' }, acts: running ? [] : [{ key: 'backup' }] }];
+}
+
 module.exports = function buildBackupRouter() {
+  seams.contribute('governor.docket', { desk: 'treasury.backup', gate: { permission: 'backup.manage' }, read: async () => backupDeskRows(await newestDumpAge(), triggerRunning) });
   const router = express.Router();
 
   // rank: metic+archon — any working builder may check or trigger a backup. Gate:
@@ -168,3 +192,5 @@ module.exports.parseDumpTimestamp = parseDumpTimestamp;
 module.exports.dumpAgeHours = dumpAgeHours;
 module.exports.isStaleDump = isStaleDump;
 module.exports.STALE_AFTER_HOURS = STALE_AFTER_HOURS;
+
+module.exports.backupDeskRows = backupDeskRows;

package/src/bongos/routes/builders.js

@@ -168,7 +168,45 @@ function fireDiscordBroadcast(text) {
   }
 }
 
+// The People desk's builder rows (task 1004559): one row per active builder the
+// viewer may act on, with the acts the viewer's own atoms allow: set tier
+// (builder.rank.set, PATCH /builders/:id/rank) and deactivate (builder.status.set,
+// PATCH /builders/:id/status). Never the viewer's own row: both routes refuse it.
+// Pure; exported for tests.
+const STOP_REASONS = Object.freeze([
+  { key: 'left', label: 'left the project' },
+  { key: 'quiet', label: 'gone quiet' },
+  { key: 'asked', label: 'asked to stop' },
+]);
+function builderDeskRows(builders, { viewerId, mayRank, mayStop, ranks }) {
+  if (!mayRank && !mayStop) return [];
+  return (builders || []).filter((b) => b && String(b.id) !== String(viewerId)).map((b) => {
+    const acts = [];
+    // one rung up at most (the route refuses a multi-rung promotion), any rung down
+    const at = (ranks || []).indexOf(b.rank);
+    // a rank off the live ladder offers no tier chip: there is no rung to move by one
+    if (mayRank && at >= 0) acts.push({ key: 'tier', options: (ranks || []).filter((r, i) => r !== b.rank && i <= at + 1).map((r) => ({ key: r, label: r })) });
+    if (mayStop) acts.push({ key: 'deactivate', options: STOP_REASONS });
+    return { id: b.id, name: b.display_name || b.github_login || `builder ${b.id}`, fact: b.rank || 'builder', facts: b.github_login ? [`@${b.github_login}`] : [], ref: { type: 'builder', id: b.id }, acts };
+  });
+}
+// Contributed from the router factory: any builder passes the gate, and the read
+// scopes itself to the viewer's atoms (an empty desk for a viewer holding neither).
+function contributeBuilderDesk() {
+  seams.contribute('governor.docket', {
+    desk: 'people.builders',
+    gate: { anyBuilder: true },
+    read: async (ctx) => {
+      const mayRank = ctx.has('builder.rank.set');
+      const mayStop = ctx.has('builder.status.set');
+      if (!mayRank && !mayStop) return [];
+      return builderDeskRows(await db.listActiveBuilders(), { viewerId: ctx.builderId, mayRank, mayStop, ranks: db.LIVE_RANK_LADDER });
+    },
+  });
+}
+
 module.exports = function buildBuildersRouter() {
+  contributeBuilderDesk();
   const router = express.Router();
 
   // rank: archon — sole chokepoint that mutates builders.rank; ADR 0016 §enforcement.
@@ -707,3 +745,5 @@ module.exports = function buildBuildersRouter() {
 
   return router;
 };
+
+module.exports.builderDeskRows = builderDeskRows;

package/src/bongos/routes/modules.js

@@ -180,8 +180,24 @@ function contributeModuleRechecksToDocket() {
   });
 }
 
+// The Rules desk's module rows (task 1004559), under the toggle's own atom
+// (POST /modules/:key/enable, module.enable): each module on disk, turned on in
+// one tap, or off with a one-tap 'yes' so a stray tap cannot pull one. Pure;
+// exported for tests.
+function moduleDeskRows(mods) {
+  return (mods || []).filter((m) => m && m.key).map((m) => ({
+    id: m.key, name: m.title || m.key, fact: m.enabled ? 'on' : 'off', facts: m.description ? [m.description] : [], tool: true,
+    ref: { type: 'module', id: m.key },
+    acts: [m.enabled ? { key: 'module_off', options: [{ key: 'yes', label: 'yes, turn off' }] } : { key: 'module_on' }],
+  }));
+}
+function contributeModuleDesk() {
+  seams.contribute('governor.docket', { desk: 'rules.modules', gate: { permission: 'module.enable' }, read: async () => moduleDeskRows(listModules()) });
+}
+
 module.exports = function buildModulesRouter() {
   contributeModuleRechecksToDocket();
+  contributeModuleDesk();
   const router = express.Router();
   // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
   // router starts empty.
@@ -702,3 +718,5 @@ module.exports = function buildModulesRouter() {
 // own disk scan, no DB), so it's safe to require directly outside an Express
 // request cycle, the same way tests/atlas.mjs requires gen-atlas.js's builders.
 module.exports.listModules = listModules;
+
+module.exports.moduleDeskRows = moduleDeskRows;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.34'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.35'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/governor_docket.mjs

@@ -285,7 +285,7 @@ test('the response shape: counts, line, street-ordered buildings, sorted matters
   c.readings.set('flow', { reading: 'flow', gate: { anyBuilder: true }, read: async () => ({ value: 3, figure: '3 stuck', line: 'longest wait 4 days, waiting for review', hot: true }) });
   const d = await docket.buildDocket({ viewer: VIEWER, permissions: ['board.vote.cast', 'security.report.adjudicate'], contributions: c, now: NOW });
 
-  assert.deepEqual(Object.keys(d).sort(), ['buildings', 'counts', 'floors', 'generated_at', 'history', 'history_sources', 'line', 'matters', 'readings', 'sources', 'viewer', 'vocabulary'].sort());
+  assert.deepEqual(Object.keys(d).sort(), ['buildings', 'counts', 'desks', 'floors', 'generated_at', 'history', 'history_sources', 'line', 'matters', 'readings', 'sources', 'viewer', 'vocabulary'].sort());
   assert.deepEqual(d.viewer, { id: '7' });
   // board 11 (needs) + board 12 (settled, closed this week) + blocker + report; board 13 is too old
   assert.deepEqual(d.counts, { needs: 2, moving: 1, settled: 1 });
@@ -734,3 +734,30 @@ test('GET /government/docket: 403 without board.vote.cast, the documented shape
   assert.equal(body.sources.find((s) => s.source === 'access_requests').status, 'not_yours');
   assert.ok(!JSON.stringify(body).includes('Admit Kai'), 'a hidden source leaks nothing');
 });
+
+// ── the floor desks' acts and rows (task 1004559) ────────────────────────────
+
+test('acts: a matter carries only well-formed acts, at most two, with at most five one-tap options', () => {
+  const m = docket.normalizeMatter({ id: 1, title: 't', acts: [{ key: 'confirm', options: [1, 2, 3, 4, 5, 6].map((n) => ({ key: n, label: `option ${n}` })) }, { key: 'Bad Key' }, { key: 'fix' }, { key: 'third' }] }, { source: 's', building: 'review' });
+  assert.deepEqual(m.acts.map((a) => a.key), ['confirm', 'fix']);
+  assert.equal(m.acts[0].options.length, 5);
+  assert.equal('acts' in docket.normalizeMatter({ id: 1, title: 't' }, { source: 's', building: 'review' }), false, 'no acts, no field');
+  assert.deepEqual(docket.normalizeActs([{ key: 'allow', pick: 'open_goals', except: [1, 2] }, { key: 'pause', pick: 'everything' }]), [{ key: 'allow', pick: 'open_goals', except: ['1', '2'] }, { key: 'pause' }]);
+  assert.equal(docket.normalizeDeskRow({ id: 1, name: 'n', acts: [] }, { desk: 'people.builders', building: 'people' }), null, 'a desk row with nothing to do is dropped');
+});
+
+test('desks: gated by the atom their write route checks; a gated-out desk is not_yours with no rows; a broken one is unavailable', async () => {
+  const c = none();
+  c.desks = new Map([
+    ['people.builders', { desk: 'people.builders', gate: { permission: 'builder.rank.set' }, read: async () => [{ id: 7, name: 'Ana', fact: 'thetes', acts: [{ key: 'tier', options: [{ key: 'metic', label: 'metic' }] }] }, { id: 8, name: 'no acts', acts: [] }] }],
+    ['automation.goals', { desk: 'automation.goals', gate: { anyBuilder: true }, read: async () => { throw new Error('boom'); } }],
+  ]);
+  const without = await docket.buildDocket({ viewer: VIEWER, permissions: [], contributions: c, now: NOW });
+  const by = (d, k) => d.desks.find((x) => x.key === k);
+  assert.deepEqual(by(without, 'people.builders'), { key: 'people.builders', building: 'people', status: 'not_yours', rows: [] });
+  assert.equal(by(without, 'automation.goals').status, 'unavailable');
+  assert.equal(by(without, 'automation.runners').status, 'off');
+  const withAtom = await docket.buildDocket({ viewer: VIEWER, permissions: ['builder.rank.set'], contributions: c, now: NOW });
+  assert.deepEqual(by(withAtom, 'people.builders').rows.map((r) => [r.id, r.name, r.acts[0].key]), [['people.builders:7', 'Ana', 'tier']]);
+  assert.equal(withAtom.matters.length, 0, 'desk rows never become matters (no pins, no counts)');
+});

package/tests/hall_matter_card.mjs

@@ -177,9 +177,18 @@ test('every act maps to the route that does it, with the body that route accepts
   assert.deepEqual(C.request(gate, 'release'), { method: 'POST', url: '/api/bongos/gate-approvals/812/approve', body: {} });
 });
 
-test('no act on any card reaches the core pin or a provisioning route', () => {
+// Task 1004559 moved the core update onto the Release desk, check first: the ONLY
+// way a card reaches the pin is the core_pin row, whose 'take' the server hands
+// only after a passed dry run (tests/hall_street_desk.mjs pins that), and which
+// needs the version chip as its confirmation. Nothing else may name the route.
+test('only the core_pin row reaches the core pin, and never without its version', () => {
   const src = read('street-card.js').replace(/^\s*\/\/.*$/gm, '');
-  assert.doesNotMatch(src, /core-upgrade|provisioning|\/core-update/);
+  const block = src.split('ACT_ROUTES.core_pin = {')[1].split('};')[0];
+  assert.equal(src.replace(block, '').match(/core-upgrade|provisioning|\/core-update/g), null, 'no other act names a provisioning route');
+  const cv = C.actsCard({ key: 'release.core:41', kind: 'core_pin', id: '41' });
+  assert.equal(C.request(cv, 'take', {}), null);
+  assert.equal(C.request(cv, 'check', {}), null);
+  assert.deepEqual(JSON.parse(JSON.stringify(C.request(cv, 'check', { option: '1.21.20' }))).body, { to: '1.21.20', dry_run: true });
 });
 
 test('an objection names its reason and its part before anything is sent; the parts are the server\'s own keys', () => {

package/tests/hall_street_desk.mjs

@@ -326,3 +326,232 @@ test('the stylesheet: the desk in tokens only, its motion dies under reduced mot
   assert.match(css, /@media \(prefers-reduced-motion: reduce\) \{[^}]*animation: none !important; transition: none !important;/);
   assert.match(read('street.html'), /id="streetTodayPips"/);
 });
+
+// ── the old-page actions on their floors (task 1004559) ───────────────────────
+// Rows built by the REAL server mappers (each module's own pure function), run
+// through the docket's own normalisers, into the real desk: so a field the
+// server stops sending, or a desk row the desk cannot draw, reds here.
+const SRV = (p) => require(path.join(ROOT, p));
+const DK = SRV('modules/government/docket.js');
+const reportsRoute = SRV('modules/security/routes/reports.js');
+const lifeDocket = SRV('modules/lifecycle/governor-docket.js');
+const autoDocket = SRV('modules/autonomy/governor-docket.js');
+const buildersRoute = SRV('src/bongos/routes/builders.js');
+const govFloors = SRV('modules/government/docket-floors.js');
+const LADDER = ['xenos', 'thetes', 'metic', 'archon'];
+const healthy = () => ({ ok: true, state: 'alive' });
+
+function actedDocket({ longWords = false, force = true } = {}) {
+  const t = (s) => (longWords ? `${LONG} ${s}` : s);
+  const norm = (source, building, list) => list.map((m) => DK.normalizeMatter(m, { source, building })).filter(Boolean);
+  const matters = [
+    ...norm('redteam_reports', 'disputes', [reportsRoute.redteamDocketMatter({ id: 2, title: t('sign-in limits'), severity: 'high', status: 'open', reported_at: '2026-10-01T10:00:00.000Z' })]),
+    ...norm('removal_proposals', 'disputes', [lifeDocket.removalMatter({ proposal_task_id: '50', title: t('old search page'), filed_at: '2026-09-30T10:00:00.000Z' })]),
+    ...norm('criteria_uat', 'review', [
+      lifeDocket.uatMatter({ id: 8, criterion_md: t('Refunds work'), goal_id: 4, shipped_total: 3, backend_only: true }, { force }),
+      lifeDocket.uatMatter({ id: 9, criterion_md: t('The city draws'), goal_id: 4, shipped_total: 2, backend_only: false }, { force }),
+    ]),
+    ...norm('autobongos_fence', 'automation', autoDocket.fenceDocketMatters({ enabled: false, paused_reason: 'payments touched', goals: [] }, true)),
+  ];
+  const desk = (key, building, rows) => ({ key, building, status: 'live', rows: rows.map((r) => DK.normalizeDeskRow(r, { desk: key, building })).filter(Boolean) });
+  const project = { enabled: true, priority_goal_id: 1, goals: [{ goal_id: 1, added_at: '2026-09-20T10:00:00.000Z' }, { goal_id: 2, added_at: '2026-09-21T10:00:00.000Z' }] };
+  const desks = [
+    desk('people.builders', 'people', buildersRoute.builderDeskRows([{ id: 7, display_name: t('Ana Ruiz'), github_login: 'ana', rank: 'thetes' }, { id: 95, display_name: 'Me', rank: 'archon' }], { viewerId: '95', mayRank: true, mayStop: true, ranks: LADDER })),
+    desk('people.ranks', 'people', govFloors.rankDeskRows([{ rank_key: 'tester', label: t('Tester'), is_system: false }, { rank_key: 'archon', label: 'Archon', is_system: true }], [{ builder_id: 7, display_name: 'Ana Ruiz', rank_key: 'tester' }, { builder_id: 8, github_login: 'kai', rank_key: 'metic' }])),
+    desk('disputes.confirmed', 'disputes', [reportsRoute.confirmedDeskRow({ id: 3, title: t('token leak'), severity: 'low', confirmed_at: '2026-09-28T10:00:00.000Z' })]),
+    desk('automation.switch', 'automation', autoDocket.switchDeskRows(project)),
+    desk('automation.goals', 'automation', autoDocket.goalDeskRows(project)),
+    desk('automation.runners', 'automation', autoDocket.runnerDeskRows([{ builder_id: 7, display_name: t('Ana Ruiz'), runners: [{ working_task_id: 12 }] }, { builder_id: 8, owner_paused: true, owner_paused_reason: 'spending too much', runners: [] }], NOW, healthy)),
+  ];
+  return docket(matters, { desks });
+}
+const GOALS = [{ id: '1', title: 'Governor city', status: 'open' }, { id: '2', title: 'Payments', status: 'open' }, { id: '3', title: LONG, status: 'open' }];
+const actedRows = (dk, key, floor) => D.rowsFor(key, floor, dk, { now: NOW, viewerId: '95', goals: GOALS });
+
+test('the moved acts keep the line rule on every floor, long words or short', () => {
+  for (const longWords of [false, true]) {
+    const dk = actedDocket({ longWords });
+    const desks = [];
+    for (const key of S.CIVIC_KEYS) I.PLAN[key].floors.forEach((_f, floor) => desks.push(D.deskModel({ key, floor, docket: dk, goals: GOALS, now: NOW, viewerId: '95' })));
+    assert.deepEqual(desks.flatMap((d) => D.breaks(d)), []);
+    const rows = desks.flatMap((d) => d.rows);
+    assert.ok(rows.length >= 14, 'every moved act drew its row');
+    assert.ok(rows.every((r) => r.wait === '' || r.actions.length === 0));
+  }
+});
+
+test('breaks() catches an asking button with no chips of its own', () => {
+  const dk = actedDocket();
+  const dm = D.deskModel({ key: 'people', floor: 2, docket: dk, goals: GOALS, now: NOW, viewerId: '95' });
+  assert.deepEqual(D.breaks(dm), []);
+  const bad = j(dm);
+  bad.rows[0].choices = {};
+  assert.ok(D.breaks(bad).some((b) => /without its own chips/.test(b)));
+});
+
+test('People: set tier and deactivate are chips on the builder row, never your own; ranks are given and taken back', () => {
+  const dk = actedDocket();
+  const rows = actedRows(dk, 'people', 2);
+  assert.deepEqual(rows.map((r) => r.name), ['Ana Ruiz'], 'your own row is never drawn');
+  const ana = rows[0];
+  assert.deepEqual(ana.actions.map((a) => [a.key, a.label]), [['tier', 'tier'], ['deactivate', 'deactivate']]);
+  assert.deepEqual(ana.choices.tier.options.map((o) => o.key), ['xenos', 'metic'], 'one rung up at most, any rung down');
+  assert.deepEqual(j(C.request(ana.card, 'tier', ana.choices.tier.options[1].input)), { method: 'PATCH', url: '/api/bongos/builders/7/rank', body: { rank: 'metic' } });
+  assert.deepEqual(j(C.request(ana.card, 'deactivate', ana.choices.deactivate.options[0].input)), { method: 'PATCH', url: '/api/bongos/builders/7/status', body: { status: 'inactive', reason: 'left the project' } });
+  const rank = actedRows(dk, 'people', 5)[0];
+  assert.deepEqual(rank.actions.map((a) => a.key), ['give', 'take']);
+  assert.deepEqual(rank.choices.give.options.map((o) => o.label), ['kai']);
+  assert.deepEqual(j(C.request(rank.card, 'give', rank.choices.give.options[0].input)), { method: 'POST', url: '/api/bongos/government/assignments', body: { builder_id: 8, rank_key: 'tester' } });
+  assert.deepEqual(j(C.request(rank.card, 'take', rank.choices.take.options[0].input)), { method: 'DELETE', url: '/api/bongos/government/assignments/7/tester', body: {} });
+  assert.deepEqual(buildersRoute.builderDeskRows([{ id: 7, rank: 'xenos' }], { viewerId: '95', mayRank: false, mayStop: false, ranks: LADDER }), [], 'no atom, no rows');
+  assert.deepEqual(buildersRoute.builderDeskRows([{ id: 7, rank: 'xenos' }], { viewerId: '95', mayRank: false, mayStop: true, ranks: LADDER })[0].acts.map((a) => a.key), ['deactivate']);
+});
+
+test('Disputes: a report is confirmed or disputed, a confirmed one marked fixed, a removal confirmed or kept', () => {
+  const dk = actedDocket();
+  const [rep, fix] = actedRows(dk, 'disputes', 0);
+  assert.deepEqual(rep.actions.map((a) => a.label), ['confirm', 'dispute']);
+  assert.equal(C.request(rep.card, 'confirm').url, '/api/bongos/security/reports/2/confirm');
+  assert.equal(C.request(rep.card, 'dispute').url, '/api/bongos/security/reports/2/dispute');
+  assert.deepEqual(fix.actions.map((a) => a.label), ['fixed']);
+  assert.equal(C.request(fix.card, 'fix').url, '/api/bongos/security/reports/3/fix');
+  const rm = actedRows(dk, 'disputes', 1)[0];
+  assert.deepEqual(rm.actions.map((a) => a.label), ['remove', 'keep']);
+  assert.deepEqual(j(C.request(rm.card, 'remove')), { method: 'POST', url: '/api/bongos/removal-proposals/50/decide', body: { verdict: 'confirmed' } });
+  assert.deepEqual(j(C.request(rm.card, 'keep')).body, { verdict: 'dismissed' });
+});
+
+test('Automation: switch on and off, allow a goal from the open goals, first in line, disallow, pause and resume a runner', () => {
+  const dk = actedDocket();
+  const sw = actedRows(dk, 'automation', 0);
+  const off = sw.find((r) => r.source === 'autobongos_fence');
+  assert.deepEqual(off.actions.map((a) => a.label), ['switch on']);
+  assert.deepEqual(j(C.request(off.card, 'switch_on')), { method: 'POST', url: '/api/bongos/autonomy/fence', body: { enabled: true } });
+  const on = sw.find((r) => r.desk);
+  assert.deepEqual(j(C.request(on.card, 'switch_off', on.choices.switch_off.options[0].input)).body, { enabled: false, reason: 'pause for now' });
+  const goals = actedRows(dk, 'automation', 1);
+  const first = goals.find((r) => r.name === 'Governor city');
+  assert.ok(first, 'an allowed goal is lettered with its title');
+  assert.deepEqual(first.actions.map((a) => a.key), ['disallow'], 'the goal first in line is not offered first again');
+  assert.equal(j(C.request(first.card, 'disallow')).method, 'DELETE');
+  assert.equal(C.request(first.card, 'disallow').url, '/api/bongos/autonomy/fence/goals/1');
+  const pay = goals.find((r) => r.name === 'Payments');
+  assert.deepEqual(j(C.request(pay.card, 'first')), { method: 'POST', url: '/api/bongos/autonomy/fence/priority', body: { goal_id: 2 } });
+  const add = goals.find((r) => r.actions.some((a) => a.key === 'allow'));
+  assert.deepEqual(add.choices.allow.options.map((o) => o.key), ['3'], 'only open goals not yet allowed');
+  const goalDesk = D.deskModel({ key: 'automation', floor: 1, docket: dk, goals: GOALS, now: NOW });
+  assert.match(goalDesk.status, /^2 allowed/, 'the allow row is a tool, not a goal: the floor counts two');
+  assert.deepEqual(j(C.request(add.card, 'allow', add.choices.allow.options[0].input)).body, { goal_id: 3 });
+  const runners = actedRows(dk, 'automation', 2);
+  const busy = runners.find((r) => r.actions[0].key === 'pause');
+  assert.deepEqual(j(C.request(busy.card, 'pause', busy.choices.pause.options[2].input)), { method: 'POST', url: '/api/bongos/autonomy/builders/7/pause', body: { paused: true, reason: 'it is stuck' } });
+  const paused = runners.find((r) => r.actions[0].key === 'resume');
+  assert.deepEqual(j(C.request(paused.card, 'resume')).body, { paused: false });
+  // with every open goal allowed, the allow row has no chip to offer and is not drawn
+  const none = D.rowsFor('automation', 1, dk, { now: NOW, goals: GOALS.slice(0, 2) });
+  assert.ok(!none.some((r) => r.actions.some((a) => a.key === 'allow')));
+});
+
+test('Review: a backend-only promise signs off in one tap; a recorded one goes to its page; force sign-off only with its atom', () => {
+  const rows = actedRows(actedDocket(), 'review', 1);
+  const backend = rows.find((r) => r.actions[0].key === 'signoff');
+  assert.deepEqual(j(C.request(backend.card, 'signoff', backend.choices.signoff.options[0].input)), { method: 'POST', url: '/api/bongos/done-when/8/uat', body: { kind: 'backend_signoff', live_attested: true } });
+  assert.deepEqual(j(C.request(backend.card, 'force', backend.choices.force.options[0].input)), { method: 'POST', url: '/api/bongos/done-when/8/satisfy', body: { override_reason: 'Signed off on the floor desk: tested by hand.' } });
+  const ui = rows.find((r) => r.actions[0].key === 'record');
+  assert.equal(ui.actions[0].go, '/goals#/goal/4');
+  const noForce = actedRows(actedDocket({ force: false }), 'review', 1);
+  assert.ok(noForce.every((r) => !r.actions.some((a) => a.key === 'force')));
+});
+
+test('a viewer the server hands no acts sees the quiet line, not rows', () => {
+  const dk = actedDocket();
+  dk.desks = dk.desks.map((d) => ({ ...d, status: 'not_yours', rows: [] }));
+  const dm = D.deskModel({ key: 'people', floor: 2, docket: dk, goals: GOALS, now: NOW, viewerId: '95' });
+  assert.equal(dm.quiet, true);
+  assert.deepEqual(D.breaks(dm), []);
+});
+
+// ── Release, Rules, Treasury and the invite (task 1004559, second pass) ──────
+const coreRoute = SRV('modules/provisioning/routes/core-upgrade.js');
+const settingsRoute = SRV('modules/lifecycle/routes/project-settings.js');
+const modulesRoute = SRV('src/bongos/routes/modules.js');
+const backupRoute = SRV('src/bongos/routes/backup.js');
+const accessRoute = SRV('modules/onboarding/routes/access-requests.js');
+const PREVIEW = { instance_id: 41, served_version: '1.21.19', recommended_version: '1.21.20', behind: true, observed_at: '2026-10-03T10:00:00.000Z' };
+
+function moreDesks({ preflight = null, longWords = false } = {}) {
+  const t = (s) => (longWords ? `${LONG} ${s}` : s);
+  const desk = (key, building, rows) => ({ key, building, status: 'live', rows: rows.map((r) => DK.normalizeDeskRow(r, { desk: key, building })).filter(Boolean) });
+  const dk = actedDocket({ longWords });
+  dk.matters.push(DK.normalizeMatter({ id: '1.21.20', rule: 'decide', state: 'needs', title: 'Take core 1.21.20 (running 1.21.19)', short: 'core 1.21.20', href: '/settings#software-update', ref: { type: 'core_version', id: '1.21.20' } }, { source: 'core_update', building: 'release' }));
+  dk.desks.push(
+    desk('release.core', 'release', coreRoute.coreDeskRows({ ...PREVIEW, preflight })),
+    desk('rules.settings', 'rules', settingsRoute.settingsDeskRows({ days: 14, categories: [{ active: true }, { active: false }] })),
+    desk('rules.modules', 'rules', modulesRoute.moduleDeskRows([{ key: 'discord', title: t('Discord'), enabled: true }, { key: 'economy', title: 'Economy', enabled: false }])),
+    desk('treasury.backup', 'treasury', backupRoute.backupDeskRows({ age_hours: 30, stale: false }, false)),
+    desk('people.invite', 'people', [accessRoute.INVITE_DESK_ROW]),
+  );
+  return dk;
+}
+
+test('the second-pass desks keep the line rule on every floor', () => {
+  for (const longWords of [false, true]) {
+    for (const preflight of [null, { target: '1.21.20', ok: true }, { target: '1.21.20', ok: false, error: LONG }]) {
+      const dk = moreDesks({ preflight, longWords });
+      const desks = [];
+      for (const key of S.CIVIC_KEYS) I.PLAN[key].floors.forEach((_f, floor) => desks.push(D.deskModel({ key, floor, docket: dk, goals: GOALS, now: NOW, viewerId: '95' })));
+      assert.deepEqual(desks.flatMap((d) => D.breaks(d)), []);
+    }
+  }
+});
+
+test('Release: the core update is checked first; take is offered only after a pass, for that version, and stands in for the link', () => {
+  const rows = (pf) => actedRows(moreDesks({ preflight: pf }), 'release', 3);
+  const fresh = rows(null);
+  assert.deepEqual(fresh.map((r) => r.source), ['release.core'], 'the core row replaces the plain core-update link');
+  assert.deepEqual(fresh[0].actions.map((a) => a.key), ['check'], 'no take before a check');
+  assert.deepEqual(j(C.request(fresh[0].card, 'check', fresh[0].choices.check.options[0].input)), { method: 'POST', url: '/api/bongos/provisioning/instances/41/core-upgrade', body: { to: '1.21.20', dry_run: true } });
+  assert.deepEqual(rows({ target: '1.21.20', ok: false, error: 'x' })[0].actions.map((a) => a.key), ['check'], 'a refused check offers no take');
+  assert.deepEqual(rows({ target: '1.21.19', ok: true })[0].actions.map((a) => a.key), ['check'], 'a pass for another version is no pass');
+  const passed = rows({ target: '1.21.20', ok: true })[0];
+  assert.deepEqual(passed.actions.map((a) => [a.key, a.label]), [['take', 'take it'], ['check', 'check']]);
+  assert.deepEqual(j(C.request(passed.card, 'take', passed.choices.take.options[0].input)), { method: 'POST', url: '/api/bongos/provisioning/instances/41/core-upgrade', body: { to: '1.21.20' } });
+  assert.equal(C.request(passed.card, 'take', {}), null, 'no version chip, no move');
+  assert.deepEqual(coreRoute.coreDeskRows({ ...PREVIEW, open_intent: { state: 'running' } }), [], 'a run in progress offers nothing');
+  assert.deepEqual(coreRoute.coreDeskRows({ ...PREVIEW, behind: false }), []);
+});
+
+test('Rules: the rot timer as day chips, work categories as a link, modules on in one tap and off with a yes', () => {
+  const rows = actedRows(moreDesks(), 'rules', 0);
+  const rot = rows.find((r) => r.name === 'Rot timer');
+  assert.deepEqual(rot.choices.rot.options.map((o) => o.key), ['7', '30', '60', '90'], 'the current value is not offered');
+  assert.deepEqual(j(C.request(rot.card, 'rot', rot.choices.rot.options[1].input)), { method: 'PATCH', url: '/api/bongos/project-settings/rot-days', body: { days: 30 } });
+  const cats = rows.find((r) => r.name === 'Work categories');
+  assert.equal(cats.actions[0].go, '/project-settings');
+  const on = rows.find((r) => r.name === 'Economy');
+  assert.deepEqual(j(C.request(on.card, 'module_on')), { method: 'POST', url: '/api/bongos/modules/economy/enable', body: { enabled: true } });
+  const off = rows.find((r) => r.name === 'Discord');
+  assert.equal(off.choices.module_off.options[0].label, 'yes, turn off');
+  assert.deepEqual(j(C.request(off.card, 'module_off', off.choices.module_off.options[0].input)).body, { enabled: false });
+});
+
+test('Treasury: back up now in one tap; People: invite takes one typed GitHub name', () => {
+  const dk = moreDesks();
+  const backup = actedRows(dk, 'treasury', 2)[0];
+  assert.equal(backup.fact, 'last 30 hours ago');
+  assert.deepEqual(j(C.request(backup.card, 'backup')), { method: 'POST', url: '/api/bongos/backup/trigger', body: {} });
+  assert.deepEqual(backupRoute.backupDeskRows(null, true)[0].acts, [], 'a backup already running offers no second one');
+  const invite = actedRows(dk, 'people', 4).find((r) => r.name === 'Invite someone');
+  assert.equal(invite.choices.invite.field, 'github_login');
+  assert.deepEqual(j(C.request(invite.card, 'invite', { option: '  ana-ruiz ' })), { method: 'POST', url: '/api/bongos/access-requests/invite', body: { github_login: 'ana-ruiz' } });
+  assert.equal(C.request(invite.card, 'invite', { option: ' ' }), null, 'nothing typed, nothing sent');
+  const tiles = D.deskModel({ key: 'treasury', floor: 2, docket: dk, goals: GOALS, now: NOW });
+  assert.deepEqual(D.breaks(tiles), []);
+});
+
+test('the Treasury desk reads the newest backup without blocking (no sync disk read on the docket path)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/backup.js'), 'utf8');
+  assert.match(src, /desk: 'treasury\.backup'[^\n]*await newestDumpAge\(\)/);
+  const body = src.split('async function newestDumpAge')[1].split('\nfunction latestDump')[0];
+  assert.doesNotMatch(body, /Sync\(/);
+});