@bongos/core 1.24.56 → 1.24.58

package/scripts/gds/css-literal-scan.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// scripts/gds/css-literal-scan.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/css-literal-scan.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'css-literal-scan.js');

package/scripts/gds/design-generators-fresh.js

@@ -0,0 +1,6 @@
+// scripts/gds/design-generators-fresh.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/design-generators-fresh.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'design-generators-fresh.js');

package/scripts/hall-preview/server.js

@@ -208,9 +208,6 @@ const CANNED_WRITES = [
   // a vote cast from the street's matter card (task 1004528), so the card's
   // answer (the toast, the building lighting) renders here too.
   ['POST', /^government\/board\/items\/\d+\/votes$/, 'government__board__items__votes.post'],
-  // Settings → Software update's "Ask for this upgrade" (task 1004595), so the
-  // pending line the panel draws after the press renders here too.
-  ['POST', /^software-update\/request$/, 'software-update__request.post'],
   // the studio's AI pages (task 1004921): a file uploads, a request is sent
   // (it answers as 1002, the running one), and money is added.
   ['POST', /^ai-studio\/uploads$/, 'ai-studio__uploads.post'],

package/src/bongos/module-scope-map.js

@@ -473,7 +473,7 @@ const MODULE_GLOBS = {
     'scripts/bongos/adr-namespace.js', 'scripts/bongos/baseline-staleness.js',
     'scripts/bongos/category-advisory-guard.js', 'scripts/bongos/client-baseurl-guard.js',
     'scripts/bongos/doc-cli-guard.js', 'scripts/bongos/doc-control-claims.js', 'scripts/bongos/doc-comment-coverage.js',
-    'scripts/bongos/exec-path-guard.js', 'scripts/bongos/fitness-lib.js',
+    'scripts/bongos/exec-path-guard.js', 'scripts/bongos/fitness-lib.js', 'scripts/bongos/design-generators-fresh.js',
     'scripts/bongos/fitness-checks-error-envelope.js', 'scripts/bongos/fitness-checks-identity.js',
     'scripts/bongos/fitness-checks-packaging.js', 'scripts/bongos/fitness-checks-route-pins.js',
     'scripts/bongos/fitness-checks-vocabulary.js', 'scripts/bongos/fitness-checks-write-validation.js',

package/src/bongos/routes/core-update.js

@@ -34,7 +34,6 @@ const { readSoftwareUpdate } = require('../software-update');
 const { followForShape } = require('../../../scripts/bongos/update-channel.js');
 const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
-const upgradeRequest = require('../upgrade-request');
 const { readUpgradeHold } = require('../upgrade-hold');
 const { moveNotice, moveHistory, readInstalledReleaseNotes } = require('../core-moves');
 
@@ -82,10 +81,35 @@ function hubManageLinks(config) {
 // address as <PREFIX>_HUB_UPGRADE_URL (task 1004608). Without it, those owners were told to
 // run `bongos upgrade` on a server the platform runs. Only the hub's /deploy path is taken.
 const HUB_UPGRADE_URL_RE = /^https?:\/\/[^\s"'<>/]+\/deploy\?project=[A-Za-z0-9._%-]+$/;
-function updateDoor({ provisioning, idp, hubUpgradeUrl }) {
+// THE LAST FALLBACK (task 1005128). A hosted project whose web.env predates the line above
+// (toast, 2026-11) named neither, fell to `cli`, and its owner was offered "Ask for this
+// upgrade" instead of the Update button — the owner: "if the update is generally available
+// then they should be able to download it". So a project that answers on a name under its
+// hub's own domain (the hub's rule for "a project we host") is sent to that hub's door by its
+// address instead of its slug: `<hub>/deploy?host=<host>`. The hub resolves the address among
+// the visitor's OWN projects, exactly as it resolves a slug, and the hand-off still only
+// accepts the project's registered origin. A self-hosted instance on its own domain stays
+// `cli`: nobody at the hub can reach its server.
+function projectHost(raw) {
+  const host = String(raw || '').trim().toLowerCase();
+  if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host)) return null;
+  if (/^\d+(\.\d+)+$/.test(host)) return null;
+  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
+  return host;
+}
+function hubHostedDoor({ hub, host }) {
+  const h = projectHost(host);
+  let origin = null;
+  let hubHost = null;
+  try { const u = new URL(String(hub)); if (/^https?:$/.test(u.protocol)) { origin = u.origin; hubHost = u.host.toLowerCase(); } } catch { /* no hub */ }
+  if (!h || !origin || h === hubHost || !h.endsWith(`.${hubHost}`)) return null;
+  return `${origin}/deploy?host=${encodeURIComponent(h)}`;
+}
+function updateDoor({ provisioning, idp, hubUpgradeUrl, hub = null, host = null }) {
   if (provisioning) return { kind: 'local', url: '/deploy' };
   const url = hubDeployUrl(idp)
-    || (typeof hubUpgradeUrl === 'string' && HUB_UPGRADE_URL_RE.test(hubUpgradeUrl.trim()) ? hubUpgradeUrl.trim() : null);
+    || (typeof hubUpgradeUrl === 'string' && HUB_UPGRADE_URL_RE.test(hubUpgradeUrl.trim()) ? hubUpgradeUrl.trim() : null)
+    || hubHostedDoor({ hub, host });
   return url ? { kind: 'hub', url } : { kind: 'cli', url: null };
 }
 
@@ -187,25 +211,15 @@ async function resolveChannel(selfChannel) {
   return { channel, source: channel ? 'deploy' : 'default' };
 }
 
-// "Ask for this upgrade" (task 1004595): what src/bongos/upgrade-request.js needs from
-// the outside world, resolved per request so a test can stand every piece in. The receipt
-// goes into the SAME store the public redeem route reads (routes/feedback.js).
-function defaultAskDeps() {
-  const ps = require('../project-settings');
-  const fb = require('./feedback');
-  return {
-    hub: fb.feedbackHub(),
-    host: configuredHost(),
-    getSetting: ps.getSetting,
-    setSetting: ps.setSetting,
-    issueReceipt: (r) => fb.defaultReceiptStore().issue(r),
-  };
+// The hub this project belongs to: the same answer the direct feedback door uses (null on the
+// hub itself, so the platform never points at itself).
+function safeHub() {
+  try { return require('./feedback').feedbackHub(); } catch { return null; }
 }
 
 // The host this project answers on, from its OWN branding pack (domains is server-only):
-// the origin the hub calls back to redeem the receipt. Never read from the request: a
-// Host or X-Forwarded-Host header is the caller's to write, and would let them point the
-// hub's call-back at any address they like. '' when the pack names none.
+// what decides whether the hub hosts it (hubHostedDoor). Never read from the request: a
+// Host or X-Forwarded-Host header is the caller's to write. '' when the pack names none.
 function configuredHost() {
   try {
     const d = require('../../branding').branding().domains || {};
@@ -213,18 +227,6 @@ function configuredHost() {
   } catch { return ''; }
 }
 
-// The page's ask state. Fail-soft: a stored row that cannot be read is "not asked yet",
-// never a 500 on the whole Software update panel.
-async function readAsk({ update, door, deps }) {
-  const offered = update && update.reading === 'ok' ? update.offered : null;
-  const base = { offered, host: upgradeRequest.projectHost(deps.host), doorKind: door.kind, hub: deps.hub };
-  let stored = null;
-  if (offered && upgradeRequest.isOperatorRun(base)) {
-    try { stored = upgradeRequest.parseStored(await deps.getSetting(upgradeRequest.SETTING_KEY)); } catch { stored = null; }
-  }
-  return upgradeRequest.askState({ ...base, stored });
-}
-
 // A core move this project's own ledger says was rolled back (task 1004730,
 // src/bongos/upgrade-hold.js): which version was tried, why in plain words, and that this
 // project is still on its old version and working. Both reads carry it, the Software update
@@ -270,16 +272,13 @@ function buildCoreUpdateRouter({
   upgrades = readCoreUpgrades,
   softwareUpdate = readSoftwareUpdate,
   canUpdate = holdsCorePin,
-  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl() }),
-  askDeps = defaultAskDeps,
+  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl(), hub: safeHub(), host: configuredHost() }),
   upgradeHold = readUpgradeHold,
   releaseNotes = readInstalledReleaseNotes,
   seenMove = defaultSeenMove,
 } = {}) {
   contributeCoreUpdateToDocket();
   const router = express.Router();
-  // One send at a time: a double press waits for the first and is answered from its row.
-  let asking = null;
 
   router.get(
     '/core-update',
@@ -341,53 +340,13 @@ function buildCoreUpdateRouter({
         resolveChannel(selfChannel).then(async ({ channel, source }) => ({ ...(await softwareUpdate({ running, channel, follow: followFor(door) })), channel_source: source })),
         canUpdate(req),
       ]);
-      const ask = await readAsk({ update, door, deps: askDeps() });
       const held = await safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.offered : null });
       // The history only for a viewer who holds core.pin.move (see safeMoved's gate note).
       const history = can === true ? await safeHistory(upgrades) : null;
-      res.json({ ok: true, update, door, can_update: can === true, ask, held, history });
+      res.json({ ok: true, update, door, can_update: can === true, held, history });
     }, { errorCode: 'software_update_failed', message: false }),
   );
 
-  // POST /software-update/request — "Ask for this upgrade" (task 1004595). On a project
-  // the hub's operator runs, sends one request for the version this project is offered
-  // to the operator, through the direct feedback door, and remembers it so the page can
-  // say it is pending. The version is the server's own reading, never the caller's.
-  // Idempotent per version; a different version waits out a 24h cooldown (429).
-  // rank: core.pin.move — the same atom as the Update button the panel draws.
-  router.post(
-    '/software-update/request',
-    auth.requireBuilder,
-    auth.requirePermission('core.pin.move'),
-    asyncHandler('POST /software-update/request', async (req, res) => {
-      while (asking) { try { await asking; } catch { /* the next one tries for itself */ } }
-      const run = (async () => {
-        let running = null;
-        try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-        const { channel } = await resolveChannel(selfChannel);
-        const door = updateDoor(doorInputs());
-        const update = await softwareUpdate({ running, channel, follow: followFor(door) });
-        const deps = askDeps();
-        return upgradeRequest.requestUpgrade({
-          host: deps.host,
-          running,
-          wanted: update && update.reading === 'ok' ? update.offered : null,
-          builder: req.builder,
-          doorKind: door.kind,
-        }, deps);
-      })();
-      asking = run;
-      let out;
-      try { out = await run; } finally { if (asking === run) asking = null; }
-      if (out.status >= 400) {
-        const { error, message, ...details } = out.body;
-        if (details.retry_after_seconds) res.set('Retry-After', String(details.retry_after_seconds));
-        return res.fail(error, { status: out.status, message, details });
-      }
-      res.status(out.status).json(out.body);
-    }, { errorCode: 'upgrade_request_failed', message: false }),
-  );
-
   // GET /project/manage-link — the hub's page for THIS project, where its owner takes it
   // offline or disconnects it (task 1004570). On a hosted project the owner is its Archon,
   // so the read is Archon-only: a builder below that is refused and the hall draws no
@@ -410,4 +369,5 @@ module.exports = buildCoreUpdateRouter;
 module.exports.hubManageLinks = hubManageLinks;
 module.exports.hubDeployUrl = hubDeployUrl;
 module.exports.updateDoor = updateDoor;
+module.exports.hubHostedDoor = hubHostedDoor;
 module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;

package/src/bongos/routes/feedback.js

@@ -78,8 +78,7 @@ function makeReceiptStore({ now = Date.now, ttlMs = RECEIPT_TTL_MS, max = RECEIP
 }
 
 // The process's one receipt store. Shared, because a receipt is redeemed at the public
-// route below whoever issued it: the CLI's POST /feedback/receipt, or this project's own
-// "Ask for this upgrade" (src/bongos/upgrade-request.js, task 1004595).
+// route below whoever issued it (the CLI's POST /feedback/receipt).
 let sharedStore = null;
 function defaultReceiptStore() {
   if (!sharedStore) sharedStore = makeReceiptStore();

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.56'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.58'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/deploy_handoff.mjs

@@ -85,7 +85,7 @@ afterEach(() => { for (const id of armed) clearTimeout(id); armed.clear(); });
 const settle = (ms = 0) => new Promise((r) => setTimeout(r, ms));
 const plain = (x) => JSON.parse(JSON.stringify(x));
 
-function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }] } = {}) {
+function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }], search = '?project=toast&handoff=1' } = {}) {
   const told = [];
   const requests = [];
   const listeners = {};
@@ -105,7 +105,7 @@ function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin })
   if (opener) opener.postMessage = (msg, origin) => told.push({ msg, origin });
   const windowObj = {
     OTB: realOTB(), document: documentObj, opener, __handoffHearMs: 30,
-    location: { protocol: 'https:', pathname: '/deploy', search: '?project=toast&handoff=1', assign() {} },
+    location: { protocol: 'https:', pathname: '/deploy', search, assign() {} },
     addEventListener: (ev, fn) => { (listeners[ev] ||= []).push(fn); },
     setTimeout: (fn, ms) => { const id = setTimeout(fn, ms); armed.add(id); return id; },
     close() { closed = true; },
@@ -150,6 +150,27 @@ test('the go from the project\'s own hall moves it to that version, says so, and
   assert.match(b.body.innerHTML, /The update has started/);
 });
 
+// task 1005128: a hosted project whose server never learned its slug sends ?host=<address>.
+test('?host= finds the project by its registered address, among the visitor\'s own, and moves it the same way', async () => {
+  const rows = [{ id: '9', slug: 'other', domain: 'other.cloudbongos.com' }, { id: '14', slug: 'toast', domain: 'Toast.CloudBongos.com' }];
+  const b = boot({ rows, search: '?host=toast.cloudbongos.com&handoff=1' });
+  await settle(5);
+  assert.deepEqual(plain(b.told), [{ msg: { tag: 'bongos-update', step: 'ready' }, origin: 'https://toast.cloudbongos.com' }]);
+  b.message(GO);
+  await settle(5);
+  assert.equal(b.posts().length, 1);
+  assert.equal(b.posts()[0].path, '/api/bongos/provisioning/instances/14/core-upgrade');
+
+  const none = boot({ rows, search: '?host=nobody.cloudbongos.com&handoff=1' });
+  await settle(5);
+  assert.equal(none.posts().length, 0);
+  assert.match(none.body.innerHTML, /No project called nobody\.cloudbongos\.com/);
+
+  const slugIsNotHost = boot({ rows, search: '?host=toast&handoff=1' });
+  await settle(5);
+  assert.equal(slugIsNotHost.told.length, 0, 'a bare slug in ?host= matches no address');
+});
+
 test('a go from another site, or another window, moves nothing', async () => {
   const b = boot();
   await settle(5);

package/tests/deploy_page_projects.mjs

@@ -34,14 +34,14 @@ const preview = (id, slug, over = {}) => ({
 
 // The fleet as the control plane really reports it: mostly torn down, a couple live.
 const FLEET = [
-  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'cloud-host' },
+  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'cloud-host', domain: 'mercury.cloudbongos.com' },
   { id: '32', slug: 'hoodify-finance', status: 'active', hosting_shape: 'co-tenant' },
   { id: '33', slug: 'walk-lantern', status: 'torn_down', hosting_shape: 'cloud-host' },
   { id: '34', slug: 'testccc', status: 'torn_down', hosting_shape: 'cloud-host' },
   { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'cloud-host' },
 ];
 
-function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null, href = null } = {}) {
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null, search = null, href = null } = {}) {
   const els = new Map();
   const posts = [];
   const gets = [];
@@ -99,7 +99,7 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
       sleep: (ms) => new Promise((r) => setTimeout(r, ms)) }, // dom-utils' OTB.sleep (task 1004893)
     // `search` is what decides which project the page is about. A stub without it is the
     // shape the page has to survive, and the default here keeps that path exercised.
-    location: { assign() {}, search: scope ? `?project=${encodeURIComponent(scope)}` : '', ...(href ? { href } : {}) },
+    location: { assign() {}, search: search != null ? search : (scope ? `?project=${encodeURIComponent(scope)}` : ''), ...(href ? { href } : {}) },
   };
   // The page's poll interval, driven rather than slept through. Injecting the REAL
   // setTimeout made every case whose preview never converges sit out the page's full
@@ -155,6 +155,38 @@ test('?project= renders THAT project, by slug, and still only one row', async ()
   assert.ok(!b.gets.includes('/provisioning/control-plane'), 'and the self row is not even read');
 });
 
+// task 1005128: a hosted project whose server never learned its slug sends its owner by address.
+test('?host= renders the project registered at THAT address, named by its slug, on its own id', async () => {
+  const b = boot({ search: '?host=Mercury.CloudBongos.com' });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /mercury/);
+  assert.doesNotMatch(html, /hoodify-finance/, 'no other project');
+  assert.ok(!b.gets.includes('/provisioning/control-plane'), 'the self row is not read');
+  b.els.get('dp-preview-31')._on.click();
+  b.els.get('dp-confirm-31')._on.click();
+  await b.settle();
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1);
+  assert.equal(moves[0].path, '/provisioning/instances/31/core-upgrade');
+});
+
+test('?host= matches only a registered address: a slug, or an address nobody registered, finds nothing', async () => {
+  for (const search of ['?host=mercury', '?host=nobody.cloudbongos.com', '?host=hoodify-finance']) {
+    const b = boot({ search });
+    await b.settle();
+    assert.match(b.panel(), /no project by that name is hosted here/, search);
+    assert.equal(b.posts.length, 0, search);
+  }
+});
+
+test('?project= wins over ?host= when both are given', async () => {
+  const b = boot({ search: '?project=hoodify-finance&host=mercury.cloudbongos.com' });
+  await b.settle();
+  assert.match(b.panel(), /hoodify-finance/);
+  assert.doesNotMatch(b.panel(), /mercury/);
+});
+
 test('a scoped project is offered its own move, on its own id', async () => {
   const b = boot({ scope: 'mercury' });
   await b.settle();

package/tests/design_counts_ratchet.mjs

@@ -0,0 +1,134 @@
+// tests/design_counts_ratchet.mjs — design counts that can only go down, and the
+// design generators wired into the fitness freshness gate (task 1005093, goal 1000138).
+//
+// Done when: adding a new hard-coded font-size to a hall sheet fails fitness, and
+// editing the shared token sheet without regenerating fails the freshness gate.
+// Both are proved here on the real tree: the first by scanning the real sheets with
+// one extra declaration, the second by running the gate on a copied tree.
+//
+// Run:  node --test tests/design_counts_ratchet.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const scan = require(path.join(ROOT, 'scripts', 'bongos', 'css-literal-scan.js'));
+const ratchets = require(path.join(ROOT, 'scripts', 'bongos', 'fitness-ratchets.js'));
+const fitness = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
+const { checkDesignGeneratorsFresh } = require(path.join(ROOT, 'scripts', 'bongos', 'design-generators-fresh.js'));
+
+const HALL_SHEET = 'modules/hall-ui/public/style.css';
+const readReal = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
+
+test('the detector counts typed-in values and leaves tokens alone', () => {
+  const c = scan.countSheet(`
+    :root { --ds-x: 14px; --tone: #123456; }            /* token definitions: not counted */
+    .a { font-size: 13px; border-radius: 6px; color: #abc; }
+    .b { font-size: var(--ds-text-sm); border-radius: var(--ds-radius-tile); color: var(--ink); }
+    .c { box-shadow: 0 2px 4px rgba(0, 0, 0, .2); }      /* a shadow; the black scrim is allowed */
+    .d { box-shadow: none; background: url("data:image/svg+xml;fill='#fff'"); }
+    .e { background: color-mix(in srgb, var(--ink) 40%, rgb(12 34 56)); padding: 0; }
+    @media (max-width: 720px) { .f { border-radius: 0; } }
+    @media (prefers-reduced-motion: reduce) { .g { transition: none; } }
+  `);
+  assert.deepEqual(c, { colours: 2, font_sizes: 1, radii: 1, shadows: 1, breakpoints: 1 });
+});
+
+test('a selector with a colon is not read as a declaration', () => {
+  assert.equal(scan.countSheet('a:hover, b:focus-visible { color: var(--ink); }').colours, 0);
+});
+
+test('the real tree matches its committed design-count baselines', () => {
+  const { sheets, scanned } = scan.scanCssLiterals();
+  assert.ok(scanned > 40, `the scan should see the live stylesheets (saw ${scanned})`);
+  const r = ratchets.checkQualityRatchets({ metrics: {}, designCounts: sheets });
+  assert.deepEqual(r.violations, [], 'design counts regressed against config/fitness-baselines.json');
+});
+
+test('a NEW hard-coded font-size in a hall sheet fails fitness', () => {
+  const { sheets } = scan.scanCssLiterals({
+    read: (f) => readReal(f) + (f === HALL_SHEET ? '\n.planted { font-size: 13px; }\n' : ''),
+  });
+  const r = ratchets.checkQualityRatchets({ metrics: {}, designCounts: sheets });
+  assert.equal(r.hardFail, true);
+  assert.ok(r.violations.some((v) => v.includes(`font_sizes in ${HALL_SHEET} regressed`)), r.violations.join('\n'));
+});
+
+test('a new sheet starts at zero: any typed-in colour in it fails', () => {
+  const d = ratchets.compareDesignCounts({ 'modules/x/public/new.css': { colours: 1 } }, { _comment: 'note' });
+  assert.equal(d.violations.length, 1);
+  assert.match(d.violations[0], /colours in modules\/x\/public\/new\.css regressed: 1 > baseline 0/);
+});
+
+test('a lower count nudges a ratchet-down and does not fail', () => {
+  const d = ratchets.compareDesignCounts({ 'a.css': { radii: 2 } }, { 'a.css': { radii: 3 } });
+  assert.deepEqual(d.violations, []);
+  assert.match(d.warnings[0], /ratchet-down available: design count radii in a\.css improved to 2/);
+});
+
+test('a baseline file with no design_counts fails closed', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'design-counts-'));
+  const file = path.join(dir, 'baselines.json');
+  fs.writeFileSync(file, JSON.stringify({ metrics: {} }));
+  try {
+    const r = ratchets.checkQualityRatchets({ baselinePath: file, metrics: {}, designCounts: {} });
+    assert.equal(r.hardFail, true);
+    assert.match(r.violations[0], /no "design_counts" object/);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// The generators resolve their sources from their own location, so a copy of the
+// files they read is a complete, isolated tree the gate can run against.
+const GENERATOR_SOURCES = [
+  'config/branding.neutral.json',
+  'config/design-tokens.neutral.json',
+  'modules/ui-design/public/tokens.css',
+  'modules/ui-design/public/brand.html',
+  'modules/ui-design/public/brand',
+  'modules/ui-design/scripts/gen-design-tokens.js',
+  'modules/ui-design/scripts/gen-design-reference.js',
+  'modules/hall-ui/public/style.css',
+  'modules/hall-ui/public/controls.css',
+  'modules/hall-ui/public/dom-utils.js',
+  'scripts/bongos/gen-brand.js',
+  'DESIGN.md',
+];
+
+function copiedTree() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'design-fresh-'));
+  for (const rel of GENERATOR_SOURCES) {
+    fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+    fs.cpSync(path.join(ROOT, rel), path.join(dir, rel), { recursive: true });
+  }
+  return dir;
+}
+
+test('the freshness gate passes on a fresh tree and fails when the token sheet changes without a regeneration', () => {
+  const dir = copiedTree();
+  try {
+    assert.deepEqual(checkDesignGeneratorsFresh(dir), [], 'the copied tree should start fresh');
+    const sheet = path.join(dir, 'modules/ui-design/public/tokens.css');
+    const before = fs.readFileSync(sheet, 'utf8');
+    const after = before.replace(/--ds-space-xs:\s*[^;]+;/, '--ds-space-xs: 11px;');
+    assert.notEqual(after, before, 'the token sheet should declare --ds-space-xs');
+    fs.writeFileSync(sheet, after);
+    const v = checkDesignGeneratorsFresh(dir);
+    assert.ok(v.some((x) => x.startsWith('config/design-tokens.neutral.json is STALE')), v.join('\n'));
+    assert.ok(v.some((x) => x.startsWith('modules/ui-design/public/brand.html')), v.join('\n'));
+    // …and the registered fitness check carries that verdict, so the build goes red.
+    assert.ok(fitness.CHECKS.includes(fitness.checkGeneratedArtifactsFresh));
+    const gate = fitness.checkGeneratedArtifactsFresh({ designRoot: dir });
+    assert.equal(gate.hardFail, true);
+    assert.ok(gate.violations.some((x) => x.startsWith('config/design-tokens.neutral.json is STALE')), gate.violations.join('\n'));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/provision_settings_apply.mjs

@@ -658,5 +658,57 @@ t('both tenant shapes get the hub door for THEIR slug; no other shape gets the k
   }
 });
 
+console.log('\nthe backfill — every core move writes the Update button\'s address (task 1005128):');
+
+t('a web.env with no line gets it; one already right is left alone; an empty file or a shape with no door is never patched', () => {
+  const saved = process.env.PROVISION_HUB_ORIGIN;
+  process.env.PROVISION_HUB_ORIGIN = 'https://hub.example.com';
+  try {
+    const U = require('../scripts/bongos/provision-units.js');
+    const key = `${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`;
+    const want = 'https://hub.example.com/deploy?project=toast';
+    const toast = { slug: 'toast', hosting_shape: 'cloud-host' };
+    const before = 'PORT=3011\nPGDATABASE=toast\n';
+    const after = U.hubUpgradeEnvPatch(before, toast);
+    assert.match(after, new RegExp(`^${key}=https://hub\\.example\\.com/deploy\\?project=toast$`, 'm'), 'the line is added');
+    assert.match(after, /^PORT=3011$/m, 'every other line kept');
+    assert.match(after, /^PGDATABASE=toast$/m);
+    assert.equal(U.hubUpgradeEnvPatch(after, toast), null, 'already right: nothing to write');
+    assert.match(U.hubUpgradeEnvPatch(`${before}${key}=\n`, toast), new RegExp(`^${key}=${want.replace(/[.?]/g, '\\$&')}$`, 'm'), 'an empty line is filled');
+    assert.equal(U.hubUpgradeEnvPatch('', toast), null, 'an empty file is never patched into a one-line body');
+    assert.equal(U.hubUpgradeEnvPatch(null, toast), null);
+    assert.equal(U.hubUpgradeEnvPatch(before, { slug: 'x', hosting_shape: 'byo-host' }), null, 'no door on this hub, nothing written');
+  } finally {
+    if (saved === undefined) delete process.env.PROVISION_HUB_ORIGIN; else process.env.PROVISION_HUB_ORIGIN = saved;
+  }
+});
+
+t('the move writes it before it runs, and a failed read or write never stops the move', () => {
+  const saved = process.env.PROVISION_HUB_ORIGIN;
+  process.env.PROVISION_HUB_ORIGIN = 'https://hub.example.com';
+  try {
+    const { backfillHubUpgradeUrl } = require('../scripts/bongos/provision-core-upgrade.js');
+    const toast = { slug: 'toast', hosting_shape: 'cloud-host' };
+    const writes = [];
+    const logs = [];
+    const deps = { privileged: true, log: (l) => logs.push(l), controlWriteFile: (p, body, o) => writes.push({ p, body, o }) };
+    const exec = (cmd) => (/cat .*web\.env$/.test(cmd) ? { stdout: 'PORT=3011\n' } : { stdout: '' });
+    assert.equal(backfillHubUpgradeUrl(toast, deps, exec), true);
+    assert.equal(writes.length, 1);
+    assert.match(writes[0].p, /toast\/web\.env$/);
+    assert.match(writes[0].body, /_HUB_UPGRADE_URL=https:\/\/hub\.example\.com\/deploy\?project=toast$/m);
+    assert.equal(writes[0].o.mode, 0o600);
+    assert.equal(backfillHubUpgradeUrl(toast, deps, () => ({ softFailed: true })), false, 'unreadable: nothing written');
+    const ran = [];
+    assert.equal(backfillHubUpgradeUrl({ slug: 'x; rm -rf /', hosting_shape: 'cloud-host' }, deps, (c) => { ran.push(c); return { stdout: 'PORT=1\n' }; }), false, 'a slug that is not a slug');
+    assert.deepEqual(ran, [], 'and no command is built from it');
+    assert.equal(backfillHubUpgradeUrl(toast, { ...deps, controlWriteFile: () => { throw new Error('EACCES'); } }, exec), false, 'a refused write is logged, not thrown');
+    assert.ok(logs.some((l) => /the move goes on/.test(l)));
+    assert.equal(writes.length, 1);
+  } finally {
+    if (saved === undefined) delete process.env.PROVISION_HUB_ORIGIN; else process.env.PROVISION_HUB_ORIGIN = saved;
+  }
+});
+
 console.log(`\nprovision_settings_apply: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/software_update.mjs

@@ -219,8 +219,7 @@ async function drive(deps) {
   const build = require('../src/bongos/routes/core-update.js');
   const express = require('express');
   const app = express();
-  // The ask state's stored row is the DB's; these tests never reach one (task 1004595).
-  app.use(build({ askDeps: () => ({ hub: 'https://cloudbongos.com', getSetting: async () => null }), ...deps }));
+  app.use(build({ ...deps }));
   auth.requireBuilder = saved;
   const server = app.listen(0);
   await new Promise((r) => server.once('listening', r));
@@ -261,6 +260,33 @@ test('HUB_UPGRADE_URL is taken only as a hub /deploy address; anything else stay
   }
 });
 
+// Task 1005128: toast predates HUB_UPGRADE_URL and federates no sign-in, so it fell to `cli`
+// and its owner was offered "Ask for this upgrade". A project on a name under its hub's own
+// domain is the hub's, so it goes to the hub's door by its address.
+test('a hosted project with neither address still gets the hub\'s door, by its own address (task 1005128)', async () => {
+  const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+    doorInputs: () => ({ provisioning: false, idp: null, hubUpgradeUrl: null, hub: 'https://cloudbongos.com', host: 'Toast.CloudBongos.com' }) });
+  assert.deepEqual(r.body.door, { kind: 'hub', url: 'https://cloudbongos.com/deploy?host=toast.cloudbongos.com' });
+  assert.equal('ask' in r.body, false, 'the panel is never told to offer an ask');
+});
+
+test('only a name under the hub\'s domain is the hub\'s: a self-hosted name, the hub itself, or no hub stays cli (task 1005128)', async () => {
+  const cases = [
+    { hub: 'https://cloudbongos.com', host: 'shop.example.org' },
+    { hub: 'https://cloudbongos.com', host: 'cloudbongos.com' },
+    { hub: 'https://cloudbongos.com', host: 'evilcloudbongos.com' },
+    { hub: null, host: 'toast.cloudbongos.com' },
+    { hub: 'https://cloudbongos.com', host: 'localhost' },
+    { hub: 'https://cloudbongos.com', host: '' },
+    { hub: 'javascript:alert(1)', host: 'toast.cloudbongos.com' },
+  ];
+  for (const c of cases) {
+    const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+      doorInputs: () => ({ provisioning: false, idp: null, ...c }) });
+    assert.deepEqual(r.body.door, { kind: 'cli', url: null }, JSON.stringify(c));
+  }
+});
+
 test('a self-hosted instance has no door to link, and says how it is upgraded instead', async () => {
   const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true, doorInputs: () => ({ provisioning: false, idp: null }) });
   assert.deepEqual(r.body.door, { kind: 'cli', url: null });
@@ -600,9 +626,13 @@ test('the route hands the reader the follow of the hall it serves: candidates on
   }
 });
 
-test('[source] the upgrade request asks with the same follow as the panel (task 1004593)', () => {
-  const seg = ROUTE_SRC.slice(ROUTE_SRC.indexOf("'/software-update/request'"), ROUTE_SRC.indexOf("'/project/manage-link'"));
-  assert.match(seg, /softwareUpdate\(\{ running, channel, follow: followFor\(door\) \}\)/, 'the version asked for is one the runner would take');
+test('[source] there is no "Ask for this upgrade" route or panel any more (task 1005128)', () => {
+  assert.equal(ROUTE_SRC.includes('/software-update/request'), false, 'the route is gone');
+  assert.equal(fs.existsSync(path.join(ROOT, 'src/bongos/upgrade-request.js')), false, 'and its module');
+  for (const f of ['modules/hall-ui/public/settings-software-update.js', 'modules/hall-ui/public/update-pill.js']) {
+    const src = fs.readFileSync(path.join(ROOT, f), 'utf8');
+    assert.equal(/software-update\/request|Ask for this/.test(src), false, f);
+  }
 });
 
 test('[source] the port the route reads is the port the provisioning module registers and declares (task 1004535)', () => {