@bongos/core 1.24.57 → 1.24.58

package/modules/hall-ui/public/settings-software-update.js

@@ -66,49 +66,12 @@
     </div>`;
   }
 
-  // "Ask for this upgrade" (task 1004595). A project the hub's operator runs cannot take an
-  // update itself, so instead of a dead end the page offers one press that reaches the people
-  // who run its server, and then says that it was asked. The server decides whether it is
-  // offered (`ask.available`) and remembers the request (`ask.requested`).
   function longDate(iso) {
     const d = new Date(iso);
     if (!Number.isFinite(d.getTime())) return null;
     try { return d.toLocaleDateString('en-GB', { day: 'numeric', month: 'long', year: 'numeric' }); } catch (e) { return d.toISOString().slice(0, 10); }
   }
 
-  // Asked, and still waiting: for this very version, or recently enough that asking again
-  // would only be refused.
-  function askPending(ask, offered) {
-    const r = ask && ask.requested;
-    if (!r) return false;
-    if (r.version === offered) return true;
-    const again = Date.parse(ask.ask_again_after);
-    return Number.isFinite(again) && Date.now() < again;
-  }
-
-  function askHtml(ask, offered, { lead }) {
-    const team = ask.hub_host ? `the team at ${escapeHtml(ask.hub_host)}` : 'the team that runs this project\'s server';
-    if (askPending(ask, offered)) {
-      const r = ask.requested;
-      const when = longDate(r.requested_at);
-      return `<div class="su-door su-ask">
-      <p class="panel-status panel-status--ok" role="status">Upgrade requested${when ? ` on ${escapeHtml(when)}` : ''}${r.by ? ` by @${escapeHtml(r.by)}` : ''}, for version ${mono(r.version)}. ${team.charAt(0).toUpperCase() + team.slice(1)} has your request. This page shows the new version once it is installed.</p>
-    </div>`;
-    }
-    const last = ask.requested && longDate(ask.requested.requested_at);
-    const before = last ? ` You last asked on ${escapeHtml(last)}, for ${mono(ask.requested.version)}.` : '';
-    const intro = lead
-      ? `<p class="panel-hint">This project runs on a server that ${team} looks after, so they install its updates. Ask them for this one and they are told which version you want.${before}</p>`
-      : `<p class="panel-hint">If that page does not let you in, ask ${team} to install it for you.${before}</p>`;
-    return `<div class="su-door su-ask">
-      ${intro}
-      <div class="row-end">
-        <button type="button" class="pbtn ${lead ? 'pbtn--save' : 'pbtn--quiet'}" id="su-ask">Ask for this upgrade</button>
-        <span class="panel-hint" id="su-ask-status" role="status"></span>
-      </div>
-    </div>`;
-  }
-
   // Where the Update button goes, and what it says it will do. Only a plain same-origin path
   // or an http(s) URL is ever put in an href; anything else draws no button.
   function doorHtml(data, offered) {
@@ -116,9 +79,9 @@
     if (!data.can_update) {
       return '<p class="panel-hint su-door">Only the people allowed to upgrade this project see an Update button here.</p>';
     }
-    const ask = data.ask || {};
+    // No request-the-upgrade button any more (task 1005128): a project the hub hosts always has
+    // the hub's door, so `cli` is only ever a server its owner runs themselves.
     if (door.kind === 'cli') {
-      if (ask.available) return askHtml(ask, offered, { lead: true });
       return '<p class="panel-hint su-door">This project is upgraded on the server that runs it: <code>bongos upgrade</code> there takes this version, with the same health check and rollback.</p>';
     }
     const url = String(door.url || '');
@@ -134,7 +97,7 @@
     return `<div class="row-end su-door">
       <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}</a>
       <span class="panel-hint">Takes a few minutes. The project restarts once, checks itself, and goes back to the version it runs now if it does not come back healthy.${where ? ` A small window from ${escapeHtml(where)} opens for a moment to start it.` : ''}</span>
-    </div>${door.kind === 'hub' && ask.available ? askHtml(ask, offered, { lead: false }) : ''}`;
+    </div>`;
   }
 
   // One entry: its text, and — only in the hall whose ledger the ids belong to, which is
@@ -223,8 +186,7 @@
       html += row('Newest for this project', `${mono(u.running)} — this project is up to date.`, '<span class="su-pill su-pill--ok">Up to date</span>');
     } else {
       const when = ago(u.offered_published_at);
-      const pending = data.can_update && data.ask && data.ask.available && askPending(data.ask, u.offered);
-      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, `<span class="su-pill">${onHold ? 'On hold' : pending ? 'Requested' : 'Update ready'}</span>`);
+      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, `<span class="su-pill">${onHold ? 'On hold' : 'Update ready'}</span>`);
       // No button to take again the very version that was just rolled back here (task 1004730).
       if (!onHold) html += doorHtml(data, u.offered);
       html += whatsNewHtml(u.whats_new, (data.door || {}).kind === 'local');
@@ -237,9 +199,6 @@
     body.innerHTML = html + historyHtml(data.history);
     if (note) note.textContent = notes.join(' ');
 
-    const askBtn = byId('su-ask');
-    if (askBtn) askBtn.addEventListener('click', () => askForUpgrade(data, askBtn));
-
     // The same press as the pill's Update now; only when it took the update in place is the
     // link's own navigation stopped.
     const updateBtn = byId('su-update');
@@ -259,32 +218,6 @@
     }
   }
 
-  // One press: the server sends the request and remembers it; the panel redraws from its
-  // answer. "Asked recently" carries the stored request, so it redraws as pending too.
-  async function askForUpgrade(data, btn) {
-    const status = byId('su-ask-status');
-    btn.disabled = true;
-    btn.textContent = 'Asking…';
-    if (status) status.textContent = '';
-    try {
-      const res = await api.request('POST', `${API}/software-update/request`, { body: {} });
-      const err = (res.data && res.data.error) || {};
-      const request = (res.data && res.data.request) || (err.details && err.details.request);
-      if ((res.ok || res.status === 429) && request) {
-        const again = new Date(Date.parse(request.requested_at) + 24 * 3600 * 1000).toISOString();
-        render({ ...data, ask: { ...data.ask, requested: request, ask_again_after: again } });
-        return;
-      }
-      // Every refusal the server sends carries a sentence; a bare code is only ever a
-      // proxy or a crash, so the status stands in for it.
-      throw new Error(err.message && err.message !== err.code ? err.message : `HTTP ${res.status}`);
-    } catch (e) {
-      btn.disabled = false;
-      btn.textContent = 'Ask for this upgrade';
-      if (status) status.textContent = `Could not send the request: ${String(e.message || 'unknown error').replace(/\.$/, '')}.`;
-    }
-  }
-
   async function load() {
     if (asked) return;
     asked = true;

package/modules/hall-ui/public/update-pill.js

@@ -23,7 +23,6 @@
 //          with &handoff=1, this page tells it the version over postMessage, and the hub
 //          posts the move with the owner's OWN hub session (deploy-handoff.js). This
 //          project's server gains no capability; the only thing that crosses is a version.
-//   ask    a hosted project the hub's operator runs: "Ask for this update" (task 1004595).
 //   cli    a self-hosted instance: no button; the card names the command.
 //
 // PROGRESS IS READ, NEVER GUESSED (deploy.js's rule). The page watches its own public
@@ -41,9 +40,10 @@
   var RUN_KEY = 'bongos.update.run';
   var MSG = 'bongos-update'; // the tag deploy-handoff.js answers to; both sides check it
   var VERSION_RE = /^\d+\.\d+\.\d+$/;
-  // A hub door as the server words it (core-update.js HUB_UPGRADE_URL_RE's shape): an
-  // origin and /deploy?project=<slug>, nothing else. Anything else draws no button.
-  var HUB_DOOR_RE = /^(https?:\/\/[^\s"'<>/]+)\/deploy\?project=[A-Za-z0-9._%-]+$/;
+  // A hub door as the server words it (core-update.js updateDoor): an origin and
+  // /deploy?project=<slug>, or /deploy?host=<address> for a hosted project whose server never
+  // learned its slug (task 1005128). Anything else draws no button.
+  var HUB_DOOR_RE = /^(https?:\/\/[^\s"'<>/]+)\/deploy\?(?:project|host)=[A-Za-z0-9._%-]+$/;
   var SETTINGS_HREF = '/settings#software-update';
   var HIGHLIGHTS = 3;
   var LINE_MAX = 120;
@@ -101,14 +101,13 @@
   function doorPlan(sw) {
     if (!sw || sw.can_update !== true) return { kind: 'none' };
     var door = sw.door || {};
-    var ask = sw.ask || {};
     if (door.kind === 'local' && door.url === '/deploy') return { kind: 'local' };
     if (door.kind === 'hub') {
       var m = HUB_DOOR_RE.exec(String(door.url || ''));
-      if (!m) return ask.available ? { kind: 'ask' } : { kind: 'none' };
+      if (!m) return { kind: 'none' };
       return { kind: 'hub', url: door.url, origin: m[1] };
     }
-    if (door.kind === 'cli') return ask.available ? { kind: 'ask' } : { kind: 'cli' };
+    if (door.kind === 'cli') return { kind: 'cli' };
     return { kind: 'none' };
   }
 
@@ -263,13 +262,6 @@
       note = '<p class="upd-card__note">Takes a few minutes. The project restarts once, and goes back to the version it runs now on its own if the new one is not healthy.' +
         (host ? ' A small window from ' + esc(host) + ' opens for a moment to start it.' : '') + '</p>';
       action = '<button type="button" class="upd-btn upd-btn--go" id="upd-go">Update now</button>';
-    } else if (plan.kind === 'ask') {
-      var ask = state.sw.ask || {};
-      var team = ask.hub_host ? 'the team at ' + ask.hub_host : 'the team that runs this project\'s server';
-      var asked = ask.requested && ask.requested.version === state.offered;
-      note = '<p class="upd-card__note">' + esc(asked ? 'You asked ' + team + ' for this update. This shows the new version once it is installed.'
-        : 'This project runs on a server that ' + team + ' looks after, so they install its updates.') + '</p>';
-      if (!asked) action = '<button type="button" class="upd-btn upd-btn--go" id="upd-ask">Ask for this update</button>';
     } else if (plan.kind === 'cli') {
       note = '<p class="upd-card__note">This project is updated on the server that runs it: <code>bongos upgrade</code> there takes this version, and puts the old one back if it fails.</p>';
     } else {
@@ -294,7 +286,6 @@
     var on = function (id, fn) { var el = c.querySelector('#' + id); if (el) el.addEventListener('click', fn); };
     on('upd-close', closeCard);
     on('upd-go', function () { updateNow(); });
-    on('upd-ask', function (e) { askForIt(e.currentTarget); });
     on('upd-reload', reload);
     on('upd-open', function () { updateNow(); });
   }
@@ -565,22 +556,6 @@
     if (root.location && root.location.reload) root.location.reload();
   }
 
-  // "Ask for this update" (task 1004595): one press reaches the people who run the server.
-  function askForIt(btn) {
-    btn.disabled = true;
-    btn.textContent = 'Asking…';
-    state.api.request('POST', '/api/bongos/software-update/request', { body: {} }).then(function (res) {
-      var data = (res && res.data) || {};
-      var request = data.request || (data.error && data.error.details && data.error.details.request);
-      if (!((res.ok || res.status === 429) && request)) throw new Error(errorOf(res, 'Could not send the request.'));
-      state.sw.ask = Object.assign({}, state.sw.ask, { requested: request });
-      drawCard();
-    }).then(null, function (e) {
-      state.error = String((e && e.message) || 'Could not send the request.');
-      drawCard();
-    });
-  }
-
   /** shell.js hands over GET /core-update's answer; the pill decides what, if anything, to show. */
   function mount(data, opts) {
     state.api = opts && opts.api;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.57",
+  "version": "1.24.58",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.57",
+      "version": "1.24.58",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.57",
+  "version": "1.24.58",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11313,5 +11313,11 @@
       "id": "1005093",
       "text": "Stylesheets can no longer gain new typed-in colours, text sizes, corners, shadows or breakpoints without the build failing, and the public design reference must be regenerated whenever its sources change."
     }
+  ],
+  "1.24.58": [
+    {
+      "id": "1005128",
+      "text": "A project's owner now takes a new Bongos version with one Update button; the \"ask the team for this upgrade\" step is gone for every hosted project."
+    }
   ]
 }

package/scripts/bongos/provision-core-upgrade.js

@@ -338,6 +338,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     log(`  ✓ would then read ${versionUrl} on the box and require it to say ${to}`);
     return { ok: true, served: null, preflight: verdict };
   }
+  backfillHubUpgradeUrl(inst, deps, boxExec);
   try {
     log(`  [upgrade] (in ${runDir}) ${cmd}`);
     boxExec(cmd, { cwd: runDir });
@@ -672,6 +673,34 @@ function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
 // HERE rather than left to instanceUser()'s own throw: that throw is correct today, but
 // a call site whose safety depends on a helper's internals is one refactor away from a
 // shell-injection path (and the apply leg's own guard sits at the route, not here).
+// WHERE THIS PROJECT'S UPDATE BUTTON GOES, written on every move (task 1005128): a project
+// provisioned before task 1004608 has no <PREFIX>_HUB_UPGRADE_URL line, and only a
+// settings-apply ever wrote one. The move restarts the service, so the line is read the moment
+// the new core comes up. BEST-EFFORT: it is written before the move and never decides it; an
+// unreadable file, a refused write or a line already right changes nothing and fails nothing.
+function backfillHubUpgradeUrl(inst, deps, boxExec) {
+  // The slug is interpolated into a shell command below, so it is checked HERE, at the point
+  // of use, not trusted to a caller that validated it earlier (the rule coreUpgradeInstance
+  // states for its own command).
+  if (!inst || !isValidSlug(inst.slug)) return false;
+  try {
+    const { hubUpgradeEnvPatch, webEnvPath } = require('./provision-units.js'); // eslint-disable-line global-require
+    const sudoP = deps.privileged ? 'sudo ' : '';
+    const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
+    if (!read || read.softFailed) return false;
+    const next = hubUpgradeEnvPatch(read.stdout, inst);
+    if (!next) return false;
+    const write = inst.hosting_shape === 'cloud-host' ? (deps.controlWriteFile || deps.writeFile) : deps.writeFile;
+    if (typeof write !== 'function') return false;
+    write(webEnvPath(inst), next, { mode: 0o600, sudo: true });
+    deps.log('  [config] wrote where this project\'s Update button goes into web.env (read on restart)');
+    return true;
+  } catch (e) {
+    deps.log(`  [config] could not write the Update button's address (${(e && e.message) || e}); the move goes on`);
+    return false;
+  }
+}
+
 function upgradeInvocation(inst, to, { privileged = false, dryRun = false, requestedBy = '', automatic = false, selfRoot = selfInstanceRoot, runAs = null, migrateAs = null } = {}) {
   if (!isValidSlug(inst && inst.slug)) {
     throw new Error(`upgradeInvocation: refusing to build a shell command from an invalid slug ${JSON.stringify(inst && inst.slug)}`);
@@ -1164,4 +1193,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { pushUpgradePin, UPGRADE_SHAPES, instanceChannel, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { pushUpgradePin, UPGRADE_SHAPES, instanceChannel, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, backfillHubUpgradeUrl, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/bongos/provision-units.js

@@ -447,9 +447,27 @@ function hubUpgradeEnvVarsFor(inst) {
   return { [`${provisionedEnvPrefix()}_HUB_UPGRADE_URL`]: origin ? `${origin}/deploy?project=${encodeURIComponent(String(inst.slug))}` : '' };
 }
 
+// THE BACKFILL (task 1005128). Only a settings-apply wrote that line, and one runs only when a
+// setting changes, so a project provisioned before task 1004608 (toast) never got it and its
+// owner was offered "Ask for this upgrade" instead of the Update button. Every core move now
+// carries the line too: the web.env as it stands, with that ONE line set, or null when it is
+// already right, there is nothing to write, or the file is empty (a missing file is never
+// "patched" into a one-line body). PURE; the core-upgrade leg does the read and the write.
+function hubUpgradeEnvPatch(body, inst) {
+  const vars = hubUpgradeEnvVarsFor(inst);
+  const [key] = Object.keys(vars);
+  const text = String(body == null ? '' : body);
+  if (!key || !vars[key] || !text.trim()) return null;
+  const esc = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const have = new RegExp(`^${esc}=(.*)$`, 'm').exec(text);
+  if (have && have[1].trim() === vars[key]) return null;
+  return upsertEnvVars(text, vars);
+}
+
 module.exports = {
   federationHubOrigin,
   hubUpgradeEnvVarsFor,
+  hubUpgradeEnvPatch,
   ENV_PREFIX_PACK,
   envPrefixMismatch,
   normalizePackEnvPrefix,

package/scripts/hall-preview/server.js

@@ -208,9 +208,6 @@ const CANNED_WRITES = [
   // a vote cast from the street's matter card (task 1004528), so the card's
   // answer (the toast, the building lighting) renders here too.
   ['POST', /^government\/board\/items\/\d+\/votes$/, 'government__board__items__votes.post'],
-  // Settings → Software update's "Ask for this upgrade" (task 1004595), so the
-  // pending line the panel draws after the press renders here too.
-  ['POST', /^software-update\/request$/, 'software-update__request.post'],
   // the studio's AI pages (task 1004921): a file uploads, a request is sent
   // (it answers as 1002, the running one), and money is added.
   ['POST', /^ai-studio\/uploads$/, 'ai-studio__uploads.post'],

package/src/bongos/routes/core-update.js

@@ -34,7 +34,6 @@ const { readSoftwareUpdate } = require('../software-update');
 const { followForShape } = require('../../../scripts/bongos/update-channel.js');
 const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
-const upgradeRequest = require('../upgrade-request');
 const { readUpgradeHold } = require('../upgrade-hold');
 const { moveNotice, moveHistory, readInstalledReleaseNotes } = require('../core-moves');
 
@@ -82,10 +81,35 @@ function hubManageLinks(config) {
 // address as <PREFIX>_HUB_UPGRADE_URL (task 1004608). Without it, those owners were told to
 // run `bongos upgrade` on a server the platform runs. Only the hub's /deploy path is taken.
 const HUB_UPGRADE_URL_RE = /^https?:\/\/[^\s"'<>/]+\/deploy\?project=[A-Za-z0-9._%-]+$/;
-function updateDoor({ provisioning, idp, hubUpgradeUrl }) {
+// THE LAST FALLBACK (task 1005128). A hosted project whose web.env predates the line above
+// (toast, 2026-11) named neither, fell to `cli`, and its owner was offered "Ask for this
+// upgrade" instead of the Update button — the owner: "if the update is generally available
+// then they should be able to download it". So a project that answers on a name under its
+// hub's own domain (the hub's rule for "a project we host") is sent to that hub's door by its
+// address instead of its slug: `<hub>/deploy?host=<host>`. The hub resolves the address among
+// the visitor's OWN projects, exactly as it resolves a slug, and the hand-off still only
+// accepts the project's registered origin. A self-hosted instance on its own domain stays
+// `cli`: nobody at the hub can reach its server.
+function projectHost(raw) {
+  const host = String(raw || '').trim().toLowerCase();
+  if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host)) return null;
+  if (/^\d+(\.\d+)+$/.test(host)) return null;
+  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
+  return host;
+}
+function hubHostedDoor({ hub, host }) {
+  const h = projectHost(host);
+  let origin = null;
+  let hubHost = null;
+  try { const u = new URL(String(hub)); if (/^https?:$/.test(u.protocol)) { origin = u.origin; hubHost = u.host.toLowerCase(); } } catch { /* no hub */ }
+  if (!h || !origin || h === hubHost || !h.endsWith(`.${hubHost}`)) return null;
+  return `${origin}/deploy?host=${encodeURIComponent(h)}`;
+}
+function updateDoor({ provisioning, idp, hubUpgradeUrl, hub = null, host = null }) {
   if (provisioning) return { kind: 'local', url: '/deploy' };
   const url = hubDeployUrl(idp)
-    || (typeof hubUpgradeUrl === 'string' && HUB_UPGRADE_URL_RE.test(hubUpgradeUrl.trim()) ? hubUpgradeUrl.trim() : null);
+    || (typeof hubUpgradeUrl === 'string' && HUB_UPGRADE_URL_RE.test(hubUpgradeUrl.trim()) ? hubUpgradeUrl.trim() : null)
+    || hubHostedDoor({ hub, host });
   return url ? { kind: 'hub', url } : { kind: 'cli', url: null };
 }
 
@@ -187,25 +211,15 @@ async function resolveChannel(selfChannel) {
   return { channel, source: channel ? 'deploy' : 'default' };
 }
 
-// "Ask for this upgrade" (task 1004595): what src/bongos/upgrade-request.js needs from
-// the outside world, resolved per request so a test can stand every piece in. The receipt
-// goes into the SAME store the public redeem route reads (routes/feedback.js).
-function defaultAskDeps() {
-  const ps = require('../project-settings');
-  const fb = require('./feedback');
-  return {
-    hub: fb.feedbackHub(),
-    host: configuredHost(),
-    getSetting: ps.getSetting,
-    setSetting: ps.setSetting,
-    issueReceipt: (r) => fb.defaultReceiptStore().issue(r),
-  };
+// The hub this project belongs to: the same answer the direct feedback door uses (null on the
+// hub itself, so the platform never points at itself).
+function safeHub() {
+  try { return require('./feedback').feedbackHub(); } catch { return null; }
 }
 
 // The host this project answers on, from its OWN branding pack (domains is server-only):
-// the origin the hub calls back to redeem the receipt. Never read from the request: a
-// Host or X-Forwarded-Host header is the caller's to write, and would let them point the
-// hub's call-back at any address they like. '' when the pack names none.
+// what decides whether the hub hosts it (hubHostedDoor). Never read from the request: a
+// Host or X-Forwarded-Host header is the caller's to write. '' when the pack names none.
 function configuredHost() {
   try {
     const d = require('../../branding').branding().domains || {};
@@ -213,18 +227,6 @@ function configuredHost() {
   } catch { return ''; }
 }
 
-// The page's ask state. Fail-soft: a stored row that cannot be read is "not asked yet",
-// never a 500 on the whole Software update panel.
-async function readAsk({ update, door, deps }) {
-  const offered = update && update.reading === 'ok' ? update.offered : null;
-  const base = { offered, host: upgradeRequest.projectHost(deps.host), doorKind: door.kind, hub: deps.hub };
-  let stored = null;
-  if (offered && upgradeRequest.isOperatorRun(base)) {
-    try { stored = upgradeRequest.parseStored(await deps.getSetting(upgradeRequest.SETTING_KEY)); } catch { stored = null; }
-  }
-  return upgradeRequest.askState({ ...base, stored });
-}
-
 // A core move this project's own ledger says was rolled back (task 1004730,
 // src/bongos/upgrade-hold.js): which version was tried, why in plain words, and that this
 // project is still on its old version and working. Both reads carry it, the Software update
@@ -270,16 +272,13 @@ function buildCoreUpdateRouter({
   upgrades = readCoreUpgrades,
   softwareUpdate = readSoftwareUpdate,
   canUpdate = holdsCorePin,
-  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl() }),
-  askDeps = defaultAskDeps,
+  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig(), hubUpgradeUrl: safeHubUpgradeUrl(), hub: safeHub(), host: configuredHost() }),
   upgradeHold = readUpgradeHold,
   releaseNotes = readInstalledReleaseNotes,
   seenMove = defaultSeenMove,
 } = {}) {
   contributeCoreUpdateToDocket();
   const router = express.Router();
-  // One send at a time: a double press waits for the first and is answered from its row.
-  let asking = null;
 
   router.get(
     '/core-update',
@@ -341,53 +340,13 @@ function buildCoreUpdateRouter({
         resolveChannel(selfChannel).then(async ({ channel, source }) => ({ ...(await softwareUpdate({ running, channel, follow: followFor(door) })), channel_source: source })),
         canUpdate(req),
       ]);
-      const ask = await readAsk({ update, door, deps: askDeps() });
       const held = await safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.offered : null });
       // The history only for a viewer who holds core.pin.move (see safeMoved's gate note).
       const history = can === true ? await safeHistory(upgrades) : null;
-      res.json({ ok: true, update, door, can_update: can === true, ask, held, history });
+      res.json({ ok: true, update, door, can_update: can === true, held, history });
     }, { errorCode: 'software_update_failed', message: false }),
   );
 
-  // POST /software-update/request — "Ask for this upgrade" (task 1004595). On a project
-  // the hub's operator runs, sends one request for the version this project is offered
-  // to the operator, through the direct feedback door, and remembers it so the page can
-  // say it is pending. The version is the server's own reading, never the caller's.
-  // Idempotent per version; a different version waits out a 24h cooldown (429).
-  // rank: core.pin.move — the same atom as the Update button the panel draws.
-  router.post(
-    '/software-update/request',
-    auth.requireBuilder,
-    auth.requirePermission('core.pin.move'),
-    asyncHandler('POST /software-update/request', async (req, res) => {
-      while (asking) { try { await asking; } catch { /* the next one tries for itself */ } }
-      const run = (async () => {
-        let running = null;
-        try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-        const { channel } = await resolveChannel(selfChannel);
-        const door = updateDoor(doorInputs());
-        const update = await softwareUpdate({ running, channel, follow: followFor(door) });
-        const deps = askDeps();
-        return upgradeRequest.requestUpgrade({
-          host: deps.host,
-          running,
-          wanted: update && update.reading === 'ok' ? update.offered : null,
-          builder: req.builder,
-          doorKind: door.kind,
-        }, deps);
-      })();
-      asking = run;
-      let out;
-      try { out = await run; } finally { if (asking === run) asking = null; }
-      if (out.status >= 400) {
-        const { error, message, ...details } = out.body;
-        if (details.retry_after_seconds) res.set('Retry-After', String(details.retry_after_seconds));
-        return res.fail(error, { status: out.status, message, details });
-      }
-      res.status(out.status).json(out.body);
-    }, { errorCode: 'upgrade_request_failed', message: false }),
-  );
-
   // GET /project/manage-link — the hub's page for THIS project, where its owner takes it
   // offline or disconnects it (task 1004570). On a hosted project the owner is its Archon,
   // so the read is Archon-only: a builder below that is refused and the hall draws no
@@ -410,4 +369,5 @@ module.exports = buildCoreUpdateRouter;
 module.exports.hubManageLinks = hubManageLinks;
 module.exports.hubDeployUrl = hubDeployUrl;
 module.exports.updateDoor = updateDoor;
+module.exports.hubHostedDoor = hubHostedDoor;
 module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;

package/src/bongos/routes/feedback.js

@@ -78,8 +78,7 @@ function makeReceiptStore({ now = Date.now, ttlMs = RECEIPT_TTL_MS, max = RECEIP
 }
 
 // The process's one receipt store. Shared, because a receipt is redeemed at the public
-// route below whoever issued it: the CLI's POST /feedback/receipt, or this project's own
-// "Ask for this upgrade" (src/bongos/upgrade-request.js, task 1004595).
+// route below whoever issued it (the CLI's POST /feedback/receipt).
 let sharedStore = null;
 function defaultReceiptStore() {
   if (!sharedStore) sharedStore = makeReceiptStore();

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.57'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.58'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/deploy_handoff.mjs

@@ -85,7 +85,7 @@ afterEach(() => { for (const id of armed) clearTimeout(id); armed.clear(); });
 const settle = (ms = 0) => new Promise((r) => setTimeout(r, ms));
 const plain = (x) => JSON.parse(JSON.stringify(x));
 
-function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }] } = {}) {
+function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }], search = '?project=toast&handoff=1' } = {}) {
   const told = [];
   const requests = [];
   const listeners = {};
@@ -105,7 +105,7 @@ function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin })
   if (opener) opener.postMessage = (msg, origin) => told.push({ msg, origin });
   const windowObj = {
     OTB: realOTB(), document: documentObj, opener, __handoffHearMs: 30,
-    location: { protocol: 'https:', pathname: '/deploy', search: '?project=toast&handoff=1', assign() {} },
+    location: { protocol: 'https:', pathname: '/deploy', search, assign() {} },
     addEventListener: (ev, fn) => { (listeners[ev] ||= []).push(fn); },
     setTimeout: (fn, ms) => { const id = setTimeout(fn, ms); armed.add(id); return id; },
     close() { closed = true; },
@@ -150,6 +150,27 @@ test('the go from the project\'s own hall moves it to that version, says so, and
   assert.match(b.body.innerHTML, /The update has started/);
 });
 
+// task 1005128: a hosted project whose server never learned its slug sends ?host=<address>.
+test('?host= finds the project by its registered address, among the visitor\'s own, and moves it the same way', async () => {
+  const rows = [{ id: '9', slug: 'other', domain: 'other.cloudbongos.com' }, { id: '14', slug: 'toast', domain: 'Toast.CloudBongos.com' }];
+  const b = boot({ rows, search: '?host=toast.cloudbongos.com&handoff=1' });
+  await settle(5);
+  assert.deepEqual(plain(b.told), [{ msg: { tag: 'bongos-update', step: 'ready' }, origin: 'https://toast.cloudbongos.com' }]);
+  b.message(GO);
+  await settle(5);
+  assert.equal(b.posts().length, 1);
+  assert.equal(b.posts()[0].path, '/api/bongos/provisioning/instances/14/core-upgrade');
+
+  const none = boot({ rows, search: '?host=nobody.cloudbongos.com&handoff=1' });
+  await settle(5);
+  assert.equal(none.posts().length, 0);
+  assert.match(none.body.innerHTML, /No project called nobody\.cloudbongos\.com/);
+
+  const slugIsNotHost = boot({ rows, search: '?host=toast&handoff=1' });
+  await settle(5);
+  assert.equal(slugIsNotHost.told.length, 0, 'a bare slug in ?host= matches no address');
+});
+
 test('a go from another site, or another window, moves nothing', async () => {
   const b = boot();
   await settle(5);